MFC r281383:

iwn, wlan: fix typos
Fxi tow typos

MFC: r260086

- Probe with BUS_PROBE_DEFAULT instead of 0.
- Remove clearing PCIM_CMD_INTxDIS; pci(4) will do that as appropriate since
r189367.

MFC: r260053

- There's no need to keep track of resource IDs.
- Simplify MSI allocation and release. For a single one, we don't need to
fiddle with the MSI count and pci_release_msi(9) is smart enough to just
do nothing in case of INTx.
- Don't allocate MSI as RF_SHAREABLE.
- Use DEVMETHOD_END.
- Use NULL instead of 0 for pointers.

MFC: r264416

Add a missing comma between error message definitions.

CID: 1199266
Found with: Coverity Prevent(tm)
MFC after: 1 week

MFC r260444:

Rename definition of IEEE80211_FC1_WEP to IEEE80211_FC1_PROTECTED.

The origin of WEP comes from IEEE Std 802.11-1997 where it defines
whether the frame body of MAC frame has been encrypted using WEP
algorithm or not.
IEEE Std. 802.11-2007 changes WEP to Protected Frame, indicates
whether the frame is protected by a cryptographic encapsulation
algorithm.

Reviewed by: adrian, rpaulo

MFC r258779,r258780,r258787,r258822:

Fix undefined behavior: (1 << 31) is not defined as 1 is an int and this
shifts into the sign bit. Instead use (1U << 31) which gets the
expected result.

Similar to the (1 << 31) case it is not defined to do (2 << 30).

This fix is not ideal as it assumes a 32 bit int, but does fix the issue
for most cases.

A similar change was made in OpenBSD.

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Migrate iwn(4) to use the new ieee80211_tx_complete() API.

Tested:

* Intel 5100, STA mode

Update PCI drivers to no longer look at the MEMIO-enabled bit in the PCI
command register. The lazy BAR allocation code in FreeBSD sometimes
disables this bit when it detects a range conflict, and will re-enable
it on demand when a driver allocates the BAR. Thus, the bit is no longer
a reliable indication of capability, and should not be checked. This
results in the elimination of a lot of code from drivers, and also gives
the opportunity to simplify a lot of drivers to use a helper API to set
the busmaster enable bit.

This changes fixes some recent reports of disk controllers and their
associated drives/enclosures disappearing during boot.

Submitted by: jhb
Reviewed by: jfv, marius, achadd, achim
MFC after: 1 day

Use the correct structure size when flipping the BT coex state machine.

This showed up when doing some basic testing on the Intel 6230.

Tested:

* Intel 6230, STA mode

Prepare for the PAN (personal area network) support for iwn(4).

* Break out the single, static RX context into a pointer, and ..
* .. extend it to two RX contexts - a default and a PAN context.

Whilst here, add a few extra fields in preparation for further iwn(4)
work.

Tested:

* Intel 4965, STA mode - same level of stability
* Intel 5100, STA mode - no change

Submitted by: Cedric Gross <cg@gross.info>

Cap the number of streams supported to two for now.

I haven't yet reviewed the Intel driver(s) in more depth to see if
there are 1x1 NICs that report they support 2 transmit/receive chains..
if so then we'll have to update this.

Tested:

* Intel 4965, which is a 2x2 device with 3 RX and 2 TX chains.

PR: kern/181132

Fixing a typo.

Approved by: sbruno (mentor, implicit)

Add in some definitions required for later iwn(4) device support.

This also clarifies a few existing fields.

Tested:

* Intel 5100

Submitted by: Cedric GROSS <cg@gross.info>

Break out the iwn(4) device IDs into if_iwn_devid.h, as well as add
IDs for new devices.

* Add new device IDs
* Extend the ID probe code to include the newer range of bits used
by later model devices

Tested:

* Intel 5100, STA mode

TODO:

* Test on Intel 4965, just to be sure

Submitted by: Cedric GROSS <cg@gross.info>

Now that conf/options knows about if_iwn.h, add it to if_iwn.c.

This allows for IWN_DEBUG (and maybe more stuff later) to be a build
time configure option.

iwn(4) debugging improvements.

* Add in some new register debugging under IWN_DEBUG_REGISTER
* Make IWN_DEBUG an option now for building. I'll chase this up
with a commit to 'options' soon.

Submitted by: Cedric GROSS <cg@cgross.info>

Implement some function tracing.

Submitted by: Cedric GROSS <cg@cgross.info>

Support setting up the iwn debug flags during probe/attach by
checking "hint.iwn.X.debug".

Submitted by: Cedric GROSS <cg@cgross.info>

Add new IDs for The Intel 2230 wireless NIC.

Submitted by: Cedric GROSS <cg@cgross.info>

Implement basic 802.11n awareness in the PHY and AMRR rate control code.

* Add 802.11n 2ghz and 5ghz tables, including legacy rates and up to
MCS23 rates (3x3.)

* Populate the rate code -> rate index lookup table with MCS _and_
normal rates, but _not_ the basic rate flag. Since the basic rate flag
is the same as the MCS flag, we can only use one.

* Introduce some accessor inlines that do PLCP and rate table lookup/access
and enforce that it doesn't set the basic rate bit. They're not
designed for MCS rates, so it will panic.

* Start converting drivers that use the rate table stuff to use the
accessor inlines and strip the basic flag.

* Teach AMRR about basic 11n - it's still as crap for MCS as it is
being used by iwn, so it's not a step _backwardS_.

* Convert iwn over to accept 11n MCS rates rather than 'translate' legacy
to MCS rates. It doesn't use a lookup table any longer; instead it's a
function which takes the current node (for HT parameters) and the
rate code, and returns the hardware PLCP code to use.

Tested:

* ath - it's a no-op, and it works that way
* iwn - both 11n and non-11n

Enable the station-side power management flag.

It's not enabled by default in net80211 so this is a no-op unless
if you enable it (ifconfig wlan0 powersave).

Tested:

* iwn0: <Intel WiFi Link 5100> mem 0xf4300000-0xf4301fff irq 17 at device 0.0 on pci3

TODO:

* .. test on all the other NICs
* See if I have to disable it during scan and such
* Make it configurable live, rather than only after it's done its initial
receive calibration.

Fixing incorrect id for Intel Centrino Wireless-N 130.

PR: kern/180094
Submitted by: Cedric <cg@cgross.info>
Approved by: sbruno (mentor)
MFC after: 3 weeks

Mechanically substitute flags from historic mbuf allocator with
malloc(9) flags in sys/dev.

Include opt_wlan.h so the net80211 RX debug API compiles correctly.

fix a panic resulting from a stray '&'

MFC after: 1 week

We need to defer passing the DELBA request to the firmware until the aggr
queue is empty or the firmware will go nuts.

PR: kern/167806
Tested by: osa@, Brandon Gooch (earlier version),
Bojan Petrovic (earlier version)
MFC after: 3 days

Fix a TX aggregation issue, if after the last compressed BA notification
the TX queue is empty, there won't be a TX done notification, effectly
resulting in an mbuf leak. The correct way to handle this is to free
up mbufs on both BA and TX done notifications up to the last sent seqno.

Tested by: osa@
MFC after: 3 days

Remove nitems() now that it lives in <sys/param.h> since r236486.

remove unused vap variable

MFC after: 1 week

Discard frames after a DELBA which where queued during an active BA
session.

MFC after: 1 week

Add some more 100/130 series device IDs.

MFC after: 3 days

Migrate the net80211 TX aggregation state to be from per-AC to per-TID.

TODO:

* Test mwl(4) more thoroughly!

Reviewed by: bschmidt (for iwn)

Use the M_AMPDU_MPDU flag to determine when to manually set the seqno and
use a BA queue.

strip (R) to match manpage and pci_vendors

MFC after: 1 week

Add support for 6150 series devices.

Tested by: Shane Riddle <sh4neriddle at yahoo dot com>
MFC after: 1 week

Use suspend/resume methods provided by net80211. This ensures that the
appropriate state handling takes place, not doing so results in the
device doing nothing until manual intervention.

Reviewed by: iwasaki
Tested by: iwasaki (iwi)
MFC after: 4 weeks

On state changes from RUN to anything else the AGGR sessions are
cleared/dropped leading to qid2tap[n] being NULL as there no longer
is a tap. Now, if there have been lots of frames queued the firmware
processes and returns those after the tap is gone.

Tested by: osa
MFC after: 1 week

Don't rely on MCS7 being at index 7 while determining the amount
of antennas to use. Not all APs enable all MCS rates.

Poked by: Lucius Windschuh <lwindschuh at googlemail dot com>
MFC after: 1 week

Fix some net80211 enum nits:
- ic_vap_create() uses an ieee80211_opmode argument
- ieee80211_rate2media() takes an ieee80211_phymode argument
- ieee80211_plcp2rate() takes an ieee80211_phytype argument
- cast to enum ieee80211_protmode and ieee80211_roamingmode to silence
compiler warnings

Submitted by: arundel@

The DC calibration result obtained during initialization can't be
passed over to the runtime firmware on 6050 devices. Instead let
the runtime firmware do the calibration itself. This fixes support
for the 6050 series devices.

Obtained from: OpenBSD
Submitted by: kevlo
Tested by: lx, Tz-Huan Huang(earlier version)

Let net80211 also know about stopped BA sessions. This fixes some issues
where the driver assumed that BA resources are still available due to
net80211 saying so.

PR: 161407, 159768
Tested by: cperciva, rene
MFC after: 3 days

Fix bmiss notifications, events should be sent when NOT scanning.

MFC after: 3 days

Recognize the Intel(R) Centrino(R) Wireless-N 130.

PR: 161162

Manually set the channel when using monitor mode - the firmware
doesn't select it automatically.

Submitted by: nox
Reviewed by: bschmidt
Approved by: re
PR: kern/160815

Make sure to drop the IEEE80211_RATE_BASIC flag even for MCS rates.

Reported by: Maciej Milewski <milu at dat dot pl>
Tested by: Maciej Milewski <milu at dat dot pl>

Enable HT40 (40MHz channel width) support.

Only consider QoS frames for TX packet aggregation.

The firmware of 4965 series adapters seems to die while trying to send
probe requests at 1Mbps while being associated on a 5GHz channel. Sending
those at 6Mbps does work, so use that instead during a background scan.
This workaround allows us to re-enable background scan support for the
4965 adapters.

Also, just enabling one antenna on 5GHz results in better reception of
beacons:
test 00:26:5a:c6:14:1a 40 54M -71:-95 200 E WME HTCAP ATH
vs
test 00:26:5a:c6:14:1a 40 54M -92:-95 200 E WME HTCAP ATH
Due to roam:rssi thresholds set to 7 by default it might have been
impossible to associate to that network. While here use
IEEE80211_IS_CHAN_5GHZ() to determine the band.

Add module version to iwi/ipw/wpi and iwn.

The version is used to check if a module is already preset, not setting
it results in:

can't re-use a leaf (ipw)!
module_register: module pci/ipw already exists!
Module pci/ipw failed to register: 17

while trying to load the module due to an entry in loader.conf. With this
commit we get the expected:

module ipw already present!

Reported by: Dru Lavigne, bz
Tested by: bz
MFC after: 1 week

Only update the scheduler's byte count table for aggregation queues.
The other queues, especially the command queue, uses the FIFO mode
which doesn't require the byte count table because queued entries are
processed in order.

Pointed out by: Lucius Windschuh <lwindschuh at googlemail dot com>

Enable 11n (sans HT40) support.

Notify firmware about various HT parameters once associated.

Add support for TX packet aggregation.

Add support for RX packet aggregation.

Add support for transmitting frames at MCS rates.

Prepare for transmitting frames at MCS rates:
- instead of calling iwn_plcp_signal() for every frame, map the expected
value directly within wn->ridx
- concat plcp, rflags and xrflags, there is no clean byte boundary within
the flags, for example the antenna setting uses bit 6, 7 and 8
- there is still need for a custom rate to plcp mapping, as those expected
by the hardware are not conform to the std

Read chainmask information before announcing it.

Add HT capabilities to probe requests.

Disable background scan support for 4965 adapters.

On legacy channels every once in a while the firmware throws a SYSASSERT
on line 208. On HT channels though this does always happen and I'm not
aware of any workaround currently.

RX aggregation is slightly different then the legacy path, we will only
receive one RX_PHY for each aggregate and not one RX_PHY per frame.

Allocate all TX rings, those will be use for TX packet aggregation.

Use the enhanced TX power information availabe on newer EEPROMs.

Hook HT channel setup.

The 6000 series adapters have a slightly different offset for band 6,
2GHz HT40 channels.

Re-add 2 device IDs which got lost.

Pointed out by: benjsc

Now that all bits are in for 1030/6230 adapters enable those.
While here pull the adapter names from the Linux driver and sort
the list by ID.

The 6000 series gen2 adapters have 2 firmware images, one with
advanced btcoex support and one without.

Add basic support for advanced bluetooth coexistence required
for 6005 gen2b (1030/6030) adapters.

Enable DC calibration for all 6000 series devices, except those
with an internal PA.
Override the chainmask also for the 6050.

Pull some features out of the firmware:
- If a ENH_SENS TLV section exit the firmware is capable of doing
enhanced sensitivity calibration.
- Newer devices/firmwares have more calibration commands therefore
hardcoding the noise gain/reset commands no longer works. It is
supposed to use the next index after the newest calibration type
support. Read the command index of the TLV section if available.

Add some new features:
- 6000 series devices need enhanced sensitivity calibration.
- 6000 series devices need a different setting for the shadow reg.
- set the IWN_FLAG_HAS_11N bit if the EEPROM says the device has 11n
support.

Obtained from: OpenBSD

Bring over the HAL/OPS changes, instead of two const structs it is now
slightly more dynamic.

Obtained from: OpenBSD

Read RX/TX chainmasks directly of the EEPROM. Some chips are known to
have the wrong/broken information stored, keep the hardcoded values for
those.

Obtained from: OpenBSD

Just a whitespace sync, some more style(9) conform then others.

Sync comments with OpenBSD.

Sync debug and error messages with OpenBSD.

Shuffle code around a bit. Mostly to group functional connected things,
others to get the same order as the OpenBSD code.

Rename some stuff in favour of the OpenBSD names:
- prefer EDCA over WME
- qid for a TXQ ID
- reg for register values

Fix WME/QoS handling:
- move the TX queue selection into iwn_tx_data/iwn_tx_data_raw
- extract traffic identifier and use it
- do not expect ACKs for frames marked as such

Remove if_ierrors which do not necessarily indicate a RX error, also
do account send packets. While here use the IWN_TX_FAIL constant.

Instead of hardcoding TX rates and using that to fill the retry table
use the neogotiated ni_rates instead.

Replace RX/TX ring allocation error messages with something more sane
and remove those where the caller already prints one.

Prevent double-free, also use the same error codes as OpenBSD.

Add missing bus_dmamap_sync calls as well as remove two duplicate ones.

Obtained from: OpenBSD

Unify TX/RX ring allocation, finish the descriptior DMA stuff before
starting with data.

Make sure to destroy all DMA tags and maps.

Rewrite DMA segment handling to be more inline with the OpenBSD code.
Also change the m_len == 0 hack to have less code churn.

scratch_paddr has the same address pre-assigned, use that instead.

In case a new mbuf can't be loaded, reuse the old one.

OpenBSD uses IWN_RBUF_SIZE not MJUMPAGESIZE for the RX path, also replace
caddr_t with void * to be in sync.

Remove the flags argument of iwn_dma_contig_alloc(), it is always set
as BUS_DMA_NOWAIT. While here also set BUS_DMA_COHERENT.

RSSI related syncs with the OpenBSD code:
- read RSSI only for the active chains
- cast RSSI/NF to int8_t before passing it up to radiotap
- remove the htole64() for the timestamp

Obtained from: OpenBSD

Pass errors that might happen during state transitions up to net80211.

Obtain the channel number directly from the laster RXON command, also
chan is an uint8_t.

fix the order of the prototypes from the previosu commit

The 6005 series devices need additional temperature offset calibration
as well as the IWN_GP_DRIVER_CALIB_VER6 bit set.

Obtained from: OpenBSD

Revert some of local calibration changes in favour of the OpenBSD
implementation. This includes the fix required for the 6050 series
devices.

remove debug left-overs

Split up watchdog and calibration callout. This allows us to use different
timing on both and to remove some monitor mode specific hacks (which has
no calibration).

Split out bluetooth coexistence setup.

Fixes for firmware handling:
- there is a local variable for sc->fw_dma, use that instead
- OpenBSD uses 5*hz to wait for firmware to be loaded
- in case the firmware module contains invalid data, actually release it

Only handle beacon misses while in RUN state and not scanning.

Don't timeout when stopping DMA channels.

Obtained from: OpenBSD

Instead of trying to figure out which rxon.flags to clear, restart
from scratch. Remove htole16() calls, rxon.chan is an uint8_t,
ieee80211_chan2ieee() does return an ic_ieee as an int, but I heavily
doubt a htole16() will buy us anything here.

iwn_cleanup() is just a wrapper around iwn_detach(), call it directly
instead.

Reuse net80211 code:
- IWN_TXOP_TO_US is equal to IEEE80211_TXOP_TO_US
- use IEEE80211_DUR_TU
- ieee80211_add_rates/ieee80211_add_xrates are public, use em
- copied ieee80211_add_ssid it is not public

Remove IWN_FLAG_HAS_5GHZ and IWN_PCI_BAR0, both unused.

Do a sweep of the tree replacing calls to pci_find_extcap() with calls to
pci_find_cap() instead.

Pull ieee80211_ratectl_node_init() calls from drivers into net80211.
This fixes hostap mode for at least ral(4) and run(4), because there is
no sufficient call into drivers which could be used initialize the node
related ratectl variables.

MFC after: 3 days

Fixes for monitor mode:
- Do not call iwn_calib_reset() for monitor mode. We do not want to query
information and do runtime calibration while in monitor mode. Poking the
firmware with adjustments for calibration results in firmware asserts.
This could happened on RUN -> RUN transition only.
- Adjust blink rate for monitor mode. It's supposed to not freak out and
turn off after a while.
- While here, remove one useless assignment of calib.state, it gets
overwritten later in the function.

Submitted by: Brandon Gooch <jamesbrandongooch at gmail.com>
MFC after: 1 week

For 6000 series and newer devices the DC calibration results are no
longer requested of the boot firmware. Instead of sending those results
to the runtime firmware the firmware is told to do the DC calibration
itself.

MFC after: 1 week

Instead of using the AMRR ratectl algo as default for drivers which have
the IEEE80211_C_RATECTL flag set, default to NONE for all drivers. Only if
a driver calls ieee80211_ratectl_init() check if the NONE algo is still
selected and try to use AMRR in that case. Drivers are still free to use
any other algo by calling ieee80211_ratectl_set() prior to the
ieee80211_ratectl_init() call.

After this change it is now safe to assume that a ratectl algo is always
available and selected, which renders the IEEE80211_C_RATECTL flag pretty
much useless. Therefore revert r211314 and 211546.

Reviewed by: rpaulo
MFC after: 2 weeks

Fix typo in previous commit.

Rewrite parts of the calibration code which is run while bringing up
the device:
- unobscure some of the code by moving it into its own functions
- get rid of some magic numbers
- create similar structure as the reference driver has, this should
make further syncs easier

Group functions used for initial calibration.

Introduce IEEE80211_C_RATECTL, drivers which use the ratectl framework
should set this capability.

MFC after: 2 weeks

Handle RUN->ASSOC->RUN transition correctly, as in not trigger a
firmware error. Convert if statements to a switch statement while
I'm here.

Tested by: Benjamin Kaduk <kaduk at mit.edu>
MFC after: 2 weeks

Add support for firmware images in "type-length-value" format.

Obtained from: OpenBSD
MFC after: 2 weeks

Detect active chains differently to work around a firmware bug which
would mark non-existing chains as active.

Obtained from: OpenBSD
MFC after: 1 week

- Add new IDs for 6000 series devices.
- The 6000 series WiMAX devices need a separate firmware.
- The b-gen devices are not hooked because the hardware revision type
is not know.

Obtained from: OpenBSD
MFC after: 1 week

Fix some small whitespace nits.

MFC after: 3 days

Remove duplicate vendor:device entry.

MFC after: 3 days

Fix TX retry rate handling. tx->linkq is an index to a rate table
beginning with the highest available rate. Currently we always use
54m for the first retry no matter what AMRR has choosen. Fix this
by setting the index to the next lower rate.

Approved by: rpaulo (mentor)
Tested by: Brandon Gooch <jamesbrandongooch at gmail.com>
MFC after: 2 weeks

Add a workaround for a bug in the firmware regarding the transition
from passive to active scans. Basicly disable it by increasing the
amount packets to be received to an amount which can't be reached
during dwell times.

Approved by: rpaulo (mentor)
MFC after: 3 days

Add new tunable 'net.link.ifqmaxlen' to set default send interface
queue length. The default value for this parameter is 50, which is
quite low for many of today's uses and the only way to modify this
parameter right now is to edit if_var.h file. Also add read-only
sysctl with the same name, so that it's possible to retrieve the
current value.

MFC after: 1 month

Use correct bus_dma_tag_t for TX frames.

Reported by: Andreas Nilsson <andrnils at gmail.com>
Approved by: rpaulo (mentor)
MFC after: 3 days

Declare all functions as static.

Approved by: rpaulo (mentor)
MFC after: 2 weeks

Hook ieee80211_media_change() to ieee80211_vap_attach().

Approved by: rpaulo (mentor)
MFC after: 2 weeks

iwn5000_reset_sched() is not used; #ifdef it.

Approved by: rpaulo (mentor)
MFC after: 2 weeks

Add some missing protoypes.

Approved by: rpaulo (mentor)
MFC after: 2 weeks

iwn4965_set_txpower() uses maxpwr from EEPROM to calculate the power to
set, it make sense to actually initialize that array. This fixes some
issues with 4965 adapters where the TX power is crucial.

This got lost somewhere while merging with the OpenBSD code.

Approved by: rpaulo (mentor)
Obtained from: OpenBSD
MFC after: 2 weeks

* Rename bluetooth coexistence flags, no binary change.
* Enable DC calibration and crystal calibration on Centrino Advanced-N
6250 parts.
* Workaround for a HW bug (does not affect 4965AGN) that may sporadically
affect latency under some rare circumstances. From a similar commit to
iwlwifi.
* Update sensitivity settings for 5000 series to workaround a performance
bug in the DSP (1000 is not affected so we keep the old values for 5000).
* Update sensitivity settings for 6000 series.
* Set differential gains on 6250 too (but use a 1.0 factor, not 1.5).
* Init OFDM sensitivity with min value (which depends on the chip)
instead of hardcoding it to 90.
* Read calibration version from ROM and set IWN_GP_DRIVER_CALIB_VER6
bit on 6x50 if version >= 6.

Approved by: rpaulo (mentor)
Obtained from: OpenBSD
MFC after: 2 weeks

Small whitespace cleanup.

Approved by: rpaulo (mentor)
MFC after: 2 weeks

net80211 rate control framework (net80211 ratectl).

This framework allows drivers to abstract the rate control algorithm and
just feed the framework with the usable parameters. The rate control
framework will now deal with passing the parameters to the selected
algorithm. Right now we have AMRR (the default) and RSSADAPT but there's
no way to select one with ifconfig, yet.
The objective is to have more rate control algorithms in the net80211
stack so all drivers[0] can use it. Ideally, we'll have the well-known
sample rate control algorithm in the net80211 at some point so all
drivers can use it (not just ath).

[0] all drivers that do rate control in software, that is.

Reviewed by: bschmidt, thompsa, weyongo
MFC after: 1 months

Fix for the Intel WiFi Link 1000. The EEPROM image is in the OTPROM block
before the last block, not in the last block itself.

Approved by: rpaulo (mentor)
Obtained from: OpenBSD
MFC after: 3 weeks

o add more notification strings in iwn_intr_str()
o sync with OpenBSD code

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>
MFC after: 3 days

Revert iwn channel-argument handling of set_txpower() to r201822

Pass the channel argument as a real argument and not through
RXON. The RXON version seems to have problem with both the older
228.57.2.23 firmware and the latest 228.61.2.24 version resulting
in device initialization errors like:

wpa_supplicant[2928]: Failed to initiate AP scan.
kernel: firmware error log:
kernel: error type = "SYSASSERT" (0x00000005)
kernel: program counter = 0x0000147C
kernel: source line = 0x0000058B
kernel: error data = 0x0000058B00000000
kernel: branch link = 0x0000145A00001492
kernel: interrupt link = 0x000006DE00000000
kernel: time = 7310
...
kernel: iwn0: iwn_config: could not set TX power
kernel: iwn0: iwn_init_locked: could not configure device, error 35

By passing the current channel to hal->set_txpower() the firmware
error is fixed, at least for the 4965 chipset of my Thinkpad and
the ones tested by Bernhard.

Submitted by: Bernhard Schmidt <bschmidt@techwires.net>
Approved by: rpaulo

Fix array overflow.

Reviewed by: rpaulo

iwn(4) update. Notable changes:
* new firmware
* untested support for 1000 and 6000 series
* bgscan support
* remove unnecessary RXON changes
* allow setting of country/regdomain by enforcing channel flags read
from the EEPROM
* suspend/resume fixes
* RF kill switch fixes
* LED adjustments
* several bus_dma*() related fixes
* addressed some LORs
* many other bug fixes

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>
Obtained from: Brandon Gooch <jamesbrandongooch at gmail dot com> (LED
related changes), Benjamin Kaduk <kaduk at mit dot edu>
(LOR fixes), OpenBSD

Updates to the iwn driver:
* iwnfw has now been split into individual modules so autoloading of
firmware module(s) does work again.
* Changes have been made to RUN -> AUTH transition, this should fix the
issue reported by Glen and others.
* Brandon reported issues in iwn_cmd() with large commands, those have
been fixed to.
* DEAUTH is now handled correctly.

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>

Updated iwn(4) driver supporting the newer series, 5000, 5150 and 5300.

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>

For ic_opmode switch cases, provide a default label with a printf saying
this opmode is not supported.

Approved by: re (kib)

validate tx rate(s) in the raw xmit path

Tested by: "Paul B. Mahol" <onemda@gmail.com> (rum, bwi)

Overhaul monitor mode handling:
o replace DLT_IEEE802_11 support in net80211 with DLT_IEEE802_11_RADIO
and remove explicit bpf support from wireless drivers; drivers now
use ieee80211_radiotap_attach to setup shared data structures that
hold the radiotap header for each packet tx/rx
o remove rx timestamp from the rx path; it was used only by the tdma support
for debugging and was mostly useless due to it being 32-bits and mostly
unavailable
o track DLT_IEEE80211_RADIO bpf attachments and maintain per-vap and
per-com state when there are active taps
o track the number of monitor mode vaps
o use bpf tap and monitor mode vap state to decide when to collect radiotap
state and dispatch frames; drivers no longer explicitly directly check
bpf state or use bpf calls to tap frames
o handle radiotap state updates on channel change in net80211; drivers
should not do this (unless they bypass net80211 which is almost always
a mistake)
o update various drivers to be more consistent/correct in handling radiotap
o update ral to include TSF in radiotap'd frames
o add promisc mode callback to wi

Reviewed by: cbzimmer, rpaulo, thompsa

Abort any scan on a fatal firmware. ic_scan_curchan is overridden to perform
the scan in firmware and this relies on the firmware to wake up the scan task
on completion.

Create a taskqueue for each wireless interface which provides a serialised
sleepable context for net80211 driver callbacks. This removes the need for USB
and firmware based drivers to roll their own code to defer the chip programming
for state changes, scan requests, channel changes and mcast/promisc updates.
When a driver callback completes the hardware state is now guaranteed to have
been updated and is in sync with net80211 layer.

This nukes around 1300 lines of code from the wireless device drivers making
them more readable and less race prone.

The net80211 layer has been updated as follows
- all state/channel changes are serialised on the taskqueue.
- ieee80211_new_state() always queues and can now be called from any context
- scanning runs from a single taskq function and executes to completion. driver
callbacks are synchronous so the channel, phy mode and rx filters are
guaranteed to be set in hardware before probe request frames are
transmitted.

Help and contributions from Sam Leffler.

Reviewed by: sam

Hoist 802.11 encapsulation up into net80211:
o call ieee80211_encap in ieee80211_start so frames passed down to drivers
are already encapsulated
o remove ieee80211_encap calls in drivers
o fixup wi so it recreates the 802.3 head it requires from the 802.11
header contents
o move fast-frame aggregation from ath to net80211 (conditional on
IEEE80211_SUPPORT_SUPERG):
- aggregation is now done in ieee80211_start; it is enabled when the
packets/sec exceeds ieee80211_ffppsmin (net.wlan.ffppsmin) and frames
are held on a staging queue according to ieee80211_ffagemax
(net.wlan.ffagemax) to wait for a frame to combine with
- drivers must call back to age/flush the staging queue (ath does this
on tx done, at swba, and on rx according to the state of the tx queues
and/or the contents of the staging queue)
- remove fast-frame-related data structures from ath
- add ieee80211_ff_node_init and ieee80211_ff_node_cleanup to handle
per-node fast-frames state (we reuse 11n tx ampdu state)
o change ieee80211_encap calling convention to include an explicit vap
so frames coming through a WDS vap are recognized w/o setting M_WDS

With these changes any device able to tx/rx 3Kbyte+ frames can use fast-frames.

Reviewed by: thompsa, rpaulo, avatar, imp, sephe

Eliminate ic_myaddr so changing the mac address of a device works correctly:
o remove ic_myaddr from ieee80211com
o change ieee80211_ifattach to take the mac address of the physical device
and use that to setup the lladdr.
o replace all references to ic_myaddr in drivers by IF_LLADDR
o related cleanups (e.g. kill dead code)

PR: kern/133178
Reviewed by: thompsa, rpaulo

Remove gratuitous unlock in error case.

Reviewed by: sam

remove references to ic_stats

Spotted by: Lucius Windschuh <lwindschuh@googlemail.com>

o use the new association callback to notify the driver when joining a bss
in sta and adhoc modes; this should've been done forever ago as most all
drivers use this hook to set per-station transmit parameters such as for
tx rate control
o adjust drivers to remove explicit calls to the driver newassoc method

Add MSI support.

Tested on: Acer TravelMate 6292 with 0x4229 chip.
Reviewed by: sam@

Change the calling convention for ic_node_alloc to deal with
some longstanding issues:
o pass the vap since it's now the "coin of the realm" and required
to do things like set initial tx parameters in private node
state for use prior to association
o pass the mac address as cards that maintain outboard station
tables require this to create an entry (e.g. in ibss mode)
o remove the node table reference, we only have one node table
and it's unlikely this will change so this is not needed to
find the com structure

We can not call iwn_start directly in the interrupt
context, where the iwn mutex is being held, and
iwn_start assumes that we do not have that mutex held.

Resolve this issue with what we do for other NICs by
splitting the iwn_start procedure into two parts,
iwn_start() do the locking, and iwn_start_locked()
assumes that the mutex is being held. This resolves
panic when WITNESS is enabled.

Minor cleanup of vap create work:
o add IEEE80211_C_STA capability to indicate sta mode is supported
(was previously assumed) and mark drivers as capable
o add ieee80211_opcap array to map an opmode to the equivalent capability bit
o move IEEE80211_C_OPMODE definition to where capabilities are defined so it's
clear it should be kept in sync (on future additions)
o check device capabilities in clone create before trying to create a vap;
this makes driver checks unneeded
o make error codes return on failed clone request unique
o temporarily add console printfs on clone request failures to aid in
debugging; these will move under DIAGNOSTIC or similar before release

Unify all the wifi *_ioctl routines
- Limit grabbing the lock to SIOCSIFFLAGS.
- Move ieee80211_start_all() to SIOCSIFFLAGS.
- Remove SIOCSIFMEDIA as it is not useful.
- Limit ether_ioctl to only SIOCGIFADDR. SIOCSIFADDR and SIOCSIFMTU have no
affect as there is no input/output path in the vap parent. The vap code
will handle the reinit of the mac address changes.
- Split off ndis_ioctl_80211 as it was getting too different to wired devices.

This fixes a copyout while locked and a lock recursion.

Reviewed by: sam

fix build

Submitted by: delphij

disable HT capabilities until we sort out firmware issues

Intel 4965 wireless driver (derived from openbsd driver of the same name)