Updated iwn(4) driver supporting the newer series, 5000, 5150 and 5300.

Submitted by:	Bernhard Schmidt <bschmidt at techwires.net>

3 files changed, 4498 insertions, 2602 deletions

diff --git a/sys/dev/iwn/if_iwn.c b/sys/dev/iwn/if_iwn.c
index 51dea22..eb2182e 100644
--- a/sys/dev/iwn/if_iwn.c
+++ b/sys/dev/iwn/if_iwn.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2007
+ * Copyright (c) 2007-2009
  *	Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2008
  *	Benjamin Close <benjsc@FreeBSD.org>
@@ -19,7 +19,8 @@
  */
 
 /*
- * Driver for Intel Wireless WiFi Link 4965AGN 802.11 network adapters.
+ * Driver for Intel Wireless WiFi Link 4965 and Intel WiFi Link 5000 Series
+ * 802.11 network adapters.
  */
 
 #include <sys/cdefs.h>
@@ -73,29 +74,28 @@ __FBSDID("$FreeBSD$");
 
 static int	iwn_probe(device_t);
 static int	iwn_attach(device_t);
-static int 	iwn_detach(device_t);
-static int	iwn_cleanup(device_t);
+const struct iwn_hal *iwn_hal_attach(struct iwn_softc *);
+void		iwn_radiotap_attach(struct iwn_softc *);
 static struct ieee80211vap *iwn_vap_create(struct ieee80211com *,
 		    const char name[IFNAMSIZ], int unit, int opmode,
 		    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
 		    const uint8_t mac[IEEE80211_ADDR_LEN]);
 static void	iwn_vap_delete(struct ieee80211vap *);
-static int	iwn_shutdown(device_t);
-static int	iwn_suspend(device_t);
-static int	iwn_resume(device_t);
+static int	iwn_cleanup(device_t);
+static int 	iwn_detach(device_t);
+int		iwn_nic_lock(struct iwn_softc *);
+int		iwn_eeprom_lock(struct iwn_softc *);
+int		iwn_init_otprom(struct iwn_softc *);
+int		iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
 static int	iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
 		    void **, bus_size_t, bus_size_t, int);
 static void	iwn_dma_contig_free(struct iwn_dma_info *);
-int		iwn_alloc_shared(struct iwn_softc *);
-void		iwn_free_shared(struct iwn_softc *);
+int		iwn_alloc_sched(struct iwn_softc *);
+void		iwn_free_sched(struct iwn_softc *);
 int		iwn_alloc_kw(struct iwn_softc *);
 void		iwn_free_kw(struct iwn_softc *);
 int		iwn_alloc_fwmem(struct iwn_softc *);
 void		iwn_free_fwmem(struct iwn_softc *);
-struct		iwn_rbuf *iwn_alloc_rbuf(struct iwn_softc *);
-void		iwn_free_rbuf(void *, void *);
-int		iwn_alloc_rpool(struct iwn_softc *);
-void		iwn_free_rpool(struct iwn_softc *);
 int		iwn_alloc_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
 void		iwn_reset_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
 void		iwn_free_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
@@ -103,76 +103,112 @@ int		iwn_alloc_tx_ring(struct iwn_softc *, struct iwn_tx_ring *,
 		    int);
 void		iwn_reset_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
 void		iwn_free_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
-static struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
-		    const uint8_t [IEEE80211_ADDR_LEN]);
+int		iwn_read_eeprom(struct iwn_softc *,
+		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
+void		iwn4965_read_eeprom(struct iwn_softc *);
+void		iwn4965_print_power_group(struct iwn_softc *, int);
+void		iwn5000_read_eeprom(struct iwn_softc *);
+static void	iwn_read_eeprom_channels(struct iwn_softc *, uint32_t, int);
+struct ieee80211_node *iwn_node_alloc(struct ieee80211vap *,
+		    const uint8_t mac[IEEE80211_ADDR_LEN]);
 void		iwn_newassoc(struct ieee80211_node *, int);
 int		iwn_media_change(struct ifnet *);
 int		iwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
-void		iwn_mem_lock(struct iwn_softc *);
-void		iwn_mem_unlock(struct iwn_softc *);
-uint32_t	iwn_mem_read(struct iwn_softc *, uint32_t);
-void		iwn_mem_write(struct iwn_softc *, uint32_t, uint32_t);
-void		iwn_mem_write_region_4(struct iwn_softc *, uint32_t,
-		    const uint32_t *, int);
-int		iwn_eeprom_lock(struct iwn_softc *);
-void		iwn_eeprom_unlock(struct iwn_softc *);
-int		iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
-int		iwn_transfer_microcode(struct iwn_softc *, const uint8_t *, int);
-int		iwn_transfer_firmware(struct iwn_softc *);
-int		iwn_load_firmware(struct iwn_softc *);
-void		iwn_unload_firmware(struct iwn_softc *);
+void		iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *,
+		    struct iwn_rx_data *);
 static void	iwn_timer_timeout(void *);
 static void	iwn_calib_reset(struct iwn_softc *);
-void		iwn_ampdu_rx_start(struct iwn_softc *, struct iwn_rx_desc *);
-void		iwn_rx_intr(struct iwn_softc *, struct iwn_rx_desc *,
+void		iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
+		    struct iwn_rx_data *);
+void		iwn5000_rx_calib_results(struct iwn_softc *,
+		    struct iwn_rx_desc *, struct iwn_rx_data *);
+void		iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *,
+		    struct iwn_rx_data *);
+void		iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
+		    struct iwn_rx_data *);
+void		iwn5000_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
 		    struct iwn_rx_data *);
-void		iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *);
-void		iwn_tx_intr(struct iwn_softc *, struct iwn_rx_desc *);
-void		iwn_cmd_intr(struct iwn_softc *, struct iwn_rx_desc *);
+void		iwn_tx_done(struct iwn_softc *, struct iwn_rx_desc *, int,
+		    uint8_t);
+void		iwn_cmd_done(struct iwn_softc *, struct iwn_rx_desc *);
 void		iwn_notif_intr(struct iwn_softc *);
+void		iwn_wakeup_intr(struct iwn_softc *);
+void		iwn_rftoggle_intr(struct iwn_softc *);
+void		iwn_fatal_intr(struct iwn_softc *, uint32_t, uint32_t);
 void		iwn_intr(void *);
-void		iwn_read_eeprom(struct iwn_softc *,
-		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
-static void	iwn_read_eeprom_channels(struct iwn_softc *);
-void		iwn_print_power_group(struct iwn_softc *, int);
-uint8_t		iwn_plcp_signal(int);
+void		iwn4965_update_sched(struct iwn_softc *, int, int, uint8_t,
+		    uint16_t);
+void		iwn5000_update_sched(struct iwn_softc *, int, int, uint8_t,
+		    uint16_t);
+void		iwn5000_reset_sched(struct iwn_softc *, int, int);
 int		iwn_tx_data(struct iwn_softc *, struct mbuf *,
 		    struct ieee80211_node *, struct iwn_tx_ring *);
-void		iwn_start(struct ifnet *);
-void		iwn_start_locked(struct ifnet *);
 static int	iwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 		    const struct ieee80211_bpf_params *);
-static void	iwn_watchdog(struct iwn_softc *);
+void		iwn_start(struct ifnet *);
+void		iwn_start_locked(struct ifnet *);
+static void	iwn_watchdog(struct iwn_softc *sc);
 int		iwn_ioctl(struct ifnet *, u_long, caddr_t);
 int		iwn_cmd(struct iwn_softc *, int, const void *, int, int);
+int		iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
+		    int);
+int		iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
+		    int);
 int		iwn_set_link_quality(struct iwn_softc *, uint8_t,
 		    const struct ieee80211_channel *, int);
-int		iwn_set_key(struct ieee80211com *, struct ieee80211_node *,
-		    const struct ieee80211_key *);
+int		iwn_add_broadcast_node(struct iwn_softc *,
+		    const struct ieee80211_channel *, int);
 int		iwn_wme_update(struct ieee80211com *);
 void		iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
 int		iwn_set_critical_temp(struct iwn_softc *);
-void		iwn_enable_tsf(struct iwn_softc *, struct ieee80211_node *);
-void		iwn_power_calibration(struct iwn_softc *, int);
-int		iwn_set_txpower(struct iwn_softc *,
+int		iwn_set_timing(struct iwn_softc *, struct ieee80211_node *);
+void		iwn4965_power_calibration(struct iwn_softc *, int);
+int		iwn4965_set_txpower(struct iwn_softc *,
+		    struct ieee80211_channel *, int);
+int		iwn5000_set_txpower(struct iwn_softc *,
 		    struct ieee80211_channel *, int);
-int8_t		iwn_get_rssi(struct iwn_softc *, const struct iwn_rx_stat *);
+int		iwn4965_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
+int		iwn5000_get_rssi(struct iwn_softc *, struct iwn_rx_stat *);
 int		iwn_get_noise(const struct iwn_rx_general_stats *);
-int		iwn_get_temperature(struct iwn_softc *);
+int		iwn4965_get_temperature(struct iwn_softc *);
+int		iwn5000_get_temperature(struct iwn_softc *);
 int		iwn_init_sensitivity(struct iwn_softc *);
-void		iwn_compute_differential_gain(struct iwn_softc *,
+void		iwn_collect_noise(struct iwn_softc *,
 		    const struct iwn_rx_general_stats *);
+int		iwn4965_init_gains(struct iwn_softc *);
+int		iwn5000_init_gains(struct iwn_softc *);
+int		iwn4965_set_gains(struct iwn_softc *);
+int		iwn5000_set_gains(struct iwn_softc *);
 void		iwn_tune_sensitivity(struct iwn_softc *,
 		    const struct iwn_rx_stats *);
 int		iwn_send_sensitivity(struct iwn_softc *);
-int		iwn_auth(struct iwn_softc *, struct ieee80211vap *);
-int		iwn_run(struct iwn_softc *, struct ieee80211vap *);
-int		iwn_scan(struct iwn_softc *);
+int		iwn_set_pslevel(struct iwn_softc *, int, int, int);
 int		iwn_config(struct iwn_softc *);
-void		iwn_post_alive(struct iwn_softc *);
-void		iwn_stop_master(struct iwn_softc *);
-int		iwn_reset(struct iwn_softc *);
-void		iwn_hw_config(struct iwn_softc *);
+int		iwn_scan(struct iwn_softc *);
+int		iwn_auth(struct iwn_softc *, struct ieee80211vap *vap);
+int		iwn_run(struct iwn_softc *, struct ieee80211vap *vap);
+int		iwn5000_query_calibration(struct iwn_softc *);
+int		iwn5000_send_calibration(struct iwn_softc *);
+int		iwn4965_post_alive(struct iwn_softc *);
+int		iwn5000_post_alive(struct iwn_softc *);
+int		iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
+		    int);
+int		iwn4965_load_firmware(struct iwn_softc *);
+int		iwn5000_load_firmware_section(struct iwn_softc *, uint32_t,
+		    const uint8_t *, int);
+int		iwn5000_load_firmware(struct iwn_softc *);
+int		iwn_read_firmware(struct iwn_softc *);
+void		iwn_unload_firmware(struct iwn_softc *);
+int		iwn_clock_wait(struct iwn_softc *);
+int		iwn4965_apm_init(struct iwn_softc *);
+int		iwn5000_apm_init(struct iwn_softc *);
+void		iwn_apm_stop_master(struct iwn_softc *);
+void		iwn_apm_stop(struct iwn_softc *);
+int		iwn4965_nic_config(struct iwn_softc *);
+int		iwn5000_nic_config(struct iwn_softc *);
+int		iwn_hw_prepare(struct iwn_softc *sc);
+int		iwn_hw_init(struct iwn_softc *);
+void		iwn_hw_stop(struct iwn_softc *);
 void		iwn_init_locked(struct iwn_softc *);
 void		iwn_init(void *);
 void		iwn_stop_locked(struct iwn_softc *);
@@ -182,10 +218,13 @@ static void 	iwn_scan_end(struct ieee80211com *);
 static void 	iwn_set_channel(struct ieee80211com *);
 static void 	iwn_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 static void 	iwn_scan_mindwell(struct ieee80211_scan_state *);
-static void	iwn_hwreset(void *, int);
-static void	iwn_radioon(void *, int);
-static void	iwn_radiooff(void *, int);
+static void	iwn_hw_reset(void *, int);
+static void	iwn_radio_on(void *, int);
+static void	iwn_radio_off(void *, int);
 static void	iwn_sysctlattach(struct iwn_softc *);
+static int	iwn_shutdown(device_t);
+static int	iwn_suspend(device_t);
+static int	iwn_resume(device_t);
 
 #define IWN_DEBUG
 #ifdef IWN_DEBUG
@@ -224,26 +263,95 @@ struct iwn_ident {
 };
 
 static const struct iwn_ident iwn_ident_table [] = {
-        { 0x8086, 0x4229, "Intel(R) PRO/Wireless 4965BGN" },
-        { 0x8086, 0x422D, "Intel(R) PRO/Wireless 4965BGN" },
-        { 0x8086, 0x4230, "Intel(R) PRO/Wireless 4965BGN" },
-        { 0x8086, 0x4233, "Intel(R) PRO/Wireless 4965BGN" },
-        { 0, 0, NULL }
+	{ 0x8086, 0x4229, "Intel(R) PRO/Wireless 4965BGN" },
+	{ 0x8086, 0x422D, "Intel(R) PRO/Wireless 4965BGN" },
+	{ 0x8086, 0x4230, "Intel(R) PRO/Wireless 4965BGN" },
+	{ 0x8086, 0x4233, "Intel(R) PRO/Wireless 4965BGN" },
+	{ 0x8086, 0x4232, "Intel(R) PRO/Wireless 5100" },
+	{ 0x8086, 0x4237, "Intel(R) PRO/Wireless 5100" },
+	{ 0x8086, 0x423C, "Intel(R) PRO/Wireless 5150" },
+	{ 0x8086, 0x423D, "Intel(R) PRO/Wireless 5150" },
+	{ 0x8086, 0x4235, "Intel(R) PRO/Wireless 5300" },
+	{ 0x8086, 0x4236, "Intel(R) PRO/Wireless 5300" },
+	{ 0x8086, 0x4236, "Intel(R) PRO/Wireless 5350" },
+	{ 0x8086, 0x423A, "Intel(R) PRO/Wireless 5350" },
+	{ 0x8086, 0x423B, "Intel(R) PRO/Wireless 5350" },
+	{ 0x8086, 0x0083, "Intel(R) PRO/Wireless 1000" },
+	{ 0x8086, 0x0084, "Intel(R) PRO/Wireless 1000" },
+	{ 0x8086, 0x008D, "Intel(R) PRO/Wireless 6000" },
+	{ 0x8086, 0x008E, "Intel(R) PRO/Wireless 6000" },
+	{ 0x8086, 0x4238, "Intel(R) PRO/Wireless 6000" },
+	{ 0x8086, 0x4239, "Intel(R) PRO/Wireless 6000" },
+	{ 0x8086, 0x422B, "Intel(R) PRO/Wireless 6000" },
+	{ 0x8086, 0x422C, "Intel(R) PRO/Wireless 6000" },
+	{ 0, 0, NULL }
+};
+
+static const struct iwn_hal iwn4965_hal = {
+	iwn4965_load_firmware,
+	iwn4965_read_eeprom,
+	iwn4965_post_alive,
+	iwn4965_apm_init,
+	iwn4965_nic_config,
+	iwn4965_update_sched,
+	iwn4965_get_temperature,
+	iwn4965_get_rssi,
+	iwn4965_set_txpower,
+	iwn4965_init_gains,
+	iwn4965_set_gains,
+	iwn4965_add_node,
+	iwn4965_tx_done,
+	&iwn4965_sensitivity_limits,
+	IWN4965_NTXQUEUES,
+	IWN4965_NDMACHNLS,
+	IWN4965_ID_BROADCAST,
+	IWN4965_RXONSZ,
+	IWN4965_SCHEDSZ,
+	IWN4965_FW_TEXT_MAXSZ,
+	IWN4965_FW_DATA_MAXSZ,
+	IWN4965_FWSZ,
+	IWN4965_SCHED_TXFACT,
+};
+
+static const struct iwn_hal iwn5000_hal = {
+	iwn5000_load_firmware,
+	iwn5000_read_eeprom,
+	iwn5000_post_alive,
+	iwn5000_apm_init,
+	iwn5000_nic_config,
+	iwn5000_update_sched,
+	iwn5000_get_temperature,
+	iwn5000_get_rssi,
+	iwn5000_set_txpower,
+	iwn5000_init_gains,
+	iwn5000_set_gains,
+	iwn5000_add_node,
+	iwn5000_tx_done,
+	&iwn5000_sensitivity_limits,
+	IWN5000_NTXQUEUES,
+	IWN5000_NDMACHNLS,
+	IWN5000_ID_BROADCAST,
+	IWN5000_RXONSZ,
+	IWN5000_SCHEDSZ,
+	IWN5000_FW_TEXT_MAXSZ,
+	IWN5000_FW_DATA_MAXSZ,
+	IWN5000_FWSZ,
+	IWN5000_SCHED_TXFACT,
 };
 
 static int
 iwn_probe(device_t dev)
 {
-        const struct iwn_ident *ident;
+	const struct iwn_ident *ident;
 
-        for (ident = iwn_ident_table; ident->name != NULL; ident++) {
-                if (pci_get_vendor(dev) == ident->vendor &&
-                    pci_get_device(dev) == ident->device) {
-                        device_set_desc(dev, ident->name);
-                        return 0;
-                }
-        }
-        return ENXIO;
+	for (ident = iwn_ident_table; ident->name != NULL; ident++) {
+		if (pci_get_vendor(dev) == ident->vendor &&
+		    pci_get_device(dev) == ident->device) {
+			device_set_desc(dev, ident->name);
+			return 0;
+		}
+	}
+	return ENXIO;
 }
 
 static int
@@ -252,30 +360,44 @@ iwn_attach(device_t dev)
 	struct iwn_softc *sc = (struct iwn_softc *)device_get_softc(dev);
 	struct ieee80211com *ic;
 	struct ifnet *ifp;
+	const struct iwn_hal *hal;
+	uint32_t tmp;
 	int i, error, result;
 	uint8_t macaddr[IEEE80211_ADDR_LEN];
 
 	sc->sc_dev = dev;
 
-	/* XXX */
-	if (pci_get_powerstate(dev) != PCI_POWERSTATE_D0) {
-		device_printf(dev, "chip is in D%d power mode "
-		    "-- setting to D0\n", pci_get_powerstate(dev));
-		pci_set_powerstate(dev, PCI_POWERSTATE_D0);
+	/*
+	 * Get the offset of the PCI Express Capability Structure in PCI
+	 * Configuration Space.
+	 */
+	error = pci_find_extcap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
+	if (error != 0) {
+		device_printf(dev, "PCIe capability structure not found!\n");
+		return error;
 	}
 
-	/* clear device specific PCI configuration register 0x41 */
+	/* Clear device-specific "PCI retry timeout" register (41h). */
 	pci_write_config(dev, 0x41, 0, 1);
 
-	/* enable bus-mastering */
+	/* Hardware bug workaround. */
+	tmp = pci_read_config(dev, PCIR_COMMAND, 1);
+	if (tmp & PCIM_CMD_INTxDIS) {
+		DPRINTF(sc, IWN_DEBUG_RESET, "%s: PCIe INTx Disable set\n",
+		    __func__);
+		tmp &= ~PCIM_CMD_INTxDIS;
+		pci_write_config(dev, PCIR_COMMAND, tmp, 1);
+	}
+
+	/* Enable bus-mastering. */
 	pci_enable_busmaster(dev);
 
-	sc->mem_rid= PCIR_BAR(0);
+	sc->mem_rid = PCIR_BAR(0);
 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &sc->mem_rid,
-					 RF_ACTIVE);
+	    RF_ACTIVE);
 	if (sc->mem == NULL ) {
 		device_printf(dev, "could not allocate memory resources\n");
-		error = ENOMEM; 
+		error = ENOMEM;
 		return error;
 	}
 
@@ -286,63 +408,68 @@ iwn_attach(device_t dev)
 	    pci_alloc_msi(dev, &result) == 0)
 		sc->irq_rid = 1;
 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->irq_rid,
-					 RF_ACTIVE | RF_SHAREABLE);
+	    RF_ACTIVE | RF_SHAREABLE);
 	if (sc->irq == NULL) {
 		device_printf(dev, "could not allocate interrupt resource\n");
 		error = ENOMEM;
-		return error;
+		goto fail;
 	}
 
 	IWN_LOCK_INIT(sc);
 	callout_init_mtx(&sc->sc_timer_to, &sc->sc_mtx, 0);
-        TASK_INIT(&sc->sc_reinit_task, 0, iwn_hwreset, sc );
-        TASK_INIT(&sc->sc_radioon_task, 0, iwn_radioon, sc );
-        TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radiooff, sc );
+	TASK_INIT(&sc->sc_reinit_task, 0, iwn_hw_reset, sc );
+	TASK_INIT(&sc->sc_radioon_task, 0, iwn_radio_on, sc );
+	TASK_INIT(&sc->sc_radiooff_task, 0, iwn_radio_off, sc );
+
+	/* Attach Hardware Abstraction Layer. */
+	hal = iwn_hal_attach(sc);
+	if (hal == NULL) {
+		error = ENXIO;	/* XXX: Wrong error code? */
+		goto fail;
+	}
 
-	/*
-	 * Put adapter into a known state.
-	 */
-	error = iwn_reset(sc);
+	error = iwn_hw_prepare(sc);
 	if (error != 0) {
-		device_printf(dev,
-		    "could not reset adapter, error %d\n", error);
+		device_printf(dev, "hardware not ready, error %d\n", error);
 		goto fail;
 	}
 
-	/*
-	 * Allocate DMA memory for firmware transfers.
-	 */
+	/* Power ON adapter. */
+	error = hal->apm_init(sc);
+	if (error != 0) {
+		device_printf(dev, "could not power ON adapter, error %d\n",
+		    error);
+		goto fail;
+	}
+
+	/* Allocate DMA memory for firmware transfers. */
 	error = iwn_alloc_fwmem(sc);
 	if (error != 0) {
 		device_printf(dev,
-		    "could not allocate firmware memory, error %d\n", error);
+		    "could not allocate memory for firmware, error %d\n",
+		    error);
 		goto fail;
 	}
 
-	/*
-	 * Allocate a "keep warm" page.
-	 */
+	/* Allocate "Keep Warm" page. */
 	error = iwn_alloc_kw(sc);
 	if (error != 0) {
 		device_printf(dev,
-		    "could not allocate keep-warm page, error %d\n", error);
+		    "could not allocate \"Keep Warm\" page, error %d\n", error);
 		goto fail;
 	}
 
-	/*
-	 * Allocate shared area (communication area).
-	 */
-	error = iwn_alloc_shared(sc);
+	/* Allocate TX scheduler "rings". */
+	error = iwn_alloc_sched(sc);
 	if (error != 0) {
 		device_printf(dev,
-		    "could not allocate shared area, error %d\n", error);
+		    "could not allocate TX scheduler rings, error %d\n",
+		    error);
 		goto fail;
 	}
 
-	/*
-	 * Allocate Tx rings.
-	 */
-	for (i = 0; i < IWN_NTXQUEUES; i++) {
+	/* Allocate TX rings (16 on 4965AGN, 20 on 5000). */
+	for (i = 0; i < hal->ntxqs; i++) {
 		error = iwn_alloc_tx_ring(sc, &sc->txq[i], i);
 		if (error != 0) {
 			device_printf(dev,
@@ -352,6 +479,7 @@ iwn_attach(device_t dev)
 		}
 	}
 
+	/* Allocate RX ring. */
 	error = iwn_alloc_rx_ring(sc, &sc->rxq);
 	if (error != 0 ){
 		device_printf(dev,
@@ -359,6 +487,12 @@ iwn_attach(device_t dev)
 		goto fail;
 	}
 
+	/* Clear pending interrupts. */
+	IWN_WRITE(sc, IWN_INT, 0xffffffff);
+
+	/* Initialization firmware has not been loaded yet. */
+	sc->sc_flags |= IWN_FLAG_FIRST_BOOT;
+
 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 	if (ifp == NULL) {
 		device_printf(dev, "can not allocate ifnet structure\n");
@@ -366,11 +500,11 @@ iwn_attach(device_t dev)
 	}
 	ic = ifp->if_l2com;
 
-	ic->ic_ifp = ifp;	
+	ic->ic_ifp = ifp;
 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
 
-	/* set device capabilities */
+	/* Set device capabilities. */
 	ic->ic_caps =
 		  IEEE80211_C_STA		/* station mode supported */
 		| IEEE80211_C_MONITOR		/* monitor mode supported */
@@ -399,8 +533,21 @@ iwn_attach(device_t dev)
 		| IEEE80211_HTC_AMSDU		/* tx A-MSDU */
 		;
 #endif
-	/* read supported channels and MAC address from EEPROM */
-	iwn_read_eeprom(sc, macaddr);
+
+	/* Read MAC address, channels, etc from EEPROM. */
+	error = iwn_read_eeprom(sc, macaddr);
+	if (error != 0) {
+		device_printf(dev, "could not read EEPROM, error %d\n",
+		    error);
+		goto fail;
+	}
+
+	/* Power OFF adapter. */
+	iwn_apm_stop(sc);
+
+	device_printf(sc->sc_dev, "MIMO %dT%dR, %.4s, address %6D\n",
+	    sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
+	    macaddr, ":");
 
 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
 	ifp->if_softc = sc;
@@ -408,7 +555,7 @@ iwn_attach(device_t dev)
 	ifp->if_init = iwn_init;
 	ifp->if_ioctl = iwn_ioctl;
 	ifp->if_start = iwn_start;
-        IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
+	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
 	IFQ_SET_READY(&ifp->if_snd);
 
@@ -418,85 +565,124 @@ iwn_attach(device_t dev)
 	ic->ic_raw_xmit = iwn_raw_xmit;
 	ic->ic_node_alloc = iwn_node_alloc;
 	ic->ic_newassoc = iwn_newassoc;
-        ic->ic_wme.wme_update = iwn_wme_update;
-        ic->ic_scan_start = iwn_scan_start;
-        ic->ic_scan_end = iwn_scan_end;
-        ic->ic_set_channel = iwn_set_channel;
-        ic->ic_scan_curchan = iwn_scan_curchan;
-        ic->ic_scan_mindwell = iwn_scan_mindwell;
-
-	ieee80211_radiotap_attach(ic,
-            &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
-		IWN_TX_RADIOTAP_PRESENT,
-            &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
-		IWN_RX_RADIOTAP_PRESENT);
-
+	ic->ic_wme.wme_update = iwn_wme_update;
+	ic->ic_scan_start = iwn_scan_start;
+	ic->ic_scan_end = iwn_scan_end;
+	ic->ic_set_channel = iwn_set_channel;
+	ic->ic_scan_curchan = iwn_scan_curchan;
+	ic->ic_scan_mindwell = iwn_scan_mindwell;
+
+	iwn_radiotap_attach(sc);
 	iwn_sysctlattach(sc);
 
-        /*
-         * Hook our interrupt after all initialization is complete.
-         */
-        error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
+	/*
+	 * Hook our interrupt after all initialization is complete.
+	 */
+	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
 	    NULL, iwn_intr, sc, &sc->sc_ih);
-        if (error != 0) {
-                device_printf(dev, "could not set up interrupt, error %d\n", error);
-                goto fail;
-        }
+	if (error != 0) {
+		device_printf(dev, "could not set up interrupt, error %d\n",
+		    error);
+		goto fail;
+	}
 
-        ieee80211_announce(ic);
+	ieee80211_announce(ic);
 	return 0;
 fail:
 	iwn_cleanup(dev);
 	return error;
 }
 
-static int
-iwn_detach(device_t dev)
+const struct iwn_hal *
+iwn_hal_attach(struct iwn_softc *sc)
 {
-	iwn_cleanup(dev);
-        return 0;
+	sc->hw_type = (IWN_READ(sc, IWN_HW_REV) >> 4) & 0xf;
+
+	switch (sc->hw_type) {
+	case IWN_HW_REV_TYPE_4965:
+		sc->sc_hal = &iwn4965_hal;
+		sc->fwname = "iwnfw-4965";
+		sc->critical_temp = IWN_CTOK(110);
+		sc->txantmsk = IWN_ANT_A | IWN_ANT_B;
+		sc->rxantmsk = IWN_ANT_ABC;
+		sc->ntxchains = 2;
+		sc->nrxchains = 3;
+		break;
+	case IWN_HW_REV_TYPE_5100:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-5000";
+		sc->critical_temp = 110;
+		sc->txantmsk = IWN_ANT_B;
+		sc->rxantmsk = IWN_ANT_A | IWN_ANT_B;
+		sc->ntxchains = 1;
+		sc->nrxchains = 2;
+		break;
+	case IWN_HW_REV_TYPE_5150:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-5150";
+		/* NB: critical temperature will be read from EEPROM. */
+		sc->txantmsk = IWN_ANT_A;
+		sc->rxantmsk = IWN_ANT_A | IWN_ANT_B;
+		sc->ntxchains = 1;
+		sc->nrxchains = 2;
+		break;
+	case IWN_HW_REV_TYPE_5300:
+	case IWN_HW_REV_TYPE_5350:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-5000";
+		sc->critical_temp = 110;
+		sc->txantmsk = sc->rxantmsk = IWN_ANT_ABC;
+		sc->ntxchains = sc->nrxchains = 3;
+		break;
+	case IWN_HW_REV_TYPE_1000:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-1000";
+		sc->critical_temp = 110;
+		sc->txantmsk = IWN_ANT_A;
+		sc->rxantmsk = IWN_ANT_A | IWN_ANT_B;
+		sc->ntxchains = 1;
+		sc->nrxchains = 2;
+		break;
+	case IWN_HW_REV_TYPE_6000:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-6000";
+		sc->critical_temp = 110;
+		sc->txantmsk = IWN_ANT_ABC;
+		sc->rxantmsk = IWN_ANT_ABC;
+		sc->ntxchains = 3;
+		sc->nrxchains = 3;
+		break;
+	case IWN_HW_REV_TYPE_6050:
+		sc->sc_hal = &iwn5000_hal;
+		sc->fwname = "iwnfw-6050";
+		sc->critical_temp = 110;
+		sc->txantmsk = IWN_ANT_ABC;
+		sc->rxantmsk = IWN_ANT_ABC;
+		sc->ntxchains = 3;
+		sc->nrxchains = 3;
+		break;
+	default:
+		device_printf(sc->sc_dev, "adapter type %d not supported\n",
+		    sc->hw_type);
+		return NULL;
+	}
+	return sc->sc_hal;
 }
 
 /*
- * Cleanup any device resources that were allocated
+ * Attach the interface to 802.11 radiotap.
  */
-int
-iwn_cleanup(device_t dev)
+void
+iwn_radiotap_attach(struct iwn_softc *sc)
 {
-	struct iwn_softc *sc = device_get_softc(dev);
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
-	int i;
-
-	ieee80211_draintask(ic, &sc->sc_reinit_task);
-	ieee80211_draintask(ic, &sc->sc_radioon_task);
-	ieee80211_draintask(ic, &sc->sc_radiooff_task);
 
-	if (ifp != NULL) {
-		iwn_stop(sc);
-		callout_drain(&sc->sc_timer_to);
-		ieee80211_ifdetach(ic);
-	}
-
-	iwn_unload_firmware(sc);
-
-	iwn_free_rx_ring(sc, &sc->rxq);
-	for (i = 0; i < IWN_NTXQUEUES; i++)
-		iwn_free_tx_ring(sc, &sc->txq[i]);
-	iwn_free_kw(sc);
-	iwn_free_fwmem(sc);
-	if (sc->irq != NULL) {
-		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
-		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
-		if (sc->irq_rid == 1)
-			pci_release_msi(dev);
-	}
-	if (sc->mem != NULL)
-		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
-	if (ifp != NULL)
-		if_free(ifp);
-	IWN_LOCK_DESTROY(sc);
-	return 0;
+	ieee80211_radiotap_attach(ic,
+	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
+		IWN_TX_RADIOTAP_PRESENT,
+	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
+		IWN_RX_RADIOTAP_PRESENT);
 }
 
 static struct ieee80211vap *
@@ -517,17 +703,18 @@ iwn_vap_create(struct ieee80211com *ic,
 	vap = &ivp->iv_vap;
 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
 	vap->iv_bmissthreshold = 10;		/* override default */
-	/* override with driver methods */
+	/* Override with driver methods. */
 	ivp->iv_newstate = vap->iv_newstate;
 	vap->iv_newstate = iwn_newstate;
 
 	ieee80211_amrr_init(&ivp->iv_amrr, vap,
 	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
 	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
-	    500 /*ms*/);
+	    500 /* ms */);
 
-	/* complete setup */
-	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
+	/* Complete setup. */
+	ieee80211_vap_attach(vap, ieee80211_media_change,
+	    ieee80211_media_status);
 	ic->ic_opmode = opmode;
 	return vap;
 }
@@ -542,71 +729,280 @@ iwn_vap_delete(struct ieee80211vap *vap)
 	free(ivp, M_80211_VAP);
 }
 
-static int
-iwn_shutdown(device_t dev)
+int
+iwn_cleanup(device_t dev)
 {
 	struct iwn_softc *sc = device_get_softc(dev);
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic;
+	int i;
 
-	iwn_stop(sc);
+	if (ifp != NULL) {
+		ic = ifp->if_l2com;
+
+		ieee80211_draintask(ic, &sc->sc_reinit_task);
+		ieee80211_draintask(ic, &sc->sc_radioon_task);
+		ieee80211_draintask(ic, &sc->sc_radiooff_task);
+
+		iwn_stop(sc);
+		callout_drain(&sc->sc_timer_to);
+		ieee80211_ifdetach(ic);
+	}
+
+	iwn_unload_firmware(sc);
+
+	iwn_free_rx_ring(sc, &sc->rxq);
+
+	if (sc->sc_hal != NULL)
+		for (i = 0; i < sc->sc_hal->ntxqs; i++)
+			iwn_free_tx_ring(sc, &sc->txq[i]);
+
+	iwn_free_sched(sc);
+	iwn_free_kw(sc);
+	iwn_free_fwmem(sc);
+
+	if (sc->irq != NULL) {
+		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
+		bus_release_resource(dev, SYS_RES_IRQ, sc->irq_rid, sc->irq);
+		if (sc->irq_rid == 1)
+			pci_release_msi(dev);
+	}
+
+	if (sc->mem != NULL)
+		bus_release_resource(dev, SYS_RES_MEMORY, sc->mem_rid, sc->mem);
+
+	if (ifp != NULL)
+		if_free(ifp);
+
+	IWN_LOCK_DESTROY(sc);
 	return 0;
 }
 
 static int
-iwn_suspend(device_t dev)
+iwn_detach(device_t dev)
 {
-	struct iwn_softc *sc = device_get_softc(dev);
-
-	iwn_stop(sc);
+	iwn_cleanup(dev);
 	return 0;
 }
 
-static int
-iwn_resume(device_t dev)
+int
+iwn_nic_lock(struct iwn_softc *sc)
 {
-	struct iwn_softc *sc = device_get_softc(dev);
-	struct ifnet *ifp = sc->sc_ifp;
+	int ntries;
 
-	pci_write_config(dev, 0x41, 0, 1);
+	/* Request exclusive access to NIC. */
+	IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
+
+	/* Spin until we actually get the lock. */
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if ((IWN_READ(sc, IWN_GP_CNTRL) &
+		     (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
+		    IWN_GP_CNTRL_MAC_ACCESS_ENA)
+			return 0;
+		DELAY(10);
+	}
+	return ETIMEDOUT;
+}
+
+static __inline void
+iwn_nic_unlock(struct iwn_softc *sc)
+{
+	IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
+}
+
+static __inline uint32_t
+iwn_prph_read(struct iwn_softc *sc, uint32_t addr)
+{
+	IWN_WRITE(sc, IWN_PRPH_RADDR, IWN_PRPH_DWORD | addr);
+	return IWN_READ(sc, IWN_PRPH_RDATA);
+}
+
+static __inline void
+iwn_prph_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
+{
+	IWN_WRITE(sc, IWN_PRPH_WADDR, IWN_PRPH_DWORD | addr);
+	IWN_WRITE(sc, IWN_PRPH_WDATA, data);
+}
+
+static __inline void
+iwn_prph_setbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
+{
+	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) | mask);
+}
+
+static __inline void
+iwn_prph_clrbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
+{
+	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) & ~mask);
+}
+
+static __inline void
+iwn_prph_write_region_4(struct iwn_softc *sc, uint32_t addr,
+    const uint32_t *data, int count)
+{
+	for (; count > 0; count--, data++, addr += 4)
+		iwn_prph_write(sc, addr, *data);
+}
+
+static __inline uint32_t
+iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
+{
+	IWN_WRITE(sc, IWN_MEM_RADDR, addr);
+	return IWN_READ(sc, IWN_MEM_RDATA);
+}
+
+static __inline void
+iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
+{
+	IWN_WRITE(sc, IWN_MEM_WADDR, addr);
+	IWN_WRITE(sc, IWN_MEM_WDATA, data);
+}
+
+static __inline void
+iwn_mem_write_2(struct iwn_softc *sc, uint32_t addr, uint16_t data)
+{
+	uint32_t tmp;
+
+	tmp = iwn_mem_read(sc, addr & ~3);
+	if (addr & 3)
+		tmp = (tmp & 0x0000ffff) | data << 16;
+	else
+		tmp = (tmp & 0xffff0000) | data;
+	iwn_mem_write(sc, addr & ~3, tmp);
+}
+
+static __inline void
+iwn_mem_read_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t *data,
+    int count)
+{
+	for (; count > 0; count--, addr += 4)
+		*data++ = iwn_mem_read(sc, addr);
+}
+
+static __inline void
+iwn_mem_set_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t val,
+    int count)
+{
+	for (; count > 0; count--, addr += 4)
+		iwn_mem_write(sc, addr, val);
+}
+
+int
+iwn_eeprom_lock(struct iwn_softc *sc)
+{
+	int i, ntries;
+
+	for (i = 0; i < 100; i++) {
+		/* Request exclusive access to EEPROM. */
+		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
+		    IWN_HW_IF_CONFIG_EEPROM_LOCKED);
+
+		/* Spin until we actually get the lock. */
+		for (ntries = 0; ntries < 100; ntries++) {
+			if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
+			    IWN_HW_IF_CONFIG_EEPROM_LOCKED)
+				return 0;
+			DELAY(10);
+		}
+	}
+	return ETIMEDOUT;
+}
+
+static __inline void
+iwn_eeprom_unlock(struct iwn_softc *sc)
+{
+	IWN_CLRBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_EEPROM_LOCKED);
+}
+
+/*
+ * Initialize access by host to One Time Programmable ROM.
+ * NB: This kind of ROM can be found on 1000 or 6000 Series only.
+ */
+int
+iwn_init_otprom(struct iwn_softc *sc)
+{
+	int error;
+
+	error = iwn_clock_wait(sc);
+	if (error != 0)
+		return error;
+
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+	iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
+	DELAY(5);
+	iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
+	iwn_nic_unlock(sc);
+
+	IWN_CLRBITS(sc, IWN_EEPROM_GP, IWN_EEPROM_GP_IF_OWNER);
+	/* Clear ECC status. */
+	IWN_SETBITS(sc, IWN_OTP_GP,
+	    IWN_OTP_GP_ECC_CORR_STTS | IWN_OTP_GP_ECC_UNCORR_STTS);
 
-	if (ifp->if_flags & IFF_UP)
-		iwn_init(sc);
+	return 0;
+}
+
+int
+iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
+{
+	uint32_t val, tmp;
+	int ntries;
+	uint8_t *out = data;
+
+	for (; count > 0; count -= 2, addr++) {
+		IWN_WRITE(sc, IWN_EEPROM, addr << 2);
+		for (ntries = 0; ntries < 100; ntries++) {
+			val = IWN_READ(sc, IWN_EEPROM);
+			if (val & IWN_EEPROM_READ_VALID)
+				break;
+			DELAY(5);
+		}
+		if (ntries == 100) {
+			device_printf(sc->sc_dev,
+			    "timeout reading ROM at 0x%x\n", addr);
+			return ETIMEDOUT;
+		}
+		if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
+			/* OTPROM, check for ECC errors. */
+			tmp = IWN_READ(sc, IWN_OTP_GP);
+			if (tmp & IWN_OTP_GP_ECC_UNCORR_STTS) {
+				device_printf(sc->sc_dev,
+				    "OTPROM ECC error at 0x%x\n", addr);
+				return EIO;
+			}
+			if (tmp & IWN_OTP_GP_ECC_CORR_STTS) {
+				/* Correctable ECC error, clear bit. */
+				IWN_SETBITS(sc, IWN_OTP_GP,
+				    IWN_OTP_GP_ECC_CORR_STTS);
+			}
+		}
+		*out++ = val >> 16;
+		if (count > 1)
+			*out++ = val >> 24;
+	}
 	return 0;
 }
 
 static void
 iwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 {
-        if (error != 0)
-                return;
-        KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
-        *(bus_addr_t *)arg = segs[0].ds_addr;
+	if (error != 0)
+		return;
+	KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
+	*(bus_addr_t *)arg = segs[0].ds_addr;
 }
 
-static int 
+static int
 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
 	void **kvap, bus_size_t size, bus_size_t alignment, int flags)
 {
-	int error, lalignment, i;
+	int error;
 
-	/*
-	 * FreeBSD can't guarrenty 16k alignment at the moment (11/2007) so
-	 * we allocate an extra 12k with 4k alignement and walk through
-	 * it trying to find where the alignment is. It's a nasty fix for
-	 * a bigger problem.
-	*/
-	DPRINTF(sc, IWN_DEBUG_RESET,
-	    "Size: %zd - alignment %zd\n", size, alignment);
-	if (alignment == 0x4000) {
-		size += 12*1024;
-		lalignment = 4096;
-		DPRINTF(sc, IWN_DEBUG_RESET, "%s\n",
-		    "Attempting to find a 16k boundary");
-	} else
-		lalignment = alignment;
 	dma->size = size;
 	dma->tag = NULL;
 
-	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), lalignment,
+	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), alignment,
 	    0, BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, size,
 	    1, size, flags, NULL, NULL, &dma->tag);
 	if (error != 0) {
@@ -623,22 +1019,6 @@ iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
 		   __func__, error);
 		goto fail;
 	}
-	if (alignment == 0x4000) {
-		for (i = 0; i < 3 && (((uintptr_t)dma->vaddr) & 0x3fff); i++) {
-			DPRINTF(sc, IWN_DEBUG_RESET,  "%s\n",
-			    "Memory Unaligned, shifting pointer by 4k");
-			dma->vaddr += 4096;
-			size -= 4096;
-		}
-		if ((((uintptr_t)dma->vaddr ) & (alignment-1))) {
-			DPRINTF(sc, IWN_DEBUG_ANY,
-			    "%s: failed to align memory, vaddr %p, align %zd\n",
-			    __func__, dma->vaddr, alignment);
-			error = ENOMEM;
-			goto fail;
-		}
-	}
-
 	error = bus_dmamap_load(dma->tag, dma->map, dma->vaddr,
 	    size, iwn_dma_map_addr, &dma->paddr, flags);
 	if (error != 0) {
@@ -672,26 +1052,25 @@ iwn_dma_contig_free(struct iwn_dma_info *dma)
 }
 
 int
-iwn_alloc_shared(struct iwn_softc *sc)
+iwn_alloc_sched(struct iwn_softc *sc)
 {
-	/* must be aligned on a 1KB boundary */
-	return iwn_dma_contig_alloc(sc, &sc->shared_dma,
-	    (void **)&sc->shared, sizeof (struct iwn_shared), 1024,
-	    BUS_DMA_NOWAIT);
+	/* TX scheduler rings must be aligned on a 1KB boundary. */
+	return iwn_dma_contig_alloc(sc, &sc->sched_dma,
+	    (void **)&sc->sched, sc->sc_hal->schedsz, 1024, BUS_DMA_NOWAIT);
 }
 
 void
-iwn_free_shared(struct iwn_softc *sc)
+iwn_free_sched(struct iwn_softc *sc)
 {
-	iwn_dma_contig_free(&sc->shared_dma);
+	iwn_dma_contig_free(&sc->sched_dma);
 }
 
 int
 iwn_alloc_kw(struct iwn_softc *sc)
 {
-	/* must be aligned on a 4k boundary */
-	return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL,
-	    PAGE_SIZE, PAGE_SIZE, BUS_DMA_NOWAIT);
+	/* "Keep Warm" page must be aligned on a 4KB boundary. */
+	return iwn_dma_contig_alloc(sc, &sc->kw_dma, NULL, 4096, 4096,
+	    BUS_DMA_NOWAIT);
 }
 
 void
@@ -703,10 +1082,9 @@ iwn_free_kw(struct iwn_softc *sc)
 int
 iwn_alloc_fwmem(struct iwn_softc *sc)
 {
-	/* allocate enough contiguous space to store text and data */
+	/* Must be aligned on a 16-byte boundary. */
 	return iwn_dma_contig_alloc(sc, &sc->fw_dma, NULL,
-	    IWN_FW_MAIN_TEXT_MAXSZ + IWN_FW_MAIN_DATA_MAXSZ, 16,
-	    BUS_DMA_NOWAIT);
+	    sc->sc_hal->fwsz, 16, BUS_DMA_NOWAIT);
 }
 
 void
@@ -718,46 +1096,71 @@ iwn_free_fwmem(struct iwn_softc *sc)
 int
 iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
 {
+	bus_size_t size;
 	int i, error;
 
 	ring->cur = 0;
 
+	/* Allocate RX descriptors (256-byte aligned). */
+	size = IWN_RX_RING_COUNT * sizeof (uint32_t);
 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma,
-	    (void **)&ring->desc, IWN_RX_RING_COUNT * sizeof (uint32_t),
-	    IWN_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
+	    (void **)&ring->desc, size, 256, BUS_DMA_NOWAIT);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not allocate rx ring DMA memory, error %d\n",
+		    "%s: could not allocate Rx ring DMA memory, error %d\n",
 		    __func__, error);
 		goto fail;
 	}
 
-        error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0, 
+	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 	    BUS_SPACE_MAXADDR_32BIT,
-            BUS_SPACE_MAXADDR, NULL, NULL, MJUMPAGESIZE, 1,
-            MJUMPAGESIZE, BUS_DMA_NOWAIT, NULL, NULL, &ring->data_dmat);
-        if (error != 0) {
-                device_printf(sc->sc_dev,
+	    BUS_SPACE_MAXADDR, NULL, NULL, MJUMPAGESIZE, 1,
+	    MJUMPAGESIZE, BUS_DMA_NOWAIT, NULL, NULL, &ring->desc_dma.tag);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
 		    "%s: bus_dma_tag_create_failed, error %d\n",
 		    __func__, error);
-                goto fail;
-        }
+		goto fail;
+	}
+
+	/* Allocate RX status area (16-byte aligned). */
+	error = iwn_dma_contig_alloc(sc, &ring->stat_dma,
+	    (void **)&ring->stat, sizeof (struct iwn_rx_status),
+	    16, BUS_DMA_NOWAIT);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not allocate Rx status DMA memory, error %d\n",
+		    __func__, error);
+		goto fail;
+	}
+
+	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
+	    BUS_SPACE_MAXADDR_32BIT,
+	    BUS_SPACE_MAXADDR, NULL, NULL, MJUMPAGESIZE, 1,
+	    MJUMPAGESIZE, BUS_DMA_NOWAIT, NULL, NULL, &ring->desc_dma.tag);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: bus_dma_tag_create_failed, error %d\n",
+		    __func__, error);
+		goto fail;
+	}
 
 	/*
-	 * Setup Rx buffers.
+	 * Allocate and map RX buffers.
 	 */
 	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
 		struct iwn_rx_data *data = &ring->data[i];
 		struct mbuf *m;
 		bus_addr_t paddr;
 
-		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
+		error = bus_dmamap_create(ring->desc_dma.tag, 0, &data->map);
 		if (error != 0) {
 			device_printf(sc->sc_dev,
 			    "%s: bus_dmamap_create failed, error %d\n",
 			    __func__, error);
 			goto fail;
 		}
+
 		m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
 		if (m == NULL) {
 			device_printf(sc->sc_dev,
@@ -765,8 +1168,9 @@ iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
 			error = ENOMEM;
 			goto fail;
 		}
-		/* map page */
-		error = bus_dmamap_load(ring->data_dmat, data->map,
+
+		/* Map page. */
+		error = bus_dmamap_load(ring->desc_dma.tag, data->map,
 		    mtod(m, caddr_t), MJUMPAGESIZE,
 		    iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
 		if (error != 0 && error != EFBIG) {
@@ -777,11 +1181,12 @@ iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
 			error = ENOMEM;	/* XXX unique code */
 			goto fail;
 		}
-		bus_dmamap_sync(ring->data_dmat, data->map, 
+		bus_dmamap_sync(ring->desc_dma.tag, data->map,
 		    BUS_DMASYNC_PREWRITE);
 
 		data->m = m;
-		/* Rx buffers are aligned on a 256-byte boundary */
+
+		/* Set physical address of RX buffer (256-byte aligned). */
 		ring->desc[i] = htole32(paddr >> 8);
 	}
 	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
@@ -797,21 +1202,23 @@ iwn_reset_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
 {
 	int ntries;
 
-	iwn_mem_lock(sc);
-
-	IWN_WRITE(sc, IWN_RX_CONFIG, 0);
-	for (ntries = 0; ntries < 100; ntries++) {
-		if (IWN_READ(sc, IWN_RX_STATUS) & IWN_RX_IDLE)
-			break;
-		DELAY(10);
-	}
+	if (iwn_nic_lock(sc) == 0) {
+		IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
+		for (ntries = 0; ntries < 1000; ntries++) {
+			if (IWN_READ(sc, IWN_FH_RX_STATUS) &
+			    IWN_FH_RX_STATUS_IDLE)
+				break;
+			DELAY(10);
+		}
+		iwn_nic_unlock(sc);
 #ifdef IWN_DEBUG
-	if (ntries == 100)
-		DPRINTF(sc, IWN_DEBUG_ANY, "%s\n", "timeout resetting Rx ring");
+		if (ntries == 1000)
+			DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
+			    "timeout resetting Rx ring");
 #endif
-	iwn_mem_unlock(sc);
-
+	}
 	ring->cur = 0;
+	sc->last_rx_valid = 0;
 }
 
 void
@@ -820,64 +1227,84 @@ iwn_free_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
 	int i;
 
 	iwn_dma_contig_free(&ring->desc_dma);
+	iwn_dma_contig_free(&ring->stat_dma);
+
+	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
+		struct iwn_rx_data *data = &ring->data[i];
 
-	for (i = 0; i < IWN_RX_RING_COUNT; i++)
-		if (ring->data[i].m != NULL)
-			m_freem(ring->data[i].m);
+		if (data->m != NULL) {
+			bus_dmamap_unload(ring->desc_dma.tag, data->map);
+			m_freem(data->m);
+		}
+	}
 }
 
 int
 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
 {
 	bus_size_t size;
+	bus_addr_t paddr;
 	int i, error;
 
 	ring->qid = qid;
 	ring->queued = 0;
 	ring->cur = 0;
 
+	/* Allocate TX descriptors (256-byte aligned.) */
 	size = IWN_TX_RING_COUNT * sizeof(struct iwn_tx_desc);
 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma,
-	    (void **)&ring->desc, size, IWN_RING_DMA_ALIGN, BUS_DMA_NOWAIT);
+	    (void **)&ring->desc, size, 256, BUS_DMA_NOWAIT);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not allocate tx ring DMA memory, error %d\n",
+		    "%s: could not allocate TX ring DMA memory, error %d\n",
 		    __func__, error);
 		goto fail;
 	}
 
+	/*
+	 * We only use rings 0 through 4 (4 EDCA + cmd) so there is no need
+	 * to allocate commands space for other rings.
+	 */
+	if (qid > 4)
+		return 0;
+
 	size = IWN_TX_RING_COUNT * sizeof(struct iwn_tx_cmd);
 	error = iwn_dma_contig_alloc(sc, &ring->cmd_dma,
 	    (void **)&ring->cmd, size, 4, BUS_DMA_NOWAIT);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not allocate tx cmd DMA memory, error %d\n",
+		    "%s: could not allocate TX cmd DMA memory, error %d\n",
 		    __func__, error);
 		goto fail;
 	}
 
-        error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0, 
+	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 	    BUS_SPACE_MAXADDR_32BIT,
-            BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWN_MAX_SCATTER - 1,
-            MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL, &ring->data_dmat);
-        if (error != 0) {
-                device_printf(sc->sc_dev,
+	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, IWN_MAX_SCATTER - 1,
+	    MCLBYTES, BUS_DMA_NOWAIT, NULL, NULL, &ring->desc_dma.tag);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
 		    "%s: bus_dma_tag_create_failed, error %d\n",
 		    __func__, error);
-                goto fail;
-        }
+		goto fail;
+	}
 
+	paddr = ring->cmd_dma.paddr;
 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
 		struct iwn_tx_data *data = &ring->data[i];
 
-		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
+		data->cmd_paddr = paddr;
+		data->scratch_paddr = paddr + 12;
+		paddr += sizeof (struct iwn_tx_cmd);
+
+		error = bus_dmamap_create(ring->desc_dma.tag, 0, &data->map);
 		if (error != 0) {
 			device_printf(sc->sc_dev,
 			    "%s: bus_dmamap_create failed, error %d\n",
 			    __func__, error);
 			goto fail;
 		}
-		bus_dmamap_sync(ring->data_dmat, data->map, 
+		bus_dmamap_sync(ring->desc_dma.tag, data->map,
 		    BUS_DMASYNC_PREWRITE);
 	}
 	return 0;
@@ -889,35 +1316,20 @@ fail:
 void
 iwn_reset_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
 {
-	uint32_t tmp;
-	int i, ntries;
-
-	iwn_mem_lock(sc);
-
-	IWN_WRITE(sc, IWN_TX_CONFIG(ring->qid), 0);
-	for (ntries = 0; ntries < 20; ntries++) {
-		tmp = IWN_READ(sc, IWN_TX_STATUS);
-		if ((tmp & IWN_TX_IDLE(ring->qid)) == IWN_TX_IDLE(ring->qid))
-			break;
-		DELAY(10);
-	}
-#ifdef IWN_DEBUG
-	if (ntries == 20)
-		DPRINTF(sc, IWN_DEBUG_RESET,
-		    "%s: timeout resetting Tx ring %d\n", __func__, ring->qid);
-#endif
-	iwn_mem_unlock(sc);
+	int i;
 
 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
 		struct iwn_tx_data *data = &ring->data[i];
 
 		if (data->m != NULL) {
-			bus_dmamap_unload(ring->data_dmat, data->map);
+			bus_dmamap_unload(ring->desc_dma.tag, data->map);
 			m_freem(data->m);
 			data->m = NULL;
 		}
 	}
-
+	/* Clear TX descriptors. */
+	memset(ring->desc, 0, ring->desc_dma.size);
+	sc->qfullmsk &= ~(1 << ring->qid);
 	ring->queued = 0;
 	ring->cur = 0;
 }
@@ -935,13 +1347,327 @@ iwn_free_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
 			struct iwn_tx_data *data = &ring->data[i];
 
 			if (data->m != NULL) {
-				bus_dmamap_unload(ring->data_dmat, data->map);
+				bus_dmamap_unload(ring->desc_dma.tag, data->map);
 				m_freem(data->m);
 			}
 		}
 	}
 }
 
+int
+iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
+{
+	const struct iwn_hal *hal = sc->sc_hal;
+	int error;
+	uint16_t val;
+
+	/* Check whether adapter has an EEPROM or an OTPROM. */
+	if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
+	    (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
+		sc->sc_flags |= IWN_FLAG_HAS_OTPROM;
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s found\n",
+	    (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
+
+	if ((IWN_READ(sc, IWN_EEPROM_GP) & 0x7) == 0) {
+		device_printf(sc->sc_dev, "%s: bad ROM signature\n", __func__);
+		return EIO;
+	}
+	error = iwn_eeprom_lock(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not lock ROM, error %d\n",
+		    __func__, error);
+		return error;
+	}
+
+	if ((sc->sc_flags & IWN_FLAG_HAS_OTPROM) &&
+	    ((error = iwn_init_otprom(sc)) != 0)) {
+		device_printf(sc->sc_dev,
+		    "%s: could not initialize OTPROM, error %d\n",
+		    __func__, error);
+		return error;
+	}
+
+	iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
+	sc->rfcfg = le16toh(val);
+	DPRINTF(sc, IWN_DEBUG_RESET, "radio config=0x%04x\n", sc->rfcfg);
+
+	/* Read MAC address. */
+	iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
+
+	/* Read adapter-specific information from EEPROM. */
+	hal->read_eeprom(sc);
+
+	iwn_eeprom_unlock(sc);
+	return 0;
+}
+
+void
+iwn4965_read_eeprom(struct iwn_softc *sc)
+{
+	int i;
+	uint16_t val;
+
+	/* Read regulatory domain (4 ASCII characters.) */
+	iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
+
+	/* Read the list of authorized channels. */
+	for (i = 0; i < 7; i++)
+		iwn_read_eeprom_channels(sc, iwn4965_regulatory_bands[i], i);
+
+	/* Read maximum allowed TX power for 2GHz and 5GHz bands. */
+	iwn_read_prom_data(sc, IWN4965_EEPROM_MAXPOW, &val, 2);
+	sc->maxpwr2GHz = val & 0xff;
+	sc->maxpwr5GHz = val >> 8;
+	/* Check that EEPROM values are within valid range. */
+	if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
+		sc->maxpwr5GHz = 38;
+	if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
+		sc->maxpwr2GHz = 38;
+	DPRINTF(sc, IWN_DEBUG_RESET, "maxpwr 2GHz=%d 5GHz=%d\n",
+	    sc->maxpwr2GHz, sc->maxpwr5GHz);
+
+	/* Read samples for each TX power group. */
+	iwn_read_prom_data(sc, IWN4965_EEPROM_BANDS, sc->bands,
+	    sizeof sc->bands);
+
+	/* Read voltage at which samples were taken. */
+	iwn_read_prom_data(sc, IWN4965_EEPROM_VOLTAGE, &val, 2);
+	sc->eeprom_voltage = (int16_t)le16toh(val);
+	DPRINTF(sc, IWN_DEBUG_RESET, "voltage=%d (in 0.3V)\n",
+	    sc->eeprom_voltage);
+
+#ifdef IWN_DEBUG
+	/* Print samples. */
+	if (sc->sc_debug & IWN_DEBUG_ANY || 1) {
+		for (i = 0; i < IWN_NBANDS; i++)
+			iwn4965_print_power_group(sc, i);
+	}
+#endif
+}
+
+#ifdef IWN_DEBUG
+void
+iwn4965_print_power_group(struct iwn_softc *sc, int i)
+{
+	struct iwn4965_eeprom_band *band = &sc->bands[i];
+	struct iwn4965_eeprom_chan_samples *chans = band->chans;
+	int j, c;
+
+	printf("===band %d===\n", i);
+	printf("chan lo=%d, chan hi=%d\n", band->lo, band->hi);
+	printf("chan1 num=%d\n", chans[0].num);
+	for (c = 0; c < 2; c++) {
+		for (j = 0; j < IWN_NSAMPLES; j++) {
+			printf("chain %d, sample %d: temp=%d gain=%d "
+			    "power=%d pa_det=%d\n", c, j,
+			    chans[0].samples[c][j].temp,
+			    chans[0].samples[c][j].gain,
+			    chans[0].samples[c][j].power,
+			    chans[0].samples[c][j].pa_det);
+		}
+	}
+	printf("chan2 num=%d\n", chans[1].num);
+	for (c = 0; c < 2; c++) {
+		for (j = 0; j < IWN_NSAMPLES; j++) {
+			printf("chain %d, sample %d: temp=%d gain=%d "
+			    "power=%d pa_det=%d\n", c, j,
+			    chans[1].samples[c][j].temp,
+			    chans[1].samples[c][j].gain,
+			    chans[1].samples[c][j].power,
+			    chans[1].samples[c][j].pa_det);
+		}
+	}
+}
+#endif
+
+void
+iwn5000_read_eeprom(struct iwn_softc *sc)
+{
+	int32_t temp, volt, delta;
+	uint32_t addr, base;
+	int i;
+	uint16_t val;
+
+	/* Read regulatory domain (4 ASCII characters.) */
+	iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
+	base = le16toh(val);
+	iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
+	    sc->eeprom_domain, 4);
+
+	/* Read the list of authorized channels. */
+	for (i = 0; i < 7; i++) {
+		addr = base + iwn5000_regulatory_bands[i];
+		iwn_read_eeprom_channels(sc, addr, i);
+	}
+
+	iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
+	base = le16toh(val);
+	if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
+		/* Compute critical temperature (in Kelvin.) */
+		iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
+		temp = le16toh(val);
+		iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
+		volt = le16toh(val);
+		delta = temp - (volt / -5);
+		sc->critical_temp = (IWN_CTOK(110) - delta) * -5;
+		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "temp=%d volt=%d delta=%dK\n",
+		    temp, volt, delta);
+	} else {
+		/* Read crystal calibration. */
+		iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
+		    &sc->eeprom_crystal, sizeof (uint32_t));
+		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "crystal calibration 0x%08x\n",
+		le32toh(sc->eeprom_crystal));
+	}
+}
+
+static void
+iwn_read_eeprom_band(struct iwn_softc *sc, const struct iwn_chan_band *band,
+    uint32_t flags, uint32_t addr)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct iwn_eeprom_chan channels[IWN_MAX_CHAN_PER_BAND];
+	struct ieee80211_channel *c;
+	int i, chan, nflags;
+
+	iwn_read_prom_data(sc, addr, channels,
+	    band->nchan * sizeof (struct iwn_eeprom_chan));
+
+	for (i = 0; i < band->nchan; i++) {
+		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
+			DPRINTF(sc, IWN_DEBUG_RESET,
+			    "skip chan %d flags 0x%x maxpwr %d\n",
+			    band->chan[i], channels[i].flags,
+			    channels[i].maxpwr);
+			continue;
+		}
+		chan = band->chan[i];
+
+		/* Translate EEPROM flags to net80211 */
+		nflags = 0;
+		if ((channels[i].flags & IWN_EEPROM_CHAN_ACTIVE) == 0)
+			nflags |= IEEE80211_CHAN_PASSIVE;
+		if ((channels[i].flags & IWN_EEPROM_CHAN_IBSS) == 0)
+			nflags |= IEEE80211_CHAN_NOADHOC;
+		if (channels[i].flags & IWN_EEPROM_CHAN_RADAR) {
+			nflags |= IEEE80211_CHAN_DFS;
+			/* XXX apparently IBSS may still be marked */
+			nflags |= IEEE80211_CHAN_NOADHOC;
+		}
+
+		DPRINTF(sc, IWN_DEBUG_RESET,
+		    "add chan %d flags 0x%x maxpwr %d\n",
+		    chan, channels[i].flags, channels[i].maxpwr);
+
+		c = &ic->ic_channels[ic->ic_nchans++];
+		c->ic_ieee = chan;
+		c->ic_freq = ieee80211_ieee2mhz(chan, flags);
+		c->ic_maxregpower = channels[i].maxpwr;
+		c->ic_maxpower = 2*c->ic_maxregpower;
+		if (flags & IEEE80211_CHAN_2GHZ) {
+			/* G =>'s B is supported */
+			c->ic_flags = IEEE80211_CHAN_B | nflags;
+
+			c = &ic->ic_channels[ic->ic_nchans++];
+			c[0] = c[-1];
+			c->ic_flags = IEEE80211_CHAN_G | nflags;
+		} else {	/* 5GHz band */
+			c->ic_flags = IEEE80211_CHAN_A | nflags;
+			sc->sc_flags |= IWN_FLAG_HAS_5GHZ;
+		}
+		/* XXX no constraints on using HT20 */
+		/* add HT20, HT40 added separately */
+		c = &ic->ic_channels[ic->ic_nchans++];
+		c[0] = c[-1];
+		c->ic_flags |= IEEE80211_CHAN_HT20;
+		/* XXX NARROW =>'s 1/2 and 1/4 width? */
+	}
+}
+
+static void
+iwn_read_eeprom_ht40(struct iwn_softc *sc, const struct iwn_chan_band *band,
+    uint32_t flags, uint32_t addr)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct iwn_eeprom_chan channels[IWN_MAX_CHAN_PER_BAND];
+	struct ieee80211_channel *c, *cent, *extc;
+	int i;
+
+	iwn_read_prom_data(sc, addr, channels,
+	    band->nchan * sizeof (struct iwn_eeprom_chan));
+
+	for (i = 0; i < band->nchan; i++) {
+		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID) ||
+		    !(channels[i].flags & IWN_EEPROM_CHAN_WIDE)) {
+			DPRINTF(sc, IWN_DEBUG_RESET,
+			    "skip chan %d flags 0x%x maxpwr %d\n",
+			    band->chan[i], channels[i].flags,
+			    channels[i].maxpwr);
+			continue;
+		}
+		/*
+		 * Each entry defines an HT40 channel pair; find the
+		 * center channel, then the extension channel above.
+		 */
+		cent = ieee80211_find_channel_byieee(ic, band->chan[i],
+		    flags & ~IEEE80211_CHAN_HT);
+		if (cent == NULL) {	/* XXX shouldn't happen */
+			device_printf(sc->sc_dev,
+			    "%s: no entry for channel %d\n",
+			    __func__, band->chan[i]);
+			continue;
+		}
+		extc = ieee80211_find_channel(ic, cent->ic_freq+20,
+		    flags & ~IEEE80211_CHAN_HT);
+		if (extc == NULL) {
+			DPRINTF(sc, IWN_DEBUG_RESET,
+			    "skip chan %d, extension channel not found\n",
+			    band->chan[i]);
+			continue;
+		}
+
+		DPRINTF(sc, IWN_DEBUG_RESET,
+		    "add ht40 chan %d flags 0x%x maxpwr %d\n",
+		    band->chan[i], channels[i].flags, channels[i].maxpwr);
+
+		c = &ic->ic_channels[ic->ic_nchans++];
+		c[0] = cent[0];
+		c->ic_extieee = extc->ic_ieee;
+		c->ic_flags &= ~IEEE80211_CHAN_HT;
+		c->ic_flags |= IEEE80211_CHAN_HT40U;
+		c = &ic->ic_channels[ic->ic_nchans++];
+		c[0] = extc[0];
+		c->ic_extieee = cent->ic_ieee;
+		c->ic_flags &= ~IEEE80211_CHAN_HT;
+		c->ic_flags |= IEEE80211_CHAN_HT40D;
+	}
+}
+
+static void
+iwn_read_eeprom_channels(struct iwn_softc *sc, uint32_t addr, int n)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	static const uint32_t iwnband_flags[] = {
+		IEEE80211_CHAN_G,
+		IEEE80211_CHAN_A,
+		IEEE80211_CHAN_A,
+		IEEE80211_CHAN_A,
+		IEEE80211_CHAN_A,
+		IEEE80211_CHAN_G | IEEE80211_CHAN_HT40,
+		IEEE80211_CHAN_A | IEEE80211_CHAN_HT40
+	};
+
+	if (n < 5)
+		iwn_read_eeprom_band(sc, &iwn_bands[n], iwnband_flags[n], addr);
+	else
+		iwn_read_eeprom_ht40(sc, &iwn_bands[n], iwnband_flags[n], addr);
+	ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
+}
+
 struct ieee80211_node *
 iwn_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
 {
@@ -954,7 +1680,7 @@ iwn_newassoc(struct ieee80211_node *ni, int isnew)
 	struct ieee80211vap *vap = ni->ni_vap;
 
 	ieee80211_amrr_node_init(&IWN_VAP(vap)->iv_amrr,
-	   &IWN_NODE(ni)->amn, ni);
+	    &IWN_NODE(ni)->amn, ni);
 }
 
 int
@@ -983,7 +1709,10 @@ iwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 
 	if (nstate == IEEE80211_S_AUTH && vap->iv_state != IEEE80211_S_AUTH) {
 		/* !AUTH -> AUTH requires adapter config */
-		error = iwn_auth(sc, vap);
+		error = 1;
+		while (error) {
+			error = iwn_auth(sc, vap);
+		}
 	}
 	if (nstate == IEEE80211_S_RUN && vap->iv_state != IEEE80211_S_RUN) {
 		/*
@@ -1005,314 +1734,20 @@ iwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 }
 
 /*
- * Grab exclusive access to NIC memory.
+ * Process an RX_PHY firmware notification.  This is usually immediately
+ * followed by an MPDU_RX_DONE notification.
  */
 void
-iwn_mem_lock(struct iwn_softc *sc)
-{
-	uint32_t tmp;
-	int ntries;
-
-	tmp = IWN_READ(sc, IWN_GPIO_CTL);
-	IWN_WRITE(sc, IWN_GPIO_CTL, tmp | IWN_GPIO_MAC);
-
-	/* spin until we actually get the lock */
-	for (ntries = 0; ntries < 1000; ntries++) {
-		if ((IWN_READ(sc, IWN_GPIO_CTL) &
-		    (IWN_GPIO_CLOCK | IWN_GPIO_SLEEP)) == IWN_GPIO_CLOCK)
-			break;
-		DELAY(10);
-	}
-	if (ntries == 1000)
-		device_printf(sc->sc_dev,
-		    "%s: could not lock memory\n", __func__);
-}
-
-/*
- * Release lock on NIC memory.
- */
-void
-iwn_mem_unlock(struct iwn_softc *sc)
-{
-	uint32_t tmp = IWN_READ(sc, IWN_GPIO_CTL);
-	IWN_WRITE(sc, IWN_GPIO_CTL, tmp & ~IWN_GPIO_MAC);
-}
-
-uint32_t
-iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
-{
-	IWN_WRITE(sc, IWN_READ_MEM_ADDR, IWN_MEM_4 | addr);
-	return IWN_READ(sc, IWN_READ_MEM_DATA);
-}
-
-void
-iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
-{
-	IWN_WRITE(sc, IWN_WRITE_MEM_ADDR, IWN_MEM_4 | addr);
-	IWN_WRITE(sc, IWN_WRITE_MEM_DATA, data);
-}
-
-void
-iwn_mem_write_region_4(struct iwn_softc *sc, uint32_t addr,
-    const uint32_t *data, int wlen)
-{
-	for (; wlen > 0; wlen--, data++, addr += 4)
-		iwn_mem_write(sc, addr, *data);
-}
-
-int
-iwn_eeprom_lock(struct iwn_softc *sc)
-{
-	uint32_t tmp;
-	int ntries;
-
-	tmp = IWN_READ(sc, IWN_HWCONFIG);
-	IWN_WRITE(sc, IWN_HWCONFIG, tmp | IWN_HW_EEPROM_LOCKED);
-
-	/* spin until we actually get the lock */
-	for (ntries = 0; ntries < 100; ntries++) {
-		if (IWN_READ(sc, IWN_HWCONFIG) & IWN_HW_EEPROM_LOCKED)
-			return 0;
-		DELAY(10);
-	}
-	return ETIMEDOUT;
-}
-
-void
-iwn_eeprom_unlock(struct iwn_softc *sc)
-{
-	uint32_t tmp = IWN_READ(sc, IWN_HWCONFIG);
-	IWN_WRITE(sc, IWN_HWCONFIG, tmp & ~IWN_HW_EEPROM_LOCKED);
-}
-
-/*
- * Read `len' bytes from the EEPROM.  We access the EEPROM through the MAC
- * instead of using the traditional bit-bang method.
- */
-int
-iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int len)
-{
-	uint8_t *out = data;
-	uint32_t val;
-	int ntries, tmp;
-
-	iwn_mem_lock(sc);
-	for (; len > 0; len -= 2, addr++) {
-		IWN_WRITE(sc, IWN_EEPROM_CTL, addr << 2);
-		tmp = IWN_READ(sc, IWN_EEPROM_CTL);	
-		IWN_WRITE(sc, IWN_EEPROM_CTL, tmp & ~IWN_EEPROM_MSK );
-
-		for (ntries = 0; ntries < 10; ntries++) {
-			if ((val = IWN_READ(sc, IWN_EEPROM_CTL)) &
-			    IWN_EEPROM_READY)
-				break;
-			DELAY(5);
-		}
-		if (ntries == 10) {
-			device_printf(sc->sc_dev,"could not read EEPROM\n");
-			return ETIMEDOUT;
-		}
-		*out++ = val >> 16;
-		if (len > 1)
-			*out++ = val >> 24;
-	}
-	iwn_mem_unlock(sc);
-
-	return 0;
-}
-
-/*
- * The firmware boot code is small and is intended to be copied directly into
- * the NIC internal memory.
- */
-int
-iwn_transfer_microcode(struct iwn_softc *sc, const uint8_t *ucode, int size)
-{
-	int ntries;
-
-	size /= sizeof (uint32_t);
-
-	iwn_mem_lock(sc);
-
-	/* copy microcode image into NIC memory */
-	iwn_mem_write_region_4(sc, IWN_MEM_UCODE_BASE,
-	    (const uint32_t *)ucode, size);
-
-	iwn_mem_write(sc, IWN_MEM_UCODE_SRC, 0);
-	iwn_mem_write(sc, IWN_MEM_UCODE_DST, IWN_FW_TEXT);
-	iwn_mem_write(sc, IWN_MEM_UCODE_SIZE, size);
-
-	/* run microcode */
-	iwn_mem_write(sc, IWN_MEM_UCODE_CTL, IWN_UC_RUN);
-
-	/* wait for transfer to complete */
-	for (ntries = 0; ntries < 1000; ntries++) {
-		if (!(iwn_mem_read(sc, IWN_MEM_UCODE_CTL) & IWN_UC_RUN))
-			break;
-		DELAY(10);
-	}
-	if (ntries == 1000) {
-		iwn_mem_unlock(sc);
-		device_printf(sc->sc_dev,
-		    "%s: could not load boot firmware\n", __func__);
-		return ETIMEDOUT;
-	}
-	iwn_mem_write(sc, IWN_MEM_UCODE_CTL, IWN_UC_ENABLE);
-
-	iwn_mem_unlock(sc);
-
-	return 0;
-}
-
-int
-iwn_load_firmware(struct iwn_softc *sc)
-{
-	int error;
-
-	KASSERT(sc->fw_fp == NULL, ("firmware already loaded"));
-
-	IWN_UNLOCK(sc);
-	/* load firmware image from disk */
-	sc->fw_fp = firmware_get("iwnfw");
-	if (sc->fw_fp == NULL) {
-		device_printf(sc->sc_dev,
-		    "%s: could not load firmare image \"iwnfw\"\n", __func__);
-		error = EINVAL;
-	} else
-		error = 0;
-	IWN_LOCK(sc);
-	return error;
-}
-
-int
-iwn_transfer_firmware(struct iwn_softc *sc)
+iwn_rx_phy(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
 {
-	struct iwn_dma_info *dma = &sc->fw_dma;
-	const struct iwn_firmware_hdr *hdr;
-	const uint8_t *init_text, *init_data, *main_text, *main_data;
-	const uint8_t *boot_text;
-	uint32_t init_textsz, init_datasz, main_textsz, main_datasz;
-	uint32_t boot_textsz;
-	int error = 0;
-	const struct firmware *fp = sc->fw_fp;
-
-	/* extract firmware header information */
-	if (fp->datasize < sizeof (struct iwn_firmware_hdr)) {
-		device_printf(sc->sc_dev,
-		    "%s: truncated firmware header: %zu bytes, expecting %zu\n",
-		    __func__, fp->datasize, sizeof (struct iwn_firmware_hdr));
-		error = EINVAL;
-		goto fail;
-	}
-	hdr = (const struct iwn_firmware_hdr *)fp->data;
-	main_textsz = le32toh(hdr->main_textsz);
-	main_datasz = le32toh(hdr->main_datasz);
-	init_textsz = le32toh(hdr->init_textsz);
-	init_datasz = le32toh(hdr->init_datasz);
-	boot_textsz = le32toh(hdr->boot_textsz);
-
-	/* sanity-check firmware segments sizes */
-	if (main_textsz > IWN_FW_MAIN_TEXT_MAXSZ ||
-	    main_datasz > IWN_FW_MAIN_DATA_MAXSZ ||
-	    init_textsz > IWN_FW_INIT_TEXT_MAXSZ ||
-	    init_datasz > IWN_FW_INIT_DATA_MAXSZ ||
-	    boot_textsz > IWN_FW_BOOT_TEXT_MAXSZ ||
-	    (boot_textsz & 3) != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: invalid firmware header, main [%d,%d], init [%d,%d] "
-		    "boot %d\n", __func__, main_textsz, main_datasz,
-		    init_textsz, init_datasz, boot_textsz);
-		error = EINVAL;
-		goto fail;
-	}
-
-	/* check that all firmware segments are present */
-	if (fp->datasize < sizeof (struct iwn_firmware_hdr) + main_textsz +
-	    main_datasz + init_textsz + init_datasz + boot_textsz) {
-		device_printf(sc->sc_dev, "%s: firmware file too short: "
-		    "%zu bytes, main [%d, %d], init [%d,%d] boot %d\n",
-		    __func__, fp->datasize, main_textsz, main_datasz,
-		    init_textsz, init_datasz, boot_textsz);
-		error = EINVAL;
-		goto fail;
-	}
-
-	/* get pointers to firmware segments */
-	main_text = (const uint8_t *)(hdr + 1);
-	main_data = main_text + main_textsz;
-	init_text = main_data + main_datasz;
-	init_data = init_text + init_textsz;
-	boot_text = init_data + init_datasz;
-
-	/* copy initialization images into pre-allocated DMA-safe memory */
-	memcpy(dma->vaddr, init_data, init_datasz);
-	memcpy(dma->vaddr + IWN_FW_INIT_DATA_MAXSZ, init_text, init_textsz);
-
-	/* tell adapter where to find initialization images */
-	iwn_mem_lock(sc);
-	iwn_mem_write(sc, IWN_MEM_DATA_BASE, dma->paddr >> 4);
-	iwn_mem_write(sc, IWN_MEM_DATA_SIZE, init_datasz);
-	iwn_mem_write(sc, IWN_MEM_TEXT_BASE,
-	    (dma->paddr + IWN_FW_INIT_DATA_MAXSZ) >> 4);
-	iwn_mem_write(sc, IWN_MEM_TEXT_SIZE, init_textsz);
-	iwn_mem_unlock(sc);
-
-	/* load firmware boot code */
-	error = iwn_transfer_microcode(sc, boot_text, boot_textsz);
-	if (error != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not load boot firmware, error %d\n",
-		    __func__, error);
-		goto fail;
-	}
-
-	/* now press "execute" ;-) */
-	IWN_WRITE(sc, IWN_RESET, 0);
-
-	/* wait at most one second for first alive notification */
-	error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
-	if (error != 0) {
-		/* this isn't what was supposed to happen.. */
-		device_printf(sc->sc_dev,
-		    "%s: timeout waiting for first alive notice, error %d\n",
-		    __func__, error);
-		goto fail;
-	}
+	struct iwn_rx_stat *stat = (struct iwn_rx_stat *)(desc + 1);
 
-	/* copy runtime images into pre-allocated DMA-safe memory */
-	memcpy(dma->vaddr, main_data, main_datasz);
-	memcpy(dma->vaddr + IWN_FW_MAIN_DATA_MAXSZ, main_text, main_textsz);
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: received PHY stats\n", __func__);
 
-	/* tell adapter where to find runtime images */
-	iwn_mem_lock(sc);
-	iwn_mem_write(sc, IWN_MEM_DATA_BASE, dma->paddr >> 4);
-	iwn_mem_write(sc, IWN_MEM_DATA_SIZE, main_datasz);
-	iwn_mem_write(sc, IWN_MEM_TEXT_BASE,
-	    (dma->paddr + IWN_FW_MAIN_DATA_MAXSZ) >> 4);
-	iwn_mem_write(sc, IWN_MEM_TEXT_SIZE, IWN_FW_UPDATED | main_textsz);
-	iwn_mem_unlock(sc);
-
-	/* wait at most one second for second alive notification */
-	error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
-	if (error != 0) {
-		/* this isn't what was supposed to happen.. */
-		device_printf(sc->sc_dev,
-		   "%s: timeout waiting for second alive notice, error %d\n",
-		   __func__, error);
-		goto fail;
-	}
-	return 0;
-fail:
-	return error;
-}
-
-void
-iwn_unload_firmware(struct iwn_softc *sc)
-{
-        if (sc->fw_fp != NULL) {
-                firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
-                sc->fw_fp = NULL;
-        }
+	/* Save RX statistics, they will be used on MPDU_RX_DONE. */
+	memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
+	sc->last_rx_valid = 1;
 }
 
 static void
@@ -1339,18 +1774,6 @@ iwn_calib_reset(struct iwn_softc *sc)
 	sc->calib_cnt = 60;		/* do calibration every 60s */
 }
 
-void
-iwn_ampdu_rx_start(struct iwn_softc *sc, struct iwn_rx_desc *desc)
-{
-	struct iwn_rx_stat *stat;
-
-	DPRINTF(sc, IWN_DEBUG_RECV, "%s\n", "received AMPDU stats");
-	/* save Rx statistics, they will be used on IWN_AMPDU_RX_DONE */
-	stat = (struct iwn_rx_stat *)(desc + 1);
-	memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
-	sc->last_rx_valid = 1;
-}
-
 static __inline int
 maprate(int iwnrate)
 {
@@ -1375,25 +1798,29 @@ maprate(int iwnrate)
 	return 0;
 }
 
+/*
+ * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
+ * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
+ */
 void
-iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
     struct iwn_rx_data *data)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct iwn_rx_ring *ring = &sc->rxq;
 	struct ieee80211_frame *wh;
 	struct ieee80211_node *ni;
-	struct mbuf *m, *mnew;
+	struct mbuf *m, *m1;
 	struct iwn_rx_stat *stat;
 	caddr_t head;
-	uint32_t *tail;
-	int8_t rssi, nf;
-	int len, error;
 	bus_addr_t paddr;
+	uint32_t flags;
+	int error, len, rssi, nf;
 
-	if (desc->type == IWN_AMPDU_RX_DONE) {
-		/* check for prior AMPDU_RX_START */
+	if (desc->type == IWN_MPDU_RX_DONE) {
+		/* Check for prior RX_PHY notification. */
 		if (!sc->last_rx_valid) {
 			DPRINTF(sc, IWN_DEBUG_ANY,
 			    "%s: missing AMPDU_RX_START\n", __func__);
@@ -1412,24 +1839,26 @@ iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
 		ifp->if_ierrors++;
 		return;
 	}
-	if (desc->type == IWN_AMPDU_RX_DONE) {
-		struct iwn_rx_ampdu *ampdu = (struct iwn_rx_ampdu *)(desc + 1);
-		head = (caddr_t)(ampdu + 1);
-		len = le16toh(ampdu->len);
+	if (desc->type == IWN_MPDU_RX_DONE) {
+		struct iwn_rx_mpdu *mpdu = (struct iwn_rx_mpdu *)(desc + 1);
+		head = (caddr_t)(mpdu + 1);
+		len = le16toh(mpdu->len);
 	} else {
 		head = (caddr_t)(stat + 1) + stat->cfg_phy_len;
 		len = le16toh(stat->len);
 	}
 
-	/* discard Rx frames with bad CRC early */
-	tail = (uint32_t *)(head + len);
-	if ((le32toh(*tail) & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
+	flags = le32toh(*(uint32_t *)(head + len));
+
+	/* Discard frames with a bad FCS early. */
+	if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
 		DPRINTF(sc, IWN_DEBUG_RECV, "%s: rx flags error %x\n",
-		    __func__, le32toh(*tail));
+		    __func__, flags);
 		ifp->if_ierrors++;
 		return;
 	}
-	if (len < sizeof (struct ieee80211_frame)) {
+	/* Discard frames that are too short. */
+	if (len < sizeof (*wh)) {
 		DPRINTF(sc, IWN_DEBUG_RECV, "%s: frame too short: %d\n",
 		    __func__, len);
 		ifp->if_ierrors++;
@@ -1437,41 +1866,40 @@ iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
 	}
 
 	/* XXX don't need mbuf, just dma buffer */
-	mnew = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
-	if (mnew == NULL) {
+	m1 = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR, MJUMPAGESIZE);
+	if (m1 == NULL) {
 		DPRINTF(sc, IWN_DEBUG_ANY, "%s: no mbuf to restock ring\n",
 		    __func__);
 		ifp->if_ierrors++;
 		return;
 	}
-	error = bus_dmamap_load(ring->data_dmat, data->map,
-	    mtod(mnew, caddr_t), MJUMPAGESIZE,
+	error = bus_dmamap_load(ring->desc_dma.tag, data->map,
+	    mtod(m1, caddr_t), MJUMPAGESIZE,
 	    iwn_dma_map_addr, &paddr, BUS_DMA_NOWAIT);
 	if (error != 0 && error != EFBIG) {
 		device_printf(sc->sc_dev,
 		    "%s: bus_dmamap_load failed, error %d\n", __func__, error);
-		m_freem(mnew);
+		m_freem(m1);
 		ifp->if_ierrors++;
 		return;
 	}
-	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 
-	/* finalize mbuf and swap in new one */
 	m = data->m;
+	data->m = m1;
+	/* Update RX descriptor. */
+	ring->desc[ring->cur] = htole32(paddr >> 8);
+	bus_dmamap_sync(ring->desc_dma.tag, data->map, BUS_DMASYNC_PREWRITE);
+
+	/* Finalize mbuf. */
 	m->m_pkthdr.rcvif = ifp;
 	m->m_data = head;
 	m->m_pkthdr.len = m->m_len = len;
 
-	data->m = mnew;
-	/* update Rx descriptor */
-	ring->desc[ring->cur] = htole32(paddr >> 8);
-
-	rssi = iwn_get_rssi(sc, stat);
+	rssi = hal->get_rssi(sc, stat);
 
-	/* grab a reference to the source node */
+	/* Grab a reference to the source node. */
 	wh = mtod(m, struct ieee80211_frame *);
 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
-
 	nf = (ni != NULL && ni->ni_vap->iv_state == IEEE80211_S_RUN &&
 	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) ? sc->noise : -95;
 
@@ -1480,7 +1908,7 @@ iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
 
 		tap->wr_tsft = htole64(stat->tstamp);
 		tap->wr_flags = 0;
-		if (stat->flags & htole16(IWN_CONFIG_SHPREAMBLE))
+		if (stat->flags & htole16(IWN_RXON_SHPREAMBLE))
 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 		tap->wr_rate = maprate(stat->rate);
 		tap->wr_dbm_antsignal = rssi;
@@ -1489,9 +1917,10 @@ iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
 
 	IWN_UNLOCK(sc);
 
-	/* send the frame to the 802.11 layer */
+	/* Send the frame to the 802.11 layer. */
 	if (ni != NULL) {
 		(void) ieee80211_input(ni, m, rssi - nf, nf);
+		/* Node is no longer needed. */
 		ieee80211_free_node(ni);
 	} else
 		(void) ieee80211_input_all(ic, m, rssi - nf, nf);
@@ -1499,93 +1928,172 @@ iwn_rx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc,
 	IWN_LOCK(sc);
 }
 
+/*
+ * Process a CALIBRATION_RESULT notification sent by the initialization
+ * firmware on response to a CMD_CALIB_CONFIG command (5000 only.)
+ */
+void
+iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
+{
+	struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
+	int len, idx = -1;
+
+	/* Runtime firmware should not send such a notification. */
+	if (!(sc->sc_flags & IWN_FLAG_FIRST_BOOT))
+		return;
+
+	len = (le32toh(desc->len) & 0x3fff) - 4;
+
+	switch (calib->code) {
+	case IWN5000_PHY_CALIB_DC:
+		if (sc->hw_type == IWN_HW_REV_TYPE_5150)
+			idx = 0;
+		break;
+	case IWN5000_PHY_CALIB_LO:
+		idx = 1;
+		break;
+	case IWN5000_PHY_CALIB_TX_IQ:
+		idx = 2;
+		break;
+	case IWN5000_PHY_CALIB_TX_IQ_PERD:
+		if (sc->hw_type != IWN_HW_REV_TYPE_5150)
+			idx = 3;
+		break;
+	case IWN5000_PHY_CALIB_BASE_BAND:
+		idx = 4;
+		break;
+	}
+	if (idx == -1)	/* Ignore other results. */
+		return;
+
+	/* Save calibration result. */
+	if (sc->calibcmd[idx].buf != NULL)
+		free(sc->calibcmd[idx].buf, M_DEVBUF);
+	sc->calibcmd[idx].buf = malloc(len, M_DEVBUF, M_NOWAIT);
+	if (sc->calibcmd[idx].buf == NULL) {
+		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+		    "not enough memory for calibration result %d\n",
+		    calib->code);
+		return;
+	}
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+	    "saving calibration result code=%d len=%d\n", calib->code, len);
+	sc->calibcmd[idx].len = len;
+	memcpy(sc->calibcmd[idx].buf, calib, len);
+}
+
+/*
+ * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
+ * The latter is sent by the firmware after each received beacon.
+ */
 void
-iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc)
+iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 	struct iwn_calib_state *calib = &sc->calib;
 	struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
+	int temp;
 
-	/* beacon stats are meaningful only when associated and not scanning */
+	/* Beacon stats are meaningful only when associated and not scanning. */
 	if (vap->iv_state != IEEE80211_S_RUN ||
 	    (ic->ic_flags & IEEE80211_F_SCAN))
 		return;
 
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: cmd %d\n", __func__, desc->type);
-	iwn_calib_reset(sc);
+	iwn_calib_reset(sc);	/* Reset TX power calibration timeout. */
 
-	/* test if temperature has changed */
+	/* Test if temperature has changed. */
 	if (stats->general.temp != sc->rawtemp) {
-		int temp;
-
+		/* Convert "raw" temperature to degC. */
 		sc->rawtemp = stats->general.temp;
-		temp = iwn_get_temperature(sc);
+		temp = hal->get_temperature(sc);
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d\n",
 		    __func__, temp);
 
-		/* update Tx power if need be */
-		iwn_power_calibration(sc, temp);
+		/* Update TX power if need be (4965AGN only.) */
+		if (sc->hw_type == IWN_HW_REV_TYPE_4965)
+			iwn4965_power_calibration(sc, temp);
 	}
 
 	if (desc->type != IWN_BEACON_STATISTICS)
-		return;	/* reply to a statistics request */
+		return;	/* Reply to a statistics request. */
 
 	sc->noise = iwn_get_noise(&stats->rx.general);
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: noise %d\n", __func__, sc->noise);
 
-	/* test that RSSI and noise are present in stats report */
-	if (stats->rx.general.flags != htole32(1)) {
+	/* Test that RSSI and noise are present in stats report. */
+	if (le32toh(stats->rx.general.flags) != 1) {
 		DPRINTF(sc, IWN_DEBUG_ANY, "%s\n",
 		    "received statistics without RSSI");
 		return;
 	}
 
 	if (calib->state == IWN_CALIB_STATE_ASSOC)
-		iwn_compute_differential_gain(sc, &stats->rx.general);
+		iwn_collect_noise(sc, &stats->rx.general);
 	else if (calib->state == IWN_CALIB_STATE_RUN)
 		iwn_tune_sensitivity(sc, &stats->rx);
 }
 
+/*
+ * Process a TX_DONE firmware notification.  Unfortunately, the 4965AGN
+ * and 5000 adapters have different incompatible TX status formats.
+ */
 void
-iwn_tx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc)
+iwn4965_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
 {
-	struct ifnet *ifp = sc->sc_ifp;
-	struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
-	struct iwn_tx_data *data = &ring->data[desc->idx];
-	struct iwn_tx_stat *stat = (struct iwn_tx_stat *)(desc + 1);
-	struct iwn_node *wn = IWN_NODE(data->ni);
-	struct mbuf *m;
-	struct ieee80211_node *ni;
-	uint32_t status;
+	struct iwn4965_tx_stat *stat = (struct iwn4965_tx_stat *)(desc + 1);
 
-	KASSERT(data->ni != NULL, ("no node"));
+	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
+	    "qid %d idx %d retries %d nkill %d rate %x duration %d status %x\n",
+	    __func__, desc->qid, desc->idx, stat->retrycnt,
+	    stat->killcnt, stat->rate, le16toh(stat->duration),
+	    le32toh(stat->status));
+
+	iwn_tx_done(sc, desc, stat->retrycnt, le32toh(stat->status) & 0xff);
+}
+
+void
+iwn5000_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
+    struct iwn_rx_data *data)
+{
+	struct iwn5000_tx_stat *stat = (struct iwn5000_tx_stat *)(desc + 1);
 
 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: "
 	    "qid %d idx %d retries %d nkill %d rate %x duration %d status %x\n",
-	    __func__, desc->qid, desc->idx, stat->ntries,
-	    stat->nkill, stat->rate, le16toh(stat->duration),
+	    __func__, desc->qid, desc->idx, stat->retrycnt,
+	    stat->killcnt, stat->rate, le16toh(stat->duration),
 	    le32toh(stat->status));
 
-	/*
-	 * Update rate control statistics for the node.
-	 */
-	status = le32toh(stat->status) & 0xff;
-	if (status & 0x80) {
-		DPRINTF(sc, IWN_DEBUG_ANY, "%s: status 0x%x\n",
-		    __func__, le32toh(stat->status));
-		ifp->if_oerrors++;
-		ieee80211_amrr_tx_complete(&wn->amn,
-		    IEEE80211_AMRR_FAILURE, stat->ntries);
-	} else {
-		ieee80211_amrr_tx_complete(&wn->amn,
-		    IEEE80211_AMRR_SUCCESS, stat->ntries);
-	}
+	/* Reset TX scheduler slot. */
+	iwn5000_reset_sched(sc, desc->qid & 0xf, desc->idx);
 
-	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
-	bus_dmamap_unload(ring->data_dmat, data->map);
+	iwn_tx_done(sc, desc, stat->retrycnt, le16toh(stat->status) & 0xff);
+}
 
+/*
+ * Adapter-independent backend for TX_DONE firmware notifications.
+ */
+void
+iwn_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc, int retrycnt,
+    uint8_t status)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
+	struct iwn_tx_data *data = &ring->data[desc->idx];
+	struct mbuf *m;
+	struct ieee80211_node *ni;
+
+	KASSERT(data->ni != NULL, ("no node"));
+
+	/* Unmap and free mbuf. */
+	bus_dmamap_sync(ring->desc_dma.tag, data->map, BUS_DMASYNC_POSTWRITE);
+	bus_dmamap_unload(ring->desc_dma.tag, data->map);
 	m = data->m, data->m = NULL;
 	ni = data->ni, data->ni = NULL;
 
@@ -1614,34 +2122,45 @@ iwn_tx_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc)
 	m_freem(m);
 	ieee80211_free_node(ni);
 
-	ring->queued--;
-
 	sc->sc_tx_timer = 0;
-	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
-	iwn_start_locked(ifp);
+	if (--ring->queued < IWN_TX_RING_LOMARK) {
+		sc->qfullmsk &= ~(1 << ring->qid);
+		if (sc->qfullmsk == 0 &&
+		    (ifp->if_drv_flags & IFF_DRV_OACTIVE)) {
+			printf("hier :(\n");
+			ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
+			iwn_start_locked(ifp);
+		}
+	}
 }
 
+/*
+ * Process a "command done" firmware notification.  This is where we wakeup
+ * processes waiting for a synchronous command completion.
+ */
 void
-iwn_cmd_intr(struct iwn_softc *sc, struct iwn_rx_desc *desc)
+iwn_cmd_done(struct iwn_softc *sc, struct iwn_rx_desc *desc)
 {
 	struct iwn_tx_ring *ring = &sc->txq[4];
 	struct iwn_tx_data *data;
 
 	if ((desc->qid & 0xf) != 4)
-		return;	/* not a command ack */
+		return;	/* Not a command ack. */
 
 	data = &ring->data[desc->idx];
 
-	/* if the command was mapped in a mbuf, free it */
+	/* If the command was mapped in an mbuf, free it. */
 	if (data->m != NULL) {
-		bus_dmamap_unload(ring->data_dmat, data->map);
+		bus_dmamap_unload(ring->desc_dma.tag, data->map);
 		m_freem(data->m);
 		data->m = NULL;
 	}
-
 	wakeup(&ring->cmd[desc->idx]);
 }
 
+/*
+ * Process an INT_FH_RX or INT_SW_RX interrupt.
+ */
 void
 iwn_notif_intr(struct iwn_softc *sc)
 {
@@ -1650,41 +2169,50 @@ iwn_notif_intr(struct iwn_softc *sc)
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 	uint16_t hw;
 
-	hw = le16toh(sc->shared->closed_count) & 0xfff;
+	bus_dmamap_sync(sc->rxq.stat_dma.tag, sc->rxq.stat_dma.map,
+	    BUS_DMASYNC_POSTREAD);
+
+	hw = le16toh(sc->rxq.stat->closed_count) & 0xfff;
 	while (sc->rxq.cur != hw) {
 		struct iwn_rx_data *data = &sc->rxq.data[sc->rxq.cur];
-		struct iwn_rx_desc *desc = (void *)data->m->m_ext.ext_buf;
+		struct iwn_rx_desc *desc;
+
+		bus_dmamap_sync(sc->rxq.stat_dma.tag, data->map,
+		    BUS_DMASYNC_PREWRITE);
+		desc = mtod(data->m, struct iwn_rx_desc *);
 
 		DPRINTF(sc, IWN_DEBUG_RECV,
 		    "%s: qid %x idx %d flags %x type %d(%s) len %d\n",
-		    __func__, desc->qid, desc->idx, desc->flags,
+		    __func__, desc->qid /*& 0xf*/, desc->idx, desc->flags,
 		    desc->type, iwn_intr_str(desc->type),
 		    le16toh(desc->len));
 
-		if (!(desc->qid & 0x80))	/* reply to a command */
-			iwn_cmd_intr(sc, desc);
+		if (!(desc->qid & 0x80))	/* Reply to a command. */
+			iwn_cmd_done(sc, desc);
 
 		switch (desc->type) {
-		case IWN_RX_DONE:
-		case IWN_AMPDU_RX_DONE:
-			iwn_rx_intr(sc, desc, data);
+		case IWN_RX_PHY:
+			iwn_rx_phy(sc, desc, data);
 			break;
 
-		case IWN_AMPDU_RX_START:
-			iwn_ampdu_rx_start(sc, desc);
+		case IWN_RX_DONE:		/* 4965AGN only. */
+		case IWN_MPDU_RX_DONE:
+			/* An 802.11 frame has been received. */
+			iwn_rx_done(sc, desc, data);
 			break;
 
 		case IWN_TX_DONE:
-			/* a 802.11 frame has been transmitted */
-			iwn_tx_intr(sc, desc);
+			/* An 802.11 frame has been transmitted. */
+			sc->sc_hal->tx_done(sc, desc, data);
 			break;
 
 		case IWN_RX_STATISTICS:
 		case IWN_BEACON_STATISTICS:
-			iwn_rx_statistics(sc, desc);
+			iwn_rx_statistics(sc, desc, data);
 			break;
 
-		case IWN_BEACON_MISSED: {
+		case IWN_BEACON_MISSED:
+		{
 			struct iwn_beacon_missed *miss =
 			    (struct iwn_beacon_missed *)(desc + 1);
 			int misses = le32toh(miss->consecutive);
@@ -1692,9 +2220,11 @@ iwn_notif_intr(struct iwn_softc *sc)
 			/* XXX not sure why we're notified w/ zero */
 			if (misses == 0)
 				break;
+
 			DPRINTF(sc, IWN_DEBUG_STATE,
 			    "%s: beacons missed %d/%d\n", __func__,
 			    misses, le32toh(miss->total));
+
 			/*
 			 * If more than 5 consecutive beacons are missed,
 			 * reinitialize the sensitivity state machine.
@@ -1705,11 +2235,13 @@ iwn_notif_intr(struct iwn_softc *sc)
 				ieee80211_beacon_miss(ic);
 			break;
 		}
-		case IWN_UC_READY: {
+		case IWN_UC_READY:
+		{
 			struct iwn_ucode_info *uc =
 			    (struct iwn_ucode_info *)(desc + 1);
 
-			/* the microcontroller is ready */
+			/* The microcontroller is ready. */
+
 			DPRINTF(sc, IWN_DEBUG_RESET,
 			    "microcode alive notification version=%d.%d "
 			    "subtype=%x alive=%x\n", uc->major, uc->minor,
@@ -1717,16 +2249,19 @@ iwn_notif_intr(struct iwn_softc *sc)
 
 			if (le32toh(uc->valid) != 1) {
 				device_printf(sc->sc_dev,
-				"microcontroller initialization failed");
+				    "microcontroller initialization failed");
 				break;
 			}
 			if (uc->subtype == IWN_UCODE_INIT) {
-				/* save microcontroller's report */
+				/* Save microcontroller's report. */
 				memcpy(&sc->ucode_info, uc, sizeof (*uc));
 			}
+			/* Save the address of the error log in SRAM. */
+			sc->errptr = le32toh(uc->errptr);
 			break;
 		}
-		case IWN_STATE_CHANGED: {
+		case IWN_STATE_CHANGED:
+		{
 			uint32_t *status = (uint32_t *)(desc + 1);
 
 			/*
@@ -1734,11 +2269,13 @@ iwn_notif_intr(struct iwn_softc *sc)
 			 * noted. However, we handle this in iwn_intr as we
 			 * get both the enable/disble intr.
 			 */
+
 			DPRINTF(sc, IWN_DEBUG_INTR, "state changed to %x\n",
 			    le32toh(*status));
 			break;
 		}
-		case IWN_START_SCAN: {
+		case IWN_START_SCAN:
+		{
 			struct iwn_start_scan *scan =
 			    (struct iwn_start_scan *)(desc + 1);
 
@@ -1747,7 +2284,8 @@ iwn_notif_intr(struct iwn_softc *sc)
 			    __func__, scan->chan, le32toh(scan->status));
 			break;
 		}
-		case IWN_STOP_SCAN: {
+		case IWN_STOP_SCAN:
+		{
 			struct iwn_stop_scan *scan =
 			    (struct iwn_stop_scan *)(desc + 1);
 
@@ -1758,43 +2296,125 @@ iwn_notif_intr(struct iwn_softc *sc)
 			ieee80211_scan_next(vap);
 			break;
 		}
+		case IWN5000_CALIBRATION_RESULT:
+			iwn5000_rx_calib_results(sc, desc, data);
+			break;
+
+		case IWN5000_CALIBRATION_DONE:
+			wakeup(sc);
+			break;
 		}
+
 		sc->rxq.cur = (sc->rxq.cur + 1) % IWN_RX_RING_COUNT;
 	}
 
-	/* tell the firmware what we have processed */
+	/* Tell the firmware what we have processed. */
 	hw = (hw == 0) ? IWN_RX_RING_COUNT - 1 : hw - 1;
-	IWN_WRITE(sc, IWN_RX_WIDX, hw & ~7);
+	IWN_WRITE(sc, IWN_FH_RX_WPTR, hw & ~7);
 }
 
-static void
+/*
+ * Process an INT_WAKEUP interrupt raised when the microcontroller wakes up
+ * from power-down sleep mode.
+ */
+void
+iwn_wakeup_intr(struct iwn_softc *sc)
+{
+	int qid;
+
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s: ucode wakeup from power-down sleep\n",
+	    __func__);
+
+	/* Wakeup RX and TX rings. */
+	IWN_WRITE(sc, IWN_FH_RX_WPTR, sc->rxq.cur & ~7);
+	for (qid = 0; qid < 6; qid++) {
+		struct iwn_tx_ring *ring = &sc->txq[qid];
+		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | ring->cur);
+	}
+}
+
+void
 iwn_rftoggle_intr(struct iwn_softc *sc)
 {
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
-	uint32_t tmp = IWN_READ(sc, IWN_GPIO_CTL);
+	uint32_t tmp = IWN_READ(sc, IWN_GP_CNTRL);
 
 	IWN_LOCK_ASSERT(sc);
 
 	device_printf(sc->sc_dev, "RF switch: radio %s\n",
-	    (tmp & IWN_GPIO_RF_ENABLED) ? "enabled" : "disabled");
-	if (tmp & IWN_GPIO_RF_ENABLED)
+	    (tmp & IWN_GP_CNTRL_RFKILL) ? "enabled" : "disabled");
+	if (tmp & IWN_GP_CNTRL_RFKILL)
 		ieee80211_runtask(ic, &sc->sc_radioon_task);
 	else
 		ieee80211_runtask(ic, &sc->sc_radiooff_task);
 }
 
-static void
-iwn_error_intr(struct iwn_softc *sc, uint32_t r1, uint32_t r2)
+/*
+ * Dump the error log of the firmware when a firmware panic occurs.  Although
+ * we can't debug the firmware because it is neither open source nor free, it
+ * can help us to identify certain classes of problems.
+ */
+void
+iwn_fatal_intr(struct iwn_softc *sc, uint32_t r1, uint32_t r2)
 {
+#define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
+	struct iwn_fw_dump dump;
+	int i;
 
 	IWN_LOCK_ASSERT(sc);
 
-	device_printf(sc->sc_dev, "error, INTR=%b STATUS=0x%x\n",
-	    r1, IWN_INTR_BITS, r2);
+	/* Check that the error log address is valid. */
+	if (sc->errptr < IWN_FW_DATA_BASE ||
+	    sc->errptr + sizeof (dump) >
+	    IWN_FW_DATA_BASE + hal->fw_data_maxsz) {
+		printf("%s: bad firmware error log address 0x%08x\n",
+		    __func__, sc->errptr);
+		return;
+	}
+	if (iwn_nic_lock(sc) != 0) {
+		printf("%s: could not read firmware error log\n",
+		    __func__);
+		return;
+	}
+	/* Read firmware error log from SRAM. */
+	iwn_mem_read_region_4(sc, sc->errptr, (uint32_t *)&dump,
+	    sizeof (dump) / sizeof (uint32_t));
+	iwn_nic_unlock(sc);
+
+	if (dump.valid == 0) {
+		printf("%s: firmware error log is empty\n",
+		    __func__);
+		return;
+	}
+	printf("firmware error log:\n");
+	printf("  error type      = \"%s\" (0x%08X)\n",
+	    (dump.id < nitems(iwn_fw_errmsg)) ?
+		iwn_fw_errmsg[dump.id] : "UNKNOWN",
+	    dump.id);
+	printf("  program counter = 0x%08X\n", dump.pc);
+	printf("  source line     = 0x%08X\n", dump.src_line);
+	printf("  error data      = 0x%08X%08X\n",
+	    dump.error_data[0], dump.error_data[1]);
+	printf("  branch link     = 0x%08X%08X\n",
+	    dump.branch_link[0], dump.branch_link[1]);
+	printf("  interrupt link  = 0x%08X%08X\n",
+	    dump.interrupt_link[0], dump.interrupt_link[1]);
+	printf("  time            = %u\n", dump.time[0]);
+
+	/* Dump driver status (TX and RX rings) while we're here. */
+	printf("driver status:\n");
+	for (i = 0; i < hal->ntxqs; i++) {
+		struct iwn_tx_ring *ring = &sc->txq[i];
+		printf("  tx ring %2d: qid=%-2d cur=%-3d queued=%-3d\n",
+		    i, ring->qid, ring->cur, ring->queued);
+	}
+	printf("  rx ring: cur=%d\n", sc->rxq.cur);
+
 	if (vap != NULL)
 		ieee80211_cancel_scan(vap);
 	ieee80211_runtask(ic, &sc->sc_reinit_task);
@@ -1804,114 +2424,155 @@ void
 iwn_intr(void *arg)
 {
 	struct iwn_softc *sc = arg;
+	struct ifnet *ifp = sc->sc_ifp;
 	uint32_t r1, r2;
 
 	IWN_LOCK(sc);
 
-	/* disable interrupts */
+	/* Disable interrupts. */
 	IWN_WRITE(sc, IWN_MASK, 0);
 
-	r1 = IWN_READ(sc, IWN_INTR);
-	r2 = IWN_READ(sc, IWN_INTR_STATUS);
+	r1 = IWN_READ(sc, IWN_INT);
+	r2 = IWN_READ(sc, IWN_FH_INT);
+
+	DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=%x reg2=%x\n", r1, r2);
 
 	if (r1 == 0 && r2 == 0) {
-		IWN_WRITE(sc, IWN_MASK, IWN_INTR_MASK);
-		goto done;	/* not for us */
+		if (ifp->if_drv_flags & IFF_DRV_OACTIVE)
+			IWN_WRITE(sc, IWN_MASK, IWN_INT_MASK);
+		goto done;	/* Interrupt not for us. */
 	}
+	if (r1 == 0xffffffff || (r1 & 0xfffffff0) == 0xa5a5a5a0)
+		goto done;	/* Hardware gone! */
 
-	if (r1 == 0xffffffff)
-		goto done;	/* hardware gone */
-
-	/* ack interrupts */
-	IWN_WRITE(sc, IWN_INTR, r1);
-	IWN_WRITE(sc, IWN_INTR_STATUS, r2);
+	/* Acknowledge interrupts. */
+	IWN_WRITE(sc, IWN_INT, r1);
+	IWN_WRITE(sc, IWN_FH_INT, r2);
 
 	DPRINTF(sc, IWN_DEBUG_INTR, "interrupt reg1=%x reg2=%x\n", r1, r2);
 
-	if (r1 & IWN_RF_TOGGLED)
+	if (r1 & IWN_INT_RF_TOGGLED) {
 		iwn_rftoggle_intr(sc);
-	if (r1 & IWN_CT_REACHED)
-		device_printf(sc->sc_dev, "critical temperature reached!\n");
-	if (r1 & (IWN_SW_ERROR | IWN_HW_ERROR)) {
-		iwn_error_intr(sc, r1, r2);
+	}
+	if (r1 & IWN_INT_CT_REACHED) {
+		device_printf(sc->sc_dev, "%s: critical temperature reached!\n",
+		    __func__);
+		/* XXX Reduce TX power? */
+	}
+	if (r1 & (IWN_INT_SW_ERR | IWN_INT_HW_ERR)) {
+		iwn_fatal_intr(sc, r1, r2);
 		goto done;
 	}
-	if ((r1 & (IWN_RX_INTR | IWN_SW_RX_INTR)) || (r2 & IWN_RX_STATUS_INTR))
+	if ((r1 & (IWN_INT_FH_RX | IWN_INT_SW_RX)) ||
+	    (r2 & IWN_FH_INT_RX))
 		iwn_notif_intr(sc);
-	if (r1 & IWN_ALIVE_INTR)
-		wakeup(sc);
 
-	/* re-enable interrupts */
-	IWN_WRITE(sc, IWN_MASK, IWN_INTR_MASK);
+	if ((r1 & IWN_INT_FH_TX) || (r2 & IWN_FH_INT_TX))
+		wakeup(sc);	/* FH DMA transfer completed. */
+
+	if (r1 & IWN_INT_ALIVE)
+		wakeup(sc);	/* Firmware is alive. */
+
+	if (r1 & IWN_INT_WAKEUP)
+		iwn_wakeup_intr(sc);
+
+	/* Re-enable interrupts. */
+	IWN_WRITE(sc, IWN_MASK, IWN_INT_MASK);
+
 done:
 	IWN_UNLOCK(sc);
 }
 
-uint8_t
-iwn_plcp_signal(int rate)
-{
-	switch (rate) {
-	/* CCK rates (returned values are device-dependent) */
-	case 2:		return 10;
-	case 4:		return 20;
-	case 11:	return 55;
-	case 22:	return 110;
-
-	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
-	/* R1-R4, (u)ral is R4-R1 */
-	case 12:	return 0xd;
-	case 18:	return 0xf;
-	case 24:	return 0x5;
-	case 36:	return 0x7;
-	case 48:	return 0x9;
-	case 72:	return 0xb;
-	case 96:	return 0x1;
-	case 108:	return 0x3;
-	case 120:	return 0x3;
-	}
-	/* unknown rate (should not get there) */
-	return 0;
+/*
+ * Update TX scheduler ring when transmitting an 802.11 frame (4965AGN and
+ * 5000 adapters use a slightly different format.)
+ */
+void
+iwn4965_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
+    uint16_t len)
+{
+	uint16_t *w = &sc->sched[qid * IWN4965_SCHED_COUNT + idx];
+
+	*w = htole16(len + 8);
+	if (idx < IWN4965_SCHEDSZ)
+		*(w + IWN_TX_RING_COUNT) = *w;
+}
+
+void
+iwn5000_update_sched(struct iwn_softc *sc, int qid, int idx, uint8_t id,
+    uint16_t len)
+{
+	uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
+
+	*w = htole16(id << 12 | (len + 8));
+	if (idx < IWN_SCHED_WINSZ)
+		*(w + IWN_TX_RING_COUNT) = *w;
+}
+
+void
+iwn5000_reset_sched(struct iwn_softc *sc, int qid, int idx)
+{
+	uint16_t *w = &sc->sched[qid * IWN5000_SCHED_COUNT + idx];
+
+	*w = (*w & htole16(0xf000)) | htole16(1);
+	if (idx < IWN_SCHED_WINSZ)
+		*(w + IWN_TX_RING_COUNT) = *w;
 }
 
-/* determine if a given rate is CCK or OFDM */
-#define IWN_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
+/* Determine if a given rate is CCK or OFDM. */
+#define IWN_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
+
+static const struct iwn_rate *
+iwn_plcp_signal(int rate) {
+	int i;
+
+	for (i = 0; i < IWN_RIDX_MAX + 1; i++) {
+		if (rate == iwn_rates[i].rate)
+			return &iwn_rates[i];
+	}
+
+	return &iwn_rates[0];
+}
 
 int
-iwn_tx_data(struct iwn_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
+iwn_tx_data(struct iwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
     struct iwn_tx_ring *ring)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
+	const struct ieee80211_txparam *tp;
+	const struct iwn_rate *rinfo;
 	struct ieee80211vap *vap = ni->ni_vap;
 	struct ieee80211com *ic = ni->ni_ic;
-	struct ifnet *ifp = sc->sc_ifp;
-	const struct ieee80211_txparam *tp;
+	struct iwn_node *wn = (void *)ni;
 	struct iwn_tx_desc *desc;
 	struct iwn_tx_data *data;
 	struct iwn_tx_cmd *cmd;
 	struct iwn_cmd_data *tx;
 	struct ieee80211_frame *wh;
-	struct ieee80211_key *k;
+	struct ieee80211_key *k = NULL;
+	struct mbuf *mnew;
 	bus_addr_t paddr;
+	bus_dma_segment_t segs[IWN_MAX_SCATTER];
 	uint32_t flags;
-	uint16_t timeout;
-	uint8_t type;
 	u_int hdrlen;
-	struct mbuf *mnew;
-	int rate, error, pad, nsegs, i, ismcast, id;
-	bus_dma_segment_t segs[IWN_MAX_SCATTER];
+	int totlen, error, pad, nsegs, i, rate;
+	uint8_t type, txant;
 
 	IWN_LOCK_ASSERT(sc);
 
-	wh = mtod(m0, struct ieee80211_frame *);
-	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
+	wh = mtod(m, struct ieee80211_frame *);
 	hdrlen = ieee80211_anyhdrsize(wh);
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
+
+	desc = &ring->desc[ring->cur];
+	data = &ring->data[ring->cur];
 
-	/* pick a tx rate */
+	/* Choose a TX rate index. */
 	/* XXX ni_chan */
 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
 	if (type == IEEE80211_FC0_TYPE_MGT)
 		rate = tp->mgmtrate;
-	else if (ismcast)
+	else if (IEEE80211_IS_MULTICAST(wh->i_addr1))
 		rate = tp->mcastrate;
 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
 		rate = tp->ucastrate;
@@ -1919,17 +2580,19 @@ iwn_tx_data(struct iwn_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 		(void) ieee80211_amrr_choose(ni, &IWN_NODE(ni)->amn);
 		rate = ni->ni_txrate;
 	}
+	rinfo = iwn_plcp_signal(rate);
 
+	/* Encrypt the frame if need be. */
 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
-		k = ieee80211_crypto_encap(ni, m0);
+		k = ieee80211_crypto_encap(ni, m);
 		if (k == NULL) {
-			m_freem(m0);
+			m_freem(m);
 			return ENOBUFS;
 		}
-		/* packet header may have moved, reset our local pointer */
-		wh = mtod(m0, struct ieee80211_frame *);
-	} else
-		k = NULL;
+		/* Packet header may have moved, reset our local pointer. */
+		wh = mtod(m, struct ieee80211_frame *);
+	}
+	totlen = m->m_pkthdr.len;
 
 	if (ieee80211_radiotap_active_vap(vap)) {
 		struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
@@ -1939,229 +2602,308 @@ iwn_tx_data(struct iwn_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
 		if (k != NULL)
 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
 
-		ieee80211_radiotap_tx(vap, m0);
+		ieee80211_radiotap_tx(vap, m);
 	}
 
-	flags = IWN_TX_AUTO_SEQ;
-	/* XXX honor ACM */
-	if (!ismcast)
-		flags |= IWN_TX_NEED_ACK;
+	/* Prepare TX firmware command. */
+	cmd = &ring->cmd[ring->cur];
+	cmd->code = IWN_CMD_TX_DATA;
+	cmd->flags = 0;
+	cmd->qid = ring->qid;
+	cmd->idx = ring->cur;
 
-	if (ismcast || type != IEEE80211_FC0_TYPE_DATA)
-		id = IWN_ID_BROADCAST;
-	else
-		id = IWN_ID_BSS;
+	tx = (struct iwn_cmd_data *)cmd->data;
+	/* NB: No need to clear tx, all fields are reinitialized here. */
+	tx->scratch = 0;	/* clear "scratch" area */
 
-	/* check if RTS/CTS or CTS-to-self protection must be used */
-	if (!ismcast) {
-		/* multicast frames are not sent at OFDM rates in 802.11b/g */
-		if (m0->m_pkthdr.len+IEEE80211_CRC_LEN > vap->iv_rtsthreshold) {
-			flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
+	flags = 0;
+	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
+		flags |= IWN_TX_NEED_ACK;
+	if ((wh->i_fc[0] &
+	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
+	    (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_BAR))
+		flags |= IWN_TX_IMM_BA;		/* Cannot happen yet. */
+
+	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
+		flags |= IWN_TX_MORE_FRAG;	/* Cannot happen yet. */
+
+	/* Check if frame must be protected using RTS/CTS or CTS-to-self. */
+	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+		/* NB: Group frames are sent using CCK in 802.11b/g. */
+		if (totlen + IEEE80211_CRC_LEN > vap->iv_rtsthreshold) {
+			flags |= IWN_TX_NEED_RTS;
 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
 		    IWN_RATE_IS_OFDM(rate)) {
 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
-				flags |= IWN_TX_NEED_CTS | IWN_TX_FULL_TXOP;
+				flags |= IWN_TX_NEED_CTS;
 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
-				flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
+				flags |= IWN_TX_NEED_RTS;
 		}
-	}
+		if (flags & (IWN_TX_NEED_RTS | IWN_TX_NEED_CTS)) {
+			if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
+				/* 5000 autoselects RTS/CTS or CTS-to-self. */
+				flags &= ~(IWN_TX_NEED_RTS | IWN_TX_NEED_CTS);
+				flags |= IWN_TX_NEED_PROTECTION;
+			} else
+				flags |= IWN_TX_FULL_TXOP;
+		}
+	} else
+
+	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
+	    type != IEEE80211_FC0_TYPE_DATA)
+		tx->id = hal->broadcast_id;
+	else
+		tx->id = wn->id;
 
 	if (type == IEEE80211_FC0_TYPE_MGT) {
 		uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 
-		/* tell h/w to set timestamp in probe responses */
+		/* Tell HW to set timestamp in probe responses. */
 		if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
 			flags |= IWN_TX_INSERT_TSTAMP;
 
 		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
 		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
-			timeout = htole16(3);
+			tx->timeout = htole16(3);
 		else
-			timeout = htole16(2);
+			tx->timeout = htole16(2);
 	} else
-		timeout = htole16(0);
+		tx->timeout = htole16(0);
 
 	if (hdrlen & 3) {
-		/* first segment's length must be a multiple of 4 */
+		/* First segment's length must be a multiple of 4. */
 		flags |= IWN_TX_NEED_PADDING;
 		pad = 4 - (hdrlen & 3);
 	} else
 		pad = 0;
 
-	desc = &ring->desc[ring->cur];
-	data = &ring->data[ring->cur];
-
-	cmd = &ring->cmd[ring->cur];
-	cmd->code = IWN_CMD_TX_DATA;
-	cmd->flags = 0;
-	cmd->qid = ring->qid;
-	cmd->idx = ring->cur;
-
-	tx = (struct iwn_cmd_data *)cmd->data;
-	/* NB: no need to bzero tx, all fields are reinitialized here */
-	tx->id = id;
-	tx->flags = htole32(flags);
-	tx->len = htole16(m0->m_pkthdr.len);
-	tx->rate = iwn_plcp_signal(rate);
+	tx->len = htole16(totlen);
+	tx->tid = 0;
 	tx->rts_ntries = 60;		/* XXX? */
 	tx->data_ntries = 15;		/* XXX? */
 	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
-	tx->timeout = timeout;
-
-	if (k != NULL) {
-		/* XXX fill in */;
+	tx->plcp = rinfo->plcp;
+	tx->rflags = rinfo->flags;
+	if (tx->id == hal->broadcast_id) {
+		/* XXX Alternate between antenna A and B? */
+		txant = IWN_LSB(sc->txantmsk);
+		tx->rflags |= IWN_RFLAG_ANT(txant);
 	} else
-		tx->security = 0;
-
-	/* XXX alternate between Ant A and Ant B ? */
-	tx->rflags = IWN_RFLAG_ANT_B;
-	if (tx->id == IWN_ID_BROADCAST) {
-		tx->ridx = IWN_MAX_TX_RETRIES - 1;
-		if (!IWN_RATE_IS_OFDM(rate))
-			tx->rflags |= IWN_RFLAG_CCK;
-	} else {
-		tx->ridx = 0;
-		/* tell adapter to ignore rflags */
-		tx->flags |= htole32(IWN_TX_USE_NODE_RATE);
-	}
+		flags |= IWN_TX_LINKQ;
 
-	/* copy and trim IEEE802.11 header */
+	/* Set physical address of "scratch area". */
+	paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
+	tx->loaddr = htole32(IWN_LOADDR(paddr));
+	tx->hiaddr = IWN_HIADDR(paddr);
+
+	/* Copy 802.11 header in TX command. */
 	memcpy((uint8_t *)(tx + 1), wh, hdrlen);
-	m_adj(m0, hdrlen);
 
-	error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m0, segs,
+	/* Trim 802.11 header. */
+	m_adj(m, hdrlen);
+	tx->security = 0;
+	tx->flags = htole32(flags);
+
+	error = bus_dmamap_load_mbuf_sg(ring->desc_dma.tag, data->map, m, segs,
 	    &nsegs, BUS_DMA_NOWAIT);
 	if (error != 0) {
 		if (error == EFBIG) {
 			/* too many fragments, linearize */
-			mnew = m_collapse(m0, M_DONTWAIT, IWN_MAX_SCATTER);
+			mnew = m_collapse(m, M_DONTWAIT, IWN_MAX_SCATTER);
 			if (mnew == NULL) {
 				IWN_UNLOCK(sc);
 				device_printf(sc->sc_dev,
 				    "%s: could not defrag mbuf\n", __func__);
-				m_freem(m0);
+				m_freem(m);
 				return ENOBUFS;
 			}
-			m0 = mnew;
-			error = bus_dmamap_load_mbuf_sg(ring->data_dmat,
-			    data->map, m0, segs, &nsegs, BUS_DMA_NOWAIT);
+			m = mnew;
+			error = bus_dmamap_load_mbuf_sg(ring->desc_dma.tag,
+			    data->map, m, segs, &nsegs, BUS_DMA_NOWAIT);
 		}
 		if (error != 0) {
 			IWN_UNLOCK(sc);
 			device_printf(sc->sc_dev,
 			    "%s: bus_dmamap_load_mbuf_sg failed, error %d\n",
 			     __func__, error);
-			m_freem(m0);
+			m_freem(m);
 			return error;
 		}
 	}
 
-	data->m = m0;
+	data->m = m;
 	data->ni = ni;
 
 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: qid %d idx %d len %d nsegs %d\n",
-	    __func__, ring->qid, ring->cur, m0->m_pkthdr.len, nsegs);
-
-	paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
-	tx->loaddr = htole32(paddr + 4 +
-	    offsetof(struct iwn_cmd_data, ntries));
-	tx->hiaddr = 0;	/* limit to 32-bit physical addresses */
-
-	/* first scatter/gather segment is used by the tx data command */
-	IWN_SET_DESC_NSEGS(desc, 1 + nsegs);
-	IWN_SET_DESC_SEG(desc, 0, paddr, 4 + sizeof (*tx) + hdrlen + pad);
+	    __func__, ring->qid, ring->cur, m->m_pkthdr.len, nsegs);
+
+	/* Fill TX descriptor. */
+	desc->nsegs = 1 + nsegs;
+	/* First DMA segment is used by the TX command. */
+	desc->segs[0].addr = htole32(IWN_LOADDR(paddr));
+	desc->segs[0].len  = htole16(IWN_HIADDR(paddr) |
+	    (4 + sizeof (*tx) + hdrlen + pad) << 4);
+	/* Other DMA segments are for data payload. */
 	for (i = 1; i <= nsegs; i++) {
-		IWN_SET_DESC_SEG(desc, i, segs[i - 1].ds_addr,
-		     segs[i - 1].ds_len);
+		desc->segs[i].addr = htole32(IWN_LOADDR(segs[i - 1].ds_addr));
+		desc->segs[i].len  = htole16(IWN_HIADDR(segs[i - 1].ds_addr) |
+		    segs[i - 1].ds_len << 4);
 	}
-	sc->shared->len[ring->qid][ring->cur] =
-	    htole16(hdrlen + m0->m_pkthdr.len + 8);
 
-	if (ring->cur < IWN_TX_WINDOW)
-		sc->shared->len[ring->qid][ring->cur + IWN_TX_RING_COUNT] =
-			htole16(hdrlen + m0->m_pkthdr.len + 8);
+	bus_dmamap_sync(ring->desc_dma.tag, data->map, BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(ring->desc_dma.tag, ring->cmd_dma.map,
+	    BUS_DMASYNC_PREWRITE);
+	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
+	    BUS_DMASYNC_PREWRITE);
 
-	ring->queued++;
+	/* Update TX scheduler. */
+	hal->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
 
-	/* kick Tx ring */
+	/* Kick TX ring. */
 	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
-	IWN_WRITE(sc, IWN_TX_WIDX, ring->qid << 8 | ring->cur);
+	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
 
-	ifp->if_opackets++;
-	sc->sc_tx_timer = 5;
+	/* Mark TX ring as full if we reach a certain threshold. */
+	if (++ring->queued > IWN_TX_RING_HIMARK)
+		sc->qfullmsk |= 1 << ring->qid;
 
 	return 0;
 }
 
-void
-iwn_start(struct ifnet *ifp)
-{
-	struct iwn_softc *sc = ifp->if_softc;
-
-	IWN_LOCK(sc);
-	iwn_start_locked(ifp);
-	IWN_UNLOCK(sc);
-}
-
-void
-iwn_start_locked(struct ifnet *ifp)
-{
-	struct iwn_softc *sc = ifp->if_softc;
-	struct ieee80211_node *ni;
-	struct iwn_tx_ring *txq;
-	struct mbuf *m;
-	int pri;
-
-	IWN_LOCK_ASSERT(sc);
-
-	for (;;) {
-		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
-		if (m == NULL)
-			break;
-		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
-		pri = M_WME_GETAC(m);
-		txq = &sc->txq[pri];
-		if (txq->queued >= IWN_TX_RING_COUNT - 8) {
-			/* XXX not right */
-			/* ring is nearly full, stop flow */
-			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
-		}
-		if (iwn_tx_data(sc, m, ni, txq) != 0) {
-			ifp->if_oerrors++;
-			ieee80211_free_node(ni);
-			break;
-		}
-	}
-}
-
 static int
-iwn_tx_handoff(struct iwn_softc *sc,
-	struct iwn_tx_ring *ring,
-	struct iwn_tx_cmd *cmd,
-	struct iwn_cmd_data *tx,
-	struct ieee80211_node *ni,
-	struct mbuf *m0, u_int hdrlen, int pad)
+iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m0,
+    struct ieee80211_node *ni, struct iwn_tx_ring *ring,
+    const struct ieee80211_bpf_params *params)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
+	const struct iwn_rate *rinfo;
 	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211vap *vap = ni->ni_vap;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct iwn_tx_cmd *cmd;
+	struct iwn_cmd_data *tx;
+	struct ieee80211_frame *wh;
 	struct iwn_tx_desc *desc;
 	struct iwn_tx_data *data;
-	bus_addr_t paddr;
 	struct mbuf *mnew;
-	int error, nsegs, i;
+	bus_addr_t paddr;
 	bus_dma_segment_t segs[IWN_MAX_SCATTER];
+	uint32_t flags;
+	u_int hdrlen;
+	int totlen, error, pad, nsegs, i, rate;
+	uint8_t type, txant;
 
-	/* copy and trim IEEE802.11 header */
-	memcpy((uint8_t *)(tx + 1), mtod(m0, uint8_t *), hdrlen);
-	m_adj(m0, hdrlen);
+	IWN_LOCK_ASSERT(sc);
+
+	wh = mtod(m0, struct ieee80211_frame *);
+	hdrlen = ieee80211_anyhdrsize(wh);
+	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 
 	desc = &ring->desc[ring->cur];
 	data = &ring->data[ring->cur];
 
-	error = bus_dmamap_load_mbuf_sg(ring->data_dmat, data->map, m0, segs,
+	/* Choose a TX rate index. */
+	rate = params->ibp_rate0;
+	if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
+		/* XXX fall back to mcast/mgmt rate? */
+		m_freem(m0);
+		return EINVAL;
+	}
+	rinfo = iwn_plcp_signal(rate);
+
+	totlen = m0->m_pkthdr.len;
+
+	cmd = &ring->cmd[ring->cur];
+	cmd->code = IWN_CMD_TX_DATA;
+	cmd->flags = 0;
+	cmd->qid = ring->qid;
+	cmd->idx = ring->cur;
+
+	tx = (struct iwn_cmd_data *)cmd->data;
+	/* NB: no need to bzero tx, all fields are reinitialized here */
+	tx->scratch = 0;	/* clear "scratch" area */
+
+	flags = 0;
+	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
+		flags |= IWN_TX_NEED_ACK;
+	if (params->ibp_flags & IEEE80211_BPF_RTS) {
+		if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
+			/* 5000 autoselects RTS/CTS or CTS-to-self. */
+			flags &= ~IWN_TX_NEED_RTS;
+			flags |= IWN_TX_NEED_PROTECTION;
+		} else
+			flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
+	}
+	if (params->ibp_flags & IEEE80211_BPF_CTS) {
+		if (sc->hw_type != IWN_HW_REV_TYPE_4965) {
+			/* 5000 autoselects RTS/CTS or CTS-to-self. */
+			flags &= ~IWN_TX_NEED_CTS;
+			flags |= IWN_TX_NEED_PROTECTION;
+		} else
+			flags |= IWN_TX_NEED_CTS | IWN_TX_FULL_TXOP;
+	}
+	if (type == IEEE80211_FC0_TYPE_MGT) {
+		uint8_t subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+		if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+			flags |= IWN_TX_INSERT_TSTAMP;
+
+		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
+		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
+			tx->timeout = htole16(3);
+		else
+			tx->timeout = htole16(2);
+	} else
+		tx->timeout = htole16(0);
+
+	if (hdrlen & 3) {
+		/* First segment's length must be a multiple of 4. */
+		flags |= IWN_TX_NEED_PADDING;
+		pad = 4 - (hdrlen & 3);
+	} else
+		pad = 0;
+
+	if (ieee80211_radiotap_active_vap(vap)) {
+		struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
+
+		tap->wt_flags = 0;
+		tap->wt_rate = rate;
+
+		ieee80211_radiotap_tx(vap, m0);
+	}
+
+	tx->len = htole16(totlen);
+	tx->tid = 0;
+	tx->id = hal->broadcast_id;
+	tx->rts_ntries = params->ibp_try1;
+	tx->data_ntries = params->ibp_try0;
+	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
+	tx->plcp = rinfo->plcp;
+	tx->rflags = rinfo->flags;
+	if (tx->id == hal->broadcast_id) {
+		txant = IWN_LSB(sc->txantmsk);
+		tx->rflags |= IWN_RFLAG_ANT(txant);
+	} else {
+		flags |= IWN_TX_LINKQ;	/* enable MRR */
+	}
+	/* Set physical address of "scratch area". */
+	paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
+	tx->loaddr = htole32(IWN_LOADDR(paddr));
+	tx->hiaddr = IWN_HIADDR(paddr);
+
+	/* Copy 802.11 header in TX command. */
+	memcpy((uint8_t *)(tx + 1), wh, hdrlen);
+
+	/* Trim 802.11 header. */
+	m_adj(m0, hdrlen);
+	tx->security = 0;
+	tx->flags = htole32(flags);
+
+	error = bus_dmamap_load_mbuf_sg(ring->desc_dma.tag, data->map, m0, segs,
 	    &nsegs, BUS_DMA_NOWAIT);
 	if (error != 0) {
 		if (error == EFBIG) {
-			/* too many fragments, linearize */
+			/* Too many fragments, linearize. */
 			mnew = m_collapse(m0, M_DONTWAIT, IWN_MAX_SCATTER);
 			if (mnew == NULL) {
 				IWN_UNLOCK(sc);
@@ -2171,7 +2913,7 @@ iwn_tx_handoff(struct iwn_softc *sc,
 				return ENOBUFS;
 			}
 			m0 = mnew;
-			error = bus_dmamap_load_mbuf_sg(ring->data_dmat,
+			error = bus_dmamap_load_mbuf_sg(ring->desc_dma.tag,
 			    data->map, m0, segs, &nsegs, BUS_DMA_NOWAIT);
 		}
 		if (error != 0) {
@@ -2190,130 +2932,34 @@ iwn_tx_handoff(struct iwn_softc *sc,
 	DPRINTF(sc, IWN_DEBUG_XMIT, "%s: qid %d idx %d len %d nsegs %d\n",
 	    __func__, ring->qid, ring->cur, m0->m_pkthdr.len, nsegs);
 
-	paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
-	tx->loaddr = htole32(paddr + 4 +
-	    offsetof(struct iwn_cmd_data, ntries));
-	tx->hiaddr = 0;	/* limit to 32-bit physical addresses */
-
-	/* first scatter/gather segment is used by the tx data command */
-	IWN_SET_DESC_NSEGS(desc, 1 + nsegs);
-	IWN_SET_DESC_SEG(desc, 0, paddr, 4 + sizeof (*tx) + hdrlen + pad);
+	/* Fill TX descriptor. */
+	desc->nsegs = 1 + nsegs;
+	/* First DMA segment is used by the TX command. */
+	desc->segs[0].addr = htole32(IWN_LOADDR(paddr));
+	desc->segs[0].len  = htole16(IWN_HIADDR(paddr) |
+	    (4 + sizeof (*tx) + hdrlen + pad) << 4);
+	/* Other DMA segments are for data payload. */
 	for (i = 1; i <= nsegs; i++) {
-		IWN_SET_DESC_SEG(desc, i, segs[i - 1].ds_addr,
-		     segs[i - 1].ds_len);
+		desc->segs[i].addr = htole32(IWN_LOADDR(segs[i - 1].ds_addr));
+		desc->segs[i].len  = htole16(IWN_HIADDR(segs[i - 1].ds_addr) |
+		    segs[i - 1].ds_len << 4);
 	}
-	sc->shared->len[ring->qid][ring->cur] =
-	    htole16(hdrlen + m0->m_pkthdr.len + 8);
 
-	if (ring->cur < IWN_TX_WINDOW)
-		sc->shared->len[ring->qid][ring->cur + IWN_TX_RING_COUNT] =
-			htole16(hdrlen + m0->m_pkthdr.len + 8);
+	/* Update TX scheduler. */
+	hal->update_sched(sc, ring->qid, ring->cur, tx->id, totlen);
 
-	ring->queued++;
-
-	/* kick Tx ring */
+	/* Kick TX ring. */
 	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
-	IWN_WRITE(sc, IWN_TX_WIDX, ring->qid << 8 | ring->cur);
+	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
 
-	ifp->if_opackets++;
-	sc->sc_tx_timer = 5;
+	/* Mark TX ring as full if we reach a certain threshold. */
+	if (++ring->queued > IWN_TX_RING_HIMARK)
+		sc->qfullmsk |= 1 << ring->qid;
 
 	return 0;
 }
 
 static int
-iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m0,
-    struct ieee80211_node *ni, struct iwn_tx_ring *ring,
-    const struct ieee80211_bpf_params *params)
-{
-	struct ieee80211vap *vap = ni->ni_vap;
-	struct ieee80211com *ic = ni->ni_ic;
-	struct iwn_tx_cmd *cmd;
-	struct iwn_cmd_data *tx;
-	struct ieee80211_frame *wh;
-	uint32_t flags;
-	uint8_t type, subtype;
-	u_int hdrlen;
-	int rate, pad;
-
-	IWN_LOCK_ASSERT(sc);
-
-	wh = mtod(m0, struct ieee80211_frame *);
-	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
-	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
-	hdrlen = ieee80211_anyhdrsize(wh);
-
-	flags = IWN_TX_AUTO_SEQ;
-	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
-		flags |= IWN_TX_NEED_ACK;
-	if (params->ibp_flags & IEEE80211_BPF_RTS)
-		flags |= IWN_TX_NEED_RTS | IWN_TX_FULL_TXOP;
-	if (params->ibp_flags & IEEE80211_BPF_CTS)
-		flags |= IWN_TX_NEED_CTS | IWN_TX_FULL_TXOP;
-	if (type == IEEE80211_FC0_TYPE_MGT &&
-	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
-		/* tell h/w to set timestamp in probe responses */
-		flags |= IWN_TX_INSERT_TSTAMP;
-	}
-	if (hdrlen & 3) {
-		/* first segment's length must be a multiple of 4 */
-		flags |= IWN_TX_NEED_PADDING;
-		pad = 4 - (hdrlen & 3);
-	} else
-		pad = 0;
-
-	/* pick a tx rate */
-	rate = params->ibp_rate0;
-	if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
-		/* XXX fall back to mcast/mgmt rate? */
-		m_freem(m0);
-		return EINVAL;
-	}
-
-	if (ieee80211_radiotap_active_vap(vap)) {
-		struct iwn_tx_radiotap_header *tap = &sc->sc_txtap;
-
-		tap->wt_flags = 0;
-		tap->wt_rate = rate;
-
-		ieee80211_radiotap_tx(vap, m0);
-	}
-
-	cmd = &ring->cmd[ring->cur];
-	cmd->code = IWN_CMD_TX_DATA;
-	cmd->flags = 0;
-	cmd->qid = ring->qid;
-	cmd->idx = ring->cur;
-
-	tx = (struct iwn_cmd_data *)cmd->data;
-	/* NB: no need to bzero tx, all fields are reinitialized here */
-	tx->id = IWN_ID_BROADCAST;
-	tx->flags = htole32(flags);
-	tx->len = htole16(m0->m_pkthdr.len);
-	tx->rate = iwn_plcp_signal(rate);
-	tx->rts_ntries = params->ibp_try1;		/* XXX? */
-	tx->data_ntries = params->ibp_try0;
-	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
-	/* XXX use try count? */
-	if (type == IEEE80211_FC0_TYPE_MGT) {
-		if (subtype == IEEE80211_FC0_SUBTYPE_ASSOC_REQ ||
-		    subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
-			tx->timeout = htole16(3);
-		else
-			tx->timeout = htole16(2);
-	} else
-		tx->timeout = htole16(0);
-	tx->security = 0;
-	/* XXX alternate between Ant A and Ant B ? */
-	tx->rflags = IWN_RFLAG_ANT_B;	/* XXX params->ibp_pri >> 2 */
-	tx->ridx = IWN_MAX_TX_RETRIES - 1;
-	if (!IWN_RATE_IS_OFDM(rate))
-		tx->rflags |= IWN_RFLAG_CCK;
-
-	return iwn_tx_handoff(sc, ring, cmd, tx, ni, m0, hdrlen, pad);
-}
-
-static int
 iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	const struct ieee80211_bpf_params *params)
 {
@@ -2321,7 +2967,7 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	struct ifnet *ifp = ic->ic_ifp;
 	struct iwn_softc *sc = ifp->if_softc;
 	struct iwn_tx_ring *txq;
-	int error;
+	int error = 0;
 
 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
 		ieee80211_free_node(ni);
@@ -2334,11 +2980,7 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		txq = &sc->txq[M_WME_GETAC(m)];
 	else
 		txq = &sc->txq[params->ibp_pri & 3];
-	if (txq->queued >= IWN_TX_RING_COUNT - 8) {
-		/* XXX not right */
-		/* ring is nearly full, stop flow */
-		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
-	}
+
 	if (params == NULL) {
 		/*
 		 * Legacy path; interpret frame contents to decide
@@ -2361,6 +3003,47 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	return error;
 }
 
+void
+iwn_start(struct ifnet *ifp)
+{
+	struct iwn_softc *sc = ifp->if_softc;
+
+	IWN_LOCK(sc);
+	iwn_start_locked(ifp);
+	IWN_UNLOCK(sc);
+}
+
+void
+iwn_start_locked(struct ifnet *ifp)
+{
+	struct iwn_softc *sc = ifp->if_softc;
+	struct ieee80211_node *ni;
+	struct iwn_tx_ring *txq;
+	struct mbuf *m;
+	int pri;
+
+	IWN_LOCK_ASSERT(sc);
+
+	for (;;) {
+		if (sc->qfullmsk != 0) {
+			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
+			break;
+		}
+		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
+		if (m == NULL)
+			break;
+		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
+		pri = M_WME_GETAC(m);
+		txq = &sc->txq[pri];
+		if (iwn_tx_data(sc, m, ni, txq) != 0) {
+			ifp->if_oerrors++;
+			ieee80211_free_node(ni);
+			break;
+		}
+		sc->sc_tx_timer = 5;
+	}
+}
+
 static void
 iwn_watchdog(struct iwn_softc *sc)
 {
@@ -2410,272 +3093,28 @@ iwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	return error;
 }
 
-void
-iwn_read_eeprom(struct iwn_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
-{
-	char domain[4];
-	uint16_t val;
-	int i, error;
-
-	if ((error = iwn_eeprom_lock(sc)) != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not lock EEPROM, error %d\n", __func__, error);
-		return;
-	}
-	/* read and print regulatory domain */
-	iwn_read_prom_data(sc, IWN_EEPROM_DOMAIN, domain, 4);
-	device_printf(sc->sc_dev,"Reg Domain: %.4s", domain);
-
-	/* read and print MAC address */
-	iwn_read_prom_data(sc, IWN_EEPROM_MAC, macaddr, 6);
-	printf(", address %6D\n", macaddr, ":");
-
-	/* read the list of authorized channels */
-	iwn_read_eeprom_channels(sc);
-
-	/* read maximum allowed Tx power for 2GHz and 5GHz bands */
-	iwn_read_prom_data(sc, IWN_EEPROM_MAXPOW, &val, 2);
-	sc->maxpwr2GHz = val & 0xff;
-	sc->maxpwr5GHz = val >> 8;
-	/* check that EEPROM values are correct */
-	if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
-		sc->maxpwr5GHz = 38;
-	if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
-		sc->maxpwr2GHz = 38;
-	DPRINTF(sc, IWN_DEBUG_RESET, "maxpwr 2GHz=%d 5GHz=%d\n",
-	    sc->maxpwr2GHz, sc->maxpwr5GHz);
-
-	/* read voltage at which samples were taken */
-	iwn_read_prom_data(sc, IWN_EEPROM_VOLTAGE, &val, 2);
-	sc->eeprom_voltage = (int16_t)le16toh(val);
-	DPRINTF(sc, IWN_DEBUG_RESET, "voltage=%d (in 0.3V)\n",
-	    sc->eeprom_voltage);
-
-	/* read power groups */
-	iwn_read_prom_data(sc, IWN_EEPROM_BANDS, sc->bands, sizeof sc->bands);
-#ifdef IWN_DEBUG
-	if (sc->sc_debug & IWN_DEBUG_ANY) {
-		for (i = 0; i < IWN_NBANDS; i++)
-			iwn_print_power_group(sc, i);
-	}
-#endif
-	iwn_eeprom_unlock(sc);
-}
-
-struct iwn_chan_band {
-	uint32_t	addr;	/* offset in EEPROM */
-	uint32_t	flags;	/* net80211 flags */
-	uint8_t		nchan;
-#define IWN_MAX_CHAN_PER_BAND	14
-	uint8_t		chan[IWN_MAX_CHAN_PER_BAND];
-};
-
-static void
-iwn_read_eeprom_band(struct iwn_softc *sc, const struct iwn_chan_band *band)
-{
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-	struct iwn_eeprom_chan channels[IWN_MAX_CHAN_PER_BAND];
-	struct ieee80211_channel *c;
-	int i, chan, flags;
-
-	iwn_read_prom_data(sc, band->addr, channels,
-	    band->nchan * sizeof (struct iwn_eeprom_chan));
-
-	for (i = 0; i < band->nchan; i++) {
-		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID)) {
-			DPRINTF(sc, IWN_DEBUG_RESET,
-			    "skip chan %d flags 0x%x maxpwr %d\n",
-			    band->chan[i], channels[i].flags,
-			    channels[i].maxpwr);
-			continue;
-		}
-		chan = band->chan[i];
-
-		/* translate EEPROM flags to net80211 */
-		flags = 0;
-		if ((channels[i].flags & IWN_EEPROM_CHAN_ACTIVE) == 0)
-			flags |= IEEE80211_CHAN_PASSIVE;
-		if ((channels[i].flags & IWN_EEPROM_CHAN_IBSS) == 0)
-			flags |= IEEE80211_CHAN_NOADHOC;
-		if (channels[i].flags & IWN_EEPROM_CHAN_RADAR) {
-			flags |= IEEE80211_CHAN_DFS;
-			/* XXX apparently IBSS may still be marked */
-			flags |= IEEE80211_CHAN_NOADHOC;
-		}
-
-		DPRINTF(sc, IWN_DEBUG_RESET,
-		    "add chan %d flags 0x%x maxpwr %d\n",
-		    chan, channels[i].flags, channels[i].maxpwr);
-
-		c = &ic->ic_channels[ic->ic_nchans++];
-		c->ic_ieee = chan;
-		c->ic_freq = ieee80211_ieee2mhz(chan, band->flags);
-		c->ic_maxregpower = channels[i].maxpwr;
-		c->ic_maxpower = 2*c->ic_maxregpower;
-		if (band->flags & IEEE80211_CHAN_2GHZ) {
-			/* G =>'s B is supported */
-			c->ic_flags = IEEE80211_CHAN_B | flags;
-
-			c = &ic->ic_channels[ic->ic_nchans++];
-			c[0] = c[-1];
-			c->ic_flags = IEEE80211_CHAN_G | flags;
-		} else {	/* 5GHz band */
-			c->ic_flags = IEEE80211_CHAN_A | flags;
-		}
-		/* XXX no constraints on using HT20 */
-		/* add HT20, HT40 added separately */
-		c = &ic->ic_channels[ic->ic_nchans++];
-		c[0] = c[-1];
-		c->ic_flags |= IEEE80211_CHAN_HT20;
-		/* XXX NARROW =>'s 1/2 and 1/4 width? */
-	}
-}
-
-static void
-iwn_read_eeprom_ht40(struct iwn_softc *sc, const struct iwn_chan_band *band)
-{
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-	struct iwn_eeprom_chan channels[IWN_MAX_CHAN_PER_BAND];
-	struct ieee80211_channel *c, *cent, *extc;
-	int i;
-
-	iwn_read_prom_data(sc, band->addr, channels,
-	    band->nchan * sizeof (struct iwn_eeprom_chan));
-
-	for (i = 0; i < band->nchan; i++) {
-		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID) ||
-		    !(channels[i].flags & IWN_EEPROM_CHAN_WIDE)) {
-			DPRINTF(sc, IWN_DEBUG_RESET,
-			    "skip chan %d flags 0x%x maxpwr %d\n",
-			    band->chan[i], channels[i].flags,
-			    channels[i].maxpwr);
-			continue;
-		}
-		/*
-		 * Each entry defines an HT40 channel pair; find the
-		 * center channel, then the extension channel above.
-		 */
-		cent = ieee80211_find_channel_byieee(ic, band->chan[i],
-		    band->flags & ~IEEE80211_CHAN_HT);
-		if (cent == NULL) {	/* XXX shouldn't happen */
-			device_printf(sc->sc_dev,
-			    "%s: no entry for channel %d\n",
-			    __func__, band->chan[i]);
-			continue;
-		}
-		extc = ieee80211_find_channel(ic, cent->ic_freq+20,
-		    band->flags & ~IEEE80211_CHAN_HT);
-		if (extc == NULL) {
-			DPRINTF(sc, IWN_DEBUG_RESET,
-			    "skip chan %d, extension channel not found\n",
-			    band->chan[i]);
-			continue;
-		}
-
-		DPRINTF(sc, IWN_DEBUG_RESET,
-		    "add ht40 chan %d flags 0x%x maxpwr %d\n",
-		    band->chan[i], channels[i].flags, channels[i].maxpwr);
-
-		c = &ic->ic_channels[ic->ic_nchans++];
-		c[0] = cent[0];
-		c->ic_extieee = extc->ic_ieee;
-		c->ic_flags &= ~IEEE80211_CHAN_HT;
-		c->ic_flags |= IEEE80211_CHAN_HT40U;
-		c = &ic->ic_channels[ic->ic_nchans++];
-		c[0] = extc[0];
-		c->ic_extieee = cent->ic_ieee;
-		c->ic_flags &= ~IEEE80211_CHAN_HT;
-		c->ic_flags |= IEEE80211_CHAN_HT40D;
-	}
-}
-
-static void
-iwn_read_eeprom_channels(struct iwn_softc *sc)
-{
-#define	N(a)	(sizeof(a)/sizeof(a[0]))
-	static const struct iwn_chan_band iwn_bands[] = {
-	    { IWN_EEPROM_BAND1, IEEE80211_CHAN_G, 14,
-		{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 } },
-	    { IWN_EEPROM_BAND2, IEEE80211_CHAN_A, 13,
-		{ 183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16 } },
-	    { IWN_EEPROM_BAND3, IEEE80211_CHAN_A, 12,
-		{ 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64 } },
-	    { IWN_EEPROM_BAND4, IEEE80211_CHAN_A, 11,
-		{ 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140 } },
-	    { IWN_EEPROM_BAND5, IEEE80211_CHAN_A, 6,
-		{ 145, 149, 153, 157, 161, 165 } },
-	    { IWN_EEPROM_BAND6, IEEE80211_CHAN_G | IEEE80211_CHAN_HT40, 7,
-		{ 1, 2, 3, 4, 5, 6, 7 } },
-	    { IWN_EEPROM_BAND7, IEEE80211_CHAN_A | IEEE80211_CHAN_HT40, 11,
-		{ 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157 } }
-	};
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-	int i;
-
-	/* read the list of authorized channels */
-	for (i = 0; i < N(iwn_bands)-2; i++)
-		iwn_read_eeprom_band(sc, &iwn_bands[i]);
-	for (; i < N(iwn_bands); i++)
-		iwn_read_eeprom_ht40(sc, &iwn_bands[i]);
-	ieee80211_sort_channels(ic->ic_channels, ic->ic_nchans);
-#undef N
-}
-
-#ifdef IWN_DEBUG
-void
-iwn_print_power_group(struct iwn_softc *sc, int i)
-{
-	struct iwn_eeprom_band *band = &sc->bands[i];
-	struct iwn_eeprom_chan_samples *chans = band->chans;
-	int j, c;
-
-	printf("===band %d===\n", i);
-	printf("chan lo=%d, chan hi=%d\n", band->lo, band->hi);
-	printf("chan1 num=%d\n", chans[0].num);
-	for (c = 0; c < IWN_NTXCHAINS; c++) {
-		for (j = 0; j < IWN_NSAMPLES; j++) {
-			printf("chain %d, sample %d: temp=%d gain=%d "
-			    "power=%d pa_det=%d\n", c, j,
-			    chans[0].samples[c][j].temp,
-			    chans[0].samples[c][j].gain,
-			    chans[0].samples[c][j].power,
-			    chans[0].samples[c][j].pa_det);
-		}
-	}
-	printf("chan2 num=%d\n", chans[1].num);
-	for (c = 0; c < IWN_NTXCHAINS; c++) {
-		for (j = 0; j < IWN_NSAMPLES; j++) {
-			printf("chain %d, sample %d: temp=%d gain=%d "
-			    "power=%d pa_det=%d\n", c, j,
-			    chans[1].samples[c][j].temp,
-			    chans[1].samples[c][j].gain,
-			    chans[1].samples[c][j].power,
-			    chans[1].samples[c][j].pa_det);
-		}
-	}
-}
-#endif
-
 /*
  * Send a command to the firmware.
  */
 int
 iwn_cmd(struct iwn_softc *sc, int code, const void *buf, int size, int async)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct iwn_tx_ring *ring = &sc->txq[4];
 	struct iwn_tx_desc *desc;
+	struct iwn_tx_data *data;
 	struct iwn_tx_cmd *cmd;
 	bus_addr_t paddr;
+	int totlen;
 
 	IWN_LOCK_ASSERT(sc);
 
 	KASSERT(size <= sizeof cmd->data, ("Command too big"));
 
 	desc = &ring->desc[ring->cur];
+	data = &ring->data[ring->cur];
 	cmd = &ring->cmd[ring->cur];
+	totlen = 4 + size;
 
 	cmd->code = code;
 	cmd->flags = 0;
@@ -2683,27 +3122,52 @@ iwn_cmd(struct iwn_softc *sc, int code, const void *buf, int size, int async)
 	cmd->idx = ring->cur;
 	memcpy(cmd->data, buf, size);
 
-	paddr = ring->cmd_dma.paddr + ring->cur * sizeof (struct iwn_tx_cmd);
+	paddr = data->cmd_paddr;
 
-	IWN_SET_DESC_NSEGS(desc, 1);
-	IWN_SET_DESC_SEG(desc, 0, paddr, 4 + size);
-	sc->shared->len[ring->qid][ring->cur] = htole16(8);
-	if (ring->cur < IWN_TX_WINDOW) {
-	    sc->shared->len[ring->qid][ring->cur + IWN_TX_RING_COUNT] =
-		htole16(8);
-	}
+	desc->nsegs = 1;
+	desc->segs[0].addr = htole32(IWN_LOADDR(paddr));
+	desc->segs[0].len  = htole16(IWN_HIADDR(paddr) | totlen << 4);
 
 	DPRINTF(sc, IWN_DEBUG_CMD, "%s: %s (0x%x) flags %d qid %d idx %d\n",
 	    __func__, iwn_intr_str(cmd->code), cmd->code,
 	    cmd->flags, cmd->qid, cmd->idx);
 
-	/* kick cmd ring */
+	/* Update TX scheduler. */
+	hal->update_sched(sc, ring->qid, ring->cur, 0, 0);
+
+	/* Kick command ring. */
 	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
-	IWN_WRITE(sc, IWN_TX_WIDX, ring->qid << 8 | ring->cur);
+	IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
 
 	return async ? 0 : msleep(cmd, &sc->sc_mtx, PCATCH, "iwncmd", hz);
 }
 
+int
+iwn4965_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
+{
+	struct iwn4965_node_info hnode;
+	caddr_t src, dst;
+
+	/*
+	 * We use the node structure for 5000 Series internally (it is
+	 * a superset of the one for 4965AGN). We thus copy the common
+	 * fields before sending the command.
+	 */
+	src = (caddr_t)node;
+	dst = (caddr_t)&hnode;
+	memcpy(dst, src, 48);
+	/* Skip TSC, RX MIC and TX MIC fields from ``src''. */
+	memcpy(dst + 48, src + 72, 20);
+	return iwn_cmd(sc, IWN_CMD_ADD_NODE, &hnode, sizeof hnode, async);
+}
+
+int
+iwn5000_add_node(struct iwn_softc *sc, struct iwn_node_info *node, int async)
+{
+	/* Direct mapping. */
+	return iwn_cmd(sc, IWN_CMD_ADD_NODE, node, sizeof (*node), async);
+}
+
 static const uint8_t iwn_ridx_to_plcp[] = {
 	10, 20, 55, 110, /* CCK */
 	0xd, 0xf, 0x5, 0x7, 0x9, 0xb, 0x1, 0x3, 0x3 /* OFDM R1-R4 */
@@ -2728,99 +3192,90 @@ static const uint8_t iwn_prev_ridx[] = {
  */
 int
 iwn_set_link_quality(struct iwn_softc *sc, uint8_t id,
-	const struct ieee80211_channel *c, int async)
+    const struct ieee80211_channel *c, int async)
 {
-	struct iwn_cmd_link_quality lq;
-	int i, ridx;
+	struct iwn_cmd_link_quality linkq;
+	int ridx, i;
+	uint8_t txant;
 
-	memset(&lq, 0, sizeof(lq));
-	lq.id = id;
-	if (IEEE80211_IS_CHAN_HT(c)) {
-		lq.mimo = 1;
-		lq.ssmask = 0x1;
-	} else
-		lq.ssmask = 0x2;
+	/* Use the first valid TX antenna. */
+	txant = IWN_LSB(sc->txantmsk);
+
+	memset(&linkq, 0, sizeof linkq);
+	linkq.id = id;
+	linkq.antmsk_1stream = txant;
+	linkq.antmsk_2stream = IWN_ANT_A | IWN_ANT_B;
+	linkq.ampdu_max = 64;
+	linkq.ampdu_threshold = 3;
+	linkq.ampdu_limit = htole16(4000);	/* 4ms */
+
+	if (IEEE80211_IS_CHAN_HT(c))
+		linkq.mimo = 1;
 
 	if (id == IWN_ID_BSS)
-		ridx = IWN_RATE_OFDM54;
+		ridx = IWN_RIDX_OFDM54;
 	else if (IEEE80211_IS_CHAN_A(c))
-		ridx = IWN_RATE_OFDM6;
+		ridx = IWN_RIDX_OFDM6;
 	else
-		ridx = IWN_RATE_CCK1;
+		ridx = IWN_RIDX_CCK1;
+
 	for (i = 0; i < IWN_MAX_TX_RETRIES; i++) {
-		/* XXX toggle antenna for retry patterns */
 		if (IEEE80211_IS_CHAN_HT40(c)) {
-			lq.table[i].rate = iwn_mimo_mcs_to_plcp[ridx]
-					 | IWN_RATE_MCS;
-			lq.table[i].rflags = IWN_RFLAG_HT
-					 | IWN_RFLAG_HT40
-					 | IWN_RFLAG_ANT_A;
+			linkq.retry[i].plcp = iwn_mimo_mcs_to_plcp[ridx]
+					 | IWN_RIDX_MCS;
+			linkq.retry[i].rflags = IWN_RFLAG_HT
+					 | IWN_RFLAG_HT40;
 			/* XXX shortGI */
 		} else if (IEEE80211_IS_CHAN_HT(c)) {
-			lq.table[i].rate = iwn_siso_mcs_to_plcp[ridx]
-					 | IWN_RATE_MCS;
-			lq.table[i].rflags = IWN_RFLAG_HT
-					 | IWN_RFLAG_ANT_A;
+			linkq.retry[i].plcp = iwn_siso_mcs_to_plcp[ridx]
+					 | IWN_RIDX_MCS;
+			linkq.retry[i].rflags = IWN_RFLAG_HT;
 			/* XXX shortGI */
 		} else {
-			lq.table[i].rate = iwn_ridx_to_plcp[ridx];
-			if (ridx <= IWN_RATE_CCK11)
-				lq.table[i].rflags = IWN_RFLAG_CCK;
-			lq.table[i].rflags |= IWN_RFLAG_ANT_B;
+			linkq.retry[i].plcp = iwn_ridx_to_plcp[ridx];
+			if (ridx <= IWN_RIDX_CCK11)
+				linkq.retry[i].rflags = IWN_RFLAG_CCK;
 		}
+		linkq.retry[i].rflags |= IWN_RFLAG_ANT(txant);
 		ridx = iwn_prev_ridx[ridx];
 	}
 
-	lq.dsmask = 0x3;
-	lq.ampdu_disable = 3;
-	lq.ampdu_limit = htole16(4000);
 #ifdef IWN_DEBUG
 	if (sc->sc_debug & IWN_DEBUG_STATE) {
 		printf("%s: set link quality for node %d, mimo %d ssmask %d\n",
-		    __func__, id, lq.mimo, lq.ssmask);
+		    __func__, id, linkq.mimo, linkq.antmsk_1stream);
 		printf("%s:", __func__);
 		for (i = 0; i < IWN_MAX_TX_RETRIES; i++)
-			printf(" %d:%x", lq.table[i].rate, lq.table[i].rflags);
+			printf(" %d:%x", linkq.retry[i].plcp,
+			    linkq.retry[i].rflags);
 		printf("\n");
 	}
 #endif
-	return iwn_cmd(sc, IWN_CMD_TX_LINK_QUALITY, &lq, sizeof(lq), async);
+	return iwn_cmd(sc, IWN_CMD_LINK_QUALITY, &linkq, sizeof linkq, async);
 }
 
-#if 0
-
 /*
- * Install a pairwise key into the hardware.
+ * Broadcast node is used to send group-addressed and management frames.
  */
 int
-iwn_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
-    const struct ieee80211_key *k)
+iwn_add_broadcast_node(struct iwn_softc *sc, const struct ieee80211_channel *c,
+    int async)
 {
-	struct iwn_softc *sc = ic->ic_softc;
+	const struct iwn_hal *hal = sc->sc_hal;
+	struct ifnet *ifp = sc->sc_ifp;
 	struct iwn_node_info node;
-
-	if (k->k_flags & IEEE80211_KEY_GROUP)
-		return 0;
+	int error;
 
 	memset(&node, 0, sizeof node);
+	IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
+	node.id = hal->broadcast_id;
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s: adding broadcast node\n", __func__);
+	error = hal->add_node(sc, &node, async);
+	if (error != 0)
+		return error;
 
-	switch (k->k_cipher) {
-	case IEEE80211_CIPHER_CCMP:
-		node.security = htole16(IWN_CIPHER_CCMP);
-		memcpy(node.key, k->k_key, k->k_len);
-		break;
-	default:
-		return 0;
-	}
-
-	node.id = IWN_ID_BSS;
-	IEEE80211_ADDR_COPY(node.macaddr, ni->ni_macaddr);
-	node.control = IWN_NODE_UPDATE;
-	node.flags = IWN_FLAG_SET_KEY;
-
-	return iwn_cmd(sc, IWN_CMD_ADD_NODE, &node, sizeof node, 1);
+	return iwn_set_link_quality(sc, node.id, c, async);
 }
-#endif
 
 int
 iwn_wme_update(struct ieee80211com *ic)
@@ -2855,106 +3310,84 @@ iwn_set_led(struct iwn_softc *sc, uint8_t which, uint8_t off, uint8_t on)
 {
 	struct iwn_cmd_led led;
 
+	/* Clear microcode LED ownership. */
+	IWN_CLRBITS(sc, IWN_LED, IWN_LED_BSM_CTRL);
+
 	led.which = which;
-	led.unit = htole32(100000);	/* on/off in unit of 100ms */
+	led.unit = htole32(10000);	/* on/off in unit of 100ms */
 	led.off = off;
 	led.on = on;
-
-	(void) iwn_cmd(sc, IWN_CMD_SET_LED, &led, sizeof led, 1);
+	(void)iwn_cmd(sc, IWN_CMD_SET_LED, &led, sizeof led, 1);
 }
 
 /*
- * Set the critical temperature at which the firmware will automatically stop
- * the radio transmitter.
+ * Set the critical temperature at which the firmware will notify us.
  */
 int
 iwn_set_critical_temp(struct iwn_softc *sc)
 {
-	struct iwn_ucode_info *uc = &sc->ucode_info;
 	struct iwn_critical_temp crit;
-	uint32_t r1, r2, r3, temp;
 
-	r1 = le32toh(uc->temp[0].chan20MHz);
-	r2 = le32toh(uc->temp[1].chan20MHz);
-	r3 = le32toh(uc->temp[2].chan20MHz);
-	/* inverse function of iwn_get_temperature() */
-	temp = r2 + (IWN_CTOK(110) * (r3 - r1)) / 259;
-
-	IWN_WRITE(sc, IWN_UCODE_CLR, IWN_CTEMP_STOP_RF);
+	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CTEMP_STOP_RF);
 
 	memset(&crit, 0, sizeof crit);
-	crit.tempR = htole32(temp);
-	DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %u\n", temp);
+	crit.tempR = htole32(sc->critical_temp);
+	DPRINTF(sc, IWN_DEBUG_RESET, "setting critical temp to %u\n",
+	    crit.tempR);
 	return iwn_cmd(sc, IWN_CMD_SET_CRITICAL_TEMP, &crit, sizeof crit, 0);
 }
 
-void
-iwn_enable_tsf(struct iwn_softc *sc, struct ieee80211_node *ni)
+int
+iwn_set_timing(struct iwn_softc *sc, struct ieee80211_node *ni)
 {
-	struct iwn_cmd_tsf tsf;
+	struct iwn_cmd_timing cmd;
 	uint64_t val, mod;
 
-	memset(&tsf, 0, sizeof tsf);
-	memcpy(&tsf.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
-	tsf.bintval = htole16(ni->ni_intval);
-	tsf.lintval = htole16(10);
+	memset(&cmd, 0, sizeof cmd);
+	memcpy(&cmd.tstamp, ni->ni_tstamp.data, sizeof (uint64_t));
+	cmd.bintval = htole16(ni->ni_intval);
+	cmd.lintval = htole16(10);
 
-	/* XXX all wrong */
-	/* compute remaining time until next beacon */
+	/* Compute remaining time until next beacon. */
 	val = (uint64_t)ni->ni_intval * 1024;	/* msecs -> usecs */
-	DPRINTF(sc, IWN_DEBUG_ANY, "%s: val = %ju %s\n", __func__,
-	    val, val == 0 ? "correcting" : "");
-	if (val == 0)
-		val = 1;
-	mod = le64toh(tsf.tstamp) % val;
-	tsf.binitval = htole32((uint32_t)(val - mod));
+	mod = le64toh(cmd.tstamp) % val;
+	cmd.binitval = htole32((uint32_t)(val - mod));
 
-	DPRINTF(sc, IWN_DEBUG_RESET, "TSF bintval=%u tstamp=%ju, init=%u\n",
-	    ni->ni_intval, le64toh(tsf.tstamp), (uint32_t)(val - mod));
+	DPRINTF(sc, IWN_DEBUG_RESET, "timing bintval=%u tstamp=%ju, init=%u\n",
+	    ni->ni_intval, le64toh(cmd.tstamp), (uint32_t)(val - mod));
 
-	if (iwn_cmd(sc, IWN_CMD_TSF, &tsf, sizeof tsf, 1) != 0)
-		device_printf(sc->sc_dev,
-		    "%s: could not enable TSF\n", __func__);
+	return iwn_cmd(sc, IWN_CMD_TIMING, &cmd, sizeof cmd, 1);
 }
 
 void
-iwn_power_calibration(struct iwn_softc *sc, int temp)
+iwn4965_power_calibration(struct iwn_softc *sc, int temp)
 {
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
-#if 0
-	KASSERT(ic->ic_state == IEEE80211_S_RUN, ("not running"));
-#endif
+
+	/* Adjust TX power if need be (delta >= 3 degC.) */
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: temperature %d->%d\n",
 	    __func__, sc->temp, temp);
-
-	/* adjust Tx power if need be (delta >= 3°C) */
-	if (abs(temp - sc->temp) < 3)
-		return;
-
-	sc->temp = temp;
-
-	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: set Tx power for channel %d\n",
-	    __func__, ieee80211_chan2ieee(ic, ic->ic_bsschan));
-	if (iwn_set_txpower(sc, ic->ic_bsschan, 1) != 0) {
-		/* just warn, too bad for the automatic calibration... */
-		device_printf(sc->sc_dev,
-		    "%s: could not adjust Tx power\n", __func__);
+	if (abs(temp - sc->temp) >= 3) {
+		/* Record temperature of last calibration. */
+		sc->temp = temp;
+		(void)iwn4965_set_txpower(sc, ic->ic_bsschan, 1);
 	}
 }
 
 /*
- * Set Tx power for a given channel (each rate has its own power settings).
+ * Set TX power for current channel (each rate has its own power settings).
  * This function takes into account the regulatory information from EEPROM,
  * the current temperature and the current voltage.
  */
 int
-iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
+iwn4965_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch,
+    int async)
 {
-/* fixed-point arithmetic division using a n-bit fractional part */
+/* Fixed-point arithmetic division using a n-bit fractional part. */
 #define fdivround(a, b, n)	\
 	((((1 << n) * (a)) / (b) + (1 << n) / 2) / (1 << n))
-/* linear interpolation */
+/* Linear interpolation. */
 #define interpolate(x, x1, y1, x2, y2, n)	\
 	((y1) + fdivround(((int)(x) - (x1)) * ((y2) - (y1)), (x2) - (x1), n))
 
@@ -2962,14 +3395,14 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct iwn_ucode_info *uc = &sc->ucode_info;
-	struct iwn_cmd_txpower cmd;
-	struct iwn_eeprom_chan_samples *chans;
-	const uint8_t *rf_gain, *dsp_gain;
+	struct iwn4965_cmd_txpower cmd;
+	struct iwn4965_eeprom_chan_samples *chans;
 	int32_t vdiff, tdiff;
 	int i, c, grp, maxpwr;
-	u_int chan;
+	const uint8_t *rf_gain, *dsp_gain;
+	uint8_t chan;
 
-	/* get channel number */
+	/* Get channel number. */
 	chan = ieee80211_chan2ieee(ic, ch);
 
 	memset(&cmd, 0, sizeof cmd);
@@ -2978,15 +3411,15 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 
 	if (IEEE80211_IS_CHAN_5GHZ(ch)) {
 		maxpwr   = sc->maxpwr5GHz;
-		rf_gain  = iwn_rf_gain_5ghz;
-		dsp_gain = iwn_dsp_gain_5ghz;
+		rf_gain  = iwn4965_rf_gain_5ghz;
+		dsp_gain = iwn4965_dsp_gain_5ghz;
 	} else {
 		maxpwr   = sc->maxpwr2GHz;
-		rf_gain  = iwn_rf_gain_2ghz;
-		dsp_gain = iwn_dsp_gain_2ghz;
+		rf_gain  = iwn4965_rf_gain_2ghz;
+		dsp_gain = iwn4965_dsp_gain_2ghz;
 	}
 
-	/* compute voltage compensation */
+	/* Compute voltage compensation. */
 	vdiff = ((int32_t)le32toh(uc->volt) - sc->eeprom_voltage) / 7;
 	if (vdiff > 0)
 		vdiff *= 2;
@@ -2996,7 +3429,7 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 	    "%s: voltage compensation=%d (UCODE=%d, EEPROM=%d)\n",
 	    __func__, vdiff, le32toh(uc->volt), sc->eeprom_voltage);
 
-	/* get channel's attenuation group */
+	/* Get channel's attenuation group. */
 	if (chan <= 20)		/* 1-20 */
 		grp = 4;
 	else if (chan <= 43)	/* 34-43 */
@@ -3010,16 +3443,18 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
 	    "%s: chan %d, attenuation group=%d\n", __func__, chan, grp);
 
-	/* get channel's sub-band */
+	/* Get channel's sub-band. */
 	for (i = 0; i < IWN_NBANDS; i++)
 		if (sc->bands[i].lo != 0 &&
 		    sc->bands[i].lo <= chan && chan <= sc->bands[i].hi)
 			break;
+	if (i == IWN_NBANDS)	/* Can't happen in real-life. */
+		return EINVAL;
 	chans = sc->bands[i].chans;
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
 	    "%s: chan %d sub-band=%d\n", __func__, chan, i);
 
-	for (c = 0; c < IWN_NTXCHAINS; c++) {
+	for (c = 0; c < 2; c++) {
 		uint8_t power, gain, temp;
 		int maxchpwr, pwr, ridx, idx;
 
@@ -3036,29 +3471,30 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 		    "%s: Tx chain %d: power=%d gain=%d temp=%d\n",
 		    __func__, c, power, gain, temp);
 
-		/* compute temperature compensation */
+		/* Compute temperature compensation. */
 		tdiff = ((sc->temp - temp) * 2) / tdiv[grp];
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
 		    "%s: temperature compensation=%d (current=%d, EEPROM=%d)\n",
 		    __func__, tdiff, sc->temp, temp);
 
 		for (ridx = 0; ridx <= IWN_RIDX_MAX; ridx++) {
-			maxchpwr = ch->ic_maxpower;
-			if ((ridx / 8) & 1) {
-				/* MIMO: decrease Tx power (-3dB) */
-				maxchpwr -= 6;
-			}
-
-			pwr = maxpwr - 10;
-
-			/* decrease power for highest OFDM rates */
-			if ((ridx % 8) == 5)		/* 48Mbit/s */
-				pwr -= 5;
-			else if ((ridx % 8) == 6)	/* 54Mbit/s */
-				pwr -= 7;
-			else if ((ridx % 8) == 7)	/* 60Mbit/s */
-				pwr -= 10;
-
+			maxchpwr = sc->maxpwr[chan] * 2;
+			if ((ridx / 8) & 1)
+				maxchpwr -= 6;	/* MIMO 2T: -3dB */
+
+			pwr = maxpwr;
+
+			/* Adjust TX power based on rate. */
+			if ((ridx % 8) == 5)
+				pwr -= 15;	/* OFDM48: -7.5dB */
+			else if ((ridx % 8) == 6)
+				pwr -= 17;	/* OFDM54: -8.5dB */
+			else if ((ridx % 8) == 7)
+				pwr -= 20;	/* OFDM60: -10dB */
+			else
+				pwr -= 10;	/* Others: -5dB */
+
+			/* Do not exceed channel's max TX power. */
 			if (pwr > maxchpwr)
 				pwr = maxchpwr;
 
@@ -3071,11 +3507,11 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 			if (ridx == IWN_RIDX_MAX)
 				idx += 5;	/* CCK */
 
-			/* make sure idx stays in a valid range */
+			/* Make sure idx stays in a valid range. */
 			if (idx < 0)
 				idx = 0;
-			else if (idx > IWN_MAX_PWR_INDEX)
-				idx = IWN_MAX_PWR_INDEX;
+			else if (idx > IWN4965_MAX_PWR_INDEX)
+				idx = IWN4965_MAX_PWR_INDEX;
 
 			DPRINTF(sc, IWN_DEBUG_CALIBRATE | IWN_DEBUG_TXPOW,
 			    "%s: Tx chain %d, rate idx %d: power=%d\n",
@@ -3093,40 +3529,80 @@ iwn_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch, int async)
 #undef fdivround
 }
 
+int
+iwn5000_set_txpower(struct iwn_softc *sc, struct ieee80211_channel *ch,
+    int async)
+{
+	struct iwn5000_cmd_txpower cmd;
+
+	/*
+	 * TX power calibration is handled automatically by the firmware
+	 * for 5000 Series.
+	 */
+	memset(&cmd, 0, sizeof cmd);
+	cmd.global_limit = 2 * IWN5000_TXPOWER_MAX_DBM;	/* 16 dBm */
+	cmd.flags = IWN5000_TXPOWER_NO_CLOSED;
+	cmd.srv_limit = IWN5000_TXPOWER_AUTO;
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: setting TX power\n", __func__);
+	return iwn_cmd(sc, IWN_CMD_TXPOWER_DBM, &cmd, sizeof cmd, async);
+}
+
 /*
- * Get the best (maximum) RSSI among the
- * connected antennas and convert to dBm.
+ * Retrieve the maximum RSSI (in dBm) among receivers.
  */
-int8_t
-iwn_get_rssi(struct iwn_softc *sc, const struct iwn_rx_stat *stat)
+int
+iwn4965_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
 {
-	int mask, agc, rssi;
+	struct iwn4965_rx_phystat *phy = (void *)stat->phybuf;
+	uint8_t mask, agc;
+	int rssi;
 
-	mask = (le16toh(stat->antenna) >> 4) & 0x7;
-	agc  = (le16toh(stat->agc) >> 7) & 0x7f;
+	mask = (le16toh(phy->antenna) >> 4) & 0x7;
+	agc  = (le16toh(phy->agc) >> 7) & 0x7f;
 
 	rssi = 0;
 #if 0
-	if (mask & (1 << 0))	/* Ant A */
-		rssi = max(rssi, stat->rssi[0]);
-	if (mask & (1 << 1))	/* Ant B */
-		rssi = max(rssi, stat->rssi[2]);
-	if (mask & (1 << 2))	/* Ant C */
-		rssi = max(rssi, stat->rssi[4]);
+	if (mask & IWN_ANT_A)	/* Ant A */
+		rssi = max(rssi, phy->rssi[0]);
+	if (mask & IWN_ATH_B)	/* Ant B */
+		rssi = max(rssi, phy->rssi[2]);
+	if (mask & IWN_ANT_C)	/* Ant C */
+		rssi = max(rssi, phy->rssi[4]);
 #else
-	rssi = max(rssi, stat->rssi[0]);
-	rssi = max(rssi, stat->rssi[2]);
-	rssi = max(rssi, stat->rssi[4]);
+	rssi = max(rssi, phy->rssi[0]);
+	rssi = max(rssi, phy->rssi[2]);
+	rssi = max(rssi, phy->rssi[4]);
 #endif
+
 	DPRINTF(sc, IWN_DEBUG_RECV, "%s: agc %d mask 0x%x rssi %d %d %d "
 	    "result %d\n", __func__, agc, mask,
-	    stat->rssi[0], stat->rssi[2], stat->rssi[4],
+	    phy->rssi[0], phy->rssi[2], phy->rssi[4],
+	    rssi - agc - IWN_RSSI_TO_DBM);
+	return rssi - agc - IWN_RSSI_TO_DBM;
+}
+
+int
+iwn5000_get_rssi(struct iwn_softc *sc, struct iwn_rx_stat *stat)
+{
+	struct iwn5000_rx_phystat *phy = (void *)stat->phybuf;
+	int rssi;
+	uint8_t agc;
+
+	agc = (le32toh(phy->agc) >> 9) & 0x7f;
+
+	rssi = MAX(le16toh(phy->rssi[0]) & 0xff,
+		   le16toh(phy->rssi[1]) & 0xff);
+	rssi = MAX(le16toh(phy->rssi[2]) & 0xff, rssi);
+
+	DPRINTF(sc, IWN_DEBUG_RECV, "%s: agc %d rssi %d %d %d "
+	    "result %d\n", __func__, agc,
+	    phy->rssi[0], phy->rssi[2], phy->rssi[4],
 	    rssi - agc - IWN_RSSI_TO_DBM);
 	return rssi - agc - IWN_RSSI_TO_DBM;
 }
 
 /*
- * Get the average noise among Rx antennas (in dBm).
+ * Retrieve the average noise (in dBm) among receivers.
  */
 int
 iwn_get_noise(const struct iwn_rx_general_stats *stats)
@@ -3135,21 +3611,20 @@ iwn_get_noise(const struct iwn_rx_general_stats *stats)
 
 	total = nbant = 0;
 	for (i = 0; i < 3; i++) {
-		noise = le32toh(stats->noise[i]) & 0xff;
-		if (noise != 0) {
-			total += noise;
-			nbant++;
-		}
+		if ((noise = le32toh(stats->noise[i]) & 0xff) == 0)
+			continue;
+		total += noise;
+		nbant++;
 	}
-	/* there should be at least one antenna but check anyway */
+	/* There should be at least one antenna but check anyway. */
 	return (nbant == 0) ? -127 : (total / nbant) - 107;
 }
 
 /*
- * Read temperature (in degC) from the on-board thermal sensor.
+ * Compute temperature (in degC) from last received statistics.
  */
 int
-iwn_get_temperature(struct iwn_softc *sc)
+iwn4965_get_temperature(struct iwn_softc *sc)
 {
 	struct iwn_ucode_info *uc = &sc->ucode_info;
 	int32_t r1, r2, r3, r4, temp;
@@ -3159,121 +3634,227 @@ iwn_get_temperature(struct iwn_softc *sc)
 	r3 = le32toh(uc->temp[2].chan20MHz);
 	r4 = le32toh(sc->rawtemp);
 
-	if (r1 == r3)	/* prevents division by 0 (should not happen) */
+	if (r1 == r3)	/* Prevents division by 0 (should not happen.) */
 		return 0;
 
-	/* sign-extend 23-bit R4 value to 32-bit */
+	/* Sign-extend 23-bit R4 value to 32-bit. */
 	r4 = (r4 << 8) >> 8;
-	/* compute temperature */
+	/* Compute temperature in Kelvin. */
 	temp = (259 * (r4 - r2)) / (r3 - r1);
 	temp = (temp * 97) / 100 + 8;
 
 	return IWN_KTOC(temp);
 }
 
+int
+iwn5000_get_temperature(struct iwn_softc *sc)
+{
+	/*
+	 * Temperature is not used by the driver for 5000 Series because
+	 * TX power calibration is handled by firmware.  We export it to
+	 * users through the sensor framework though.
+	 */
+	return le32toh(sc->rawtemp);
+}
+
 /*
  * Initialize sensitivity calibration state machine.
  */
 int
 iwn_init_sensitivity(struct iwn_softc *sc)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct iwn_calib_state *calib = &sc->calib;
-	struct iwn_phy_calib_cmd cmd;
+	uint32_t flags;
 	int error;
 
-	/* reset calibration state */
+	/* Reset calibration state machine. */
 	memset(calib, 0, sizeof (*calib));
 	calib->state = IWN_CALIB_STATE_INIT;
 	calib->cck_state = IWN_CCK_STATE_HIFA;
-	/* initial values taken from the reference driver */
-	calib->corr_ofdm_x1     = 105;
-	calib->corr_ofdm_mrc_x1 = 220;
-	calib->corr_ofdm_x4     =  90;
-	calib->corr_ofdm_mrc_x4 = 170;
-	calib->corr_cck_x4      = 125;
-	calib->corr_cck_mrc_x4  = 200;
-	calib->energy_cck       = 100;
-
-	/* write initial sensitivity values */
+	/* Set initial correlation values. */
+	calib->ofdm_x1     = hal->limits->min_ofdm_x1;
+	calib->ofdm_mrc_x1 = hal->limits->min_ofdm_mrc_x1;
+	calib->ofdm_x4     = 90;
+	calib->ofdm_mrc_x4 = hal->limits->min_ofdm_mrc_x4;
+	calib->cck_x4      = 125;
+	calib->cck_mrc_x4  = hal->limits->min_cck_mrc_x4;
+	calib->energy_cck  = hal->limits->energy_cck;
+
+	/* Write initial sensitivity. */
 	error = iwn_send_sensitivity(sc);
 	if (error != 0)
 		return error;
 
-	memset(&cmd, 0, sizeof cmd);
-	cmd.code = IWN_SET_DIFF_GAIN;
-	/* differential gains initially set to 0 for all 3 antennas */
+	/* Write initial gains. */
+	error = hal->init_gains(sc);
+	if (error != 0)
+		return error;
+
+	/* Request statistics at each beacon interval. */
+	flags = 0;
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: calibrate phy\n", __func__);
-	return iwn_cmd(sc, IWN_PHY_CALIB, &cmd, sizeof cmd, 1);
+	return iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags, sizeof flags, 1);
 }
 
 /*
  * Collect noise and RSSI statistics for the first 20 beacons received
  * after association and use them to determine connected antennas and
- * set differential gains.
+ * to set differential gains.
  */
 void
-iwn_compute_differential_gain(struct iwn_softc *sc,
+iwn_collect_noise(struct iwn_softc *sc,
     const struct iwn_rx_general_stats *stats)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct iwn_calib_state *calib = &sc->calib;
-	struct iwn_phy_calib_cmd cmd;
-	int i, val;
+	uint32_t val;
+	int i;
 
-	/* accumulate RSSI and noise for all 3 antennas */
+	/* Accumulate RSSI and noise for all 3 antennas. */
 	for (i = 0; i < 3; i++) {
 		calib->rssi[i] += le32toh(stats->rssi[i]) & 0xff;
 		calib->noise[i] += le32toh(stats->noise[i]) & 0xff;
 	}
-
-	/* we update differential gain only once after 20 beacons */
+	/* NB: We update differential gains only once after 20 beacons. */
 	if (++calib->nbeacons < 20)
 		return;
 
-	/* determine antenna with highest average RSSI */
-	val = max(calib->rssi[0], calib->rssi[1]);
-	val = max(calib->rssi[2], val);
+	/* Determine highest average RSSI. */
+	val = MAX(calib->rssi[0], calib->rssi[1]);
+	val = MAX(calib->rssi[2], val);
 
-	/* determine which antennas are connected */
+	/* Determine which antennas are connected. */
 	sc->antmsk = 0;
 	for (i = 0; i < 3; i++)
 		if (val - calib->rssi[i] <= 15 * 20)
 			sc->antmsk |= 1 << i;
-	/* if neither Ant A and Ant B are connected.. */
-	if ((sc->antmsk & (1 << 0 | 1 << 1)) == 0)
-		sc->antmsk |= 1 << 1;	/* ..mark Ant B as connected! */
+	/* If none of the TX antennas are connected, keep at least one. */
+	if ((sc->antmsk & sc->txantmsk) == 0)
+		sc->antmsk |= IWN_LSB(sc->txantmsk);
 
-	/* get minimal noise among connected antennas */
-	val = INT_MAX;	/* ok, there's at least one */
+	(void)hal->set_gains(sc);
+	calib->state = IWN_CALIB_STATE_RUN;
+
+#ifdef notyet
+	/* XXX Disable RX chains with no antennas connected. */
+	sc->rxon.rxchain = htole16(IWN_RXCHAIN_SEL(sc->antmsk));
+	(void)iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->rxon, hal->rxonsz, 1);
+#endif
+
+#if 0
+	/* XXX: not yet */
+	/* Enable power-saving mode if requested by user. */
+	if (sc->sc_ic.ic_flags & IEEE80211_F_PMGTON)
+		(void)iwn_set_pslevel(sc, 0, 3, 1);
+#endif
+}
+
+int
+iwn4965_init_gains(struct iwn_softc *sc)
+{
+	struct iwn_phy_calib_gain cmd;
+
+	memset(&cmd, 0, sizeof cmd);
+	cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
+	/* Differential gains initially set to 0 for all 3 antennas. */
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+	    "%s: setting initial differential gains\n", __func__);
+	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
+}
+
+int
+iwn5000_init_gains(struct iwn_softc *sc)
+{
+	struct iwn_phy_calib cmd;
+
+	if (sc->hw_type == IWN_HW_REV_TYPE_6000 ||
+	    sc->hw_type == IWN_HW_REV_TYPE_6050)
+		return 0;
+
+	memset(&cmd, 0, sizeof cmd);
+	cmd.code = IWN5000_PHY_CALIB_RESET_NOISE_GAIN;
+	cmd.ngroups = 1;
+	cmd.isvalid = 1;
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+	    "%s: setting initial differential gains\n", __func__);
+	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
+}
+
+int
+iwn4965_set_gains(struct iwn_softc *sc)
+{
+	struct iwn_calib_state *calib = &sc->calib;
+	struct iwn_phy_calib_gain cmd;
+	int i, delta, noise;
+
+	/* Get minimal noise among connected antennas. */
+	noise = INT_MAX;	/* NB: There's at least one antennaiwn. */
 	for (i = 0; i < 3; i++)
 		if (sc->antmsk & (1 << i))
-			val = min(calib->noise[i], val);
+			noise = MIN(calib->noise[i], noise);
 
 	memset(&cmd, 0, sizeof cmd);
-	cmd.code = IWN_SET_DIFF_GAIN;
-	/* set differential gains for connected antennas */
+	cmd.code = IWN4965_PHY_CALIB_DIFF_GAIN;
+	/* Set differential gains for connected antennas. */
 	for (i = 0; i < 3; i++) {
 		if (sc->antmsk & (1 << i)) {
-			cmd.gain[i] = (calib->noise[i] - val) / 30;
-			/* limit differential gain to 3 */
-			cmd.gain[i] = min(cmd.gain[i], 3);
-			cmd.gain[i] |= IWN_GAIN_SET;
+			/* Compute attenuation (in unit of 1.5dB). */
+			delta = (noise - (int32_t)calib->noise[i]) / 30;
+			/* NB: delta <= 0 */
+			/* Limit to [-4.5dB,0]. */
+			cmd.gain[i] = MIN(abs(delta), 3);
+			if (delta < 0)
+				cmd.gain[i] |= 1 << 2;	/* sign bit */
+		}
+	}
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+	    "setting differential gains Ant A/B/C: %x/%x/%x (%x)\n",
+	    cmd.gain[0], cmd.gain[1], cmd.gain[2], sc->antmsk);
+	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
+}
+
+int
+iwn5000_set_gains(struct iwn_softc *sc)
+{
+	struct iwn_calib_state *calib = &sc->calib;
+	struct iwn_phy_calib_gain cmd;
+	int i, delta;
+
+	if (sc->hw_type == IWN_HW_REV_TYPE_6000 ||
+	    sc->hw_type == IWN_HW_REV_TYPE_6050)
+		return 0;
+
+	memset(&cmd, 0, sizeof cmd);
+	cmd.code = IWN5000_PHY_CALIB_NOISE_GAIN;
+	cmd.ngroups = 1;
+	cmd.isvalid = 1;
+	/* Set differential gains for antennas B and C. */
+	for (i = 1; i < 3; i++) {
+		if (sc->antmsk & (1 << i)) {
+			/* The delta is relative to antenna A. */
+			delta = ((int32_t)calib->noise[0] -
+			    (int32_t)calib->noise[i]) / 30;
+			/* Limit to [-4.5dB,+4.5dB]. */
+			cmd.gain[i - 1] = MIN(abs(delta), 3);
+			if (delta < 0)
+				cmd.gain[i - 1] |= 1 << 2;	/* sign bit */
 		}
 	}
 	DPRINTF(sc, IWN_DEBUG_CALIBRATE,
-	    "%s: set differential gains Ant A/B/C: %x/%x/%x (%x)\n",
-	    __func__,cmd.gain[0], cmd.gain[1], cmd.gain[2], sc->antmsk);
-	if (iwn_cmd(sc, IWN_PHY_CALIB, &cmd, sizeof cmd, 1) == 0)
-		calib->state = IWN_CALIB_STATE_RUN;
+	    "setting differential gains Ant B/C: %x/%x (%x)\n",
+	    cmd.gain[0], cmd.gain[1], sc->antmsk);
+	return iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 1);
 }
 
 /*
- * Tune RF Rx sensitivity based on the number of false alarms detected
+ * Tune RF RX sensitivity based on the number of false alarms detected
  * during the last beacon period.
  */
 void
 iwn_tune_sensitivity(struct iwn_softc *sc, const struct iwn_rx_stats *stats)
 {
-#define inc_clip(val, inc, max)			\
+#define inc(val, inc, max)			\
 	if ((val) < (max)) {			\
 		if ((val) < (max) - (inc))	\
 			(val) += (inc);		\
@@ -3281,7 +3862,7 @@ iwn_tune_sensitivity(struct iwn_softc *sc, const struct iwn_rx_stats *stats)
 			(val) = (max);		\
 		needs_update = 1;		\
 	}
-#define dec_clip(val, dec, min)			\
+#define dec(val, dec, min)			\
 	if ((val) > (min)) {			\
 		if ((val) > (min) + (dec))	\
 			(val) -= (dec);		\
@@ -3290,215 +3871,524 @@ iwn_tune_sensitivity(struct iwn_softc *sc, const struct iwn_rx_stats *stats)
 		needs_update = 1;		\
 	}
 
+	const struct iwn_hal *hal = sc->sc_hal;
+	const struct iwn_sensitivity_limits *limits = hal->limits;
 	struct iwn_calib_state *calib = &sc->calib;
 	uint32_t val, rxena, fa;
 	uint32_t energy[3], energy_min;
-	uint8_t noise[3], noise_ref;
 	int i, needs_update = 0;
+	uint8_t noise[3], noise_ref;
 
-	/* check that we've been enabled long enough */
+	/* Check that we've been enabled long enough. */
 	if ((rxena = le32toh(stats->general.load)) == 0)
 		return;
 
-	/* compute number of false alarms since last call for OFDM */
+	/* Compute number of false alarms since last call for OFDM. */
 	fa  = le32toh(stats->ofdm.bad_plcp) - calib->bad_plcp_ofdm;
 	fa += le32toh(stats->ofdm.fa) - calib->fa_ofdm;
 	fa *= 200 * 1024;	/* 200TU */
 
-	/* save counters values for next call */
+	/* Save counters values for next call. */
 	calib->bad_plcp_ofdm = le32toh(stats->ofdm.bad_plcp);
 	calib->fa_ofdm = le32toh(stats->ofdm.fa);
 
 	if (fa > 50 * rxena) {
-		/* high false alarm count, decrease sensitivity */
+		/* High false alarm count, decrease sensitivity. */
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
 		    "%s: OFDM high false alarm count: %u\n", __func__, fa);
-		inc_clip(calib->corr_ofdm_x1,     1, 140);
-		inc_clip(calib->corr_ofdm_mrc_x1, 1, 270);
-		inc_clip(calib->corr_ofdm_x4,     1, 120);
-		inc_clip(calib->corr_ofdm_mrc_x4, 1, 210);
+		inc(calib->ofdm_x1,     1, limits->max_ofdm_x1);
+		inc(calib->ofdm_mrc_x1, 1, limits->max_ofdm_mrc_x1);
+		inc(calib->ofdm_x4,     1, limits->max_ofdm_x4);
+		inc(calib->ofdm_mrc_x4, 1, limits->max_ofdm_mrc_x4);
 
 	} else if (fa < 5 * rxena) {
-		/* low false alarm count, increase sensitivity */
+		/* Low false alarm count, increase sensitivity. */
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
 		    "%s: OFDM low false alarm count: %u\n", __func__, fa);
-		dec_clip(calib->corr_ofdm_x1,     1, 105);
-		dec_clip(calib->corr_ofdm_mrc_x1, 1, 220);
-		dec_clip(calib->corr_ofdm_x4,     1,  85);
-		dec_clip(calib->corr_ofdm_mrc_x4, 1, 170);
+		dec(calib->ofdm_x1,     1, limits->min_ofdm_x1);
+		dec(calib->ofdm_mrc_x1, 1, limits->min_ofdm_mrc_x1);
+		dec(calib->ofdm_x4,     1, limits->min_ofdm_x4);
+		dec(calib->ofdm_mrc_x4, 1, limits->min_ofdm_mrc_x4);
 	}
 
-	/* compute maximum noise among 3 antennas */
+	/* Compute maximum noise among 3 receivers. */
 	for (i = 0; i < 3; i++)
 		noise[i] = (le32toh(stats->general.noise[i]) >> 8) & 0xff;
-	val = max(noise[0], noise[1]);
-	val = max(noise[2], val);
-	/* insert it into our samples table */
+	val = MAX(noise[0], noise[1]);
+	val = MAX(noise[2], val);
+	/* Insert it into our samples table. */
 	calib->noise_samples[calib->cur_noise_sample] = val;
 	calib->cur_noise_sample = (calib->cur_noise_sample + 1) % 20;
 
-	/* compute maximum noise among last 20 samples */
+	/* Compute maximum noise among last 20 samples. */
 	noise_ref = calib->noise_samples[0];
 	for (i = 1; i < 20; i++)
-		noise_ref = max(noise_ref, calib->noise_samples[i]);
+		noise_ref = MAX(noise_ref, calib->noise_samples[i]);
 
-	/* compute maximum energy among 3 antennas */
+	/* Compute maximum energy among 3 receivers. */
 	for (i = 0; i < 3; i++)
 		energy[i] = le32toh(stats->general.energy[i]);
-	val = min(energy[0], energy[1]);
-	val = min(energy[2], val);
-	/* insert it into our samples table */
+	val = MIN(energy[0], energy[1]);
+	val = MIN(energy[2], val);
+	/* Insert it into our samples table. */
 	calib->energy_samples[calib->cur_energy_sample] = val;
 	calib->cur_energy_sample = (calib->cur_energy_sample + 1) % 10;
 
-	/* compute minimum energy among last 10 samples */
+	/* Compute minimum energy among last 10 samples. */
 	energy_min = calib->energy_samples[0];
 	for (i = 1; i < 10; i++)
-		energy_min = max(energy_min, calib->energy_samples[i]);
+		energy_min = MAX(energy_min, calib->energy_samples[i]);
 	energy_min += 6;
 
-	/* compute number of false alarms since last call for CCK */
+	/* Compute number of false alarms since last call for CCK. */
 	fa  = le32toh(stats->cck.bad_plcp) - calib->bad_plcp_cck;
 	fa += le32toh(stats->cck.fa) - calib->fa_cck;
 	fa *= 200 * 1024;	/* 200TU */
 
-	/* save counters values for next call */
+	/* Save counters values for next call. */
 	calib->bad_plcp_cck = le32toh(stats->cck.bad_plcp);
 	calib->fa_cck = le32toh(stats->cck.fa);
 
 	if (fa > 50 * rxena) {
-		/* high false alarm count, decrease sensitivity */
+		/* High false alarm count, decrease sensitivity. */
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
 		    "%s: CCK high false alarm count: %u\n", __func__, fa);
 		calib->cck_state = IWN_CCK_STATE_HIFA;
 		calib->low_fa = 0;
 
-		if (calib->corr_cck_x4 > 160) {
+		if (calib->cck_x4 > 160) {
 			calib->noise_ref = noise_ref;
 			if (calib->energy_cck > 2)
-				dec_clip(calib->energy_cck, 2, energy_min);
+				dec(calib->energy_cck, 2, energy_min);
 		}
-		if (calib->corr_cck_x4 < 160) {
-			calib->corr_cck_x4 = 161;
+		if (calib->cck_x4 < 160) {
+			calib->cck_x4 = 161;
 			needs_update = 1;
 		} else
-			inc_clip(calib->corr_cck_x4, 3, 200);
+			inc(calib->cck_x4, 3, limits->max_cck_x4);
 
-		inc_clip(calib->corr_cck_mrc_x4, 3, 400);
+		inc(calib->cck_mrc_x4, 3, limits->max_cck_mrc_x4);
 
 	} else if (fa < 5 * rxena) {
-		/* low false alarm count, increase sensitivity */
+		/* Low false alarm count, increase sensitivity. */
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
 		    "%s: CCK low false alarm count: %u\n", __func__, fa);
 		calib->cck_state = IWN_CCK_STATE_LOFA;
 		calib->low_fa++;
 
-		if (calib->cck_state != 0 &&
-		    ((calib->noise_ref - noise_ref) > 2 ||
+		if (calib->cck_state != IWN_CCK_STATE_INIT &&
+		    (((int32_t)calib->noise_ref - (int32_t)noise_ref) > 2 ||
 		     calib->low_fa > 100)) {
-			inc_clip(calib->energy_cck,      2,  97);
-			dec_clip(calib->corr_cck_x4,     3, 125);
-			dec_clip(calib->corr_cck_mrc_x4, 3, 200);
+			inc(calib->energy_cck, 2, limits->min_energy_cck);
+			dec(calib->cck_x4,     3, limits->min_cck_x4);
+			dec(calib->cck_mrc_x4, 3, limits->min_cck_mrc_x4);
 		}
 	} else {
-		/* not worth to increase or decrease sensitivity */
+		/* Not worth to increase or decrease sensitivity. */
 		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
 		    "%s: CCK normal false alarm count: %u\n", __func__, fa);
 		calib->low_fa = 0;
 		calib->noise_ref = noise_ref;
 
 		if (calib->cck_state == IWN_CCK_STATE_HIFA) {
-			/* previous interval had many false alarms */
-			dec_clip(calib->energy_cck, 8, energy_min);
+			/* Previous interval had many false alarms. */
+			dec(calib->energy_cck, 8, energy_min);
 		}
 		calib->cck_state = IWN_CCK_STATE_INIT;
 	}
 
 	if (needs_update)
 		(void)iwn_send_sensitivity(sc);
-#undef dec_clip
-#undef inc_clip
+#undef dec
+#undef inc
 }
 
 int
 iwn_send_sensitivity(struct iwn_softc *sc)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct iwn_calib_state *calib = &sc->calib;
 	struct iwn_sensitivity_cmd cmd;
 
 	memset(&cmd, 0, sizeof cmd);
 	cmd.which = IWN_SENSITIVITY_WORKTBL;
-	/* OFDM modulation */
-	cmd.corr_ofdm_x1     = htole16(calib->corr_ofdm_x1);
-	cmd.corr_ofdm_mrc_x1 = htole16(calib->corr_ofdm_mrc_x1);
-	cmd.corr_ofdm_x4     = htole16(calib->corr_ofdm_x4);
-	cmd.corr_ofdm_mrc_x4 = htole16(calib->corr_ofdm_mrc_x4);
-	cmd.energy_ofdm      = htole16(100);
+	/* OFDM modulation. */
+	cmd.corr_ofdm_x1     = htole16(calib->ofdm_x1);
+	cmd.corr_ofdm_mrc_x1 = htole16(calib->ofdm_mrc_x1);
+	cmd.corr_ofdm_x4     = htole16(calib->ofdm_x4);
+	cmd.corr_ofdm_mrc_x4 = htole16(calib->ofdm_mrc_x4);
+	cmd.energy_ofdm      = htole16(hal->limits->energy_ofdm);
 	cmd.energy_ofdm_th   = htole16(62);
-	/* CCK modulation */
-	cmd.corr_cck_x4      = htole16(calib->corr_cck_x4);
-	cmd.corr_cck_mrc_x4  = htole16(calib->corr_cck_mrc_x4);
+	/* CCK modulation. */
+	cmd.corr_cck_x4      = htole16(calib->cck_x4);
+	cmd.corr_cck_mrc_x4  = htole16(calib->cck_mrc_x4);
 	cmd.energy_cck       = htole16(calib->energy_cck);
-	/* Barker modulation: use default values */
+	/* Barker modulation: use default values. */
 	cmd.corr_barker      = htole16(190);
 	cmd.corr_barker_mrc  = htole16(390);
 
-	DPRINTF(sc, IWN_DEBUG_RESET, 
+	DPRINTF(sc, IWN_DEBUG_RESET,
 	    "%s: set sensitivity %d/%d/%d/%d/%d/%d/%d\n", __func__,
-	    calib->corr_ofdm_x1, calib->corr_ofdm_mrc_x1, calib->corr_ofdm_x4,
-	    calib->corr_ofdm_mrc_x4, calib->corr_cck_x4,
-	    calib->corr_cck_mrc_x4, calib->energy_cck);
-	return iwn_cmd(sc, IWN_SENSITIVITY, &cmd, sizeof cmd, 1);
+	    calib->ofdm_x1, calib->ofdm_mrc_x1, calib->ofdm_x4,
+	    calib->ofdm_mrc_x4, calib->cck_x4,
+	    calib->cck_mrc_x4, calib->energy_cck);
+	return iwn_cmd(sc, IWN_CMD_SET_SENSITIVITY, &cmd, sizeof cmd, 1);
+}
+
+/*
+ * Set STA mode power saving level (between 0 and 5).
+ * Level 0 is CAM (Continuously Aware Mode), 5 is for maximum power saving.
+ */
+int
+iwn_set_pslevel(struct iwn_softc *sc, int dtim, int level, int async)
+{
+	const struct iwn_pmgt *pmgt;
+	struct iwn_pmgt_cmd cmd;
+	uint32_t max, skip_dtim;
+	uint32_t tmp;
+	int i;
+
+	/* Select which PS parameters to use. */
+	if (dtim <= 2)
+		pmgt = &iwn_pmgt[0][level];
+	else if (dtim <= 10)
+		pmgt = &iwn_pmgt[1][level];
+	else
+		pmgt = &iwn_pmgt[2][level];
+
+	memset(&cmd, 0, sizeof cmd);
+	if (level != 0)	/* not CAM */
+		cmd.flags |= htole16(IWN_PS_ALLOW_SLEEP);
+	if (level == 5)
+		cmd.flags |= htole16(IWN_PS_FAST_PD);
+	tmp = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
+	if (!(tmp & 0x1))	/* L0s Entry disabled. */
+		cmd.flags |= htole16(IWN_PS_PCI_PMGT);
+	cmd.rxtimeout = htole32(pmgt->rxtimeout * 1024);
+	cmd.txtimeout = htole32(pmgt->txtimeout * 1024);
+
+	if (dtim == 0) {
+		dtim = 1;
+		skip_dtim = 0;
+	} else
+		skip_dtim = pmgt->skip_dtim;
+	if (skip_dtim != 0) {
+		cmd.flags |= htole16(IWN_PS_SLEEP_OVER_DTIM);
+		max = pmgt->intval[4];
+		if (max == (uint32_t)-1)
+			max = dtim * (skip_dtim + 1);
+		else if (max > dtim)
+			max = (max / dtim) * dtim;
+	} else
+		max = dtim;
+	for (i = 0; i < 5; i++)
+		cmd.intval[i] = htole32(MIN(max, pmgt->intval[i]));
+
+	DPRINTF(sc, IWN_DEBUG_RESET, "setting power saving level to %d\n",
+	    level);
+	return iwn_cmd(sc, IWN_CMD_SET_POWER_MODE, &cmd, sizeof cmd, async);
+}
+
+int
+iwn_config(struct iwn_softc *sc)
+{
+	const struct iwn_hal *hal = sc->sc_hal;
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct iwn_bluetooth bluetooth;
+	int error;
+	uint16_t rxchain;
+
+	/* Set power saving level to CAM during initialization. */
+	if ((error = iwn_set_pslevel(sc, 0, 0, 0)) != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not set power saving level, error %d\n",
+		    __func__, error);
+		return error;
+	}
+
+	/* Configure bluetooth coexistence. */
+	memset(&bluetooth, 0, sizeof bluetooth);
+	bluetooth.flags = 3;
+	bluetooth.lead = 0xaa;
+	bluetooth.kill = 1;
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s: config bluetooth coexistence\n",
+	    __func__);
+	error = iwn_cmd(sc, IWN_CMD_BT_COEX, &bluetooth, sizeof bluetooth, 0);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not configure bluetooth coexistence, error %d\n",
+		    __func__, error);
+		return error;
+	}
+
+	/* Configure adapter. */
+	memset(&sc->rxon, 0, sizeof (struct iwn_rxon));
+	IEEE80211_ADDR_COPY(sc->rxon.myaddr, IF_LLADDR(ifp));
+	IEEE80211_ADDR_COPY(sc->rxon.wlap, IF_LLADDR(ifp));
+	/* Set default channel. */
+	sc->rxon.chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
+	sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
+	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
+		sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
+	switch (ic->ic_opmode) {
+	case IEEE80211_M_STA:
+		sc->rxon.mode = IWN_MODE_STA;
+		sc->rxon.filter = htole32(IWN_FILTER_MULTICAST);
+		break;
+	case IEEE80211_M_IBSS:
+	case IEEE80211_M_AHDEMO:
+		sc->rxon.mode = IWN_MODE_IBSS;
+		break;
+	case IEEE80211_M_HOSTAP:
+		sc->rxon.mode = IWN_MODE_HOSTAP;
+		break;
+	case IEEE80211_M_MONITOR:
+		sc->rxon.mode = IWN_MODE_MONITOR;
+		sc->rxon.filter = htole32(IWN_FILTER_MULTICAST |
+		    IWN_FILTER_CTL | IWN_FILTER_PROMISC);
+		break;
+	default:
+		/* Should not get there. */
+		break;
+	}
+	sc->rxon.cck_mask  = 0x0f;	/* not yet negotiated */
+	sc->rxon.ofdm_mask = 0xff;	/* not yet negotiated */
+	sc->rxon.ht_single_mask = 0xff;
+	sc->rxon.ht_dual_mask = 0xff;
+	rxchain = IWN_RXCHAIN_VALID(IWN_ANT_ABC) | IWN_RXCHAIN_IDLE_COUNT(2) |
+	    IWN_RXCHAIN_MIMO_COUNT(2);
+	sc->rxon.rxchain = htole16(rxchain);
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s: setting configuration\n", __func__);
+	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->rxon, hal->rxonsz, 0);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: configure command failed\n", __func__);
+		return error;
+	}
+	sc->sc_curchan = ic->ic_curchan;
+
+	/* Configuration has changed, set TX power accordingly. */
+	error = hal->set_txpower(sc, ic->ic_curchan, 0);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not set TX power\n", __func__);
+		return error;
+	}
+
+	error = iwn_add_broadcast_node(sc, ic->ic_curchan, 0);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not add broadcast node\n", __func__);
+		return error;
+	}
+
+	error = iwn_set_critical_temp(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not set critical temperature\n", __func__);
+		return error;
+	}
+	return 0;
+}
+
+int
+iwn_scan(struct iwn_softc *sc)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	struct ieee80211com *ic = ifp->if_l2com;
+	struct ieee80211_scan_state *ss = ic->ic_scan;	/*XXX*/
+	struct iwn_scan_hdr *hdr;
+	struct iwn_cmd_data *tx;
+	struct iwn_scan_essid *essid;
+	struct iwn_scan_chan *chan;
+	struct ieee80211_frame *wh;
+	struct ieee80211_rateset *rs;
+	struct ieee80211_channel *c;
+	enum ieee80211_phymode mode;
+	int buflen, error, nrates;
+	uint16_t rxchain;
+	uint8_t *buf, *frm, txant;
+
+	buf = malloc(IWN_SCAN_MAXSZ, M_DEVBUF, M_NOWAIT | M_ZERO);
+	if (buf == NULL) {
+		device_printf(sc->sc_dev,
+		    "%s: could not allocate buffer for scan command\n",
+		    __func__);
+		return ENOMEM;
+	}
+	hdr = (struct iwn_scan_hdr *)buf;
+
+	/*
+	 * Move to the next channel if no frames are received within 10ms
+	 * after sending the probe request.
+	 */
+	hdr->quiet_time = htole16(10);		/* timeout in milliseconds */
+	hdr->quiet_threshold = htole16(1);	/* min # of packets */
+
+	/* Select antennas for scanning. */
+	rxchain = IWN_RXCHAIN_FORCE | IWN_RXCHAIN_VALID(IWN_ANT_ABC) |
+	    IWN_RXCHAIN_MIMO(IWN_ANT_ABC);
+	if (IEEE80211_IS_CHAN_A(ic->ic_curchan) &&
+	    sc->hw_type == IWN_HW_REV_TYPE_4965) {
+		/* Ant A must be avoided in 5GHz because of an HW bug. */
+		rxchain |= IWN_RXCHAIN_SEL(IWN_ANT_B | IWN_ANT_C);
+	} else	/* Use all available RX antennas. */
+		rxchain |= IWN_RXCHAIN_SEL(IWN_ANT_ABC);
+	hdr->rxchain = htole16(rxchain);
+	hdr->filter = htole32(IWN_FILTER_MULTICAST | IWN_FILTER_BEACON);
+
+	tx = (struct iwn_cmd_data *)(hdr + 1);
+	tx->flags = htole32(IWN_TX_AUTO_SEQ);
+	tx->id = sc->sc_hal->broadcast_id;
+	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
+
+	if (IEEE80211_IS_CHAN_A(ic->ic_curchan)) {
+		hdr->crc_threshold = htole16(1);
+		/* Send probe requests at 6Mbps. */
+		tx->plcp = iwn_rates[IWN_RIDX_OFDM6].plcp;
+	} else {
+		hdr->flags = htole32(IWN_RXON_24GHZ | IWN_RXON_AUTO);
+		/* Send probe requests at 1Mbps. */
+		tx->plcp = iwn_rates[IWN_RIDX_CCK1].plcp;
+		tx->rflags = IWN_RFLAG_CCK;
+	}
+	/* Use the first valid TX antenna. */
+	txant = IWN_LSB(sc->txantmsk);
+	tx->rflags |= IWN_RFLAG_ANT(txant);
+
+	essid = (struct iwn_scan_essid *)(tx + 1);
+	if (ss->ss_ssid[0].len != 0) {
+		essid[0].id = IEEE80211_ELEMID_SSID;
+		essid[0].len = ss->ss_ssid[0].len;
+		memcpy(essid[0].data, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
+	}
+	/*
+	 * Build a probe request frame.  Most of the following code is a
+	 * copy & paste of what is done in net80211.
+	 */
+	wh = (struct ieee80211_frame *)(essid + 20);
+	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
+	    IEEE80211_FC0_SUBTYPE_PROBE_REQ;
+	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
+	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
+	IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(ifp));
+	IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
+	*(uint16_t *)&wh->i_dur[0] = 0;	/* filled by HW */
+	*(uint16_t *)&wh->i_seq[0] = 0;	/* filled by HW */
+
+	frm = (uint8_t *)(wh + 1);
+
+	/* Add SSID IE. */
+	*frm++ = IEEE80211_ELEMID_SSID;
+	*frm++ = ss->ss_ssid[0].len;
+	memcpy(frm, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
+	frm += ss->ss_ssid[0].len;
+
+	mode = ieee80211_chan2mode(ic->ic_curchan);
+	rs = &ic->ic_sup_rates[mode];
+
+	/* Add supported rates IE. */
+	*frm++ = IEEE80211_ELEMID_RATES;
+	nrates = rs->rs_nrates;
+	if (nrates > IEEE80211_RATE_SIZE)
+		nrates = IEEE80211_RATE_SIZE;
+	*frm++ = nrates;
+	memcpy(frm, rs->rs_rates, nrates);
+	frm += nrates;
+
+	/* Add supported xrates IE. */
+	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
+		nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
+		*frm++ = IEEE80211_ELEMID_XRATES;
+		*frm++ = (uint8_t)nrates;
+		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
+		frm += nrates;
+	}
+
+	/* Set length of probe request. */
+	tx->len = htole16(frm - (uint8_t *)wh);
+
+	c = ic->ic_curchan;
+	chan = (struct iwn_scan_chan *)frm;
+	chan->chan = ieee80211_chan2ieee(ic, c);
+	chan->flags = 0;
+	if (!(c->ic_flags & IEEE80211_CHAN_PASSIVE))
+		chan->flags |= htole32(IWN_CHAN_ACTIVE);
+	if (ss->ss_nssid > 0)
+		chan->flags |= htole32(IWN_CHAN_NPBREQS(1));
+	chan->dsp_gain = 0x6e;
+	if (IEEE80211_IS_CHAN_5GHZ(c)) {
+		chan->rf_gain = 0x3b;
+		chan->active  = htole16(24);
+		chan->passive = htole16(110);
+	} else {
+		chan->rf_gain = 0x28;
+		chan->active  = htole16(36);
+		chan->passive = htole16(120);
+	}
+	hdr->nchan++;
+	chan++;
+
+	DPRINTF(sc, IWN_DEBUG_STATE, "%s: chan %u flags 0x%x rf_gain 0x%x "
+	    "dsp_gain 0x%x active 0x%x passive 0x%x\n", __func__,
+	    chan->chan, chan->flags, chan->rf_gain, chan->dsp_gain,
+	    chan->active, chan->passive);
+
+	buflen = (uint8_t *)chan - buf;
+	hdr->len = htole16(buflen);
+
+	DPRINTF(sc, IWN_DEBUG_STATE, "sending scan command nchan=%d\n",
+	    hdr->nchan);
+	error = iwn_cmd(sc, IWN_CMD_SCAN, buf, buflen, 1);
+	free(buf, M_DEVBUF);
+	return error;
 }
 
 int
 iwn_auth(struct iwn_softc *sc, struct ieee80211vap *vap)
 {
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct ieee80211_node *ni = vap->iv_bss;
-	struct iwn_node_info node;
 	int error;
 
 	sc->calib.state = IWN_CALIB_STATE_INIT;
 
-	/* update adapter's configuration */
-	sc->config.associd = 0;
-	IEEE80211_ADDR_COPY(sc->config.bssid, ni->ni_bssid);
-	sc->config.chan = htole16(ieee80211_chan2ieee(ic, ni->ni_chan));
-	sc->config.flags = htole32(IWN_CONFIG_TSF);
+	/* Update adapter's configuration. */
+	IEEE80211_ADDR_COPY(sc->rxon.bssid, ni->ni_bssid);
+	sc->rxon.chan = htole16(ieee80211_chan2ieee(ic, ni->ni_chan));
+	sc->rxon.flags = htole32(IWN_RXON_TSF | IWN_RXON_CTS_TO_SELF);
 	if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
-		sc->config.flags |= htole32(IWN_CONFIG_AUTO | IWN_CONFIG_24GHZ);
+		sc->rxon.flags |= htole32(IWN_RXON_AUTO | IWN_RXON_24GHZ);
+	if (ic->ic_flags & IEEE80211_F_SHSLOT)
+		sc->rxon.flags |= htole32(IWN_RXON_SHSLOT);
+	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
+		sc->rxon.flags |= htole32(IWN_RXON_SHPREAMBLE);
 	if (IEEE80211_IS_CHAN_A(ni->ni_chan)) {
-		sc->config.cck_mask  = 0;
-		sc->config.ofdm_mask = 0x15;
+		sc->rxon.cck_mask  = 0;
+		sc->rxon.ofdm_mask = 0x15;
 	} else if (IEEE80211_IS_CHAN_B(ni->ni_chan)) {
-		sc->config.cck_mask  = 0x03;
-		sc->config.ofdm_mask = 0;
+		sc->rxon.cck_mask  = 0x03;
+		sc->rxon.ofdm_mask = 0;
 	} else {
 		/* XXX assume 802.11b/g */
-		sc->config.cck_mask  = 0x0f;
-		sc->config.ofdm_mask = 0x15;
+		sc->rxon.cck_mask  = 0x0f;
+		sc->rxon.ofdm_mask = 0x15;
 	}
-	if (ic->ic_flags & IEEE80211_F_SHSLOT)
-		sc->config.flags |= htole32(IWN_CONFIG_SHSLOT);
-	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
-		sc->config.flags |= htole32(IWN_CONFIG_SHPREAMBLE);
-	sc->config.filter &= ~htole32(IWN_FILTER_BSS);
-
 	DPRINTF(sc, IWN_DEBUG_STATE,
-	   "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
-	   "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
-	   "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
-	   __func__,
-	   le16toh(sc->config.chan), sc->config.mode, le32toh(sc->config.flags),
-	   sc->config.cck_mask, sc->config.ofdm_mask,
-	   sc->config.ht_single_mask, sc->config.ht_dual_mask,
-	   le16toh(sc->config.rxchain),
-	   sc->config.myaddr, ":", sc->config.wlap, ":", sc->config.bssid, ":",
-	   le16toh(sc->config.associd), le32toh(sc->config.filter));
-	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->config,
-	    sizeof (struct iwn_config), 1);
+	    "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
+	    "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
+	    "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
+	    __func__,
+	    le16toh(sc->rxon.chan), sc->rxon.mode, le32toh(sc->rxon.flags),
+	    sc->rxon.cck_mask, sc->rxon.ofdm_mask,
+	    sc->rxon.ht_single_mask, sc->rxon.ht_dual_mask,
+	    le16toh(sc->rxon.rxchain),
+	    sc->rxon.myaddr, ":", sc->rxon.wlap, ":", sc->rxon.bssid, ":",
+	    le16toh(sc->rxon.associd), le32toh(sc->rxon.filter));
+	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->rxon, hal->rxonsz, 1);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
 		    "%s: could not configure, error %d\n", __func__, error);
@@ -3506,37 +4396,23 @@ iwn_auth(struct iwn_softc *sc, struct ieee80211vap *vap)
 	}
 	sc->sc_curchan = ic->ic_curchan;
 
-	/* configuration has changed, set Tx power accordingly */
-	error = iwn_set_txpower(sc, ni->ni_chan, 1);
-	if (error != 0) {
+	/* Configuration has changed, set TX power accordingly. */
+	if ((error = hal->set_txpower(sc, ni->ni_chan, 1)) != 0) {
 		device_printf(sc->sc_dev,
 		    "%s: could not set Tx power, error %d\n", __func__, error);
 		return error;
 	}
-
 	/*
-	 * Reconfiguring clears the adapter's nodes table so we must
+	 * Reconfiguring RXON clears the firmware's nodes table so we must
 	 * add the broadcast node again.
 	 */
-	memset(&node, 0, sizeof node);
-	IEEE80211_ADDR_COPY(node.macaddr, ifp->if_broadcastaddr);
-	node.id = IWN_ID_BROADCAST;
-	DPRINTF(sc, IWN_DEBUG_STATE, "%s: add broadcast node\n", __func__);
-	error = iwn_cmd(sc, IWN_CMD_ADD_NODE, &node, sizeof node, 1);
+	error = iwn_add_broadcast_node(sc, ic->ic_curchan, 1);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not add broadcast node, error %d\n",
+		    "%s: 1 could not add broadcast node, error %d\n",
 		    __func__, error);
 		return error;
 	}
-	error = iwn_set_link_quality(sc, node.id, ic->ic_curchan, 1);
-	if (error != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not setup MRR for broadcast node, error %d\n",
-		    __func__, error);
-		return error;
-	}
-
 	return 0;
 }
 
@@ -3547,6 +4423,7 @@ int
 iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 {
 #define	MS(v,x)	(((v) & x) >> x##_S)
+	const struct iwn_hal *hal = sc->sc_hal;
 	struct ifnet *ifp = sc->sc_ifp;
 	struct ieee80211com *ic = ifp->if_l2com;
 	struct ieee80211_node *ni = vap->iv_bss;
@@ -3560,50 +4437,53 @@ iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 		iwn_set_led(sc, IWN_LED_LINK, 5, 5);
 		return 0;
 	}
+	error = iwn_set_timing(sc, ni);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not set timing, error %d\n", __func__, error);
+		return error;
+	}
 
-	iwn_enable_tsf(sc, ni);
-
-	/* update adapter's configuration */
-	sc->config.associd = htole16(IEEE80211_AID(ni->ni_associd));
-	/* short preamble/slot time are negotiated when associating */
-	sc->config.flags &= ~htole32(IWN_CONFIG_SHPREAMBLE | IWN_CONFIG_SHSLOT);
+	/* Update adapter's configuration. */
+	sc->rxon.associd = htole16(IEEE80211_AID(ni->ni_associd));
+	/* Short preamble and slot time are negotiated when associating. */
+	sc->rxon.flags &= ~htole32(IWN_RXON_SHPREAMBLE | IWN_RXON_SHSLOT);
 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
-		sc->config.flags |= htole32(IWN_CONFIG_SHSLOT);
+		sc->rxon.flags |= htole32(IWN_RXON_SHSLOT);
 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
-		sc->config.flags |= htole32(IWN_CONFIG_SHPREAMBLE);
+		sc->rxon.flags |= htole32(IWN_RXON_SHPREAMBLE);
 	if (IEEE80211_IS_CHAN_HT(ni->ni_chan)) {
-		sc->config.flags &= ~htole32(IWN_CONFIG_HT);
+		sc->rxon.flags &= ~htole32(IWN_RXON_HT);
 		if (IEEE80211_IS_CHAN_HT40U(ni->ni_chan))
-			sc->config.flags |= htole32(IWN_CONFIG_HT40U);
+			sc->rxon.flags |= htole32(IWN_RXON_HT40U);
 		else if (IEEE80211_IS_CHAN_HT40D(ni->ni_chan))
-			sc->config.flags |= htole32(IWN_CONFIG_HT40D);
+			sc->rxon.flags |= htole32(IWN_RXON_HT40D);
 		else
-			sc->config.flags |= htole32(IWN_CONFIG_HT20);
-		sc->config.rxchain = htole16(
-			  (3 << IWN_RXCHAIN_VALID_S)
-			| (3 << IWN_RXCHAIN_MIMO_CNT_S)
-			| (1 << IWN_RXCHAIN_CNT_S)
+			sc->rxon.flags |= htole32(IWN_RXON_HT20);
+		sc->rxon.rxchain = htole16(
+			  IWN_RXCHAIN_VALID(3)
+			| IWN_RXCHAIN_MIMO_COUNT(3)
+			| IWN_RXCHAIN_IDLE_COUNT(1)
 			| IWN_RXCHAIN_MIMO_FORCE);
 
 		maxrxampdu = MS(ni->ni_htparam, IEEE80211_HTCAP_MAXRXAMPDU);
 		ampdudensity = MS(ni->ni_htparam, IEEE80211_HTCAP_MPDUDENSITY);
 	} else
 		maxrxampdu = ampdudensity = 0;
-	sc->config.filter |= htole32(IWN_FILTER_BSS);
+	sc->rxon.filter |= htole32(IWN_FILTER_BSS);
 
 	DPRINTF(sc, IWN_DEBUG_STATE,
-	   "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
-	   "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
-	   "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
-	   __func__,
-	   le16toh(sc->config.chan), sc->config.mode, le32toh(sc->config.flags),
-	   sc->config.cck_mask, sc->config.ofdm_mask,
-	   sc->config.ht_single_mask, sc->config.ht_dual_mask,
-	   le16toh(sc->config.rxchain),
-	   sc->config.myaddr, ":", sc->config.wlap, ":", sc->config.bssid, ":",
-	   le16toh(sc->config.associd), le32toh(sc->config.filter));
-	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->config,
-	    sizeof (struct iwn_config), 1);
+	    "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
+	    "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
+	    "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
+	    __func__,
+	    le16toh(sc->rxon.chan), sc->rxon.mode, le32toh(sc->rxon.flags),
+	    sc->rxon.cck_mask, sc->rxon.ofdm_mask,
+	    sc->rxon.ht_single_mask, sc->rxon.ht_dual_mask,
+	    le16toh(sc->rxon.rxchain),
+	    sc->rxon.myaddr, ":", sc->rxon.wlap, ":", sc->rxon.bssid, ":",
+	    le16toh(sc->rxon.associd), le32toh(sc->rxon.filter));
+	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->rxon, hal->rxonsz, 1);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
 		    "%s: could not update configuration, error %d\n",
@@ -3612,26 +4492,25 @@ iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 	}
 	sc->sc_curchan = ni->ni_chan;
 
-	/* configuration has changed, set Tx power accordingly */
-	error = iwn_set_txpower(sc, ni->ni_chan, 1);
+	/* Configuration has changed, set TX power accordingly. */
+	error = hal->set_txpower(sc, ni->ni_chan, 1);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
 		    "%s: could not set Tx power, error %d\n", __func__, error);
 		return error;
 	}
 
-	/* add BSS node */
+	/* Add BSS node. */
 	memset(&node, 0, sizeof node);
 	IEEE80211_ADDR_COPY(node.macaddr, ni->ni_macaddr);
 	node.id = IWN_ID_BSS;
-	node.htflags = htole32(
-	    (maxrxampdu << IWN_MAXRXAMPDU_S) |
-	    (ampdudensity << IWN_MPDUDENSITY_S));
+	node.htflags = htole32(IWN_AMDPU_SIZE_FACTOR(maxrxampdu)
+	    | IWN_AMDPU_DENSITY(ampdudensity));
 	DPRINTF(sc, IWN_DEBUG_STATE, "%s: add BSS node, id %d htflags 0x%x\n",
 	    __func__, node.id, le32toh(node.htflags));
-	error = iwn_cmd(sc, IWN_CMD_ADD_NODE, &node, sizeof node, 1);
+	error = hal->add_node(sc, &node, 1);
 	if (error != 0) {
-		device_printf(sc->sc_dev,"could not add BSS node\n");
+		device_printf(sc->sc_dev, "could not add BSS node\n");
 		return error;
 	}
 	error = iwn_set_link_quality(sc, node.id, ni->ni_chan, 1);
@@ -3650,11 +4529,11 @@ iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 		return error;
 	}
 
-	/* start/restart periodic calibration timer */
+	/* Start periodic calibration timer. */
 	sc->calib.state = IWN_CALIB_STATE_ASSOC;
 	iwn_calib_reset(sc);
 
-	/* link LED always on while associated */
+	/* Link LED always on while associated. */
 	iwn_set_led(sc, IWN_LED_LINK, 0, 1);
 
 	return 0;
@@ -3662,582 +4541,901 @@ iwn_run(struct iwn_softc *sc, struct ieee80211vap *vap)
 }
 
 /*
- * Send a scan request to the firmware.  Since this command is huge, we map it
- * into a mbuf instead of using the pre-allocated set of commands.
+ * Query calibration tables from the initialization firmware.  We do this
+ * only once at first boot.  Called from a process context.
  */
 int
-iwn_scan(struct iwn_softc *sc)
+iwn5000_query_calibration(struct iwn_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-	struct ieee80211_scan_state *ss = ic->ic_scan;	/*XXX*/
-	struct iwn_tx_ring *ring = &sc->txq[4];
-	struct iwn_tx_desc *desc;
-	struct iwn_tx_data *data;
-	struct iwn_tx_cmd *cmd;
-	struct iwn_cmd_data *tx;
-	struct iwn_scan_hdr *hdr;
-	struct iwn_scan_essid *essid;
-	struct iwn_scan_chan *chan;
-	struct ieee80211_frame *wh;
-	struct ieee80211_rateset *rs;
-	struct ieee80211_channel *c;
-	enum ieee80211_phymode mode;
-	uint8_t *frm;
-	int pktlen, error, nrates;
-	bus_addr_t physaddr;
+	struct iwn5000_calib_config cmd;
+	int error;
 
-	desc = &ring->desc[ring->cur];
-	data = &ring->data[ring->cur];
+	memset(&cmd, 0, sizeof cmd);
+	cmd.ucode.once.enable = 0xffffffff;
+	cmd.ucode.once.start  = 0xffffffff;
+	cmd.ucode.once.send   = 0xffffffff;
+	cmd.ucode.flags       = 0xffffffff;
+	DPRINTF(sc, IWN_DEBUG_CALIBRATE, "%s: sending calibration query\n",
+	    __func__);
+	error = iwn_cmd(sc, IWN5000_CMD_CALIB_CONFIG, &cmd, sizeof cmd, 0);
+	if (error != 0)
+		return error;
 
-	/* XXX malloc */
-	data->m = m_getcl(M_DONTWAIT, MT_DATA, 0);
-	if (data->m == NULL) {
-		device_printf(sc->sc_dev,
-		    "%s: could not allocate mbuf for scan command\n", __func__);
-		return ENOMEM;
+	/* Wait at most two seconds for calibration to complete. */
+	return msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", 2 * hz);
+}
+
+/*
+ * Send calibration results to the runtime firmware.  These results were
+ * obtained on first boot from the initialization firmware.
+ */
+int
+iwn5000_send_calibration(struct iwn_softc *sc)
+{
+	int idx, error;
+
+	for (idx = 0; idx < 5; idx++) {
+		if (sc->calibcmd[idx].buf == NULL)
+			continue;	/* No results available. */
+		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+		    "send calibration result idx=%d len=%d\n",
+		    idx, sc->calibcmd[idx].len);
+		error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, sc->calibcmd[idx].buf,
+		    sc->calibcmd[idx].len, 0);
+		if (error != 0) {
+			device_printf(sc->sc_dev,
+			    "%s: could not send calibration result, error %d\n",
+			    __func__, error);
+			return error;
+		}
 	}
+	return 0;
+}
 
-	cmd = mtod(data->m, struct iwn_tx_cmd *);
-	cmd->code = IWN_CMD_SCAN;
-	cmd->flags = 0;
-	cmd->qid = ring->qid;
-	cmd->idx = ring->cur;
+/*
+ * This function is called after the runtime firmware notifies us of its
+ * readiness (called in a process context.)
+ */
+int
+iwn4965_post_alive(struct iwn_softc *sc)
+{
+	int error, qid;
 
-	hdr = (struct iwn_scan_hdr *)cmd->data;
-	memset(hdr, 0, sizeof (struct iwn_scan_hdr));
+	if ((error = iwn_nic_lock(sc)) != 0)
+		return error;
 
-	/* XXX use scan state */
-	/*
-	 * Move to the next channel if no packets are received within 5 msecs
-	 * after sending the probe request (this helps to reduce the duration
-	 * of active scans).
-	 */
-	hdr->quiet = htole16(5);	/* timeout in milliseconds */
-	hdr->plcp_threshold = htole16(1);	/* min # of packets */
+	/* Clear TX scheduler's state in SRAM. */
+	sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
+	iwn_mem_set_region_4(sc, sc->sched_base + IWN4965_SCHED_CTX_OFF, 0,
+	    IWN4965_SCHED_CTX_LEN);
 
-	/* select Ant B and Ant C for scanning */
-	hdr->rxchain = htole16(0x3e1 | (7 << IWN_RXCHAIN_VALID_S));
+	/* Set physical address of TX scheduler rings (1KB aligned.) */
+	iwn_prph_write(sc, IWN4965_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
 
-	tx = (struct iwn_cmd_data *)(hdr + 1);
-	memset(tx, 0, sizeof (struct iwn_cmd_data));
-	tx->flags = htole32(IWN_TX_AUTO_SEQ | 0x200);	/* XXX */
-	tx->id = IWN_ID_BROADCAST;
-	tx->lifetime = htole32(IWN_LIFETIME_INFINITE);
-	tx->rflags = IWN_RFLAG_ANT_B;
+	IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
 
-	if (IEEE80211_IS_CHAN_A(ic->ic_curchan)) {
-		hdr->crc_threshold = htole16(1);
-		/* send probe requests at 6Mbps */
-		tx->rate = iwn_ridx_to_plcp[IWN_RATE_OFDM6];
-	} else {
-		hdr->flags = htole32(IWN_CONFIG_24GHZ | IWN_CONFIG_AUTO);
-		/* send probe requests at 1Mbps */
-		tx->rate = iwn_ridx_to_plcp[IWN_RATE_CCK1];
-		tx->rflags |= IWN_RFLAG_CCK;
+	/* Disable chain mode for all our 16 queues. */
+	iwn_prph_write(sc, IWN4965_SCHED_QCHAIN_SEL, 0);
+
+	for (qid = 0; qid < IWN4965_NTXQUEUES; qid++) {
+		iwn_prph_write(sc, IWN4965_SCHED_QUEUE_RDPTR(qid), 0);
+		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
+
+		/* Set scheduler window size. */
+		iwn_mem_write(sc, sc->sched_base +
+		    IWN4965_SCHED_QUEUE_OFFSET(qid), IWN_SCHED_WINSZ);
+		/* Set scheduler frame limit. */
+		iwn_mem_write(sc, sc->sched_base +
+		    IWN4965_SCHED_QUEUE_OFFSET(qid) + 4,
+		    IWN_SCHED_LIMIT << 16);
 	}
 
-	essid = (struct iwn_scan_essid *)(tx + 1);
-	memset(essid, 0, 4 * sizeof (struct iwn_scan_essid));
-	essid[0].id  = IEEE80211_ELEMID_SSID;
-	essid[0].len = ss->ss_ssid[0].len;
-	memcpy(essid[0].data, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
+	/* Enable interrupts for all our 16 queues. */
+	iwn_prph_write(sc, IWN4965_SCHED_INTR_MASK, 0xffff);
+	/* Identify TX FIFO rings (0-7). */
+	iwn_prph_write(sc, IWN4965_SCHED_TXFACT, 0xff);
 
-	/*
-	 * Build a probe request frame.  Most of the following code is a
-	 * copy & paste of what is done in net80211.
-	 */
-	wh = (struct ieee80211_frame *)&essid[4];
-	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
-	    IEEE80211_FC0_SUBTYPE_PROBE_REQ;
-	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
-	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
-	IEEE80211_ADDR_COPY(wh->i_addr2, IF_LLADDR(ifp));
-	IEEE80211_ADDR_COPY(wh->i_addr3, ifp->if_broadcastaddr);
-	*(u_int16_t *)&wh->i_dur[0] = 0;	/* filled by h/w */
-	*(u_int16_t *)&wh->i_seq[0] = 0;	/* filled by h/w */
+	/* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
+	for (qid = 0; qid < 7; qid++) {
+		static uint8_t qid2fifo[] = { 3, 2, 1, 0, 4, 5, 6 };
+		iwn_prph_write(sc, IWN4965_SCHED_QUEUE_STATUS(qid),
+		    IWN4965_TXQ_STATUS_ACTIVE | qid2fifo[qid] << 1);
+	}
+	iwn_nic_unlock(sc);
+	return 0;
+}
 
-	frm = (uint8_t *)(wh + 1);
+/*
+ * This function is called after the initialization or runtime firmware
+ * notifies us of its readiness (called in a process context.)
+ */
+int
+iwn5000_post_alive(struct iwn_softc *sc)
+{
+	struct iwn5000_wimax_coex wimax;
+	int error, qid;
 
-	/* add SSID IE */
-        *frm++ = IEEE80211_ELEMID_SSID;
-        *frm++ = ss->ss_ssid[0].len;
-        memcpy(frm, ss->ss_ssid[0].ssid, ss->ss_ssid[0].len);
-	frm += ss->ss_ssid[0].len;
+	if ((error = iwn_nic_lock(sc)) != 0)
+		return error;
 
-	mode = ieee80211_chan2mode(ic->ic_curchan);
-	rs = &ic->ic_sup_rates[mode];
+	/* Clear TX scheduler's state in SRAM. */
+	sc->sched_base = iwn_prph_read(sc, IWN_SCHED_SRAM_ADDR);
+	iwn_mem_set_region_4(sc, sc->sched_base + IWN5000_SCHED_CTX_OFF, 0,
+	    IWN5000_SCHED_CTX_LEN);
 
-	/* add supported rates IE */
-	*frm++ = IEEE80211_ELEMID_RATES;
-	nrates = rs->rs_nrates;
-	if (nrates > IEEE80211_RATE_SIZE)
-		nrates = IEEE80211_RATE_SIZE;
-	*frm++ = nrates;
-	memcpy(frm, rs->rs_rates, nrates);
-	frm += nrates;
+	/* Set physical address of TX scheduler rings (1KB aligned.) */
+	iwn_prph_write(sc, IWN5000_SCHED_DRAM_ADDR, sc->sched_dma.paddr >> 10);
 
-	/* add supported xrates IE */
-	if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
-		nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
-		*frm++ = IEEE80211_ELEMID_XRATES;
-		*frm++ = (uint8_t)nrates;
-		memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
-		frm += nrates;
-	}
+	IWN_SETBITS(sc, IWN_FH_TX_CHICKEN, IWN_FH_TX_CHICKEN_SCHED_RETRY);
 
-	/* setup length of probe request */
-	tx->len = htole16(frm - (uint8_t *)wh);
+	/* Enable chain mode for all our 20 queues. */
+	iwn_prph_write(sc, IWN5000_SCHED_QCHAIN_SEL, 0xfffff);
+	iwn_prph_write(sc, IWN5000_SCHED_AGGR_SEL, 0);
 
-	c = ic->ic_curchan;
-	chan = (struct iwn_scan_chan *)frm;
-	chan->chan = ieee80211_chan2ieee(ic, c);
-	chan->flags = 0;
-	if ((c->ic_flags & IEEE80211_CHAN_PASSIVE) == 0) {
-		chan->flags |= IWN_CHAN_ACTIVE;
-		if (ss->ss_nssid > 0)
-			chan->flags |= IWN_CHAN_DIRECT;
-	}
-	chan->dsp_gain = 0x6e;
-	if (IEEE80211_IS_CHAN_5GHZ(c)) {
-		chan->rf_gain = 0x3b;
-		chan->active  = htole16(10);
-		chan->passive = htole16(110);
-	} else {
-		chan->rf_gain = 0x28;
-		chan->active  = htole16(20);
-		chan->passive = htole16(120);
-	}
+	for (qid = 0; qid < IWN5000_NTXQUEUES; qid++) {
+		iwn_prph_write(sc, IWN5000_SCHED_QUEUE_RDPTR(qid), 0);
+		IWN_WRITE(sc, IWN_HBUS_TARG_WRPTR, qid << 8 | 0);
 
-	DPRINTF(sc, IWN_DEBUG_STATE, "%s: chan %u flags 0x%x rf_gain 0x%x "
-	    "dsp_gain 0x%x active 0x%x passive 0x%x\n", __func__,
-	    chan->chan, chan->flags, chan->rf_gain, chan->dsp_gain,
-	    chan->active, chan->passive);
-	hdr->nchan++;
-	chan++;
+		iwn_mem_write(sc, sc->sched_base +
+		    IWN5000_SCHED_QUEUE_OFFSET(qid), 0);
+		/* Set scheduler window size and frame limit. */
+		iwn_mem_write(sc, sc->sched_base +
+		    IWN5000_SCHED_QUEUE_OFFSET(qid) + 4,
+		    IWN_SCHED_LIMIT << 16 | IWN_SCHED_WINSZ);
+	}
 
-	frm += sizeof (struct iwn_scan_chan);
+	/* Enable interrupts for all our 20 queues. */
+	iwn_prph_write(sc, IWN5000_SCHED_INTR_MASK, 0xfffff);
+	/* Identify TX FIFO rings (0-7). */
+	iwn_prph_write(sc, IWN5000_SCHED_TXFACT, 0xff);
 
-	hdr->len = htole16(frm - (uint8_t *)hdr);
-	pktlen = frm - (uint8_t *)cmd;
+	/* Mark TX rings (4 EDCA + cmd + 2 HCCA) as active. */
+	for (qid = 0; qid < 7; qid++) {
+		static uint8_t qid2fifo[] = { 3, 2, 1, 0, 7, 5, 6 };
+		iwn_prph_write(sc, IWN5000_SCHED_QUEUE_STATUS(qid),
+		    IWN5000_TXQ_STATUS_ACTIVE | qid2fifo[qid]);
+	}
+	iwn_nic_unlock(sc);
 
-	error = bus_dmamap_load(ring->data_dmat, data->map, cmd, pktlen,
-	    iwn_dma_map_addr, &physaddr, BUS_DMA_NOWAIT);
+	/* Configure WiMAX (IEEE 802.16e) coexistence. */
+	memset(&wimax, 0, sizeof wimax);
+	DPRINTF(sc, IWN_DEBUG_RESET, "%s: Configuring WiMAX coexistence\n",
+	    __func__);
+	error = iwn_cmd(sc, IWN5000_CMD_WIMAX_COEX, &wimax, sizeof wimax, 0);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not map scan command, error %d\n",
+		    "%s: could not configure WiMAX coexistence, error %d\n",
 		    __func__, error);
-		m_freem(data->m);
-		data->m = NULL;
 		return error;
 	}
 
-	IWN_SET_DESC_NSEGS(desc, 1);
-	IWN_SET_DESC_SEG(desc, 0, physaddr, pktlen);
-	sc->shared->len[ring->qid][ring->cur] = htole16(8);
-	if (ring->cur < IWN_TX_WINDOW)
-		sc->shared->len[ring->qid][ring->cur + IWN_TX_RING_COUNT] =
-		    htole16(8);
+	if (sc->hw_type != IWN_HW_REV_TYPE_5150) {
+		struct iwn5000_phy_calib_crystal cmd;
 
-	bus_dmamap_sync(ring->desc_dma.tag, ring->desc_dma.map,
-	    BUS_DMASYNC_PREWRITE);
-	bus_dmamap_sync(ring->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
+		/* Perform crystal calibration. */
+		memset(&cmd, 0, sizeof cmd);
+		cmd.code = IWN5000_PHY_CALIB_CRYSTAL;
+		cmd.ngroups = 1;
+		cmd.isvalid = 1;
+		cmd.cap_pin[0] = le32toh(sc->eeprom_crystal) & 0xff;
+		cmd.cap_pin[1] = (le32toh(sc->eeprom_crystal) >> 16) & 0xff;
+		DPRINTF(sc, IWN_DEBUG_CALIBRATE,
+		    "sending crystal calibration %d, %d\n",
+		    cmd.cap_pin[0], cmd.cap_pin[1]);
+		error = iwn_cmd(sc, IWN_CMD_PHY_CALIB, &cmd, sizeof cmd, 0);
+		if (error != 0) {
+			device_printf(sc->sc_dev,
+			    "%s: crystal calibration failed, error %d\n",
+			    __func__, error);
+			return error;
+		}
+	}
+	if (sc->sc_flags & IWN_FLAG_FIRST_BOOT) {
+		/* Query calibration from the initialization firmware. */
+		if ((error = iwn5000_query_calibration(sc)) != 0) {
+			device_printf(sc->sc_dev,
+			    "%s: could not query calibration, error %d\n",
+			    __func__, error);
+			return error;
+		}
+		/*
+		 * We have the calibration results now so we can skip
+		 * loading the initialization firmware next time.
+		 */
+		sc->sc_flags &= ~IWN_FLAG_FIRST_BOOT;
 
-	/* kick cmd ring */
-	ring->cur = (ring->cur + 1) % IWN_TX_RING_COUNT;
-	IWN_WRITE(sc, IWN_TX_WIDX, ring->qid << 8 | ring->cur);
+		/* Reboot (call ourselves recursively!) */
+		iwn_hw_stop(sc);
+		error = iwn_hw_init(sc);
+	} else {
+		/* Send calibration results to runtime firmware. */
+		error = iwn5000_send_calibration(sc);
+	}
+	return error;
+}
+
+/*
+ * The firmware boot code is small and is intended to be copied directly into
+ * the NIC internal memory (no DMA transfer.)
+ */
+int
+iwn4965_load_bootcode(struct iwn_softc *sc, const uint8_t *ucode, int size)
+{
+	int error, ntries;
+
+	size /= sizeof (uint32_t);
+
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+
+	/* Copy microcode image into NIC memory. */
+	iwn_prph_write_region_4(sc, IWN_BSM_SRAM_BASE,
+	    (const uint32_t *)ucode, size);
+
+	iwn_prph_write(sc, IWN_BSM_WR_MEM_SRC, 0);
+	iwn_prph_write(sc, IWN_BSM_WR_MEM_DST, IWN_FW_TEXT_BASE);
+	iwn_prph_write(sc, IWN_BSM_WR_DWCOUNT, size);
+
+	/* Start boot load now. */
+	iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START);
+
+	/* Wait for transfer to complete. */
+	for (ntries = 0; ntries < 1000; ntries++) {
+		if (!(iwn_prph_read(sc, IWN_BSM_WR_CTRL) &
+		    IWN_BSM_WR_CTRL_START))
+			break;
+		DELAY(10);
+	}
+	if (ntries == 1000) {
+		device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
+		    __func__);
+		iwn_nic_unlock(sc);
+		return ETIMEDOUT;
+	}
 
-	return 0;	/* will be notified async. of failure/success */
+	/* Enable boot after power up. */
+	iwn_prph_write(sc, IWN_BSM_WR_CTRL, IWN_BSM_WR_CTRL_START_EN);
+
+	iwn_nic_unlock(sc);
+	return 0;
 }
 
 int
-iwn_config(struct iwn_softc *sc)
+iwn4965_load_firmware(struct iwn_softc *sc)
 {
-	struct ifnet *ifp = sc->sc_ifp;
-	struct ieee80211com *ic = ifp->if_l2com;
-	struct iwn_power power;
-	struct iwn_bluetooth bluetooth;
-	struct iwn_node_info node;
+	struct iwn_fw_info *fw = &sc->fw;
+	struct iwn_dma_info *dma = &sc->fw_dma;
 	int error;
 
-	/* set power mode */
-	memset(&power, 0, sizeof power);
-	power.flags = htole16(IWN_POWER_CAM | 0x8);
-	DPRINTF(sc, IWN_DEBUG_RESET, "%s: set power mode\n", __func__);
-	error = iwn_cmd(sc, IWN_CMD_SET_POWER_MODE, &power, sizeof power, 0);
+	/* Copy initialization sections into pre-allocated DMA-safe memory. */
+	memcpy(dma->vaddr, fw->init.data, fw->init.datasz);
+	memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
+	    fw->init.text, fw->init.textsz);
+
+	/* Tell adapter where to find initialization sections. */
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
+	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->init.datasz);
+	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
+	    (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
+	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE, fw->init.textsz);
+	iwn_nic_unlock(sc);
+
+	/* Load firmware boot code. */
+	error = iwn4965_load_bootcode(sc, fw->boot.text, fw->boot.textsz);
 	if (error != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not set power mode, error %d\n",
-		    __func__, error);
+		device_printf(sc->sc_dev, "%s: could not load boot firmware\n",
+		    __func__);
 		return error;
 	}
+	/* Now press "execute". */
+	IWN_WRITE(sc, IWN_RESET, 0);
 
-	/* configure bluetooth coexistence */
-	memset(&bluetooth, 0, sizeof bluetooth);
-	bluetooth.flags = 3;
-	bluetooth.lead = 0xaa;
-	bluetooth.kill = 1;
-	DPRINTF(sc, IWN_DEBUG_RESET, "%s: config bluetooth coexistence\n",
-	    __func__);
-	error = iwn_cmd(sc, IWN_CMD_BLUETOOTH, &bluetooth, sizeof bluetooth,
-	    0);
-	if (error != 0) {
+	/* Wait at most one second for first alive notification. */
+	error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
+	if (error) {
 		device_printf(sc->sc_dev,
-		    "%s: could not configure bluetooth coexistence, error %d\n",
+		    "%s: timeout waiting for adapter to initialize, error %d\n",
 		    __func__, error);
 		return error;
 	}
 
-	/* configure adapter */
-	memset(&sc->config, 0, sizeof (struct iwn_config));
-	IEEE80211_ADDR_COPY(sc->config.myaddr, IF_LLADDR(ifp));
-	IEEE80211_ADDR_COPY(sc->config.wlap, IF_LLADDR(ifp));
-	/* set default channel */
-	sc->config.chan = htole16(ieee80211_chan2ieee(ic, ic->ic_curchan));
-	sc->config.flags = htole32(IWN_CONFIG_TSF);
-	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan))
-		sc->config.flags |= htole32(IWN_CONFIG_AUTO | IWN_CONFIG_24GHZ);
-	sc->config.filter = 0;
-	switch (ic->ic_opmode) {
-	case IEEE80211_M_STA:
-		sc->config.mode = IWN_MODE_STA;
-		sc->config.filter |= htole32(IWN_FILTER_MULTICAST);
-		break;
-	case IEEE80211_M_IBSS:
-	case IEEE80211_M_AHDEMO:
-		sc->config.mode = IWN_MODE_IBSS;
-		break;
-	case IEEE80211_M_HOSTAP:
-		sc->config.mode = IWN_MODE_HOSTAP;
-		break;
-	case IEEE80211_M_MONITOR:
-		sc->config.mode = IWN_MODE_MONITOR;
-		sc->config.filter |= htole32(IWN_FILTER_MULTICAST |
-		    IWN_FILTER_CTL | IWN_FILTER_PROMISC);
-		break;
-	default:
-		device_printf(sc->sc_dev, "unknown opmode %d\n", ic->ic_opmode);
-		return EINVAL;
-	}
-	sc->config.cck_mask  = 0x0f;	/* not yet negotiated */
-	sc->config.ofdm_mask = 0xff;	/* not yet negotiated */
-	sc->config.ht_single_mask = 0xff;
-	sc->config.ht_dual_mask = 0xff;
-	sc->config.rxchain = htole16(0x2800 | (7 << IWN_RXCHAIN_VALID_S));
+	/* Retrieve current temperature for initial TX power calibration. */
+	sc->rawtemp = sc->ucode_info.temp[3].chan20MHz;
+	sc->temp = iwn4965_get_temperature(sc);
 
-	DPRINTF(sc, IWN_DEBUG_STATE,
-	   "%s: config chan %d mode %d flags 0x%x cck 0x%x ofdm 0x%x "
-	   "ht_single 0x%x ht_dual 0x%x rxchain 0x%x "
-	   "myaddr %6D wlap %6D bssid %6D associd %d filter 0x%x\n",
-	   __func__,
-	   le16toh(sc->config.chan), sc->config.mode, le32toh(sc->config.flags),
-	   sc->config.cck_mask, sc->config.ofdm_mask,
-	   sc->config.ht_single_mask, sc->config.ht_dual_mask,
-	   le16toh(sc->config.rxchain),
-	   sc->config.myaddr, ":", sc->config.wlap, ":", sc->config.bssid, ":",
-	   le16toh(sc->config.associd), le32toh(sc->config.filter));
-	error = iwn_cmd(sc, IWN_CMD_CONFIGURE, &sc->config,
-	    sizeof (struct iwn_config), 0);
+	/* Copy runtime sections into pre-allocated DMA-safe memory. */
+	memcpy(dma->vaddr, fw->main.data, fw->main.datasz);
+	memcpy(dma->vaddr + IWN4965_FW_DATA_MAXSZ,
+	    fw->main.text, fw->main.textsz);
+
+	/* Tell adapter where to find runtime sections. */
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+
+	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_ADDR, dma->paddr >> 4);
+	iwn_prph_write(sc, IWN_BSM_DRAM_DATA_SIZE, fw->main.datasz);
+	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_ADDR,
+	    (dma->paddr + IWN4965_FW_DATA_MAXSZ) >> 4);
+	iwn_prph_write(sc, IWN_BSM_DRAM_TEXT_SIZE,
+	    IWN_FW_UPDATED | fw->main.textsz);
+	iwn_nic_unlock(sc);
+
+	return 0;
+}
+
+int
+iwn5000_load_firmware_section(struct iwn_softc *sc, uint32_t dst,
+    const uint8_t *section, int size)
+{
+	struct iwn_dma_info *dma = &sc->fw_dma;
+	int error;
+
+	/* Copy firmware section into pre-allocated DMA-safe memory. */
+	memcpy(dma->vaddr, section, size);
+
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+
+	IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
+	    IWN_FH_TX_CONFIG_DMA_PAUSE);
+
+	IWN_WRITE(sc, IWN_FH_SRAM_ADDR(IWN_SRVC_DMACHNL), dst);
+	IWN_WRITE(sc, IWN_FH_TFBD_CTRL0(IWN_SRVC_DMACHNL),
+	    IWN_LOADDR(dma->paddr));
+	IWN_WRITE(sc, IWN_FH_TFBD_CTRL1(IWN_SRVC_DMACHNL),
+	    IWN_HIADDR(dma->paddr) << 28 | size);
+	IWN_WRITE(sc, IWN_FH_TXBUF_STATUS(IWN_SRVC_DMACHNL),
+	    IWN_FH_TXBUF_STATUS_TBNUM(1) |
+	    IWN_FH_TXBUF_STATUS_TBIDX(1) |
+	    IWN_FH_TXBUF_STATUS_TFBD_VALID);
+
+	/* Kick Flow Handler to start DMA transfer. */
+	IWN_WRITE(sc, IWN_FH_TX_CONFIG(IWN_SRVC_DMACHNL),
+	    IWN_FH_TX_CONFIG_DMA_ENA | IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD);
+
+	iwn_nic_unlock(sc);
+
+	/* Wait at most five seconds for FH DMA transfer to complete. */
+	return msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
+}
+
+int
+iwn5000_load_firmware(struct iwn_softc *sc)
+{
+	struct iwn_fw_part *fw;
+	int error;
+
+	/* Load the initialization firmware on first boot only. */
+	fw = (sc->sc_flags & IWN_FLAG_FIRST_BOOT) ?
+	    &sc->fw.init : &sc->fw.main;
+
+	error = iwn5000_load_firmware_section(sc, IWN_FW_TEXT_BASE,
+	    fw->text, fw->textsz);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: configure command failed, error %d\n",
-		    __func__, error);
+		    "%s: could not load firmware %s section, error %d\n",
+		    __func__, ".text", error);
 		return error;
 	}
-	sc->sc_curchan = ic->ic_curchan;
-
-	/* configuration has changed, set Tx power accordingly */
-	error = iwn_set_txpower(sc, ic->ic_curchan, 0);
+	error = iwn5000_load_firmware_section(sc, IWN_FW_DATA_BASE,
+	    fw->data, fw->datasz);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not set Tx power, error %d\n", __func__, error);
+		    "%s: could not load firmware %s section, error %d\n",
+		    __func__, ".data", error);
 		return error;
 	}
 
-	/* add broadcast node */
-	memset(&node, 0, sizeof node);
-	IEEE80211_ADDR_COPY(node.macaddr, ic->ic_ifp->if_broadcastaddr);
-	node.id = IWN_ID_BROADCAST;
-	node.rate = iwn_plcp_signal(2);
-	DPRINTF(sc, IWN_DEBUG_RESET, "%s: add broadcast node\n", __func__);
-	error = iwn_cmd(sc, IWN_CMD_ADD_NODE, &node, sizeof node, 0);
-	if (error != 0) {
+	/* Now press "execute". */
+	IWN_WRITE(sc, IWN_RESET, 0);
+	return 0;
+}
+
+int
+iwn_read_firmware(struct iwn_softc *sc)
+{
+	const struct iwn_hal *hal = sc->sc_hal;
+	const struct iwn_firmware_hdr *hdr;
+	struct iwn_fw_info *fw = &sc->fw;
+	size_t size;
+
+	IWN_UNLOCK(sc);
+
+	/* Read firmware image from filesystem. */
+	sc->fw_fp = firmware_get(sc->fwname);
+	if (sc->fw_fp == NULL) {
 		device_printf(sc->sc_dev,
-		    "%s: could not add broadcast node, error %d\n",
-		    __func__, error);
-		return error;
+		    "%s: could not load firmare image \"%s\"\n", __func__,
+		     sc->fwname);
+		IWN_LOCK(sc);
+		return EINVAL;
 	}
-	error = iwn_set_link_quality(sc, node.id, ic->ic_curchan, 0);
-	if (error != 0) {
+	IWN_LOCK(sc);
+
+	size = sc->fw_fp->datasize;
+	if (size < sizeof (*hdr)) {
 		device_printf(sc->sc_dev,
-		    "%s: could not setup MRR for node %d, error %d\n",
-		    __func__, node.id, error);
-		return error;
+		    "%s: truncated firmware header: %zu bytes\n",
+		    __func__, size);
+		return EINVAL;
 	}
 
-	error = iwn_set_critical_temp(sc);
-	if (error != 0) {
+	/* Extract firmware header information. */
+	hdr = (const struct iwn_firmware_hdr *)sc->fw_fp->data;
+	fw->main.textsz = le32toh(hdr->main_textsz);
+	fw->main.datasz = le32toh(hdr->main_datasz);
+	fw->init.textsz = le32toh(hdr->init_textsz);
+	fw->init.datasz = le32toh(hdr->init_datasz);
+	fw->boot.textsz = le32toh(hdr->boot_textsz);
+	fw->boot.datasz = 0;
+
+	/* Sanity-check firmware header. */
+	if (fw->main.textsz > hal->fw_text_maxsz ||
+	    fw->main.datasz > hal->fw_data_maxsz ||
+	    fw->init.textsz > hal->fw_text_maxsz ||
+	    fw->init.datasz > hal->fw_data_maxsz ||
+	    fw->boot.textsz > IWN_FW_BOOT_TEXT_MAXSZ ||
+	    (fw->boot.textsz & 3) != 0) {
+		device_printf(sc->sc_dev, "%s: invalid firmware header\n",
+		    __func__);
+		return EINVAL;
+	}
+
+	/* Check that all firmware sections fit. */
+	if (size < sizeof (*hdr) + fw->main.textsz + fw->main.datasz +
+	    fw->init.textsz + fw->init.datasz + fw->boot.textsz) {
 		device_printf(sc->sc_dev,
-		    "%s: could not set critical temperature, error %d\n",
-		    __func__, error);
-		return error;
+		    "%s: firmware file too short: %zu bytes\n",
+		    __func__, size);
+		return EINVAL;
 	}
+
+	/* Get pointers to firmware sections. */
+	fw->main.text = (const uint8_t *)(hdr + 1);
+	fw->main.data = fw->main.text + fw->main.textsz;
+	fw->init.text = fw->main.data + fw->main.datasz;
+	fw->init.data = fw->init.text + fw->init.textsz;
+	fw->boot.text = fw->init.data + fw->init.datasz;
+
 	return 0;
 }
 
-/*
- * Do post-alive initialization of the NIC (after firmware upload).
- */
 void
-iwn_post_alive(struct iwn_softc *sc)
+iwn_unload_firmware(struct iwn_softc *sc)
 {
-	uint32_t base;
-	uint16_t offset;
-	int qid;
+	if (sc->fw_fp != NULL) {
+		firmware_put(sc->fw_fp, FIRMWARE_UNLOAD);
+		sc->fw_fp = NULL;
+	}
+}
 
-	iwn_mem_lock(sc);
+int
+iwn_clock_wait(struct iwn_softc *sc)
+{
+	int ntries;
+
+	/* Set "initialization complete" bit. */
+	IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
 
-	/* clear SRAM */
-	base = iwn_mem_read(sc, IWN_SRAM_BASE);
-	for (offset = 0x380; offset < 0x520; offset += 4) {
-		IWN_WRITE(sc, IWN_MEM_WADDR, base + offset);
-		IWN_WRITE(sc, IWN_MEM_WDATA, 0);
+	/* Wait for clock stabilization. */
+	for (ntries = 0; ntries < 25000; ntries++) {
+		if (IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_MAC_CLOCK_READY)
+			return 0;
+		DELAY(100);
 	}
+	device_printf(sc->sc_dev,
+	    "%s: timeout waiting for clock stabilization\n", __func__);
+	return ETIMEDOUT;
+}
+
+int
+iwn4965_apm_init(struct iwn_softc *sc)
+{
+	int error;
 
-	/* shared area is aligned on a 1K boundary */
-	iwn_mem_write(sc, IWN_SRAM_BASE, sc->shared_dma.paddr >> 10);
-	iwn_mem_write(sc, IWN_SELECT_QCHAIN, 0);
+	/* Disable L0s. */
+	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
+	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_L1A_NO_L0S_RX);
 
-	for (qid = 0; qid < IWN_NTXQUEUES; qid++) {
-		iwn_mem_write(sc, IWN_QUEUE_RIDX(qid), 0);
-		IWN_WRITE(sc, IWN_TX_WIDX, qid << 8 | 0);
+	error = iwn_clock_wait(sc);
+	if (error != 0)
+		return error;
 
-		/* set sched. window size */
-		IWN_WRITE(sc, IWN_MEM_WADDR, base + IWN_QUEUE_OFFSET(qid));
-		IWN_WRITE(sc, IWN_MEM_WDATA, 64);
-		/* set sched. frame limit */
-		IWN_WRITE(sc, IWN_MEM_WADDR, base + IWN_QUEUE_OFFSET(qid) + 4);
-		IWN_WRITE(sc, IWN_MEM_WDATA, 10 << 16);
-	}
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
 
-	/* enable interrupts for all 16 queues */
-	iwn_mem_write(sc, IWN_QUEUE_INTR_MASK, 0xffff);
+	/* Enable DMA. */
+	iwn_prph_write(sc, IWN_APMG_CLK_CTRL,
+	    IWN_APMG_CLK_CTRL_DMA_CLK_RQT | IWN_APMG_CLK_CTRL_BSM_CLK_RQT);
+	DELAY(20);
 
-	/* identify active Tx rings (0-7) */
-	iwn_mem_write(sc, IWN_TX_ACTIVE, 0xff);
+	/* Disable L1. */
+	iwn_prph_setbits(sc, IWN_APMG_PCI_STT, IWN_APMG_PCI_STT_L1A_DIS);
+	iwn_nic_unlock(sc);
 
-	/* mark Tx rings (4 EDCA + cmd + 2 HCCA) as active */
-	for (qid = 0; qid < 7; qid++) {
-		iwn_mem_write(sc, IWN_TXQ_STATUS(qid),
-		    IWN_TXQ_STATUS_ACTIVE | qid << 1);
-	}
+	return 0;
+}
+
+int
+iwn5000_apm_init(struct iwn_softc *sc)
+{
+	int error;
+
+	/* Disable L0s. */
+	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_DIS_L0S_TIMER);
+	IWN_SETBITS(sc, IWN_GIO_CHICKEN, IWN_GIO_CHICKEN_L1A_NO_L0S_RX);
+
+	/* Set Flow Handler wait threshold to the maximum. */
+	IWN_SETBITS(sc, IWN_DBG_HPET_MEM, 0xffff0000);
+
+	/* Enable HAP to move adapter from L1a to L0s. */
+	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_HAP_WAKE_L1A);
 
-	iwn_mem_unlock(sc);
+	if (sc->hw_type != IWN_HW_REV_TYPE_6000 &&
+	    sc->hw_type != IWN_HW_REV_TYPE_6050)
+		IWN_SETBITS(sc, IWN_ANA_PLL, IWN_ANA_PLL_INIT);
+
+	error = iwn_clock_wait(sc);
+	if (error != 0)
+		return error;
+
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+
+	/* Enable DMA. */
+	iwn_prph_write(sc, IWN_APMG_CLK_CTRL, IWN_APMG_CLK_CTRL_DMA_CLK_RQT);
+	DELAY(20);
+
+	/* Disable L1. */
+	iwn_prph_setbits(sc, IWN_APMG_PCI_STT, IWN_APMG_PCI_STT_L1A_DIS);
+	iwn_nic_unlock(sc);
+
+	return 0;
 }
 
 void
-iwn_stop_master(struct iwn_softc *sc)
+iwn_apm_stop_master(struct iwn_softc *sc)
 {
-	uint32_t tmp;
 	int ntries;
 
-	tmp = IWN_READ(sc, IWN_RESET);
-	IWN_WRITE(sc, IWN_RESET, tmp | IWN_STOP_MASTER);
-
-	tmp = IWN_READ(sc, IWN_GPIO_CTL);
-	if ((tmp & IWN_GPIO_PWR_STATUS) == IWN_GPIO_PWR_SLEEP)
-		return;	/* already asleep */
-
+	IWN_SETBITS(sc, IWN_RESET, IWN_RESET_STOP_MASTER);
 	for (ntries = 0; ntries < 100; ntries++) {
-		if (IWN_READ(sc, IWN_RESET) & IWN_MASTER_DISABLED)
-			break;
+		if (IWN_READ(sc, IWN_RESET) & IWN_RESET_MASTER_DISABLED)
+			return;
 		DELAY(10);
 	}
-	if (ntries == 100)
-		device_printf(sc->sc_dev,
-		    "%s: timeout waiting for master\n", __func__);
+	device_printf(sc->sc_dev, "%s: timeout waiting for master\n",
+	    __func__);
+}
+
+void
+iwn_apm_stop(struct iwn_softc *sc)
+{
+	iwn_apm_stop_master(sc);
+
+	IWN_SETBITS(sc, IWN_RESET, IWN_RESET_SW);
+	DELAY(10);
+	/* Clear "initialization complete" bit. */
+	IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_INIT_DONE);
 }
 
 int
-iwn_reset(struct iwn_softc *sc)
+iwn4965_nic_config(struct iwn_softc *sc)
 {
 	uint32_t tmp;
-	int ntries;
 
-	/* clear any pending interrupts */
-	IWN_WRITE(sc, IWN_INTR, 0xffffffff);
+	/* Retrieve PCIe Active State Power Management (ASPM). */
+	tmp = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
+	if (tmp & 0x02)		/* L1 Entry enabled. */
+		IWN_SETBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
+	else
+		IWN_CLRBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
+
+	if (IWN_RFCFG_TYPE(sc->rfcfg) == 1) {
+		/*
+		 * I don't believe this to be correct but this is what the
+		 * vendor driver is doing. Probably the bits should not be
+		 * shifted in IWN_RFCFG_*.
+		 */
+		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
+		    IWN_RFCFG_TYPE(sc->rfcfg) |
+		    IWN_RFCFG_STEP(sc->rfcfg) |
+		    IWN_RFCFG_DASH(sc->rfcfg));
+	}
+	IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
+	    IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
+	return 0;
+}
+
+int
+iwn5000_nic_config(struct iwn_softc *sc)
+{
+	uint32_t tmp;
+	int error;
+
+	/* Retrieve PCIe Active State Power Management (ASPM). */
+	tmp = pci_read_config(sc->sc_dev, sc->sc_cap_off + 0x10, 1);
+	if (tmp & 0x02)		/* L1 Entry enabled. */
+		IWN_SETBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
+	else
+		IWN_CLRBITS(sc, IWN_GIO, IWN_GIO_L0S_ENA);
 
-	tmp = IWN_READ(sc, IWN_CHICKEN);
-	IWN_WRITE(sc, IWN_CHICKEN, tmp | IWN_CHICKEN_DISLOS);
+	if (IWN_RFCFG_TYPE(sc->rfcfg) < 3) {
+		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
+		    IWN_RFCFG_TYPE(sc->rfcfg) |
+		    IWN_RFCFG_STEP(sc->rfcfg) |
+		    IWN_RFCFG_DASH(sc->rfcfg));
+	}
+	IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
+	    IWN_HW_IF_CONFIG_RADIO_SI | IWN_HW_IF_CONFIG_MAC_SI);
 
-	tmp = IWN_READ(sc, IWN_GPIO_CTL);
-	IWN_WRITE(sc, IWN_GPIO_CTL, tmp | IWN_GPIO_INIT);
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+	iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_EARLY_PWROFF_DIS);
+	iwn_nic_unlock(sc);
+	return 0;
+}
 
-	/* wait for clock stabilization */
-	for (ntries = 0; ntries < 1000; ntries++) {
-		if (IWN_READ(sc, IWN_GPIO_CTL) & IWN_GPIO_CLOCK)
+/*
+ * Take NIC ownership over Intel Active Management Technology (AMT).
+ */
+int
+iwn_hw_prepare(struct iwn_softc *sc)
+{
+	int ntries;
+
+	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_PREPARE);
+	for (ntries = 0; ntries < 15000; ntries++) {
+		if (!(IWN_READ(sc, IWN_HW_IF_CONFIG) &
+		    IWN_HW_IF_CONFIG_PREPARE_DONE))
 			break;
 		DELAY(10);
 	}
-	if (ntries == 1000) {
-		device_printf(sc->sc_dev,
-		    "%s: timeout waiting for clock stabilization\n", __func__);
+	if (ntries == 15000)
 		return ETIMEDOUT;
+
+	IWN_SETBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_NIC_READY);
+	for (ntries = 0; ntries < 5; ntries++) {
+		if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
+		    IWN_HW_IF_CONFIG_NIC_READY)
+			return 0;
+		DELAY(10);
 	}
-	return 0;
+	return ETIMEDOUT;
 }
 
-void
-iwn_hw_config(struct iwn_softc *sc)
+int
+iwn_hw_init(struct iwn_softc *sc)
 {
-	uint32_t tmp, hw;
+	const struct iwn_hal *hal = sc->sc_hal;
+	int error, chnl, qid;
 
-	/* enable interrupts mitigation */
-	IWN_WRITE(sc, IWN_INTR_MIT, 512 / 32);
+	/* Clear pending interrupts. */
+	IWN_WRITE(sc, IWN_INT, 0xffffffff);
 
-	/* voodoo from the reference driver */
-	tmp = pci_read_config(sc->sc_dev, PCIR_REVID,1);
-	if ((tmp & 0x80) && (tmp & 0x7f) < 8) {
-		/* enable "no snoop" field */
-		tmp = pci_read_config(sc->sc_dev, 0xe8, 1);
-		tmp &= ~IWN_DIS_NOSNOOP;
-		/* clear device specific PCI configuration register 0x41 */
-		pci_write_config(sc->sc_dev, 0xe8, tmp, 1);
+	error = hal->apm_init(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not power ON adapter, error %d\n",
+		    __func__, error);
+		return error;
 	}
 
-	/* disable L1 entry to work around a hardware bug */
-	tmp = pci_read_config(sc->sc_dev, 0xf0, 1);
-	tmp &= ~IWN_ENA_L1;
-	pci_write_config(sc->sc_dev, 0xf0, tmp, 1 );
+	/* Select VMAIN power source. */
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+	iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_PWR_SRC_MASK);
+	iwn_nic_unlock(sc);
 
-	hw = IWN_READ(sc, IWN_HWCONFIG);
-	IWN_WRITE(sc, IWN_HWCONFIG, hw | 0x310);
+	/* Perform adapter-specific initialization. */
+	error = hal->nic_config(sc);
+	if (error != 0)
+		return error;
 
-	iwn_mem_lock(sc);
-	tmp = iwn_mem_read(sc, IWN_MEM_POWER);
-	iwn_mem_write(sc, IWN_MEM_POWER, tmp | IWN_POWER_RESET);
-	DELAY(5);
-	tmp = iwn_mem_read(sc, IWN_MEM_POWER);
-	iwn_mem_write(sc, IWN_MEM_POWER, tmp & ~IWN_POWER_RESET);
-	iwn_mem_unlock(sc);
-}
+	/* Initialize RX ring. */
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
+	IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
+	IWN_WRITE(sc, IWN_FH_RX_WPTR, 0);
+	/* Set physical address of RX ring (256-byte aligned.) */
+	IWN_WRITE(sc, IWN_FH_RX_BASE, sc->rxq.desc_dma.paddr >> 8);
+	/* Set physical address of RX status (16-byte aligned.) */
+	IWN_WRITE(sc, IWN_FH_STATUS_WPTR, sc->rxq.stat_dma.paddr >> 4);
+	/* Enable RX. */
+	IWN_WRITE(sc, IWN_FH_RX_CONFIG,
+	    IWN_FH_RX_CONFIG_ENA           |
+	    IWN_FH_RX_CONFIG_IGN_RXF_EMPTY |	/* HW bug workaround */
+	    IWN_FH_RX_CONFIG_IRQ_DST_HOST  |
+	    IWN_FH_RX_CONFIG_SINGLE_FRAME  |
+	    IWN_FH_RX_CONFIG_RB_TIMEOUT(0) |
+	    IWN_FH_RX_CONFIG_NRBD(IWN_RX_RING_COUNT_LOG));
+	iwn_nic_unlock(sc);
+	IWN_WRITE(sc, IWN_FH_RX_WPTR, (IWN_RX_RING_COUNT - 1) & ~7);
+
+	error = iwn_nic_lock(sc);
+	if (error != 0)
+		return error;
 
-void
-iwn_init_locked(struct iwn_softc *sc)
-{
-	struct ifnet *ifp = sc->sc_ifp;
-	uint32_t tmp;
-	int error, qid;
+	/* Initialize TX scheduler. */
+	iwn_prph_write(sc, hal->sched_txfact_addr, 0);
 
-	IWN_LOCK_ASSERT(sc);
+	/* Set physical address of "keep warm" page (16-byte aligned.) */
+	IWN_WRITE(sc, IWN_FH_KW_ADDR, sc->kw_dma.paddr >> 4);
 
-	/* load the firmware */
-	if (sc->fw_fp == NULL && (error = iwn_load_firmware(sc)) != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not load firmware, error %d\n", __func__, error);
-		return;
+	/* Initialize TX rings. */
+	for (qid = 0; qid < hal->ntxqs; qid++) {
+		struct iwn_tx_ring *txq = &sc->txq[qid];
+
+		/* Set physical address of TX ring (256-byte aligned.) */
+		IWN_WRITE(sc, IWN_FH_CBBC_QUEUE(qid),
+		    txq->desc_dma.paddr >> 8);
 	}
+	iwn_nic_unlock(sc);
 
-	error = iwn_reset(sc);
-	if (error != 0) {
-		device_printf(sc->sc_dev,
-		    "%s: could not reset adapter, error %d\n", __func__, error);
-		return;
+	/* Enable DMA channels. */
+	for (chnl = 0; chnl < hal->ndmachnls; chnl++) {
+		IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl),
+		    IWN_FH_TX_CONFIG_DMA_ENA |
+		    IWN_FH_TX_CONFIG_DMA_CREDIT_ENA);
 	}
 
-	iwn_mem_lock(sc);
-	iwn_mem_read(sc, IWN_CLOCK_CTL);
-	iwn_mem_write(sc, IWN_CLOCK_CTL, 0xa00);
-	iwn_mem_read(sc, IWN_CLOCK_CTL);
-	iwn_mem_unlock(sc);
+	/* Clear "radio off" and "commands blocked" bits. */
+	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
+	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_CMD_BLOCKED);
 
-	DELAY(20);
+	/* Clear pending interrupts. */
+	IWN_WRITE(sc, IWN_INT, 0xffffffff);
+	/* Enable interrupt coalescing. */
+	IWN_WRITE(sc, IWN_INT_COALESCING, 512 / 8);
+	/* Enable interrupts. */
+	IWN_WRITE(sc, IWN_MASK, IWN_INT_MASK);
 
-	iwn_mem_lock(sc);
-	tmp = iwn_mem_read(sc, IWN_MEM_PCIDEV);
-	iwn_mem_write(sc, IWN_MEM_PCIDEV, tmp | 0x800);
-	iwn_mem_unlock(sc);
+	/* _Really_ make sure "radio off" bit is cleared! */
+	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
+	IWN_WRITE(sc, IWN_UCODE_GP1_CLR, IWN_UCODE_GP1_RFKILL);
 
-	iwn_mem_lock(sc);
-	tmp = iwn_mem_read(sc, IWN_MEM_POWER);
-	iwn_mem_write(sc, IWN_MEM_POWER, tmp & ~0x03000000);
-	iwn_mem_unlock(sc);
+	error = hal->load_firmware(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not load firmware, error %d\n",
+		    __func__, error);
+		return error;
+	}
+	/* Wait at most one second for firmware alive notification. */
+	error = msleep(sc, &sc->sc_mtx, PCATCH, "iwninit", hz);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: timeout waiting for adapter to initialize, error %d\n",
+		    __func__, error);
+		return error;
+	}
+	/* Do post-firmware initialization. */
+	return hal->post_alive(sc);
+}
 
-	iwn_hw_config(sc);
+void
+iwn_hw_stop(struct iwn_softc *sc)
+{
+	const struct iwn_hal *hal = sc->sc_hal;
+	uint32_t tmp;
+	int chnl, qid, ntries;
 
-	/* init Rx ring */
-	iwn_mem_lock(sc);
-	IWN_WRITE(sc, IWN_RX_CONFIG, 0);
-	IWN_WRITE(sc, IWN_RX_WIDX, 0);
-	/* Rx ring is aligned on a 256-byte boundary */
-	IWN_WRITE(sc, IWN_RX_BASE, sc->rxq.desc_dma.paddr >> 8);
-	/* shared area is aligned on a 16-byte boundary */
-	IWN_WRITE(sc, IWN_RW_WIDX_PTR, (sc->shared_dma.paddr +
-	    offsetof(struct iwn_shared, closed_count)) >> 4);
-	IWN_WRITE(sc, IWN_RX_CONFIG, 0x80601000);
-	iwn_mem_unlock(sc);
+	IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
 
-	IWN_WRITE(sc, IWN_RX_WIDX, (IWN_RX_RING_COUNT - 1) & ~7);
+	/* Disable interrupts. */
+	IWN_WRITE(sc, IWN_MASK, 0);
+	IWN_WRITE(sc, IWN_INT, 0xffffffff);
+	IWN_WRITE(sc, IWN_FH_INT, 0xffffffff);
+
+	/* Make sure we no longer hold the NIC lock. */
+	iwn_nic_unlock(sc);
+
+	/* Stop TX scheduler. */
+	iwn_prph_write(sc, hal->sched_txfact_addr, 0);
+
+	/* Stop all DMA channels. */
+	if (iwn_nic_lock(sc) == 0) {
+		for (chnl = 0; chnl < hal->ndmachnls; chnl++) {
+			IWN_WRITE(sc, IWN_FH_TX_CONFIG(chnl), 0);
+			for (ntries = 0; ntries < 200; ntries++) {
+				tmp = IWN_READ(sc, IWN_FH_TX_STATUS);
+				if ((tmp & IWN_FH_TX_STATUS_IDLE(chnl)) ==
+				    IWN_FH_TX_STATUS_IDLE(chnl))
+					break;
+				DELAY(10);
+			}
+		}
+		iwn_nic_unlock(sc);
+	}
 
-	iwn_mem_lock(sc);
-	iwn_mem_write(sc, IWN_TX_ACTIVE, 0);
+	/* Stop RX ring. */
+	iwn_reset_rx_ring(sc, &sc->rxq);
 
-	/* set physical address of "keep warm" page */
-	IWN_WRITE(sc, IWN_KW_BASE, sc->kw_dma.paddr >> 4);
+	/* Reset all TX rings. */
+	for (qid = 0; qid < hal->ntxqs; qid++)
+		iwn_reset_tx_ring(sc, &sc->txq[qid]);
 
-	/* init Tx rings */
-	for (qid = 0; qid < IWN_NTXQUEUES; qid++) {
-		struct iwn_tx_ring *txq = &sc->txq[qid];
-		IWN_WRITE(sc, IWN_TX_BASE(qid), txq->desc_dma.paddr >> 8);
-		IWN_WRITE(sc, IWN_TX_CONFIG(qid), 0x80000008);
+	if (iwn_nic_lock(sc) == 0) {
+		iwn_prph_write(sc, IWN_APMG_CLK_DIS, IWN_APMG_CLK_DMA_RQT);
+		iwn_nic_unlock(sc);
 	}
-	iwn_mem_unlock(sc);
+	DELAY(5);
 
-	/* clear "radio off" and "disable command" bits (reversed logic) */
-	IWN_WRITE(sc, IWN_UCODE_CLR, IWN_RADIO_OFF);
-	IWN_WRITE(sc, IWN_UCODE_CLR, IWN_DISABLE_CMD);
+	/* Power OFF adapter. */
+	iwn_apm_stop(sc);
+}
 
-	/* clear any pending interrupts */
-	IWN_WRITE(sc, IWN_INTR, 0xffffffff);
-	/* enable interrupts */
-	IWN_WRITE(sc, IWN_MASK, IWN_INTR_MASK);
+void
+iwn_init_locked(struct iwn_softc *sc)
+{
+	struct ifnet *ifp = sc->sc_ifp;
+	int error;
 
-	/* not sure why/if this is necessary... */
-	IWN_WRITE(sc, IWN_UCODE_CLR, IWN_RADIO_OFF);
-	IWN_WRITE(sc, IWN_UCODE_CLR, IWN_RADIO_OFF);
+	IWN_LOCK_ASSERT(sc);
+
+	iwn_stop_locked(sc);
 
-	/* check that the radio is not disabled by RF switch */
-	if (!(IWN_READ(sc, IWN_GPIO_CTL) & IWN_GPIO_RF_ENABLED)) {
+	error = iwn_hw_prepare(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev, "%s: hardware not ready, eror %d\n",
+		    __func__, error);
+		goto fail;
+	}
+
+	/* Check that the radio is not disabled by hardware switch. */
+	if (!(IWN_READ(sc, IWN_GP_CNTRL) & IWN_GP_CNTRL_RFKILL)) {
 		device_printf(sc->sc_dev,
-		    "radio is disabled by hardware switch\n");
-		return;
+		    "%s: radio is disabled by hardware switch\n",
+		    __func__);
+		error = EPERM;	/* :-) */
+		goto fail;
 	}
 
-	error = iwn_transfer_firmware(sc);
+	/* Read firmware images from the filesystem. */
+	error = iwn_read_firmware(sc);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
-		    "%s: could not load firmware, error %d\n", __func__, error);
-		return;
+		    "%s: could not read firmware, error %d\n",
+		    __func__, error);
+		goto fail;
 	}
 
-	/* firmware has notified us that it is alive.. */
-	iwn_post_alive(sc);	/* ..do post alive initialization */
-
-	sc->rawtemp = sc->ucode_info.temp[3].chan20MHz;
-	sc->temp = iwn_get_temperature(sc);
-	DPRINTF(sc, IWN_DEBUG_RESET, "%s: temperature=%d\n",
-	   __func__, sc->temp);
+	/* Initialize hardware and upload firmware. */
+	error = iwn_hw_init(sc);
+	if (error != 0) {
+		device_printf(sc->sc_dev,
+		    "%s: could not initialize hardware, error %d\n",
+		    __func__, error);
+		goto fail;
+	}
 
+	/* Configure adapter now that it is ready. */
 	error = iwn_config(sc);
 	if (error != 0) {
 		device_printf(sc->sc_dev,
 		    "%s: could not configure device, error %d\n",
 		    __func__, error);
-		return;
+		goto fail;
 	}
 
 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
+
+	return;
+
+fail:
+	iwn_stop_locked(sc);
 }
 
 void
@@ -4259,40 +5457,20 @@ void
 iwn_stop_locked(struct iwn_softc *sc)
 {
 	struct ifnet *ifp = sc->sc_ifp;
-	uint32_t tmp;
-	int i;
 
 	IWN_LOCK_ASSERT(sc);
 
-	IWN_WRITE(sc, IWN_RESET, IWN_NEVO_RESET);
+	IWN_WRITE(sc, IWN_RESET, IWN_RESET_NEVO);
 
 	sc->sc_tx_timer = 0;
 	callout_stop(&sc->sc_timer_to);
 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
 
-	/* disable interrupts */
-	IWN_WRITE(sc, IWN_MASK, 0);
-	IWN_WRITE(sc, IWN_INTR, 0xffffffff);
-	IWN_WRITE(sc, IWN_INTR_STATUS, 0xffffffff);
-
-	/* reset all Tx rings */
-	for (i = 0; i < IWN_NTXQUEUES; i++)
-		iwn_reset_tx_ring(sc, &sc->txq[i]);
-
-	/* reset Rx ring */
-	iwn_reset_rx_ring(sc, &sc->rxq);
-
-	iwn_mem_lock(sc);
-	iwn_mem_write(sc, IWN_MEM_CLOCK2, 0x200);
-	iwn_mem_unlock(sc);
-
-	DELAY(5);
-	iwn_stop_master(sc);
-
-	tmp = IWN_READ(sc, IWN_RESET);
-	IWN_WRITE(sc, IWN_RESET, tmp | IWN_SW_RESET);
+	/* Power OFF hardware. */
+	iwn_hw_stop(sc);
 }
 
+
 void
 iwn_stop(struct iwn_softc *sc)
 {
@@ -4331,10 +5509,10 @@ iwn_scan_end(struct ieee80211com *ic)
 static void
 iwn_set_channel(struct ieee80211com *ic)
 {
+	const struct ieee80211_channel *c = ic->ic_curchan;
 	struct ifnet *ifp = ic->ic_ifp;
 	struct iwn_softc *sc = ifp->if_softc;
 	struct ieee80211vap *vap;
-	const struct ieee80211_channel *c = ic->ic_curchan;
 	int error;
 
 	vap = TAILQ_FIRST(&ic->ic_vaps);	/* XXX */
@@ -4387,7 +5565,7 @@ iwn_scan_mindwell(struct ieee80211_scan_state *ss)
 }
 
 static void
-iwn_hwreset(void *arg0, int pending)
+iwn_hw_reset(void *arg0, int pending)
 {
 	struct iwn_softc *sc = arg0;
 	struct ifnet *ifp = sc->sc_ifp;
@@ -4398,7 +5576,7 @@ iwn_hwreset(void *arg0, int pending)
 }
 
 static void
-iwn_radioon(void *arg0, int pending)
+iwn_radio_on(void *arg0, int pending)
 {
 	struct iwn_softc *sc = arg0;
 
@@ -4406,7 +5584,7 @@ iwn_radioon(void *arg0, int pending)
 }
 
 static void
-iwn_radiooff(void *arg0, int pending)
+iwn_radio_off(void *arg0, int pending)
 {
 	struct iwn_softc *sc = arg0;
 	struct ifnet *ifp = sc->sc_ifp;
@@ -4431,6 +5609,37 @@ iwn_sysctlattach(struct iwn_softc *sc)
 #endif
 }
 
+static int
+iwn_shutdown(device_t dev)
+{
+	struct iwn_softc *sc = device_get_softc(dev);
+
+	iwn_stop(sc);
+	return 0;
+}
+
+static int
+iwn_suspend(device_t dev)
+{
+	struct iwn_softc *sc = device_get_softc(dev);
+
+	iwn_stop(sc);
+	return 0;
+}
+
+static int
+iwn_resume(device_t dev)
+{
+	struct iwn_softc *sc = device_get_softc(dev);
+	struct ifnet *ifp = sc->sc_ifp;
+
+	pci_write_config(dev, 0x41, 0, 1);
+
+	if (ifp->if_flags & IFF_UP)
+		iwn_init(sc);
+	return 0;
+}
+
 #ifdef IWN_DEBUG
 static const char *
 iwn_intr_str(uint8_t cmd)
@@ -4446,47 +5655,50 @@ iwn_intr_str(uint8_t cmd)
 	case IWN_BEACON_STATISTICS:	return "BEACON_STATS";
 	case IWN_STATE_CHANGED:		return "STATE_CHANGED";
 	case IWN_BEACON_MISSED:		return "BEACON_MISSED";
-	case IWN_AMPDU_RX_START:	return "AMPDU_RX_START";
-	case IWN_AMPDU_RX_DONE:		return "AMPDU_RX_DONE";
+	case IWN_RX_PHY:		return "RX_PHY";
+	case IWN_MPDU_RX_DONE:		return "MPDU_RX_DONE";
 	case IWN_RX_DONE:		return "RX_DONE";
 
 	/* Command Notifications */
 	case IWN_CMD_CONFIGURE:		return "IWN_CMD_CONFIGURE";
 	case IWN_CMD_ASSOCIATE:		return "IWN_CMD_ASSOCIATE";
 	case IWN_CMD_EDCA_PARAMS:	return "IWN_CMD_EDCA_PARAMS";
-	case IWN_CMD_TSF:		return "IWN_CMD_TSF";
-	case IWN_CMD_TX_LINK_QUALITY:	return "IWN_CMD_TX_LINK_QUALITY";
+	case IWN_CMD_TIMING:		return "IWN_CMD_TIMING";
+	case IWN_CMD_LINK_QUALITY:	return "IWN_CMD_LINK_QUALITY";
 	case IWN_CMD_SET_LED:		return "IWN_CMD_SET_LED";
+	case IWN5000_CMD_WIMAX_COEX:	return "IWN5000_CMD_WIMAX_COEX";
+	case IWN5000_CMD_CALIB_CONFIG:	return "IWN5000_CMD_CALIB_CONFIG";
 	case IWN_CMD_SET_POWER_MODE:	return "IWN_CMD_SET_POWER_MODE";
 	case IWN_CMD_SCAN:		return "IWN_CMD_SCAN";
 	case IWN_CMD_TXPOWER:		return "IWN_CMD_TXPOWER";
-	case IWN_CMD_BLUETOOTH:		return "IWN_CMD_BLUETOOTH";
+	case IWN_CMD_TXPOWER_DBM:	return "IWN_CMD_TXPOWER_DBM";
+	case IWN_CMD_BT_COEX:		return "IWN_CMD_BT_COEX";
 	case IWN_CMD_SET_CRITICAL_TEMP:	return "IWN_CMD_SET_CRITICAL_TEMP";
-	case IWN_SENSITIVITY:		return "IWN_SENSITIVITY";
-	case IWN_PHY_CALIB:		return "IWN_PHY_CALIB";
+	case IWN_CMD_SET_SENSITIVITY:	return "IWN_CMD_SET_SENSITIVITY";
+	case IWN_CMD_PHY_CALIB:		return "IWN_CMD_PHY_CALIB";
 	}
 	return "UNKNOWN INTR NOTIF/CMD";
 }
 #endif /* IWN_DEBUG */
 
 static device_method_t iwn_methods[] = {
-        /* Device interface */
-        DEVMETHOD(device_probe,         iwn_probe),
-        DEVMETHOD(device_attach,        iwn_attach),
-        DEVMETHOD(device_detach,        iwn_detach),
-        DEVMETHOD(device_shutdown,      iwn_shutdown),
-        DEVMETHOD(device_suspend,       iwn_suspend),
-        DEVMETHOD(device_resume,        iwn_resume),
-
-        { 0, 0 }
+	/* Device interface */
+	DEVMETHOD(device_probe,		iwn_probe),
+	DEVMETHOD(device_attach,	iwn_attach),
+	DEVMETHOD(device_detach,	iwn_detach),
+	DEVMETHOD(device_shutdown,	iwn_shutdown),
+	DEVMETHOD(device_suspend,	iwn_suspend),
+	DEVMETHOD(device_resume,	iwn_resume),
+	{ 0, 0 }
 };
 
 static driver_t iwn_driver = {
-        "iwn",
-        iwn_methods,
-        sizeof (struct iwn_softc)
+	"iwn",
+	iwn_methods,
+	sizeof (struct iwn_softc)
 };
 static devclass_t iwn_devclass;
+
 DRIVER_MODULE(iwn, pci, iwn_driver, iwn_devclass, 0, 0);
 MODULE_DEPEND(iwn, pci, 1, 1, 1);
 MODULE_DEPEND(iwn, firmware, 1, 1, 1);
diff --git a/sys/dev/iwn/if_iwnreg.h b/sys/dev/iwn/if_iwnreg.h
index 96e5867..ed514af 100644
--- a/sys/dev/iwn/if_iwnreg.h
+++ b/sys/dev/iwn/if_iwnreg.h
@@ -1,8 +1,8 @@
 /*	$FreeBSD$	*/
-/*	$OpenBSD: if_iwnreg.h,v 1.9 2007/11/27 20:59:40 damien Exp $	*/
+/*	$OpenBSD: if_iwnreg.h,v 1.26 2009/05/29 08:25:45 damien Exp $	*/
 
 /*-
- * Copyright (c) 2007
+ * Copyright (c) 2007, 2008
  *	Damien Bergamini <damien.bergamini@free.fr>
  *
  * Permission to use, copy, modify, and distribute this software for any
@@ -18,177 +18,326 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#define	EDCA_NUM_AC  4
+#define EDCA_NUM_AC	4
 
 #define IWN_TX_RING_COUNT	256
-#define IWN_RX_RING_COUNT	64
+#define IWN_TX_RING_LOMARK	192
+#define IWN_TX_RING_HIMARK	224
+#define IWN_RX_RING_COUNT_LOG	6
+#define IWN_RX_RING_COUNT	(1 << IWN_RX_RING_COUNT_LOG)
 
-#define IWN_NTXQUEUES		16
-#define IWN_NTXCHAINS		2
+#define IWN4965_NTXQUEUES	16
+#define IWN5000_NTXQUEUES	20
 
-/*
- * Rings must be aligned on a 256-byte boundary.
- */
-#define IWN_RING_DMA_ALIGN	256
+#define IWN4965_NDMACHNLS	7
+#define IWN5000_NDMACHNLS	8
+
+#define IWN_SRVC_DMACHNL	9
 
-/* maximum scatter/gather */
+/* Maximum number of DMA segments for TX. */
 #define IWN_MAX_SCATTER	20
 
-/* Rx buffers must be large enough to hold a full 4K A-MPDU */
+/* RX buffers must be large enough to hold a full 4K A-MPDU. */
 #define IWN_RBUF_SIZE	(4 * 1024)
 
+#if defined(__LP64__)
+/* HW supports 36-bit DMA addresses. */
+#define IWN_LOADDR(paddr)	((uint32_t)(paddr))
+#define IWN_HIADDR(paddr)	(((paddr) >> 32) & 0xf)
+#else
+#define IWN_LOADDR(paddr)	(paddr)
+#define IWN_HIADDR(paddr)	(0)
+#endif
+
+/* Base Address Register. */
+#define IWN_PCI_BAR0	PCI_MAPREG_START
+
 /*
  * Control and status registers.
  */
-#define IWN_HWCONFIG		0x000
-#define IWN_INTR_MIT		0x004
-#define IWN_INTR		0x008
+#define IWN_HW_IF_CONFIG	0x000
+#define IWN_INT_COALESCING	0x004
+#define IWN_INT			0x008
 #define IWN_MASK		0x00c
-#define IWN_INTR_STATUS		0x010
+#define IWN_FH_INT		0x010
 #define IWN_RESET		0x020
-#define IWN_GPIO_CTL		0x024
-#define IWN_EEPROM_CTL		0x02c
-#define IWN_UCODE_CLR		0x05c
-#define IWN_CHICKEN		0x100
-#define IWN_QUEUE_OFFSET(qid)	(0x380 + (qid) * 8)
+#define IWN_GP_CNTRL		0x024
+#define IWN_HW_REV		0x028
+#define IWN_EEPROM		0x02c
+#define IWN_EEPROM_GP		0x030
+#define IWN_OTP_GP		0x034
+#define IWN_GIO			0x03c
+#define IWN_UCODE_GP1_CLR	0x05c
+#define IWN_LED			0x094
+#define IWN_GIO_CHICKEN		0x100
+#define IWN_ANA_PLL		0x20c
+#define IWN_DBG_HPET_MEM	0x240
+#define IWN_MEM_RADDR		0x40c
 #define IWN_MEM_WADDR		0x410
 #define IWN_MEM_WDATA		0x418
-#define IWN_WRITE_MEM_ADDR  	0x444
-#define IWN_READ_MEM_ADDR   	0x448
-#define IWN_WRITE_MEM_DATA  	0x44c
-#define IWN_READ_MEM_DATA   	0x450
-#define IWN_TX_WIDX		0x460
-
-#define IWN_KW_BASE		0x197c
-#define IWN_TX_BASE(qid)	(0x19d0 + (qid) * 4)
-#define IWN_RW_WIDX_PTR		0x1bc0
-#define IWN_RX_BASE		0x1bc4
-#define IWN_RX_WIDX		0x1bc8
-#define IWN_RX_CONFIG		0x1c00
-#define IWN_RX_STATUS		0x1c44
-#define IWN_TX_CONFIG(qid)	(0x1d00 + (qid) * 32)
-#define IWN_TX_STATUS		0x1eb0
-
-#define IWN_SRAM_BASE		0xa02c00
-#define IWN_TX_ACTIVE		(IWN_SRAM_BASE + 0x01c)
-#define IWN_QUEUE_RIDX(qid)	(IWN_SRAM_BASE + 0x064 + (qid) * 4)
-#define IWN_SELECT_QCHAIN	(IWN_SRAM_BASE + 0x0d0)
-#define IWN_QUEUE_INTR_MASK	(IWN_SRAM_BASE + 0x0e4)
-#define IWN_TXQ_STATUS(qid)	(IWN_SRAM_BASE + 0x104 + (qid) * 4)
+#define IWN_MEM_RDATA		0x41c
+#define IWN_PRPH_WADDR  	0x444
+#define IWN_PRPH_RADDR   	0x448
+#define IWN_PRPH_WDATA  	0x44c
+#define IWN_PRPH_RDATA   	0x450
+#define IWN_HBUS_TARG_WRPTR	0x460
+
+/*
+ * Flow-Handler registers.
+ */
+#define IWN_FH_TFBD_CTRL0(qid)		(0x1900 + (qid) * 8)
+#define IWN_FH_TFBD_CTRL1(qid)		(0x1904 + (qid) * 8)
+#define IWN_FH_KW_ADDR			0x197c
+#define IWN_FH_SRAM_ADDR(qid)		(0x19a4 + (qid) * 4)
+#define IWN_FH_CBBC_QUEUE(qid)		(0x19d0 + (qid) * 4)
+#define IWN_FH_STATUS_WPTR		0x1bc0
+#define IWN_FH_RX_BASE			0x1bc4
+#define IWN_FH_RX_WPTR			0x1bc8
+#define IWN_FH_RX_CONFIG		0x1c00
+#define IWN_FH_RX_STATUS		0x1c44
+#define IWN_FH_TX_CONFIG(qid)		(0x1d00 + (qid) * 32)
+#define IWN_FH_TXBUF_STATUS(qid)	(0x1d08 + (qid) * 32)
+#define IWN_FH_TX_CHICKEN		0x1e98
+#define IWN_FH_TX_STATUS		0x1eb0
+
+/*
+ * TX scheduler registers.
+ */
+#define IWN_SCHED_BASE			0xa02c00
+#define IWN_SCHED_SRAM_ADDR		(IWN_SCHED_BASE + 0x000)
+#define IWN5000_SCHED_DRAM_ADDR		(IWN_SCHED_BASE + 0x008)
+#define IWN4965_SCHED_DRAM_ADDR		(IWN_SCHED_BASE + 0x010)
+#define IWN5000_SCHED_TXFACT		(IWN_SCHED_BASE + 0x010)
+#define IWN4965_SCHED_TXFACT		(IWN_SCHED_BASE + 0x01c)
+#define IWN4965_SCHED_QUEUE_RDPTR(qid)	(IWN_SCHED_BASE + 0x064 + (qid) * 4)
+#define IWN5000_SCHED_QUEUE_RDPTR(qid)	(IWN_SCHED_BASE + 0x068 + (qid) * 4)
+#define IWN4965_SCHED_QCHAIN_SEL	(IWN_SCHED_BASE + 0x0d0)
+#define IWN4965_SCHED_INTR_MASK		(IWN_SCHED_BASE + 0x0e4)
+#define IWN5000_SCHED_QCHAIN_SEL	(IWN_SCHED_BASE + 0x0e8)
+#define IWN4965_SCHED_QUEUE_STATUS(qid)	(IWN_SCHED_BASE + 0x104 + (qid) * 4)
+#define IWN5000_SCHED_INTR_MASK		(IWN_SCHED_BASE + 0x108)
+#define IWN5000_SCHED_QUEUE_STATUS(qid)	(IWN_SCHED_BASE + 0x10c + (qid) * 4)
+#define IWN5000_SCHED_AGGR_SEL		(IWN_SCHED_BASE + 0x248)
+
+/*
+ * Offsets in TX scheduler's SRAM.
+ */
+#define IWN4965_SCHED_CTX_OFF		0x380
+#define IWN4965_SCHED_CTX_LEN		416
+#define IWN4965_SCHED_QUEUE_OFFSET(qid)	(0x380 + (qid) * 8)
+#define IWN4965_SCHED_TRANS_TBL(qid)	(0x500 + (qid) * 2)
+#define IWN5000_SCHED_CTX_OFF		0x600
+#define IWN5000_SCHED_CTX_LEN		520
+#define IWN5000_SCHED_QUEUE_OFFSET(qid)	(0x600 + (qid) * 8)
+#define IWN5000_SCHED_TRANS_TBL(qid)	(0x7e0 + (qid) * 2)
 
 /*
  * NIC internal memory offsets.
  */
 #define IWN_CLOCK_CTL		0x3000
-#define IWN_MEM_CLOCK2		0x3008
-#define IWN_MEM_POWER		0x300c
-#define IWN_MEM_PCIDEV		0x3010
-#define IWN_MEM_UCODE_CTL	0x3400
-#define IWN_MEM_UCODE_SRC	0x3404
-#define IWN_MEM_UCODE_DST	0x3408
-#define IWN_MEM_UCODE_SIZE	0x340c
-#define IWN_MEM_TEXT_BASE	0x3490
-#define IWN_MEM_TEXT_SIZE	0x3494
-#define IWN_MEM_DATA_BASE	0x3498
-#define IWN_MEM_DATA_SIZE	0x349c
-#define IWN_MEM_UCODE_BASE	0x3800
-
-
-/* possible flags for register IWN_HWCONFIG */
-#define IWN_HW_EEPROM_LOCKED	(1 << 21)
-
-/* possible flags for registers IWN_READ_MEM_ADDR/IWN_WRITE_MEM_ADDR */
-#define IWN_MEM_4	((sizeof (uint32_t) - 1) << 24)
-
-/* possible values for IWN_MEM_UCODE_DST */
-#define IWN_FW_TEXT	0x00000000
-
-/* possible flags for register IWN_RESET */
-#define IWN_NEVO_RESET		(1 << 0)
-#define IWN_SW_RESET		(1 << 7)
-#define IWN_MASTER_DISABLED	(1 << 8)
-#define IWN_STOP_MASTER		(1 << 9)
-
-/* possible flags for register IWN_GPIO_CTL */
-#define IWN_GPIO_CLOCK		(1 << 0)
-#define IWN_GPIO_INIT		(1 << 2)
-#define IWN_GPIO_MAC		(1 << 3)
-#define IWN_GPIO_SLEEP		(1 << 4)
-#define IWN_GPIO_PWR_STATUS	0x07000000
-#define IWN_GPIO_PWR_SLEEP	(4 << 24)
-#define IWN_GPIO_RF_ENABLED	(1 << 27)
-
-/* possible flags for register IWN_CHICKEN */
-#define IWN_CHICKEN_DISLOS	(1 << 29)
-
-/* possible flags for register IWN_UCODE_CLR */
-#define IWN_RADIO_OFF		(1 << 1)
-#define IWN_DISABLE_CMD		(1 << 2)
-#define IWN_CTEMP_STOP_RF	(1 << 3)
-
-/* possible flags for IWN_RX_STATUS */
-#define	IWN_RX_IDLE	(1 << 24)
-
-/* possible flags for register IWN_UC_CTL */
-#define IWN_UC_ENABLE	(1 << 30)
-#define IWN_UC_RUN	(1 << 31)
-
-/* possible flags for register IWN_INTR */
-#define IWN_ALIVE_INTR	(1 <<  0)
-#define IWN_WAKEUP_INTR	(1 <<  1)
-#define IWN_SW_RX_INTR	(1 <<  3)
-#define IWN_CT_REACHED	(1 <<  6)
-#define IWN_RF_TOGGLED	(1 <<  7)
-#define IWN_SW_ERROR	(1 << 25)
-#define IWN_TX_INTR	(1 << 27)
-#define IWN_HW_ERROR	(1 << 29)
-#define IWN_RX_INTR	(1 << 31)
-
-#define	IWN_INTR_BITS	"\20\1ALIVE\2WAKEUP\3SW_RX\6CT_REACHED\7RF_TOGGLED" \
-	"\32SW_ERROR\34TX_INTR\36HW_ERROR\40RX_INTR"
-
-#define IWN_INTR_MASK							\
-	(IWN_SW_ERROR | IWN_HW_ERROR | IWN_TX_INTR | IWN_RX_INTR |	\
-	 IWN_ALIVE_INTR | IWN_WAKEUP_INTR | IWN_SW_RX_INTR |		\
-	 IWN_CT_REACHED | IWN_RF_TOGGLED)
-
-/* possible flags for register IWN_INTR_STATUS */
-#define IWN_STATUS_TXQ(x)	(1 << (x))
-#define IWN_STATUS_RXQ(x)	(1 << ((x) + 16))
-#define IWN_STATUS_PRI		(1 << 30)
-/* shortcuts for the above */
-#define IWN_TX_STATUS_INTR						\
-	(IWN_STATUS_TXQ(0) | IWN_STATUS_TXQ(1) | IWN_STATUS_TXQ(6))
-#define IWN_RX_STATUS_INTR						\
-	(IWN_STATUS_RXQ(0) | IWN_STATUS_RXQ(1) | IWN_STATUS_RXQ(2) |	\
-	 IWN_STATUS_PRI)
-
-/* possible flags for register IWN_TX_STATUS */
-#define IWN_TX_IDLE(qid)	(1 << ((qid) + 24) | 1 << ((qid) + 16))
-
-/* possible flags/masks for register IWN_EEPROM_CTL */
-#define IWN_EEPROM_READY	(1 << 0)
-#define IWN_EEPROM_MSK		(1 << 1)
-
-/* possible flags for register IWN_TXQ_STATUS */
-#define IWN_TXQ_STATUS_ACTIVE	0x0007fc01
-
-/* possible flags for register IWN_MEM_POWER */
-#define IWN_POWER_RESET	(1 << 26)
-
-/* possible flags for register IWN_MEM_TEXT_SIZE */
+#define IWN_APMG_CLK_CTRL	0x3004
+#define IWN_APMG_CLK_DIS	0x3008
+#define IWN_APMG_PS		0x300c
+#define IWN_APMG_PCI_STT	0x3010
+#define IWN_BSM_WR_CTRL		0x3400
+#define IWN_BSM_WR_MEM_SRC	0x3404
+#define IWN_BSM_WR_MEM_DST	0x3408
+#define IWN_BSM_WR_DWCOUNT	0x340c
+#define IWN_BSM_DRAM_TEXT_ADDR	0x3490
+#define IWN_BSM_DRAM_TEXT_SIZE	0x3494
+#define IWN_BSM_DRAM_DATA_ADDR	0x3498
+#define IWN_BSM_DRAM_DATA_SIZE	0x349c
+#define IWN_BSM_SRAM_BASE	0x3800
+
+/* Possible values for IWN_APMG_CLK_DIS. */
+#define IWN_APMG_CLK_DMA_RQT	(1 << 9)
+
+/* Possible flags for register IWN_HW_IF_CONFIG. */
+#define IWN_HW_IF_CONFIG_4965_R		(1 <<  4)
+#define IWN_HW_IF_CONFIG_MAC_SI		(1 <<  8)
+#define IWN_HW_IF_CONFIG_RADIO_SI	(1 <<  9)
+#define IWN_HW_IF_CONFIG_EEPROM_LOCKED	(1 << 21)
+#define IWN_HW_IF_CONFIG_NIC_READY	(1 << 22)
+#define IWN_HW_IF_CONFIG_HAP_WAKE_L1A	(1 << 23)
+#define IWN_HW_IF_CONFIG_PREPARE_DONE	(1 << 25)
+#define IWN_HW_IF_CONFIG_PREPARE	(1 << 27)
+
+/* Possible flags for registers IWN_PRPH_RADDR/IWN_PRPH_WADDR. */
+#define IWN_PRPH_DWORD	((sizeof (uint32_t) - 1) << 24)
+
+/* Possible values for IWN_BSM_WR_MEM_DST. */
+#define IWN_FW_TEXT_BASE	0x00000000
+#define IWN_FW_DATA_BASE	0x00800000
+
+/* Possible flags for register IWN_RESET. */
+#define IWN_RESET_NEVO			(1 << 0)
+#define IWN_RESET_SW			(1 << 7)
+#define IWN_RESET_MASTER_DISABLED	(1 << 8)
+#define IWN_RESET_STOP_MASTER		(1 << 9)
+
+/* Possible flags for register IWN_GP_CNTRL. */
+#define IWN_GP_CNTRL_MAC_ACCESS_ENA	(1 << 0)
+#define IWN_GP_CNTRL_MAC_CLOCK_READY	(1 << 0)
+#define IWN_GP_CNTRL_INIT_DONE		(1 << 2)
+#define IWN_GP_CNTRL_MAC_ACCESS_REQ	(1 << 3)
+#define IWN_GP_CNTRL_SLEEP		(1 << 4)
+#define IWN_GP_CNTRL_RFKILL		(1 << 27)
+
+/* Possible flags for register IWN_HW_REV. */
+#define IWN_HW_REV_TYPE_SHIFT	4
+#define IWN_HW_REV_TYPE_MASK	0x000000f0
+#define IWN_HW_REV_TYPE_4965	0
+#define IWN_HW_REV_TYPE_5300	2
+#define IWN_HW_REV_TYPE_5350	3
+#define IWN_HW_REV_TYPE_5150	4
+#define IWN_HW_REV_TYPE_5100	5
+#define IWN_HW_REV_TYPE_1000	6
+#define IWN_HW_REV_TYPE_6000	7
+#define IWN_HW_REV_TYPE_6050	8
+
+/* Possible flags for register IWN_GIO_CHICKEN. */
+#define IWN_GIO_CHICKEN_L1A_NO_L0S_RX	(1 << 23)
+#define IWN_GIO_CHICKEN_DIS_L0S_TIMER	(1 << 29)
+
+/* Possible flags for register IWN_GIO. */
+#define IWN_GIO_L0S_ENA		(1 << 1)
+
+/* Possible flags for register IWN_UCODE_GP1_CLR. */
+#define IWN_UCODE_GP1_RFKILL		(1 << 1)
+#define IWN_UCODE_GP1_CMD_BLOCKED	(1 << 2)
+#define IWN_UCODE_GP1_CTEMP_STOP_RF	(1 << 3)
+
+/* Possible flags/values for register IWN_LED. */
+#define IWN_LED_BSM_CTRL	(1 << 5)
+#define IWN_LED_OFF		0x00000038
+#define IWN_LED_ON		0x00000078
+
+/* Possible values for register IWN_ANA_PLL. */
+#define IWN_ANA_PLL_INIT	0x00880300
+
+/* Possible flags for register IWN_FH_RX_STATUS. */
+#define	IWN_FH_RX_STATUS_IDLE	(1 << 24)
+
+/* Possible flags for register IWN_BSM_WR_CTRL. */
+#define IWN_BSM_WR_CTRL_START_EN	(1 << 30)
+#define IWN_BSM_WR_CTRL_START		(1 << 31)
+
+/* Possible flags for register IWN_INT. */
+#define IWN_INT_ALIVE		(1 <<  0)
+#define IWN_INT_WAKEUP		(1 <<  1)
+#define IWN_INT_SW_RX		(1 <<  3)
+#define IWN_INT_CT_REACHED	(1 <<  6)
+#define IWN_INT_RF_TOGGLED	(1 <<  7)
+#define IWN_INT_SW_ERR		(1 << 25)
+#define IWN_INT_FH_TX		(1 << 27)
+#define IWN_INT_HW_ERR		(1 << 29)
+#define IWN_INT_FH_RX		(1 << 31)
+
+/* Shortcut. */
+#define IWN_INT_MASK							\
+	(IWN_INT_SW_ERR | IWN_INT_HW_ERR | IWN_INT_FH_TX |		\
+	 IWN_INT_FH_RX | IWN_INT_ALIVE | IWN_INT_WAKEUP |		\
+	 IWN_INT_SW_RX | IWN_INT_CT_REACHED | IWN_INT_RF_TOGGLED)
+
+/* Possible flags for register IWN_FH_INT. */
+#define IWN_FH_INT_TX_CHNL(x)	(1 << (x))
+#define IWN_FH_INT_RX_CHNL(x)	(1 << ((x) + 16))
+#define IWN_FH_INT_HI_PRIOR	(1 << 30)
+/* Shortcuts for the above. */
+#define IWN_FH_INT_TX							\
+	(IWN_FH_INT_TX_CHNL(0) | IWN_FH_INT_TX_CHNL(1))
+#define IWN_FH_INT_RX							\
+	(IWN_FH_INT_RX_CHNL(0) | IWN_FH_INT_RX_CHNL(1) | IWN_FH_INT_HI_PRIOR)
+
+/* Possible flags/values for register IWN_FH_TX_CONFIG. */
+#define IWN_FH_TX_CONFIG_DMA_PAUSE		0
+#define IWN_FH_TX_CONFIG_DMA_ENA		(1 << 31)
+#define IWN_FH_TX_CONFIG_CIRQ_HOST_ENDTFD	(1 << 20)
+
+/* Possible flags/values for register IWN_FH_TXBUF_STATUS. */
+#define IWN_FH_TXBUF_STATUS_TBNUM(x)	((x) << 20)
+#define IWN_FH_TXBUF_STATUS_TBIDX(x)	((x) << 12)
+#define IWN_FH_TXBUF_STATUS_TFBD_VALID	3
+
+/* Possible flags for register IWN_FH_TX_CHICKEN. */
+#define IWN_FH_TX_CHICKEN_SCHED_RETRY	(1 << 1)
+
+/* Possible flags for register IWN_FH_TX_STATUS. */
+#define IWN_FH_TX_STATUS_IDLE(chnl)					\
+	(1 << ((chnl) + 24) | 1 << ((chnl) + 16))
+
+/* Possible flags for register IWN_FH_RX_CONFIG. */
+#define IWN_FH_RX_CONFIG_ENA		(1 << 31)
+#define IWN_FH_RX_CONFIG_NRBD(x)	((x) << 20)
+#define IWN_FH_RX_CONFIG_RB_SIZE_8K	(1 << 16)
+#define IWN_FH_RX_CONFIG_SINGLE_FRAME	(1 << 15)
+#define IWN_FH_RX_CONFIG_IRQ_DST_HOST	(1 << 12)
+#define IWN_FH_RX_CONFIG_RB_TIMEOUT(x)	((x) << 4)
+#define IWN_FH_RX_CONFIG_IGN_RXF_EMPTY	(1 <<  2)
+
+/* Possible flags for register IWN_FH_TX_CONFIG. */
+#define IWN_FH_TX_CONFIG_DMA_ENA	(1 << 31)
+#define IWN_FH_TX_CONFIG_DMA_CREDIT_ENA	(1 <<  3)
+
+/* Possible flags for register IWN_EEPROM. */
+#define IWN_EEPROM_READ_VALID	(1 << 0)
+#define IWN_EEPROM_CMD		(1 << 1)
+
+/* Possible flags for register IWN_EEPROM_GP. */
+#define IWN_EEPROM_GP_IF_OWNER	0x00000180
+
+/* Possible flags for register IWN_OTP_GP. */
+#define IWN_OTP_GP_DEV_SEL_OTP		(1 << 16)
+#define IWN_OTP_GP_RELATIVE_ACCESS	(1 << 17)
+#define IWN_OTP_GP_ECC_CORR_STTS	(1 << 20)
+#define IWN_OTP_GP_ECC_UNCORR_STTS	(1 << 21)
+
+/* Possible flags for register IWN_SCHED_QUEUE_STATUS. */
+#define IWN4965_TXQ_STATUS_ACTIVE	0x0007fc01
+#define IWN4965_TXQ_STATUS_INACTIVE	0x0007fc00
+#define IWN4965_TXQ_STATUS_AGGR_ENA	(1 << 5 | 1 << 8)
+#define IWN4965_TXQ_STATUS_CHGACT	(1 << 10)
+#define IWN5000_TXQ_STATUS_ACTIVE	0x00ff0018
+#define IWN5000_TXQ_STATUS_INACTIVE	0x00ff0010
+#define IWN5000_TXQ_STATUS_CHGACT	(1 << 19)
+
+/* Possible flags for register IWN_APMG_CLK_CTRL. */
+#define IWN_APMG_CLK_CTRL_DMA_CLK_RQT	(1 <<  9)
+#define IWN_APMG_CLK_CTRL_BSM_CLK_RQT	(1 << 11)
+
+/* Possible flags for register IWN_APMG_PS. */
+#define IWN_APMG_PS_EARLY_PWROFF_DIS	(1 << 22)
+#define IWN_APMG_PS_PWR_SRC(x)		((x) << 24)
+#define IWN_APMG_PS_PWR_SRC_VMAIN	0
+#define IWN_APMG_PS_PWR_SRC_VAUX	2
+#define IWN_APMG_PS_PWR_SRC_MASK	IWN_APMG_PS_PWR_SRC(3)
+#define IWN_APMG_PS_RESET_REQ		(1 << 26)
+
+/* Possible flags for IWN_APMG_PCI_STT. */
+#define IWN_APMG_PCI_STT_L1A_DIS	(1 << 11)
+
+/* Possible flags for register IWN_BSM_DRAM_TEXT_SIZE. */
 #define IWN_FW_UPDATED	(1 << 31)
 
-/* possible flags for device-specific PCI register 0xe8 */
-#define IWN_DIS_NOSNOOP	(1 << 11)
-
-/* possible flags for device-specific PCI register 0xf0 */
-#define IWN_ENA_L1	(1 << 1)
+#define IWN_SCHED_WINSZ		64
+#define IWN_SCHED_LIMIT		64
+#define IWN4965_SCHED_COUNT	512
+#define IWN5000_SCHED_COUNT	(IWN_TX_RING_COUNT + IWN_SCHED_WINSZ)
+#define IWN4965_SCHEDSZ		(IWN4965_NTXQUEUES * IWN4965_SCHED_COUNT * 2)
+#define IWN5000_SCHEDSZ		(IWN5000_NTXQUEUES * IWN5000_SCHED_COUNT * 2)
 
+struct iwn_tx_desc {
+	uint8_t		reserved1[3];
+	uint8_t		nsegs;
+	struct {
+		uint32_t	addr;
+		uint16_t	len;
+	} __packed	segs[IWN_MAX_SCATTER];
+	/* Pad to 128 bytes. */
+	uint32_t	reserved2;
+} __packed;
 
-#define IWN_TX_WINDOW	64
-struct iwn_shared {
-	uint16_t	len[IWN_NTXQUEUES][512];	/* 16KB total */
+struct iwn_rx_status {
 	uint16_t	closed_count;
 	uint16_t	closed_rx_count;
 	uint16_t	finished_count;
@@ -196,86 +345,78 @@ struct iwn_shared {
 	uint32_t	reserved[2];
 } __packed;
 
-struct iwn_tx_desc {
-	uint32_t	flags;
-	struct {
-		uint32_t	w1;
-		uint32_t	w2;
-		uint32_t	w3;
-	} __packed	segs[IWN_MAX_SCATTER / 2];
-	/* pad to 128 bytes */
-	uint32_t	reserved;
-} __packed;
-
-#define IWN_SET_DESC_NSEGS(d, x)					\
-	(d)->flags = htole32(((x) & 0x1f) << 24)
-
-/* set a segment physical address and length in a Tx descriptor */
-#define IWN_SET_DESC_SEG(d, n, addr, size) do {				\
-	if ((n) & 1) {							\
-		(d)->segs[(n) / 2].w2 |=				\
-		    htole32(((addr) & 0xffff) << 16);			\
-		(d)->segs[(n) / 2].w3 =					\
-		    htole32((((addr) >> 16) & 0xffff) | (size) << 20);	\
-	} else {							\
-		(d)->segs[(n) / 2].w1 = htole32(addr);			\
-		(d)->segs[(n) / 2].w2 = htole32((size) << 4);		\
-	}								\
-} while (0)
-
 struct iwn_rx_desc {
 	uint32_t	len;
 	uint8_t		type;
-#define IWN_UC_READY		  1
-#define IWN_ADD_NODE_DONE	 24
-#define IWN_TX_DONE		 28
-#define IWN_START_SCAN		130
-#define IWN_STOP_SCAN		132
-#define IWN_RX_STATISTICS	156
-#define IWN_BEACON_STATISTICS	157
-#define IWN_STATE_CHANGED	161
-#define IWN_BEACON_MISSED	162
-#define IWN_AMPDU_RX_START	192
-#define IWN_AMPDU_RX_DONE	193
-#define IWN_RX_DONE		195
+#define IWN_UC_READY			  1
+#define IWN_ADD_NODE_DONE		 24
+#define IWN_TX_DONE			 28
+#define IWN5000_CALIBRATION_RESULT	102
+#define IWN5000_CALIBRATION_DONE	103
+#define IWN_START_SCAN			130
+#define IWN_STOP_SCAN			132
+#define IWN_RX_STATISTICS		156
+#define IWN_BEACON_STATISTICS		157
+#define IWN_STATE_CHANGED		161
+#define IWN_BEACON_MISSED		162
+#define IWN_RX_PHY			192
+#define IWN_MPDU_RX_DONE		193
+#define IWN_RX_DONE			195
 
 	uint8_t		flags;
 	uint8_t		idx;
 	uint8_t		qid;
 } __packed;
 
-/* possible Rx status flags */
-#define IWN_RX_NO_CRC_ERR	(1 << 0)
-#define IWN_RX_NO_OVFL_ERR	(1 << 1)
-/* shortcut for the above */
+/* Possible RX status flags. */
+#define IWN_RX_NO_CRC_ERR	(1 <<  0)
+#define IWN_RX_NO_OVFL_ERR	(1 <<  1)
+/* Shortcut for the above. */
 #define IWN_RX_NOERROR	(IWN_RX_NO_CRC_ERR | IWN_RX_NO_OVFL_ERR)
+#define IWN_RX_MPDU_MIC_OK	(1 <<  6)
+#define IWN_RX_CIPHER_MASK	(7 <<  8)
+#define IWN_RX_CIPHER_CCMP	(2 <<  8)
+#define IWN_RX_MPDU_DEC		(1 << 11)
+#define IWN_RX_DECRYPT_MASK	(3 << 11)
+#define IWN_RX_DECRYPT_OK	(3 << 11)
 
 struct iwn_tx_cmd {
 	uint8_t	code;
-#define IWN_CMD_CONFIGURE		0x10	/* REPLY_RXON */
-#define IWN_CMD_ASSOCIATE		0x11	/* REPLY_RXON_ASSOC */
-#define IWN_CMD_EDCA_PARAMS		0x13	/* REPLY_QOS_PARAM */
-#define IWN_CMD_TSF			0x14	/* REPLY_RXON_TIMING */
-#define IWN_CMD_ADD_NODE		0x18	/* REPLY_ADD_STA */
-#define IWN_CMD_TX_DATA			0x1c	/* REPLY_TX */
-#define IWN_CMD_TX_LINK_QUALITY		0x4e	/* REPLY_TX_LINK_QUALITY_CMD */
-#define IWN_CMD_SET_LED			0x48	/* REPLY_LEDS_CMD */
-#define IWN_CMD_SET_POWER_MODE		0x77	/* POWER_TABLE_CMD */
-#define IWN_CMD_SCAN			0x80	/* REPLY_SCAN_CMD */
-#define IWN_CMD_TXPOWER			0x97	/* REPLY_TX_PWR_TABLE_CMD */
-#define IWN_CMD_BLUETOOTH		0x9b	/* REPLY_BT_CONFIG */
-#define IWN_CMD_GET_STATISTICS		0x9c	/* REPLY_STATISTICS_CMD */
-#define IWN_CMD_SET_CRITICAL_TEMP	0xa4	/* REPLY_CT_KILL_CONFIG_CMD */
-#define IWN_SENSITIVITY			0xa8	/* SENSITIVITY_CMD */
-#define IWN_PHY_CALIB			0xb0	/* REPLY_PHY_CALIBRATION_CMD */
+#define IWN_CMD_CONFIGURE		 16
+#define IWN_CMD_ASSOCIATE		 17
+#define IWN_CMD_EDCA_PARAMS		 19
+#define IWN_CMD_TIMING			 20
+#define IWN_CMD_ADD_NODE		 24
+#define IWN_CMD_TX_DATA			 28
+#define IWN_CMD_LINK_QUALITY		 78
+#define IWN_CMD_SET_LED			 72
+#define IWN5000_CMD_WIMAX_COEX		 90
+#define IWN5000_CMD_CALIB_CONFIG	101
+#define IWN_CMD_SET_POWER_MODE		119
+#define IWN_CMD_SCAN			128
+#define IWN_CMD_TXPOWER			151
+#define IWN_CMD_TXPOWER_DBM		152
+#define IWN_CMD_BT_COEX			155
+#define IWN_CMD_GET_STATISTICS		156
+#define IWN_CMD_SET_CRITICAL_TEMP	164
+#define IWN_CMD_SET_SENSITIVITY		168
+#define IWN_CMD_PHY_CALIB		176
+
 	uint8_t	flags;
 	uint8_t	idx;
 	uint8_t	qid;
 	uint8_t	data[136];
 } __packed;
 
-/* structure for command IWN_CMD_CONFIGURE (aka RXON) */
-struct iwn_config {
+/* Antenna flags, used in various commands. */
+#define IWN_ANT_A	(1 << 0)
+#define IWN_ANT_B	(1 << 1)
+#define IWN_ANT_C	(1 << 2)
+/* Shortcut. */
+#define IWN_ANT_ABC	(IWN_ANT_A | IWN_ANT_B | IWN_ANT_C)
+
+/* Structure for command IWN_CMD_CONFIGURE. */
+struct iwn_rxon {
 	uint8_t		myaddr[IEEE80211_ADDR_LEN];
 	uint16_t	reserved1;
 	uint8_t		bssid[IEEE80211_ADDR_LEN];
@@ -287,54 +428,62 @@ struct iwn_config {
 #define IWN_MODE_STA		3
 #define IWN_MODE_IBSS		4
 #define IWN_MODE_MONITOR	6
-	uint8_t		unused4;	/* air propagation */
+
+	uint8_t		air;
 	uint16_t	rxchain;
-#define	IWN_RXCHAIN_VALID	0x000e	/* which antennae are valid */
-#define IWN_RXCHAIN_VALID_S	1
-#define	IWN_RXCHAIN_FORCE	0x0070
-#define	IWN_RXCHAIN_FORCE_S	4
-#define	IWN_RXCHAIN_FORCE_MIMO	0x0380
-#define	IWN_RXCHAIN_FORCE_MIMO_S	7
-#define	IWN_RXCHAIN_CNT		0x0c00
-#define	IWN_RXCHAIN_CNT_S	10
-#define	IWN_RXCHAIN_MIMO_CNT	0x3000
-#define	IWN_RXCHAIN_MIMO_CNT_S	12
-#define IWN_RXCHAIN_MIMO_FORCE	0x4000
-#define IWN_RXCHAIN_MIMO_FORCE_S	14
-	uint8_t		ofdm_mask;	/* basic rates */
-	uint8_t		cck_mask;	/* basic rates */
+#define IWN_RXCHAIN_FORCE		(1 << 0)
+#define IWN_RXCHAIN_VALID(x)		((x) <<  1)
+#define IWN_RXCHAIN_SEL(x)		((x) <<  4)
+#define IWN_RXCHAIN_MIMO(x)		((x) <<  7)
+#define IWN_RXCHAIN_IDLE_COUNT(x)	((x) << 10)
+#define IWN_RXCHAIN_MIMO_COUNT(x)	((x) << 12)
+#define IWN_RXCHAIN_MIMO_FORCE		(1 << 14)
+
+	uint8_t		ofdm_mask;
+	uint8_t		cck_mask;
 	uint16_t	associd;
 	uint32_t	flags;
-#define	IWN_CONFIG_24GHZ	0x00000001	/* band */
-#define	IWN_CONFIG_CCK		0x00000002	/* modulation */
-#define	IWN_CONFIG_AUTO		0x00000004	/* 2.4-only auto-detect */
-#define	IWN_CONFIG_HTPROT	0x00000008	/* xmit with HT protection */
-#define	IWN_CONFIG_SHSLOT	0x00000010	/* short slot time */
-#define	IWN_CONFIG_SHPREAMBLE	0x00000020	/* short premable */
-#define	IWN_CONFIG_NODIVERSITY	0x00000080	/* disable antenna diversity */
-#define	IWN_CONFIG_ANTENNA_A	0x00000100
-#define	IWN_CONFIG_ANTENNA_B	0x00000200
-#define	IWN_CONFIG_RADAR	0x00001000	/* enable radar detect */
-#define	IWN_CONFIG_NARROW	0x00002000	/* MKK narrow band select */
-#define	IWN_CONFIG_TSF		0x00008000
-#define	IWN_CONFIG_HT		0x06400000
-#define	IWN_CONFIG_HT20		0x02000000
-#define	IWN_CONFIG_HT40U	0x04000000
-#define	IWN_CONFIG_HT40D	0x04400000
+#define IWN_RXON_24GHZ		0x00000001	/* band */
+#define IWN_RXON_CCK		0x00000002	/* modulation */
+#define IWN_RXON_AUTO		0x00000004	/* 2.4-only auto-detect */
+#define IWN_RXON_HTPROT		0x00000008	/* xmit with HT protection */
+#define IWN_RXON_SHSLOT		0x00000010	/* short slot time */
+#define IWN_RXON_SHPREAMBLE	0x00000020	/* short premable */
+#define IWN_RXON_NODIVERSITY	0x00000080	/* disable antenna diversity */
+#define IWN_RXON_ANTENNA_A	0x00000100
+#define IWN_RXON_ANTENNA_B	0x00000200
+#define IWN_RXON_RADAR		0x00001000	/* enable radar detect */
+#define IWN_RXON_NARROW		0x00002000	/* MKK narrow band select */
+#define IWN_RXON_TSF		0x00008000
+#define IWN_RXON_HT		0x06400000
+#define IWN_RXON_HT20		0x02000000
+#define IWN_RXON_HT40U		0x04000000
+#define IWN_RXON_HT40D		0x04400000
+#define IWN_RXON_CTS_TO_SELF	0x40000000
+
 	uint32_t	filter;
-#define IWN_FILTER_PROMISC	(1 << 0)	/* pass all data frames */
-#define IWN_FILTER_CTL		(1 << 1)	/* pass ctl+mgt frames */
-#define IWN_FILTER_MULTICAST	(1 << 2)	/* pass multi-cast frames */
-#define IWN_FILTER_NODECRYPT	(1 << 3)	/* pass unicast undecrypted */
-#define IWN_FILTER_BSS		(1 << 5)	/* station is associated */
-#define IWN_FILTER_ALLBEACONS	(1 << 6)	/* pass overlapping bss beacons
-						   (must be associated) */
-	uint16_t	chan;		/* IEEE channel # of control/primary */
-	uint8_t		ht_single_mask;	/* single-stream basic rates */
-	uint8_t		ht_dual_mask;	/* dual-stream basic rates */
-} __packed;
-
-/* structure for command IWN_CMD_ASSOCIATE */
+#define IWN_FILTER_PROMISC	(1 << 0)
+#define IWN_FILTER_CTL		(1 << 1)
+#define IWN_FILTER_MULTICAST	(1 << 2)
+#define IWN_FILTER_NODECRYPT	(1 << 3)
+#define IWN_FILTER_BSS		(1 << 5)
+#define IWN_FILTER_BEACON	(1 << 6)
+
+	uint8_t		chan;
+	uint8_t		reserved4;
+	uint8_t		ht_single_mask;
+	uint8_t		ht_dual_mask;
+	/* The following fields are for 5000 Series only. */
+	uint8_t		ht_triple_mask;
+	uint8_t		reserved5;
+	uint16_t	acquisition;
+	uint16_t	reserved6;
+} __packed;
+
+#define IWN4965_RXONSZ	(sizeof (struct iwn_rxon) - 6)
+#define IWN5000_RXONSZ	(sizeof (struct iwn_rxon))
+
+/* Structure for command IWN_CMD_ASSOCIATE. */
 struct iwn_assoc {
 	uint32_t	flags;
 	uint32_t	filter;
@@ -343,7 +492,7 @@ struct iwn_assoc {
 	uint16_t	reserved;
 } __packed;
 
-/* structure for command IWN_CMD_EDCA_PARAMS */
+/* Structure for command IWN_CMD_EDCA_PARAMS. */
 struct iwn_edca_params {
 	uint32_t	flags;
 #define IWN_EDCA_UPDATE	(1 << 0)
@@ -358,8 +507,8 @@ struct iwn_edca_params {
 	} __packed	ac[EDCA_NUM_AC];
 } __packed;
 
-/* structure for command IWN_CMD_TSF */
-struct iwn_cmd_tsf {
+/* Structure for command IWN_CMD_TIMING. */
+struct iwn_cmd_timing {
 	uint64_t	tstamp;
 	uint16_t	bintval;
 	uint16_t	atim;
@@ -368,66 +517,115 @@ struct iwn_cmd_tsf {
 	uint16_t	reserved;
 } __packed;
 
-/* structure for command IWN_CMD_ADD_NODE */
+/* Structure for command IWN_CMD_ADD_NODE. */
 struct iwn_node_info {
 	uint8_t		control;
 #define IWN_NODE_UPDATE		(1 << 0)
+
 	uint8_t		reserved1[3];
+
 	uint8_t		macaddr[IEEE80211_ADDR_LEN];
 	uint16_t	reserved2;
 	uint8_t		id;
 #define IWN_ID_BSS		 0
-#define IWN_ID_BROADCAST	31
+#define IWN5000_ID_BROADCAST	15
+#define IWN4965_ID_BROADCAST	31
+
+	uint8_t		flags;
+#define IWN_FLAG_SET_KEY		(1 << 0)
+#define IWN_FLAG_SET_DISABLE_TID	(1 << 1)
+#define IWN_FLAG_SET_TXRATE		(1 << 2)
+#define IWN_FLAG_SET_ADDBA		(1 << 3)
+#define IWN_FLAG_SET_DELBA		(1 << 4)
+
+	uint16_t	reserved3;
+	uint16_t	kflags;
+#define IWN_KFLAG_CCMP		(1 <<  1)
+#define IWN_KFLAG_MAP		(1 <<  3)
+#define IWN_KFLAG_KID(kid)	((kid) << 8)
+#define IWN_KFLAG_INVALID	(1 << 11)
+#define IWN_KFLAG_GROUP		(1 << 14)
+
+	uint8_t		tsc2;	/* TKIP TSC2 */
+	uint8_t		reserved4;
+	uint16_t	ttak[5];
+	uint8_t		kid;
+	uint8_t		reserved5;
+	uint8_t		key[16];
+	/* The following 3 fields are for 5000 Series only. */
+	uint64_t	tsc;
+	uint8_t		rxmic[8];
+	uint8_t		txmic[8];
+
+	uint32_t	htflags;
+#define IWN_AMDPU_SIZE_FACTOR(x)	((x) << 19)
+#define IWN_AMDPU_DENSITY(x)		((x) << 23)
+
+	uint32_t	mask;
+	uint16_t	disable_tid;
+	uint16_t	reserved6;
+	uint8_t		addba_tid;
+	uint8_t		delba_tid;
+	uint16_t	addba_ssn;
+	uint32_t	reserved7;
+} __packed;
+
+struct iwn4965_node_info {
+	uint8_t		control;
+	uint8_t		reserved1[3];
+	uint8_t		macaddr[IEEE80211_ADDR_LEN];
+	uint16_t	reserved2;
+	uint8_t		id;
 	uint8_t		flags;
-#define IWN_FLAG_SET_KEY	(1 << 0)
 	uint16_t	reserved3;
-	uint16_t	security;
+	uint16_t	kflags;
 	uint8_t		tsc2;	/* TKIP TSC2 */
 	uint8_t		reserved4;
 	uint16_t	ttak[5];
-	uint16_t	reserved5;
-	uint8_t		key[IEEE80211_KEYBUF_SIZE];
+	uint8_t		kid;
+	uint8_t		reserved5;
+	uint8_t		key[16];
 	uint32_t	htflags;
-#define IWN_MAXRXAMPDU_S	19
-#define IWN_MPDUDENSITY_S	23
 	uint32_t	mask;
-	uint16_t	tid;
-	uint8_t		rate;		/* legacy rate/MCS */
-#define	IWN_RATE_MCS	0x08		/* or'd to indicate MCS */
-	uint8_t		rflags;
-#define	IWN_RFLAG_HT	(1 << 0)	/* use HT modulation */
+	uint16_t	disable_tid;
+	uint16_t	reserved6;
+	uint8_t		addba_tid;
+	uint8_t		delba_tid;
+	uint16_t	addba_ssn;
+	uint32_t	reserved7;
+} __packed;
+
+#define IWN_RFLAG_HT	(1 << 0)	/* use HT modulation */
 #define IWN_RFLAG_CCK	(1 << 1)	/* use CCK modulation */
-#define	IWN_RFLAG_HT40	(1 << 3)	/* use dual-stream */
-#define	IWN_RFLAG_SGI	(1 << 5)	/* use short GI */
+#define IWN_RFLAG_HT40	(1 << 3)	/* use dual-stream */
+#define IWN_RFLAG_SGI	(1 << 5)	/* use short GI */
 #define IWN_RFLAG_ANT_A	(1 << 6)	/* start on antenna port A */
 #define IWN_RFLAG_ANT_B	(1 << 7)	/* start on antenna port B */
-	uint8_t		add_imm;
-	uint8_t		del_imm;
-	uint16_t	add_imm_start;
-	uint32_t	reserved6;
-} __packed;
+#define IWN_RFLAG_ANT(x)	((x) << 6)
 
-/* structure for command IWN_CMD_TX_DATA */
+/* Structure for command IWN_CMD_TX_DATA. */
 struct iwn_cmd_data {
 	uint16_t	len;
 	uint16_t	lnext;
 	uint32_t	flags;
+#define IWN_TX_NEED_PROTECTION	(1 <<  0)	/* 5000 only */
 #define IWN_TX_NEED_RTS		(1 <<  1)
 #define IWN_TX_NEED_CTS		(1 <<  2)
 #define IWN_TX_NEED_ACK		(1 <<  3)
-#define IWN_TX_USE_NODE_RATE	(1 <<  4)
+#define IWN_TX_LINKQ		(1 <<  4)
+#define IWN_TX_IMM_BA		(1 <<  6)
 #define IWN_TX_FULL_TXOP	(1 <<  7)
 #define IWN_TX_BT_DISABLE	(1 << 12)	/* bluetooth coexistence */
 #define IWN_TX_AUTO_SEQ		(1 << 13)
+#define IWN_TX_MORE_FRAG	(1 << 14)
 #define IWN_TX_INSERT_TSTAMP	(1 << 16)
 #define IWN_TX_NEED_PADDING	(1 << 20)
 
-	uint8_t		ntries;
-	uint8_t		bluetooth;
-	uint16_t	reserved1;
-	uint8_t		rate;
+	uint32_t	scratch;
+	uint8_t		plcp;
 	uint8_t		rflags;
 	uint16_t	xrflags;
+
 	uint8_t		id;
 	uint8_t		security;
 #define IWN_CIPHER_WEP40	1
@@ -435,9 +633,9 @@ struct iwn_cmd_data {
 #define IWN_CIPHER_TKIP		3
 #define IWN_CIPHER_WEP104	9
 
-	uint8_t		ridx;
+	uint8_t		linkq;
 	uint8_t		reserved2;
-	uint8_t		key[IEEE80211_KEYBUF_SIZE];
+	uint8_t		key[16];
 	uint16_t	fnext;
 	uint16_t	reserved3;
 	uint32_t	lifetime;
@@ -452,34 +650,30 @@ struct iwn_cmd_data {
 	uint16_t	txop;
 } __packed;
 
-/* structure for command IWN_CMD_TX_LINK_QUALITY */
+/* Structure for command IWN_CMD_LINK_QUALITY. */
 #define IWN_MAX_TX_RETRIES	16
 struct iwn_cmd_link_quality {
 	uint8_t		id;
 	uint8_t		reserved1;
 	uint16_t	ctl;
 	uint8_t		flags;
-	uint8_t		mimo;		/* MIMO delimiter */
-	uint8_t		ssmask;		/* single stream antenna mask */
-	uint8_t		dsmask;		/* dual stream antenna mask */
-	uint8_t		ridx[EDCA_NUM_AC];/* starting rate index */
-	uint16_t	ampdu_limit;	/* tx aggregation time limit */
-	uint8_t		ampdu_disable;
-	uint8_t		ampdu_max;	/* frame count limit */
+	uint8_t		mimo;
+	uint8_t		antmsk_1stream;
+	uint8_t		antmsk_2stream;
+	uint8_t		ridx[EDCA_NUM_AC];
+	uint16_t	ampdu_limit;
+	uint8_t		ampdu_threshold;
+	uint8_t		ampdu_max;
 	uint32_t	reserved2;
 	struct {
-		uint8_t		rate;
-#define IWN_RATE_CCK1	 0
-#define IWN_RATE_CCK11	 3
-#define IWN_RATE_OFDM6	 4
-#define IWN_RATE_OFDM54	11
+		uint8_t		plcp;
 		uint8_t		rflags;
 		uint16_t	xrflags;
-	} table[IWN_MAX_TX_RETRIES];
+	} __packed	retry[IWN_MAX_TX_RETRIES];
 	uint32_t	reserved3;
 } __packed;
 
-/* structure for command IWN_CMD_SET_LED */
+/* Structure for command IWN_CMD_SET_LED. */
 struct iwn_cmd_led {
 	uint32_t	unit;	/* multiplier (in usecs) */
 	uint8_t		which;
@@ -491,20 +685,56 @@ struct iwn_cmd_led {
 	uint8_t		reserved;
 } __packed;
 
-/* structure for command IWN_CMD_SET_POWER_MODE */
-struct iwn_power {
+/* Structure for command IWN5000_CMD_WIMAX_COEX. */
+struct iwn5000_wimax_coex {
+	uint32_t	flags;
+	struct {
+		uint8_t	request;
+		uint8_t	window;
+		uint8_t	reserved;
+		uint8_t	flags;
+	} __packed	events[16];
+} __packed;
+
+/* Structures for command IWN5000_CMD_CALIB_CONFIG. */
+struct iwn5000_calib_elem {
+	uint32_t	enable;
+	uint32_t	start;
+	uint32_t	send;
+	uint32_t	apply;
+	uint32_t	reserved;
+} __packed;
+
+struct iwn5000_calib_status {
+	struct iwn5000_calib_elem	once;
+	struct iwn5000_calib_elem	perd;
+	uint32_t			flags;
+} __packed;
+
+struct iwn5000_calib_config {
+	struct iwn5000_calib_status	ucode;
+	struct iwn5000_calib_status	driver;
+	uint32_t			reserved;
+} __packed;
+
+/* Structure for command IWN_CMD_SET_POWER_MODE. */
+struct iwn_pmgt_cmd {
 	uint16_t	flags;
-#define IWN_POWER_CAM	0	/* constantly awake mode */
+#define IWN_PS_ALLOW_SLEEP	(1 << 0)
+#define IWN_PS_NOTIFY		(1 << 1)
+#define IWN_PS_SLEEP_OVER_DTIM	(1 << 2)
+#define IWN_PS_PCI_PMGT		(1 << 3)
+#define IWN_PS_FAST_PD		(1 << 4)
 
-	uint8_t		alive;
+	uint8_t		keepalive;
 	uint8_t		debug;
-	uint32_t	rx_timeout;
-	uint32_t	tx_timeout;
-	uint32_t	sleep[5];
+	uint32_t	rxtimeout;
+	uint32_t	txtimeout;
+	uint32_t	intval[5];
 	uint32_t	beacons;
 } __packed;
 
-/* structures for command IWN_CMD_SCAN */
+/* Structures for command IWN_CMD_SCAN. */
 struct iwn_scan_essid {
 	uint8_t	id;
 	uint8_t	len;
@@ -515,8 +745,8 @@ struct iwn_scan_hdr {
 	uint16_t	len;
 	uint8_t		reserved1;
 	uint8_t		nchan;
-	uint16_t	quiet;
-	uint16_t	plcp_threshold;
+	uint16_t	quiet_time;
+	uint16_t	quiet_threshold;
 	uint16_t	crc_threshold;
 	uint16_t	rxchain;
 	uint32_t	max_svc;	/* background scans */
@@ -524,38 +754,54 @@ struct iwn_scan_hdr {
 	uint32_t	flags;
 	uint32_t	filter;
 
-	/* followed by a struct iwn_cmd_data */
-	/* followed by an array of 4x struct iwn_scan_essid */
-	/* followed by probe request body */
-	/* followed by nchan x struct iwn_scan_chan */
+	/* Followed by a struct iwn_cmd_data. */
+	/* Followed by an array of 20 structs iwn_scan_essid. */
+	/* Followed by probe request body. */
+	/* Followed by an array of ``nchan'' structs iwn_scan_chan. */
 } __packed;
 
 struct iwn_scan_chan {
-	uint8_t		flags;
-#define IWN_CHAN_ACTIVE	(1 << 0)
-#define IWN_CHAN_DIRECT	(1 << 1)
+	uint32_t	flags;
+#define IWN_CHAN_ACTIVE		(1 << 0)
+#define IWN_CHAN_NPBREQS(x)	(((1 << (x)) - 1) << 1)
 
-	uint8_t		chan;
+	uint16_t	chan;
 	uint8_t		rf_gain;
 	uint8_t		dsp_gain;
 	uint16_t	active;		/* msecs */
 	uint16_t	passive;	/* msecs */
 } __packed;
 
-/* structure for command IWN_CMD_TXPOWER */
+/* Maximum size of a scan command. */
+#define IWN_SCAN_MAXSZ	(MCLBYTES - 4)
+
+/* Structure for command IWN_CMD_TXPOWER (4965AGN only.) */
 #define IWN_RIDX_MAX	32
-struct iwn_cmd_txpower {
-	uint8_t	band;
-	uint8_t	reserved1;
-	uint8_t	chan;
-	uint8_t	reserved2;
+struct iwn4965_cmd_txpower {
+	uint8_t		band;
+	uint8_t		reserved1;
+	uint8_t		chan;
+	uint8_t		reserved2;
 	struct {
-		uint8_t	rf_gain[IWN_NTXCHAINS];
-		uint8_t	dsp_gain[IWN_NTXCHAINS];
-	}	power[IWN_RIDX_MAX + 1];
+		uint8_t	rf_gain[2];
+		uint8_t	dsp_gain[2];
+	} __packed	power[IWN_RIDX_MAX + 1];
+} __packed;
+
+/* Structure for command IWN_CMD_TXPOWER_DBM (5000 Series only.) */
+struct iwn5000_cmd_txpower {
+	int8_t	global_limit;	/* in half-dBm */
+#define IWN5000_TXPOWER_AUTO		0x7f
+#define IWN5000_TXPOWER_MAX_DBM		16
+
+	uint8_t	flags;
+#define IWN5000_TXPOWER_NO_CLOSED	(1 << 6)
+
+	int8_t	srv_limit;	/* in half-dBm */
+	uint8_t	reserved;
 } __packed;
 
-/* structure for command IWN_CMD_BLUETOOTH */
+/* Structure for command IWN_CMD_BLUETOOTH. */
 struct iwn_bluetooth {
 	uint8_t		flags;
 	uint8_t		lead;
@@ -565,18 +811,18 @@ struct iwn_bluetooth {
 	uint32_t	cts;
 } __packed;
 
-/* structure for command IWN_CMD_SET_CRITICAL_TEMP */
+/* Structure for command IWN_CMD_SET_CRITICAL_TEMP. */
 struct iwn_critical_temp {
 	uint32_t	reserved;
 	uint32_t	tempM;
 	uint32_t	tempR;
-/* degK <-> degC conversion macros */
+/* degK <-> degC conversion macros. */
 #define IWN_CTOK(c)	((c) + 273)
 #define IWN_KTOC(k)	((k) - 273)
 #define IWN_CTOMUK(c)	(((c) * 1000000) + 273150000)
 } __packed;
 
-/* structure for command IWN_SENSITIVITY */
+/* Structure for command IWN_CMD_SET_SENSITIVITY. */
 struct iwn_sensitivity_cmd {
 	uint16_t	which;
 #define IWN_SENSITIVITY_DEFAULTTBL	0
@@ -595,21 +841,74 @@ struct iwn_sensitivity_cmd {
 	uint16_t	energy_ofdm_th;
 } __packed;
 
-/* structure for command IWN_PHY_CALIB */
-struct iwn_phy_calib_cmd {
-	uint8_t		code;
-#define IWN_SET_DIFF_GAIN	7
+/* Structures for command IWN_CMD_PHY_CALIB. */
+struct iwn_phy_calib {
+	uint8_t	code;
+#define IWN4965_PHY_CALIB_DIFF_GAIN		 7
+#define IWN5000_PHY_CALIB_DC			 8
+#define IWN5000_PHY_CALIB_LO			 9
+#define IWN5000_PHY_CALIB_TX_IQ			11
+#define IWN5000_PHY_CALIB_CRYSTAL		15
+#define IWN5000_PHY_CALIB_BASE_BAND		16
+#define IWN5000_PHY_CALIB_TX_IQ_PERD		17
+#define IWN5000_PHY_CALIB_RESET_NOISE_GAIN	18
+#define IWN5000_PHY_CALIB_NOISE_GAIN		19
+
+	uint8_t	group;
+	uint8_t	ngroups;
+	uint8_t	isvalid;
+} __packed;
 
-	uint8_t		flags;
-	uint16_t	reserved1;
-	int8_t		gain[3];
-#define IWN_GAIN_SET	(1 << 2)
+struct iwn5000_phy_calib_crystal {
+	uint8_t	code;
+	uint8_t	group;
+	uint8_t	ngroups;
+	uint8_t	isvalid;
 
-	uint8_t		reserved2;
+	uint8_t	cap_pin[2];
+	uint8_t	reserved[2];
 } __packed;
 
+struct iwn_phy_calib_gain {
+	uint8_t	code;
+	uint8_t	group;
+	uint8_t	ngroups;
+	uint8_t	isvalid;
+
+	int8_t	gain[3];
+	uint8_t	reserved;
+} __packed;
 
-/* structure for IWN_UC_READY notification */
+/* Structure for command IWN_CMD_SPECTRUM_MEASUREMENT. */
+struct iwn_spectrum_cmd {
+	uint16_t	len;
+	uint8_t		token;
+	uint8_t		id;
+	uint8_t		origin;
+	uint8_t		periodic;
+	uint16_t	timeout;
+	uint32_t	start;
+	uint32_t	reserved1;
+	uint32_t	flags;
+	uint32_t	filter;
+	uint16_t	nchan;
+	uint16_t	reserved2;
+	struct {
+		uint32_t	duration;
+		uint8_t		chan;
+		uint8_t		type;
+#define IWN_MEASUREMENT_BASIC		(1 << 0)
+#define IWN_MEASUREMENT_CCA		(1 << 1)
+#define IWN_MEASUREMENT_RPI_HISTOGRAM	(1 << 2)
+#define IWN_MEASUREMENT_NOISE_HISTOGRAM	(1 << 3)
+#define IWN_MEASUREMENT_FRAME		(1 << 4)
+#define IWN_MEASUREMENT_IDLE		(1 << 7)
+
+		uint16_t	reserved;
+	} __packed	chan[10];
+} __packed;
+
+/* Structure for IWN_UC_READY notification. */
 #define IWN_NATTEN_GROUPS	5
 struct iwn_ucode_info {
 	uint8_t		minor;
@@ -623,25 +922,33 @@ struct iwn_ucode_info {
 
 	uint16_t	reserved2;
 	uint32_t	logptr;
-	uint32_t	errorptr;
+	uint32_t	errptr;
 	uint32_t	tstamp;
 	uint32_t	valid;
 
-	/* the following fields are for UCODE_INIT only */
+	/* The following fields are for UCODE_INIT only. */
 	int32_t		volt;
 	struct {
 		int32_t	chan20MHz;
 		int32_t	chan40MHz;
 	} __packed	temp[4];
-	int32_t		atten[IWN_NATTEN_GROUPS][IWN_NTXCHAINS];
+	int32_t		atten[IWN_NATTEN_GROUPS][2];
 } __packed;
 
-/* structure for IWN_TX_DONE notification */
-struct iwn_tx_stat {
+/* Structures for IWN_TX_DONE notification. */
+#define IWN_TX_SUCCESS			0x00
+#define IWN_TX_FAIL			0x80	/* all failures have 0x80 set */
+#define IWN_TX_FAIL_SHORT_LIMIT		0x82	/* too many RTS retries */
+#define IWN_TX_FAIL_LONG_LIMIT		0x83	/* too many retries */
+#define IWN_TX_FAIL_FIFO_UNDERRRUN	0x84	/* tx fifo not kept running */
+#define IWN_TX_FAIL_DEST_IN_PS		0x88	/* sta found in power save */
+#define IWN_TX_FAIL_TX_LOCKED		0x90	/* waiting to see traffic */
+
+struct iwn4965_tx_stat {
 	uint8_t		nframes;
-	uint8_t		nkill;
-	uint8_t		nrts;
-	uint8_t		ntries;
+	uint8_t		killcnt;
+	uint8_t		rtscnt;
+	uint8_t		retrycnt;
 	uint8_t		rate;
 	uint8_t		rflags;
 	uint16_t	xrflags;
@@ -649,16 +956,28 @@ struct iwn_tx_stat {
 	uint16_t	reserved;
 	uint32_t	power[2];
 	uint32_t	status;
-#define	IWN_TX_SUCCESS			0x00
-#define	IWN_TX_FAIL			0x80	/* all failures have 0x80 set */
-#define	IWN_TX_FAIL_SHORT_LIMIT		0x82	/* too many RTS retries */
-#define	IWN_TX_FAIL_LONG_LIMIT		0x83	/* too many retries */
-#define	IWN_TX_FAIL_FIFO_UNDERRRUN	0x84	/* tx fifo not kept running */
-#define	IWN_TX_FAIL_DEST_IN_PS		0x88	/* sta found in power save */
-#define	IWN_TX_FAIL_TX_LOCKED		0x90	/* waiting to see traffic */
 } __packed;
 
-/* structure for IWN_BEACON_MISSED notification */
+struct iwn5000_tx_stat {
+	uint8_t		nframes;
+	uint8_t		killcnt;
+	uint8_t		rtscnt;
+	uint8_t		retrycnt;
+	uint8_t		rate;
+	uint8_t		rflags;
+	uint16_t	xrflags;
+	uint16_t	duration;
+	uint16_t	reserved;
+	uint32_t	power[2];
+	uint32_t	info;
+	uint16_t	seq;
+	uint16_t	len;
+	uint32_t	tlc;
+	uint16_t	status;
+	uint16_t	sequence;
+} __packed;
+
+/* Structure for IWN_BEACON_MISSED notification. */
 struct iwn_beacon_missed {
 	uint32_t	consecutive;
 	uint32_t	total;
@@ -666,13 +985,25 @@ struct iwn_beacon_missed {
 	uint32_t	received;
 } __packed;
 
-/* structure for IWN_AMPDU_RX_DONE notification */
-struct iwn_rx_ampdu {
+/* Structure for IWN_MPDU_RX_DONE notification. */
+struct iwn_rx_mpdu {
 	uint16_t	len;
 	uint16_t	reserved;
 } __packed;
 
-/* structure for IWN_RX_DONE and IWN_AMPDU_RX_START notifications */
+/* Structures for IWN_RX_DONE and IWN_MPDU_RX_DONE notifications. */
+struct iwn4965_rx_phystat {
+	uint16_t	antenna;
+	uint16_t	agc;
+	uint8_t		rssi[6];
+} __packed;
+
+struct iwn5000_rx_phystat {
+	uint32_t	reserved1;
+	uint32_t	agc;
+	uint16_t	rssi[3];
+} __packed;
+
 struct iwn_rx_stat {
 	uint8_t		phy_len;
 	uint8_t		cfg_phy_len;
@@ -683,13 +1014,10 @@ struct iwn_rx_stat {
 	uint64_t	tstamp;
 	uint32_t	beacon;
 	uint16_t	flags;
-	uint16_t	chan;
-	uint16_t	antenna;
-	uint16_t	agc;
-	uint8_t		rssi[6];
-#define IWN_RSSI_TO_DBM	44
+#define IWN_STAT_FLAG_SHPREAMBLE	(1 << 2)
 
-	uint8_t		reserved2[22];
+	uint16_t	chan;
+	uint8_t		phybuf[32];
 	uint8_t		rate;
 	uint8_t		rflags;
 	uint16_t	xrflags;
@@ -697,7 +1025,9 @@ struct iwn_rx_stat {
 	uint16_t	reserve3;
 } __packed;
 
-/* structure for IWN_START_SCAN notification */
+#define IWN_RSSI_TO_DBM	44
+
+/* Structure for IWN_START_SCAN notification. */
 struct iwn_start_scan {
 	uint64_t	tstamp;
 	uint32_t	tbeacon;
@@ -707,7 +1037,7 @@ struct iwn_start_scan {
 	uint32_t	status;
 } __packed;
 
-/* structure for IWN_STOP_SCAN notification */
+/* Structure for IWN_STOP_SCAN notification. */
 struct iwn_stop_scan {
 	uint8_t		nchan;
 	uint8_t		status;
@@ -716,7 +1046,39 @@ struct iwn_stop_scan {
 	uint64_t	tsf;
 } __packed;
 
-/* structure for IWN_{RX,BEACON}_STATISTICS notification */
+/* Structure for IWN_SPECTRUM_MEASUREMENT notification. */
+struct iwn_spectrum_notif {
+	uint8_t		id;
+	uint8_t		token;
+	uint8_t		idx;
+	uint8_t		state;
+#define IWN_MEASUREMENT_START	0
+#define IWN_MEASUREMENT_STOP	1
+
+	uint32_t	start;
+	uint8_t		band;
+	uint8_t		chan;
+	uint8_t		type;
+	uint8_t		reserved1;
+	uint32_t	cca_ofdm;
+	uint32_t	cca_cck;
+	uint32_t	cca_time;
+	uint8_t		basic;
+	uint8_t		reserved2[3];
+	uint32_t	ofdm[8];
+	uint32_t	cck[8];
+	uint32_t	stop;
+	uint32_t	status;
+#define IWN_MEASUREMENT_OK		0
+#define IWN_MEASUREMENT_CONCURRENT	1
+#define IWN_MEASUREMENT_CSA_CONFLICT	2
+#define IWN_MEASUREMENT_TGH_CONFLICT	3
+#define IWN_MEASUREMENT_STOPPED		6
+#define IWN_MEASUREMENT_TIMEOUT		7
+#define IWN_MEASUREMENT_FAILED		8
+} __packed;
+
+/* Structure for IWN_{RX,BEACON}_STATISTICS notification. */
 struct iwn_rx_phy_stats {
 	uint32_t	ina;
 	uint32_t	fina;
@@ -833,7 +1195,20 @@ struct iwn_stats {
 } __packed;
 
 
-/* firmware image header */
+/* Firmware error dump. */
+struct iwn_fw_dump {
+	uint32_t	valid;
+	uint32_t	id;
+	uint32_t	pc;
+	uint32_t	branch_link[2];
+	uint32_t	interrupt_link[2];
+	uint32_t	error_data[2];
+	uint32_t	src_line;
+	uint32_t	tsf;
+	uint32_t	time[2];
+} __packed;
+
+/* Firmware image file header. */
 struct iwn_firmware_hdr {
 	uint32_t	version;
 	uint32_t	main_textsz;
@@ -843,36 +1218,58 @@ struct iwn_firmware_hdr {
 	uint32_t	boot_textsz;
 } __packed;
 
-#define IWN_FW_MAIN_TEXT_MAXSZ	(96 * 1024)
-#define IWN_FW_MAIN_DATA_MAXSZ	(40 * 1024)
-#define IWN_FW_INIT_TEXT_MAXSZ	(96 * 1024)
-#define IWN_FW_INIT_DATA_MAXSZ	(40 * 1024)
+#define IWN4965_FW_TEXT_MAXSZ	( 96 * 1024)
+#define IWN4965_FW_DATA_MAXSZ	( 40 * 1024)
+#define IWN5000_FW_TEXT_MAXSZ	(256 * 1024)
+#define IWN5000_FW_DATA_MAXSZ	( 80 * 1024)
 #define IWN_FW_BOOT_TEXT_MAXSZ	1024
-
+#define IWN4965_FWSZ		(IWN4965_FW_TEXT_MAXSZ + IWN4965_FW_DATA_MAXSZ)
+#define IWN5000_FWSZ		IWN5000_FW_TEXT_MAXSZ
 
 /*
  * Offsets into EEPROM.
  */
 #define IWN_EEPROM_MAC		0x015
-#define IWN_EEPROM_DOMAIN	0x060
-#define IWN_EEPROM_BAND1	0x063
-#define IWN_EEPROM_BAND2	0x072
-#define IWN_EEPROM_BAND3	0x080
-#define IWN_EEPROM_BAND4	0x08d
-#define IWN_EEPROM_BAND5	0x099
-#define IWN_EEPROM_BAND6	0x0a0
-#define IWN_EEPROM_BAND7	0x0a8
-#define IWN_EEPROM_MAXPOW	0x0e8
-#define IWN_EEPROM_VOLTAGE	0x0e9
-#define IWN_EEPROM_BANDS	0x0ea
+#define IWN_EEPROM_RFCFG	0x048
+#define IWN4965_EEPROM_DOMAIN	0x060
+#define IWN4965_EEPROM_BAND1	0x063
+#define IWN5000_EEPROM_REG	0x066
+#define IWN5000_EEPROM_CAL	0x067
+#define IWN4965_EEPROM_BAND2	0x072
+#define IWN4965_EEPROM_BAND3	0x080
+#define IWN4965_EEPROM_BAND4	0x08d
+#define IWN4965_EEPROM_BAND5	0x099
+#define IWN4965_EEPROM_BAND6	0x0a0
+#define IWN4965_EEPROM_BAND7	0x0a8
+#define IWN4965_EEPROM_MAXPOW	0x0e8
+#define IWN4965_EEPROM_VOLTAGE	0x0e9
+#define IWN4965_EEPROM_BANDS	0x0ea
+/* Indirect offsets. */
+#define IWN5000_EEPROM_DOMAIN	0x001
+#define IWN5000_EEPROM_BAND1	0x004
+#define IWN5000_EEPROM_BAND2	0x013
+#define IWN5000_EEPROM_BAND3	0x021
+#define IWN5000_EEPROM_BAND4	0x02e
+#define IWN5000_EEPROM_BAND5	0x03a
+#define IWN5000_EEPROM_BAND6	0x041
+#define IWN5000_EEPROM_BAND7	0x049
+#define IWN5000_EEPROM_CRYSTAL	0x128
+#define IWN5000_EEPROM_TEMP	0x12a
+#define IWN5000_EEPROM_VOLT	0x12b
+
+/* Possible flags for IWN_EEPROM_RFCFG. */
+#define IWN_RFCFG_TYPE(x)	(((x) >>  0) & 0x3)
+#define IWN_RFCFG_STEP(x)	(((x) >>  2) & 0x3)
+#define IWN_RFCFG_DASH(x)	(((x) >>  4) & 0x3)
+#define IWN_RFCFG_TXANTMSK(x)	(((x) >>  8) & 0xf)
+#define IWN_RFCFG_RXANTMSK(x)	(((x) >> 12) & 0xf)
 
 struct iwn_eeprom_chan {
 	uint8_t	flags;
 #define IWN_EEPROM_CHAN_VALID	(1 << 0)
-#define IWN_EEPROM_CHAN_IBSS	(1 << 1)	/* adhoc permitted */
-/* NB: bit 2 is reserved */
-#define IWN_EEPROM_CHAN_ACTIVE	(1 << 3)	/* active/passive scan */
-#define IWN_EEPROM_CHAN_RADAR	(1 << 4)	/* DFS required */
+#define IWN_EEPROM_CHAN_IBSS	(1 << 1)
+#define IWN_EEPROM_CHAN_ACTIVE	(1 << 3)
+#define IWN_EEPROM_CHAN_RADAR	(1 << 4)
 #define IWN_EEPROM_CHAN_WIDE	(1 << 5)	/* HT40 */
 #define IWN_EEPROM_CHAN_NARROW	(1 << 6)	/* HT20 */
 
@@ -880,30 +1277,100 @@ struct iwn_eeprom_chan {
 } __packed;
 
 #define IWN_NSAMPLES	3
-struct iwn_eeprom_chan_samples {
+struct iwn4965_eeprom_chan_samples {
 	uint8_t	num;
 	struct {
 		uint8_t temp;
 		uint8_t	gain;
 		uint8_t	power;
 		int8_t	pa_det;
-	}	samples[IWN_NTXCHAINS][IWN_NSAMPLES];
+	}	samples[2][IWN_NSAMPLES];
 } __packed;
 
 #define IWN_NBANDS	8
-struct iwn_eeprom_band {
+struct iwn4965_eeprom_band {
 	uint8_t	lo;	/* low channel number */
 	uint8_t	hi;	/* high channel number */
-	struct	iwn_eeprom_chan_samples chans[2];
+	struct	iwn4965_eeprom_chan_samples chans[2];
 } __packed;
 
-#define IWN_MAX_PWR_INDEX	107
+/*
+ * Offsets of channels descriptions in EEPROM.
+ */
+static const uint32_t iwn4965_regulatory_bands[IWN_NBANDS] = {
+	IWN4965_EEPROM_BAND1,
+	IWN4965_EEPROM_BAND2,
+	IWN4965_EEPROM_BAND3,
+	IWN4965_EEPROM_BAND4,
+	IWN4965_EEPROM_BAND5,
+	IWN4965_EEPROM_BAND6,
+	IWN4965_EEPROM_BAND7
+};
+
+static const uint32_t iwn5000_regulatory_bands[IWN_NBANDS] = {
+	IWN5000_EEPROM_BAND1,
+	IWN5000_EEPROM_BAND2,
+	IWN5000_EEPROM_BAND3,
+	IWN5000_EEPROM_BAND4,
+	IWN5000_EEPROM_BAND5,
+	IWN5000_EEPROM_BAND6,
+	IWN5000_EEPROM_BAND7
+};
+
+#define IWN_CHAN_BANDS_COUNT	 7
+#define IWN_MAX_CHAN_PER_BAND	14
+static const struct iwn_chan_band {
+	uint8_t	nchan;
+	uint8_t	chan[IWN_MAX_CHAN_PER_BAND];
+} iwn_bands[] = {
+	/* 20MHz channels, 2GHz band. */
+	{ 14, { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 } },
+	/* 20MHz channels, 5GHz band. */
+	{ 13, { 183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16 } },
+	{ 12, { 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64 } },
+	{ 11, { 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140 } },
+	{  6, { 145, 149, 153, 157, 161, 165 } },
+	/* 40MHz channels (primary channels), 2GHz band. */
+	{  7, { 1, 2, 3, 4, 5, 6, 7 } },
+	/* 40MHz channels (primary channels), 5GHz band. */
+	{ 11, { 36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157 } }
+};
+
+#define IWN_RIDX_MCS	0x08		/* or'd to indicate MCS */
+
+/* HW rate indices. */
+#define IWN_RIDX_CCK1	 0
+#define IWN_RIDX_CCK11	 3
+#define IWN_RIDX_OFDM6	 4
+#define IWN_RIDX_OFDM54	11
+
+static const struct iwn_rate {
+	uint8_t	rate;
+	uint8_t	plcp;
+	uint8_t	flags;
+} iwn_rates[IWN_RIDX_MAX + 1] = {
+	{   2,  10, IWN_RFLAG_CCK },
+	{   4,  20, IWN_RFLAG_CCK },
+	{  11,  55, IWN_RFLAG_CCK },
+	{  22, 110, IWN_RFLAG_CCK },
+	{  12, 0xd, 0 },
+	{  18, 0xf, 0 },
+	{  24, 0x5, 0 },
+	{  36, 0x7, 0 },
+	{  48, 0x9, 0 },
+	{  72, 0xb, 0 },
+	{  96, 0x1, 0 },
+	{ 108, 0x3, 0 },
+	{ 120, 0x3, 0 }
+};
+
+#define IWN4965_MAX_PWR_INDEX	107
 
 /*
  * RF Tx gain values from highest to lowest power (values obtained from
  * the reference driver.)
  */
-static const uint8_t iwn_rf_gain_2ghz[IWN_MAX_PWR_INDEX + 1] = {
+static const uint8_t iwn4965_rf_gain_2ghz[IWN4965_MAX_PWR_INDEX + 1] = {
 	0x3f, 0x3f, 0x3f, 0x3e, 0x3e, 0x3e, 0x3d, 0x3d, 0x3d, 0x3c, 0x3c,
 	0x3c, 0x3b, 0x3b, 0x3b, 0x3a, 0x3a, 0x3a, 0x39, 0x39, 0x39, 0x38,
 	0x38, 0x38, 0x37, 0x37, 0x37, 0x36, 0x36, 0x36, 0x35, 0x35, 0x35,
@@ -916,7 +1383,7 @@ static const uint8_t iwn_rf_gain_2ghz[IWN_MAX_PWR_INDEX + 1] = {
 	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
 };
 
-static const uint8_t iwn_rf_gain_5ghz[IWN_MAX_PWR_INDEX + 1] = {
+static const uint8_t iwn4965_rf_gain_5ghz[IWN4965_MAX_PWR_INDEX + 1] = {
 	0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x3e, 0x3e, 0x3e, 0x3d, 0x3d, 0x3d,
 	0x3c, 0x3c, 0x3c, 0x3b, 0x3b, 0x3b, 0x3a, 0x3a, 0x3a, 0x39, 0x39,
 	0x39, 0x38, 0x38, 0x38, 0x37, 0x37, 0x37, 0x36, 0x36, 0x36, 0x35,
@@ -933,7 +1400,7 @@ static const uint8_t iwn_rf_gain_5ghz[IWN_MAX_PWR_INDEX + 1] = {
  * DSP pre-DAC gain values from highest to lowest power (values obtained
  * from the reference driver.)
  */
-static const uint8_t iwn_dsp_gain_2ghz[IWN_MAX_PWR_INDEX + 1] = {
+static const uint8_t iwn4965_dsp_gain_2ghz[IWN4965_MAX_PWR_INDEX + 1] = {
 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
@@ -946,7 +1413,7 @@ static const uint8_t iwn_dsp_gain_2ghz[IWN_MAX_PWR_INDEX + 1] = {
 	0x43, 0x42, 0x41, 0x40, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b
 };
 
-static const uint8_t iwn_dsp_gain_5ghz[IWN_MAX_PWR_INDEX + 1] = {
+static const uint8_t iwn4965_dsp_gain_5ghz[IWN4965_MAX_PWR_INDEX + 1] = {
 	0x7b, 0x75, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62,
 	0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68,
 	0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e, 0x68, 0x62, 0x6e,
@@ -959,12 +1426,140 @@ static const uint8_t iwn_dsp_gain_5ghz[IWN_MAX_PWR_INDEX + 1] = {
 	0x68, 0x62, 0x6e, 0x68, 0x62, 0x5d, 0x58, 0x53, 0x4e
 };
 
+/*
+ * Power saving settings (values obtained from the reference driver.)
+ */
+#define IWN_NDTIMRANGES		3
+#define IWN_NPOWERLEVELS	6
+static const struct iwn_pmgt {
+	uint32_t	rxtimeout;
+	uint32_t	txtimeout;
+	uint32_t	intval[5];
+	int		skip_dtim;
+} iwn_pmgt[IWN_NDTIMRANGES][IWN_NPOWERLEVELS] = {
+	/* DTIM <= 2 */
+	{
+	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
+	{ 200, 500, {  1,  2,  2,  2, -1 }, 0 },	/* PS level 1 */
+	{ 200, 300, {  1,  2,  2,  2, -1 }, 0 },	/* PS level 2 */
+	{  50, 100, {  2,  2,  2,  2, -1 }, 0 },	/* PS level 3 */
+	{  50,  25, {  2,  2,  4,  4, -1 }, 1 },	/* PS level 4 */
+	{  25,  25, {  2,  2,  4,  6, -1 }, 2 }		/* PS level 5 */
+	},
+	/* 3 <= DTIM <= 10 */
+	{
+	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
+	{ 200, 500, {  1,  2,  3,  4,  4 }, 0 },	/* PS level 1 */
+	{ 200, 300, {  1,  2,  3,  4,  7 }, 0 },	/* PS level 2 */
+	{  50, 100, {  2,  4,  6,  7,  9 }, 0 },	/* PS level 3 */
+	{  50,  25, {  2,  4,  6,  9, 10 }, 1 },	/* PS level 4 */
+	{  25,  25, {  2,  4,  7, 10, 10 }, 2 }		/* PS level 5 */
+	},
+	/* DTIM >= 11 */
+	{
+	{   0,   0, {  0,  0,  0,  0,  0 }, 0 },	/* CAM */
+	{ 200, 500, {  1,  2,  3,  4, -1 }, 0 },	/* PS level 1 */
+	{ 200, 300, {  2,  4,  6,  7, -1 }, 0 },	/* PS level 2 */
+	{  50, 100, {  2,  7,  9,  9, -1 }, 0 },	/* PS level 3 */
+	{  50,  25, {  2,  7,  9,  9, -1 }, 0 },	/* PS level 4 */
+	{  25,  25, {  4,  7, 10, 10, -1 }, 0 }		/* PS level 5 */
+	}
+};
+
+struct iwn_sensitivity_limits {
+	uint32_t	min_ofdm_x1;
+	uint32_t	max_ofdm_x1;
+	uint32_t	min_ofdm_mrc_x1;
+	uint32_t	max_ofdm_mrc_x1;
+	uint32_t	min_ofdm_x4;
+	uint32_t	max_ofdm_x4;
+	uint32_t	min_ofdm_mrc_x4;
+	uint32_t	max_ofdm_mrc_x4;
+	uint32_t	min_cck_x4;
+	uint32_t	max_cck_x4;
+	uint32_t	min_cck_mrc_x4;
+	uint32_t	max_cck_mrc_x4;
+	uint32_t	min_energy_cck;
+	uint32_t	energy_cck;
+	uint32_t	energy_ofdm;
+};
+
+/*
+ * RX sensitivity limits (values obtained from the reference driver.)
+ */
+static const struct iwn_sensitivity_limits iwn4965_sensitivity_limits = {
+	105, 140,
+	170, 210,
+	 85, 120,
+	170, 210,
+	125, 200,
+	200, 400,
+	 97,
+	100,
+	100
+};
+
+static const struct iwn_sensitivity_limits iwn5000_sensitivity_limits = {
+	120, 155,
+	240, 290,
+	 90, 120,
+	170, 210,
+	125, 200,
+	170, 400,
+	 95,
+	 95,
+	 95
+};
+
+/* Map TID to TX scheduler's FIFO. */
+static const uint8_t iwn_tid2fifo[] = {
+	1, 0, 0, 1, 2, 2, 3, 3, 7, 7, 7, 7, 7, 7, 7, 7, 3
+};
+
+/* Firmware errors. */
+static const char * const iwn_fw_errmsg[] = {
+	"OK",
+	"FAIL",
+	"BAD_PARAM",
+	"BAD_CHECKSUM",
+	"NMI_INTERRUPT_WDG",
+	"SYSASSERT",
+	"FATAL_ERROR",
+	"BAD_COMMAND",
+	"HW_ERROR_TUNE_LOCK",
+	"HW_ERROR_TEMPERATURE",
+	"ILLEGAL_CHAN_FREQ",
+	"VCC_NOT_STABLE",
+	"FH_ERROR",
+	"NMI_INTERRUPT_HOST",
+	"NMI_INTERRUPT_ACTION_PT",
+	"NMI_INTERRUPT_UNKNOWN",
+	"UCODE_VERSION_MISMATCH",
+	"HW_ERROR_ABS_LOCK",
+	"HW_ERROR_CAL_LOCK_FAIL",
+	"NMI_INTERRUPT_INST_ACTION_PT",
+	"NMI_INTERRUPT_DATA_ACTION_PT",
+	"NMI_TRM_HW_ER",
+	"NMI_INTERRUPT_TRM",
+	"NMI_INTERRUPT_BREAKPOINT"
+	"DEBUG_0",
+	"DEBUG_1",
+	"DEBUG_2",
+	"DEBUG_3",
+	"UNKNOWN"
+};
+
+/* Find least significant bit that is set. */
+#define IWN_LSB(x)	((((x) - 1) & (x)) ^ (x))
+
 #define IWN_READ(sc, reg)						\
 	bus_space_read_4((sc)->sc_st, (sc)->sc_sh, (reg))
 
 #define IWN_WRITE(sc, reg, val)						\
 	bus_space_write_4((sc)->sc_st, (sc)->sc_sh, (reg), (val))
 
-#define IWN_WRITE_REGION_4(sc, offset, datap, count)			\
-	bus_space_write_region_4((sc)->sc_st, (sc)->sc_sh, (offset),	\
-	    (datap), (count))
+#define IWN_SETBITS(sc, reg, mask)					\
+	IWN_WRITE(sc, reg, IWN_READ(sc, reg) | (mask))
+
+#define IWN_CLRBITS(sc, reg, mask)					\
+	IWN_WRITE(sc, reg, IWN_READ(sc, reg) & ~(mask))
diff --git a/sys/dev/iwn/if_iwnvar.h b/sys/dev/iwn/if_iwnvar.h
index 19cc025..a5fb31f 100644
--- a/sys/dev/iwn/if_iwnvar.h
+++ b/sys/dev/iwn/if_iwnvar.h
@@ -1,6 +1,8 @@
 /*	$FreeBSD$	*/
+/*	$OpenBSD: if_iwnvar.h,v 1.12 2009/05/29 08:25:45 damien Exp $	*/
+
 /*-
- * Copyright (c) 2007
+ * Copyright (c) 2007, 2008
  *	Damien Bergamini <damien.bergamini@free.fr>
  * Copyright (c) 2008 Sam Leffler, Errno Consulting
  *
@@ -60,6 +62,8 @@ struct iwn_dma_info {
 
 struct iwn_tx_data {
 	bus_dmamap_t		map;
+	bus_addr_t		cmd_paddr;
+	bus_addr_t		scratch_paddr;
 	struct mbuf		*m;
 	struct ieee80211_node	*ni;
 };
@@ -70,45 +74,52 @@ struct iwn_tx_ring {
 	struct iwn_tx_desc	*desc;
 	struct iwn_tx_cmd	*cmd;
 	struct iwn_tx_data	data[IWN_TX_RING_COUNT];
-	bus_dma_tag_t		data_dmat;
 	int			qid;
 	int			queued;
 	int			cur;
 };
 
+struct iwn_softc;
+
 struct iwn_rx_data {
-	bus_dmamap_t		map;
-	struct mbuf		*m;
+	struct mbuf	*m;
+	bus_dmamap_t	map;
 };
 
 struct iwn_rx_ring {
 	struct iwn_dma_info	desc_dma;
+	struct iwn_dma_info	stat_dma;
 	uint32_t		*desc;
+	struct iwn_rx_status	*stat;
 	struct iwn_rx_data	data[IWN_RX_RING_COUNT];
-	bus_dma_tag_t		data_dmat;
 	int			cur;
 };
 
 struct iwn_node {
 	struct	ieee80211_node		ni;	/* must be the first */
+#define	IWN_NODE(_ni)	((struct iwn_node *)(_ni))
+
 	struct	ieee80211_amrr_node	amn;
+	uint16_t			disable_tid;
+	uint8_t				id;
+	uint8_t				ridx[IEEE80211_RATE_MAXSIZE];
 };
-#define	IWN_NODE(_ni)	((struct iwn_node *)(_ni))
 
 struct iwn_calib_state {
 	uint8_t		state;
 #define IWN_CALIB_STATE_INIT	0
 #define IWN_CALIB_STATE_ASSOC	1
 #define IWN_CALIB_STATE_RUN	2
+
 	u_int		nbeacons;
 	uint32_t	noise[3];
 	uint32_t	rssi[3];
-	uint32_t	corr_ofdm_x1;
-	uint32_t	corr_ofdm_mrc_x1;
-	uint32_t	corr_ofdm_x4;
-	uint32_t	corr_ofdm_mrc_x4;
-	uint32_t	corr_cck_x4;
-	uint32_t	corr_cck_mrc_x4;
+	uint32_t	ofdm_x1;
+	uint32_t	ofdm_mrc_x1;
+	uint32_t	ofdm_x4;
+	uint32_t	ofdm_mrc_x4;
+	uint32_t	cck_x4;
+	uint32_t	cck_mrc_x4;
 	uint32_t	bad_plcp_ofdm;
 	uint32_t	fa_ofdm;
 	uint32_t	bad_plcp_cck;
@@ -118,6 +129,7 @@ struct iwn_calib_state {
 #define IWN_CCK_STATE_INIT	0
 #define IWN_CCK_STATE_LOFA	1
 #define IWN_CCK_STATE_HIFA	2
+
 	uint8_t		noise_samples[20];
 	u_int		cur_noise_sample;
 	uint8_t		noise_ref;
@@ -126,10 +138,60 @@ struct iwn_calib_state {
 	uint32_t	energy_cck;
 };
 
+struct iwn_calib_info {
+	uint8_t		*buf;
+	u_int		len;
+};
+
+struct iwn_fw_part {
+	const uint8_t	*text;
+	uint32_t	textsz;
+	const uint8_t	*data;
+	uint32_t	datasz;
+};
+
+struct iwn_fw_info {
+	u_char			*data;
+	struct iwn_fw_part	init;
+	struct iwn_fw_part	main;
+	struct iwn_fw_part	boot;
+};
+
+struct iwn_hal {
+	int		(*load_firmware)(struct iwn_softc *);
+	void		(*read_eeprom)(struct iwn_softc *);
+	int		(*post_alive)(struct iwn_softc *);
+	int		(*apm_init)(struct iwn_softc *);
+	int		(*nic_config)(struct iwn_softc *);
+	void		(*update_sched)(struct iwn_softc *, int, int, uint8_t,
+			    uint16_t);
+	int		(*get_temperature)(struct iwn_softc *);
+	int		(*get_rssi)(struct iwn_softc *, struct iwn_rx_stat *);
+	int		(*set_txpower)(struct iwn_softc *,
+			    struct ieee80211_channel *, int);
+	int		(*init_gains)(struct iwn_softc *);
+	int		(*set_gains)(struct iwn_softc *);
+	int		(*add_node)(struct iwn_softc *, struct iwn_node_info *,
+			    int);
+	void		(*tx_done)(struct iwn_softc *, struct iwn_rx_desc *,
+			    struct iwn_rx_data *);
+	const struct	iwn_sensitivity_limits *limits;
+	int		ntxqs;
+	int		ndmachnls;
+	uint8_t		broadcast_id;
+	int		rxonsz;
+	int		schedsz;
+	uint32_t	fw_text_maxsz;
+	uint32_t	fw_data_maxsz;
+	uint32_t	fwsz;
+	bus_size_t	sched_txfact_addr;
+};
+
 struct iwn_vap {
 	struct ieee80211vap	iv_vap;
 	struct ieee80211_amrr	iv_amrr;
 	struct callout		iv_amrr_to;
+	uint8_t			iv_ridx;
 
 	int			(*iv_newstate)(struct ieee80211vap *,
 				    enum ieee80211_state, int);
@@ -139,67 +201,94 @@ struct iwn_vap {
 struct iwn_softc {
 	struct ifnet		*sc_ifp;
 	int			sc_debug;
-	struct callout		sc_timer_to;	/* calib+watchdog timer */
-	int			sc_tx_timer;	/* tx watchdog timer/counter */
-	const struct ieee80211_channel *sc_curchan;
-
-        struct iwn_rx_radiotap_header sc_rxtap;
-        struct iwn_tx_radiotap_header sc_txtap;
 
 	/* locks */
 	struct mtx		sc_mtx;
 
-	/* bus */
+	/* Bus */
 	device_t 		sc_dev;
 	int			mem_rid;
 	int			irq_rid;
 	struct resource 	*mem;
 	struct resource		*irq;
 
-	/* shared area */
-	struct iwn_dma_info	shared_dma;
-	struct iwn_shared	*shared;
+	u_int			sc_flags;
+#define IWN_FLAG_HAS_5GHZ	(1 << 0)
+#define IWN_FLAG_HAS_OTPROM	(1 << 1)
+#define IWN_FLAG_FIRST_BOOT	(1 << 2)
 
-	/* "keep warm" page */
+	uint8_t 		hw_type;
+	const struct iwn_hal	*sc_hal;
+	const char		*fwname;
+
+	/* TX scheduler rings. */
+	struct iwn_dma_info	sched_dma;
+	uint16_t		*sched;
+	uint32_t		sched_base;
+
+	/* "Keep Warm" page. */
 	struct iwn_dma_info	kw_dma;
 
-	/* firmware image */
+	/* Firmware image. */
 	const struct firmware	*fw_fp;
 
-	/* firmware DMA transfer */
+	/* Firmware DMA transfer. */
 	struct iwn_dma_info	fw_dma;
 
-	/* rings */
-	struct iwn_tx_ring	txq[IWN_NTXQUEUES];
+	/* TX/RX rings. */
+	struct iwn_tx_ring	txq[IWN5000_NTXQUEUES];
 	struct iwn_rx_ring	rxq;
 
 	bus_space_tag_t		sc_st;
 	bus_space_handle_t	sc_sh;
 	void 			*sc_ih;
 	bus_size_t		sc_sz;
+	int			sc_cap_off;	/* PCIe Capabilities. */
 
 	/* Tasks used by the driver */
 	struct task             sc_reinit_task;
 	struct task		sc_radioon_task;
 	struct task		sc_radiooff_task;
-
-	/* Thermal calibration */
+	
 	int			calib_cnt;
 	struct iwn_calib_state	calib;
 
+	struct iwn_fw_info	fw;
+	struct iwn_calib_info	calibcmd[5];
+	uint32_t		errptr;
+
 	struct iwn_rx_stat	last_rx_stat;
 	int			last_rx_valid;
 	struct iwn_ucode_info	ucode_info;
-	struct iwn_config	config;
+	struct iwn_rxon		rxon;
 	uint32_t		rawtemp;
 	int			temp;
 	int			noise;
-	uint8_t			antmsk;
+	uint32_t		qfullmsk;
 
-	struct iwn_eeprom_band	bands[IWN_NBANDS];
+	struct iwn4965_eeprom_band
+				bands[IWN_NBANDS];
+	uint16_t		rfcfg;
+	char			eeprom_domain[4];
+	uint32_t		eeprom_crystal;
 	int16_t			eeprom_voltage;
 	int8_t			maxpwr2GHz;
 	int8_t			maxpwr5GHz;
+	int8_t			maxpwr[IEEE80211_CHAN_MAX];
+
+	uint32_t		critical_temp;
+	uint8_t			ntxchains;
+	uint8_t			nrxchains;
+	uint8_t			txantmsk;
+	uint8_t			rxantmsk;
+	uint8_t			antmsk;
+
+	struct callout		sc_timer_to;
+	int			sc_tx_timer;
+
+	struct iwn_rx_radiotap_header sc_rxtap;
+	struct iwn_tx_radiotap_header sc_txtap;
+	const struct ieee80211_channel *sc_curchan;
 };
 
 #define IWN_LOCK_INIT(_sc) \