Ticket #10729: iwn.patch

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwn.c

@@ -72 +72 @@
 #include <dev/iwn/if_iwnreg.h>
 #include <dev/iwn/if_iwnvar.h>
 
+struct iwn_ident {
+    uint16_t    vendor;
+    uint16_t    device;
+    const char  *name;
+};
+
+static const struct iwn_ident iwn_ident_table[] = {
+    { 0x8086, 0x0082, "Intel Centrino Advanced-N 6205"      },
+    { 0x8086, 0x0083, "Intel Centrino Wireless-N 1000"      },
+    { 0x8086, 0x0084, "Intel Centrino Wireless-N 1000"      },
+    { 0x8086, 0x0085, "Intel Centrino Advanced-N 6205"      },
+    { 0x8086, 0x0087, "Intel Centrino Advanced-N + WiMAX 6250"  },
+    { 0x8086, 0x0089, "Intel Centrino Advanced-N + WiMAX 6250"  },
+    { 0x8086, 0x008a, "Intel Centrino Wireless-N 1030"      },
+    { 0x8086, 0x008b, "Intel Centrino Wireless-N 1030"      },
+    { 0x8086, 0x0090, "Intel Centrino Advanced-N 6230"      },
+    { 0x8086, 0x0091, "Intel Centrino Advanced-N 6230"      },
+    { 0x8086, 0x0885, "Intel Centrino Wireless-N + WiMAX 6150"  },
+    { 0x8086, 0x0886, "Intel Centrino Wireless-N + WiMAX 6150"  },
+    { 0x8086, 0x0896, "Intel Centrino Wireless-N 130"       },
+    { 0x8086, 0x0887, "Intel Centrino Wireless-N 130"       },
+    { 0x8086, 0x08ae, "Intel Centrino Wireless-N 100"       },
+    { 0x8086, 0x08af, "Intel Centrino Wireless-N 100"       },
+    { 0x8086, 0x4229, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, 0x422b, "Intel Centrino Ultimate-N 6300"      },
+    { 0x8086, 0x422c, "Intel Centrino Advanced-N 6200"      },
+    { 0x8086, 0x422d, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, 0x4230, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, 0x4232, "Intel WiFi Link 5100"            },
+    { 0x8086, 0x4233, "Intel Wireless WiFi Link 4965"       },
+    { 0x8086, 0x4235, "Intel Ultimate N WiFi Link 5300"     },
+    { 0x8086, 0x4236, "Intel Ultimate N WiFi Link 5300"     },
+    { 0x8086, 0x4237, "Intel WiFi Link 5100"            },
+    { 0x8086, 0x4238, "Intel Centrino Ultimate-N 6300"      },
+    { 0x8086, 0x4239, "Intel Centrino Advanced-N 6200"      },
+    { 0x8086, 0x423a, "Intel WiMAX/WiFi Link 5350"          },
+    { 0x8086, 0x423b, "Intel WiMAX/WiFi Link 5350"          },
+    { 0x8086, 0x423c, "Intel WiMAX/WiFi Link 5150"          },
+    { 0x8086, 0x423d, "Intel WiMAX/WiFi Link 5150"          },
+    { 0, 0, NULL }
+};
+
 static int  iwn_probe(device_t);
 static int  iwn_attach(device_t);
-static const struct iwn_hal *iwn_hal_attach(struct iwn_softc *);
+static int  iwn4965_attach(struct iwn_softc *, uint16_t);
+static int  iwn5000_attach(struct iwn_softc *, uint16_t);
 static void iwn_radiotap_attach(struct iwn_softc *);
+static void iwn_sysctlattach(struct iwn_softc *);
 static struct ieee80211vap *iwn_vap_create(struct ieee80211com *,
-            const char name[IFNAMSIZ], int unit, int opmode,
+            const char name[IFNAMSIZ], int unit, enum ieee80211_opmode opmode,
             int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
             const uint8_t mac[IEEE80211_ADDR_LEN]);
 static void iwn_vap_delete(struct ieee80211vap *);
-static int  iwn_cleanup(device_t);
 static int  iwn_detach(device_t);
+static int  iwn_shutdown(device_t);
+static int  iwn_suspend(device_t);
+static int  iwn_resume(device_t);
 static int  iwn_nic_lock(struct iwn_softc *);
 static int  iwn_eeprom_lock(struct iwn_softc *);
 static int  iwn_init_otprom(struct iwn_softc *);
 static int  iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
 static void iwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 static int  iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
-            void **, bus_size_t, bus_size_t, int);
+            void **, bus_size_t, bus_size_t);
 static void iwn_dma_contig_free(struct iwn_dma_info *);
 static int  iwn_alloc_sched(struct iwn_softc *);
 static void iwn_free_sched(struct iwn_softc *);
@@ -117 +163 @@
 #if 0   /* HT */
 static void iwn_read_eeprom_ht40(struct iwn_softc *, int);
 #endif
-static void iwn_read_eeprom_channels(struct iwn_softc *, int,
-            uint32_t);
+static void iwn_read_eeprom_channels(struct iwn_softc *, int, uint32_t);
+static struct iwn_eeprom_chan *iwn_find_eeprom_channel(struct iwn_softc *,
+            struct ieee80211_channel *);
+static int  iwn_setregdomain(struct ieee80211com *,
+            struct ieee80211_regdomain *, int,
+            struct ieee80211_channel[]);
 static void iwn_read_eeprom_enhinfo(struct iwn_softc *);
 static struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
             const uint8_t mac[IEEE80211_ADDR_LEN]);
+static void iwn_newassoc(struct ieee80211_node *, int);
 static int  iwn_media_change(struct ifnet *);
 static int  iwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
+static void iwn_calib_timeout(void *);
 static void iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *,
             struct iwn_rx_data *);
-static void iwn_timer_timeout(void *);
-static void iwn_calib_reset(struct iwn_softc *);
 static void iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
             struct iwn_rx_data *);
 #if 0   /* HT */
 static void iwn_rx_compressed_ba(struct iwn_softc *, struct iwn_rx_desc *,
             struct iwn_rx_data *);
 #endif
+static void iwn5000_rx_calib_results(struct iwn_softc *,
+            struct iwn_rx_desc *, struct iwn_rx_data *);
 static void iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *,
             struct iwn_rx_data *);
 static void iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
@@ -157 +209 @@
 #endif
 static uint8_t  iwn_plcp_signal(int);
 static int  iwn_tx_data(struct iwn_softc *, struct mbuf *,
-            struct ieee80211_node *, struct iwn_tx_ring *);
+            struct ieee80211_node *);
+static int  iwn_tx_data_raw(struct iwn_softc *, struct mbuf *,
+            struct ieee80211_node *,
+            const struct ieee80211_bpf_params *params);
 static int  iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
             const struct ieee80211_bpf_params *);
 static void iwn_start(struct ifnet *);
 static void iwn_start_locked(struct ifnet *);
-static void iwn_watchdog(struct iwn_softc *sc);
+static void iwn_watchdog(void *);
 static int  iwn_ioctl(struct ifnet *, u_long, caddr_t);
 static int  iwn_cmd(struct iwn_softc *, int, const void *, int, int);
 static int  iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
             int);
 static int  iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
             int);
-static int  iwn_set_link_quality(struct iwn_softc *, uint8_t, int);
+static int  iwn_set_link_quality(struct iwn_softc *,
+            struct ieee80211_node *);
 static int  iwn_add_broadcast_node(struct iwn_softc *, int);
-static int  iwn_wme_update(struct ieee80211com *);
+static int  iwn_updateedca(struct ieee80211com *);
 static void iwn_update_mcast(struct ifnet *);
 static void iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
 static int  iwn_set_critical_temp(struct iwn_softc *);
@@ -197 +253 @@
             const struct iwn_rx_stats *);
 static int  iwn_send_sensitivity(struct iwn_softc *);
 static int  iwn_set_pslevel(struct iwn_softc *, int, int, int);
+static int  iwn_send_btcoex(struct iwn_softc *);
+static int  iwn_send_advanced_btcoex(struct iwn_softc *);
 static int  iwn_config(struct iwn_softc *);
+static uint8_t  *ieee80211_add_ssid(uint8_t *, const uint8_t *, u_int);
 static int  iwn_scan(struct iwn_softc *);
 static int  iwn_auth(struct iwn_softc *, struct ieee80211vap *vap);
 static int  iwn_run(struct iwn_softc *, struct ieee80211vap *vap);
@@ -212 +271 @@
             struct ieee80211_node *, uint8_t);
 static void iwn4965_ampdu_tx_start(struct iwn_softc *,
             struct ieee80211_node *, uint8_t, uint16_t);
-static void iwn4965_ampdu_tx_stop(struct iwn_softc *, uint8_t, uint16_t);
+static void iwn4965_ampdu_tx_stop(struct iwn_softc *,
+            uint8_t, uint16_t);
 static void iwn5000_ampdu_tx_start(struct iwn_softc *,
             struct ieee80211_node *, uint8_t, uint16_t);
-static void iwn5000_ampdu_tx_stop(struct iwn_softc *, uint8_t, uint16_t);
+static void iwn5000_ampdu_tx_stop(struct iwn_softc *,
+            uint8_t, uint16_t);
 #endif
-static int  iwn5000_send_calib_results(struct iwn_softc *);
-static int  iwn5000_save_calib_result(struct iwn_softc *,
-            struct iwn_phy_calib *, int, int);
-static void iwn5000_free_calib_results(struct iwn_softc *);
-static int  iwn5000_chrystal_calib(struct iwn_softc *);
-static int  iwn5000_send_calib_query(struct iwn_softc *, uint32_t);
-static int  iwn5000_rx_calib_result(struct iwn_softc *,
-            struct iwn_rx_desc *, struct iwn_rx_data *);
+static int  iwn5000_query_calibration(struct iwn_softc *);
+static int  iwn5000_send_calibration(struct iwn_softc *);
 static int  iwn5000_send_wimax_coex(struct iwn_softc *);
+static int  iwn5000_crystal_calib(struct iwn_softc *);
+static int  iwn5000_temp_offset_calib(struct iwn_softc *);
 static int  iwn4965_post_alive(struct iwn_softc *);
 static int  iwn5000_post_alive(struct iwn_softc *);
 static int  iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
@@ -248 +305 @@
 static int  iwn_hw_prepare(struct iwn_softc *);
 static int  iwn_hw_init(struct iwn_softc *);
 static void iwn_hw_stop(struct iwn_softc *);
+static void iwn_radio_on(void *, int);
+static void iwn_radio_off(void *, int);
 static void iwn_init_locked(struct iwn_softc *);
 static void iwn_init(void *);
 static void iwn_stop_locked(struct iwn_softc *);
 static void iwn_stop(struct iwn_softc *);
-static void     iwn_scan_start(struct ieee80211com *);
-static void     iwn_scan_end(struct ieee80211com *);
-static void     iwn_set_channel(struct ieee80211com *);
-static void     iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
-static void     iwn_scan_mindwell(struct ieee80211_scan_state *);
-static struct iwn_eeprom_chan *iwn_find_eeprom_channel(struct iwn_softc *,
-            struct ieee80211_channel *);
-static int  iwn_setregdomain(struct ieee80211com *,
-            struct ieee80211_regdomain *, int,
-            struct ieee80211_channel []);
+static void iwn_scan_start(struct ieee80211com *);
+static void iwn_scan_end(struct ieee80211com *);
+static void iwn_set_channel(struct ieee80211com *);
+static void iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
+static void iwn_scan_mindwell(struct ieee80211_scan_state *);
 static void iwn_hw_reset(void *, int);
-static void iwn_radio_on(void *, int);
-static void iwn_radio_off(void *, int);
-static void iwn_sysctlattach(struct iwn_softc *);
-static int  iwn_shutdown(device_t);
-static int  iwn_suspend(device_t);
-static int  iwn_resume(device_t);
 
 #define IWN_DEBUG
 #ifdef IWN_DEBUG
@@ -295 +343 @@
         printf(fmt, __VA_ARGS__);       \
 } while (0)
 
-static const char *iwn_intr_str(uint8_t);
+static const char *
+iwn_intr_str(uint8_t cmd)
+{
+    switch (cmd) {
+    /* Notifications */
+    case IWN_UC_READY:      return "UC_READY";
+    case IWN_ADD_NODE_DONE:     return "ADD_NODE_DONE";
+    case IWN_TX_DONE:       return "TX_DONE";
+    case IWN_START_SCAN:        return "START_SCAN";
+    case IWN_STOP_SCAN:     return "STOP_SCAN";
+    case IWN_RX_STATISTICS:     return "RX_STATS";
+    case IWN_BEACON_STATISTICS: return "BEACON_STATS";
+    case IWN_STATE_CHANGED:     return "STATE_CHANGED";
+    case IWN_BEACON_MISSED:     return "BEACON_MISSED";
+    case IWN_RX_PHY:        return "RX_PHY";
+    case IWN_MPDU_RX_DONE:      return "MPDU_RX_DONE";
+    case IWN_RX_DONE:       return "RX_DONE";
+
+    /* Command Notifications */
+    case IWN_CMD_RXON:      return "IWN_CMD_RXON";
+    case IWN_CMD_RXON_ASSOC:    return "IWN_CMD_RXON_ASSOC";
+    case IWN_CMD_EDCA_PARAMS:   return "IWN_CMD_EDCA_PARAMS";
+    case IWN_CMD_TIMING:        return "IWN_CMD_TIMING";
+    case IWN_CMD_LINK_QUALITY:  return "IWN_CMD_LINK_QUALITY";
+    case IWN_CMD_SET_LED:       return "IWN_CMD_SET_LED";
+    case IWN5000_CMD_WIMAX_COEX:    return "IWN5000_CMD_WIMAX_COEX";
+    case IWN5000_CMD_CALIB_CONFIG:  return "IWN5000_CMD_CALIB_CONFIG";
+    case IWN5000_CMD_CALIB_RESULT:  return "IWN5000_CMD_CALIB_RESULT";
+    case IWN5000_CMD_CALIB_COMPLETE: return "IWN5000_CMD_CALIB_COMPLETE";
+    case IWN_CMD_SET_POWER_MODE:    return "IWN_CMD_SET_POWER_MODE";
+    case IWN_CMD_SCAN:      return "IWN_CMD_SCAN";
+    case IWN_CMD_SCAN_RESULTS:  return "IWN_CMD_SCAN_RESULTS";
+    case IWN_CMD_TXPOWER:       return "IWN_CMD_TXPOWER";
+    case IWN_CMD_TXPOWER_DBM:   return "IWN_CMD_TXPOWER_DBM";
+    case IWN5000_CMD_TX_ANT_CONFIG: return "IWN5000_CMD_TX_ANT_CONFIG";
+    case IWN_CMD_BT_COEX:       return "IWN_CMD_BT_COEX";
+    case IWN_CMD_SET_CRITICAL_TEMP: return "IWN_CMD_SET_CRITICAL_TEMP";
+    case IWN_CMD_SET_SENSITIVITY:   return "IWN_CMD_SET_SENSITIVITY";
+    case IWN_CMD_PHY_CALIB:     return "IWN_CMD_PHY_CALIB";
+    }
+    return "UNKNOWN INTR NOTIF/CMD";
+}
 #else
 #define DPRINTF(sc, m, fmt, ...) do { (void) sc; } while (0)
 #endif
 
-struct iwn_ident {
-    uint16_t    vendor;
-    uint16_t    device;
-    const char  *name;
+static device_method_t iwn_methods[] = {
+    /* Device interface */
+    DEVMETHOD(device_probe,     iwn_probe),
+    DEVMETHOD(device_attach,    iwn_attach),
+    DEVMETHOD(device_detach,    iwn_detach),
+    DEVMETHOD(device_shutdown,  iwn_shutdown),
+    DEVMETHOD(device_suspend,   iwn_suspend),
+    DEVMETHOD(device_resume,    iwn_resume),
+    { 0, 0 }
 };
 
-static const struct iwn_ident iwn_ident_table [] = {
-    { 0x8086, 0x4229, "Intel(R) PRO/Wireless 4965BGN" },
-    { 0x8086, 0x422D, "Intel(R) PRO/Wireless 4965BGN" },
-    { 0x8086, 0x4230, "Intel(R) PRO/Wireless 4965BGN" },
-    { 0x8086, 0x4233, "Intel(R) PRO/Wireless 4965BGN" },
-    { 0x8086, 0x4232, "Intel(R) PRO/Wireless 5100" },
-    { 0x8086, 0x4237, "Intel(R) PRO/Wireless 5100" },
-    { 0x8086, 0x423C, "Intel(R) PRO/Wireless 5150" },
-    { 0x8086, 0x423D, "Intel(R) PRO/Wireless 5150" },
-    { 0x8086, 0x4235, "Intel(R) PRO/Wireless 5300" },
-    { 0x8086, 0x4236, "Intel(R) PRO/Wireless 5300" },
-    { 0x8086, 0x423A, "Intel(R) PRO/Wireless 5350" },
-    { 0x8086, 0x423B, "Intel(R) PRO/Wireless 5350" },
-    { 0x8086, 0x0083, "Intel(R) PRO/Wireless 1000" },
-    { 0x8086, 0x0084, "Intel(R) PRO/Wireless 1000" },
-    { 0x8086, 0x008D, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x008E, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x4238, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x4239, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x422B, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x422C, "Intel(R) PRO/Wireless 6000" },
-    { 0x8086, 0x0087, "Intel(R) PRO/Wireless 6250" },
-    { 0x8086, 0x0089, "Intel(R) PRO/Wireless 6250" },
-    { 0x8086, 0x0082, "Intel(R) PRO/Wireless 6205a" },
-    { 0x8086, 0x0085, "Intel(R) PRO/Wireless 6205a" },
-#ifdef notyet
-    { 0x8086, 0x008a, "Intel(R) PRO/Wireless 6205b" },
-    { 0x8086, 0x008b, "Intel(R) PRO/Wireless 6205b" },
-    { 0x8086, 0x008f, "Intel(R) PRO/Wireless 6205b" },
-    { 0x8086, 0x0090, "Intel(R) PRO/Wireless 6205b" },
-    { 0x8086, 0x0091, "Intel(R) PRO/Wireless 6205b" },
-#endif
-    { 0, 0, NULL }
+static driver_t iwn_driver = {
+    "iwn",
+    iwn_methods,
+    sizeof(struct iwn_softc)
 };
+static devclass_t iwn_devclass;
 
-static const struct iwn_hal iwn4965_hal = {
-    iwn4965_load_firmware,
-    iwn4965_read_eeprom,
-    iwn4965_post_alive,
-    iwn4965_nic_config,
-    iwn4965_update_sched,
-    iwn4965_get_temperature,
-    iwn4965_get_rssi,
-    iwn4965_set_txpower,
-    iwn4965_init_gains,
-    iwn4965_set_gains,
-    iwn4965_add_node,
-    iwn4965_tx_done,
-#if 0   /* HT */
-    iwn4965_ampdu_tx_start,
-    iwn4965_ampdu_tx_stop,
-#endif
-    IWN4965_NTXQUEUES,
-    IWN4965_NDMACHNLS,
-    IWN4965_ID_BROADCAST,
-    IWN4965_RXONSZ,
-    IWN4965_SCHEDSZ,
-    IWN4965_FW_TEXT_MAXSZ,
-    IWN4965_FW_DATA_MAXSZ,
-    IWN4965_FWSZ,
-    IWN4965_SCHED_TXFACT
-};
+DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, 0, 0);
 
-static const struct iwn_hal iwn5000_hal = {
-    iwn5000_load_firmware,
-    iwn5000_read_eeprom,
-    iwn5000_post_alive,
-    iwn5000_nic_config,
-    iwn5000_update_sched,
-    iwn5000_get_temperature,
-    iwn5000_get_rssi,
-    iwn5000_set_txpower,
-    iwn5000_init_gains,
-    iwn5000_set_gains,
-    iwn5000_add_node,
-    iwn5000_tx_done,
-#if 0   /* HT */
-    iwn5000_ampdu_tx_start,
-    iwn5000_ampdu_tx_stop,
-#endif
-    IWN5000_NTXQUEUES,
-    IWN5000_NDMACHNLS,
-    IWN5000_ID_BROADCAST,
-    IWN5000_RXONSZ,
-    IWN5000_SCHEDSZ,
-    IWN5000_FW_TEXT_MAXSZ,
-    IWN5000_FW_DATA_MAXSZ,
-    IWN5000_FWSZ,
-    IWN5000_SCHED_TXFACT
-};
+MODULE_DEPEND(iwn, firmware, 1, 1, 1);
+MODULE_DEPEND(iwn, pci, 1, 1, 1);
+MODULE_DEPEND(iwn, wlan, 1, 1, 1);
 
 static int
 iwn_probe(device_t dev)
@@ -418 +434 @@
     struct iwn_softc *sc = (struct iwn_softc *)device_get_softc(dev);
     struct ieee80211com *ic;
     struct ifnet *ifp;
-    const struct iwn_hal *hal;
-    uint32_t tmp;
+    uint32_t reg;
     int i, error, result;
     uint8_t macaddr[IEEE80211_ADDR_LEN];
 
@@ -439 +454 @@
     pci_write_config(dev, 0x41, 0, 1);
 
     /* Hardware bug workaround. */
-    tmp = pci_read_config(dev, PCIR_COMMAND, 1);
-    if (tmp & PCIM_CMD_INTxDIS) {
+    reg = pci_read_config(dev, PCIR_COMMAND, 1);
+    if (reg & PCIM_CMD_INTxDIS) {
         DPRINTF(sc, IWN_DEBUG_RESET, "%s: PCIe INTx Disable set\n",
             __func__);
-        tmp &= ~PCIM_CMD_INTxDIS;
-        pci_write_config(dev, PCIR_COMMAND, tmp, 1);
+        reg &= ~PCIM_CMD_INTxDIS;
+        pci_write_config(dev, PCIR_COMMAND, reg, 1);
     }
 
     /* Enable bus-mastering. */
@@ -453 +468 @@
     sc->mem_rid = PCIR_BAR(0);
     sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
         RF_ACTIVE);
-    if (sc->mem == NULL ) {
-        device_printf(dev, "could not allocate memory resources\n");
+    if (sc->mem == NULL) {
+        device_printf(dev, "can't map mem space\n");
         error = ENOMEM;
         return error;
     }
-
     sc->sc_st = rman_get_bustag(sc->mem);
     sc->sc_sh = rman_get_bushandle(sc->mem);
+
     sc->irq_rid = 0;
     if ((result = pci_msi_count(dev)) == 1 &&
         pci_alloc_msi(dev, &result) == 0)
         sc->irq_rid = 1;
+    /* Install interrupt handler. */
     sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
         RF_ACTIVE | RF_SHAREABLE);
     if (sc->irq == NULL) {
-        device_printf(dev, "could not allocate interrupt resource\n");
+        device_printf(dev, "can't map interrupt\n");
         error = ENOMEM;
         goto fail;
     }
 
     IWN_LOCK_INIT(sc);
-    callout_init_mtx(&sc->sc_timer_to, &sc->sc_mtx, 0);
-    TASK_INIT(&sc->sc_reinit_task, 0, iwn_hw_reset, sc );
-    TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on, sc );
-    TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off, sc );
-
-    /* Attach Hardware Abstraction Layer. */
-    hal = iwn_hal_attach(sc);
-    if (hal == NULL) {
-        error = ENXIO;  /* XXX: Wrong error code? */
+
+    /* Read hardware revision and attach. */
+    sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> 4) & 0xf;
+    if (sc->hw_type == IWN_HW_REV_TYPE_4965)
+        error = iwn4965_attach(sc, pci_get_device(dev));
+    else
+        error = iwn5000_attach(sc, pci_get_device(dev));
+    if (error != 0) {
+        device_printf(dev, "could not attach device, error %d\n",
+            error);
         goto fail;
     }
 
-    error = iwn_hw_prepare(sc);
-    if (error != 0) {
+    if ((error = iwn_hw_prepare(sc)) != 0) {
         device_printf(dev, "hardware not ready, error %d\n", error);
         goto fail;
     }
 
     /* Allocate DMA memory for firmware transfers. */
-    error = iwn_alloc_fwmem(sc);
-    if (error != 0) {
+    if ((error = iwn_alloc_fwmem(sc)) != 0) {
         device_printf(dev,
             "could not allocate memory for firmware, error %d\n",
             error);
@@ -502 +517 @@
     }
 
     /* Allocate "Keep Warm" page. */
-    error = iwn_alloc_kw(sc);
-    if (error != 0) {
+    if ((error = iwn_alloc_kw(sc)) != 0) {
         device_printf(dev,
-            "could not allocate \"Keep Warm\" page, error %d\n", error);
+            "could not allocate keep warm page, error %d\n", error);
         goto fail;
     }
 
     /* Allocate ICT table for 5000 Series. */
     if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
         (error = iwn_alloc_ict(sc)) != 0) {
-        device_printf(dev,
-            "%s: could not allocate ICT table, error %d\n",
-            __func__, error);
+        device_printf(dev, "could not allocate ICT table, error %d\n",
+            error);
         goto fail;
     }
 
     /* Allocate TX scheduler "rings". */
-    error = iwn_alloc_sched(sc);
-    if (error != 0) {
+    if ((error = iwn_alloc_sched(sc)) != 0) {
         device_printf(dev,
-            "could not allocate TX scheduler rings, error %d\n",
-            error);
+            "could not allocate TX scheduler rings, error %d\n", error);
         goto fail;
     }
 
-    /* Allocate TX rings (16 on 4965AGN, 20 on 5000). */
-    for (i = 0; i < hal->ntxqs; i++) {
-        error = iwn_alloc_tx_ring(sc, &sc->txq[i], i);
-        if (error != 0) {
+    /* Allocate TX rings (16 on 4965AGN, 20 on >=5000). */
+    for (i = 0; i < sc->ntxqs; i++) {
+        if ((error = iwn_alloc_tx_ring(sc, &sc->txq[i], i)) != 0) {
             device_printf(dev,
-                "could not allocate Tx ring %d, error %d\n",
-                i, error);
+                "could not allocate TX ring %d, error %d\n", i,
+                error);
             goto fail;
         }
     }
 
     /* Allocate RX ring. */
-    error = iwn_alloc_rx_ring(sc, &sc->rxq);
-    if (error != 0 ){
-        device_printf(dev,
-            "could not allocate Rx ring, error %d\n", error);
+    if ((error = iwn_alloc_rx_ring(sc, &sc->rxq)) != 0) {
+        device_printf(dev, "could not allocate RX ring, error %d\n",
+            error);
         goto fail;
     }
 
@@ -558 +567 @@
         ((sc->rxchainmask >> 2) & 1) +
         ((sc->rxchainmask >> 1) & 1) +
         ((sc->rxchainmask >> 0) & 1);
+    if (bootverbose) {
+        device_printf(dev, "MIMO %dT%dR, %.4s, address %6D\n",
+            sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
+            macaddr, ":");
+    }
 
     ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
     if (ifp == NULL) {
         device_printf(dev, "can not allocate ifnet structure\n");
         goto fail;
     }
-    ic = ifp->if_l2com;
 
+    ic = ifp->if_l2com;
     ic->ic_ifp = ifp;
     ic->ic_phytype = IEEE80211_T_OFDM;  /* not only, but not used */
     ic->ic_opmode = IEEE80211_M_STA;    /* default to BSS mode */
@@ -616 +630 @@
 #endif
 
     /* Read MAC address, channels, etc from EEPROM. */
-    error = iwn_read_eeprom(sc, macaddr);
-    if (error != 0) {
+    if ((error = iwn_read_eeprom(sc, macaddr)) != 0) {
         device_printf(dev, "could not read EEPROM, error %d\n",
             error);
         goto fail;
     }
 
-    device_printf(sc->sc_dev, "MIMO %dT%dR, %.4s, address %6D\n",
-        sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
-        macaddr, ":");
-
 #if 0   /* HT */
     /* Set supported HT rates. */
     ic->ic_sup_mcs[0] = 0xff;
@@ -651 +660 @@
     ic->ic_vap_delete = iwn_vap_delete;
     ic->ic_raw_xmit = iwn_raw_xmit;
     ic->ic_node_alloc = iwn_node_alloc;
-    ic->ic_wme.wme_update = iwn_wme_update;
+#if 0   /* HT */
+    ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
+    ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
+    ic->ic_ampdu_tx_start = iwn_ampdu_tx_start;
+    ic->ic_ampdu_tx_stop = iwn_ampdu_tx_stop;
+#endif
+    ic->ic_newassoc = iwn_newassoc;
+    ic->ic_wme.wme_update = iwn_updateedca;
     ic->ic_update_mcast = iwn_update_mcast;
     ic->ic_scan_start = iwn_scan_start;
     ic->ic_scan_end = iwn_scan_end;
@@ -659 +675 @@
     ic->ic_scan_curchan = iwn_scan_curchan;
     ic->ic_scan_mindwell = iwn_scan_mindwell;
     ic->ic_setregdomain = iwn_setregdomain;
-#if 0   /* HT */
-    ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
-    ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
-    ic->ic_ampdu_tx_start = iwn_ampdu_tx_start;
-    ic->ic_ampdu_tx_stop = iwn_ampdu_tx_stop;
-#endif
 
     iwn_radiotap_attach(sc);
+
+    callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
+    callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
+    TASK_INIT(&sc->sc_reinit_task, 0, iwn_hw_reset, sc);
+    TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on, sc);
+    TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off, sc);
+
     iwn_sysctlattach(sc);
 
     /*
@@ -675 +692 @@
     error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
         NULL, iwn_intr, sc, &sc->sc_ih);
     if (error != 0) {
-        device_printf(dev, "could not set up interrupt, error %d\n",
+        device_printf(dev, "can't establish interrupt, error %d\n",
             error);
         goto fail;
     }
 
-    ieee80211_announce(ic);
+    if (bootverbose)
+        ieee80211_announce(ic);
     return 0;
 fail:
-    iwn_cleanup(dev);
+    iwn_detach(dev);
     return error;
 }
 
-static const struct iwn_hal *
-iwn_hal_attach(struct iwn_softc *sc)
-{
-    sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> 4) & 0xf;
+static int
+iwn4965_attach(struct iwn_softc *sc, uint16_t pid)
+{
+    struct iwn_ops *ops = &sc->ops;
+
+    ops->load_firmware = iwn4965_load_firmware;
+    ops->read_eeprom = iwn4965_read_eeprom;
+    ops->post_alive = iwn4965_post_alive;
+    ops->nic_config = iwn4965_nic_config;
+    ops->update_sched = iwn4965_update_sched;
+    ops->get_temperature = iwn4965_get_temperature;
+    ops->get_rssi = iwn4965_get_rssi;
+    ops->set_txpower = iwn4965_set_txpower;
+    ops->init_gains = iwn4965_init_gains;
+    ops->set_gains = iwn4965_set_gains;
+    ops->add_node = iwn4965_add_node;
+    ops->tx_done = iwn4965_tx_done;
+#if 0   /* HT */
+    ops->ampdu_tx_start = iwn4965_ampdu_tx_start;
+    ops->ampdu_tx_stop = iwn4965_ampdu_tx_stop;
+#endif
+    sc->ntxqs = IWN4965_NTXQUEUES;
+    sc->ndmachnls = IWN4965_NDMACHNLS;
+    sc->broadcast_id = IWN4965_ID_BROADCAST;
+    sc->rxonsz = IWN4965_RXONSZ;
+    sc->schedsz = IWN4965_SCHEDSZ;
+    sc->fw_text_maxsz = IWN4965_FW_TEXT_MAXSZ;
+    sc->fw_data_maxsz = IWN4965_FW_DATA_MAXSZ;
+    sc->fwsz = IWN4965_FWSZ;
+    sc->sched_txfact_addr = IWN4965_SCHED_TXFACT;
+    sc->limits = &iwn4965_sensitivity_limits;
+    sc->fwname = "iwn4965fw";
+    /* Override chains masks, ROM is known to be broken. */
+    sc->txchainmask = IWN_ANT_AB;
+    sc->rxchainmask = IWN_ANT_ABC;
+
+    return 0;
+}
+
+static int
+iwn5000_attach(struct iwn_softc *sc, uint16_t pid)
+{
+    struct iwn_ops *ops = &sc->ops;
+
+    ops->load_firmware = iwn5000_load_firmware;
+    ops->read_eeprom = iwn5000_read_eeprom;
+    ops->post_alive = iwn5000_post_alive;
+    ops->nic_config = iwn5000_nic_config;
+    ops->update_sched = iwn5000_update_sched;
+    ops->get_temperature = iwn5000_get_temperature;
+    ops->get_rssi = iwn5000_get_rssi;
+    ops->set_txpower = iwn5000_set_txpower;
+    ops->init_gains = iwn5000_init_gains;
+    ops->set_gains = iwn5000_set_gains;
+    ops->add_node = iwn5000_add_node;
+    ops->tx_done = iwn5000_tx_done;
+#if 0   /* HT */
+    ops->ampdu_tx_start = iwn5000_ampdu_tx_start;
+    ops->ampdu_tx_stop = iwn5000_ampdu_tx_stop;
+#endif
+    sc->ntxqs = IWN5000_NTXQUEUES;
+    sc->ndmachnls = IWN5000_NDMACHNLS;
+    sc->broadcast_id = IWN5000_ID_BROADCAST;
+    sc->rxonsz = IWN5000_RXONSZ;
+    sc->schedsz = IWN5000_SCHEDSZ;
+    sc->fw_text_maxsz = IWN5000_FW_TEXT_MAXSZ;
+    sc->fw_data_maxsz = IWN5000_FW_DATA_MAXSZ;
+    sc->fwsz = IWN5000_FWSZ;
+    sc->sched_txfact_addr = IWN5000_SCHED_TXFACT;
+    sc->reset_noise_gain = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
+    sc->noise_gain = IWN5000_PHY_CALIB_NOISE_GAIN;
 
     switch (sc->hw_type) {
-    case IWN_HW_REV_TYPE_4965:
-        sc->sc_hal = &iwn4965_hal;
-        sc->limits = &iwn4965_sensitivity_limits;
-        sc->fwname = "iwn4965fw";
-        sc->txchainmask = IWN_ANT_AB;
-        sc->rxchainmask = IWN_ANT_ABC;
-        break;
     case IWN_HW_REV_TYPE_5100:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn5000_sensitivity_limits;
         sc->fwname = "iwn5000fw";
+        /* Override chains masks, ROM is known to be broken. */
         sc->txchainmask = IWN_ANT_B;
         sc->rxchainmask = IWN_ANT_AB;
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_TX_IQ_PERIODIC |
-            IWN_CALIB_BASE_BAND;
         break;
     case IWN_HW_REV_TYPE_5150:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn5150_sensitivity_limits;
         sc->fwname = "iwn5150fw";
-        sc->txchainmask = IWN_ANT_A;
-        sc->rxchainmask = IWN_ANT_AB;
-        sc->calib_init = IWN_CALIB_DC | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_BASE_BAND;
         break;
     case IWN_HW_REV_TYPE_5300:
     case IWN_HW_REV_TYPE_5350:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn5000_sensitivity_limits;
         sc->fwname = "iwn5000fw";
-        sc->txchainmask = IWN_ANT_ABC;
-        sc->rxchainmask = IWN_ANT_ABC;
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_TX_IQ_PERIODIC |
-            IWN_CALIB_BASE_BAND;
         break;
     case IWN_HW_REV_TYPE_1000:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn1000_sensitivity_limits;
         sc->fwname = "iwn1000fw";
-        sc->txchainmask = IWN_ANT_A;
-        sc->rxchainmask = IWN_ANT_AB;
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_TX_IQ_PERIODIC |
-            IWN_CALIB_BASE_BAND;
         break;
     case IWN_HW_REV_TYPE_6000:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn6000_sensitivity_limits;
         sc->fwname = "iwn6000fw";
-        switch (pci_get_device(sc->sc_dev)) {
-        case 0x422C:
-        case 0x4239:
+        if (pid == 0x422c || pid == 0x4239) {
             sc->sc_flags |= IWN_FLAG_INTERNAL_PA;
+            /* Override chains masks, ROM is known to be broken. */
             sc->txchainmask = IWN_ANT_BC;
             sc->rxchainmask = IWN_ANT_BC;
-            break;
-        default:
-            sc->txchainmask = IWN_ANT_ABC;
-            sc->rxchainmask = IWN_ANT_ABC;
-            sc->calib_runtime = IWN_CALIB_DC;
-            break;
         }
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_BASE_BAND;
         break;
     case IWN_HW_REV_TYPE_6050:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn6000_sensitivity_limits;
         sc->fwname = "iwn6050fw";
+        /* Override chains masks, ROM is known to be broken. */
         sc->txchainmask = IWN_ANT_AB;
         sc->rxchainmask = IWN_ANT_AB;
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_BASE_BAND;
-        sc->calib_runtime = IWN_CALIB_DC;
         break;
     case IWN_HW_REV_TYPE_6005:
-        sc->sc_hal = &iwn5000_hal;
         sc->limits = &iwn6000_sensitivity_limits;
-        sc->fwname = "iwn6005fw";
-        sc->txchainmask = IWN_ANT_AB;
-        sc->rxchainmask = IWN_ANT_AB;
-        sc->calib_init = IWN_CALIB_XTAL | IWN_CALIB_LO |
-            IWN_CALIB_TX_IQ | IWN_CALIB_BASE_BAND;
-        sc->calib_runtime = IWN_CALIB_DC;
+        if (pid != 0x0082 && pid != 0x0085) {
+            sc->fwname = "iwn6000g2bfw";
+            sc->sc_flags |= IWN_FLAG_ADV_BTCOEX;
+        } else
+            sc->fwname = "iwn6000g2afw";
         break;
     default:
         device_printf(sc->sc_dev, "adapter type %d not supported\n",
             sc->hw_type);
-        return NULL;
+        return ENOTSUP;
     }
-    return sc->sc_hal;
+    return 0;
 }
 
 /*
@@ -804 +847 @@
         IWN_RX_RADIOTAP_PRESENT);
 }
 
+static void
+iwn_sysctlattach(struct iwn_softc *sc)
+{
+    struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
+    struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
+
+#ifdef IWN_DEBUG
+    sc->sc_debug = 0;
+    SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
+        "debug", CTLFLAG_RW, &sc->sc_debug, 0, "control debugging printfs");
+#endif
+}
+
 static struct ieee80211vap *
 iwn_vap_create(struct ieee80211com *ic,
-    const char name[IFNAMSIZ], int unit, int opmode, int flags,
-    const uint8_t bssid[IEEE80211_ADDR_LEN],
-    const uint8_t mac[IEEE80211_ADDR_LEN])
+    const char name[IFNAMSIZ], int unit, enum ieee80211_opmode opmode, int flags,
+    const uint8_t bssid[IEEE80211_ADDR_LEN],
+    const uint8_t mac[IEEE80211_ADDR_LEN])
 {
     struct iwn_vap *ivp;
     struct ieee80211vap *vap;
@@ -844 +900 @@
 }
 
 static int
-iwn_cleanup(device_t dev)
+iwn_detach(device_t dev)
 {
     struct iwn_softc *sc = device_get_softc(dev);
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic;
-    int i;
+    int qid;
 
     if (ifp != NULL) {
         ic = ifp->if_l2com;
@@ -859 +915 @@
         ieee80211_draintask(ic, &sc->sc_radiooff_task);
 
         iwn_stop(sc);
-        callout_drain(&sc->sc_timer_to);
+        callout_drain(&sc->watchdog_to);
+        callout_drain(&sc->calib_to);
         ieee80211_ifdetach(ic);
     }
 
-    iwn5000_free_calib_results(sc);
+    /* Uninstall interrupt handler. */
+    if (sc->irq != NULL) {
+        bus_teardown_intr(dev, sc->irq, sc->sc_ih);
+        bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
+        if (sc->irq_rid == 1)
+            pci_release_msi(dev);
+    }
 
     /* Free DMA resources. */
     iwn_free_rx_ring(sc, &sc->rxq);
-    if (sc->sc_hal != NULL)
-        for (i = 0; i < sc->sc_hal->ntxqs; i++)
-            iwn_free_tx_ring(sc, &sc->txq[i]);
+    for (qid = 0; qid < sc->ntxqs; qid++)
+        iwn_free_tx_ring(sc, &sc->txq[qid]);
     iwn_free_sched(sc);
     iwn_free_kw(sc);
     if (sc->ict != NULL)
         iwn_free_ict(sc);
     iwn_free_fwmem(sc);
 
-    if (sc->irq != NULL) {
-        bus_teardown_intr(dev, sc->irq, sc->sc_ih);
-        bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
-        if (sc->irq_rid == 1)
-            pci_release_msi(dev);
-    }
-
     if (sc->mem != NULL)
         bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
 
@@ -894 +949 @@
 }
 
 static int
-iwn_detach(device_t dev)
+iwn_shutdown(device_t dev)
+{
+    struct iwn_softc *sc = device_get_softc(dev);
+
+    iwn_stop(sc);
+    return 0;
+}
+
+static int
+iwn_suspend(device_t dev)
 {
-    iwn_cleanup(dev);
+    struct iwn_softc *sc = device_get_softc(dev);
+    struct ieee80211com *ic = sc->sc_ifp->if_l2com;
+
+    ieee80211_suspend_all(ic);
+    return 0;
+}
+
+static int
+iwn_resume(device_t dev)
+{
+    struct iwn_softc *sc = device_get_softc(dev);
+    struct ieee80211com *ic = sc->sc_ifp->if_l2com;
+
+    /* Clear device-specific "PCI retry timeout" register (41h). */
+    pci_write_config(dev, 0x41, 0, 1);
+
+    ieee80211_resume_all(ic);
     return 0;
 }
 
@@ -911 +991 @@
     /* Spin until we actually get the lock. */
     for (ntries = 0; ntries < 1000; ntries++) {
         if ((IWN_READ(sc, IWN_GP_CNTRL) &
-            (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
+             (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
             IWN_GP_CNTRL_MAC_ACCESS_ENA)
             return 0;
         DELAY(10);
@@ -1044 +1124 @@
     int count, error;
 
     /* Wait for clock stabilization before accessing prph. */
-    error = iwn_clock_wait(sc);
-    if (error != 0)
+    if ((error = iwn_clock_wait(sc)) != 0)
         return error;
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
     iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
     DELAY(5);
@@ -1094 +1172 @@
 static int
 iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
 {
+    uint8_t *out = data;
     uint32_t val, tmp;
     int ntries;
-    uint8_t *out = data;
 
     addr += sc->prom_base;
     for (; count > 0; count -= 2, addr++) {
@@ -1144 +1222 @@
 
 static int
 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
-    void **kvap, bus_size_t size, bus_size_t alignment, int flags)
+    void **kvap, bus_size_t size, bus_size_t alignment)
 {
     int error;
 
-    dma->size = size;
     dma->tag = NULL;
+    dma->size = size;
 
     error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), alignment,
         0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
-        1, size, flags, NULL, NULL, &dma->tag);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: bus_dma_tag_create failed, error %d\n",
-            __func__, error);
+        1, size, BUS_DMA_NOWAIT, NULL, NULL, &dma->tag);
+    if (error != 0)
         goto fail;
-    }
+
     error = bus_dmamem_alloc(dma->tag, (void **)&dma->vaddr,
-        flags | BUS_DMA_ZERO, &dma->map);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: bus_dmamem_alloc failed, error %d\n", __func__, error);
+        BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT, &dma->map);
+    if (error != 0)
         goto fail;
-    }
-    error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr,
-        size, iwn_dma_map_addr, &dma->paddr, flags);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: bus_dmamap_load failed, error %d\n", __func__, error);
+
+    error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr, size,
+        iwn_dma_map_addr, &dma->paddr, BUS_DMA_NOWAIT);
+    if (error != 0)
         goto fail;
-    }
+
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 
     if (kvap != NULL)
         *kvap = dma->vaddr;
+
     return 0;
-fail:
-    iwn_dma_contig_free(dma);
+
+fail:   iwn_dma_contig_free(dma);
     return error;
 }
 
 static void
 iwn_dma_contig_free(struct iwn_dma_info *dma)
 {
-    if (dma->tag != NULL) {
-        if (dma->map != NULL) {
-            if (dma->paddr == 0) {
-                bus_dmamap_sync(dma->tag, dma->map,
-                    BUS_DMASYNC_POSTREAD|BUS_DMASYNC_POSTWRITE);
-                bus_dmamap_unload(dma->tag, dma->map);
-            }
+    if (dma->map != NULL) {
+        if (dma->vaddr != NULL) {
+            bus_dmamap_sync(dma->tag, dma->map,
+                BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
+            bus_dmamap_unload(dma->tag, dma->map);
             bus_dmamem_free(dma->tag, &dma->vaddr, dma->map);
+            dma->vaddr = NULL;
         }
+        bus_dmamap_destroy(dma->tag, dma->map);
+        dma->map = NULL;
+    }
+    if (dma->tag != NULL) {
         bus_dma_tag_destroy(dma->tag);
+        dma->tag = NULL;
     }
 }
 
@@ -1203 +1280 @@
 iwn_alloc_sched(struct iwn_softc *sc)
 {
     /* TX scheduler rings must be aligned on a 1KB boundary. */
-    return iwn_dma_contig_alloc(sc, &sc->sched_dma,
-        (void **)&sc->sched, sc->sc_hal->schedsz, 1024, BUS_DMA_NOWAIT);
+    return iwn_dma_contig_alloc(sc, &sc->sched_dma, (void **)&sc->sched,
+        sc->schedsz, 1024);
 }
 
 static void
@@ -1217 +1294 @@
 iwn_alloc_kw(struct iwn_softc *sc)
 {
     /* "Keep Warm" page must be aligned on a 4KB boundary. */
-    return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096,
-        BUS_DMA_NOWAIT);
+    return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096);
 }
 
 static void
@@ -1231 +1307 @@
 iwn_alloc_ict(struct iwn_softc *sc)
 {
     /* ICT table must be aligned on a 4KB boundary. */
-    return iwn_dma_contig_alloc(sc, &sc->ict_dma,
-        (void **)&sc->ict, IWN_ICT_SIZE, 4096, BUS_DMA_NOWAIT);
+    return iwn_dma_contig_alloc(sc, &sc->ict_dma, (void **)&sc->ict,
+        IWN_ICT_SIZE, 4096);
 }
 
 static void
@@ -1245 +1321 @@
 iwn_alloc_fwmem(struct iwn_softc *sc)
 {
     /* Must be aligned on a 16-byte boundary. */
-    return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL,
-        sc->sc_hal->fwsz, 16, BUS_DMA_NOWAIT);
+    return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL, sc->fwsz, 16);
 }
 
 static void
@@ -1265 +1340 @@
 
     /* Allocate RX descriptors (256-byte aligned). */
     size = IWN_RX_RING_COUNT * sizeof (uint32_t);
-    error = iwn_dma_contig_alloc(sc, &ring->desc_dma,
-        (void **)&ring->desc, size, 256, BUS_DMA_NOWAIT);
+    error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
+        size, 256);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not allocate Rx ring DMA memory, error %d\n",
+            "%s: could not allocate RX ring DMA memory, error %d\n",
             __func__, error);
         goto fail;
     }
 
-    error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
-        BUS_SPACE_MAXADDR_32BIT,
-        BUS_SPACE_MAXADDR, NULL, NULL, MJUMPAGESIZE, 1,
-        MJUMPAGESIZE, BUS_DMA_NOWAIT, NULL, NULL, &ring->data_dmat);
+    /* Allocate RX status area (16-byte aligned). */
+    error = iwn_dma_contig_alloc(sc, &ring->stat_dma, (void **)&ring->stat,
+        sizeof (struct iwn_rx_status), 16);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: bus_dma_tag_create_failed, error %d\n",
+            "%s: could not allocate RX status DMA memory, error %d\n",
             __func__, error);
         goto fail;
     }
 
-    /* Allocate RX status area (16-byte aligned). */
-    error = iwn_dma_contig_alloc(sc, &ring->stat_dma,
-        (void **)&ring->stat, sizeof (struct iwn_rx_status),
-        16, BUS_DMA_NOWAIT);
+    /* Create RX buffer DMA tag. */
+    error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
+        BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
+        IWN_RBUF_SIZE, 1, IWN_RBUF_SIZE, BUS_DMA_NOWAIT, NULL, NULL,
+        &ring->data_dmat);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not allocate Rx status DMA memory, error %d\n",
+            "%s: could not create RX buf DMA tag, error %d\n",
             __func__, error);
         goto fail;
     }
@@ -1306 +1381 @@
         error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
         if (error != 0) {
             device_printf(sc->sc_dev,
-                "%s: bus_dmamap_create failed, error %d\n",
+                "%s: could not create RX buf DMA map, error %d\n",
                 __func__, error);
             goto fail;
         }
 
-        data->m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
+        data->m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR,
+            IWN_RBUF_SIZE);
         if (data->m == NULL) {
             device_printf(sc->sc_dev,
-                "%s: could not allocate rx mbuf\n", __func__);
-            error = ENOMEM;
+                "%s: could not allocate RX mbuf\n", __func__);
+            error = ENOBUFS;
             goto fail;
         }
 
-        /* Map page. */
         error = bus_dmamap_load(ring->data_dmat, data->map,
-            mtod(data->m, caddr_t), MJUMPAGESIZE,
-            iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
+            mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
+            &paddr, BUS_DMA_NOWAIT);
         if (error != 0 && error != EFBIG) {
             device_printf(sc->sc_dev,
-                "%s: bus_dmamap_load failed, error %d\n",
-                __func__, error);
-            m_freem(data->m);
-            error = ENOMEM; /* XXX unique code */
+                "%s: can't not map mbuf, error %d\n", __func__,
+                error);
             goto fail;
         }
-        bus_dmamap_sync(ring->data_dmat, data->map,
-            BUS_DMASYNC_PREWRITE);
 
         /* Set physical address of RX buffer (256-byte aligned). */
         ring->desc[i] = htole32(paddr >> 8);
     }
+
     bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
         BUS_DMASYNC_PREWRITE);
+
     return 0;
-fail:
-    iwn_free_rx_ring(sc, ring);
+
+fail:   iwn_free_rx_ring(sc, ring);
     return error;
 }
 
@@ -1359 +1432 @@
             DELAY(10);
         }
         iwn_nic_unlock(sc);
-#ifdef IWN_DEBUG
-        if (ntries == 1000)
-            DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
-                "timeout resetting Rx ring");
-#endif
     }
     ring->cur = 0;
     sc->last_rx_valid = 0;
@@ -1385 +1453 @@
                 BUS_DMASYNC_POSTREAD);
             bus_dmamap_unload(ring->data_dmat, data->map);
             m_freem(data->m);
+            data->m = NULL;
         }
         if (data->map != NULL)
             bus_dmamap_destroy(ring->data_dmat, data->map);
     }
+    if (ring->data_dmat != NULL) {
+        bus_dma_tag_destroy(ring->data_dmat);
+        ring->data_dmat = NULL;
+    }
 }
 
 static int
 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
 {
-    bus_size_t size;
     bus_addr_t paddr;
+    bus_size_t size;
     int i, error;
 
     ring->qid = qid;
     ring->queued = 0;
     ring->cur = 0;
 
-    /* Allocate TX descriptors (256-byte aligned.) */
-    size = IWN_TX_RING_COUNT * sizeof(struct iwn_tx_desc);
-    error = iwn_dma_contig_alloc(sc, &ring->desc_dma,
-        (void **)&ring->desc, size, 256, BUS_DMA_NOWAIT);
+    /* Allocate TX descriptors (256-byte aligned). */
+    size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
+    error = iwn_dma_contig_alloc(sc, &ring->desc_dma, (void **)&ring->desc,
+        size, 256);
     if (error != 0) {
         device_printf(sc->sc_dev,
             "%s: could not allocate TX ring DMA memory, error %d\n",
             __func__, error);
         goto fail;
     }
-
     /*
      * We only use rings 0 through 4 (4 EDCA + cmd) so there is no need
      * to allocate commands space for other rings.
+     * XXX Do we really need to allocate descriptors for other rings?
      */
     if (qid > 4)
         return 0;
 
-    size = IWN_TX_RING_COUNT * sizeof(struct iwn_tx_cmd);
-    error = iwn_dma_contig_alloc(sc, &ring->cmd_dma,
-        (void **)&ring->cmd, size, 4, BUS_DMA_NOWAIT);
+    size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_cmd);
+    error = iwn_dma_contig_alloc(sc, &ring->cmd_dma, (void **)&ring->cmd,
+        size, 4);
     if (error != 0) {
         device_printf(sc->sc_dev,
             "%s: could not allocate TX cmd DMA memory, error %d\n",
@@ -1431 +1504 @@
     }
 
     error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
-        BUS_SPACE_MAXADDR_32BIT,
-        BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWN_MAX_SCATTER - 1,
-        MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL, &ring->data_dmat);
+        BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
+        IWN_MAX_SCATTER - 1, MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL,
+        &ring->data_dmat);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: bus_dma_tag_create_failed, error %d\n",
+            "%s: could not create TX buf DMA tag, error %d\n",
             __func__, error);
         goto fail;
     }
@@ -1452 +1525 @@
         error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
         if (error != 0) {
             device_printf(sc->sc_dev,
-                "%s: bus_dmamap_create failed, error %d\n",
+                "%s: could not create TX buf DMA map, error %d\n",
                 __func__, error);
             goto fail;
         }
-        bus_dmamap_sync(ring->data_dmat, data->map,
-            BUS_DMASYNC_PREWRITE);
     }
     return 0;
-fail:
-    iwn_free_tx_ring(sc, ring);
+
+fail:   iwn_free_tx_ring(sc, ring);
     return error;
 }
 
@@ -1474 +1545 @@
         struct iwn_tx_data *data = &ring->data[i];
 
         if (data->m != NULL) {
+            bus_dmamap_sync(ring->data_dmat, data->map,
+                BUS_DMASYNC_POSTWRITE);
             bus_dmamap_unload(ring->data_dmat, data->map);
             m_freem(data->m);
             data->m = NULL;
@@ -1508 +1581 @@
         if (data->map != NULL)
             bus_dmamap_destroy(ring->data_dmat, data->map);
     }
+    if (ring->data_dmat != NULL) {
+        bus_dma_tag_destroy(ring->data_dmat);
+        ring->data_dmat = NULL;
+    }
 }
 
 static void
@@ -1520 +1597 @@
     memset(sc->ict, 0, IWN_ICT_SIZE);
     sc->ict_cur = 0;
 
-    /* Set physical address of ICT table (4KB aligned.) */
+    /* Set physical address of ICT table (4KB aligned). */
     DPRINTF(sc, IWN_DEBUG_RESET, "%s: enabling ICT\n", __func__);
     IWN_WRITE(sc, IWN_DRAM_INT_TBL, IWN_DRAM_INT_TBL_ENABLE |
         IWN_DRAM_INT_TBL_WRAP_CHECK | sc->ict_dma.paddr >> 12);
@@ -1538 +1615 @@
 static int
 iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
 {
-    const struct iwn_hal *hal = sc->sc_hal;
-    int error;
+    struct iwn_ops *ops = &sc->ops;
     uint16_t val;
+    int error;
 
     /* Check whether adapter has an EEPROM or an OTPROM. */
     if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
@@ -1550 +1627 @@
         (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
 
     /* Adapter has to be powered on for EEPROM access to work. */
-    error = iwn_apm_init(sc);
-    if (error != 0) {
+    if ((error = iwn_apm_init(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not power ON adapter, error %d\n",
-            __func__, error);
+            "%s: could not power ON adapter, error %d\n", __func__,
+            error);
         return error;
     }
 
@@ -1562 +1638 @@
         device_printf(sc->sc_dev, "%s: bad ROM signature\n", __func__);
         return EIO;
     }
-    error = iwn_eeprom_lock(sc);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: could not lock ROM, error %d\n",
+    if ((error = iwn_eeprom_lock(sc)) != 0) {
+        device_printf(sc->sc_dev, "%s: could not lock ROM, error %d\n",
             __func__, error);
         return error;
     }
-
     if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
-        error = iwn_init_otprom(sc);
-        if (error != 0) {
+        if ((error = iwn_init_otprom(sc)) != 0) {
             device_printf(sc->sc_dev,
                 "%s: could not initialize OTPROM, error %d\n",
                 __func__, error);
@@ -1580 +1652 @@
         }
     }
 
+    iwn_read_prom_data(sc, IWN_EEPROM_SKU_CAP, &val, 2);
+    DPRINTF(sc, IWN_DEBUG_RESET, "SKU capabilities=0x%04x\n", le16toh(val));
+    /* Check if HT support is bonded out. */
+    if (val & htole16(IWN_EEPROM_SKU_CAP_11N))
+        sc->sc_flags |= IWN_FLAG_HAS_11N;
+
     iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
     sc->rfcfg = le16toh(val);
     DPRINTF(sc, IWN_DEBUG_RESET, "radio config=0x%04x\n", sc->rfcfg);
+    /* Read Tx/Rx chains from ROM unless it's known to be broken. */
+    if (sc->txchainmask == 0)
+        sc->txchainmask = IWN_RFCFG_TXANTMSK(sc->rfcfg);
+    if (sc->rxchainmask == 0)
+        sc->rxchainmask = IWN_RFCFG_RXANTMSK(sc->rfcfg);
 
     /* Read MAC address. */
     iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
 
     /* Read adapter-specific information from EEPROM. */
-    hal->read_eeprom(sc);
+    ops->read_eeprom(sc);
 
     iwn_apm_stop(sc);   /* Power OFF adapter. */
 
@@ -1600 +1683 @@
 iwn4965_read_eeprom(struct iwn_softc *sc)
 {
     uint32_t addr;
-    int i;
     uint16_t val;
+    int i;
 
-    /* Read regulatory domain (4 ASCII characters.) */
+    /* Read regulatory domain (4 ASCII characters). */
     iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
 
-    /* Read the list of authorized channels (20MHz ones only.) */
+    /* Read the list of authorized channels (20MHz ones only). */
     for (i = 0; i < 5; i++) {
         addr = iwn4965_regulatory_bands[i];
         iwn_read_eeprom_channels(sc, i, addr);
@@ -1682 +1765 @@
 iwn5000_read_eeprom(struct iwn_softc *sc)
 {
     struct iwn5000_eeprom_calib_hdr hdr;
-    int32_t temp, volt;
-    uint32_t addr, base;
-    int i;
+    int32_t volt;
+    uint32_t base, addr;
     uint16_t val;
+    int i;
 
-    /* Read regulatory domain (4 ASCII characters.) */
+    /* Read regulatory domain (4 ASCII characters). */
     iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
     base = le16toh(val);
     iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
         sc->eeprom_domain, 4);
 
-    /* Read the list of authorized channels (20MHz ones only.) */
+    /* Read the list of authorized channels (20MHz ones only). */
     for (i = 0; i < 5; i++) {
         addr = base + iwn5000_regulatory_bands[i];
         iwn_read_eeprom_channels(sc, i, addr);
@@ -1707 +1790 @@
     base = le16toh(val);
     iwn_read_prom_data(sc, base, &hdr, sizeof hdr);
     DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-        "%s: calib version=%u pa type=%u voltage=%u\n",
-        __func__, hdr.version, hdr.pa_type, le16toh(hdr.volt));
+        "%s: calib version=%u pa type=%u voltage=%u\n", __func__,
+        hdr.version, hdr.pa_type, le16toh(hdr.volt));
     sc->calib_ver = hdr.version;
 
     if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
         /* Compute temperature offset. */
         iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
-        temp = le16toh(val);
+        sc->eeprom_temp = le16toh(val);
         iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
         volt = le16toh(val);
-        sc->temp_off = temp - (volt / -5);
+        sc->temp_off = sc->eeprom_temp - (volt / -5);
         DPRINTF(sc, IWN_DEBUG_CALIBRATE, "temp=%d volt=%d offset=%dK\n",
-            temp, volt, sc->temp_off);
+            sc->eeprom_temp, volt, sc->temp_off);
+    } else {
+        /* Read crystal calibration. */
+        iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
+            &sc->eeprom_crystal, sizeof (uint32_t));
+        DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
+            le32toh(sc->eeprom_crystal));
     }
 }
 
@@ -1753 +1842 @@
     struct iwn_eeprom_chan *channels = sc->eeprom_channels[n];
     const struct iwn_chan_band *band = &iwn_bands[n];
     struct ieee80211_channel *c;
-    int i, chan, nflags;
+    uint8_t chan;
+    int i, nflags;
 
     for (i = 0; i < band->nchan; i++) {
         if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
@@ -1766 +1856 @@
         chan = band->chan[i];
         nflags = iwn_eeprom_channel_flags(&channels[i]);
 
-        DPRINTF(sc, IWN_DEBUG_RESET,
-            "add chan %d flags 0x%x maxpwr %d\n",
-            chan, channels[i].flags, channels[i].maxpwr);
-
         c = &ic->ic_channels[ic->ic_nchans++];
         c->ic_ieee = chan;
         c->ic_maxregpower = channels[i].maxpwr;
         c->ic_maxpower = 2*c->ic_maxregpower;
 
-        /* Save maximum allowed TX power for this channel. */
-        sc->maxpwr[chan] = channels[i].maxpwr;
-
         if (n == 0) {   /* 2GHz band */
-            c->ic_freq = ieee80211_ieee2mhz(chan,
-                IEEE80211_CHAN_G);
-
+            c->ic_freq = ieee80211_ieee2mhz(chan, IEEE80211_CHAN_G);
             /* G =>'s B is supported */
             c->ic_flags = IEEE80211_CHAN_B | nflags;
-
             c = &ic->ic_channels[ic->ic_nchans++];
             c[0] = c[-1];
             c->ic_flags = IEEE80211_CHAN_G | nflags;
         } else {    /* 5GHz band */
-            c->ic_freq = ieee80211_ieee2mhz(chan,
-                IEEE80211_CHAN_A);
+            c->ic_freq = ieee80211_ieee2mhz(chan, IEEE80211_CHAN_A);
             c->ic_flags = IEEE80211_CHAN_A | nflags;
-            sc->sc_flags |= IWN_FLAG_HAS_5GHZ;
         }
+
+        /* Save maximum allowed TX power for this channel. */
+        sc->maxpwr[chan] = channels[i].maxpwr;
+
+        DPRINTF(sc, IWN_DEBUG_RESET,
+            "add chan %d flags 0x%x maxpwr %d\n", chan,
+            channels[i].flags, channels[i].maxpwr);
+
 #if 0   /* HT */
         /* XXX no constraints on using HT20 */
         /* add HT20, HT40 added separately */
@@ -1882 +1968 @@
     ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
 }
 
-#define nitems(_a)  (sizeof((_a)) / sizeof((_a)[0]))
+static struct iwn_eeprom_chan *
+iwn_find_eeprom_channel(struct iwn_softc *sc, struct ieee80211_channel *c)
+{
+    int i, j;
+
+    for (j = 0; j < 7; j++) {
+        for (i = 0; i < iwn_bands[j].nchan; i++) {
+            if (iwn_bands[j].chan[i] == c->ic_ieee)
+                return &sc->eeprom_channels[j][i];
+        }
+    }
+
+    return NULL;
+}
+
+/*
+ * Enforce flags read from EEPROM.
+ */
+static int
+iwn_setregdomain(struct ieee80211com *ic, struct ieee80211_regdomain *rd,
+    int nchan, struct ieee80211_channel chans[])
+{
+    struct iwn_softc *sc = ic->ic_ifp->if_softc;
+    int i;
+
+    for (i = 0; i < nchan; i++) {
+        struct ieee80211_channel *c = &chans[i];
+        struct iwn_eeprom_chan *channel;
+
+        channel = iwn_find_eeprom_channel(sc, c);
+        if (channel == NULL) {
+            if_printf(ic->ic_ifp,
+                "%s: invalid channel %u freq %u/0x%x\n",
+                __func__, c->ic_ieee, c->ic_freq, c->ic_flags);
+            return EINVAL;
+        }
+        c->ic_flags |= iwn_eeprom_channel_flags(channel);
+    }
+
+    return 0;
+}
 
 static void
 iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
@@ -1927 +2053 @@
     return malloc(sizeof (struct iwn_node), M_80211_NODE,M_NOWAIT | M_ZERO);
 }
 
+static void
+iwn_newassoc(struct ieee80211_node *ni, int isnew)
+{
+    struct iwn_node *wn = (void *)ni;
+    int ridx, i;
+
+    for (i = 0; i < ni->ni_rates.rs_nrates; i++) {
+        ridx = iwn_plcp_signal(ni->ni_rates.rs_rates[i]);
+        wn->ridx[i] = ridx;
+    }
+}
+
 static int
 iwn_media_change(struct ifnet *ifp)
 {
-    int error = ieee80211_media_change(ifp);
+    int error;
+
+    error = ieee80211_media_change(ifp);
     /* NB: only the fixed rate can change and that doesn't need a reset */
     return (error == ENETRESET ? 0 : error);
 }
@@ -1941 +2081 @@
     struct iwn_vap *ivp = IWN_VAP(vap);
     struct ieee80211com *ic = vap->iv_ic;
     struct iwn_softc *sc = ic->ic_ifp->if_softc;
-    int error;
+    int error = 0;
 
     DPRINTF(sc, IWN_DEBUG_STATE, "%s: %s -> %s\n", __func__,
-        ieee80211_state_name[vap->iv_state],
-        ieee80211_state_name[nstate]);
+        ieee80211_state_name[vap->iv_state], ieee80211_state_name[nstate]);
 
     IEEE80211_UNLOCK(ic);
     IWN_LOCK(sc);
-    callout_stop(&sc->sc_timer_to);
+    callout_stop(&sc->calib_to);
 
     switch (nstate) {
     case IEEE80211_S_ASSOC:
@@ -1966 +2105 @@
          */
         sc->rxon.associd = 0;
         sc->rxon.filter &= ~htole32(IWN_FILTER_BSS);
-        iwn_calib_reset(sc);
-        error = iwn_auth(sc, vap);
+        sc->calib.state = IWN_CALIB_STATE_INIT;
+
+        if ((error = iwn_auth(sc, vap)) != 0) {
+            device_printf(sc->sc_dev,
+                "%s: could not move to auth state\n", __func__);
+        }
         break;
 
     case IEEE80211_S_RUN:
         /*
          * RUN -> RUN transition; Just restart the timers.
          */
-        if (vap->iv_state == IEEE80211_S_RUN &&
-            vap->iv_opmode != IEEE80211_M_MONITOR) {
-            iwn_calib_reset(sc);
+        if (vap->iv_state == IEEE80211_S_RUN) {
+            sc->calib_cnt = 0;
             break;
         }
 
@@ -1985 +2127 @@
          * which is done with a firmware cmd.  We also defer
          * starting the timers until that work is done.
          */
-        error = iwn_run(sc, vap);
+        if ((error = iwn_run(sc, vap)) != 0) {
+            device_printf(sc->sc_dev,
+                "%s: could not move to run state\n", __func__);
+        }
+        break;
+
+    case IEEE80211_S_INIT:
+        sc->calib.state = IWN_CALIB_STATE_INIT;
         break;
 
     default:
@@ -1993 +2142 @@
     }
     IWN_UNLOCK(sc);
     IEEE80211_LOCK(ic);
+    if (error != 0)
+        return error;
     return ivp->iv_newstate(vap, nstate, arg);
 }
 
+static void
+iwn_calib_timeout(void *arg)
+{
+    struct iwn_softc *sc = arg;
+
+    IWN_LOCK_ASSERT(sc);
+
+    /* Force automatic TX power calibration every 60 secs. */
+    if (++sc->calib_cnt >= 120) {
+        uint32_t flags = 0;
+
+        DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s\n",
+            "sending request for statistics");
+        (void)iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
+            sizeof flags, 1);
+        sc->calib_cnt = 0;
+    }
+    callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
+        sc);
+}
+
 /*
  * Process an RX_PHY firmware notification.  This is usually immediately
  * followed by an MPDU_RX_DONE notification.
@@ -2014 +2186 @@
     sc->last_rx_valid = 1;
 }
 
-static void
-iwn_timer_timeout(void *arg)
-{
-    struct iwn_softc *sc = arg;
-    uint32_t flags = 0;
-
-    IWN_LOCK_ASSERT(sc);
-
-    if (sc->calib_cnt && --sc->calib_cnt == 0) {
-        DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s\n",
-            "send statistics request");
-        (void) iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
-            sizeof flags, 1);
-        sc->calib_cnt = 60; /* do calibration every 60s */
-    }
-    iwn_watchdog(sc);       /* NB: piggyback tx watchdog */
-    callout_reset(&sc->sc_timer_to, hz, iwn_timer_timeout, sc);
-}
-
-static void
-iwn_calib_reset(struct iwn_softc *sc)
-{
-    callout_reset(&sc->sc_timer_to, hz, iwn_timer_timeout, sc);
-    sc->calib_cnt = 60;     /* do calibration every 60s */
-}
-
 /*
  * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
  * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
@@ -2048 +2194 @@
 iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
     struct iwn_rx_data *data)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
     struct iwn_rx_ring *ring = &sc->rxq;
@@ -2066 +2212 @@
         if (!sc->last_rx_valid) {
             DPRINTF(sc, IWN_DEBUG_ANY,
                 "%s: missing RX_PHY\n", __func__);
-            ifp->if_ierrors++;
             return;
         }
         sc->last_rx_valid = 0;
@@ -2078 +2223 @@
 
     if (stat->cfg_phy_len > IWN_STAT_MAXLEN) {
         device_printf(sc->sc_dev,
-            "%s: invalid rx statistic header, len %d\n",
-            __func__, stat->cfg_phy_len);
-        ifp->if_ierrors++;
+            "%s: invalid RX statistic header, len %d\n", __func__,
+            stat->cfg_phy_len);
         return;
     }
     if (desc->type == IWN_MPDU_RX_DONE) {
@@ -2096 +2240 @@
 
     /* Discard frames with a bad FCS early. */
     if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
-        DPRINTF(sc, IWN_DEBUG_RECV, "%s: rx flags error %x\n",
+        DPRINTF(sc, IWN_DEBUG_RECV, "%s: RX flags error %x\n",
             __func__, flags);
         ifp->if_ierrors++;
         return;
@@ -2109 +2253 @@
         return;
     }
 
-    /* XXX don't need mbuf, just dma buffer */
-    m1 = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
+    m1 = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, IWN_RBUF_SIZE);
     if (m1 == NULL) {
         DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
             __func__);
@@ -2119 +2262 @@
     }
     bus_dmamap_unload(ring->data_dmat, data->map);
 
-    error = bus_dmamap_load(ring->data_dmat, data->map,
-        mtod(m1, caddr_t), MJUMPAGESIZE,
-        iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
+    error = bus_dmamap_load(ring->data_dmat, data->map, mtod(m1, void *),
+        IWN_RBUF_SIZE, iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
     if (error != 0 && error != EFBIG) {
         device_printf(sc->sc_dev,
             "%s: bus_dmamap_load failed, error %d\n", __func__, error);
         m_freem(m1);
+
+        /* Try to reload the old mbuf. */
+        error = bus_dmamap_load(ring->data_dmat, data->map,
+            mtod(data->m, void *), IWN_RBUF_SIZE, iwn_dma_map_addr,
+            &paddr, BUS_DMA_NOWAIT);
+        if (error != 0 && error != EFBIG) {
+            panic("%s: could not load old RX mbuf", __func__);
+        }
+        /* Physical address may have changed. */
+        ring->desc[ring->cur] = htole32(paddr >> 8);
+        bus_dmamap_sync(ring->data_dmat, ring->desc_dma.map,
+            BUS_DMASYNC_PREWRITE);
         ifp->if_ierrors++;
         return;
     }
@@ -2142 +2296 @@
     m->m_data = head;
     m->m_pkthdr.len = m->m_len = len;
 
-    rssi = hal->get_rssi(sc, stat);
-
     /* Grab a reference to the source node. */
     wh = mtod(m, struct ieee80211_frame *);
     ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
     nf = (ni != NULL && ni->ni_vap->iv_state == IEEE80211_S_RUN &&
         (ic->ic_flags & IEEE80211_F_SCAN) == 0) ? sc->noise : -95;
 
+    rssi = ops->get_rssi(sc, stat);
+
     if (ieee80211_radiotap_active(ic)) {
         struct iwn_rx_radiotap_header *tap = &sc->sc_rxtap;
 
-        tap->wr_tsft = htole64(stat->tstamp);
         tap->wr_flags = 0;
         if (stat->flags & htole16(IWN_STAT_FLAG_SHPREAMBLE))
             tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
+        tap->wr_dbm_antsignal = (int8_t)rssi;
+        tap->wr_dbm_antnoise = (int8_t)nf;
+        tap->wr_tsft = stat->tstamp;
         switch (stat->rate) {
         /* CCK rates. */
         case  10: tap->wr_rate =   2; break;
@@ -2175 +2331 @@
         /* Unknown rate: should not happen. */
         default:  tap->wr_rate =   0;
         }
-        tap->wr_dbm_antsignal = rssi;
-        tap->wr_dbm_antnoise = nf;
     }
 
     IWN_UNLOCK(sc);
 
     /* Send the frame to the 802.11 layer. */
     if (ni != NULL) {
-        (void) ieee80211_input(ni, m, rssi - nf, nf);
+        (void)ieee80211_input(ni, m, rssi - nf, nf);
         /* Node is no longer needed. */
         ieee80211_free_node(ni);
     } else
-        (void) ieee80211_input_all(ic, m, rssi - nf, nf);
+        (void)ieee80211_input_all(ic, m, rssi - nf, nf);
 
     IWN_LOCK(sc);
 }
@@ -2201 +2355 @@
     struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1);
     struct iwn_tx_ring *txq;
 
+    bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
+
     txq = &sc->txq[letoh16(ba->qid)];
     /* XXX TBD */
 }
 #endif
 
 /*
+ * Process a CALIBRATION_RESULT notification sent by the initialization
+ * firmware on response to a CMD_CALIB_CONFIG command (5000 only).
+ */
+static void
+iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
+{
+    struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
+    int len, idx = -1;
+
+    /* Runtime firmware should not send such a notification. */
+    if (sc->sc_flags & IWN_FLAG_CALIB_DONE)
+        return;
+
+    len = (le32toh(desc->len) & 0x3fff) - 4;
+    bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
+
+    switch (calib->code) {
+    case IWN5000_PHY_CALIB_DC:
+        if ((sc->sc_flags & IWN_FLAG_INTERNAL_PA) == 0 &&
+            (sc->hw_type == IWN_HW_REV_TYPE_5150 ||
+             sc->hw_type >= IWN_HW_REV_TYPE_6000))
+            idx = 0;
+        break;
+    case IWN5000_PHY_CALIB_LO:
+        idx = 1;
+        break;
+    case IWN5000_PHY_CALIB_TX_IQ:
+        idx = 2;
+        break;
+    case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
+        if (sc->hw_type < IWN_HW_REV_TYPE_6000 &&
+            sc->hw_type != IWN_HW_REV_TYPE_5150)
+            idx = 3;
+        break;
+    case IWN5000_PHY_CALIB_BASE_BAND:
+        idx = 4;
+        break;
+    }
+    if (idx == -1)  /* Ignore other results. */
+        return;
+
+    /* Save calibration result. */
+    if (sc->calibcmd[idx].buf != NULL)
+        free(sc->calibcmd[idx].buf, M_DEVBUF);
+    sc->calibcmd[idx].buf = malloc(len, M_DEVBUF, M_NOWAIT);
+    if (sc->calibcmd[idx].buf == NULL) {
+        DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+            "not enough memory for calibration result %d\n",
+            calib->code);
+        return;
+    }
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+        "saving calibration result code=%d len=%d\n", calib->code, len);
+    sc->calibcmd[idx].len = len;
+    memcpy(sc->calibcmd[idx].buf, calib, len);
+}
+
+/*
  * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
  * The latter is sent by the firmware after each received beacon.
  */
@@ -2214 +2429 @@
 iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc,
     struct iwn_rx_data *data)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
@@ -2222 +2437 @@
     struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
     int temp;
 
-    /* Beacon stats are meaningful only when associated and not scanning. */
+    /* Ignore statistics received during a scan. */
     if (vap->iv_state != IEEE80211_S_RUN ||
         (ic->ic_flags & IEEE80211_F_SCAN))
         return;
 
     bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
-    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: cmd %d\n", __func__, desc->type);
-    iwn_calib_reset(sc);    /* Reset TX power calibration timeout. */
+
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: received statistics, cmd %d\n",
+        __func__, desc->type);
+    sc->calib_cnt = 0;  /* Reset TX power calibration timeout. */
 
     /* Test if temperature has changed. */
     if (stats->general.temp != sc->rawtemp) {
         /* Convert "raw" temperature to degC. */
         sc->rawtemp = stats->general.temp;
-        temp = hal->get_temperature(sc);
+        temp = ops->get_temperature(sc);
         DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d\n",
             __func__, temp);
 
-        /* Update TX power if need be (4965AGN only.) */
+        /* Update TX power if need be (4965AGN only). */
         if (sc->hw_type == IWN_HW_REV_TYPE_4965)
             iwn4965_power_calibration(sc, temp);
     }
@@ -2355 +2572 @@
     /*
      * Update rate control statistics for the node.
      */
-    if (status & 0x80) {
+    if (status & IWN_TX_FAIL) {
         ifp->if_oerrors++;
         ieee80211_ratectl_tx_complete(vap, ni,
             IEEE80211_RATECTL_TX_FAILURE, &ackfailcnt, NULL);
     } else {
+        ifp->if_opackets++;
         ieee80211_ratectl_tx_complete(vap, ni,
             IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
     }
@@ -2394 +2612 @@
 
     /* If the command was mapped in an mbuf, free it. */
     if (data->m != NULL) {
+        bus_dmamap_sync(ring->data_dmat, data->map,
+            BUS_DMASYNC_POSTWRITE);
         bus_dmamap_unload(ring->data_dmat, data->map);
         m_freem(data->m);
         data->m = NULL;
@@ -2407 +2627 @@
 static void
 iwn_notif_intr(struct iwn_softc *sc)
 {
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
@@ -2453 +2674 @@
 
         case IWN_TX_DONE:
             /* An 802.11 frame has been transmitted. */
-            sc->sc_hal->tx_done(sc, desc, data);
+            ops->tx_done(sc, desc, data);
             break;
 
         case IWN_RX_STATISTICS:
@@ -2471 +2692 @@
                 BUS_DMASYNC_POSTREAD);
             misses = le32toh(miss->consecutive);
 
-            /* XXX not sure why we're notified w/ zero */
-            if (misses == 0)
-                break;
             DPRINTF(sc, IWN_DEBUG_STATE,
                 "%s: beacons missed %d/%d\n", __func__,
                 misses, le32toh(miss->total));
-
             /*
              * If more than 5 consecutive beacons are missed,
              * reinitialize the sensitivity state machine.
              */
-            if (vap->iv_state == IEEE80211_S_RUN && misses > 5)
-                (void) iwn_init_sensitivity(sc);
-            if (misses >= vap->iv_bmissthreshold) {
-                IWN_UNLOCK(sc);
-                ieee80211_beacon_miss(ic);
-                IWN_LOCK(sc);
+            if (vap->iv_state == IEEE80211_S_RUN &&
+                (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
+                if (misses > 5)
+                    (void)iwn_init_sensitivity(sc);
+                if (misses >= vap->iv_bmissthreshold) {
+                    IWN_UNLOCK(sc);
+                    ieee80211_beacon_miss(ic);
+                    IWN_LOCK(sc);
+                }
             }
             break;
         }
@@ -2561 +2781 @@
             break;
         }
         case IWN5000_CALIBRATION_RESULT:
-            iwn5000_rx_calib_result(sc, desc, data);
+            iwn5000_rx_calib_results(sc, desc, data);
             break;
 
         case IWN5000_CALIBRATION_DONE:
@@ -2592 +2812 @@
 
     /* Wakeup RX and TX rings. */
     IWN_WRITE(sc, IWN_FH_RX_WPTR, sc->rxq.cur & ~7);
-    for (qid = 0; qid < sc->sc_hal->ntxqs; qid++) {
+    for (qid = 0; qid < sc->ntxqs; qid++) {
         struct iwn_tx_ring *ring = &sc->txq[qid];
         IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | ring->cur);
     }
@@ -2623 +2843 @@
 static void
 iwn_fatal_intr(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
     struct iwn_fw_dump dump;
     int i;
 
@@ -2635 +2854 @@
     /* Check that the error log address is valid. */
     if (sc->errptr < IWN_FW_DATA_BASE ||
         sc->errptr + sizeof (dump) >
-        IWN_FW_DATA_BASE + hal->fw_data_maxsz) {
-        printf("%s: bad firmware error log address 0x%08x\n",
-            __func__, sc->errptr);
+        IWN_FW_DATA_BASE + sc->fw_data_maxsz) {
+        printf("%s: bad firmware error log address 0x%08x\n", __func__,
+            sc->errptr);
         return;
     }
     if (iwn_nic_lock(sc) != 0) {
-        printf("%s: could not read firmware error log\n",
-            __func__);
+        printf("%s: could not read firmware error log\n", __func__);
         return;
     }
     /* Read firmware error log from SRAM. */
@@ -2651 +2869 @@
     iwn_nic_unlock(sc);
 
     if (dump.valid == 0) {
-        printf("%s: firmware error log is empty\n",
-            __func__);
+        printf("%s: firmware error log is empty\n", __func__);
         return;
     }
     printf("firmware error log:\n");
@@ -2672 +2889 @@
 
     /* Dump driver status (TX and RX rings) while we're here. */
     printf("driver status:\n");
-    for (i = 0; i < hal->ntxqs; i++) {
+    for (i = 0; i < sc->ntxqs; i++) {
         struct iwn_tx_ring *ring = &sc->txq[i];
         printf("  tx ring %2d: qid=%-2d cur=%-3d queued=%-3d\n",
             i, ring->qid, ring->cur, ring->queued);
@@ -2733 +2950 @@
             __func__);
     }
     if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
+        device_printf(sc->sc_dev, "%s: fatal firmware error\n",
+            __func__);
+        /* Dump firmware error log and stop. */
         iwn_fatal_intr(sc);
         ifp->if_flags &= ~IFF_UP;
         iwn_stop_locked(sc);
@@ -2776 +2996 @@
 
 /*
  * Update TX scheduler ring when transmitting an 802.11 frame (4965AGN and
- * 5000 adapters use a slightly different format.)
+ * 5000 adapters use a slightly different format).
  */
 static void
 iwn4965_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
@@ -2801 +3021 @@
     uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
 
     *w = htole16(id << 12 | (len + 8));
-
     bus_dmamap_sync(sc->sched_dma.tag, sc->sched_dma.map,
         BUS_DMASYNC_PREWRITE);
     if (idx < IWN_SCHED_WINSZ) {
@@ -2833 +3052 @@
     int i;
 
     for (i = 0; i < IWN_RIDX_MAX + 1; i++) {
-        if (rate == iwn_rates[i].rate)
+        if ((rate & IEEE80211_RATE_VAL) == iwn_rates[i].rate)
             return i;
     }
 
@@ -2841 +3060 @@
 }
 
 static int
-iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
-    struct iwn_tx_ring *ring)
+iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
     const struct ieee80211_txparam *tp;
-    const struct iwn_rate *rinfo;
     struct ieee80211vap *vap = ni->ni_vap;
     struct ieee80211com *ic = ni->ni_ic;
     struct iwn_node *wn = (void *)ni;
+    struct iwn_tx_ring *ring;
     struct iwn_tx_desc *desc;
     struct iwn_tx_data *data;
     struct iwn_tx_cmd *cmd;
     struct iwn_cmd_data *tx;
+    const struct iwn_rate *rinfo;
     struct ieee80211_frame *wh;
     struct ieee80211_key *k = NULL;
-    struct mbuf *mnew;
-    bus_dma_segment_t segs[IWN_MAX_SCATTER];
+    struct mbuf *m1;
     uint32_t flags;
+    uint16_t qos;
     u_int hdrlen;
-    int totlen, error, pad, nsegs = 0, i, rate;
-    uint8_t ridx, type, txant;
+    bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
+    uint8_t tid, ridx, txant, type;
+    int ac, i, totlen, error, pad, nsegs = 0, rate;
 
     IWN_LOCK_ASSERT(sc);
 
@@ -2869 +3088 @@
     hdrlen = ieee80211_anyhdrsize(wh);
     type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 
+    /* Select EDCA Access Category and TX ring for this frame. */
+    if (IEEE80211_QOS_HAS_SEQ(wh)) {
+        qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
+        tid = qos & IEEE80211_QOS_TID;
+    } else {
+        qos = 0;
+        tid = 0;
+    }
+    ac = M_WME_GETAC(m);
+
+    ring = &sc->txq[ac];
     desc = &ring->desc[ring->cur];
     data = &ring->data[ring->cur];
 
@@ -2890 +3120 @@
 
     /* Encrypt the frame if need be. */
     if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
+        /* Retrieve key for TX. */
         k = ieee80211_crypto_encap(ni, m);
         if (k == NULL) {
             m_freem(m);
             return ENOBUFS;
         }
-        /* Packet header may have moved, reset our local pointer. */
+        /* 802.11 header may have moved. */
         wh = mtod(m, struct ieee80211_frame *);
     }
     totlen = m->m_pkthdr.len;
@@ -2923 +3154 @@
     tx->scratch = 0;    /* clear "scratch" area */
 
     flags = 0;
-    if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
-        flags |= IWN_TX_NEED_ACK;
+    if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+        /* Unicast frame, check if an ACK is expected. */
+        if (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
+            IEEE80211_QOS_ACKPOLICY_NOACK)
+            flags |= IWN_TX_NEED_ACK;
+    }
     if ((wh->i_fc[0] &
         (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
         (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_BAR))
@@ -2957 +3192 @@
 
     if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
         type != IEEE80211_FC0_TYPE_DATA)
-        tx->id = hal->broadcast_id;
+        tx->id = sc->broadcast_id;
     else
         tx->id = wn->id;
 
@@ -2967 +3202 @@
         /* Tell HW to set timestamp in probe responses. */
         if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
             flags |= IWN_TX_INSERT_TSTAMP;
-
         if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
             subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
             tx->timeout = htole16(3);
@@ -2984 +3218 @@
         pad = 0;
 
     tx->len = htole16(totlen);
-    tx->tid = 0;
+    tx->tid = tid;
     tx->rts_ntries = 60;
     tx->data_ntries = 15;
     tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
     tx->plcp = rinfo->plcp;
     tx->rflags = rinfo->flags;
-    if (tx->id == hal->broadcast_id) {
+    if (tx->id == sc->broadcast_id) {
         /* Group or management frame. */
         tx->linkq = 0;
         /* XXX Alternate between antenna A and B? */
         txant = IWN_LSB(sc->txchainmask);
         tx->rflags |= IWN_RFLAG_ANT(txant);
     } else {
-        tx->linkq = IWN_RIDX_OFDM54 - ridx;
+        tx->linkq = ni->ni_rates.rs_nrates - ridx - 1;
         flags |= IWN_TX_LINKQ;  /* enable MRR */
     }
-
     /* Set physical address of "scratch area". */
     tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
     tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
@@ -3013 +3246 @@
     tx->security = 0;
     tx->flags = htole32(flags);
 
-    if (m->m_len > 0) {
-        error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map,
-            m, segs, &nsegs, BUS_DMA_NOWAIT);
-        if (error == EFBIG) {
-            /* too many fragments, linearize */
-            mnew = m_collapse(m, M_DONTWAIT, IWN_MAX_SCATTER);
-            if (mnew == NULL) {
-                device_printf(sc->sc_dev,
-                    "%s: could not defrag mbuf\n", __func__);
-                m_freem(m);
-                return ENOBUFS;
-            }
-            m = mnew;
-            error = bus_dmamap_load_mbuf_sg(ring->data_dmat,
-                data->map, m, segs, &nsegs, BUS_DMA_NOWAIT);
+    error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, segs,
+        &nsegs, BUS_DMA_NOWAIT);
+    if (error != 0) {
+        if (error != EFBIG) {
+            device_printf(sc->sc_dev,
+                "%s: can't map mbuf (error %d)\n", __func__, error);
+            m_freem(m);
+            return error;
+        }
+        /* Too many DMA segments, linearize mbuf. */
+        m1 = m_collapse(m, M_DONTWAIT, IWN_MAX_SCATTER);
+        if (m1 == NULL) {
+            device_printf(sc->sc_dev,
+                "%s: could not defrag mbuf\n", __func__);
+            m_freem(m);
+            return ENOBUFS;
         }
+        m = m1;
+
+        error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
+            segs, &nsegs, BUS_DMA_NOWAIT);
         if (error != 0) {
             device_printf(sc->sc_dev,
-                "%s: bus_dmamap_load_mbuf_sg failed, error %d\n",
-                __func__, error);
+                "%s: can't map mbuf (error %d)\n", __func__, error);
             m_freem(m);
             return error;
         }
@@ -3045 +3282 @@
         __func__, ring->qid, ring->cur, m->m_pkthdr.len, nsegs);
 
     /* Fill TX descriptor. */
-    desc->nsegs = 1 + nsegs;
+    desc->nsegs = 1;
+    if (m->m_len != 0)
+        desc->nsegs += nsegs;
     /* First DMA segment is used by the TX command. */
     desc->segs[0].addr = htole32(IWN_LOADDR(data->cmd_paddr));
     desc->segs[0].len  = htole16(IWN_HIADDR(data->cmd_paddr) |
         (4 + sizeof (*tx) + hdrlen + pad) << 4);
     /* Other DMA segments are for data payload. */
+    seg = &segs[0];
     for (i = 1; i <= nsegs; i++) {
-        desc->segs[i].addr = htole32(IWN_LOADDR(segs[i - 1].ds_addr));
-        desc->segs[i].len  = htole16(IWN_HIADDR(segs[i - 1].ds_addr) |
-            segs[i - 1].ds_len << 4);
+        desc->segs[i].addr = htole32(IWN_LOADDR(seg->ds_addr));
+        desc->segs[i].len  = htole16(IWN_HIADDR(seg->ds_addr) |
+            seg->ds_len << 4);
+        seg++;
     }
 
     bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
@@ -3065 +3306 @@
 
 #ifdef notyet
     /* Update TX scheduler. */
-    hal->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
+    ops->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
 #endif
 
     /* Kick TX ring. */
@@ -3081 +3322 @@
 
 static int
 iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m,
-    struct ieee80211_node *ni, struct iwn_tx_ring *ring,
-    const struct ieee80211_bpf_params *params)
+    struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
     const struct iwn_rate *rinfo;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211vap *vap = ni->ni_vap;
@@ -3092 +3331 @@
     struct iwn_tx_cmd *cmd;
     struct iwn_cmd_data *tx;
     struct ieee80211_frame *wh;
+    struct iwn_tx_ring *ring;
     struct iwn_tx_desc *desc;
     struct iwn_tx_data *data;
-    struct mbuf *mnew;
-    bus_addr_t paddr;
-    bus_dma_segment_t segs[IWN_MAX_SCATTER];
+    struct mbuf *m1;
+    bus_dma_segment_t *seg, segs[IWN_MAX_SCATTER];
     uint32_t flags;
     u_int hdrlen;
-    int totlen, error, pad, nsegs = 0, i, rate;
+    int ac, totlen, error, pad, nsegs = 0, i, rate;
     uint8_t ridx, type, txant;
 
     IWN_LOCK_ASSERT(sc);
@@ -3108 +3347 @@
     hdrlen = ieee80211_anyhdrsize(wh);
     type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 
+    ac = params->ibp_pri & 3;
+
+    ring = &sc->txq[ac];
     desc = &ring->desc[ring->cur];
     data = &ring->data[ring->cur];
 
@@ -3156 +3398 @@
     if (type == IEEE80211_FC0_TYPE_MGT) {
         uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 
+        /* Tell HW to set timestamp in probe responses. */
         if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
             flags |= IWN_TX_INSERT_TSTAMP;
 
@@ -3185 +3428 @@
 
     tx->len = htole16(totlen);
     tx->tid = 0;
-    tx->id = hal->broadcast_id;
+    tx->id = sc->broadcast_id;
     tx->rts_ntries = params->ibp_try1;
     tx->data_ntries = params->ibp_try0;
     tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
@@ -3196 +3439 @@
     txant = IWN_LSB(sc->txchainmask);
     tx->rflags |= IWN_RFLAG_ANT(txant);
     /* Set physical address of "scratch area". */
-    paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
-    tx->loaddr = htole32(IWN_LOADDR(paddr));
-    tx->hiaddr = IWN_HIADDR(paddr);
+    tx->loaddr = htole32(IWN_LOADDR(data->scratch_paddr));
+    tx->hiaddr = IWN_HIADDR(data->scratch_paddr);
 
     /* Copy 802.11 header in TX command. */
     memcpy((uint8_t *)(tx + 1), wh, hdrlen);
@@ -3208 +3450 @@
     tx->security = 0;
     tx->flags = htole32(flags);
 
-    if (m->m_len > 0) {
-        error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map,
-            m, segs, &nsegs, BUS_DMA_NOWAIT);
-        if (error == EFBIG) {
-            /* Too many fragments, linearize. */
-            mnew = m_collapse(m, M_DONTWAIT, IWN_MAX_SCATTER);
-            if (mnew == NULL) {
-                device_printf(sc->sc_dev,
-                    "%s: could not defrag mbuf\n", __func__);
-                m_freem(m);
-                return ENOBUFS;
-            }
-            m = mnew;
-            error = bus_dmamap_load_mbuf_sg(ring->data_dmat,
-                data->map, m, segs, &nsegs, BUS_DMA_NOWAIT);
+    error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m, segs,
+        &nsegs, BUS_DMA_NOWAIT);
+    if (error != 0) {
+        if (error != EFBIG) {
+            device_printf(sc->sc_dev,
+                "%s: can't map mbuf (error %d)\n", __func__, error);
+            m_freem(m);
+            return error;
+        }
+        /* Too many DMA segments, linearize mbuf. */
+        m1 = m_collapse(m, M_DONTWAIT, IWN_MAX_SCATTER);
+        if (m1 == NULL) {
+            device_printf(sc->sc_dev,
+                "%s: could not defrag mbuf\n", __func__);
+            m_freem(m);
+            return ENOBUFS;
         }
+        m = m1;
+
+        error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m,
+            segs, &nsegs, BUS_DMA_NOWAIT);
         if (error != 0) {
             device_printf(sc->sc_dev,
-                "%s: bus_dmamap_load_mbuf_sg failed, error %d\n",
-                __func__, error);
+                "%s: can't map mbuf (error %d)\n", __func__, error);
             m_freem(m);
             return error;
         }
@@ -3240 +3486 @@
         __func__, ring->qid, ring->cur, m->m_pkthdr.len, nsegs);
 
     /* Fill TX descriptor. */
-    desc->nsegs = 1 + nsegs;
+    desc->nsegs = 1;
+    if (m->m_len != 0)
+        desc->nsegs += nsegs;
     /* First DMA segment is used by the TX command. */
     desc->segs[0].addr = htole32(IWN_LOADDR(data->cmd_paddr));
     desc->segs[0].len  = htole16(IWN_HIADDR(data->cmd_paddr) |
         (4 + sizeof (*tx) + hdrlen + pad) << 4);
     /* Other DMA segments are for data payload. */
+    seg = &segs[0];
     for (i = 1; i <= nsegs; i++) {
-        desc->segs[i].addr = htole32(IWN_LOADDR(segs[i - 1].ds_addr));
-        desc->segs[i].len  = htole16(IWN_HIADDR(segs[i - 1].ds_addr) |
-            segs[i - 1].ds_len << 4);
+        desc->segs[i].addr = htole32(IWN_LOADDR(seg->ds_addr));
+        desc->segs[i].len  = htole16(IWN_HIADDR(seg->ds_addr) |
+            seg->ds_len << 4);
+        seg++;
     }
 
     bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
@@ -3260 +3510 @@
 
 #ifdef notyet
     /* Update TX scheduler. */
-    hal->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
+    ops->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
 #endif
 
     /* Kick TX ring. */
@@ -3276 +3526 @@
 
 static int
 iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
-    const struct ieee80211_bpf_params *params)
+    const struct ieee80211_bpf_params *params)
 {
     struct ieee80211com *ic = ni->ni_ic;
     struct ifnet *ifp = ic->ic_ifp;
     struct iwn_softc *sc = ifp->if_softc;
-    struct iwn_tx_ring *txq;
     int error = 0;
 
     if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
@@ -3291 +3540 @@
     }
 
     IWN_LOCK(sc);
-    if (params == NULL)
-        txq = &sc->txq[M_WME_GETAC(m)];
-    else
-        txq = &sc->txq[params->ibp_pri & 3];
-
     if (params == NULL) {
         /*
          * Legacy path; interpret frame contents to decide
          * precisely how to send the frame.
          */
-        error = iwn_tx_data(sc, m, ni, txq);
+        error = iwn_tx_data(sc, m, ni);
     } else {
         /*
          * Caller supplied explicit parameters to use in
          * sending the frame.
          */
-        error = iwn_tx_data_raw(sc, m, ni, txq, params);
+        error = iwn_tx_data_raw(sc, m, ni, params);
     }
     if (error != 0) {
         /* NB: m is reclaimed on tx failure */
         ieee80211_free_node(ni);
         ifp->if_oerrors++;
     }
+    sc->sc_tx_timer = 5;
+
     IWN_UNLOCK(sc);
     return error;
 }
@@ -3333 +3579 @@
 {
     struct iwn_softc *sc = ifp->if_softc;
     struct ieee80211_node *ni;
-    struct iwn_tx_ring *txq;
     struct mbuf *m;
-    int pri;
 
     IWN_LOCK_ASSERT(sc);
 
+    if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
+        (ifp->if_drv_flags & IFF_DRV_OACTIVE))
+        return;
+
     for (;;) {
         if (sc->qfullmsk != 0) {
             ifp->if_drv_flags |= IFF_DRV_OACTIVE;
@@ -3348 +3596 @@
         if (m == NULL)
             break;
         ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-        pri = M_WME_GETAC(m);
-        txq = &sc->txq[pri];
-        if (iwn_tx_data(sc, m, ni, txq) != 0) {
-            ifp->if_oerrors++;
+        if (iwn_tx_data(sc, m, ni) != 0) {
             ieee80211_free_node(ni);
-            break;
+            ifp->if_oerrors++;
+            continue;
         }
         sc->sc_tx_timer = 5;
     }
 }
 
 static void
-iwn_watchdog(struct iwn_softc *sc)
+iwn_watchdog(void *arg)
 {
-    if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
-        struct ifnet *ifp = sc->sc_ifp;
-        struct ieee80211com *ic = ifp->if_l2com;
+    struct iwn_softc *sc = arg;
+    struct ifnet *ifp = sc->sc_ifp;
+    struct ieee80211com *ic = ifp->if_l2com;
+
+    IWN_LOCK_ASSERT(sc);
+
+    KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
 
-        if_printf(ifp, "device timeout\n");
-        ieee80211_runtask(ic, &sc->sc_reinit_task);
+    if (sc->sc_tx_timer > 0) {
+        if (--sc->sc_tx_timer == 0) {
+            if_printf(ifp, "device timeout\n");
+            ieee80211_runtask(ic, &sc->sc_reinit_task);
+            return;
+        }
     }
+    callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);
 }
 
 static int
@@ -3381 +3636 @@
     int error = 0, startall = 0, stop = 0;
 
     switch (cmd) {
+    case SIOCGIFADDR:
+        error = ether_ioctl(ifp, cmd, data);
+        break;
     case SIOCSIFFLAGS:
         IWN_LOCK(sc);
         if (ifp->if_flags & IFF_UP) {
@@ -3404 +3662 @@
     case SIOCGIFMEDIA:
         error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
         break;
-    case SIOCGIFADDR:
-        error = ether_ioctl(ifp, cmd, data);
-        break;
     default:
         error = EINVAL;
         break;
@@ -3480 +3735 @@
 
 #ifdef notyet
     /* Update TX scheduler. */
-    sc->sc_hal->update_sched(sc, ring->qid, ring->cur, 0, 0);
+    ops->update_sched(sc, ring->qid, ring->cur, 0, 0);
 #endif
 
     /* Kick command ring. */
@@ -3516 +3771 @@
     return iwn_cmd(sc, IWN_CMD_ADD_NODE, node, sizeof (*node), async);
 }
 
-#if 0   /* HT */
-static const uint8_t iwn_ridx_to_plcp[] = {
-    10, 20, 55, 110, /* CCK */
-    0xd, 0xf, 0x5, 0x7, 0x9, 0xb, 0x1, 0x3, 0x3 /* OFDM R1-R4 */
-};
-static const uint8_t iwn_siso_mcs_to_plcp[] = {
-    0, 0, 0, 0,             /* CCK */
-    0, 0, 1, 2, 3, 4, 5, 6, 7   /* HT */
-};
-static const uint8_t iwn_mimo_mcs_to_plcp[] = {
-    0, 0, 0, 0,             /* CCK */
-    8, 8, 9, 10, 11, 12, 13, 14, 15 /* HT */
-};
-#endif
-static const uint8_t iwn_prev_ridx[] = {
-    /* NB: allow fallback from CCK11 to OFDM9 and from OFDM6 to CCK5 */
-    0, 0, 1, 5,         /* CCK */
-    2, 4, 3, 6, 7, 8, 9, 10, 10 /* OFDM */
-};
-
-/*
- * Configure hardware link parameters for the specified
- * node operating on the specified channel.
- */
 static int
-iwn_set_link_quality(struct iwn_softc *sc, uint8_t id, int async)
+iwn_set_link_quality(struct iwn_softc *sc, struct ieee80211_node *ni)
 {
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
+    struct iwn_node *wn = (void *)ni;
+    struct ieee80211_rateset *rs = &ni->ni_rates;
     struct iwn_cmd_link_quality linkq;
     const struct iwn_rate *rinfo;
-    int i;
-    uint8_t txant, ridx;
+    uint8_t txant;
+    int i, txrate;
 
     /* Use the first valid TX antenna. */
     txant = IWN_LSB(sc->txchainmask);
 
     memset(&linkq, 0, sizeof linkq);
-    linkq.id = id;
+    linkq.id = wn->id;
     linkq.antmsk_1stream = txant;
     linkq.antmsk_2stream = IWN_ANT_AB;
     linkq.ampdu_max = 31;
     linkq.ampdu_threshold = 3;
     linkq.ampdu_limit = htole16(4000);  /* 4ms */
 
-#if 0   /* HT */
-    if (IEEE80211_IS_CHAN_HT(c))
-        linkq.mimo = 1;
-#endif
-
-    if (id == IWN_ID_BSS)
-        ridx = IWN_RIDX_OFDM54;
-    else if (IEEE80211_IS_CHAN_A(ic->ic_curchan))
-        ridx = IWN_RIDX_OFDM6;
-    else
-        ridx = IWN_RIDX_CCK1;
-
+    /* Start at highest available bit-rate. */
+    txrate = rs->rs_nrates - 1;
     for (i = 0; i < IWN_MAX_TX_RETRIES; i++) {
-        rinfo = &iwn_rates[ridx];
-#if 0   /* HT */
-        if (IEEE80211_IS_CHAN_HT40(c)) {
-            linkq.retry[i].plcp = iwn_mimo_mcs_to_plcp[ridx]
-                     | IWN_RIDX_MCS;
-            linkq.retry[i].rflags = IWN_RFLAG_HT
-                     | IWN_RFLAG_HT40;
-            /* XXX shortGI */
-        } else if (IEEE80211_IS_CHAN_HT(c)) {
-            linkq.retry[i].plcp = iwn_siso_mcs_to_plcp[ridx]
-                     | IWN_RIDX_MCS;
-            linkq.retry[i].rflags = IWN_RFLAG_HT;
-            /* XXX shortGI */
-        } else
-#endif
-        {
-            linkq.retry[i].plcp = rinfo->plcp;
-            linkq.retry[i].rflags = rinfo->flags;
-        }
+        rinfo = &iwn_rates[wn->ridx[txrate]];
+        linkq.retry[i].plcp = rinfo->plcp;
+        linkq.retry[i].rflags = rinfo->flags;
         linkq.retry[i].rflags |= IWN_RFLAG_ANT(txant);
-        ridx = iwn_prev_ridx[ridx];
-    }
-#ifdef IWN_DEBUG
-    if (sc->sc_debug & IWN_DEBUG_STATE) {
-        printf("%s: set link quality for node %d, mimo %d ssmask %d\n",
-            __func__, id, linkq.mimo, linkq.antmsk_1stream);
-        printf("%s:", __func__);
-        for (i = 0; i < IWN_MAX_TX_RETRIES; i++)
-            printf(" %d:%x", linkq.retry[i].plcp,
-                linkq.retry[i].rflags);
-        printf("\n");
+        /* Next retry at immediate lower bit-rate. */
+        if (txrate > 0)
+            txrate--;
     }
-#endif
-    return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
+    return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, 1);
 }
 
 /*
@@ -3616 +3812 @@
 static int
 iwn_add_broadcast_node(struct iwn_softc *sc, int async)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
+    struct ieee80211com *ic = ifp->if_l2com;
     struct iwn_node_info node;
-    int error;
+    struct iwn_cmd_link_quality linkq;
+    const struct iwn_rate *rinfo;
+    uint8_t txant;
+    int i, error;
 
     memset(&node, 0, sizeof node);
     IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
-    node.id = hal->broadcast_id;
+    node.id = sc->broadcast_id;
     DPRINTF(sc, IWN_DEBUG_RESET, "%s: adding broadcast node\n", __func__);
-    error = hal->add_node(sc, &node, async);
-    if (error != 0)
+    if ((error = ops->add_node(sc, &node, async)) != 0)
         return error;
 
-    error = iwn_set_link_quality(sc, hal->broadcast_id, async);
-    return error;
+    /* Use the first valid TX antenna. */
+    txant = IWN_LSB(sc->txchainmask);
+
+    memset(&linkq, 0, sizeof linkq);
+    linkq.id = sc->broadcast_id;
+    linkq.antmsk_1stream = txant;
+    linkq.antmsk_2stream = IWN_ANT_AB;
+    linkq.ampdu_max = 64;
+    linkq.ampdu_threshold = 3;
+    linkq.ampdu_limit = htole16(4000);  /* 4ms */
+
+    /* Use lowest mandatory bit-rate. */
+    if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
+        rinfo = &iwn_rates[IWN_RIDX_OFDM6];
+    else
+        rinfo = &iwn_rates[IWN_RIDX_CCK1];
+    linkq.retry[0].plcp = rinfo->plcp;
+    linkq.retry[0].rflags = rinfo->flags;
+    linkq.retry[0].rflags |= IWN_RFLAG_ANT(txant);
+    /* Use same bit-rate for all TX retries. */
+    for (i = 1; i < IWN_MAX_TX_RETRIES; i++) {
+        linkq.retry[i].plcp = linkq.retry[0].plcp;
+        linkq.retry[i].rflags = linkq.retry[0].rflags;
+    }
+    return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
 }
 
 static int
-iwn_wme_update(struct ieee80211com *ic)
+iwn_updateedca(struct ieee80211com *ic)
 {
 #define IWN_EXP2(x) ((1 << (x)) - 1)    /* CWmin = 2^ECWmin - 1 */
-#define IWN_TXOP_TO_US(v)       (v<<5)
     struct iwn_softc *sc = ic->ic_ifp->if_softc;
     struct iwn_edca_params cmd;
-    int i;
+    int aci;
 
     memset(&cmd, 0, sizeof cmd);
     cmd.flags = htole32(IWN_EDCA_UPDATE);
-    for (i = 0; i < WME_NUM_AC; i++) {
-        const struct wmeParams *wmep =
-            &ic->ic_wme.wme_chanParams.cap_wmeParams[i];
-        cmd.ac[i].aifsn = wmep->wmep_aifsn;
-        cmd.ac[i].cwmin = htole16(IWN_EXP2(wmep->wmep_logcwmin));
-        cmd.ac[i].cwmax = htole16(IWN_EXP2(wmep->wmep_logcwmax));
-        cmd.ac[i].txoplimit =
-            htole16(IWN_TXOP_TO_US(wmep->wmep_txopLimit));
+    for (aci = 0; aci < WME_NUM_AC; aci++) {
+        const struct wmeParams *ac =
+            &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
+        cmd.ac[aci].aifsn = ac->wmep_aifsn;
+        cmd.ac[aci].cwmin = htole16(IWN_EXP2(ac->wmep_logcwmin));
+        cmd.ac[aci].cwmax = htole16(IWN_EXP2(ac->wmep_logcwmax));
+        cmd.ac[aci].txoplimit =
+            htole16(IEEE80211_TXOP_TO_US(ac->wmep_txopLimit));
     }
     IEEE80211_UNLOCK(ic);
     IWN_LOCK(sc);
-    (void) iwn_cmd(sc, IWN_CMD_EDCA_PARAMS, &cmd, sizeof cmd, 1 /*async*/);
+    (void)iwn_cmd(sc, IWN_CMD_EDCA_PARAMS, &cmd, sizeof cmd, 1);
     IWN_UNLOCK(sc);
     IEEE80211_LOCK(ic);
     return 0;
-#undef IWN_TXOP_TO_US
 #undef IWN_EXP2
 }
 
@@ -3704 +3924 @@
         temp = 110;
     memset(&crit, 0, sizeof crit);
     crit.tempR = htole32(temp);
-    DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %d\n",
-        temp);
+    DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %d\n", temp);
     return iwn_cmd(sc, IWN_CMD_SET_CRITICAL_TEMP, &crit, sizeof crit, 0);
 }
 
@@ -3721 +3940 @@
     cmd.lintval = htole16(10);
 
     /* Compute remaining time until next beacon. */
-    val = (uint64_t)ni->ni_intval * 1024;   /* msecs -> usecs */
+    val = (uint64_t)ni->ni_intval * IEEE80211_DUR_TU;
     mod = le64toh(cmd.tstamp) % val;
     cmd.binitval = htole32((uint32_t)(val - mod));
 
@@ -3737 +3956 @@
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
 
-    /* Adjust TX power if need be (delta >= 3 degC.) */
+    /* Adjust TX power if need be (delta >= 3 degC). */
     DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d->%d\n",
         __func__, sc->temp, temp);
     if (abs(temp - sc->temp) >= 3) {
@@ -3764 +3983 @@
     ((y1) + fdivround(((int)(x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
 
     static const int tdiv[IWN_NATTEN_GROUPS] = { 9, 8, 8, 8, 6 };
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
     struct iwn_ucode_info *uc = &sc->ucode_info;
     struct iwn4965_cmd_txpower cmd;
     struct iwn4965_eeprom_chan_samples *chans;
+    const uint8_t *rf_gain, *dsp_gain;
     int32_t vdiff, tdiff;
     int i, c, grp, maxpwr;
-    const uint8_t *rf_gain, *dsp_gain;
     uint8_t chan;
 
-    /* Retrieve channel number. */
-    chan = ieee80211_chan2ieee(ic, ch);
+    /* Retrieve current channel from last RXON. */
+    chan = sc->rxon.chan;
     DPRINTF(sc, IWN_DEBUG_RESET, "setting TX power for channel %d\n",
         chan);
 
@@ -3936 +4153 @@
     agc  = (le16toh(phy->agc) >> 7) & 0x7f;
 
     rssi = 0;
-#if 0
-    if (mask & IWN_ANT_A)   /* Ant A */
-        rssi = max(rssi, phy->rssi[0]);
-    if (mask & IWN_ATH_B)   /* Ant B */
-        rssi = max(rssi, phy->rssi[2]);
-    if (mask & IWN_ANT_C)   /* Ant C */
-        rssi = max(rssi, phy->rssi[4]);
-#else
-    rssi = max(rssi, phy->rssi[0]);
-    rssi = max(rssi, phy->rssi[2]);
-    rssi = max(rssi, phy->rssi[4]);
-#endif
-
-    DPRINTF(sc, IWN_DEBUG_RECV, "%s: agc %d mask 0x%x rssi %d %d %d "
-        "result %d\n", __func__, agc, mask,
-        phy->rssi[0], phy->rssi[2], phy->rssi[4],
+    if (mask & IWN_ANT_A)
+        rssi = MAX(rssi, phy->rssi[0]);
+    if (mask & IWN_ANT_B)
+        rssi = MAX(rssi, phy->rssi[2]);
+    if (mask & IWN_ANT_C)
+        rssi = MAX(rssi, phy->rssi[4]);
+
+    DPRINTF(sc, IWN_DEBUG_RECV,
+        "%s: agc %d mask 0x%x rssi %d %d %d result %d\n", __func__, agc,
+        mask, phy->rssi[0], phy->rssi[2], phy->rssi[4],
         rssi - agc - IWN_RSSI_TO_DBM);
     return rssi - agc - IWN_RSSI_TO_DBM;
 }
@@ -3960 +4171 @@
 iwn5000_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
 {
     struct iwn5000_rx_phystat *phy = (void *)stat->phybuf;
-    int rssi;
     uint8_t agc;
+    int rssi;
 
     agc = (le32toh(phy->agc) >> 9) & 0x7f;
 
@@ -3969 +4180 @@
            le16toh(phy->rssi[1]) & 0xff);
     rssi = MAX(le16toh(phy->rssi[2]) & 0xff, rssi);
 
-    DPRINTF(sc, IWN_DEBUG_RECV, "%s: agc %d rssi %d %d %d "
-        "result %d\n", __func__, agc,
+    DPRINTF(sc, IWN_DEBUG_RECV,
+        "%s: agc %d rssi %d %d %d result %d\n", __func__, agc,
         phy->rssi[0], phy->rssi[1], phy->rssi[2],
         rssi - agc - IWN_RSSI_TO_DBM);
     return rssi - agc - IWN_RSSI_TO_DBM;
@@ -4009 +4220 @@
     r3 = le32toh(uc->temp[2].chan20MHz);
     r4 = le32toh(sc->rawtemp);
 
-    if (r1 == r3)   /* Prevents division by 0 (should not happen.) */
+    if (r1 == r3)   /* Prevents division by 0 (should not happen). */
         return 0;
 
     /* Sign-extend 23-bit R4 value to 32-bit. */
-    r4 = (r4 << 8) >> 8;
+    r4 = ((r4 & 0xffffff) ^ 0x800000) - 0x800000;
     /* Compute temperature in Kelvin. */
     temp = (259 * (r4 - r2)) / (r3 - r1);
     temp = (temp * 97) / 100 + 8;
@@ -4030 +4241 @@
 
     /*
      * Temperature is not used by the driver for 5000 Series because
-     * TX power calibration is handled by firmware.  We export it to
-     * users through the sensor framework though.
+     * TX power calibration is handled by firmware.
      */
     temp = le32toh(sc->rawtemp);
     if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
@@ -4047 +4257 @@
 static int
 iwn_init_sensitivity(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct iwn_calib_state *calib = &sc->calib;
     uint32_t flags;
     int error;
@@ -4066 +4276 @@
     calib->energy_cck  = sc->limits->energy_cck;
 
     /* Write initial sensitivity. */
-    error = iwn_send_sensitivity(sc);
-    if (error != 0)
+    if ((error = iwn_send_sensitivity(sc)) != 0)
         return error;
 
     /* Write initial gains. */
-    error = hal->init_gains(sc);
-    if (error != 0)
+    if ((error = ops->init_gains(sc)) != 0)
         return error;
 
     /* Request statistics at each beacon interval. */
     flags = 0;
-    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: calibrate phy\n", __func__);
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending request for statistics\n",
+        __func__);
     return iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags, sizeof flags, 1);
 }
 
@@ -4090 +4299 @@
 iwn_collect_noise(struct iwn_softc *sc,
     const struct iwn_rx_general_stats *stats)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct iwn_calib_state *calib = &sc->calib;
     uint32_t val;
     int i;
@@ -4121 +4330 @@
     if ((sc->chainmask & sc->txchainmask) == 0)
         sc->chainmask |= IWN_LSB(sc->txchainmask);
 
-    (void)hal->set_gains(sc);
+    (void)ops->set_gains(sc);
     calib->state = IWN_CALIB_STATE_RUN;
 
 #ifdef notyet
     /* XXX Disable RX chains with no antennas connected. */
     sc->rxon.rxchain = htole16(IWN_RXCHAIN_SEL(sc->chainmask));
-    (void)iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, hal->rxonsz, 1);
+    (void)iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
 #endif
 
 #if 0
@@ -4157 +4366 @@
     struct iwn_phy_calib cmd;
 
     memset(&cmd, 0, sizeof cmd);
-    cmd.code = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
+    cmd.code = sc->reset_noise_gain;
     cmd.ngroups = 1;
     cmd.isvalid = 1;
     DPRINTF(sc, IWN_DEBUG_CALIBRATE,
@@ -4203 +4412 @@
 {
     struct iwn_calib_state *calib = &sc->calib;
     struct iwn_phy_calib_gain cmd;
-    int i, ant, delta, div;
+    int i, ant, div, delta;
 
     /* We collected 20 beacons and !=6050 need a 1.5 factor. */
     div = (sc->hw_type == IWN_HW_REV_TYPE_6050) ? 20 : 30;
 
     memset(&cmd, 0, sizeof cmd);
-    cmd.code = IWN5000_PHY_CALIB_NOISE_GAIN;
+    cmd.code = sc->noise_gain;
     cmd.ngroups = 1;
     cmd.isvalid = 1;
     /* Get first available RX antenna as referential. */
@@ -4264 +4473 @@
     int i, needs_update = 0;
 
     /* Check that we've been enabled long enough. */
-    rxena = le32toh(stats->general.load);
-    if (rxena == 0)
+    if ((rxena = le32toh(stats->general.load)) == 0)
         return;
 
     /* Compute number of false alarms since last call for OFDM. */
     fa  = le32toh(stats->ofdm.bad_plcp) - calib->bad_plcp_ofdm;
     fa += le32toh(stats->ofdm.fa) - calib->fa_ofdm;
-    fa *= 200 * 1024;   /* 200TU */
+    fa *= 200 * IEEE80211_DUR_TU;   /* 200TU */
 
     /* Save counters values for next call. */
     calib->bad_plcp_ofdm = le32toh(stats->ofdm.bad_plcp);
@@ -4328 +4536 @@
     /* Compute number of false alarms since last call for CCK. */
     fa  = le32toh(stats->cck.bad_plcp) - calib->bad_plcp_cck;
     fa += le32toh(stats->cck.fa) - calib->fa_cck;
-    fa *= 200 * 1024;   /* 200TU */
+    fa *= 200 * IEEE80211_DUR_TU;   /* 200TU */
 
     /* Save counters values for next call. */
     calib->bad_plcp_cck = le32toh(stats->cck.bad_plcp);
@@ -4363 +4571 @@
 
         if (calib->cck_state != IWN_CCK_STATE_INIT &&
             (((int32_t)calib->noise_ref - (int32_t)noise_ref) > 2 ||
-            calib->low_fa > 100)) {
+             calib->low_fa > 100)) {
             inc(calib->energy_cck, 2, limits->min_energy_cck);
             dec(calib->cck_x4,     3, limits->min_cck_x4);
             dec(calib->cck_mrc_x4, 3, limits->min_cck_mrc_x4);
@@ -4392 +4600 @@
 iwn_send_sensitivity(struct iwn_softc *sc)
 {
     struct iwn_calib_state *calib = &sc->calib;
-    struct iwn_sensitivity_cmd cmd;
+    struct iwn_enhanced_sensitivity_cmd cmd;
+    int len;
 
     memset(&cmd, 0, sizeof cmd);
+    len = sizeof (struct iwn_sensitivity_cmd);
     cmd.which = IWN_SENSITIVITY_WORKTBL;
     /* OFDM modulation. */
-    cmd.corr_ofdm_x1     = htole16(calib->ofdm_x1);
-    cmd.corr_ofdm_mrc_x1 = htole16(calib->ofdm_mrc_x1);
-    cmd.corr_ofdm_x4     = htole16(calib->ofdm_x4);
-    cmd.corr_ofdm_mrc_x4 = htole16(calib->ofdm_mrc_x4);
-    cmd.energy_ofdm      = htole16(sc->limits->energy_ofdm);
-    cmd.energy_ofdm_th   = htole16(62);
+    cmd.corr_ofdm_x1       = htole16(calib->ofdm_x1);
+    cmd.corr_ofdm_mrc_x1   = htole16(calib->ofdm_mrc_x1);
+    cmd.corr_ofdm_x4       = htole16(calib->ofdm_x4);
+    cmd.corr_ofdm_mrc_x4   = htole16(calib->ofdm_mrc_x4);
+    cmd.energy_ofdm        = htole16(sc->limits->energy_ofdm);
+    cmd.energy_ofdm_th     = htole16(62);
     /* CCK modulation. */
-    cmd.corr_cck_x4      = htole16(calib->cck_x4);
-    cmd.corr_cck_mrc_x4  = htole16(calib->cck_mrc_x4);
-    cmd.energy_cck       = htole16(calib->energy_cck);
+    cmd.corr_cck_x4        = htole16(calib->cck_x4);
+    cmd.corr_cck_mrc_x4    = htole16(calib->cck_mrc_x4);
+    cmd.energy_cck         = htole16(calib->energy_cck);
     /* Barker modulation: use default values. */
-    cmd.corr_barker      = htole16(190);
-    cmd.corr_barker_mrc  = htole16(390);
+    cmd.corr_barker        = htole16(190);
+    cmd.corr_barker_mrc    = htole16(390);
 
     DPRINTF(sc, IWN_DEBUG_CALIBRATE,
         "%s: set sensitivity %d/%d/%d/%d/%d/%d/%d\n", __func__,
         calib->ofdm_x1, calib->ofdm_mrc_x1, calib->ofdm_x4,
         calib->ofdm_mrc_x4, calib->cck_x4,
         calib->cck_mrc_x4, calib->energy_cck);
-    return iwn_cmd(sc, IWN_CMD_SET_SENSITIVITY, &cmd, sizeof cmd, 1);
+
+    if (!(sc->sc_flags & IWN_FLAG_ENH_SENS))
+        goto send;
+    /* Enhanced sensitivity settings. */
+    len = sizeof (struct iwn_enhanced_sensitivity_cmd);
+    cmd.ofdm_det_slope_mrc = htole16(668);
+    cmd.ofdm_det_icept_mrc = htole16(4);
+    cmd.ofdm_det_slope     = htole16(486);
+    cmd.ofdm_det_icept     = htole16(37);
+    cmd.cck_det_slope_mrc  = htole16(853);
+    cmd.cck_det_icept_mrc  = htole16(4);
+    cmd.cck_det_slope      = htole16(476);
+    cmd.cck_det_icept      = htole16(99);
+send:
+    return iwn_cmd(sc, IWN_CMD_SET_SENSITIVITY, &cmd, len, 1);
 }
 
 /*
@@ -4426 +4650 @@
 static int
 iwn_set_pslevel(struct iwn_softc *sc, int dtim, int level, int async)
 {
-    const struct iwn_pmgt *pmgt;
     struct iwn_pmgt_cmd cmd;
+    const struct iwn_pmgt *pmgt;
     uint32_t max, skip_dtim;
-    uint32_t tmp;
+    uint32_t reg;
     int i;
 
     /* Select which PS parameters to use. */
@@ -4446 +4670 @@
     if (level == 5)
         cmd.flags |= htole16(IWN_PS_FAST_PD);
     /* Retrieve PCIe Active State Power Management (ASPM). */
-    tmp = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
-    if (!(tmp & 0x1))   /* L0s Entry disabled. */
+    reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
+    if (!(reg & 0x1))   /* L0s Entry disabled. */
         cmd.flags |= htole16(IWN_PS_PCI_PMGT);
     cmd.rxtimeout = htole32(pmgt->rxtimeout * 1024);
     cmd.txtimeout = htole32(pmgt->txtimeout * 1024);
@@ -4475 +4699 @@
 }
 
 static int
+iwn_send_btcoex(struct iwn_softc *sc)
+{
+    struct iwn_bluetooth cmd;
+
+    memset(&cmd, 0, sizeof cmd);
+    cmd.flags = IWN_BT_COEX_CHAN_ANN | IWN_BT_COEX_BT_PRIO;
+    cmd.lead_time = IWN_BT_LEAD_TIME_DEF;
+    cmd.max_kill = IWN_BT_MAX_KILL_DEF;
+    DPRINTF(sc, IWN_DEBUG_RESET, "%s: configuring bluetooth coexistence\n",
+        __func__);
+    return iwn_cmd(sc, IWN_CMD_BT_COEX, &cmd, sizeof(cmd), 0);
+}
+
+static int
+iwn_send_advanced_btcoex(struct iwn_softc *sc)
+{
+    static const uint32_t btcoex_3wire[12] = {
+        0xaaaaaaaa, 0xaaaaaaaa, 0xaeaaaaaa, 0xaaaaaaaa,
+        0xcc00ff28, 0x0000aaaa, 0xcc00aaaa, 0x0000aaaa,
+        0xc0004000, 0x00004000, 0xf0005000, 0xf0005000,
+    };
+    struct iwn6000_btcoex_config btconfig;
+    struct iwn_btcoex_priotable btprio;
+    struct iwn_btcoex_prot btprot;
+    int error, i;
+
+    memset(&btconfig, 0, sizeof btconfig);
+    btconfig.flags = 145;
+    btconfig.max_kill = 5;
+    btconfig.bt3_t7_timer = 1;
+    btconfig.kill_ack = htole32(0xffff0000);
+    btconfig.kill_cts = htole32(0xffff0000);
+    btconfig.sample_time = 2;
+    btconfig.bt3_t2_timer = 0xc;
+    for (i = 0; i < 12; i++)
+        btconfig.lookup_table[i] = htole32(btcoex_3wire[i]);
+    btconfig.valid = htole16(0xff);
+    btconfig.prio_boost = 0xf0;
+    DPRINTF(sc, IWN_DEBUG_RESET,
+        "%s: configuring advanced bluetooth coexistence\n", __func__);
+    error = iwn_cmd(sc, IWN_CMD_BT_COEX, &btconfig, sizeof(btconfig), 1);
+    if (error != 0)
+        return error;
+
+    memset(&btprio, 0, sizeof btprio);
+    btprio.calib_init1 = 0x6;
+    btprio.calib_init2 = 0x7;
+    btprio.calib_periodic_low1 = 0x2;
+    btprio.calib_periodic_low2 = 0x3;
+    btprio.calib_periodic_high1 = 0x4;
+    btprio.calib_periodic_high2 = 0x5;
+    btprio.dtim = 0x6;
+    btprio.scan52 = 0x8;
+    btprio.scan24 = 0xa;
+    error = iwn_cmd(sc, IWN_CMD_BT_COEX_PRIOTABLE, &btprio, sizeof(btprio),
+        1);
+    if (error != 0)
+        return error;
+
+    /* Force BT state machine change. */
+    memset(&btprot, 0, sizeof btprio);
+    btprot.open = 1;
+    btprot.type = 1;
+    error = iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
+    if (error != 0)
+        return error;
+    btprot.open = 0;
+    return iwn_cmd(sc, IWN_CMD_BT_COEX_PROT, &btprot, sizeof(btprot), 1);
+}
+
+static int
 iwn_config(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
-    struct iwn_bluetooth bluetooth;
     uint32_t txmask;
-    int error;
     uint16_t rxchain;
+    int error;
+
+    if (sc->hw_type == IWN_HW_REV_TYPE_6005) {
+        /* Set radio temperature sensor offset. */
+        error = iwn5000_temp_offset_calib(sc);
+        if (error != 0) {
+            device_printf(sc->sc_dev,
+                "%s: could not set temperature offset\n", __func__);
+            return error;
+        }
+    }
 
-    /* Configure valid TX chains for 5000 Series. */
+    /* Configure valid TX chains for >=5000 Series. */
     if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
         txmask = htole32(sc->txchainmask);
         DPRINTF(sc, IWN_DEBUG_RESET,
@@ -4501 +4805 @@
     }
 
     /* Configure bluetooth coexistence. */
-    memset(&bluetooth, 0, sizeof bluetooth);
-    bluetooth.flags = IWN_BT_COEX_CHAN_ANN | IWN_BT_COEX_BT_PRIO;
-    bluetooth.lead_time = IWN_BT_LEAD_TIME_DEF;
-    bluetooth.max_kill = IWN_BT_MAX_KILL_DEF;
-    DPRINTF(sc, IWN_DEBUG_RESET, "%s: config bluetooth coexistence\n",
-        __func__);
-    error = iwn_cmd(sc, IWN_CMD_BT_COEX, &bluetooth, sizeof bluetooth, 0);
+    if (sc->sc_flags & IWN_FLAG_ADV_BTCOEX)
+        error = iwn_send_advanced_btcoex(sc);
+    else
+        error = iwn_send_btcoex(sc);
     if (error != 0) {
         device_printf(sc->sc_dev,
             "%s: could not configure bluetooth coexistence, error %d\n",
@@ -4548 +4849 @@
         IWN_RXCHAIN_IDLE_COUNT(2);
     sc->rxon.rxchain = htole16(rxchain);
     DPRINTF(sc, IWN_DEBUG_RESET, "%s: setting configuration\n", __func__);
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, hal->rxonsz, 0);
+    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 0);
     if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: RXON command failed\n", __func__);
+        device_printf(sc->sc_dev, "%s: RXON command failed\n",
+            __func__);
         return error;
     }
 
-    error = iwn_add_broadcast_node(sc, 0);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: could not add broadcast node\n", __func__);
+    if ((error = iwn_add_broadcast_node(sc, 0)) != 0) {
+        device_printf(sc->sc_dev, "%s: could not add broadcast node\n",
+            __func__);
         return error;
     }
 
     /* Configuration has changed, set TX power accordingly. */
-    error = hal->set_txpower(sc, ic->ic_curchan, 0);
-    if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: could not set TX power\n", __func__);
+    if ((error = ops->set_txpower(sc, ic->ic_curchan, 0)) != 0) {
+        device_printf(sc->sc_dev, "%s: could not set TX power\n",
+            __func__);
         return error;
     }
 
-    error = iwn_set_critical_temp(sc);
-    if (error != 0) {
+    if ((error = iwn_set_critical_temp(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: ccould not set critical temperature\n", __func__);
+            "%s: could not set critical temperature\n", __func__);
         return error;
     }
 
     /* Set power saving level to CAM during initialization. */
-    error = iwn_set_pslevel(sc, 0, 0, 0);
-    if (error != 0) {
+    if ((error = iwn_set_pslevel(sc, 0, 0, 0)) != 0) {
         device_printf(sc->sc_dev,
             "%s: could not set power saving level\n", __func__);
         return error;
@@ -4587 +4884 @@
     return 0;
 }
 
+/*
+ * Add an ssid element to a frame.
+ */
+static uint8_t *
+ieee80211_add_ssid(uint8_t *frm, const uint8_t *ssid, u_int len)
+{
+    *frm++ = IEEE80211_ELEMID_SSID;
+    *frm++ = len;
+    memcpy(frm, ssid, len);
+    return frm + len;
+}
+
 static int
 iwn_scan(struct iwn_softc *sc)
 {
@@ -4600 +4909 @@
     struct ieee80211_frame *wh;
     struct ieee80211_rateset *rs;
     struct ieee80211_channel *c;
-    int buflen, error, nrates;
+    uint8_t *buf, *frm;
     uint16_t rxchain;
-    uint8_t *buf, *frm, txant;
+    uint8_t txant;
+    int buflen, error;
 
     buf = malloc(IWN_SCAN_MAXSZ, M_DEVBUF, M_NOWAIT | M_ZERO);
     if (buf == NULL) {
@@ -4612 +4922 @@
         return ENOMEM;
     }
     hdr = (struct iwn_scan_hdr *)buf;
-
     /*
      * Move to the next channel if no frames are received within 10ms
      * after sending the probe request.
@@ -4636 +4945 @@
 
     tx = (struct iwn_cmd_data *)(hdr + 1);
     tx->flags = htole32(IWN_TX_AUTO_SEQ);
-    tx->id = sc->sc_hal->broadcast_id;
+    tx->id = sc->broadcast_id;
     tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
 
     if (IEEE80211_IS_CHAN_A(ic->ic_curchan)) {
@@ -4660 +4969 @@
         essid[0].len = ss->ss_ssid[0].len;
         memcpy(essid[0].data, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
     }
-
     /*
      * Build a probe request frame.  Most of the following code is a
      * copy & paste of what is done in net80211.
@@ -4676 +4984 @@
     *(uint16_t *)&wh->i_seq[0] = 0; /* filled by HW */
 
     frm = (uint8_t *)(wh + 1);
-
-    /* Add SSID IE. */
-    *frm++ = IEEE80211_ELEMID_SSID;
-    *frm++ = ss->ss_ssid[0].len;
-    memcpy(frm, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
-    frm += ss->ss_ssid[0].len;
-
-    /* Add supported rates IE. */
-    *frm++ = IEEE80211_ELEMID_RATES;
-    nrates = rs->rs_nrates;
-    if (nrates > IEEE80211_RATE_SIZE)
-        nrates = IEEE80211_RATE_SIZE;
-    *frm++ = nrates;
-    memcpy(frm, rs->rs_rates, nrates);
-    frm += nrates;
-
-    /* Add supported xrates IE. */
-    if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
-        nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
-        *frm++ = IEEE80211_ELEMID_XRATES;
-        *frm++ = (uint8_t)nrates;
-        memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
-        frm += nrates;
-    }
+    frm = ieee80211_add_ssid(frm, NULL, 0);
+    frm = ieee80211_add_rates(frm, rs);
+    if (rs->rs_nrates > IEEE80211_RATE_SIZE)
+        frm = ieee80211_add_xrates(frm, rs);
+#if 0   /* HT */
+    if (ic->ic_flags & IEEE80211_F_HTON)
+        frm = ieee80211_add_htcaps(frm, ic);
+#endif
 
     /* Set length of probe request. */
     tx->len = htole16(frm - (uint8_t *)wh);
@@ -4761 +5053 @@
 static int
 iwn_auth(struct iwn_softc *sc, struct ieee80211vap *vap)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211_node *ni = vap->iv_bss;
     int error;
 
-    sc->calib.state = IWN_CALIB_STATE_INIT;
-
     /* Update adapter configuration. */
     IEEE80211_ADDR_COPY(sc->rxon.bssid, ni->ni_bssid);
-    sc->rxon.chan = htole16(ieee80211_chan2ieee(ic, ni->ni_chan));
+    sc->rxon.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
     sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
     if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
         sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
@@ -4786 +5076 @@
         sc->rxon.cck_mask  = 0x03;
         sc->rxon.ofdm_mask = 0;
     } else {
-        /* XXX assume 802.11b/g */
+        /* Assume 802.11b/g. */
         sc->rxon.cck_mask  = 0x0f;
         sc->rxon.ofdm_mask = 0x15;
     }
-    DPRINTF(sc, IWN_DEBUG_STATE,
-        "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
-        "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
-        "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
-        __func__,
-        le16toh(sc->rxon.chan), sc->rxon.mode, le32toh(sc->rxon.flags),
-        sc->rxon.cck_mask, sc->rxon.ofdm_mask,
-        sc->rxon.ht_single_mask, sc->rxon.ht_dual_mask,
-        le16toh(sc->rxon.rxchain),
-        sc->rxon.myaddr, ":", sc->rxon.wlap, ":", sc->rxon.bssid, ":",
-        le16toh(sc->rxon.associd), le32toh(sc->rxon.filter));
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, hal->rxonsz, 1);
+    DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x cck %x ofdm %x\n",
+        sc->rxon.chan, sc->rxon.flags, sc->rxon.cck_mask,
+        sc->rxon.ofdm_mask);
+    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
     if (error != 0) {
-        device_printf(sc->sc_dev,
-            "%s: RXON command failed, error %d\n", __func__, error);
+        device_printf(sc->sc_dev, "%s: RXON command failed, error %d\n",
+            __func__, error);
         return error;
     }
 
     /* Configuration has changed, set TX power accordingly. */
-    error = hal->set_txpower(sc, ni->ni_chan, 1);
-    if (error != 0) {
+    if ((error = ops->set_txpower(sc, ni->ni_chan, 1)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not set Tx power, error %d\n", __func__, error);
+            "%s: could not set TX power, error %d\n", __func__, error);
         return error;
     }
     /*
      * Reconfiguring RXON clears the firmware nodes table so we must
      * add the broadcast node again.
      */
-    error = iwn_add_broadcast_node(sc, 1);
-    if (error != 0) {
+    if ((error = iwn_add_broadcast_node(sc, 1)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not add broadcast node, error %d\n",
-            __func__, error);
+            "%s: could not add broadcast node, error %d\n", __func__,
+            error);
         return error;
     }
     return 0;
 }
 
-/*
- * Configure the adapter for associated state.
- */
 static int
 iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 {
 #define MS(v,x) (((v) & x) >> x##_S)
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct ifnet *ifp = sc->sc_ifp;
     struct ieee80211com *ic = ifp->if_l2com;
     struct ieee80211_node *ni = vap->iv_bss;
@@ -4845 +5122 @@
 
     if (ic->ic_opmode == IEEE80211_M_MONITOR) {
         /* Link LED blinks while monitoring. */
-        iwn_set_led(sc, IWN_LED_LINK, 20, 20);
+        iwn_set_led(sc, IWN_LED_LINK, 5, 5);
         return 0;
     }
-    error = iwn_set_timing(sc, ni);
-    if (error != 0) {
+    if ((error = iwn_set_timing(sc, ni)) != 0) {
         device_printf(sc->sc_dev,
             "%s: could not set timing, error %d\n", __func__, error);
         return error;
@@ -4857 +5133 @@
 
     /* Update adapter configuration. */
     IEEE80211_ADDR_COPY(sc->rxon.bssid, ni->ni_bssid);
-    sc->rxon.chan = htole16(ieee80211_chan2ieee(ic, ni->ni_chan));
     sc->rxon.associd = htole16(IEEE80211_AID(ni->ni_associd));
-    /* Short preamble and slot time are negotiated when associating. */
-    sc->rxon.flags &= ~htole32(IWN_RXON_SHPREAMBLE | IWN_RXON_SHSLOT);
-    sc->rxon.flags |= htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
+    sc->rxon.chan = ieee80211_chan2ieee(ic, ni->ni_chan);
+    sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
     if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
         sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
-    else
-        sc->rxon.flags &= ~htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
     if (ic->ic_flags & IEEE80211_F_SHSLOT)
         sc->rxon.flags |= htole32(IWN_RXON_SHSLOT);
     if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
@@ -4877 +5149 @@
         sc->rxon.cck_mask  = 0x03;
         sc->rxon.ofdm_mask = 0;
     } else {
-        /* XXX assume 802.11b/g */
+        /* Assume 802.11b/g. */
         sc->rxon.cck_mask  = 0x0f;
         sc->rxon.ofdm_mask = 0x15;
     }
@@ -4902 +5174 @@
         maxrxampdu = ampdudensity = 0;
 #endif
     sc->rxon.filter |= htole32(IWN_FILTER_BSS);
-
-    DPRINTF(sc, IWN_DEBUG_STATE,
-        "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
-        "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
-        "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
-        __func__,
-        le16toh(sc->rxon.chan), sc->rxon.mode, le32toh(sc->rxon.flags),
-        sc->rxon.cck_mask, sc->rxon.ofdm_mask,
-        sc->rxon.ht_single_mask, sc->rxon.ht_dual_mask,
-        le16toh(sc->rxon.rxchain),
-        sc->rxon.myaddr, ":", sc->rxon.wlap, ":", sc->rxon.bssid, ":",
-        le16toh(sc->rxon.associd), le32toh(sc->rxon.filter));
-    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, hal->rxonsz, 1);
+    DPRINTF(sc, IWN_DEBUG_STATE, "rxon chan %d flags %x\n",
+        sc->rxon.chan, sc->rxon.flags);
+    error = iwn_cmd(sc, IWN_CMD_RXON, &sc->rxon, sc->rxonsz, 1);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not update configuration, error %d\n",
-            __func__, error);
+            "%s: could not update configuration, error %d\n", __func__,
+            error);
         return error;
     }
 
     /* Configuration has changed, set TX power accordingly. */
-    error = hal->set_txpower(sc, ni->ni_chan, 1);
-    if (error != 0) {
+    if ((error = ops->set_txpower(sc, ni->ni_chan, 1)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not set Tx power, error %d\n", __func__, error);
+            "%s: could not set TX power, error %d\n", __func__, error);
         return error;
     }
 
+    /* Fake a join to initialize the TX rate. */
+    ((struct iwn_node *)ni)->id = IWN_ID_BSS;
+    iwn_newassoc(ni, 1);
+
     /* Add BSS node. */
     memset(&node, 0, sizeof node);
     IEEE80211_ADDR_COPY(node.macaddr, ni->ni_macaddr);
@@ -4938 +5203 @@
     node.htflags = htole32(IWN_AMDPU_SIZE_FACTOR(3) |
         IWN_AMDPU_DENSITY(5));  /* 2us */
 #endif
-    DPRINTF(sc, IWN_DEBUG_STATE, "%s: add BSS node, id %d htflags 0x%x\n",
-        __func__, node.id, le32toh(node.htflags));
-    error = hal->add_node(sc, &node, 1);
+    DPRINTF(sc, IWN_DEBUG_STATE, "%s: adding BSS node\n", __func__);
+    error = ops->add_node(sc, &node, 1);
     if (error != 0) {
-        device_printf(sc->sc_dev, "could not add BSS node\n");
+        device_printf(sc->sc_dev,
+            "%s: could not add BSS node, error %d\n", __func__, error);
         return error;
     }
-    DPRINTF(sc, IWN_DEBUG_STATE, "setting link quality for node %d\n",
-        node.id);
-    error = iwn_set_link_quality(sc, node.id, 1);
-    if (error != 0) {
+    DPRINTF(sc, IWN_DEBUG_STATE, "%s: setting link quality for node %d\n",
+        __func__, node.id);
+    if ((error = iwn_set_link_quality(sc, ni)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not setup MRR for node %d, error %d\n",
+            "%s: could not setup link quality for node %d, error %d\n",
             __func__, node.id, error);
         return error;
     }
 
-    error = iwn_init_sensitivity(sc);
-    if (error != 0) {
+    if ((error = iwn_init_sensitivity(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not set sensitivity, error %d\n",
-            __func__, error);
+            "%s: could not set sensitivity, error %d\n", __func__,
+            error);
         return error;
     }
-
     /* Start periodic calibration timer. */
     sc->calib.state = IWN_CALIB_STATE_ASSOC;
-    iwn_calib_reset(sc);
+    sc->calib_cnt = 0;
+    callout_reset(&sc->calib_to, msecs_to_ticks(500), iwn_calib_timeout,
+        sc);
 
     /* Link LED always on while associated. */
     iwn_set_led(sc, IWN_LED_LINK, 0, 1);
-
     return 0;
 #undef MS
 }
@@ -4985 +5248 @@
 {
     struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid];
     struct iwn_softc *sc = ic->ic_softc;
+    struct iwn_ops *ops = &sc->ops;
     struct iwn_node *wn = (void *)ni;
     struct iwn_node_info node;
 
@@ -4995 +5259 @@
     node.addba_tid = tid;
     node.addba_ssn = htole16(ba->ba_winstart);
     DPRINTF(sc, IWN_DEBUG_RECV, "ADDBA RA=%d TID=%d SSN=%d\n",
-        wn->id, tid, ba->ba_winstart));
-    return sc->sc_hal->add_node(sc, &node, 1);
+        wn->id, tid, ba->ba_winstart);
+    return ops->add_node(sc, &node, 1);
 }
 
 /*
  * This function is called by upper layer on teardown of an HT-immediate
- * Block Ack agreement (eg. uppon receipt of a DELBA frame.)
+ * Block Ack agreement (eg. uppon receipt of a DELBA frame).
  */
 static void
 iwn_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
     uint8_t tid)
 {
     struct iwn_softc *sc = ic->ic_softc;
+    struct iwn_ops *ops = &sc->ops;
     struct iwn_node *wn = (void *)ni;
     struct iwn_node_info node;
 
@@ -5017 +5282 @@
     node.flags = IWN_FLAG_SET_DELBA;
     node.delba_tid = tid;
     DPRINTF(sc, IWN_DEBUG_RECV, "DELBA RA=%d TID=%d\n", wn->id, tid);
-    (void)sc->sc_hal->add_node(sc, &node, 1);
+    (void)ops->add_node(sc, &node, 1);
 }
 
 /*
@@ -5030 +5295 @@
 {
     struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
     struct iwn_softc *sc = ic->ic_softc;
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     struct iwn_node *wn = (void *)ni;
     struct iwn_node_info node;
     int error;
@@ -5042 +5307 @@
     node.control = IWN_NODE_UPDATE;
     node.flags = IWN_FLAG_SET_DISABLE_TID;
     node.disable_tid = htole16(wn->disable_tid);
-    error = hal->add_node(sc, &node, 1);
+    error = ops->add_node(sc, &node, 1);
     if (error != 0)
         return error;
 
     if ((error = iwn_nic_lock(sc)) != 0)
         return error;
-    hal->ampdu_tx_start(sc, ni, tid, ba->ba_winstart);
+    ops->ampdu_tx_start(sc, ni, tid, ba->ba_winstart);
     iwn_nic_unlock(sc);
     return 0;
 }
@@ -5059 +5324 @@
 {
     struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
     struct iwn_softc *sc = ic->ic_softc;
-    int error;
+    struct iwn_ops *ops = &sc->ops;
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if (iwn_nic_lock(sc) != 0)
         return;
-    sc->sc_hal->ampdu_tx_stop(sc, tid, ba->ba_winstart);
+    ops->ampdu_tx_stop(sc, tid, ba->ba_winstart);
     iwn_nic_unlock(sc);
 }
 
@@ -5190 +5454 @@
 #endif
 
 /*
- * Send calibration results to the runtime firmware.  These results were
- * obtained on first boot from the initialization firmware, or by reading
- * the EEPROM for crystal calibration.
- */
-static int
-iwn5000_send_calib_results(struct iwn_softc *sc)
-{
-    struct iwn_calib_info *calib_result;
-    int idx, error;
-
-    for (idx = 0; idx < IWN_CALIB_NUM; idx++) {
-        calib_result = &sc->calib_results[idx];
-
-        /* No support for this type of calibration. */
-        if ((sc->calib_init & (1 << idx)) == 0)
-            continue;
-
-        /* No calibration result available. */
-        if (calib_result->buf == NULL)
-            continue;
-
-        DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-            "%s: send calibration result idx=%d, len=%d\n",
-            __func__, idx, calib_result->len);
-
-        error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, calib_result->buf,
-            calib_result->len, 0);
-        if (error != 0) {
-            device_printf(sc->sc_dev,
-                "%s: could not send calibration result "
-                "idx=%d, error=%d\n",
-                __func__, idx, error);
-            return error;
-        }
-    }
-    return 0;
-}
-
-/*
- * Save calibration result at the given index.  The index determines
- * in which order the results are sent to the runtime firmware.
+ * Query calibration tables from the initialization firmware.  We do this
+ * only once at first boot.  Called from a process context.
  */
 static int
-iwn5000_save_calib_result(struct iwn_softc *sc, struct iwn_phy_calib *calib,
-    int len, int idx)
+iwn5000_query_calibration(struct iwn_softc *sc)
 {
-    struct iwn_calib_info *calib_result = &sc->calib_results[idx];
-
-    DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-        "%s: saving calibration result code=%d, idx=%d, len=%d\n",
-        __func__, calib->code, idx, len);
-
-    if (calib_result->buf != NULL)
-        free(calib_result->buf, M_DEVBUF);
-
-    calib_result->buf = malloc(len, M_DEVBUF, M_NOWAIT);
-    if (calib_result->buf == NULL) {
-        device_printf(sc->sc_dev,
-            "%s: not enough memory for calibration result "
-            "code=%d, len=%d\n", __func__, calib->code, len);
-        return ENOMEM;
-    }
-
-    calib_result->len = len;
-    memcpy(calib_result->buf, calib, len);
-    return 0;
-}
-
-static void
-iwn5000_free_calib_results(struct iwn_softc *sc)
-{
-    struct iwn_calib_info *calib_result;
-    int idx;
-
-    for (idx = 0; idx < IWN_CALIB_NUM; idx++) {
-        calib_result = &sc->calib_results[idx];
-
-        if (calib_result->buf != NULL)
-            free(calib_result->buf, M_DEVBUF);
-
-        calib_result->buf = NULL;
-        calib_result->len = 0;
-    }
-}
-
-/*
- * Obtain the crystal calibration result from the EEPROM.
- */
-static int
-iwn5000_chrystal_calib(struct iwn_softc *sc)
-{
-    struct iwn5000_phy_calib_crystal cmd;
-    uint32_t base, crystal;
-    uint16_t val;
-
-    /* Read crystal calibration. */
-    iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
-    base = le16toh(val);
-    iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL, &crystal,
-        sizeof(uint32_t));
-    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: crystal calibration=0x%08x\n",
-        __func__, le32toh(crystal));
-
-    memset(&cmd, 0, sizeof cmd);
-    cmd.code = IWN5000_PHY_CALIB_CRYSTAL;
-    cmd.ngroups = 1;
-    cmd.isvalid = 1;
-    cmd.cap_pin[0] = le32toh(crystal) & 0xff;
-    cmd.cap_pin[1] = (le32toh(crystal) >> 16) & 0xff;
-
-    return iwn5000_save_calib_result(sc, (struct iwn_phy_calib *)&cmd,
-        sizeof cmd, IWN_CALIB_IDX_XTAL);
-}
-
-/*
- * Query calibration results from the initialization firmware.  We do this
- * only once at first boot.
- */
-static int
-iwn5000_send_calib_query(struct iwn_softc *sc, uint32_t cfg)
-{
-#define CALIB_INIT_CFG  0xffffffff;
     struct iwn5000_calib_config cmd;
     int error;
 
     memset(&cmd, 0, sizeof cmd);
-    cmd.ucode.once.enable = CALIB_INIT_CFG;
-    if (cfg == 0) {
-        cmd.ucode.once.start  = CALIB_INIT_CFG;
-        cmd.ucode.once.send   = CALIB_INIT_CFG;
-        cmd.ucode.flags       = CALIB_INIT_CFG;
-    } else
-        cmd.ucode.once.start  = cfg;
-
-    DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-        "%s: query calibration results, cfg %x\n", __func__, cfg);
-
+    cmd.ucode.once.enable = 0xffffffff;
+    cmd.ucode.once.start  = 0xffffffff;
+    cmd.ucode.once.send   = 0xffffffff;
+    cmd.ucode.flags       = 0xffffffff;
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending calibration query\n",
+        __func__);
     error = iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof cmd, 0);
     if (error != 0)
         return error;
 
     /* Wait at most two seconds for calibration to complete. */
     if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE))
-        error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", 2 * hz);
-
+        error = msleep(sc, &sc->sc_mtx, PCATCH, "iwncal", 2 * hz);
     return error;
-#undef  CALIB_INIT_CFG
 }
 
 /*
- * Process a CALIBRATION_RESULT notification sent by the initialization
- * firmware on response to a CMD_CALIB_CONFIG command.
+ * Send calibration results to the runtime firmware.  These results were
+ * obtained on first boot from the initialization firmware.
  */
 static int
-iwn5000_rx_calib_result(struct iwn_softc *sc, struct iwn_rx_desc *desc,
-    struct iwn_rx_data *data)
+iwn5000_send_calibration(struct iwn_softc *sc)
 {
-#define FRAME_SIZE_MASK     0x3fff
-    struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
-    int len, idx;
-
-    bus_dmamap_sync(sc->rxq.data_dmat, data->map, BUS_DMASYNC_POSTREAD);
-    len = (le32toh(desc->len) & FRAME_SIZE_MASK);
-
-    /* Remove length field itself. */
-    len -= 4;
+    int idx, error;
 
-    /*
-     * Determine the order in which the results will be send to the
-     * runtime firmware.
-     */
-    switch (calib->code) {
-    case IWN5000_PHY_CALIB_DC:
-        idx = IWN_CALIB_IDX_DC;
-        break;
-    case IWN5000_PHY_CALIB_LO:
-        idx = IWN_CALIB_IDX_LO;
-        break;
-    case IWN5000_PHY_CALIB_TX_IQ:
-        idx = IWN_CALIB_IDX_TX_IQ;
-        break;
-    case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
-        idx = IWN_CALIB_IDX_TX_IQ_PERIODIC;
-        break;
-    case IWN5000_PHY_CALIB_BASE_BAND:
-        idx = IWN_CALIB_IDX_BASE_BAND;
-        break;
-    default:
+    for (idx = 0; idx < 5; idx++) {
+        if (sc->calibcmd[idx].buf == NULL)
+            continue;   /* No results available. */
         DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-           "%s: unknown calibration code=%d\n", __func__, calib->code);
-        return EINVAL;
+            "send calibration result idx=%d len=%d\n", idx,
+            sc->calibcmd[idx].len);
+        error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, sc->calibcmd[idx].buf,
+            sc->calibcmd[idx].len, 0);
+        if (error != 0) {
+            device_printf(sc->sc_dev,
+                "%s: could not send calibration result, error %d\n",
+                __func__, error);
+            return error;
+        }
     }
-    return iwn5000_save_calib_result(sc, calib, len, idx);
-#undef  FRAME_SIZE_MASK
+    return 0;
 }
 
 static int
@@ -5413 +5534 @@
     return iwn_cmd(sc, IWN5000_CMD_WIMAX_COEX, &wimax, sizeof wimax, 0);
 }
 
+static int
+iwn5000_crystal_calib(struct iwn_softc *sc)
+{
+    struct iwn5000_phy_calib_crystal cmd;
+
+    memset(&cmd, 0, sizeof cmd);
+    cmd.code = IWN5000_PHY_CALIB_CRYSTAL;
+    cmd.ngroups = 1;
+    cmd.isvalid = 1;
+    cmd.cap_pin[0] = le32toh(sc->eeprom_crystal) & 0xff;
+    cmd.cap_pin[1] = (le32toh(sc->eeprom_crystal) >> 16) & 0xff;
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "sending crystal calibration %d, %d\n",
+        cmd.cap_pin[0], cmd.cap_pin[1]);
+    return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
+}
+
+static int
+iwn5000_temp_offset_calib(struct iwn_softc *sc)
+{
+    struct iwn5000_phy_calib_temp_offset cmd;
+
+    memset(&cmd, 0, sizeof cmd);
+    cmd.code = IWN5000_PHY_CALIB_TEMP_OFFSET;
+    cmd.ngroups = 1;
+    cmd.isvalid = 1;
+    if (sc->eeprom_temp != 0)
+        cmd.offset = htole16(sc->eeprom_temp);
+    else
+        cmd.offset = htole16(IWN_DEFAULT_TEMP_OFFSET);
+    DPRINTF(sc, IWN_DEBUG_CALIBRATE, "setting radio sensor offset to %d\n",
+        le16toh(cmd.offset));
+    return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
+}
+
 /*
  * This function is called after the runtime firmware notifies us of its
- * readiness (called in a process context.)
+ * readiness (called in a process context).
  */
 static int
 iwn4965_post_alive(struct iwn_softc *sc)
@@ -5430 +5585 @@
     iwn_mem_set_region_4(sc, sc->sched_base + IWN4965_SCHED_CTX_OFF, 0,
         IWN4965_SCHED_CTX_LEN / sizeof (uint32_t));
 
-    /* Set physical address of TX scheduler rings (1KB aligned.) */
+    /* Set physical address of TX scheduler rings (1KB aligned). */
     iwn_prph_write(sc, IWN4965_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
 
     IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
@@ -5468 +5623 @@
 
 /*
  * This function is called after the initialization or runtime firmware
- * notifies us of its readiness (called in a process context.)
+ * notifies us of its readiness (called in a process context).
  */
 static int
 iwn5000_post_alive(struct iwn_softc *sc)
@@ -5478 +5633 @@
     /* Switch to using ICT interrupt mode. */
     iwn5000_ict_reset(sc);
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
 
     /* Clear TX scheduler state in SRAM. */
@@ -5487 +5641 @@
     iwn_mem_set_region_4(sc, sc->sched_base + IWN5000_SCHED_CTX_OFF, 0,
         IWN5000_SCHED_CTX_LEN / sizeof (uint32_t));
 
-    /* Set physical address of TX scheduler rings (1KB aligned.) */
+    /* Set physical address of TX scheduler rings (1KB aligned). */
     iwn_prph_write(sc, IWN5000_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
 
     IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
@@ -5529 +5683 @@
             __func__, error);
         return error;
     }
-
-    if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE)) {
-        /*
-         * Start calibration by setting and sending the chrystal
-         * calibration first, this must be done before we are able
-         * to query the other calibration results.
-         */
-        error = iwn5000_chrystal_calib(sc);
+    if (sc->hw_type != IWN_HW_REV_TYPE_5150) {
+        /* Perform crystal calibration. */
+        error = iwn5000_crystal_calib(sc);
         if (error != 0) {
             device_printf(sc->sc_dev,
-                "%s: could not set chrystal calibration, "
-                "error=%d\n", __func__, error);
-            return error;
-        }
-        error = iwn5000_send_calib_results(sc);
-        if (error != 0) {
-            device_printf(sc->sc_dev,
-                "%s: could not send chrystal calibration, "
-                "error=%d\n", __func__, error);
+                "%s: crystal calibration failed, error %d\n",
+                __func__, error);
             return error;
         }
-
-        /*
-         * Query other calibration results from the initialization
-         * firmware.
-         */
-        error = iwn5000_send_calib_query(sc, 0);
-        if (error != 0) {
+    }
+    if (!(sc->sc_flags & IWN_FLAG_CALIB_DONE)) {
+        /* Query calibration from the initialization firmware. */
+        if ((error = iwn5000_query_calibration(sc)) != 0) {
             device_printf(sc->sc_dev,
-                "%s: could not query calibration, error=%d\n",
+                "%s: could not query calibration, error %d\n",
                 __func__, error);
             return error;
         }
-
         /*
          * We have the calibration results now, reboot with the
          * runtime firmware (call ourselves recursively!)
@@ -5570 +5708 @@
         iwn_hw_stop(sc);
         error = iwn_hw_init(sc);
     } else {
-        /*
-         * Send calibration results obtained from the initialization
-         * firmware to the runtime firmware.
-         */
-        error = iwn5000_send_calib_results(sc);
-
-        /*
-         * Tell the runtime firmware to do certain calibration types.
-         */
-        if (sc->calib_runtime != 0) {
-            error = iwn5000_send_calib_query(sc, sc->calib_runtime);
-            if (error != 0) {
-                device_printf(sc->sc_dev,
-                    "%s: could not send query calibration, "
-                    "error=%d, cfg=%x\n", __func__, error,
-                    sc->calib_runtime);
-            }
-        }
+        /* Send calibration results to runtime firmware. */
+        error = iwn5000_send_calibration(sc);
     }
     return error;
 }
 
 /*
  * The firmware boot code is small and is intended to be copied directly into
- * the NIC internal memory (no DMA transfer.)
+ * the NIC internal memory (no DMA transfer).
  */
 static int
 iwn4965_load_bootcode(struct iwn_softc *sc, const uint8_t *ucode, int size)
@@ -5603 +5725 @@
 
     size /= sizeof (uint32_t);
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
 
     /* Copy microcode image into NIC memory. */
@@ -5648 +5769 @@
 
     /* Copy initialization sections into pre-allocated DMA-safe memory. */
     memcpy(dma->vaddr, fw->init.data, fw->init.datasz);
-    bus_dmamap_sync(sc->fw_dma.tag, dma->map, BUS_DMASYNC_PREWRITE);
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
     memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
         fw->init.text, fw->init.textsz);
-    bus_dmamap_sync(sc->fw_dma.tag, dma->map, BUS_DMASYNC_PREWRITE);
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 
     /* Tell adapter where to find initialization sections. */
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
     iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
     iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->init.datasz);
@@ -5675 +5795 @@
     IWN_WRITE(sc, IWN_RESET, 0);
 
     /* Wait at most one second for first alive notification. */
-    error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
-    if (error) {
+    if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz)) != 0) {
         device_printf(sc->sc_dev,
             "%s: timeout waiting for adapter to initialize, error %d\n",
             __func__, error);
@@ -5689 +5808 @@
 
     /* Copy runtime sections into pre-allocated DMA-safe memory. */
     memcpy(dma->vaddr, fw->main.data, fw->main.datasz);
-    bus_dmamap_sync(sc->fw_dma.tag, dma->map, BUS_DMASYNC_PREWRITE);
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
     memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
         fw->main.text, fw->main.textsz);
-    bus_dmamap_sync(sc->fw_dma.tag, dma->map, BUS_DMASYNC_PREWRITE);
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 
     /* Tell adapter where to find runtime sections. */
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
-
     iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
     iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->main.datasz);
     iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
@@ -5719 +5836 @@
 
     /* Copy firmware section into pre-allocated DMA-safe memory. */
     memcpy(dma->vaddr, section, size);
-    bus_dmamap_sync(sc->fw_dma.tag, dma->map, BUS_DMASYNC_PREWRITE);
+    bus_dmamap_sync(dma->tag, dma->map, BUS_DMASYNC_PREWRITE);
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
 
     IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
@@ -5745 +5861 @@
     iwn_nic_unlock(sc);
 
     /* Wait at most five seconds for FH DMA transfer to complete. */
-    return msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
+    return msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", 5 * hz);
 }
 
 static int
@@ -5790 +5906 @@
     size_t hdrlen = 24;
     uint32_t rev;
 
-    ptr = (const uint32_t *)sc->fw_fp->data;
+    ptr = (const uint32_t *)fw->data;
     rev = le32toh(*ptr++);
 
     /* Check firmware API version. */
@@ -5805 +5921 @@
         ptr++;
     }
     if (fw->size < hdrlen) {
-        device_printf(sc->sc_dev,
-            "%s: firmware file too short: %zu bytes\n",
+        device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
             __func__, fw->size);
         return EINVAL;
     }
@@ -5819 +5934 @@
     /* Check that all firmware sections fit. */
     if (fw->size < hdrlen + fw->main.textsz + fw->main.datasz +
         fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
-        device_printf(sc->sc_dev,
-            "%s: firmware file too short: %zu bytes\n",
+        device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
             __func__, fw->size);
         return EINVAL;
     }
@@ -5831 +5945 @@
     fw->init.text = fw->main.data + fw->main.datasz;
     fw->init.data = fw->init.text + fw->init.textsz;
     fw->boot.text = fw->init.data + fw->init.datasz;
-
     return 0;
 }
 
 /*
  * Extract text and data sections from a TLV firmware image.
  */
-int
+static int
 iwn_read_firmware_tlv(struct iwn_softc *sc, struct iwn_fw_info *fw,
     uint16_t alt)
 {
@@ -5846 +5959 @@
     const struct iwn_fw_tlv *tlv;
     const uint8_t *ptr, *end;
     uint64_t altmask;
-    uint32_t len;
+    uint32_t len, tmp;
 
     if (fw->size < sizeof (*hdr)) {
-        device_printf(sc->sc_dev,
-            "%s: firmware file too short: %zu bytes\n",
+        device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
             __func__, fw->size);
         return EINVAL;
     }
     hdr = (const struct iwn_fw_tlv_hdr *)fw->data;
     if (hdr->signature != htole32(IWN_FW_SIGNATURE)) {
-        device_printf(sc->sc_dev,
-            "%s: bad firmware file signature 0x%08x\n",
+        device_printf(sc->sc_dev, "%s: bad firmware signature 0x%08x\n",
             __func__, le32toh(hdr->signature));
         return EINVAL;
     }
+    DPRINTF(sc, IWN_DEBUG_RESET, "FW: \"%.64s\", build 0x%x\n", hdr->descr,
+        le32toh(hdr->build));
 
     /*
      * Select the closest supported alternative that is less than
@@ -5869 +5982 @@
     altmask = le64toh(hdr->altmask);
     while (alt > 0 && !(altmask & (1ULL << alt)))
         alt--;  /* Downgrade. */
+    DPRINTF(sc, IWN_DEBUG_RESET, "using alternative %d\n", alt);
 
     ptr = (const uint8_t *)(hdr + 1);
     end = (const uint8_t *)(fw->data + fw->size);
@@ -5881 +5995 @@
         ptr += sizeof (*tlv);
         if (ptr + len > end) {
             device_printf(sc->sc_dev,
-                "%s: firmware file too short: %zu bytes\n",
-                __func__, fw->size);
+                "%s: firmware too short: %zu bytes\n", __func__,
+                fw->size);
             return EINVAL;
         }
         /* Skip other alternatives. */
@@ -5910 +6024 @@
             fw->boot.text = ptr;
             fw->boot.textsz = len;
             break;
+        case IWN_FW_TLV_ENH_SENS:
+            if (!len)
+                sc->sc_flags |= IWN_FLAG_ENH_SENS;
+            break;
+        case IWN_FW_TLV_PHY_CALIB:
+            tmp = htole32(*ptr);
+            if (tmp < 253) {
+                sc->reset_noise_gain = tmp;
+                sc->noise_gain = tmp + 1;
+            }
+            break;
         default:
             DPRINTF(sc, IWN_DEBUG_RESET,
-                "%s: TLV type %d not handled\n",
-                __func__, le16toh(tlv->type));
+                "TLV type %d not handled\n", le16toh(tlv->type));
             break;
         }
-next:       /* TLV fields are 32-bit aligned. */
+ next:      /* TLV fields are 32-bit aligned. */
         ptr += (len + 3) & ~3;
     }
     return 0;
@@ -5925 +6049 @@
 static int
 iwn_read_firmware(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
     struct iwn_fw_info *fw = &sc->fw;
     int error;
 
@@ -5936 +6059 @@
     /* Read firmware image from filesystem. */
     sc->fw_fp = firmware_get(sc->fwname);
     if (sc->fw_fp == NULL) {
-        device_printf(sc->sc_dev,
-            "%s: could not load firmare image \"%s\"\n", __func__,
-            sc->fwname);
+        device_printf(sc->sc_dev, "%s: could not read firmware %s\n",
+            __func__, sc->fwname);
         IWN_LOCK(sc);
         return EINVAL;
     }
@@ -5947 +6069 @@
     fw->size = sc->fw_fp->datasize;
     fw->data = (const uint8_t *)sc->fw_fp->data;
     if (fw->size < sizeof (uint32_t)) {
-        device_printf(sc->sc_dev,
-            "%s: firmware file too short: %zu bytes\n",
+        device_printf(sc->sc_dev, "%s: firmware too short: %zu bytes\n",
             __func__, fw->size);
+        firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
+        sc->fw_fp = NULL;
         return EINVAL;
     }
 
@@ -5960 +6083 @@
         error = iwn_read_firmware_tlv(sc, fw, 1);
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not read firmware sections\n", __func__);
+            "%s: could not read firmware sections, error %d\n",
+            __func__, error);
+        firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
+        sc->fw_fp = NULL;
         return error;
     }
 
     /* Make sure text and data sections fit in hardware memory. */
-    if (fw->main.textsz > hal->fw_text_maxsz ||
-        fw->main.datasz > hal->fw_data_maxsz ||
-        fw->init.textsz > hal->fw_text_maxsz ||
-        fw->init.datasz > hal->fw_data_maxsz ||
+    if (fw->main.textsz > sc->fw_text_maxsz ||
+        fw->main.datasz > sc->fw_data_maxsz ||
+        fw->init.textsz > sc->fw_text_maxsz ||
+        fw->init.datasz > sc->fw_data_maxsz ||
         fw->boot.textsz > IWN_FW_BOOT_TEXT_MAXSZ ||
         (fw->boot.textsz & 3) != 0) {
-        device_printf(sc->sc_dev,
-            "%s: firmware sections too large\n", __func__);
+        device_printf(sc->sc_dev, "%s: firmware sections too large\n",
+            __func__);
+        firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
+        sc->fw_fp = NULL;
         return EINVAL;
     }
 
@@ -6002 +6130 @@
 static int
 iwn_apm_init(struct iwn_softc *sc)
 {
-    uint32_t tmp;
+    uint32_t reg;
     int error;
 
-    /* Disable L0s exit timer (NMI bug workaround.) */
+    /* Disable L0s exit timer (NMI bug workaround). */
     IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
-    /* Don't wait for ICH L0s (ICH bug workaround.) */
+    /* Don't wait for ICH L0s (ICH bug workaround). */
     IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_L1A_NO_L0S_RX);
 
-    /* Set FH wait threshold to max (HW bug under stress workaround.) */
+    /* Set FH wait threshold to max (HW bug under stress workaround). */
     IWN_SETBITS(sc, IWN_DBG_HPET_MEM, 0xffff0000);
 
     /* Enable HAP INTA to move adapter from L1a to L0s. */
     IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_HAP_WAKE_L1A);
 
     /* Retrieve PCIe Active State Power Management (ASPM). */
-    tmp = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
+    reg = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
     /* Workaround for HW instability in PCIe L0->L0s->L1 transition. */
-    if (tmp & 0x02) /* L1 Entry enabled. */
+    if (reg & 0x02) /* L1 Entry enabled. */
         IWN_SETBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
     else
         IWN_CLRBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
@@ -6029 +6157 @@
         IWN_SETBITS(sc, IWN_ANA_PLL, IWN_ANA_PLL_INIT);
 
     /* Wait for clock stabilization before accessing prph. */
-    error = iwn_clock_wait(sc);
-    if (error != 0)
+    if ((error = iwn_clock_wait(sc)) != 0)
         return error;
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
-
     if (sc->hw_type == IWN_HW_REV_TYPE_4965) {
-        /* Enable DMA and BSM (Bootstrap State Machine.) */
+        /* Enable DMA and BSM (Bootstrap State Machine). */
         iwn_prph_write(sc, IWN_APMG_CLK_EN,
             IWN_APMG_CLK_CTRL_DMA_CLK_RQT |
             IWN_APMG_CLK_CTRL_BSM_CLK_RQT);
@@ -6048 +6173 @@
             IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
     }
     DELAY(20);
-
     /* Disable L1-Active. */
     iwn_prph_setbits(sc, IWN_APMG_PCI_STT, IWN_APMG_PCI_STT_L1A_DIS);
     iwn_nic_unlock(sc);
@@ -6068 +6192 @@
             return;
         DELAY(10);
     }
-    device_printf(sc->sc_dev, "%s: timeout waiting for master\n",
-        __func__);
+    device_printf(sc->sc_dev, "%s: timeout waiting for master\n", __func__);
 }
 
 static void
@@ -6118 +6241 @@
     IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
         IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
     iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_EARLY_PWROFF_DIS);
 
@@ -6140 +6262 @@
         /* Use internal power amplifier only. */
         IWN_WRITE(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_RADIO_2X2_IPA);
     }
-    if (sc->hw_type == IWN_HW_REV_TYPE_6050 && sc->calib_ver >= 6) {
+    if ((sc->hw_type == IWN_HW_REV_TYPE_6050 ||
+         sc->hw_type == IWN_HW_REV_TYPE_6005) && sc->calib_ver >= 6) {
         /* Indicate that ROM calibration version is >=6. */
         IWN_SETBITS(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_CALIB_VER6);
     }
+    if (sc->hw_type == IWN_HW_REV_TYPE_6005)
+        IWN_SETBITS(sc, IWN_GP_DRIVER, IWN_GP_DRIVER_6050_1X2);
     return 0;
 }
 
@@ -6189 +6314 @@
 static int
 iwn_hw_init(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
+    struct iwn_ops *ops = &sc->ops;
     int error, chnl, qid;
 
     /* Clear pending interrupts. */
     IWN_WRITE(sc, IWN_INT, 0xffffffff);
 
-    error = iwn_apm_init(sc);
-    if (error != 0) {
+    if ((error = iwn_apm_init(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not power ON adapter, error %d\n",
-            __func__, error);
+            "%s: could not power ON adapter, error %d\n", __func__,
+            error);
         return error;
     }
 
     /* Select VMAIN power source. */
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
     iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_PWR_SRC_MASK);
     iwn_nic_unlock(sc);
 
     /* Perform adapter-specific initialization. */
-    error = hal->nic_config(sc);
-    if (error != 0)
+    if ((error = ops->nic_config(sc)) != 0)
         return error;
 
     /* Initialize RX ring. */
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
     IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
     IWN_WRITE(sc, IWN_FH_RX_WPTR, 0);
-    /* Set physical address of RX ring (256-byte aligned.) */
+    /* Set physical address of RX ring (256-byte aligned). */
     IWN_WRITE(sc, IWN_FH_RX_BASE, sc->rxq.desc_dma.paddr >> 8);
-    /* Set physical address of RX status (16-byte aligned.) */
+    /* Set physical address of RX status (16-byte aligned). */
     IWN_WRITE(sc, IWN_FH_STATUS_WPTR, sc->rxq.stat_dma.paddr >> 4);
     /* Enable RX. */
     IWN_WRITE(sc, IWN_FH_RX_CONFIG,
@@ -6236 +6357 @@
     iwn_nic_unlock(sc);
     IWN_WRITE(sc, IWN_FH_RX_WPTR, (IWN_RX_RING_COUNT - 1) & ~7);
 
-    error = iwn_nic_lock(sc);
-    if (error != 0)
+    if ((error = iwn_nic_lock(sc)) != 0)
         return error;
 
     /* Initialize TX scheduler. */
-    iwn_prph_write(sc, hal->sched_txfact_addr, 0);
+    iwn_prph_write(sc, sc->sched_txfact_addr, 0);
 
-    /* Set physical address of "keep warm" page (16-byte aligned.) */
+    /* Set physical address of "keep warm" page (16-byte aligned). */
     IWN_WRITE(sc, IWN_FH_KW_ADDR, sc->kw_dma.paddr >> 4);
 
     /* Initialize TX rings. */
-    for (qid = 0; qid < hal->ntxqs; qid++) {
+    for (qid = 0; qid < sc->ntxqs; qid++) {
         struct iwn_tx_ring *txq = &sc->txq[qid];
 
-        /* Set physical address of TX ring (256-byte aligned.) */
+        /* Set physical address of TX ring (256-byte aligned). */
         IWN_WRITE(sc, IWN_FH_CBBC_QUEUE(qid),
             txq->desc_dma.paddr >> 8);
     }
     iwn_nic_unlock(sc);
 
     /* Enable DMA channels. */
-    for (chnl = 0; chnl < hal->ndmachnls; chnl++) {
+    for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
         IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl),
             IWN_FH_TX_CONFIG_DMA_ENA |
             IWN_FH_TX_CONFIG_DMA_CREDIT_ENA);
@@ -6278 +6398 @@
     IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
     IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
 
-    error = hal->load_firmware(sc);
-    if (error != 0) {
+    /* Enable shadow registers. */
+    if (sc->hw_type >= IWN_HW_REV_TYPE_6000)
+        IWN_SETBITS(sc, IWN_SHADOW_REG_CTRL, 0x800fffff);
+
+    if ((error = ops->load_firmware(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not load firmware, error %d\n",
-            __func__, error);
+            "%s: could not load firmware, error %d\n", __func__,
+            error);
         return error;
     }
     /* Wait at most one second for firmware alive notification. */
-    error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
-    if (error != 0) {
+    if ((error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz)) != 0) {
         device_printf(sc->sc_dev,
             "%s: timeout waiting for adapter to initialize, error %d\n",
             __func__, error);
         return error;
     }
     /* Do post-firmware initialization. */
-    return hal->post_alive(sc);
+    return ops->post_alive(sc);
 }
 
 static void
 iwn_hw_stop(struct iwn_softc *sc)
 {
-    const struct iwn_hal *hal = sc->sc_hal;
-    uint32_t tmp;
     int chnl, qid, ntries;
 
     IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
@@ -6316 +6436 @@
     iwn_nic_unlock(sc);
 
     /* Stop TX scheduler. */
-    iwn_prph_write(sc, hal->sched_txfact_addr, 0);
+    iwn_prph_write(sc, sc->sched_txfact_addr, 0);
 
     /* Stop all DMA channels. */
     if (iwn_nic_lock(sc) == 0) {
-        for (chnl = 0; chnl < hal->ndmachnls; chnl++) {
+        for (chnl = 0; chnl < sc->ndmachnls; chnl++) {
             IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl), 0);
             for (ntries = 0; ntries < 200; ntries++) {
-                tmp = IWN_READ(sc, IWN_FH_TX_STATUS);
-                if ((tmp & IWN_FH_TX_STATUS_IDLE(chnl)) ==
+                if (IWN_READ(sc, IWN_FH_TX_STATUS) &
                     IWN_FH_TX_STATUS_IDLE(chnl))
                     break;
                 DELAY(10);
@@ -6337 +6456 @@
     iwn_reset_rx_ring(sc, &sc->rxq);
 
     /* Reset all TX rings. */
-    for (qid = 0; qid < hal->ntxqs; qid++)
+    for (qid = 0; qid < sc->ntxqs; qid++)
         iwn_reset_tx_ring(sc, &sc->txq[qid]);
 
     if (iwn_nic_lock(sc) == 0) {
@@ -6346 +6465 @@
         iwn_nic_unlock(sc);
     }
     DELAY(5);
-
     /* Power OFF adapter. */
     iwn_apm_stop(sc);
 }
 
 static void
+iwn_radio_on(void *arg0, int pending)
+{
+    struct iwn_softc *sc = arg0;
+    struct ifnet *ifp = sc->sc_ifp;
+    struct ieee80211com *ic = ifp->if_l2com;
+    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+
+    if (vap != NULL) {
+        iwn_init(sc);
+        ieee80211_init(vap);
+    }
+}
+
+static void
+iwn_radio_off(void *arg0, int pending)
+{
+    struct iwn_softc *sc = arg0;
+    struct ifnet *ifp = sc->sc_ifp;
+    struct ieee80211com *ic = ifp->if_l2com;
+    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+
+    iwn_stop(sc);
+    if (vap != NULL)
+        ieee80211_stop(vap);
+
+    /* Enable interrupts to get RF toggle notification. */
+    IWN_LOCK(sc);
+    IWN_WRITE(sc, IWN_INT, 0xffffffff);
+    IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
+    IWN_UNLOCK(sc);
+}
+
+static void
 iwn_init_locked(struct iwn_softc *sc)
 {
     struct ifnet *ifp = sc->sc_ifp;
@@ -6359 +6510 @@
 
     IWN_LOCK_ASSERT(sc);
 
-    error = iwn_hw_prepare(sc);
-    if (error != 0) {
-        device_printf(sc->sc_dev, "%s: hardware not ready, eror %d\n",
+    if ((error = iwn_hw_prepare(sc)) != 0) {
+        device_printf(sc->sc_dev, "%s: hardware not ready, error %d\n",
             __func__, error);
         goto fail;
     }
@@ -6374 +6524 @@
     if (!(IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)) {
         device_printf(sc->sc_dev,
             "radio is disabled by hardware switch\n");
-
         /* Enable interrupts to get RF toggle notifications. */
         IWN_WRITE(sc, IWN_INT, 0xffffffff);
         IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
@@ -6382 +6531 @@
     }
 
     /* Read firmware images from the filesystem. */
-    error = iwn_read_firmware(sc);
-    if (error != 0) {
+    if ((error = iwn_read_firmware(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not read firmware, error %d\n",
-            __func__, error);
+            "%s: could not read firmware, error %d\n", __func__,
+            error);
         goto fail;
     }
 
@@ -6396 +6544 @@
     sc->fw_fp = NULL;
     if (error != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not initialize hardware, error %d\n",
-            __func__, error);
+            "%s: could not initialize hardware, error %d\n", __func__,
+            error);
         goto fail;
     }
 
     /* Configure adapter now that it is ready. */
-    error = iwn_config(sc);
-    if (error != 0) {
+    if ((error = iwn_config(sc)) != 0) {
         device_printf(sc->sc_dev,
-            "%s: could not configure device, error %d\n",
-            __func__, error);
+            "%s: could not configure device, error %d\n", __func__,
+            error);
         goto fail;
     }
 
     ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
     ifp->if_drv_flags |= IFF_DRV_RUNNING;
 
+    callout_reset(&sc->watchdog_to, hz, iwn_watchdog, sc);
     return;
 
-fail:
-    iwn_stop_locked(sc);
+fail:   iwn_stop_locked(sc);
 }
 
 static void
@@ -6442 +6589 @@
     IWN_LOCK_ASSERT(sc);
 
     sc->sc_tx_timer = 0;
-    callout_stop(&sc->sc_timer_to);
+    callout_stop(&sc->watchdog_to);
+    callout_stop(&sc->calib_to);
     ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
 
     /* Power OFF hardware. */
@@ -6499 +6647 @@
     const struct ieee80211_channel *c = ic->ic_curchan;
     struct ifnet *ifp = ic->ic_ifp;
     struct iwn_softc *sc = ifp->if_softc;
+    int error;
 
     IWN_LOCK(sc);
     sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
     sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
     sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
     sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
+
+    /*
+     * Only need to set the channel in Monitor mode. AP scanning and auth
+     * are already taken care of by their respective firmware commands.
+     */
+    if (ic->ic_opmode == IEEE80211_M_MONITOR) {
+        error = iwn_config(sc);
+        if (error != 0)
+        device_printf(sc->sc_dev,
+            "%s: error %d settting channel\n", __func__, error);
+    }
     IWN_UNLOCK(sc);
 }
 
@@ -6536 +6696 @@
     /* NB: don't try to abort scan; wait for firmware to finish */
 }
 
-static struct iwn_eeprom_chan *
-iwn_find_eeprom_channel(struct iwn_softc *sc, struct ieee80211_channel *c)
-{
-    int i, j;
-
-    for (j = 0; j < 7; j++) {
-        for (i = 0; i < iwn_bands[j].nchan; i++) {
-            if (iwn_bands[j].chan[i] == c->ic_ieee)
-                return &sc->eeprom_channels[j][i];
-        }
-    }
-
-    return NULL;
-}
-
-/*
- * Enforce flags read from EEPROM.
- */
-static int
-iwn_setregdomain(struct ieee80211com *ic, struct ieee80211_regdomain *rd,
-    int nchan, struct ieee80211_channel chans[])
-{
-    struct iwn_softc *sc = ic->ic_ifp->if_softc;
-    int i;
-
-    for (i = 0; i < nchan; i++) {
-        struct ieee80211_channel *c = &chans[i];
-        struct iwn_eeprom_chan *channel;
-
-        channel = iwn_find_eeprom_channel(sc, c);
-        if (channel == NULL) {
-            if_printf(ic->ic_ifp,
-                "%s: invalid channel %u freq %u/0x%x\n",
-                __func__, c->ic_ieee, c->ic_freq, c->ic_flags);
-            return EINVAL;
-        }
-        c->ic_flags |= iwn_eeprom_channel_flags(channel);
-    }
-
-    return 0;
-}
-
 static void
 iwn_hw_reset(void *arg0, int pending)
 {
@@ -6589 +6707 @@
     iwn_init(sc);
     ieee80211_notify_radio(ic, 1);
 }
-
-static void
-iwn_radio_on(void *arg0, int pending)
-{
-    struct iwn_softc *sc = arg0;
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
-    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
-
-    if (vap != NULL) {
-        iwn_init(sc);
-        ieee80211_init(vap);
-    }
-}
-
-static void
-iwn_radio_off(void *arg0, int pending)
-{
-    struct iwn_softc *sc = arg0;
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
-    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
-
-    iwn_stop(sc);
-    if (vap != NULL)
-        ieee80211_stop(vap);
-
-    /* Enable interrupts to get RF toggle notification. */
-    IWN_LOCK(sc);
-    IWN_WRITE(sc, IWN_INT, 0xffffffff);
-    IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
-    IWN_UNLOCK(sc);
-}
-
-static void
-iwn_sysctlattach(struct iwn_softc *sc)
-{
-    struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
-    struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
-
-#ifdef IWN_DEBUG
-    sc->sc_debug = 0;
-    SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
-        "debug", CTLFLAG_RW, &sc->sc_debug, 0, "control debugging printfs");
-#endif
-}
-
-static int
-iwn_shutdown(device_t dev)
-{
-    struct iwn_softc *sc = device_get_softc(dev);
-
-    iwn_stop(sc);
-    return 0;
-}
-
-static int
-iwn_suspend(device_t dev)
-{
-    struct iwn_softc *sc = device_get_softc(dev);
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
-    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
-
-    iwn_stop(sc);
-    if (vap != NULL)
-        ieee80211_stop(vap);
-    return 0;
-}
-
-static int
-iwn_resume(device_t dev)
-{
-    struct iwn_softc *sc = device_get_softc(dev);
-    struct ifnet *ifp = sc->sc_ifp;
-    struct ieee80211com *ic = ifp->if_l2com;
-    struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
-
-    /* Clear device-specific "PCI retry timeout" register (41h). */
-    pci_write_config(dev, 0x41, 0, 1);
-
-    if (ifp->if_flags & IFF_UP) {
-        iwn_init(sc);
-        if (vap != NULL)
-            ieee80211_init(vap);
-        if (ifp->if_drv_flags & IFF_DRV_RUNNING)
-            iwn_start(ifp);
-    }
-    return 0;
-}
-
-#ifdef IWN_DEBUG
-static const char *
-iwn_intr_str(uint8_t cmd)
-{
-    switch (cmd) {
-    /* Notifications */
-    case IWN_UC_READY:      return "UC_READY";
-    case IWN_ADD_NODE_DONE:     return "ADD_NODE_DONE";
-    case IWN_TX_DONE:       return "TX_DONE";
-    case IWN_START_SCAN:        return "START_SCAN";
-    case IWN_STOP_SCAN:     return "STOP_SCAN";
-    case IWN_RX_STATISTICS:     return "RX_STATS";
-    case IWN_BEACON_STATISTICS: return "BEACON_STATS";
-    case IWN_STATE_CHANGED:     return "STATE_CHANGED";
-    case IWN_BEACON_MISSED:     return "BEACON_MISSED";
-    case IWN_RX_PHY:        return "RX_PHY";
-    case IWN_MPDU_RX_DONE:      return "MPDU_RX_DONE";
-    case IWN_RX_DONE:       return "RX_DONE";
-
-    /* Command Notifications */
-    case IWN_CMD_RXON:      return "IWN_CMD_RXON";
-    case IWN_CMD_RXON_ASSOC:    return "IWN_CMD_RXON_ASSOC";
-    case IWN_CMD_EDCA_PARAMS:   return "IWN_CMD_EDCA_PARAMS";
-    case IWN_CMD_TIMING:        return "IWN_CMD_TIMING";
-    case IWN_CMD_LINK_QUALITY:  return "IWN_CMD_LINK_QUALITY";
-    case IWN_CMD_SET_LED:       return "IWN_CMD_SET_LED";
-    case IWN5000_CMD_WIMAX_COEX:    return "IWN5000_CMD_WIMAX_COEX";
-    case IWN5000_CMD_CALIB_CONFIG:  return "IWN5000_CMD_CALIB_CONFIG";
-    case IWN5000_CMD_CALIB_RESULT:  return "IWN5000_CMD_CALIB_RESULT";
-    case IWN5000_CMD_CALIB_COMPLETE: return "IWN5000_CMD_CALIB_COMPLETE";
-    case IWN_CMD_SET_POWER_MODE:    return "IWN_CMD_SET_POWER_MODE";
-    case IWN_CMD_SCAN:      return "IWN_CMD_SCAN";
-    case IWN_CMD_SCAN_RESULTS:  return "IWN_CMD_SCAN_RESULTS";
-    case IWN_CMD_TXPOWER:       return "IWN_CMD_TXPOWER";
-    case IWN_CMD_TXPOWER_DBM:   return "IWN_CMD_TXPOWER_DBM";
-    case IWN5000_CMD_TX_ANT_CONFIG: return "IWN5000_CMD_TX_ANT_CONFIG";
-    case IWN_CMD_BT_COEX:       return "IWN_CMD_BT_COEX";
-    case IWN_CMD_SET_CRITICAL_TEMP: return "IWN_CMD_SET_CRITICAL_TEMP";
-    case IWN_CMD_SET_SENSITIVITY:   return "IWN_CMD_SET_SENSITIVITY";
-    case IWN_CMD_PHY_CALIB:     return "IWN_CMD_PHY_CALIB";
-    }
-    return "UNKNOWN INTR NOTIF/CMD";
-}
-#endif /* IWN_DEBUG */
-
-static device_method_t iwn_methods[] = {
-    /* Device interface */
-    DEVMETHOD(device_probe,     iwn_probe),
-    DEVMETHOD(device_attach,    iwn_attach),
-    DEVMETHOD(device_detach,    iwn_detach),
-    DEVMETHOD(device_shutdown,  iwn_shutdown),
-    DEVMETHOD(device_suspend,   iwn_suspend),
-    DEVMETHOD(device_resume,    iwn_resume),
-    { 0, 0 }
-};
-
-static driver_t iwn_driver = {
-    "iwn",
-    iwn_methods,
-    sizeof (struct iwn_softc)
-};
-static devclass_t iwn_devclass;
-
-DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, 0, 0);
-MODULE_DEPEND(iwn, pci, 1, 1, 1);
-MODULE_DEPEND(iwn, firmware, 1, 1, 1);
-MODULE_DEPEND(iwn, wlan, 1, 1, 1);

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwnreg.h

@@ -17 +17 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-#ifndef __IF_IWNREG_H__
-#define __IF_IWNREG_H__
-
-#define IWN_CT_KILL_THRESHOLD       114 /* in Celsius */
-#define IWN_CT_KILL_EXIT_THRESHOLD  95  /* in Celsius */
 
 #define IWN_TX_RING_COUNT   256
 #define IWN_TX_RING_LOMARK  192
@@ -32 +27 @@
 #define IWN4965_NTXQUEUES   16
 #define IWN5000_NTXQUEUES   20
 
-#define IWN4965_FIRSTAGGQUEUE   7
-#define IWN5000_FIRSTAGGQUEUE   10
-
 #define IWN4965_NDMACHNLS   7
 #define IWN5000_NDMACHNLS   8
 
@@ -43 +35 @@
 #define IWN_ICT_SIZE        4096
 #define IWN_ICT_COUNT       (IWN_ICT_SIZE / sizeof (uint32_t))
 
-/* For cards with PAN command, default is IWN_CMD_QUEUE_NUM */
-#define IWN_CMD_QUEUE_NUM       4
-#define IWN_PAN_CMD_QUEUE       9
-
 /* Maximum number of DMA segments for TX. */
 #define IWN_MAX_SCATTER 20
 
@@ -71 +59 @@
 #define IWN_INT         0x008
 #define IWN_INT_MASK        0x00c
 #define IWN_FH_INT      0x010
-#define IWN_GPIO_IN     0x018   /* read external chip pins */
 #define IWN_RESET       0x020
 #define IWN_GP_CNTRL        0x024
 #define IWN_HW_REV      0x028
@@ -79 +66 @@
 #define IWN_EEPROM_GP       0x030
 #define IWN_OTP_GP      0x034
 #define IWN_GIO         0x03c
-#define IWN_GP_UCODE        0x048
 #define IWN_GP_DRIVER       0x050
-#define IWN_UCODE_GP1       0x054
-#define IWN_UCODE_GP1_SET   0x058
 #define IWN_UCODE_GP1_CLR   0x05c
-#define IWN_UCODE_GP2       0x060
 #define IWN_LED         0x094
 #define IWN_DRAM_INT_TBL    0x0a0
 #define IWN_SHADOW_REG_CTRL 0x0a8
@@ -93 +76 @@
 #define IWN_HW_REV_WA       0x22c
 #define IWN_DBG_HPET_MEM    0x240
 #define IWN_DBG_LINK_PWR_MGMT   0x250
-/* Need nic_lock for use above */
 #define IWN_MEM_RADDR       0x40c
 #define IWN_MEM_WADDR       0x410
 #define IWN_MEM_WDATA       0x418
 #define IWN_MEM_RDATA       0x41c
-#define IWN_TARG_MBX_C      0x430
 #define IWN_PRPH_WADDR      0x444
 #define IWN_PRPH_RADDR      0x448
 #define IWN_PRPH_WDATA      0x44c
@@ -200 +181 @@
 #define IWN_RESET_SW            (1 << 7)
 #define IWN_RESET_MASTER_DISABLED   (1 << 8)
 #define IWN_RESET_STOP_MASTER       (1 << 9)
-#define IWN_RESET_LINK_PWR_MGMT_DIS (1U << 31)
+#define IWN_RESET_LINK_PWR_MGMT_DIS (1 << 31)
 
 /* Possible flags for register IWN_GP_CNTRL. */
 #define IWN_GP_CNTRL_MAC_ACCESS_ENA (1 << 0)
@@ -210 +191 @@
 #define IWN_GP_CNTRL_SLEEP      (1 << 4)
 #define IWN_GP_CNTRL_RFKILL     (1 << 27)
 
+/* Possible flags for register IWN_HW_REV. */
+#define IWN_HW_REV_TYPE_SHIFT   4
+#define IWN_HW_REV_TYPE_MASK    0x000000f0
+#define IWN_HW_REV_TYPE_4965    0
+#define IWN_HW_REV_TYPE_5300    2
+#define IWN_HW_REV_TYPE_5350    3
+#define IWN_HW_REV_TYPE_5150    4
+#define IWN_HW_REV_TYPE_5100    5
+#define IWN_HW_REV_TYPE_1000    6
+#define IWN_HW_REV_TYPE_6000    7
+#define IWN_HW_REV_TYPE_6050    8
+#define IWN_HW_REV_TYPE_6005    11
+
 /* Possible flags for register IWN_GIO_CHICKEN. */
 #define IWN_GIO_CHICKEN_L1A_NO_L0S_RX   (1 << 23)
 #define IWN_GIO_CHICKEN_DIS_L0S_TIMER   (1 << 29)
@@ -223 +217 @@
 #define IWN_GP_DRIVER_RADIO_2X2_IPA (2 << 0)
 #define IWN_GP_DRIVER_CALIB_VER6    (1 << 2)
 #define IWN_GP_DRIVER_6050_1X2      (1 << 3)
-#define IWN_GP_DRIVER_REG_BIT_RADIO_IQ_INVERT   (1 << 7)
-#define IWN_GP_DRIVER_NONE      0
 
 /* Possible flags for register IWN_UCODE_GP1_CLR. */
 #define IWN_UCODE_GP1_RFKILL        (1 << 1)
 #define IWN_UCODE_GP1_CMD_BLOCKED   (1 << 2)
 #define IWN_UCODE_GP1_CTEMP_STOP_RF (1 << 3)
-#define IWN_UCODE_GP1_CFG_COMPLETE  (1 << 5)
 
 /* Possible flags/values for register IWN_LED. */
 #define IWN_LED_BSM_CTRL    (1 << 5)
 #define IWN_LED_OFF     0x00000038
 #define IWN_LED_ON      0x00000078
 
-#define IWN_MAX_BLINK_TBL   10
-#define IWN_LED_STATIC_ON   0
-#define IWN_LED_STATIC_OFF  1
-#define IWN_LED_SLOW_BLINK  2
-#define IWN_LED_INT_BLINK   3
-#define IWN_LED_UNIT        0x1388  /* 5 ms */
-
-static const struct {
-    uint16_t    tpt;    /* Mb/s */
-    uint8_t     on_time;
-    uint8_t     off_time;
-} blink_tbl[] =
-{
-    {300, 5, 5},
-    {200, 8, 8},
-    {100, 11, 11},
-    {70, 13, 13},
-    {50, 15, 15},
-    {20, 17, 17},
-    {10, 19, 19},
-    {5, 22, 22},
-    {1, 26, 26},
-    {0, 33, 33},
-    /* SOLID_ON */
-};
-
 /* Possible flags for register IWN_DRAM_INT_TBL. */
 #define IWN_DRAM_INT_TBL_WRAP_CHECK (1 << 27)
-#define IWN_DRAM_INT_TBL_ENABLE     (1U << 31)
+#define IWN_DRAM_INT_TBL_ENABLE     (1 << 31)
 
 /* Possible values for register IWN_ANA_PLL. */
 #define IWN_ANA_PLL_INIT    0x00880300
@@ -275 +240 @@
 
 /* Possible flags for register IWN_BSM_WR_CTRL. */
 #define IWN_BSM_WR_CTRL_START_EN    (1 << 30)
-#define IWN_BSM_WR_CTRL_START       (1U << 31)
+#define IWN_BSM_WR_CTRL_START       (1 << 31)
 
 /* Possible flags for register IWN_INT. */
 #define IWN_INT_ALIVE       (1 <<  0)
@@ -288 +253 @@
 #define IWN_INT_FH_TX       (1 << 27)
 #define IWN_INT_RX_PERIODIC (1 << 28)
 #define IWN_INT_HW_ERR      (1 << 29)
-#define IWN_INT_FH_RX       (1U << 31)
+#define IWN_INT_FH_RX       (1 << 31)
 
 /* Shortcut. */
 #define IWN_INT_MASK_DEF                        \
@@ -308 +273 @@
 
 /* Possible flags/values for register IWN_FH_TX_CONFIG. */
 #define IWN_FH_TX_CONFIG_DMA_PAUSE      0
-#define IWN_FH_TX_CONFIG_DMA_ENA        (1U << 31)
+#define IWN_FH_TX_CONFIG_DMA_ENA        (1 << 31)
 #define IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD   (1 << 20)
 
 /* Possible flags/values for register IWN_FH_TXBUF_STATUS. */
@@ -323 +288 @@
 #define IWN_FH_TX_STATUS_IDLE(chnl) (1 << ((chnl) + 16))
 
 /* Possible flags for register IWN_FH_RX_CONFIG. */
-#define IWN_FH_RX_CONFIG_ENA        (1U << 31)
+#define IWN_FH_RX_CONFIG_ENA        (1 << 31)
 #define IWN_FH_RX_CONFIG_NRBD(x)    ((x) << 20)
 #define IWN_FH_RX_CONFIG_RB_SIZE_8K (1 << 16)
 #define IWN_FH_RX_CONFIG_SINGLE_FRAME   (1 << 15)
@@ -332 +297 @@
 #define IWN_FH_RX_CONFIG_IGN_RXF_EMPTY  (1 <<  2)
 
 /* Possible flags for register IWN_FH_TX_CONFIG. */
-#define IWN_FH_TX_CONFIG_DMA_ENA    (1U << 31)
+#define IWN_FH_TX_CONFIG_DMA_ENA    (1 << 31)
 #define IWN_FH_TX_CONFIG_DMA_CREDIT_ENA (1 <<  3)
 
 /* Possible flags for register IWN_EEPROM. */
@@ -380 +345 @@
 #define IWN_APMG_PCI_STT_L1A_DIS    (1 << 11)
 
 /* Possible flags for register IWN_BSM_DRAM_TEXT_SIZE. */
-#define IWN_FW_UPDATED  (1U << 31)
+#define IWN_FW_UPDATED  (1 << 31)
 
 #define IWN_SCHED_WINSZ     64
 #define IWN_SCHED_LIMIT     64
@@ -409 +374 @@
 } __packed;
 
 struct iwn_rx_desc {
-    /*
-     * The first 4 bytes of the RX frame header contain both the RX frame
-     * size and some flags.
-     * Bit fields:
-     * 31:    flag flush RB request
-     * 30:    flag ignore TC (terminal counter) request
-     * 29:    flag fast IRQ request
-     * 28-14: Reserved
-     * 13-00: RX frame size
-     */
     uint32_t    len;
     uint8_t     type;
 #define IWN_UC_READY              1
 #define IWN_ADD_NODE_DONE        24
 #define IWN_TX_DONE          28
-#define IWN_REPLY_LED_CMD       72
 #define IWN5000_CALIBRATION_RESULT  102
 #define IWN5000_CALIBRATION_DONE    103
 #define IWN_START_SCAN          130
-#define IWN_NOTIF_SCAN_RESULT       131
 #define IWN_STOP_SCAN           132
 #define IWN_RX_STATISTICS       156
 #define IWN_BEACON_STATISTICS       157
@@ -439 +392 @@
 #define IWN_RX_DONE         195
 #define IWN_RX_COMPRESSED_BA        197
 
-    uint8_t     flags;  /* 0:5 reserved, 6 abort, 7 internal */
-    uint8_t     idx;    /* position within TX queue */
+    uint8_t     flags;
+    uint8_t     idx;
     uint8_t     qid;
-    /* 0:4 TX queue id - 5:6 reserved - 7 unsolicited RX
-     * or uCode-originated notification
-     */
 } __packed;
 
-#define IWN_RX_DESC_QID_MSK     0x1F
-#define IWN_UNSOLICITED_RX_NOTIF    0x80
-
-/* CARD_STATE_NOTIFICATION */
-#define IWN_STATE_CHANGE_HW_CARD_DISABLED       0x01
-#define IWN_STATE_CHANGE_SW_CARD_DISABLED       0x02
-#define IWN_STATE_CHANGE_CT_CARD_DISABLED       0x04
-#define IWN_STATE_CHANGE_RXON_CARD_DISABLED     0x10
-
 /* Possible RX status flags. */
 #define IWN_RX_NO_CRC_ERR   (1 <<  0)
 #define IWN_RX_NO_OVFL_ERR  (1 <<  1)
@@ -479 +420 @@
 #define IWN_CMD_LINK_QUALITY         78
 #define IWN_CMD_SET_LED          72
 #define IWN5000_CMD_WIMAX_COEX       90
-#define IWN_TEMP_NOTIFICATION       98
 #define IWN5000_CMD_CALIB_CONFIG    101
 #define IWN5000_CMD_CALIB_RESULT    102
 #define IWN5000_CMD_CALIB_COMPLETE  103
@@ -496 +436 @@
 #define IWN_CMD_PHY_CALIB       176
 #define IWN_CMD_BT_COEX_PRIOTABLE   204
 #define IWN_CMD_BT_COEX_PROT        205
-#define IWN_CMD_BT_COEX_NOTIF       206
-/* PAN commands */
-#define IWN_CMD_WIPAN_PARAMS            0xb2
-#define IWN_CMD_WIPAN_RXON          0xb3
-#define IWN_CMD_WIPAN_RXON_TIMING       0xb4
-#define IWN_CMD_WIPAN_RXON_ASSOC        0xb6
-#define IWN_CMD_WIPAN_QOS_PARAM         0xb7
-#define IWN_CMD_WIPAN_WEPKEY            0xb8
-#define IWN_CMD_WIPAN_P2P_CHANNEL_SWITCH    0xb9
-#define IWN_CMD_WIPAN_NOA_NOTIFICATION      0xbc
-#define IWN_CMD_WIPAN_DEACTIVATION_COMPLETE 0xbd
 
     uint8_t flags;
     uint8_t idx;
@@ -514 +443 @@
     uint8_t data[136];
 } __packed;
 
-/*
- * Structure for IWN_CMD_GET_STATISTICS = (0x9c) 156
- * all devices identical.
- *
- * This command triggers an immediate response containing uCode statistics.
- * The response is in the same format as IWN_BEACON_STATISTICS (0x9d) 157.
- *
- * If the CLEAR_STATS configuration flag is set, uCode will clear its
- * internal copy of the statistics (counters) after issuing the response.
- * This flag does not affect IWN_BEACON_STATISTICS after beacons (see below).
- *
- * If the DISABLE_NOTIF configuration flag is set, uCode will not issue
- * IWN_BEACON_STATISTICS after received beacons.  This flag
- * does not affect the response to the IWN_CMD_GET_STATISTICS 0x9c itself.
- */
-struct iwn_statistics_cmd {
-    uint32_t    configuration_flags;
-#define IWN_STATS_CONF_CLEAR_STATS      htole32(0x1)
-#define IWN_STATS_CONF_DISABLE_NOTIF    htole32(0x2)
-} __packed;
-
 /* Antenna flags, used in various commands. */
 #define IWN_ANT_A   (1 << 0)
 #define IWN_ANT_B   (1 << 1)
@@ -542 +450 @@
 /* Shortcuts. */
 #define IWN_ANT_AB  (IWN_ANT_A | IWN_ANT_B)
 #define IWN_ANT_BC  (IWN_ANT_B | IWN_ANT_C)
-#define IWN_ANT_AC  (IWN_ANT_A | IWN_ANT_C)
 #define IWN_ANT_ABC (IWN_ANT_A | IWN_ANT_B | IWN_ANT_C)
 
 /* Structure for command IWN_CMD_RXON. */
@@ -558 +465 @@
 #define IWN_MODE_STA        3
 #define IWN_MODE_IBSS       4
 #define IWN_MODE_MONITOR    6
-#define IWN_MODE_2STA       8
-#define IWN_MODE_P2P        9
 
     uint8_t     air;
     uint16_t    rxchain;
@@ -584 +489 @@
 #define IWN_RXON_ANTENNA_A  (1 <<  8)
 #define IWN_RXON_ANTENNA_B  (1 <<  9)
 #define IWN_RXON_TSF        (1 << 15)
-#define IWN_RXON_HT_HT40MINUS   (1 << 22)
-#define IWN_RXON_HT_PROTMODE(x) (x << 23)
-#define IWN_RXON_HT_MODEPURE40  (1 << 25)
-#define IWN_RXON_HT_MODEMIXED   (2 << 25)
 #define IWN_RXON_CTS_TO_SELF    (1 << 30)
 
     uint32_t    filter;
@@ -643 +544 @@
     uint16_t    atim;
     uint32_t    binitval;
     uint16_t    lintval;
-    uint8_t     dtim_period;
-    uint8_t     delta_cp_bss_tbtts;
+    uint16_t    reserved;
 } __packed;
 
 /* Structure for command IWN_CMD_ADD_NODE. */
@@ -658 +558 @@
     uint16_t    reserved2;
     uint8_t     id;
 #define IWN_ID_BSS       0
-#define IWN_STA_ID      1
-
-#define IWN_PAN_ID_BCAST        14
 #define IWN5000_ID_BROADCAST    15
 #define IWN4965_ID_BROADCAST    31
 
@@ -691 +588 @@
     uint8_t     txmic[8];
 
     uint32_t    htflags;
-#define IWN_SMPS_MIMO_PROT      (1 << 17)
 #define IWN_AMDPU_SIZE_FACTOR(x)    ((x) << 19)
-#define IWN_NODE_HT40           (1 << 21)
-#define IWN_SMPS_MIMO_DIS       (1 << 22)
 #define IWN_AMDPU_DENSITY(x)        ((x) << 23)
 
     uint32_t    mask;
@@ -731 +625 @@
     uint32_t    reserved7;
 } __packed;
 
-#define IWN_RFLAG_MCS       (1 << 8)
-#define IWN_RFLAG_CCK       (1 << 9)
-#define IWN_RFLAG_GREENFIELD    (1 << 10)
-#define IWN_RFLAG_HT40      (1 << 11)
-#define IWN_RFLAG_DUPLICATE (1 << 12)
-#define IWN_RFLAG_SGI       (1 << 13)
-#define IWN_RFLAG_ANT(x)    ((x) << 14)
+#define IWN_RFLAG_CCK       (1 << 1)
+#define IWN_RFLAG_ANT(x)    ((x) << 6)
 
 /* Structure for command IWN_CMD_TX_DATA. */
 struct iwn_cmd_data {
@@ -758 +647 @@
 #define IWN_TX_NEED_PADDING (1 << 20)
 
     uint32_t    scratch;
-    uint32_t    rate;
+    uint8_t     plcp;
+    uint8_t     rflags;
+    uint16_t    xrflags;
 
     uint8_t     id;
     uint8_t     security;
@@ -799 +690 @@
     uint8_t     ampdu_threshold;
     uint8_t     ampdu_max;
     uint32_t    reserved2;
-    uint32_t    retry[IWN_MAX_TX_RETRIES];
+    struct {
+        uint8_t     plcp;
+        uint8_t     rflags;
+        uint16_t    xrflags;
+    } __packed  retry[IWN_MAX_TX_RETRIES];
     uint32_t    reserved3;
 } __packed;
 
@@ -835 +730 @@
 struct iwn5000_calib_elem {
     uint32_t    enable;
     uint32_t    start;
-#define IWN5000_CALIB_DC    (1 << 1)
-
     uint32_t    send;
     uint32_t    apply;
     uint32_t    reserved;
@@ -862 +755 @@
 #define IWN_PS_SLEEP_OVER_DTIM  (1 << 2)
 #define IWN_PS_PCI_PMGT     (1 << 3)
 #define IWN_PS_FAST_PD      (1 << 4)
-#define IWN_PS_BEACON_FILTERING (1 << 5)
-#define IWN_PS_SHADOW_REG   (1 << 6)
-#define IWN_PS_CT_KILL      (1 << 7)
-#define IWN_PS_BT_SCD       (1 << 8)
-#define IWN_PS_ADVANCED_PM  (1 << 9)
 
     uint8_t     keepalive;
     uint8_t     debug;
@@ -885 +773 @@
 
 struct iwn_scan_hdr {
     uint16_t    len;
-    uint8_t     scan_flags;
+    uint8_t     reserved1;
     uint8_t     nchan;
     uint16_t    quiet_time;
     uint16_t    quiet_threshold;
@@ -904 +792 @@
 
 struct iwn_scan_chan {
     uint32_t    flags;
-#define IWN_CHAN_PASSIVE    (0 << 0)
 #define IWN_CHAN_ACTIVE     (1 << 0)
 #define IWN_CHAN_NPBREQS(x) (((1 << (x)) - 1) << 1)
 
@@ -915 +802 @@
     uint16_t    passive;    /* msecs */
 } __packed;
 
-#define IWN_SCAN_CRC_TH_DISABLED    0
-#define IWN_SCAN_CRC_TH_DEFAULT     htole16(1)
-#define IWN_SCAN_CRC_TH_NEVER       htole16(0xffff)
-
 /* Maximum size of a scan command. */
 #define IWN_SCAN_MAXSZ  (MCLBYTES - 4)
 
-/*
- * For active scan, listen ACTIVE_DWELL_TIME (msec) on each channel after
- * sending probe req.  This should be set long enough to hear probe responses
- * from more than one AP.
- */
-#define IWN_ACTIVE_DWELL_TIME_2GHZ  (30)    /* all times in msec */
-#define IWN_ACTIVE_DWELL_TIME_5GHZ  (20)
-#define IWN_ACTIVE_DWELL_FACTOR_2GHZ    (3)
-#define IWN_ACTIVE_DWELL_FACTOR_5GHZ    (2)
-
-/*
- * For passive scan, listen PASSIVE_DWELL_TIME (msec) on each channel.
- * Must be set longer than active dwell time.
- * For the most reliable scan, set > AP beacon interval (typically 100msec).
- */
-#define IWN_PASSIVE_DWELL_TIME_2GHZ (20)    /* all times in msec */
-#define IWN_PASSIVE_DWELL_TIME_5GHZ (10)
-#define IWN_PASSIVE_DWELL_BASE      (100)
-#define IWN_CHANNEL_TUNE_TIME       (5)
-
-#define IWN_SCAN_CHAN_TIMEOUT       2
-#define IWN_MAX_SCAN_CHANNEL        50
-
-/*
- * If active scanning is requested but a certain channel is
- * marked passive, we can do active scanning if we detect
- * transmissions.
- *
- * There is an issue with some firmware versions that triggers
- * a sysassert on a "good CRC threshold" of zero (== disabled),
- * on a radar channel even though this means that we should NOT
- * send probes.
- *
- * The "good CRC threshold" is the number of frames that we
- * need to receive during our dwell time on a channel before
- * sending out probes -- setting this to a huge value will
- * mean we never reach it, but at the same time work around
- * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
- * here instead of IWL_GOOD_CRC_TH_DISABLED.
- *
- * This was fixed in later versions along with some other
- * scan changes, and the threshold behaves as a flag in those
- * versions.
- */
-#define IWN_GOOD_CRC_TH_DISABLED    0
-#define IWN_GOOD_CRC_TH_DEFAULT     htole16(1)
-#define IWN_GOOD_CRC_TH_NEVER       htole16(0xffff)
-
 /* Structure for command IWN_CMD_TXPOWER (4965AGN only.) */
 #define IWN_RIDX_MAX    32
 struct iwn4965_cmd_txpower {
@@ -1016 +851 @@
 
 struct iwn6000_btcoex_config {
     uint8_t     flags;
-#define IWN_BT_FLAG_COEX6000_CHAN_INHIBITION    1
-#define IWN_BT_FLAG_COEX6000_MODE_MASK      ((1 << 3) | (1 << 4) | (1 << 5 ))
-#define IWN_BT_FLAG_COEX6000_MODE_SHIFT         3
-#define IWN_BT_FLAG_COEX6000_MODE_DISABLED      0
-#define IWN_BT_FLAG_COEX6000_MODE_LEGACY_2W     1
-#define IWN_BT_FLAG_COEX6000_MODE_3W            2
-#define IWN_BT_FLAG_COEX6000_MODE_4W            3
-
-#define IWN_BT_FLAG_UCODE_DEFAULT       (1 << 6)
-#define IWN_BT_FLAG_SYNC_2_BT_DISABLE   (1 << 7)
     uint8_t     lead_time;
     uint8_t     max_kill;
     uint8_t     bt3_t7_timer;
@@ -1042 +867 @@
     uint16_t    rx_prio_boost;
 } __packed;
 
-/* Structure for enhanced command IWN_CMD_BLUETOOTH for 2000 Series. */
-struct iwn2000_btcoex_config {
-    uint8_t     flags;  /* Cf Flags in iwn6000_btcoex_config */
-    uint8_t     lead_time;
-    uint8_t     max_kill;
-    uint8_t     bt3_t7_timer;
-    uint32_t    kill_ack;
-    uint32_t    kill_cts;
-    uint8_t     sample_time;
-    uint8_t     bt3_t2_timer;
-    uint16_t    bt4_reaction;
-    uint32_t    lookup_table[12];
-    uint16_t    bt4_decision;
-    uint16_t    valid;
-
-    uint32_t    prio_boost; /* size change prior to iwn6000_btcoex_config */
-    uint8_t     reserved;   /* added prior to iwn6000_btcoex_config */
-
-    uint8_t     tx_prio_boost;
-    uint16_t    rx_prio_boost;
-} __packed;
-
 struct iwn_btcoex_priotable {
     uint8_t     calib_init1;
     uint8_t     calib_init2;
@@ -1141 +944 @@
     uint16_t    reserved;
 } __packed;
 
-/*
- * Define maximal number of calib result send to runtime firmware
- * PS: TEMP_OFFSET count for 2 (std and v2)
- */
-#define IWN5000_PHY_CALIB_MAX_RESULT        8
-
 /* Structures for command IWN_CMD_PHY_CALIB. */
 struct iwn_phy_calib {
     uint8_t code;
@@ -1188 +985 @@
     uint16_t    reserved;
 } __packed;
 
-struct iwn5000_phy_calib_temp_offsetv2 {
-    uint8_t     code;
-    uint8_t     group;
-    uint8_t     ngroups;
-    uint8_t     isvalid;
-    int16_t     offset_high;
-    int16_t     offset_low;
-    int16_t     burnt_voltage_ref;
-    int16_t     reserved;
-} __packed;
-
 struct iwn_phy_calib_gain {
     uint8_t code;
     uint8_t group;
@@ -1266 +1052 @@
 } __packed;
 
 /* Structures for IWN_TX_DONE notification. */
-#define IWN_TX_STATUS_MSK       0xff
-#define TX_STATUS_SUCCESS       0x01
-#define TX_STATUS_DIRECT_DONE       0x02
-
 #define IWN_TX_SUCCESS          0x00
 #define IWN_TX_FAIL         0x80    /* all failures have 0x80 set */
 #define IWN_TX_FAIL_SHORT_LIMIT     0x82    /* too many RTS retries */
@@ -1277 +1059 @@
 #define IWN_TX_FAIL_FIFO_UNDERRRUN  0x84    /* tx fifo not kept running */
 #define IWN_TX_FAIL_DEST_IN_PS      0x88    /* sta found in power save */
 #define IWN_TX_FAIL_TX_LOCKED       0x90    /* waiting to see traffic */
-#define IWN_TX_FAIL_STA_INVALID     0x8b    /* XXX STA invalid (???) */
 
 struct iwn4965_tx_stat {
     uint8_t     nframes;
     uint8_t     btkillcnt;
     uint8_t     rtsfailcnt;
     uint8_t     ackfailcnt;
-    uint32_t    rate;
+    uint8_t     rate;
+    uint8_t     rflags;
+    uint16_t    xrflags;
     uint16_t    duration;
     uint16_t    reserved;
     uint32_t    power[2];
@@ -1292 +1075 @@
 } __packed;
 
 struct iwn5000_tx_stat {
-    uint8_t     nframes;    /* 1 no aggregation, >1 aggregation */
+    uint8_t     nframes;
     uint8_t     btkillcnt;
     uint8_t     rtsfailcnt;
     uint8_t     ackfailcnt;
-    uint32_t    rate;
+    uint8_t     rate;
+    uint8_t     rflags;
+    uint16_t    xrflags;
     uint16_t    duration;
     uint16_t    reserved;
     uint32_t    power[2];
@@ -1304 +1089 @@
     uint16_t    seq;
     uint16_t    len;
     uint8_t     tlc;
-    uint8_t     ratid;  /* tid (0:3), sta_id (4:7) */
+    uint8_t     ratid;
     uint8_t     fc[2];
     uint16_t    status;
     uint16_t    sequence;
@@ -1351 +1136 @@
 
     uint16_t    chan;
     uint8_t     phybuf[32];
-    uint32_t    rate;
-/*
- * rate bit fields
- *
- * High-throughput (HT) rate format for bits 7:0 (bit 8 must be "1"):
- *  2-0:  0)   6 Mbps
- *        1)  12 Mbps
- *        2)  18 Mbps
- *        3)  24 Mbps
- *        4)  36 Mbps
- *        5)  48 Mbps
- *        6)  54 Mbps
- *        7)  60 Mbps
- *
- *  4-3:  0)  Single stream (SISO)
- *        1)  Dual stream (MIMO)
- *        2)  Triple stream (MIMO)
- *
- *    5:  Value of 0x20 in bits 7:0 indicates 6 Mbps HT40 duplicate data
- *
- * Legacy OFDM rate format for bits 7:0 (bit 8 must be "0", bit 9 "0"):
- *  3-0:  0xD)   6 Mbps
- *        0xF)   9 Mbps
- *        0x5)  12 Mbps
- *        0x7)  18 Mbps
- *        0x9)  24 Mbps
- *        0xB)  36 Mbps
- *        0x1)  48 Mbps
- *        0x3)  54 Mbps
- *
- * Legacy CCK rate format for bits 7:0 (bit 8 must be "0", bit 9 "1"):
- *  6-0:   10)  1 Mbps
- *         20)  2 Mbps
- *         55)  5.5 Mbps
- *        110)  11 Mbps
- *
- */
+    uint8_t     rate;
+    uint8_t     rflags;
+    uint16_t    xrflags;
     uint16_t    len;
     uint16_t    reserve3;
 } __packed;
@@ -1509 +1260 @@
     uint32_t    good_ampdu_crc32;
     uint32_t    ampdu;
     uint32_t    fragment;
-    uint32_t    unsupport_mcs;
+    uint32_t    reserved;
 } __packed;
 
 struct iwn_rx_stats {
@@ -1519 +1270 @@
     struct iwn_rx_ht_phy_stats  ht;
 } __packed;
 
-struct iwn_rx_general_stats_bt {
-    struct iwn_rx_general_stats common;
-    /* additional stats for bt */
-    uint32_t num_bt_kills;
-    uint32_t reserved[2];
-} __packed;
-
-struct iwn_rx_stats_bt {
-    struct iwn_rx_phy_stats     ofdm;
-    struct iwn_rx_phy_stats     cck;
-    struct iwn_rx_general_stats_bt  general_bt;
-    struct iwn_rx_ht_phy_stats  ht;
-} __packed;
-
 struct iwn_tx_stats {
     uint32_t    preamble;
     uint32_t    rx_detected;
@@ -1544 +1281 @@
     uint32_t    exp_ack;
     uint32_t    ack;
     uint32_t    msdu;
-    uint32_t    burst_err1;
+    uint32_t    busrt_err1;
     uint32_t    burst_err2;
     uint32_t    cts_collision;
     uint32_t    ack_collision;
@@ -1558 +1295 @@
     uint32_t    underrun;
     uint32_t    bt_ht_kill;
     uint32_t    rx_ba_resp;
-    /*
-     * 6000 series only - LSB=ant A, ant B, ant C, MSB=reserved
-     * TX power on chain in 1/2 dBm.
-     */
-    uint32_t    tx_power;
-    uint32_t    reserved[1];
+    uint32_t    reserved[2];
 } __packed;
 
 struct iwn_general_stats {
-    uint32_t    temp;       /* radio temperature */
-    uint32_t    temp_m;     /* radio voltage */
+    uint32_t    temp;
+    uint32_t    temp_m;
     uint32_t    burst_check;
     uint32_t    burst;
-    uint32_t    wait_for_silence_timeout_cnt;
-    uint32_t    reserved1[3];
+    uint32_t    reserved1[4];
     uint32_t    sleep;
     uint32_t    slot_out;
     uint32_t    slot_idle;
@@ -1583 +1314 @@
     uint32_t    probe;
     uint32_t    reserved2[2];
     uint32_t    rx_enabled;
-    /*
-     * This is the number of times we have to re-tune
-     * in order to get out of bad PHY status.
-     */
-    uint32_t    num_of_sos_states;
+    uint32_t    reserved3[3];
 } __packed;
 
 struct iwn_stats {
@@ -1595 +1322 @@
     struct iwn_rx_stats     rx;
     struct iwn_tx_stats     tx;
     struct iwn_general_stats    general;
-    uint32_t            reserved1[2];
 } __packed;
 
-struct iwn_bt_activity_stats {
-    /* Tx statistics */
-    uint32_t hi_priority_tx_req_cnt;
-    uint32_t hi_priority_tx_denied_cnt;
-    uint32_t lo_priority_tx_req_cnt;
-    uint32_t lo_priority_tx_denied_cnt;
-    /* Rx statistics */
-    uint32_t hi_priority_rx_req_cnt;
-    uint32_t hi_priority_rx_denied_cnt;
-    uint32_t lo_priority_rx_req_cnt;
-    uint32_t lo_priority_rx_denied_cnt;
-} __packed;
-
-struct iwn_stats_bt {
-    uint32_t            flags;
-    struct iwn_rx_stats_bt      rx_bt;
-    struct iwn_tx_stats     tx;
-    struct iwn_general_stats    general;
-    struct iwn_bt_activity_stats    activity;
-    uint32_t            reserved1[2];
-};
 
 /* Firmware error dump. */
 struct iwn_fw_dump {
@@ -1656 +1361 @@
 #define IWN_FW_TLV_INIT_DATA        4
 #define IWN_FW_TLV_BOOT_TEXT        5
 #define IWN_FW_TLV_PBREQ_MAXLEN     6
-#define IWN_FW_TLV_PAN          7
-#define IWN_FW_TLV_RUNT_EVTLOG_PTR  8
-#define IWN_FW_TLV_RUNT_EVTLOG_SIZE 9
-#define IWN_FW_TLV_RUNT_ERRLOG_PTR  10
-#define IWN_FW_TLV_INIT_EVTLOG_PTR  11
-#define IWN_FW_TLV_INIT_EVTLOG_SIZE 12
-#define IWN_FW_TLV_INIT_ERRLOG_PTR  13
 #define IWN_FW_TLV_ENH_SENS     14
 #define IWN_FW_TLV_PHY_CALIB        15
-#define IWN_FW_TLV_WOWLAN_INST      16
-#define IWN_FW_TLV_WOWLAN_DATA      17
-#define IWN_FW_TLV_FLAGS        18
 
     uint16_t    alt;
     uint32_t    len;
@@ -1682 +1377 @@
 #define IWN5000_FWSZ        IWN5000_FW_TEXT_MAXSZ
 
 /*
- * Microcode flags TLV (18.)
- */
-
-/**
- * enum iwn_ucode_tlv_flag - ucode API flags
- * @IWN_UCODE_TLV_FLAGS_PAN: This is PAN capable microcode; this previously
- *      was a separate TLV but moved here to save space.
- * @IWN_UCODE_TLV_FLAGS_NEWSCAN: new uCode scan behaviour on hidden SSID,
- *      treats good CRC threshold as a boolean
- * @IWN_UCODE_TLV_FLAGS_MFP: This uCode image supports MFP (802.11w).
- * @IWN_UCODE_TLV_FLAGS_P2P: This uCode image supports P2P.
- * @IWN_UCODE_TLV_FLAGS_DW_BC_TABLE: The SCD byte count table is in DWORDS
- * @IWN_UCODE_TLV_FLAGS_UAPSD: This uCode image supports uAPSD
- * @IWN_UCODE_TLV_FLAGS_SHORT_BL: 16 entries of black list instead of 64 in scan
- *      offload profile config command.
- * @IWN_UCODE_TLV_FLAGS_RX_ENERGY_API: supports rx signal strength api
- * @IWN_UCODE_TLV_FLAGS_TIME_EVENT_API_V2: using the new time event API.
- * @IWN_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS: D3 image supports up to six
- *      (rather than two) IPv6 addresses
- * @IWN_UCODE_TLV_FLAGS_BF_UPDATED: new beacon filtering API
- * @IWN_UCODE_TLV_FLAGS_NO_BASIC_SSID: not sending a probe with the SSID element
- *      from the probe request template.
- * @IWN_UCODE_TLV_FLAGS_D3_CONTINUITY_API: modified D3 API to allow keeping
- *      connection when going back to D0
- * @IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL: new NS offload (small version)
- * @IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE: new NS offload (large version)
- * @IWN_UCODE_TLV_FLAGS_SCHED_SCAN: this uCode image supports scheduled scan.
- * @IWN_UCODE_TLV_FLAGS_STA_KEY_CMD: new ADD_STA and ADD_STA_KEY command API
- * @IWN_UCODE_TLV_FLAGS_DEVICE_PS_CMD: support device wide power command
- *      containing CAM (Continuous Active Mode) indication.
- */
-enum iwn_ucode_tlv_flag {
-    IWN_UCODE_TLV_FLAGS_PAN         = (1 << 0),
-    IWN_UCODE_TLV_FLAGS_NEWSCAN     = (1 << 1),
-    IWN_UCODE_TLV_FLAGS_MFP         = (1 << 2),
-    IWN_UCODE_TLV_FLAGS_P2P         = (1 << 3),
-    IWN_UCODE_TLV_FLAGS_DW_BC_TABLE     = (1 << 4),
-    IWN_UCODE_TLV_FLAGS_NEWBT_COEX      = (1 << 5),
-    IWN_UCODE_TLV_FLAGS_UAPSD       = (1 << 6),
-    IWN_UCODE_TLV_FLAGS_SHORT_BL        = (1 << 7),
-    IWN_UCODE_TLV_FLAGS_RX_ENERGY_API   = (1 << 8),
-    IWN_UCODE_TLV_FLAGS_TIME_EVENT_API_V2   = (1 << 9),
-    IWN_UCODE_TLV_FLAGS_D3_6_IPV6_ADDRS = (1 << 10),
-    IWN_UCODE_TLV_FLAGS_BF_UPDATED      = (1 << 11),
-    IWN_UCODE_TLV_FLAGS_NO_BASIC_SSID   = (1 << 12),
-    IWN_UCODE_TLV_FLAGS_D3_CONTINUITY_API   = (1 << 14),
-    IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_SMALL    = (1 << 15),
-    IWN_UCODE_TLV_FLAGS_NEW_NSOFFL_LARGE    = (1 << 16),
-    IWN_UCODE_TLV_FLAGS_SCHED_SCAN      = (1 << 17),
-    IWN_UCODE_TLV_FLAGS_STA_KEY_CMD     = (1 << 19),
-    IWN_UCODE_TLV_FLAGS_DEVICE_PS_CMD   = (1 << 20),
-};
-
-/*
  * Offsets into EEPROM.
  */
 #define IWN_EEPROM_MAC      0x015
@@ -1755 +1396 @@
 #define IWN4965_EEPROM_VOLTAGE  0x0e9
 #define IWN4965_EEPROM_BANDS    0x0ea
 /* Indirect offsets. */
-#define IWN5000_EEPROM_NO_HT40  0x000
 #define IWN5000_EEPROM_DOMAIN   0x001
 #define IWN5000_EEPROM_BAND1    0x004
 #define IWN5000_EEPROM_BAND2    0x013
@@ -1763 +1403 @@
 #define IWN5000_EEPROM_BAND4    0x02e
 #define IWN5000_EEPROM_BAND5    0x03a
 #define IWN5000_EEPROM_BAND6    0x041
-#define IWN6000_EEPROM_BAND6    0x040
 #define IWN5000_EEPROM_BAND7    0x049
 #define IWN6000_EEPROM_ENHINFO  0x054
 #define IWN5000_EEPROM_CRYSTAL  0x128
@@ -1793 +1432 @@
 } __packed;
 
 struct iwn_eeprom_enhinfo {
-    uint8_t     flags;
-#define IWN_ENHINFO_VALID   0x01
-#define IWN_ENHINFO_5GHZ    0x02
-#define IWN_ENHINFO_OFDM    0x04
-#define IWN_ENHINFO_HT40    0x08
-#define IWN_ENHINFO_HTAP    0x10
-#define IWN_ENHINFO_RES1    0x20
-#define IWN_ENHINFO_RES2    0x40
-#define IWN_ENHINFO_COMMON  0x80
-
-    uint8_t     chan;
+    uint16_t    chan;
     int8_t      chain[3];   /* max power in half-dBm */
     uint8_t     reserved;
     int8_t      mimo2;      /* max power in half-dBm */
@@ -1857 +1486 @@
     IWN5000_EEPROM_BAND7
 };
 
-static const uint32_t iwn6000_regulatory_bands[IWN_NBANDS] = {
-    IWN5000_EEPROM_BAND1,
-    IWN5000_EEPROM_BAND2,
-    IWN5000_EEPROM_BAND3,
-    IWN5000_EEPROM_BAND4,
-    IWN5000_EEPROM_BAND5,
-    IWN6000_EEPROM_BAND6,
-    IWN5000_EEPROM_BAND7
-};
-
-static const uint32_t iwn1000_regulatory_bands[IWN_NBANDS] = {
-    IWN5000_EEPROM_BAND1,
-    IWN5000_EEPROM_BAND2,
-    IWN5000_EEPROM_BAND3,
-    IWN5000_EEPROM_BAND4,
-    IWN5000_EEPROM_BAND5,
-    IWN5000_EEPROM_BAND6,
-    IWN5000_EEPROM_NO_HT40,
-};
-
-static const uint32_t iwn2030_regulatory_bands[IWN_NBANDS] = {
-    IWN5000_EEPROM_BAND1,
-    IWN5000_EEPROM_BAND2,
-    IWN5000_EEPROM_BAND3,
-    IWN5000_EEPROM_BAND4,
-    IWN5000_EEPROM_BAND5,
-    IWN6000_EEPROM_BAND6,
-    IWN5000_EEPROM_BAND7
-};
-
 #define IWN_CHAN_BANDS_COUNT     7
 #define IWN_MAX_CHAN_PER_BAND   14
 static const struct iwn_chan_band {
@@ -1906 +1505 @@
     { 11, { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157 } }
 };
 
-static const uint8_t iwn_bss_ac_to_queue[] = {
-    2, 3, 1, 0,
-};
-
-static const uint8_t iwn_pan_ac_to_queue[] = {
-    5, 4, 6, 7,
-};
-#define IWN1000_OTP_NBLOCKS 3
-#define IWN6000_OTP_NBLOCKS 4
+#define IWN1000_OTP_NBLOCKS 3 
+#define IWN6000_OTP_NBLOCKS 4 
 #define IWN6050_OTP_NBLOCKS 7
 
 /* HW rate indices. */
 #define IWN_RIDX_CCK1   0
 #define IWN_RIDX_OFDM6  4
 
-#define IWN4965_MAX_PWR_INDEX   107
-#define IWN_POWERSAVE_LVL_NONE          0
-#define IWN_POWERSAVE_LVL_VOIP_COMPATIBLE   1
-#define IWN_POWERSAVE_LVL_MAX           5
-
-#define IWN_POWERSAVE_LVL_DEFAULT   IWN_POWERSAVE_LVL_NONE
+static const struct iwn_rate {
+    uint8_t rate;
+    uint8_t plcp;
+    uint8_t flags;
+} iwn_rates[IWN_RIDX_MAX + 1] = {
+    {   2,  10, IWN_RFLAG_CCK },
+    {   4,  20, IWN_RFLAG_CCK },
+    {  11,  55, IWN_RFLAG_CCK },
+    {  22, 110, IWN_RFLAG_CCK },
+    {  12, 0xd, 0 },
+    {  18, 0xf, 0 },
+    {  24, 0x5, 0 },
+    {  36, 0x7, 0 },
+    {  48, 0x9, 0 },
+    {  72, 0xb, 0 },
+    {  96, 0x1, 0 },
+    { 108, 0x3, 0 },
+    { 120, 0x3, 0 }
+};
 
-/* DTIM value to pass in for IWN_POWERSAVE_LVL_VOIP_COMPATIBLE */
-#define IWN_POWERSAVE_DTIM_VOIP_COMPATIBLE  2
+#define IWN4965_MAX_PWR_INDEX   107
 
 /*
  * RF Tx gain values from highest to lowest power (values obtained from
@@ -2047 +1651 @@
     uint32_t    min_energy_cck;
     uint32_t    energy_cck;
     uint32_t    energy_ofdm;
-    uint32_t    barker_mrc;
 };
 
 /*
@@ -2062 +1665 @@
     200, 400,
      97,
     100,
-    100,
-    390
+    100
 };
 
 static const struct iwn_sensitivity_limits iwn5000_sensitivity_limits = {
@@ -2075 +1677 @@
     170, 400,
      95,
      95,
-     95,
-     390
+     95
 };
 
 static const struct iwn_sensitivity_limits iwn5150_sensitivity_limits = {
@@ -2088 +1689 @@
     170, 400,
      95,
      95,
-     95,
-     390,
+     95
 };
 
 static const struct iwn_sensitivity_limits iwn1000_sensitivity_limits = {
@@ -2101 +1701 @@
     170, 400,
      95,
      95,
-     95,
-     390,
+     95
 };
 
 static const struct iwn_sensitivity_limits iwn6000_sensitivity_limits = {
@@ -2114 +1713 @@
     160, 310,
      97,
      97,
-    100,
-    390
-};
-
-static const struct iwn_sensitivity_limits iwn6235_sensitivity_limits = {
-    105, 110,
-    192, 232,
-     80, 145,
-    128, 232,
-    125, 175,
-    160, 310,
-    100,
-    110,
-    110,
-    336
-};
-
-
-/* Get value from linux kernel 3.2.+ in Drivers/net/wireless/iwlwifi/iwl-2000.c*/
-static const struct iwn_sensitivity_limits iwn2030_sensitivity_limits = {
-    105,110,
-    128,232,
-    80,145,
-    128,232,
-    125,175,
-    160,310,
-    97,
-    97,
-    110
+    100
 };
 
 /* Map TID to TX scheduler's FIFO. */
@@ -2228 +1799 @@
 #define IWN_BARRIER_READ_WRITE(sc)                  \
     bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, (sc)->sc_sz, \
         BUS_SPACE_BARRIER_READ | BUS_SPACE_BARRIER_WRITE)
-
-#endif  /* __IF_IWNREG_H__ */

src/add-ons/kernel/drivers/network/wlan/iprowifi4965/dev/iwn/if_iwnvar.h

@@ -2 +2 @@
 /*  $OpenBSD: if_iwnvar.h,v 1.18 2010/04/30 16:06:46 damien Exp $   */
 
 /*-
- * Copyright (c) 2013 Cedric GROSS <cg@cgross.info>
- * Copyright (c) 2011 Intel Corporation
  * Copyright (c) 2007, 2008
  *  Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2008 Sam Leffler, Errno Consulting
@@ -20 +18 @@
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
-enum iwn_rxon_ctx_id {
-        IWN_RXON_BSS_CTX,
-        IWN_RXON_PAN_CTX,
-        IWN_NUM_RXON_CTX
-};
-
-struct iwn_pan_slot {
-    uint16_t    time;
-    uint8_t     type;
-    uint8_t     reserved;
-} __packed;
-
-struct iwn_pan_params_cmd {
-    uint16_t flags;
-#define IWN_PAN_PARAMS_FLG_SLOTTED_MODE (1 << 3)
-
-    uint8_t reserved;
-    uint8_t num_slots;
-    struct iwn_pan_slot slots[10];
-} __packed;
-
-struct iwn_led_mode
-{
-    uint8_t     led_cur_mode;
-    uint64_t    led_cur_bt;
-    uint64_t    led_last_bt;
-    uint64_t    led_cur_tpt;
-    uint64_t    led_last_tpt;
-    uint64_t    led_bt_diff;
-    int     led_cur_time;
-    int     led_last_time;
-};
 
 struct iwn_rx_radiotap_header {
     struct ieee80211_radiotap_header wr_ihdr;
@@ -112 +78 @@
     int         qid;
     int         queued;
     int         cur;
-    int         read;
 };
 
 struct iwn_softc;
@@ -136 +101 @@
     struct  ieee80211_node      ni; /* must be the first */
     uint16_t            disable_tid;
     uint8_t             id;
-    struct {
-        uint64_t        bitmap;
-        int         startidx;
-        int         nframes;
-    } agg[IEEE80211_TID_SIZE];
+    uint8_t             ridx[IEEE80211_RATE_MAXSIZE];
 };
 
 struct iwn_calib_state {
@@ -163 +124 @@
     uint32_t    bad_plcp_cck;
     uint32_t    fa_cck;
     uint32_t    low_fa;
-    uint32_t    bad_plcp_ht;
     uint8_t     cck_state;
 #define IWN_CCK_STATE_INIT  0
 #define IWN_CCK_STATE_LOFA  1
@@ -214 +174 @@
                 int);
     void        (*tx_done)(struct iwn_softc *, struct iwn_rx_desc *,
                 struct iwn_rx_data *);
+#if 0   /* HT */
     void        (*ampdu_tx_start)(struct iwn_softc *,
-                struct ieee80211_node *, int, uint8_t, uint16_t);
-    void        (*ampdu_tx_stop)(struct iwn_softc *, int, uint8_t,
+                struct ieee80211_node *, uint8_t, uint16_t);
+    void        (*ampdu_tx_stop)(struct iwn_softc *, uint8_t,
                 uint16_t);
+#endif
 };
 
 struct iwn_vap {
@@ -226 +188 @@
 
     int         (*iv_newstate)(struct ieee80211vap *,
                     enum ieee80211_state, int);
-    int         ctx;
-    int         beacon_int;
-    uint8_t     macaddr[IEEE80211_ADDR_LEN];
-
 };
 #define IWN_VAP(_vap)   ((struct iwn_vap *)(_vap))
 
@@ -249 +207 @@
 #define IWN_FLAG_HAS_11N    (1 << 6)
 #define IWN_FLAG_ENH_SENS   (1 << 7)
 #define IWN_FLAG_ADV_BTCOEX (1 << 8)
-#define IWN_FLAG_PAN_SUPPORT    (1 << 9)
-#define IWN_FLAG_BTCOEX     (1 << 10)
 
     uint8_t         hw_type;
-    /* subdevice_id used to adjust configuration */
-    uint16_t        subdevice_id;
 
     struct iwn_ops      ops;
     const char      *fwname;
     const struct iwn_sensitivity_limits
                 *limits;
     int         ntxqs;
-    int         firstaggqueue;
     int         ndmachnls;
     uint8_t         broadcast_id;
     int         rxonsz;
@@ -296 +249 @@
     struct iwn_tx_ring  txq[IWN5000_NTXQUEUES];
     struct iwn_rx_ring  rxq;
 
+    int         mem_rid;
     struct resource     *mem;
     bus_space_tag_t     sc_st;
     bus_space_handle_t  sc_sh;
+    int         irq_rid;
     struct resource     *irq;
     void            *sc_ih;
     bus_size_t      sc_sz;
@@ -309 +264 @@
     struct task     sc_radioon_task;
     struct task     sc_radiooff_task;
 
-    /* Calibration information */
     struct callout      calib_to;
     int         calib_cnt;
     struct iwn_calib_state  calib;
-    int         last_calib_ticks;
     struct callout      watchdog_to;
-    struct callout      ct_kill_exit_to;
+
     struct iwn_fw_info  fw;
-    struct iwn_calib_info   calibcmd[IWN5000_PHY_CALIB_MAX_RESULT];
+    struct iwn_calib_info   calibcmd[5];
     uint32_t        errptr;
 
     struct iwn_rx_stat  last_rx_stat;
     int         last_rx_valid;
     struct iwn_ucode_info   ucode_info;
-    struct iwn_rxon     rx_on[IWN_NUM_RXON_CTX];
-    struct iwn_rxon     *rxon;
-    int         ctx;
-    struct ieee80211vap *ivap[IWN_NUM_RXON_CTX];
-
-    /* General statistics */
-    /*
-     * The statistics are reset after each channel
-     * change.  So it may be zeroed after things like
-     * a background scan.
-     *
-     * So for now, this is just a cheap hack to
-     * expose the last received statistics dump
-     * via an ioctl().  Later versions of this
-     * could expose the last 'n' messages, or just
-     * provide a pipeline for the firmware responses
-     * via something like BPF.
-     */
-    struct iwn_stats    last_stat;
-    int         last_stat_valid;
-
-    uint8_t         uc_scan_progress;
+    struct iwn_rxon     rxon;
     uint32_t        rawtemp;
     int         temp;
     int         noise;
@@ -359 +291 @@
     char            eeprom_domain[4];
     uint32_t        eeprom_crystal;
     int16_t         eeprom_temp;
-    int16_t         eeprom_temp_high;
     int16_t         eeprom_voltage;
     int8_t          maxpwr2GHz;
     int8_t          maxpwr5GHz;
     int8_t          maxpwr[IEEE80211_CHAN_MAX];
-
-    uint32_t        tlv_feature_flags;
+    int8_t          enh_maxpwr[35];
 
     int32_t         temp_off;
     uint32_t        int_mask;
@@ -376 +306 @@
     uint8_t         chainmask;
 
     int         sc_tx_timer;
-    int         sc_scan_timer;
-
-    /* Are we doing a scan? */
-    int         sc_is_scanning;
-
-    struct ieee80211_tx_ampdu *qid2tap[IWN5000_NTXQUEUES];
-
-    int         (*sc_ampdu_rx_start)(struct ieee80211_node *,
-                    struct ieee80211_rx_ampdu *, int, int, int);
-    void            (*sc_ampdu_rx_stop)(struct ieee80211_node *,
-                    struct ieee80211_rx_ampdu *);
-    int         (*sc_addba_request)(struct ieee80211_node *,
-                    struct ieee80211_tx_ampdu *, int, int, int);
-    int         (*sc_addba_response)(struct ieee80211_node *,
-                    struct ieee80211_tx_ampdu *, int, int, int);
-    void            (*sc_addba_stop)(struct ieee80211_node *,
-                    struct ieee80211_tx_ampdu *);
-
-    struct  iwn_led_mode sc_led;
 
     struct iwn_rx_radiotap_header sc_rxtap;
     struct iwn_tx_radiotap_header sc_txtap;
-
-    /* The power save level originally configured by user */
-    int         desired_pwrsave_level;
-
-    /*
-     * The current power save level, this may differ from the
-     * configured value due to thermal throttling etc.
-     */
-    int         current_pwrsave_level;
-
-    /* For specific params */
-    const struct iwn_base_params *base_params;
 };
 
 #define IWN_LOCK_INIT(_sc) \