Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Attempt to make 5GHz HT/40 work on the 6xxx series NICs.

The 6205 (Taylor Peak) in the Lenovo X230 works fine in 5GHz 11a and 11n HT20,
but not 11n HT40. The NIC goes RX deaf the moment HT40 is configured.
It's so RX deaf that it doesn't even hear beacons and the firmware sends
"BEACON MISS" events. That's pretty deaf.

I tried configuring up the HT40 flags in monitor mode and it worked - so
I assumed that doing the transition from 20 -> 40MHz channel configuration
when going auth->assoc (ie, after the NIC has been partially configured)
is a problem.

So for now, let's just always set them if they're available.

Tested:

* Intel 5300, STA mode, 5GHz HT/40 AP; 2GHz HT/20 AP
* Intel 6205, STA mode, 5GHz HT/40, HT20, 11a AP; 2GHz HT/20 AP

This was pointed out to me by coworkers trying to use FreeBSD-HEAD
in the office on their Thinkpad T420p laptops.

TODO:

* I don't like how the HT40 flags are configured - the whole interop/
protection config should be re-checked. Notably, I think curhtprotmode
is 0 in a lot of cases, which means "no interoperability" and i think
that's busted.

Sponsored by: Norse Corp, Inc.

Bring over some more status codes from the Linux iwlwifi driver.

The (eventual) intention is to create MIB counters for transmitted
frame completion to count how many packets with each status are
transmitted.

Note the difference between A-MPDU and non A-MPDU status.

Obtained from: Linux iwlwifi/dvm driver

Fix antenna configuration, microcode version checks and rate selection
in preparation for the 5300 3x3 NIC.

During this particular adventure, I did indeed discover that a whole
swath of things made little to no sense.

Those included, and are fixed here:

* A lot of the antenna configuration bits assume the NIC has two receive
chains. That's blatantly untrue for NICs that don't.
* There was some disconnect between the antenna configuration when
forming a PLCP rate DWORD (which includes the transmit antenna
configuration), separate to the link quality antenna configuration.

So now there's helper functions to return which antenna configurations
to use and those are used wherever an antenna config is required.

* The 5300 does up to three stream TX/RX (so MCS0->23), however
the link quality table has only 16 slots. This means all of the
rate entries are .. well, dual-stream rates. If this is the case,
the "last MIMO" parameter can't be 16 or it panics the firmware.
Set it to 15.

* .. and since yes it has 16 slots, it only would try retransmitting
from MCS8->MCS23, which can be quite .. terrible. Hard-code the last
two retry slots to be the lowest configured rate.

* I noticed some transmit configuration command stuff is different
based on firmware API version, so I lifted that code from Linux.

* Add / augment some more logging to make it easier to capture this
stuff.

Now, 3x3 is still terrible because the link quality configuration is
plainly not good enough. I'll have to think about that.
However, the original goal of this - 3x3 operation on the Intel
5300 NIC - actually worked.

There are also rate control bugs in the way this driver handles
notifying the net80211 rate control code when AMPDU is enabled.
It always steps the rate up to the maximum rate possible - and
this eventually ends in much sadness. I'll fix that later.

As a side note - 2GHz HT40 now works on all the NICs I have tested.

As a second side note - this exposed some bad 3x3 behaviour in
the ath(4) rate control code where it starts off at a 3-stream rate
and doesn't downgrade quickly enough. This makes the initial
dhcp exchange take a long time. I'll fix the ath(4) rate code
to start at a low fixed 1x1 MCS rate and step up if everything
works out.

Tested:

* Intel 2200
* Intel 2230
* Intel 5300
* Intel 5100
* Intel 6205
* Intel 100

TODO:

* Test the other NICs more thoroughly!

Thank you to Michael Kosarev <russiane39@gmail.com> for donating the
Intel 5300 NIC and pestering me about it since last year to try and
make it all work.

Add a missing comma between error message definitions.

CID: 1199266
Found with: Coverity Prevent(tm)
MFC after: 1 week

Add the bluetooth information structs to the firmware RX statistics message.

It turns out that there's a variant format of the RX statisitcs notification
from the intel firmware. It's even more whacked - the non-BT variant has
bluetooth fields; apparently some later NICs return even _more_ bluetooth
related fields.

I'll commit the statistics structure changes here - it's a no-op for the
driver. I'll later teach the driver code to populate a statistics structure
from the received message after reformatting things correctly.

I don't _think_ it's going to fix anything related to sensitivity programming
as the CCK/OFDM (non-11n) fields are in the same place for both formats.
But the HT structure and the general statistics aren't in the same place.

I'll go find some NIC(s) that spit out the other format and when I find one,
I'll go and update the driver to handle things correctly.

Tested:

* Intel 5100 (which returns the legacy, non-BT format)

Obtained from: Linux iwlwifi

Fix a typo.

Fix indentation.

Add some initial support for the Intel 6235.

Tested:

* Intel 5100
* Intel 6235

Obtained from: mav, others

Overhaul the iwn(4) scan infrastructure to be slightly more "correct"
for these chipsets.

* Correctly set the active/passive flag in the scan request - this is
NOT a "is the channel active|passive"; it's to do with whether we
have an SSID to actively scan for or not. The firmware takes care
of the active/passive setup of the channel.

* Calculate the active/passive dwell time based on the beacon interval
and the channel mode, rather than using a hard coded value.

* For now, hardcode the scan service_time. It's defined as:

31:22 - number of beacon intervals to come back onto the home channel
for;
0:21 - time (microseconds) to come back onto the home channel for.

When doing an active scan when the NIC is active (whether we're associated
or not - it only matters if we've setup the NIC to a destination or not)
this determines how much time to stay on the home channel for when
scanning. We can tune this based on the amount of active traffic.

For now it's 4 beacon intervals and 100 microseconds.

* Fix the "good crc threshold" setting. It differs based on the NIC
firmware. Some older firmware required a workaround; the later
firmware instead treats the field as a flag.

* Enforce that we are not sending a scan command if one is already
pending. Any time this is done is a bug and it absolutely needs
to be fixed - so be very loud.

* Add the SCAN flag to a few debug messages that are scan related but
only occuring under STATE.

Now, this does get noisy when you're scanning in an actively busy 2GHz
network as the firmware (for reason I don't quite yet understand) seems
hell bent on staying on some passive channels longer than it should.
However, it should eventually recover and complete the scan.

This is a work in progress; please let me know if things get stuck or
if things improve!

Tested:

* intel centrino 2200
* intel centrino 2230
* intel 6200
* intel 5100
* intel 4965 (gets upset, but that's a known issue)

Obtained from: linux iwlwifi

Fix undefined behavior: (1 << 31) is not defined as 1 is an int and this
shifts into the sign bit. Instead use (1U << 31) which gets the
expected result.

This fix is not ideal as it assumes a 32 bit int, but does fix the issue
for most cases.

A similar change was made in OpenBSD.

Discussed with: -arch, rdivacky
Reviewed by: cperciva

Add definitions for the microcode TLV flags entry (type 18.)

This isn't used anywhere just yet!

Obtained from: Linux iwlwifi

This is "scan_flags" from Linux.

Add some new driver definitions as part of the chip support updates:

This is a no-op for now!

* Add a new flag value for "there are no extra bits" for some random
field;

* Add a definition for the maximum number of calibration entries in
the calibration data cache in iwn_softc. It's not yet used.

* Add regulatory bands for the 2030 NIC.

Submitted by: Cedric Gross <cg@cgross.info>

Remove trailing whitespace.

Submitted by: Cedric Gross <cg@cgross.info>

add 0x8b, lifted from Linux iwlegacy/commands.h

This is "STA invalid". I saw it during some 4965 testing (kern/183260)
and I still have no idea what is causing it.

Obtained from: Linux drivers/net/wireless/iwlegacy

Add #ifdef wrapper around definitions so they aren't included multiple
times.

Add in some definitions required for later iwn(4) device support.

This also clarifies a few existing fields.

Tested:

* Intel 5100

Submitted by: Cedric GROSS <cg@gross.info>

Break out the iwn(4) device IDs into if_iwn_devid.h, as well as add
IDs for new devices.

* Add new device IDs
* Extend the ID probe code to include the newer range of bits used
by later model devices

Tested:

* Intel 5100, STA mode

TODO:

* Test on Intel 4965, just to be sure

Submitted by: Cedric GROSS <cg@gross.info>

iwn(4) debugging improvements.

* Add in some new register debugging under IWN_DEBUG_REGISTER
* Make IWN_DEBUG an option now for building. I'll chase this up
with a commit to 'options' soon.

Submitted by: Cedric GROSS <cg@cgross.info>

The DC calibration result obtained during initialization can't be
passed over to the runtime firmware on 6050 devices. Instead let
the runtime firmware do the calibration itself. This fixes support
for the 6050 series devices.

Obtained from: OpenBSD
Submitted by: kevlo
Tested by: lx, Tz-Huan Huang(earlier version)

Notify firmware about various HT parameters once associated.

Add support for TX packet aggregation.

Add support for transmitting frames at MCS rates.

Prepare for transmitting frames at MCS rates:
- instead of calling iwn_plcp_signal() for every frame, map the expected
value directly within wn->ridx
- concat plcp, rflags and xrflags, there is no clean byte boundary within
the flags, for example the antenna setting uses bit 6, 7 and 8
- there is still need for a custom rate to plcp mapping, as those expected
by the hardware are not conform to the std

Use the enhanced TX power information availabe on newer EEPROMs.

The 6000 series adapters have a slightly different offset for band 6,
2GHz HT40 channels.

Add basic support for advanced bluetooth coexistence required
for 6005 gen2b (1030/6030) adapters.

Pull some features out of the firmware:
- If a ENH_SENS TLV section exit the firmware is capable of doing
enhanced sensitivity calibration.
- Newer devices/firmwares have more calibration commands therefore
hardcoding the noise gain/reset commands no longer works. It is
supposed to use the next index after the newest calibration type
support. Read the command index of the TLV section if available.

Add some new features:
- 6000 series devices need enhanced sensitivity calibration.
- 6000 series devices need a different setting for the shadow reg.
- set the IWN_FLAG_HAS_11N bit if the EEPROM says the device has 11n
support.

Obtained from: OpenBSD

Just a whitespace sync, some more style(9) conform then others.

Instead of hardcoding TX rates and using that to fill the retry table
use the neogotiated ni_rates instead.

The 6005 series devices need additional temperature offset calibration
as well as the IWN_GP_DRIVER_CALIB_VER6 bit set.

Obtained from: OpenBSD

Don't timeout when stopping DMA channels.

Obtained from: OpenBSD

Remove IWN_FLAG_HAS_5GHZ and IWN_PCI_BAR0, both unused.

Add support for firmware images in "type-length-value" format.

Obtained from: OpenBSD
MFC after: 2 weeks

- Add new IDs for 6000 series devices.
- The 6000 series WiMAX devices need a separate firmware.
- The b-gen devices are not hooked because the hardware revision type
is not know.

Obtained from: OpenBSD
MFC after: 1 week

* Rename bluetooth coexistence flags, no binary change.
* Enable DC calibration and crystal calibration on Centrino Advanced-N
6250 parts.
* Workaround for a HW bug (does not affect 4965AGN) that may sporadically
affect latency under some rare circumstances. From a similar commit to
iwlwifi.
* Update sensitivity settings for 5000 series to workaround a performance
bug in the DSP (1000 is not affected so we keep the old values for 5000).
* Update sensitivity settings for 6000 series.
* Set differential gains on 6250 too (but use a 1.0 factor, not 1.5).
* Init OFDM sensitivity with min value (which depends on the chip)
instead of hardcoding it to 90.
* Read calibration version from ROM and set IWN_GP_DRIVER_CALIB_VER6
bit on 6x50 if version >= 6.

Approved by: rpaulo (mentor)
Obtained from: OpenBSD
MFC after: 2 weeks

o add more notification strings in iwn_intr_str()
o sync with OpenBSD code

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>
MFC after: 3 days

iwn(4) update. Notable changes:
* new firmware
* untested support for 1000 and 6000 series
* bgscan support
* remove unnecessary RXON changes
* allow setting of country/regdomain by enforcing channel flags read
from the EEPROM
* suspend/resume fixes
* RF kill switch fixes
* LED adjustments
* several bus_dma*() related fixes
* addressed some LORs
* many other bug fixes

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>
Obtained from: Brandon Gooch <jamesbrandongooch at gmail dot com> (LED
related changes), Benjamin Kaduk <kaduk at mit dot edu>
(LOR fixes), OpenBSD

Updated iwn(4) driver supporting the newer series, 5000, 5150 and 5300.

Submitted by: Bernhard Schmidt <bschmidt at techwires.net>

Intel 4965 wireless driver (derived from openbsd driver of the same name)