Home | History | Annotate | Download | only in iwk
      1 /*
      2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
      3  * Use is subject to license terms.
      4  */
      5 
      6 /*
      7  * Copyright (c) 2007, Intel Corporation
      8  * All rights reserved.
      9  */
     10 
     11 /*
     12  * Copyright (c) 2006
     13  * Copyright (c) 2007
     14  *	Damien Bergamini <damien.bergamini (at) free.fr>
     15  *
     16  * Permission to use, copy, modify, and distribute this software for any
     17  * purpose with or without fee is hereby granted, provided that the above
     18  * copyright notice and this permission notice appear in all copies.
     19  *
     20  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     21  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     22  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     23  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     24  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     25  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     26  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     27  */
     28 
     29 /*
     30  * Driver for Intel PRO/Wireless 4965AGN(kedron) 802.11 network adapters.
     31  */
     32 
     33 #include <sys/types.h>
     34 #include <sys/byteorder.h>
     35 #include <sys/conf.h>
     36 #include <sys/cmn_err.h>
     37 #include <sys/stat.h>
     38 #include <sys/ddi.h>
     39 #include <sys/sunddi.h>
     40 #include <sys/strsubr.h>
     41 #include <sys/ethernet.h>
     42 #include <inet/common.h>
     43 #include <inet/nd.h>
     44 #include <inet/mi.h>
     45 #include <sys/note.h>
     46 #include <sys/stream.h>
     47 #include <sys/strsun.h>
     48 #include <sys/modctl.h>
     49 #include <sys/devops.h>
     50 #include <sys/dlpi.h>
     51 #include <sys/mac_provider.h>
     52 #include <sys/mac_wifi.h>
     53 #include <sys/net80211.h>
     54 #include <sys/net80211_proto.h>
     55 #include <sys/varargs.h>
     56 #include <sys/policy.h>
     57 #include <sys/pci.h>
     58 
     59 #include "iwk_calibration.h"
     60 #include "iwk_hw.h"
     61 #include "iwk_eeprom.h"
     62 #include "iwk2_var.h"
     63 #include <inet/wifi_ioctl.h>
     64 
     65 #ifdef DEBUG
     66 #define	IWK_DEBUG_80211		(1 << 0)
     67 #define	IWK_DEBUG_CMD		(1 << 1)
     68 #define	IWK_DEBUG_DMA		(1 << 2)
     69 #define	IWK_DEBUG_EEPROM	(1 << 3)
     70 #define	IWK_DEBUG_FW		(1 << 4)
     71 #define	IWK_DEBUG_HW		(1 << 5)
     72 #define	IWK_DEBUG_INTR		(1 << 6)
     73 #define	IWK_DEBUG_MRR		(1 << 7)
     74 #define	IWK_DEBUG_PIO		(1 << 8)
     75 #define	IWK_DEBUG_RX		(1 << 9)
     76 #define	IWK_DEBUG_SCAN		(1 << 10)
     77 #define	IWK_DEBUG_TX		(1 << 11)
     78 #define	IWK_DEBUG_RATECTL	(1 << 12)
     79 #define	IWK_DEBUG_RADIO		(1 << 13)
     80 #define	IWK_DEBUG_RESUME	(1 << 14)
     81 #define	IWK_DEBUG_CALIBRATION	(1 << 15)
     82 uint32_t iwk_dbg_flags = 0;
     83 #define	IWK_DBG(x) \
     84 	iwk_dbg x
     85 #else
     86 #define	IWK_DBG(x)
     87 #endif
     88 
     89 static void	*iwk_soft_state_p = NULL;
     90 static uint8_t iwk_fw_bin [] = {
     91 #include "fw-iw/iw4965.ucode.hex"
     92 };
     93 
     94 /* DMA attributes for a shared page */
     95 static ddi_dma_attr_t sh_dma_attr = {
     96 	DMA_ATTR_V0,	/* version of this structure */
     97 	0,		/* lowest usable address */
     98 	0xffffffffU,	/* highest usable address */
     99 	0xffffffffU,	/* maximum DMAable byte count */
    100 	0x1000,		/* alignment in bytes */
    101 	0x1000,		/* burst sizes (any?) */
    102 	1,		/* minimum transfer */
    103 	0xffffffffU,	/* maximum transfer */
    104 	0xffffffffU,	/* maximum segment length */
    105 	1,		/* maximum number of segments */
    106 	1,		/* granularity */
    107 	0,		/* flags (reserved) */
    108 };
    109 
    110 /* DMA attributes for a keep warm DRAM descriptor */
    111 static ddi_dma_attr_t kw_dma_attr = {
    112 	DMA_ATTR_V0,	/* version of this structure */
    113 	0,		/* lowest usable address */
    114 	0xffffffffU,	/* highest usable address */
    115 	0xffffffffU,	/* maximum DMAable byte count */
    116 	0x1000,		/* alignment in bytes */
    117 	0x1000,		/* burst sizes (any?) */
    118 	1,		/* minimum transfer */
    119 	0xffffffffU,	/* maximum transfer */
    120 	0xffffffffU,	/* maximum segment length */
    121 	1,		/* maximum number of segments */
    122 	1,		/* granularity */
    123 	0,		/* flags (reserved) */
    124 };
    125 
    126 /* DMA attributes for a ring descriptor */
    127 static ddi_dma_attr_t ring_desc_dma_attr = {
    128 	DMA_ATTR_V0,	/* version of this structure */
    129 	0,		/* lowest usable address */
    130 	0xffffffffU,	/* highest usable address */
    131 	0xffffffffU,	/* maximum DMAable byte count */
    132 	0x100,		/* alignment in bytes */
    133 	0x100,		/* burst sizes (any?) */
    134 	1,		/* minimum transfer */
    135 	0xffffffffU,	/* maximum transfer */
    136 	0xffffffffU,	/* maximum segment length */
    137 	1,		/* maximum number of segments */
    138 	1,		/* granularity */
    139 	0,		/* flags (reserved) */
    140 };
    141 
    142 /* DMA attributes for a cmd */
    143 static ddi_dma_attr_t cmd_dma_attr = {
    144 	DMA_ATTR_V0,	/* version of this structure */
    145 	0,		/* lowest usable address */
    146 	0xffffffffU,	/* highest usable address */
    147 	0xffffffffU,	/* maximum DMAable byte count */
    148 	4,		/* alignment in bytes */
    149 	0x100,		/* burst sizes (any?) */
    150 	1,		/* minimum transfer */
    151 	0xffffffffU,	/* maximum transfer */
    152 	0xffffffffU,	/* maximum segment length */
    153 	1,		/* maximum number of segments */
    154 	1,		/* granularity */
    155 	0,		/* flags (reserved) */
    156 };
    157 
    158 /* DMA attributes for a rx buffer */
    159 static ddi_dma_attr_t rx_buffer_dma_attr = {
    160 	DMA_ATTR_V0,	/* version of this structure */
    161 	0,		/* lowest usable address */
    162 	0xffffffffU,	/* highest usable address */
    163 	0xffffffffU,	/* maximum DMAable byte count */
    164 	0x100,		/* alignment in bytes */
    165 	0x100,		/* burst sizes (any?) */
    166 	1,		/* minimum transfer */
    167 	0xffffffffU,	/* maximum transfer */
    168 	0xffffffffU,	/* maximum segment length */
    169 	1,		/* maximum number of segments */
    170 	1,		/* granularity */
    171 	0,		/* flags (reserved) */
    172 };
    173 
    174 /*
    175  * DMA attributes for a tx buffer.
    176  * the maximum number of segments is 4 for the hardware.
    177  * now all the wifi drivers put the whole frame in a single
    178  * descriptor, so we define the maximum  number of segments 1,
    179  * just the same as the rx_buffer. we consider leverage the HW
    180  * ability in the future, that is why we don't define rx and tx
    181  * buffer_dma_attr as the same.
    182  */
    183 static ddi_dma_attr_t tx_buffer_dma_attr = {
    184 	DMA_ATTR_V0,	/* version of this structure */
    185 	0,		/* lowest usable address */
    186 	0xffffffffU,	/* highest usable address */
    187 	0xffffffffU,	/* maximum DMAable byte count */
    188 	4,		/* alignment in bytes */
    189 	0x100,		/* burst sizes (any?) */
    190 	1,		/* minimum transfer */
    191 	0xffffffffU,	/* maximum transfer */
    192 	0xffffffffU,	/* maximum segment length */
    193 	1,		/* maximum number of segments */
    194 	1,		/* granularity */
    195 	0,		/* flags (reserved) */
    196 };
    197 
    198 /* DMA attributes for text and data part in the firmware */
    199 static ddi_dma_attr_t fw_dma_attr = {
    200 	DMA_ATTR_V0,	/* version of this structure */
    201 	0,		/* lowest usable address */
    202 	0xffffffffU,	/* highest usable address */
    203 	0x7fffffff,	/* maximum DMAable byte count */
    204 	0x10,		/* alignment in bytes */
    205 	0x100,		/* burst sizes (any?) */
    206 	1,		/* minimum transfer */
    207 	0xffffffffU,	/* maximum transfer */
    208 	0xffffffffU,	/* maximum segment length */
    209 	1,		/* maximum number of segments */
    210 	1,		/* granularity */
    211 	0,		/* flags (reserved) */
    212 };
    213 
    214 
    215 /* regs access attributes */
    216 static ddi_device_acc_attr_t iwk_reg_accattr = {
    217 	DDI_DEVICE_ATTR_V0,
    218 	DDI_STRUCTURE_LE_ACC,
    219 	DDI_STRICTORDER_ACC,
    220 	DDI_DEFAULT_ACC
    221 };
    222 
    223 /* DMA access attributes for Descriptor */
    224 static ddi_device_acc_attr_t iwk_dma_descattr = {
    225 	DDI_DEVICE_ATTR_V0,
    226 	DDI_STRUCTURE_LE_ACC,
    227 	DDI_STRICTORDER_ACC,
    228 	DDI_DEFAULT_ACC
    229 };
    230 
    231 /* DMA access attributes */
    232 static ddi_device_acc_attr_t iwk_dma_accattr = {
    233 	DDI_DEVICE_ATTR_V0,
    234 	DDI_NEVERSWAP_ACC,
    235 	DDI_STRICTORDER_ACC,
    236 	DDI_DEFAULT_ACC
    237 };
    238 
    239 static int	iwk_ring_init(iwk_sc_t *);
    240 static void	iwk_ring_free(iwk_sc_t *);
    241 static int	iwk_alloc_shared(iwk_sc_t *);
    242 static void	iwk_free_shared(iwk_sc_t *);
    243 static int	iwk_alloc_kw(iwk_sc_t *);
    244 static void	iwk_free_kw(iwk_sc_t *);
    245 static int	iwk_alloc_fw_dma(iwk_sc_t *);
    246 static void	iwk_free_fw_dma(iwk_sc_t *);
    247 static int	iwk_alloc_rx_ring(iwk_sc_t *);
    248 static void	iwk_reset_rx_ring(iwk_sc_t *);
    249 static void	iwk_free_rx_ring(iwk_sc_t *);
    250 static int	iwk_alloc_tx_ring(iwk_sc_t *, iwk_tx_ring_t *,
    251     int, int);
    252 static void	iwk_reset_tx_ring(iwk_sc_t *, iwk_tx_ring_t *);
    253 static void	iwk_free_tx_ring(iwk_sc_t *, iwk_tx_ring_t *);
    254 
    255 static ieee80211_node_t *iwk_node_alloc(ieee80211com_t *);
    256 static void	iwk_node_free(ieee80211_node_t *);
    257 static int	iwk_newstate(ieee80211com_t *, enum ieee80211_state, int);
    258 static int	iwk_key_set(ieee80211com_t *, const struct ieee80211_key *,
    259     const uint8_t mac[IEEE80211_ADDR_LEN]);
    260 static void	iwk_mac_access_enter(iwk_sc_t *);
    261 static void	iwk_mac_access_exit(iwk_sc_t *);
    262 static uint32_t	iwk_reg_read(iwk_sc_t *, uint32_t);
    263 static void	iwk_reg_write(iwk_sc_t *, uint32_t, uint32_t);
    264 static void	iwk_reg_write_region_4(iwk_sc_t *, uint32_t,
    265 		    uint32_t *, int);
    266 static int	iwk_load_firmware(iwk_sc_t *);
    267 static void	iwk_rx_intr(iwk_sc_t *, iwk_rx_desc_t *,
    268 		    iwk_rx_data_t *);
    269 static void	iwk_tx_intr(iwk_sc_t *, iwk_rx_desc_t *,
    270 		    iwk_rx_data_t *);
    271 static void	iwk_cmd_intr(iwk_sc_t *, iwk_rx_desc_t *);
    272 static uint_t   iwk_intr(caddr_t, caddr_t);
    273 static int	iwk_eep_load(iwk_sc_t *sc);
    274 static void	iwk_get_mac_from_eep(iwk_sc_t *sc);
    275 static int	iwk_eep_sem_down(iwk_sc_t *sc);
    276 static void	iwk_eep_sem_up(iwk_sc_t *sc);
    277 static uint_t   iwk_rx_softintr(caddr_t, caddr_t);
    278 static uint8_t	iwk_rate_to_plcp(int);
    279 static int	iwk_cmd(iwk_sc_t *, int, const void *, int, int);
    280 static void	iwk_set_led(iwk_sc_t *, uint8_t, uint8_t, uint8_t);
    281 static int	iwk_hw_set_before_auth(iwk_sc_t *);
    282 static int	iwk_scan(iwk_sc_t *);
    283 static int	iwk_config(iwk_sc_t *);
    284 static void	iwk_stop_master(iwk_sc_t *);
    285 static int	iwk_power_up(iwk_sc_t *);
    286 static int	iwk_preinit(iwk_sc_t *);
    287 static int	iwk_init(iwk_sc_t *);
    288 static void	iwk_stop(iwk_sc_t *);
    289 static void	iwk_amrr_init(iwk_amrr_t *);
    290 static void	iwk_amrr_timeout(iwk_sc_t *);
    291 static void	iwk_amrr_ratectl(void *, ieee80211_node_t *);
    292 static int32_t	iwk_curr_tempera(iwk_sc_t *sc);
    293 static int	iwk_tx_power_calibration(iwk_sc_t *sc);
    294 static inline int	iwk_is_24G_band(iwk_sc_t *sc);
    295 static inline int	iwk_is_fat_channel(iwk_sc_t *sc);
    296 static int	iwk_txpower_grp(uint16_t channel);
    297 static struct	iwk_eep_channel *iwk_get_eep_channel(iwk_sc_t *sc,
    298     uint16_t channel,
    299     int is_24G, int is_fat, int is_hi_chan);
    300 static int32_t	iwk_band_number(iwk_sc_t *sc, uint16_t channel);
    301 static int	iwk_division(int32_t num, int32_t denom, int32_t *res);
    302 static int32_t	iwk_interpolate_value(int32_t x, int32_t x1, int32_t y1,
    303     int32_t x2, int32_t y2);
    304 static int	iwk_channel_interpolate(iwk_sc_t *sc, uint16_t channel,
    305     struct iwk_eep_calib_channel_info *chan_info);
    306 static int32_t	iwk_voltage_compensation(int32_t eep_voltage,
    307     int32_t curr_voltage);
    308 static int32_t	iwk_min_power_index(int32_t rate_pow_idx, int32_t is_24G);
    309 static int	iwk_txpower_table_cmd_init(iwk_sc_t *sc,
    310     struct iwk_tx_power_db *tp_db);
    311 static void	iwk_statistics_notify(iwk_sc_t *sc, iwk_rx_desc_t *desc);
    312 static int	iwk_is_associated(iwk_sc_t *sc);
    313 static int	iwk_rxgain_diff_init(iwk_sc_t *sc);
    314 static int	iwk_rxgain_diff(iwk_sc_t *sc);
    315 static int	iwk_rx_sens_init(iwk_sc_t *sc);
    316 static int	iwk_rx_sens(iwk_sc_t *sc);
    317 static int	iwk_cck_sens(iwk_sc_t *sc, uint32_t actual_rx_time);
    318 static int	iwk_ofdm_sens(iwk_sc_t *sc, uint32_t actual_rx_time);
    319 static void	iwk_recv_mgmt(struct ieee80211com *ic, mblk_t *mp,
    320     struct ieee80211_node *in, int subtype, int rssi, uint32_t rstamp);
    321 
    322 static void	iwk_write_event_log(iwk_sc_t *);
    323 static void	iwk_write_error_log(iwk_sc_t *);
    324 
    325 static int	iwk_attach(dev_info_t *dip, ddi_attach_cmd_t cmd);
    326 static int	iwk_detach(dev_info_t *dip, ddi_detach_cmd_t cmd);
    327 static int	iwk_quiesce(dev_info_t *dip);
    328 
    329 /*
    330  * GLD specific operations
    331  */
    332 static int	iwk_m_stat(void *arg, uint_t stat, uint64_t *val);
    333 static int	iwk_m_start(void *arg);
    334 static void	iwk_m_stop(void *arg);
    335 static int	iwk_m_unicst(void *arg, const uint8_t *macaddr);
    336 static int	iwk_m_multicst(void *arg, boolean_t add, const uint8_t *m);
    337 static int	iwk_m_promisc(void *arg, boolean_t on);
    338 static mblk_t 	*iwk_m_tx(void *arg, mblk_t *mp);
    339 static void	iwk_m_ioctl(void *arg, queue_t *wq, mblk_t *mp);
    340 static int	iwk_m_setprop(void *arg, const char *pr_name,
    341 	mac_prop_id_t wldp_pr_name, uint_t wldp_length, const void *wldp_buf);
    342 static int	iwk_m_getprop(void *arg, const char *pr_name,
    343 	mac_prop_id_t wldp_pr_name, uint_t pr_flags, uint_t wldp_length,
    344 	void *wldp_buf, uint_t *perm);
    345 static void	iwk_destroy_locks(iwk_sc_t *sc);
    346 static int	iwk_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type);
    347 static void	iwk_thread(iwk_sc_t *sc);
    348 static void	iwk_watchdog(void *arg);
    349 static int	iwk_run_state_config_ibss(ieee80211com_t *ic);
    350 static int	iwk_run_state_config_sta(ieee80211com_t *ic);
    351 static int	iwk_fast_recover(iwk_sc_t *sc);
    352 static int	iwk_start_tx_beacon(ieee80211com_t *ic);
    353 static int	iwk_clean_add_node_ibss(struct ieee80211com *ic,
    354     uint8_t addr[IEEE80211_ADDR_LEN], uint8_t *index2);
    355 
    356 /*
    357  * Supported rates for 802.11b/g modes (in 500Kbps unit).
    358  * 11a and 11n support will be added later.
    359  */
    360 static const struct ieee80211_rateset iwk_rateset_11b =
    361 	{ 4, { 2, 4, 11, 22 } };
    362 
    363 static const struct ieee80211_rateset iwk_rateset_11g =
    364 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
    365 
    366 /*
    367  * For mfthread only
    368  */
    369 extern pri_t minclsyspri;
    370 
    371 #define	DRV_NAME_4965	"iwk"
    372 
    373 /*
    374  * Module Loading Data & Entry Points
    375  */
    376 DDI_DEFINE_STREAM_OPS(iwk_devops, nulldev, nulldev, iwk_attach,
    377     iwk_detach, nodev, NULL, D_MP, NULL, iwk_quiesce);
    378 
    379 static struct modldrv iwk_modldrv = {
    380 	&mod_driverops,
    381 	"Intel(R) 4965AGN driver(N)",
    382 	&iwk_devops
    383 };
    384 
    385 static struct modlinkage iwk_modlinkage = {
    386 	MODREV_1,
    387 	&iwk_modldrv,
    388 	NULL
    389 };
    390 
    391 int
    392 _init(void)
    393 {
    394 	int	status;
    395 
    396 	status = ddi_soft_state_init(&iwk_soft_state_p,
    397 	    sizeof (iwk_sc_t), 1);
    398 	if (status != DDI_SUCCESS)
    399 		return (status);
    400 
    401 	mac_init_ops(&iwk_devops, DRV_NAME_4965);
    402 	status = mod_install(&iwk_modlinkage);
    403 	if (status != DDI_SUCCESS) {
    404 		mac_fini_ops(&iwk_devops);
    405 		ddi_soft_state_fini(&iwk_soft_state_p);
    406 	}
    407 
    408 	return (status);
    409 }
    410 
    411 int
    412 _fini(void)
    413 {
    414 	int status;
    415 
    416 	status = mod_remove(&iwk_modlinkage);
    417 	if (status == DDI_SUCCESS) {
    418 		mac_fini_ops(&iwk_devops);
    419 		ddi_soft_state_fini(&iwk_soft_state_p);
    420 	}
    421 
    422 	return (status);
    423 }
    424 
    425 int
    426 _info(struct modinfo *mip)
    427 {
    428 	return (mod_info(&iwk_modlinkage, mip));
    429 }
    430 
    431 /*
    432  * Mac Call Back entries
    433  */
    434 mac_callbacks_t	iwk_m_callbacks = {
    435 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
    436 	iwk_m_stat,
    437 	iwk_m_start,
    438 	iwk_m_stop,
    439 	iwk_m_promisc,
    440 	iwk_m_multicst,
    441 	iwk_m_unicst,
    442 	iwk_m_tx,
    443 	iwk_m_ioctl,
    444 	NULL,
    445 	NULL,
    446 	NULL,
    447 	iwk_m_setprop,
    448 	iwk_m_getprop
    449 };
    450 
    451 #ifdef DEBUG
    452 void
    453 iwk_dbg(uint32_t flags, const char *fmt, ...)
    454 {
    455 	va_list	ap;
    456 
    457 	if (flags & iwk_dbg_flags) {
    458 		va_start(ap, fmt);
    459 		vcmn_err(CE_NOTE, fmt, ap);
    460 		va_end(ap);
    461 	}
    462 }
    463 #endif
    464 
    465 /*
    466  * device operations
    467  */
    468 int
    469 iwk_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
    470 {
    471 	iwk_sc_t		*sc;
    472 	ieee80211com_t	*ic;
    473 	int			instance, err, i;
    474 	char			strbuf[32];
    475 	wifi_data_t		wd = { 0 };
    476 	mac_register_t		*macp;
    477 
    478 	int			intr_type;
    479 	int			intr_count;
    480 	int			intr_actual;
    481 
    482 	switch (cmd) {
    483 	case DDI_ATTACH:
    484 		break;
    485 	case DDI_RESUME:
    486 		sc = ddi_get_soft_state(iwk_soft_state_p,
    487 		    ddi_get_instance(dip));
    488 		ASSERT(sc != NULL);
    489 
    490 		mutex_enter(&sc->sc_glock);
    491 		sc->sc_flags &= ~IWK_F_SUSPEND;
    492 		mutex_exit(&sc->sc_glock);
    493 
    494 		if (sc->sc_flags & IWK_F_RUNNING)
    495 			(void) iwk_init(sc);
    496 
    497 		mutex_enter(&sc->sc_glock);
    498 		sc->sc_flags |= IWK_F_LAZY_RESUME;
    499 		mutex_exit(&sc->sc_glock);
    500 
    501 		IWK_DBG((IWK_DEBUG_RESUME, "iwk: resume\n"));
    502 		return (DDI_SUCCESS);
    503 	default:
    504 		err = DDI_FAILURE;
    505 		goto attach_fail1;
    506 	}
    507 
    508 	instance = ddi_get_instance(dip);
    509 	err = ddi_soft_state_zalloc(iwk_soft_state_p, instance);
    510 	if (err != DDI_SUCCESS) {
    511 		cmn_err(CE_WARN,
    512 		    "iwk_attach(): failed to allocate soft state\n");
    513 		goto attach_fail1;
    514 	}
    515 	sc = ddi_get_soft_state(iwk_soft_state_p, instance);
    516 	sc->sc_dip = dip;
    517 
    518 	err = ddi_regs_map_setup(dip, 0, &sc->sc_cfg_base, 0, 0,
    519 	    &iwk_reg_accattr, &sc->sc_cfg_handle);
    520 	if (err != DDI_SUCCESS) {
    521 		cmn_err(CE_WARN,
    522 		    "iwk_attach(): failed to map config spaces regs\n");
    523 		goto attach_fail2;
    524 	}
    525 	sc->sc_rev = ddi_get8(sc->sc_cfg_handle,
    526 	    (uint8_t *)(sc->sc_cfg_base + PCI_CONF_REVID));
    527 	ddi_put8(sc->sc_cfg_handle, (uint8_t *)(sc->sc_cfg_base + 0x41), 0);
    528 	sc->sc_clsz = ddi_get16(sc->sc_cfg_handle,
    529 	    (uint16_t *)(sc->sc_cfg_base + PCI_CONF_CACHE_LINESZ));
    530 	if (!sc->sc_clsz)
    531 		sc->sc_clsz = 16;
    532 	sc->sc_clsz = (sc->sc_clsz << 2);
    533 	sc->sc_dmabuf_sz = roundup(0x1000 + sizeof (struct ieee80211_frame) +
    534 	    IEEE80211_MTU + IEEE80211_CRC_LEN +
    535 	    (IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN +
    536 	    IEEE80211_WEP_CRCLEN), sc->sc_clsz);
    537 	/*
    538 	 * Map operating registers
    539 	 */
    540 	err = ddi_regs_map_setup(dip, 1, &sc->sc_base,
    541 	    0, 0, &iwk_reg_accattr, &sc->sc_handle);
    542 	if (err != DDI_SUCCESS) {
    543 		cmn_err(CE_WARN,
    544 		    "iwk_attach(): failed to map device regs\n");
    545 		goto attach_fail2a;
    546 	}
    547 
    548 	err = ddi_intr_get_supported_types(dip, &intr_type);
    549 	if ((err != DDI_SUCCESS) || (!(intr_type & DDI_INTR_TYPE_FIXED))) {
    550 		cmn_err(CE_WARN, "iwk_attach(): "
    551 		    "Fixed type interrupt is not supported\n");
    552 		goto attach_fail_intr_a;
    553 	}
    554 
    555 	err = ddi_intr_get_nintrs(dip, DDI_INTR_TYPE_FIXED, &intr_count);
    556 	if ((err != DDI_SUCCESS) || (intr_count != 1)) {
    557 		cmn_err(CE_WARN, "iwk_attach(): "
    558 		    "No fixed interrupts\n");
    559 		goto attach_fail_intr_a;
    560 	}
    561 
    562 	sc->sc_intr_htable = kmem_zalloc(sizeof (ddi_intr_handle_t), KM_SLEEP);
    563 
    564 	err = ddi_intr_alloc(dip, sc->sc_intr_htable, DDI_INTR_TYPE_FIXED, 0,
    565 	    intr_count, &intr_actual, 0);
    566 	if ((err != DDI_SUCCESS) || (intr_actual != 1)) {
    567 		cmn_err(CE_WARN, "iwk_attach(): "
    568 		    "ddi_intr_alloc() failed 0x%x\n", err);
    569 		goto attach_fail_intr_b;
    570 	}
    571 
    572 	err = ddi_intr_get_pri(sc->sc_intr_htable[0], &sc->sc_intr_pri);
    573 	if (err != DDI_SUCCESS) {
    574 		cmn_err(CE_WARN, "iwk_attach(): "
    575 		    "ddi_intr_get_pri() failed 0x%x\n", err);
    576 		goto attach_fail_intr_c;
    577 	}
    578 
    579 	mutex_init(&sc->sc_glock, NULL, MUTEX_DRIVER,
    580 	    DDI_INTR_PRI(sc->sc_intr_pri));
    581 	mutex_init(&sc->sc_tx_lock, NULL, MUTEX_DRIVER,
    582 	    DDI_INTR_PRI(sc->sc_intr_pri));
    583 	mutex_init(&sc->sc_mt_lock, NULL, MUTEX_DRIVER,
    584 	    DDI_INTR_PRI(sc->sc_intr_pri));
    585 	mutex_init(&sc->sc_ibss.node_tb_lock, NULL, MUTEX_DRIVER,
    586 	    DDI_INTR_PRI(sc->sc_intr_pri));
    587 
    588 	cv_init(&sc->sc_fw_cv, NULL, CV_DRIVER, NULL);
    589 	cv_init(&sc->sc_cmd_cv, NULL, CV_DRIVER, NULL);
    590 	cv_init(&sc->sc_tx_cv, "tx-ring", CV_DRIVER, NULL);
    591 	/*
    592 	 * initialize the mfthread
    593 	 */
    594 	cv_init(&sc->sc_mt_cv, NULL, CV_DRIVER, NULL);
    595 	sc->sc_mf_thread = NULL;
    596 	sc->sc_mf_thread_switch = 0;
    597 
    598 	/*
    599 	 * Allocate shared page.
    600 	 */
    601 	err = iwk_alloc_shared(sc);
    602 	if (err != DDI_SUCCESS) {
    603 		cmn_err(CE_WARN, "iwk_attach(): "
    604 		    "failed to allocate shared page\n");
    605 		goto attach_fail3;
    606 	}
    607 
    608 	/*
    609 	 * Allocate keep warm page.
    610 	 */
    611 	err = iwk_alloc_kw(sc);
    612 	if (err != DDI_SUCCESS) {
    613 		cmn_err(CE_WARN, "iwk_attach(): "
    614 		    "failed to allocate keep warm page\n");
    615 		goto attach_fail3a;
    616 	}
    617 
    618 	/*
    619 	 * Do some necessary hardware initializations.
    620 	 */
    621 	err = iwk_preinit(sc);
    622 	if (err != DDI_SUCCESS) {
    623 		cmn_err(CE_WARN, "iwk_attach(): "
    624 		    "failed to init hardware\n");
    625 		goto attach_fail4;
    626 	}
    627 
    628 	/* initialize EEPROM */
    629 	err = iwk_eep_load(sc);  /* get hardware configurations from eeprom */
    630 	if (err != 0) {
    631 		cmn_err(CE_WARN, "iwk_attach(): failed to load eeprom\n");
    632 		goto attach_fail4;
    633 	}
    634 
    635 	if (LE_16(sc->sc_eep_map.calib_version) < EEP_TX_POWER_VERSION_NEW) {
    636 		cmn_err(CE_WARN, "older EEPROM detected\n");
    637 		goto attach_fail4;
    638 	}
    639 
    640 	iwk_get_mac_from_eep(sc);
    641 
    642 	err = iwk_ring_init(sc);
    643 	if (err != DDI_SUCCESS) {
    644 		cmn_err(CE_WARN, "iwk_attach(): "
    645 		    "failed to allocate and initialize ring\n");
    646 		goto attach_fail4;
    647 	}
    648 
    649 	sc->sc_hdr = (iwk_firmware_hdr_t *)iwk_fw_bin;
    650 
    651 	err = iwk_alloc_fw_dma(sc);
    652 	if (err != DDI_SUCCESS) {
    653 		cmn_err(CE_WARN, "iwk_attach(): "
    654 		    "failed to allocate firmware dma\n");
    655 		goto attach_fail5;
    656 	}
    657 
    658 	/*
    659 	 * Initialize the wifi part, which will be used by
    660 	 * generic layer
    661 	 */
    662 	ic = &sc->sc_ic;
    663 	ic->ic_phytype  = IEEE80211_T_OFDM;
    664 	ic->ic_opmode   = IEEE80211_M_STA; /* default to BSS mode */
    665 	ic->ic_state    = IEEE80211_S_INIT;
    666 	ic->ic_maxrssi  = 100; /* experimental number */
    667 	ic->ic_caps = IEEE80211_C_SHPREAMBLE | IEEE80211_C_TXPMGT |
    668 	    IEEE80211_C_PMGT | IEEE80211_C_SHSLOT;
    669 	/*
    670 	 * use software WEP and TKIP, hardware CCMP;
    671 	 */
    672 	ic->ic_caps |= IEEE80211_C_AES_CCM;
    673 	/*
    674 	 * Support WPA/WPA2
    675 	 */
    676 	ic->ic_caps |= IEEE80211_C_WPA;
    677 	/*
    678 	 * support Adhoc mode
    679 	 */
    680 	ic->ic_caps |= IEEE80211_C_IBSS;
    681 
    682 	/* set supported .11b and .11g rates */
    683 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwk_rateset_11b;
    684 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwk_rateset_11g;
    685 
    686 	/* set supported .11b and .11g channels (1 through 11) */
    687 	for (i = 1; i <= 11; i++) {
    688 		ic->ic_sup_channels[i].ich_freq =
    689 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
    690 		ic->ic_sup_channels[i].ich_flags =
    691 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
    692 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ |
    693 		    IEEE80211_CHAN_PASSIVE;
    694 	}
    695 	ic->ic_ibss_chan = &ic->ic_sup_channels[0];
    696 
    697 	ic->ic_xmit = iwk_send;
    698 	/*
    699 	 * init Wifi layer
    700 	 */
    701 	ieee80211_attach(ic);
    702 
    703 	/*
    704 	 * different instance has different WPA door
    705 	 */
    706 	(void) snprintf(ic->ic_wpadoor, MAX_IEEE80211STR, "%s_%s%d", WPA_DOOR,
    707 	    ddi_driver_name(dip),
    708 	    ddi_get_instance(dip));
    709 
    710 	/*
    711 	 * Override 80211 default routines
    712 	 */
    713 	sc->sc_newstate = ic->ic_newstate;
    714 	ic->ic_newstate = iwk_newstate;
    715 	ic->ic_watchdog = iwk_watchdog;
    716 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
    717 	ic->ic_recv_mgmt = iwk_recv_mgmt;
    718 	ic->ic_node_alloc = iwk_node_alloc;
    719 	ic->ic_node_free = iwk_node_free;
    720 	ic->ic_crypto.cs_key_set = iwk_key_set;
    721 	ieee80211_media_init(ic);
    722 	/*
    723 	 * initialize default tx key
    724 	 */
    725 	ic->ic_def_txkey = 0;
    726 	err = ddi_intr_add_softint(dip, &sc->sc_soft_hdl, DDI_INTR_SOFTPRI_MAX,
    727 	    iwk_rx_softintr, (caddr_t)sc);
    728 	if (err != DDI_SUCCESS) {
    729 		cmn_err(CE_WARN, "iwk_attach(): "
    730 		    "add soft interrupt failed\n");
    731 		goto attach_fail7;
    732 	}
    733 
    734 	/*
    735 	 * Add the interrupt handler
    736 	 */
    737 	err = ddi_intr_add_handler(sc->sc_intr_htable[0], iwk_intr,
    738 	    (caddr_t)sc, NULL);
    739 	if (err != DDI_SUCCESS) {
    740 		cmn_err(CE_WARN, "iwk_attach(): "
    741 		    "ddi_intr_add_handle() failed\n");
    742 		goto attach_fail8;
    743 	}
    744 
    745 	err = ddi_intr_enable(sc->sc_intr_htable[0]);
    746 	if (err != DDI_SUCCESS) {
    747 		cmn_err(CE_WARN, "iwk_attach(): "
    748 		    "ddi_intr_enable() failed\n");
    749 		goto attach_fail_intr_d;
    750 	}
    751 
    752 	/*
    753 	 * Initialize pointer to device specific functions
    754 	 */
    755 	wd.wd_secalloc = WIFI_SEC_NONE;
    756 	wd.wd_opmode = ic->ic_opmode;
    757 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_macaddr);
    758 
    759 	macp = mac_alloc(MAC_VERSION);
    760 	if (macp == NULL) {
    761 		cmn_err(CE_WARN,
    762 		    "iwk_attach(): failed to do mac_alloc()\n");
    763 		goto attach_fail9;
    764 	}
    765 
    766 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
    767 	macp->m_driver		= sc;
    768 	macp->m_dip		= dip;
    769 	macp->m_src_addr	= ic->ic_macaddr;
    770 	macp->m_callbacks	= &iwk_m_callbacks;
    771 	macp->m_min_sdu		= 0;
    772 	macp->m_max_sdu		= IEEE80211_MTU;
    773 	macp->m_pdata		= &wd;
    774 	macp->m_pdata_size	= sizeof (wd);
    775 
    776 	/*
    777 	 * Register the macp to mac
    778 	 */
    779 	err = mac_register(macp, &ic->ic_mach);
    780 	mac_free(macp);
    781 	if (err != DDI_SUCCESS) {
    782 		cmn_err(CE_WARN,
    783 		    "iwk_attach(): failed to do mac_register()\n");
    784 		goto attach_fail9;
    785 	}
    786 
    787 	/*
    788 	 * Create minor node of type DDI_NT_NET_WIFI
    789 	 */
    790 	(void) snprintf(strbuf, sizeof (strbuf), DRV_NAME_4965"%d", instance);
    791 	err = ddi_create_minor_node(dip, strbuf, S_IFCHR,
    792 	    instance + 1, DDI_NT_NET_WIFI, 0);
    793 	if (err != DDI_SUCCESS)
    794 		cmn_err(CE_WARN,
    795 		    "iwk_attach(): failed to do ddi_create_minor_node()\n");
    796 
    797 	/*
    798 	 * Notify link is down now
    799 	 */
    800 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
    801 
    802 	/*
    803 	 * create the mf thread to handle the link status,
    804 	 * recovery fatal error, etc.
    805 	 */
    806 	sc->sc_mf_thread_switch = 1;
    807 	if (sc->sc_mf_thread == NULL)
    808 		sc->sc_mf_thread = thread_create((caddr_t)NULL, 0,
    809 		    iwk_thread, sc, 0, &p0, TS_RUN, minclsyspri);
    810 
    811 	sc->sc_flags |= IWK_F_ATTACHED;
    812 
    813 	return (DDI_SUCCESS);
    814 attach_fail9:
    815 	(void) ddi_intr_disable(sc->sc_intr_htable[0]);
    816 attach_fail_intr_d:
    817 	(void) ddi_intr_remove_handler(sc->sc_intr_htable[0]);
    818 
    819 attach_fail8:
    820 	(void) ddi_intr_remove_softint(sc->sc_soft_hdl);
    821 	sc->sc_soft_hdl = NULL;
    822 attach_fail7:
    823 	ieee80211_detach(ic);
    824 attach_fail6:
    825 	iwk_free_fw_dma(sc);
    826 attach_fail5:
    827 	iwk_ring_free(sc);
    828 attach_fail4:
    829 	iwk_free_kw(sc);
    830 attach_fail3a:
    831 	iwk_free_shared(sc);
    832 attach_fail3:
    833 	iwk_destroy_locks(sc);
    834 attach_fail_intr_c:
    835 	(void) ddi_intr_free(sc->sc_intr_htable[0]);
    836 attach_fail_intr_b:
    837 	kmem_free(sc->sc_intr_htable, sizeof (ddi_intr_handle_t));
    838 attach_fail_intr_a:
    839 	ddi_regs_map_free(&sc->sc_handle);
    840 attach_fail2a:
    841 	ddi_regs_map_free(&sc->sc_cfg_handle);
    842 attach_fail2:
    843 	ddi_soft_state_free(iwk_soft_state_p, instance);
    844 attach_fail1:
    845 	return (err);
    846 }
    847 
    848 int
    849 iwk_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
    850 {
    851 	iwk_sc_t	*sc;
    852 	int err;
    853 
    854 	sc = ddi_get_soft_state(iwk_soft_state_p, ddi_get_instance(dip));
    855 	ASSERT(sc != NULL);
    856 
    857 	switch (cmd) {
    858 	case DDI_DETACH:
    859 		break;
    860 	case DDI_SUSPEND:
    861 		mutex_enter(&sc->sc_glock);
    862 		sc->sc_flags |= IWK_F_SUSPEND;
    863 		mutex_exit(&sc->sc_glock);
    864 		if (sc->sc_flags & IWK_F_RUNNING) {
    865 			iwk_stop(sc);
    866 		}
    867 
    868 		IWK_DBG((IWK_DEBUG_RESUME, "iwk: suspend\n"));
    869 		return (DDI_SUCCESS);
    870 	default:
    871 		return (DDI_FAILURE);
    872 	}
    873 
    874 	if (!(sc->sc_flags & IWK_F_ATTACHED))
    875 		return (DDI_FAILURE);
    876 
    877 	err = mac_disable(sc->sc_ic.ic_mach);
    878 	if (err != DDI_SUCCESS)
    879 		return (err);
    880 
    881 	/*
    882 	 * Destroy the mf_thread
    883 	 */
    884 	mutex_enter(&sc->sc_mt_lock);
    885 	sc->sc_mf_thread_switch = 0;
    886 	while (sc->sc_mf_thread != NULL) {
    887 		if (cv_wait_sig(&sc->sc_mt_cv, &sc->sc_mt_lock) == 0)
    888 			break;
    889 	}
    890 	mutex_exit(&sc->sc_mt_lock);
    891 
    892 	iwk_stop(sc);
    893 	DELAY(500000);
    894 
    895 	/*
    896 	 * Unregiste from the MAC layer subsystem
    897 	 */
    898 	(void) mac_unregister(sc->sc_ic.ic_mach);
    899 
    900 	mutex_enter(&sc->sc_glock);
    901 	iwk_free_fw_dma(sc);
    902 	iwk_ring_free(sc);
    903 	iwk_free_kw(sc);
    904 	iwk_free_shared(sc);
    905 	mutex_exit(&sc->sc_glock);
    906 
    907 	(void) ddi_intr_disable(sc->sc_intr_htable[0]);
    908 	(void) ddi_intr_remove_handler(sc->sc_intr_htable[0]);
    909 	(void) ddi_intr_free(sc->sc_intr_htable[0]);
    910 	kmem_free(sc->sc_intr_htable, sizeof (ddi_intr_handle_t));
    911 
    912 	(void) ddi_intr_remove_softint(sc->sc_soft_hdl);
    913 	sc->sc_soft_hdl = NULL;
    914 
    915 	/*
    916 	 * detach ieee80211
    917 	 */
    918 	ieee80211_detach(&sc->sc_ic);
    919 
    920 	iwk_destroy_locks(sc);
    921 
    922 	ddi_regs_map_free(&sc->sc_handle);
    923 	ddi_regs_map_free(&sc->sc_cfg_handle);
    924 	ddi_remove_minor_node(dip, NULL);
    925 	ddi_soft_state_free(iwk_soft_state_p, ddi_get_instance(dip));
    926 
    927 	return (DDI_SUCCESS);
    928 }
    929 
    930 /*
    931  * quiesce(9E) entry point.
    932  *
    933  * This function is called when the system is single-threaded at high
    934  * PIL with preemption disabled. Therefore, this function must not be
    935  * blocked.
    936  *
    937  * This function returns DDI_SUCCESS on success, or DDI_FAILURE on failure.
    938  * DDI_FAILURE indicates an error condition and should almost never happen.
    939  */
    940 int
    941 iwk_quiesce(dev_info_t *dip)
    942 {
    943 	iwk_sc_t	*sc;
    944 
    945 	sc = ddi_get_soft_state(iwk_soft_state_p, ddi_get_instance(dip));
    946 	ASSERT(sc != NULL);
    947 
    948 	/* no message prints and no lock accquisition */
    949 #ifdef DEBUG
    950 	iwk_dbg_flags = 0;
    951 #endif
    952 	sc->sc_flags |= IWK_F_QUIESCED;
    953 
    954 	iwk_stop(sc);
    955 
    956 	return (DDI_SUCCESS);
    957 }
    958 
    959 static void
    960 iwk_destroy_locks(iwk_sc_t *sc)
    961 {
    962 	cv_destroy(&sc->sc_mt_cv);
    963 	mutex_destroy(&sc->sc_mt_lock);
    964 	cv_destroy(&sc->sc_tx_cv);
    965 	cv_destroy(&sc->sc_cmd_cv);
    966 	cv_destroy(&sc->sc_fw_cv);
    967 	mutex_destroy(&sc->sc_tx_lock);
    968 	mutex_destroy(&sc->sc_glock);
    969 }
    970 
    971 /*
    972  * Allocate an area of memory and a DMA handle for accessing it
    973  */
    974 static int
    975 iwk_alloc_dma_mem(iwk_sc_t *sc, size_t memsize,
    976     ddi_dma_attr_t *dma_attr_p, ddi_device_acc_attr_t *acc_attr_p,
    977     uint_t dma_flags, iwk_dma_t *dma_p)
    978 {
    979 	caddr_t vaddr;
    980 	int err;
    981 
    982 	/*
    983 	 * Allocate handle
    984 	 */
    985 	err = ddi_dma_alloc_handle(sc->sc_dip, dma_attr_p,
    986 	    DDI_DMA_SLEEP, NULL, &dma_p->dma_hdl);
    987 	if (err != DDI_SUCCESS) {
    988 		dma_p->dma_hdl = NULL;
    989 		return (DDI_FAILURE);
    990 	}
    991 
    992 	/*
    993 	 * Allocate memory
    994 	 */
    995 	err = ddi_dma_mem_alloc(dma_p->dma_hdl, memsize, acc_attr_p,
    996 	    dma_flags & (DDI_DMA_CONSISTENT | DDI_DMA_STREAMING),
    997 	    DDI_DMA_SLEEP, NULL, &vaddr, &dma_p->alength, &dma_p->acc_hdl);
    998 	if (err != DDI_SUCCESS) {
    999 		ddi_dma_free_handle(&dma_p->dma_hdl);
   1000 		dma_p->dma_hdl = NULL;
   1001 		dma_p->acc_hdl = NULL;
   1002 		return (DDI_FAILURE);
   1003 	}
   1004 
   1005 	/*
   1006 	 * Bind the two together
   1007 	 */
   1008 	dma_p->mem_va = vaddr;
   1009 	err = ddi_dma_addr_bind_handle(dma_p->dma_hdl, NULL,
   1010 	    vaddr, dma_p->alength, dma_flags, DDI_DMA_SLEEP, NULL,
   1011 	    &dma_p->cookie, &dma_p->ncookies);
   1012 	if (err != DDI_DMA_MAPPED) {
   1013 		ddi_dma_mem_free(&dma_p->acc_hdl);
   1014 		ddi_dma_free_handle(&dma_p->dma_hdl);
   1015 		dma_p->acc_hdl = NULL;
   1016 		dma_p->dma_hdl = NULL;
   1017 		return (DDI_FAILURE);
   1018 	}
   1019 
   1020 	dma_p->nslots = ~0U;
   1021 	dma_p->size = ~0U;
   1022 	dma_p->token = ~0U;
   1023 	dma_p->offset = 0;
   1024 	return (DDI_SUCCESS);
   1025 }
   1026 
   1027 /*
   1028  * Free one allocated area of DMAable memory
   1029  */
   1030 static void
   1031 iwk_free_dma_mem(iwk_dma_t *dma_p)
   1032 {
   1033 	if (dma_p->dma_hdl != NULL) {
   1034 		if (dma_p->ncookies) {
   1035 			(void) ddi_dma_unbind_handle(dma_p->dma_hdl);
   1036 			dma_p->ncookies = 0;
   1037 		}
   1038 		ddi_dma_free_handle(&dma_p->dma_hdl);
   1039 		dma_p->dma_hdl = NULL;
   1040 	}
   1041 
   1042 	if (dma_p->acc_hdl != NULL) {
   1043 		ddi_dma_mem_free(&dma_p->acc_hdl);
   1044 		dma_p->acc_hdl = NULL;
   1045 	}
   1046 }
   1047 
   1048 /*
   1049  *
   1050  */
   1051 static int
   1052 iwk_alloc_fw_dma(iwk_sc_t *sc)
   1053 {
   1054 	int err = DDI_SUCCESS;
   1055 	iwk_dma_t *dma_p;
   1056 	char *t;
   1057 
   1058 	/*
   1059 	 * firmware image layout:
   1060 	 * |HDR|<-TEXT->|<-DATA->|<-INIT_TEXT->|<-INIT_DATA->|<-BOOT->|
   1061 	 */
   1062 	t = (char *)(sc->sc_hdr + 1);
   1063 	err = iwk_alloc_dma_mem(sc, LE_32(sc->sc_hdr->textsz),
   1064 	    &fw_dma_attr, &iwk_dma_accattr,
   1065 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1066 	    &sc->sc_dma_fw_text);
   1067 	dma_p = &sc->sc_dma_fw_text;
   1068 	IWK_DBG((IWK_DEBUG_DMA, "text[ncookies:%d addr:%lx size:%lx]\n",
   1069 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1070 	    dma_p->cookie.dmac_size));
   1071 	if (err != DDI_SUCCESS) {
   1072 		cmn_err(CE_WARN, "iwk_alloc_fw_dma(): failed to alloc"
   1073 		    " text dma memory");
   1074 		goto fail;
   1075 	}
   1076 	(void) memcpy(dma_p->mem_va, t, LE_32(sc->sc_hdr->textsz));
   1077 
   1078 	t += LE_32(sc->sc_hdr->textsz);
   1079 	err = iwk_alloc_dma_mem(sc, LE_32(sc->sc_hdr->datasz),
   1080 	    &fw_dma_attr, &iwk_dma_accattr,
   1081 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1082 	    &sc->sc_dma_fw_data);
   1083 	dma_p = &sc->sc_dma_fw_data;
   1084 	IWK_DBG((IWK_DEBUG_DMA, "data[ncookies:%d addr:%lx size:%lx]\n",
   1085 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1086 	    dma_p->cookie.dmac_size));
   1087 	if (err != DDI_SUCCESS) {
   1088 		cmn_err(CE_WARN, "iwk_alloc_fw_dma(): failed to alloc"
   1089 		    " data dma memory");
   1090 		goto fail;
   1091 	}
   1092 	(void) memcpy(dma_p->mem_va, t, LE_32(sc->sc_hdr->datasz));
   1093 
   1094 	err = iwk_alloc_dma_mem(sc, LE_32(sc->sc_hdr->datasz),
   1095 	    &fw_dma_attr, &iwk_dma_accattr,
   1096 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1097 	    &sc->sc_dma_fw_data_bak);
   1098 	dma_p = &sc->sc_dma_fw_data_bak;
   1099 	IWK_DBG((IWK_DEBUG_DMA, "data_bak[ncookies:%d addr:%lx "
   1100 	    "size:%lx]\n",
   1101 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1102 	    dma_p->cookie.dmac_size));
   1103 	if (err != DDI_SUCCESS) {
   1104 		cmn_err(CE_WARN, "iwk_alloc_fw_dma(): failed to alloc"
   1105 		    " data bakeup dma memory");
   1106 		goto fail;
   1107 	}
   1108 	(void) memcpy(dma_p->mem_va, t, LE_32(sc->sc_hdr->datasz));
   1109 
   1110 	t += LE_32(sc->sc_hdr->datasz);
   1111 	err = iwk_alloc_dma_mem(sc, LE_32(sc->sc_hdr->init_textsz),
   1112 	    &fw_dma_attr, &iwk_dma_accattr,
   1113 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1114 	    &sc->sc_dma_fw_init_text);
   1115 	dma_p = &sc->sc_dma_fw_init_text;
   1116 	IWK_DBG((IWK_DEBUG_DMA, "init_text[ncookies:%d addr:%lx "
   1117 	    "size:%lx]\n",
   1118 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1119 	    dma_p->cookie.dmac_size));
   1120 	if (err != DDI_SUCCESS) {
   1121 		cmn_err(CE_WARN, "iwk_alloc_fw_dma(): failed to alloc"
   1122 		    "init text dma memory");
   1123 		goto fail;
   1124 	}
   1125 	(void) memcpy(dma_p->mem_va, t, LE_32(sc->sc_hdr->init_textsz));
   1126 
   1127 	t += LE_32(sc->sc_hdr->init_textsz);
   1128 	err = iwk_alloc_dma_mem(sc, LE_32(sc->sc_hdr->init_datasz),
   1129 	    &fw_dma_attr, &iwk_dma_accattr,
   1130 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1131 	    &sc->sc_dma_fw_init_data);
   1132 	dma_p = &sc->sc_dma_fw_init_data;
   1133 	IWK_DBG((IWK_DEBUG_DMA, "init_data[ncookies:%d addr:%lx "
   1134 	    "size:%lx]\n",
   1135 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1136 	    dma_p->cookie.dmac_size));
   1137 	if (err != DDI_SUCCESS) {
   1138 		cmn_err(CE_WARN, "iwk_alloc_fw_dma(): failed to alloc"
   1139 		    "init data dma memory");
   1140 		goto fail;
   1141 	}
   1142 	(void) memcpy(dma_p->mem_va, t, LE_32(sc->sc_hdr->init_datasz));
   1143 
   1144 	sc->sc_boot = t + LE_32(sc->sc_hdr->init_datasz);
   1145 fail:
   1146 	return (err);
   1147 }
   1148 
   1149 static void
   1150 iwk_free_fw_dma(iwk_sc_t *sc)
   1151 {
   1152 	iwk_free_dma_mem(&sc->sc_dma_fw_text);
   1153 	iwk_free_dma_mem(&sc->sc_dma_fw_data);
   1154 	iwk_free_dma_mem(&sc->sc_dma_fw_data_bak);
   1155 	iwk_free_dma_mem(&sc->sc_dma_fw_init_text);
   1156 	iwk_free_dma_mem(&sc->sc_dma_fw_init_data);
   1157 }
   1158 
   1159 /*
   1160  * Allocate a shared page between host and NIC.
   1161  */
   1162 static int
   1163 iwk_alloc_shared(iwk_sc_t *sc)
   1164 {
   1165 	iwk_dma_t *dma_p;
   1166 	int err = DDI_SUCCESS;
   1167 
   1168 	/* must be aligned on a 4K-page boundary */
   1169 	err = iwk_alloc_dma_mem(sc, sizeof (iwk_shared_t),
   1170 	    &sh_dma_attr, &iwk_dma_descattr,
   1171 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1172 	    &sc->sc_dma_sh);
   1173 	if (err != DDI_SUCCESS)
   1174 		goto fail;
   1175 	sc->sc_shared = (iwk_shared_t *)sc->sc_dma_sh.mem_va;
   1176 
   1177 	dma_p = &sc->sc_dma_sh;
   1178 	IWK_DBG((IWK_DEBUG_DMA, "sh[ncookies:%d addr:%lx size:%lx]\n",
   1179 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1180 	    dma_p->cookie.dmac_size));
   1181 
   1182 	return (err);
   1183 fail:
   1184 	iwk_free_shared(sc);
   1185 	return (err);
   1186 }
   1187 
   1188 static void
   1189 iwk_free_shared(iwk_sc_t *sc)
   1190 {
   1191 	iwk_free_dma_mem(&sc->sc_dma_sh);
   1192 }
   1193 
   1194 /*
   1195  * Allocate a keep warm page.
   1196  */
   1197 static int
   1198 iwk_alloc_kw(iwk_sc_t *sc)
   1199 {
   1200 	iwk_dma_t *dma_p;
   1201 	int err = DDI_SUCCESS;
   1202 
   1203 	/* must be aligned on a 4K-page boundary */
   1204 	err = iwk_alloc_dma_mem(sc, IWK_KW_SIZE,
   1205 	    &kw_dma_attr, &iwk_dma_accattr,
   1206 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1207 	    &sc->sc_dma_kw);
   1208 	if (err != DDI_SUCCESS)
   1209 		goto fail;
   1210 
   1211 	dma_p = &sc->sc_dma_kw;
   1212 	IWK_DBG((IWK_DEBUG_DMA, "kw[ncookies:%d addr:%lx size:%lx]\n",
   1213 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1214 	    dma_p->cookie.dmac_size));
   1215 
   1216 	return (err);
   1217 fail:
   1218 	iwk_free_kw(sc);
   1219 	return (err);
   1220 }
   1221 
   1222 static void
   1223 iwk_free_kw(iwk_sc_t *sc)
   1224 {
   1225 	iwk_free_dma_mem(&sc->sc_dma_kw);
   1226 }
   1227 
   1228 static int
   1229 iwk_alloc_rx_ring(iwk_sc_t *sc)
   1230 {
   1231 	iwk_rx_ring_t *ring;
   1232 	iwk_rx_data_t *data;
   1233 	iwk_dma_t *dma_p;
   1234 	int i, err = DDI_SUCCESS;
   1235 
   1236 	ring = &sc->sc_rxq;
   1237 	ring->cur = 0;
   1238 
   1239 	err = iwk_alloc_dma_mem(sc, RX_QUEUE_SIZE * sizeof (uint32_t),
   1240 	    &ring_desc_dma_attr, &iwk_dma_descattr,
   1241 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1242 	    &ring->dma_desc);
   1243 	if (err != DDI_SUCCESS) {
   1244 		cmn_err(CE_WARN, "dma alloc rx ring desc failed\n");
   1245 		goto fail;
   1246 	}
   1247 	ring->desc = (uint32_t *)ring->dma_desc.mem_va;
   1248 	dma_p = &ring->dma_desc;
   1249 	IWK_DBG((IWK_DEBUG_DMA, "rx bd[ncookies:%d addr:%lx size:%lx]\n",
   1250 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1251 	    dma_p->cookie.dmac_size));
   1252 
   1253 	/*
   1254 	 * Allocate Rx buffers.
   1255 	 */
   1256 	for (i = 0; i < RX_QUEUE_SIZE; i++) {
   1257 		data = &ring->data[i];
   1258 		err = iwk_alloc_dma_mem(sc, sc->sc_dmabuf_sz,
   1259 		    &rx_buffer_dma_attr, &iwk_dma_accattr,
   1260 		    DDI_DMA_READ | DDI_DMA_STREAMING,
   1261 		    &data->dma_data);
   1262 		if (err != DDI_SUCCESS) {
   1263 			cmn_err(CE_WARN, "dma alloc rx ring buf[%d] "
   1264 			    "failed\n", i);
   1265 			goto fail;
   1266 		}
   1267 		/*
   1268 		 * the physical address bit [8-36] are used,
   1269 		 * instead of bit [0-31] in 3945.
   1270 		 */
   1271 		ring->desc[i] = (uint32_t)
   1272 		    (data->dma_data.cookie.dmac_address >> 8);
   1273 	}
   1274 	dma_p = &ring->data[0].dma_data;
   1275 	IWK_DBG((IWK_DEBUG_DMA, "rx buffer[0][ncookies:%d addr:%lx "
   1276 	    "size:%lx]\n",
   1277 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1278 	    dma_p->cookie.dmac_size));
   1279 
   1280 	IWK_DMA_SYNC(ring->dma_desc, DDI_DMA_SYNC_FORDEV);
   1281 
   1282 	return (err);
   1283 
   1284 fail:
   1285 	iwk_free_rx_ring(sc);
   1286 	return (err);
   1287 }
   1288 
   1289 static void
   1290 iwk_reset_rx_ring(iwk_sc_t *sc)
   1291 {
   1292 	int n;
   1293 
   1294 	iwk_mac_access_enter(sc);
   1295 	IWK_WRITE(sc, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
   1296 	for (n = 0; n < 2000; n++) {
   1297 		if (IWK_READ(sc, FH_MEM_RSSR_RX_STATUS_REG) & (1 << 24))
   1298 			break;
   1299 		DELAY(1000);
   1300 	}
   1301 
   1302 	if (n == 2000)
   1303 		IWK_DBG((IWK_DEBUG_DMA, "timeout resetting Rx ring\n"));
   1304 
   1305 	iwk_mac_access_exit(sc);
   1306 
   1307 	sc->sc_rxq.cur = 0;
   1308 }
   1309 
   1310 static void
   1311 iwk_free_rx_ring(iwk_sc_t *sc)
   1312 {
   1313 	int i;
   1314 
   1315 	for (i = 0; i < RX_QUEUE_SIZE; i++) {
   1316 		if (sc->sc_rxq.data[i].dma_data.dma_hdl)
   1317 			IWK_DMA_SYNC(sc->sc_rxq.data[i].dma_data,
   1318 			    DDI_DMA_SYNC_FORCPU);
   1319 		iwk_free_dma_mem(&sc->sc_rxq.data[i].dma_data);
   1320 	}
   1321 
   1322 	if (sc->sc_rxq.dma_desc.dma_hdl)
   1323 		IWK_DMA_SYNC(sc->sc_rxq.dma_desc, DDI_DMA_SYNC_FORDEV);
   1324 	iwk_free_dma_mem(&sc->sc_rxq.dma_desc);
   1325 }
   1326 
   1327 static int
   1328 iwk_alloc_tx_ring(iwk_sc_t *sc, iwk_tx_ring_t *ring,
   1329     int slots, int qid)
   1330 {
   1331 	iwk_tx_data_t *data;
   1332 	iwk_tx_desc_t *desc_h;
   1333 	uint32_t paddr_desc_h;
   1334 	iwk_cmd_t *cmd_h;
   1335 	uint32_t paddr_cmd_h;
   1336 	iwk_dma_t *dma_p;
   1337 	int i, err = DDI_SUCCESS;
   1338 
   1339 	ring->qid = qid;
   1340 	ring->count = TFD_QUEUE_SIZE_MAX;
   1341 	ring->window = slots;
   1342 	ring->queued = 0;
   1343 	ring->cur = 0;
   1344 
   1345 	err = iwk_alloc_dma_mem(sc,
   1346 	    TFD_QUEUE_SIZE_MAX * sizeof (iwk_tx_desc_t),
   1347 	    &ring_desc_dma_attr, &iwk_dma_descattr,
   1348 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1349 	    &ring->dma_desc);
   1350 	if (err != DDI_SUCCESS) {
   1351 		cmn_err(CE_WARN, "dma alloc tx ring desc[%d] "
   1352 		    "failed\n", qid);
   1353 		goto fail;
   1354 	}
   1355 	dma_p = &ring->dma_desc;
   1356 	IWK_DBG((IWK_DEBUG_DMA, "tx bd[ncookies:%d addr:%lx size:%lx]\n",
   1357 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1358 	    dma_p->cookie.dmac_size));
   1359 
   1360 	desc_h = (iwk_tx_desc_t *)ring->dma_desc.mem_va;
   1361 	paddr_desc_h = ring->dma_desc.cookie.dmac_address;
   1362 
   1363 	err = iwk_alloc_dma_mem(sc,
   1364 	    TFD_QUEUE_SIZE_MAX * sizeof (iwk_cmd_t),
   1365 	    &cmd_dma_attr, &iwk_dma_accattr,
   1366 	    DDI_DMA_RDWR | DDI_DMA_CONSISTENT,
   1367 	    &ring->dma_cmd);
   1368 	if (err != DDI_SUCCESS) {
   1369 		cmn_err(CE_WARN, "dma alloc tx ring cmd[%d] "
   1370 		    "failed\n", qid);
   1371 		goto fail;
   1372 	}
   1373 	dma_p = &ring->dma_cmd;
   1374 	IWK_DBG((IWK_DEBUG_DMA, "tx cmd[ncookies:%d addr:%lx size:%lx]\n",
   1375 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1376 	    dma_p->cookie.dmac_size));
   1377 
   1378 	cmd_h = (iwk_cmd_t *)ring->dma_cmd.mem_va;
   1379 	paddr_cmd_h = ring->dma_cmd.cookie.dmac_address;
   1380 
   1381 	/*
   1382 	 * Allocate Tx buffers.
   1383 	 */
   1384 	ring->data = kmem_zalloc(sizeof (iwk_tx_data_t) * TFD_QUEUE_SIZE_MAX,
   1385 	    KM_NOSLEEP);
   1386 	if (ring->data == NULL) {
   1387 		cmn_err(CE_WARN, "could not allocate tx data slots\n");
   1388 		goto fail;
   1389 	}
   1390 
   1391 	for (i = 0; i < TFD_QUEUE_SIZE_MAX; i++) {
   1392 		data = &ring->data[i];
   1393 		err = iwk_alloc_dma_mem(sc, sc->sc_dmabuf_sz,
   1394 		    &tx_buffer_dma_attr, &iwk_dma_accattr,
   1395 		    DDI_DMA_WRITE | DDI_DMA_STREAMING,
   1396 		    &data->dma_data);
   1397 		if (err != DDI_SUCCESS) {
   1398 			cmn_err(CE_WARN, "dma alloc tx ring "
   1399 			    "buf[%d] failed\n", i);
   1400 			goto fail;
   1401 		}
   1402 
   1403 		data->desc = desc_h + i;
   1404 		data->paddr_desc = paddr_desc_h +
   1405 		    _PTRDIFF(data->desc, desc_h);
   1406 		data->cmd = cmd_h +  i; /* (i % slots); */
   1407 		/* ((i % slots) * sizeof (iwk_cmd_t)); */
   1408 		data->paddr_cmd = paddr_cmd_h +
   1409 		    _PTRDIFF(data->cmd, cmd_h);
   1410 	}
   1411 	dma_p = &ring->data[0].dma_data;
   1412 	IWK_DBG((IWK_DEBUG_DMA, "tx buffer[0][ncookies:%d addr:%lx "
   1413 	    "size:%lx]\n",
   1414 	    dma_p->ncookies, dma_p->cookie.dmac_address,
   1415 	    dma_p->cookie.dmac_size));
   1416 
   1417 	return (err);
   1418 
   1419 fail:
   1420 	if (ring->data)
   1421 		kmem_free(ring->data,
   1422 		    sizeof (iwk_tx_data_t) * TFD_QUEUE_SIZE_MAX);
   1423 	iwk_free_tx_ring(sc, ring);
   1424 	return (err);
   1425 }
   1426 
   1427 static void
   1428 iwk_reset_tx_ring(iwk_sc_t *sc, iwk_tx_ring_t *ring)
   1429 {
   1430 	iwk_tx_data_t *data;
   1431 	int i, n;
   1432 
   1433 	iwk_mac_access_enter(sc);
   1434 
   1435 	IWK_WRITE(sc, IWK_FH_TCSR_CHNL_TX_CONFIG_REG(ring->qid), 0);
   1436 	for (n = 0; n < 200; n++) {
   1437 		if (IWK_READ(sc, IWK_FH_TSSR_TX_STATUS_REG) &
   1438 		    IWK_FH_TSSR_TX_STATUS_REG_MSK_CHNL_IDLE(ring->qid))
   1439 			break;
   1440 		DELAY(10);
   1441 	}
   1442 	if (n == 200) {
   1443 		IWK_DBG((IWK_DEBUG_DMA, "timeout reset tx ring %d\n",
   1444 		    ring->qid));
   1445 	}
   1446 	iwk_mac_access_exit(sc);
   1447 
   1448 	for (i = 0; i < ring->count; i++) {
   1449 		data = &ring->data[i];
   1450 		IWK_DMA_SYNC(data->dma_data, DDI_DMA_SYNC_FORDEV);
   1451 	}
   1452 
   1453 	ring->queued = 0;
   1454 	ring->cur = 0;
   1455 }
   1456 
   1457 /*ARGSUSED*/
   1458 static void
   1459 iwk_free_tx_ring(iwk_sc_t *sc, iwk_tx_ring_t *ring)
   1460 {
   1461 	int i;
   1462 
   1463 	if (ring->dma_desc.dma_hdl != NULL)
   1464 		IWK_DMA_SYNC(ring->dma_desc, DDI_DMA_SYNC_FORDEV);
   1465 	iwk_free_dma_mem(&ring->dma_desc);
   1466 
   1467 	if (ring->dma_cmd.dma_hdl != NULL)
   1468 		IWK_DMA_SYNC(ring->dma_cmd, DDI_DMA_SYNC_FORDEV);
   1469 	iwk_free_dma_mem(&ring->dma_cmd);
   1470 
   1471 	if (ring->data != NULL) {
   1472 		for (i = 0; i < ring->count; i++) {
   1473 			if (ring->data[i].dma_data.dma_hdl)
   1474 				IWK_DMA_SYNC(ring->data[i].dma_data,
   1475 				    DDI_DMA_SYNC_FORDEV);
   1476 			iwk_free_dma_mem(&ring->data[i].dma_data);
   1477 		}
   1478 		kmem_free(ring->data, ring->count * sizeof (iwk_tx_data_t));
   1479 	}
   1480 }
   1481 
   1482 static int
   1483 iwk_ring_init(iwk_sc_t *sc)
   1484 {
   1485 	int i, err = DDI_SUCCESS;
   1486 
   1487 	for (i = 0; i < IWK_NUM_QUEUES; i++) {
   1488 		if (i == IWK_CMD_QUEUE_NUM)
   1489 			continue;
   1490 		err = iwk_alloc_tx_ring(sc, &sc->sc_txq[i], TFD_TX_CMD_SLOTS,
   1491 		    i);
   1492 		if (err != DDI_SUCCESS)
   1493 			goto fail;
   1494 	}
   1495 	err = iwk_alloc_tx_ring(sc, &sc->sc_txq[IWK_CMD_QUEUE_NUM],
   1496 	    TFD_CMD_SLOTS, IWK_CMD_QUEUE_NUM);
   1497 	if (err != DDI_SUCCESS)
   1498 		goto fail;
   1499 	err = iwk_alloc_rx_ring(sc);
   1500 	if (err != DDI_SUCCESS)
   1501 		goto fail;
   1502 	return (err);
   1503 
   1504 fail:
   1505 	return (err);
   1506 }
   1507 
   1508 static void
   1509 iwk_ring_free(iwk_sc_t *sc)
   1510 {
   1511 	int i = IWK_NUM_QUEUES;
   1512 
   1513 	iwk_free_rx_ring(sc);
   1514 	while (--i >= 0) {
   1515 		iwk_free_tx_ring(sc, &sc->sc_txq[i]);
   1516 	}
   1517 }
   1518 
   1519 /* ARGSUSED */
   1520 static ieee80211_node_t *
   1521 iwk_node_alloc(ieee80211com_t *ic)
   1522 {
   1523 	iwk_amrr_t *amrr;
   1524 
   1525 	amrr = kmem_zalloc(sizeof (iwk_amrr_t), KM_SLEEP);
   1526 	if (amrr != NULL)
   1527 		iwk_amrr_init(amrr);
   1528 	return (&amrr->in);
   1529 }
   1530 
   1531 static void
   1532 iwk_node_free(ieee80211_node_t *in)
   1533 {
   1534 	ieee80211com_t *ic = in->in_ic;
   1535 
   1536 	ic->ic_node_cleanup(in);
   1537 	if (in->in_wpa_ie != NULL)
   1538 		ieee80211_free(in->in_wpa_ie);
   1539 	kmem_free(in, sizeof (iwk_amrr_t));
   1540 }
   1541 
   1542 /*ARGSUSED*/
   1543 static int
   1544 iwk_newstate(ieee80211com_t *ic, enum ieee80211_state nstate, int arg)
   1545 {
   1546 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   1547 	ieee80211_node_t *in = ic->ic_bss;
   1548 	enum ieee80211_state ostate = ic->ic_state;
   1549 	int i, err = IWK_SUCCESS;
   1550 
   1551 	mutex_enter(&sc->sc_glock);
   1552 	switch (nstate) {
   1553 	case IEEE80211_S_SCAN:
   1554 		switch (ostate) {
   1555 		case IEEE80211_S_INIT:
   1556 		{
   1557 			iwk_add_sta_t node;
   1558 
   1559 			sc->sc_flags |= IWK_F_SCANNING;
   1560 			sc->sc_scan_pending = 0;
   1561 			iwk_set_led(sc, 2, 10, 2);
   1562 
   1563 			/*
   1564 			 * clear association to receive beacons from
   1565 			 * all BSS'es
   1566 			 */
   1567 			sc->sc_config.assoc_id = 0;
   1568 			sc->sc_config.filter_flags &=
   1569 			    ~LE_32(RXON_FILTER_ASSOC_MSK);
   1570 
   1571 			IWK_DBG((IWK_DEBUG_80211, "config chan %d "
   1572 			    "flags %x filter_flags %x\n", sc->sc_config.chan,
   1573 			    sc->sc_config.flags, sc->sc_config.filter_flags));
   1574 
   1575 			err = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   1576 			    sizeof (iwk_rxon_cmd_t), 1);
   1577 			if (err != IWK_SUCCESS) {
   1578 				cmn_err(CE_WARN,
   1579 				    "could not clear association\n");
   1580 				sc->sc_flags &= ~IWK_F_SCANNING;
   1581 				mutex_exit(&sc->sc_glock);
   1582 				return (err);
   1583 			}
   1584 
   1585 			/* add broadcast node to send probe request */
   1586 			(void) memset(&node, 0, sizeof (node));
   1587 			(void) memset(&node.bssid, 0xff, IEEE80211_ADDR_LEN);
   1588 			node.id = IWK_BROADCAST_ID;
   1589 			err = iwk_cmd(sc, REPLY_ADD_STA, &node,
   1590 			    sizeof (node), 1);
   1591 			if (err != IWK_SUCCESS) {
   1592 				cmn_err(CE_WARN, "could not add "
   1593 				    "broadcast node\n");
   1594 				sc->sc_flags &= ~IWK_F_SCANNING;
   1595 				mutex_exit(&sc->sc_glock);
   1596 				return (err);
   1597 			}
   1598 			break;
   1599 		}
   1600 
   1601 		case IEEE80211_S_AUTH:
   1602 		case IEEE80211_S_ASSOC:
   1603 		case IEEE80211_S_RUN:
   1604 			sc->sc_flags |= IWK_F_SCANNING;
   1605 			sc->sc_scan_pending = 0;
   1606 
   1607 			iwk_set_led(sc, 2, 10, 2);
   1608 			/* FALLTHRU */
   1609 		case IEEE80211_S_SCAN:
   1610 			mutex_exit(&sc->sc_glock);
   1611 			/* step to next channel before actual FW scan */
   1612 			err = sc->sc_newstate(ic, nstate, arg);
   1613 			mutex_enter(&sc->sc_glock);
   1614 			if ((err != 0) || ((err = iwk_scan(sc)) != 0)) {
   1615 				cmn_err(CE_WARN,
   1616 				    "could not initiate scan\n");
   1617 				sc->sc_flags &= ~IWK_F_SCANNING;
   1618 				ieee80211_cancel_scan(ic);
   1619 			}
   1620 			mutex_exit(&sc->sc_glock);
   1621 			return (err);
   1622 		default:
   1623 			break;
   1624 
   1625 		}
   1626 		sc->sc_clk = 0;
   1627 		break;
   1628 
   1629 	case IEEE80211_S_AUTH:
   1630 		if (ostate == IEEE80211_S_SCAN) {
   1631 			sc->sc_flags &= ~IWK_F_SCANNING;
   1632 		}
   1633 
   1634 		/* reset state to handle reassociations correctly */
   1635 		sc->sc_config.assoc_id = 0;
   1636 		sc->sc_config.filter_flags &= ~LE_32(RXON_FILTER_ASSOC_MSK);
   1637 
   1638 		/*
   1639 		 * before sending authentication and association request frame,
   1640 		 * we need do something in the hardware, such as setting the
   1641 		 * channel same to the target AP...
   1642 		 */
   1643 		if ((err = iwk_hw_set_before_auth(sc)) != 0) {
   1644 			cmn_err(CE_WARN, "could not setup firmware for "
   1645 			    "authentication\n");
   1646 			mutex_exit(&sc->sc_glock);
   1647 			return (err);
   1648 		}
   1649 		break;
   1650 
   1651 	case IEEE80211_S_RUN:
   1652 		if (ostate == IEEE80211_S_SCAN) {
   1653 			sc->sc_flags &= ~IWK_F_SCANNING;
   1654 		}
   1655 
   1656 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
   1657 			/* let LED blink when monitoring */
   1658 			iwk_set_led(sc, 2, 10, 10);
   1659 			break;
   1660 		}
   1661 		IWK_DBG((IWK_DEBUG_80211, "iwk: associated."));
   1662 
   1663 		/* IBSS mode */
   1664 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
   1665 			/*
   1666 			 * clean all nodes in ibss node table
   1667 			 * in order to be consistent with hardware
   1668 			 */
   1669 			err = iwk_run_state_config_ibss(ic);
   1670 			if (err != IWK_SUCCESS) {
   1671 				cmn_err(CE_WARN, "iwk_newstate(): "
   1672 				    "failed to update configuration "
   1673 				    "in IBSS mode\n");
   1674 				mutex_exit(&sc->sc_glock);
   1675 				return (err);
   1676 			}
   1677 		}
   1678 
   1679 		/* none IBSS mode */
   1680 		if (ic->ic_opmode != IEEE80211_M_IBSS) {
   1681 			/* update adapter's configuration */
   1682 			err = iwk_run_state_config_sta(ic);
   1683 			if (err != IWK_SUCCESS) {
   1684 				cmn_err(CE_WARN, "iwk_newstate(): "
   1685 				    "failed to update configuration "
   1686 				    "in none IBSS mode\n");
   1687 				mutex_exit(&sc->sc_glock);
   1688 				return (err);
   1689 			}
   1690 		}
   1691 
   1692 		/* obtain current temperature of chipset */
   1693 		sc->sc_tempera = iwk_curr_tempera(sc);
   1694 
   1695 		/*
   1696 		 * make Tx power calibration to determine
   1697 		 * the gains of DSP and radio
   1698 		 */
   1699 		err = iwk_tx_power_calibration(sc);
   1700 		if (err) {
   1701 			cmn_err(CE_WARN, "iwk_newstate(): "
   1702 			    "failed to set tx power table\n");
   1703 			mutex_exit(&sc->sc_glock);
   1704 			return (err);
   1705 		}
   1706 
   1707 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
   1708 
   1709 			/*
   1710 			 * allocate and transmit beacon frames
   1711 			 */
   1712 			err = iwk_start_tx_beacon(ic);
   1713 			if (err != IWK_SUCCESS) {
   1714 				cmn_err(CE_WARN, "iwk_newstate(): "
   1715 				    "can't transmit beacon frames\n");
   1716 				mutex_exit(&sc->sc_glock);
   1717 				return (err);
   1718 			}
   1719 		}
   1720 
   1721 		/* start automatic rate control */
   1722 		mutex_enter(&sc->sc_mt_lock);
   1723 		if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
   1724 			sc->sc_flags |= IWK_F_RATE_AUTO_CTL;
   1725 			/* set rate to some reasonable initial value */
   1726 			i = in->in_rates.ir_nrates - 1;
   1727 			while (i > 0 && IEEE80211_RATE(i) > 72)
   1728 				i--;
   1729 			in->in_txrate = i;
   1730 		} else {
   1731 			sc->sc_flags &= ~IWK_F_RATE_AUTO_CTL;
   1732 		}
   1733 		mutex_exit(&sc->sc_mt_lock);
   1734 
   1735 		/* set LED on after associated */
   1736 		iwk_set_led(sc, 2, 0, 1);
   1737 		break;
   1738 
   1739 	case IEEE80211_S_INIT:
   1740 		if (ostate == IEEE80211_S_SCAN) {
   1741 			sc->sc_flags &= ~IWK_F_SCANNING;
   1742 		}
   1743 
   1744 		/* set LED off after init */
   1745 		iwk_set_led(sc, 2, 1, 0);
   1746 		break;
   1747 	case IEEE80211_S_ASSOC:
   1748 		if (ostate == IEEE80211_S_SCAN) {
   1749 			sc->sc_flags &= ~IWK_F_SCANNING;
   1750 		}
   1751 
   1752 		break;
   1753 	}
   1754 
   1755 	mutex_exit(&sc->sc_glock);
   1756 
   1757 	err = sc->sc_newstate(ic, nstate, arg);
   1758 
   1759 	if (nstate == IEEE80211_S_RUN) {
   1760 
   1761 		mutex_enter(&sc->sc_glock);
   1762 
   1763 		/*
   1764 		 * make initialization for Receiver
   1765 		 * sensitivity calibration
   1766 		 */
   1767 		err = iwk_rx_sens_init(sc);
   1768 		if (err) {
   1769 			cmn_err(CE_WARN, "iwk_newstate(): "
   1770 			    "failed to init RX sensitivity\n");
   1771 			mutex_exit(&sc->sc_glock);
   1772 			return (err);
   1773 		}
   1774 
   1775 		/* make initialization for Receiver gain balance */
   1776 		err = iwk_rxgain_diff_init(sc);
   1777 		if (err) {
   1778 			cmn_err(CE_WARN, "iwk_newstate(): "
   1779 			    "failed to init phy calibration\n");
   1780 			mutex_exit(&sc->sc_glock);
   1781 			return (err);
   1782 		}
   1783 
   1784 		mutex_exit(&sc->sc_glock);
   1785 
   1786 	}
   1787 
   1788 	return (err);
   1789 }
   1790 
   1791 static void
   1792 iwk_watchdog(void *arg)
   1793 {
   1794 	iwk_sc_t *sc = arg;
   1795 	struct ieee80211com *ic = &sc->sc_ic;
   1796 #ifdef DEBUG
   1797 	timeout_id_t timeout_id = ic->ic_watchdog_timer;
   1798 #endif
   1799 
   1800 	ieee80211_stop_watchdog(ic);
   1801 
   1802 	if ((ic->ic_state != IEEE80211_S_AUTH) &&
   1803 	    (ic->ic_state != IEEE80211_S_ASSOC))
   1804 		return;
   1805 
   1806 	if (ic->ic_bss->in_fails > 0) {
   1807 		IWK_DBG((IWK_DEBUG_80211, "watchdog (0x%x) reset: "
   1808 		    "node (0x%x)\n", timeout_id, &ic->ic_bss));
   1809 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   1810 	} else {
   1811 		IWK_DBG((IWK_DEBUG_80211, "watchdog (0x%x) timeout: "
   1812 		    "node (0x%x), retry (%d)\n",
   1813 		    timeout_id, &ic->ic_bss, ic->ic_bss->in_fails + 1));
   1814 		ieee80211_watchdog(ic);
   1815 	}
   1816 }
   1817 
   1818 /*ARGSUSED*/
   1819 static int iwk_key_set(ieee80211com_t *ic, const struct ieee80211_key *k,
   1820     const uint8_t mac[IEEE80211_ADDR_LEN])
   1821 {
   1822 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   1823 	iwk_add_sta_t node;
   1824 	int err;
   1825 	uint8_t index1;
   1826 
   1827 	switch (k->wk_cipher->ic_cipher) {
   1828 	case IEEE80211_CIPHER_WEP:
   1829 	case IEEE80211_CIPHER_TKIP:
   1830 		return (1); /* sofeware do it. */
   1831 	case IEEE80211_CIPHER_AES_CCM:
   1832 		break;
   1833 	default:
   1834 		return (0);
   1835 	}
   1836 	sc->sc_config.filter_flags &= ~LE_32(RXON_FILTER_DIS_DECRYPT_MSK |
   1837 	    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   1838 
   1839 	mutex_enter(&sc->sc_glock);
   1840 
   1841 	/* update ap/multicast node */
   1842 	(void) memset(&node, 0, sizeof (node));
   1843 	if (IEEE80211_IS_MULTICAST(mac)) {
   1844 		(void) memset(node.bssid, 0xff, 6);
   1845 		node.id = IWK_BROADCAST_ID;
   1846 	} else if (ic->ic_opmode == IEEE80211_M_IBSS) {
   1847 		mutex_exit(&sc->sc_glock);
   1848 		mutex_enter(&sc->sc_ibss.node_tb_lock);
   1849 
   1850 		/*
   1851 		 * search for node in ibss node table
   1852 		 */
   1853 		for (index1 = IWK_STA_ID; index1 < IWK_STATION_COUNT;
   1854 		    index1++) {
   1855 			if (sc->sc_ibss.ibss_node_tb[index1].used &&
   1856 			    IEEE80211_ADDR_EQ(sc->sc_ibss.
   1857 			    ibss_node_tb[index1].node.bssid,
   1858 			    mac)) {
   1859 				break;
   1860 			}
   1861 		}
   1862 		if (index1 >= IWK_BROADCAST_ID) {
   1863 			cmn_err(CE_WARN, "iwk_key_set(): "
   1864 			    "have no this node in hardware node table\n");
   1865 			mutex_exit(&sc->sc_ibss.node_tb_lock);
   1866 			return (0);
   1867 		} else {
   1868 			/*
   1869 			 * configure key for given node in hardware
   1870 			 */
   1871 			if (k->wk_flags & IEEE80211_KEY_XMIT) {
   1872 				sc->sc_ibss.ibss_node_tb[index1].
   1873 				    node.key_flags = 0;
   1874 				sc->sc_ibss.ibss_node_tb[index1].
   1875 				    node.keyp = k->wk_keyix;
   1876 			} else {
   1877 				sc->sc_ibss.ibss_node_tb[index1].
   1878 				    node.key_flags = (1 << 14);
   1879 				sc->sc_ibss.ibss_node_tb[index1].
   1880 				    node.keyp = k->wk_keyix + 4;
   1881 			}
   1882 
   1883 			(void) memcpy(sc->sc_ibss.ibss_node_tb[index1].node.key,
   1884 			    k->wk_key, k->wk_keylen);
   1885 			sc->sc_ibss.ibss_node_tb[index1].node.key_flags |=
   1886 			    (STA_KEY_FLG_CCMP | (1 << 3) | (k->wk_keyix << 8));
   1887 			sc->sc_ibss.ibss_node_tb[index1].node.key_flags =
   1888 			    LE_16(sc->sc_ibss.ibss_node_tb[index1].
   1889 			    node.key_flags);
   1890 			sc->sc_ibss.ibss_node_tb[index1].node.sta_mask =
   1891 			    STA_MODIFY_KEY_MASK;
   1892 			sc->sc_ibss.ibss_node_tb[index1].node.control = 1;
   1893 
   1894 			mutex_enter(&sc->sc_glock);
   1895 			err = iwk_cmd(sc, REPLY_ADD_STA,
   1896 			    &sc->sc_ibss.ibss_node_tb[index1].node,
   1897 			    sizeof (iwk_add_sta_t), 1);
   1898 			if (err != IWK_SUCCESS) {
   1899 				cmn_err(CE_WARN, "iwk_key_set(): "
   1900 				    "failed to update IBSS node in hardware\n");
   1901 				mutex_exit(&sc->sc_glock);
   1902 				mutex_exit(&sc->sc_ibss.node_tb_lock);
   1903 				return (0);
   1904 			}
   1905 			mutex_exit(&sc->sc_glock);
   1906 		}
   1907 		mutex_exit(&sc->sc_ibss.node_tb_lock);
   1908 		return (1);
   1909 	} else {
   1910 		IEEE80211_ADDR_COPY(node.bssid, ic->ic_bss->in_bssid);
   1911 		node.id = IWK_AP_ID;
   1912 	}
   1913 	if (k->wk_flags & IEEE80211_KEY_XMIT) {
   1914 		node.key_flags = 0;
   1915 		node.keyp = k->wk_keyix;
   1916 	} else {
   1917 		node.key_flags = (1 << 14);
   1918 		node.keyp = k->wk_keyix + 4;
   1919 	}
   1920 	(void) memcpy(node.key, k->wk_key, k->wk_keylen);
   1921 	node.key_flags |= (STA_KEY_FLG_CCMP | (1 << 3) | (k->wk_keyix << 8));
   1922 	node.key_flags = LE_16(node.key_flags);
   1923 	node.sta_mask = STA_MODIFY_KEY_MASK;
   1924 	node.control = 1;
   1925 	err = iwk_cmd(sc, REPLY_ADD_STA, &node, sizeof (node), 1);
   1926 	if (err != IWK_SUCCESS) {
   1927 		cmn_err(CE_WARN, "iwk_key_set():"
   1928 		    "failed to update ap node\n");
   1929 		mutex_exit(&sc->sc_glock);
   1930 		return (0);
   1931 	}
   1932 	mutex_exit(&sc->sc_glock);
   1933 	return (1);
   1934 }
   1935 
   1936 /*
   1937  * exclusive access to mac begin.
   1938  */
   1939 static void
   1940 iwk_mac_access_enter(iwk_sc_t *sc)
   1941 {
   1942 	uint32_t tmp;
   1943 	int n;
   1944 
   1945 	tmp = IWK_READ(sc, CSR_GP_CNTRL);
   1946 	IWK_WRITE(sc, CSR_GP_CNTRL,
   1947 	    tmp | CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
   1948 
   1949 	/* wait until we succeed */
   1950 	for (n = 0; n < 1000; n++) {
   1951 		if ((IWK_READ(sc, CSR_GP_CNTRL) &
   1952 		    (CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY |
   1953 		    CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP)) ==
   1954 		    CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN)
   1955 			break;
   1956 		DELAY(10);
   1957 	}
   1958 	if (n == 1000)
   1959 		IWK_DBG((IWK_DEBUG_PIO, "could not lock memory\n"));
   1960 }
   1961 
   1962 /*
   1963  * exclusive access to mac end.
   1964  */
   1965 static void
   1966 iwk_mac_access_exit(iwk_sc_t *sc)
   1967 {
   1968 	uint32_t tmp = IWK_READ(sc, CSR_GP_CNTRL);
   1969 	IWK_WRITE(sc, CSR_GP_CNTRL,
   1970 	    tmp & ~CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
   1971 }
   1972 
   1973 static uint32_t
   1974 iwk_mem_read(iwk_sc_t *sc, uint32_t addr)
   1975 {
   1976 	IWK_WRITE(sc, HBUS_TARG_MEM_RADDR, addr);
   1977 	return (IWK_READ(sc, HBUS_TARG_MEM_RDAT));
   1978 }
   1979 
   1980 static void
   1981 iwk_mem_write(iwk_sc_t *sc, uint32_t addr, uint32_t data)
   1982 {
   1983 	IWK_WRITE(sc, HBUS_TARG_MEM_WADDR, addr);
   1984 	IWK_WRITE(sc, HBUS_TARG_MEM_WDAT, data);
   1985 }
   1986 
   1987 static uint32_t
   1988 iwk_reg_read(iwk_sc_t *sc, uint32_t addr)
   1989 {
   1990 	IWK_WRITE(sc, HBUS_TARG_PRPH_RADDR, addr | (3 << 24));
   1991 	return (IWK_READ(sc, HBUS_TARG_PRPH_RDAT));
   1992 }
   1993 
   1994 static void
   1995 iwk_reg_write(iwk_sc_t *sc, uint32_t addr, uint32_t data)
   1996 {
   1997 	IWK_WRITE(sc, HBUS_TARG_PRPH_WADDR, addr | (3 << 24));
   1998 	IWK_WRITE(sc, HBUS_TARG_PRPH_WDAT, data);
   1999 }
   2000 
   2001 static void
   2002 iwk_reg_write_region_4(iwk_sc_t *sc, uint32_t addr,
   2003     uint32_t *data, int wlen)
   2004 {
   2005 	for (; wlen > 0; wlen--, data++, addr += 4)
   2006 		iwk_reg_write(sc, addr, LE_32(*data));
   2007 }
   2008 
   2009 
   2010 /*
   2011  * ucode load/initialization steps:
   2012  * 1)  load Bootstrap State Machine (BSM) with "bootstrap" uCode image.
   2013  * BSM contains a small memory that *always* stays powered up, so it can
   2014  * retain the bootstrap program even when the card is in a power-saving
   2015  * power-down state.  The BSM loads the small program into ARC processor's
   2016  * instruction memory when triggered by power-up.
   2017  * 2)  load Initialize image via bootstrap program.
   2018  * The Initialize image sets up regulatory and calibration data for the
   2019  * Runtime/Protocol uCode. This sends a REPLY_ALIVE notification when completed.
   2020  * The 4965 reply contains calibration data for temperature, voltage and tx gain
   2021  * correction.
   2022  */
   2023 static int
   2024 iwk_load_firmware(iwk_sc_t *sc)
   2025 {
   2026 	uint32_t *boot_fw = (uint32_t *)sc->sc_boot;
   2027 	uint32_t size = LE_32(sc->sc_hdr->bootsz);
   2028 	int n, err = IWK_SUCCESS;
   2029 
   2030 	/*
   2031 	 * The physical address bit [4-35] of the initialize uCode.
   2032 	 * In the initialize alive notify interrupt the physical address of
   2033 	 * the runtime ucode will be set for loading.
   2034 	 */
   2035 	iwk_mac_access_enter(sc);
   2036 
   2037 	iwk_reg_write(sc, BSM_DRAM_INST_PTR_REG,
   2038 	    sc->sc_dma_fw_init_text.cookie.dmac_address >> 4);
   2039 	iwk_reg_write(sc, BSM_DRAM_DATA_PTR_REG,
   2040 	    sc->sc_dma_fw_init_data.cookie.dmac_address >> 4);
   2041 	iwk_reg_write(sc, BSM_DRAM_INST_BYTECOUNT_REG,
   2042 	    sc->sc_dma_fw_init_text.cookie.dmac_size);
   2043 	iwk_reg_write(sc, BSM_DRAM_DATA_BYTECOUNT_REG,
   2044 	    sc->sc_dma_fw_init_data.cookie.dmac_size);
   2045 
   2046 	/* load bootstrap code into BSM memory */
   2047 	iwk_reg_write_region_4(sc, BSM_SRAM_LOWER_BOUND, boot_fw,
   2048 	    size / sizeof (uint32_t));
   2049 
   2050 	iwk_reg_write(sc, BSM_WR_MEM_SRC_REG, 0);
   2051 	iwk_reg_write(sc, BSM_WR_MEM_DST_REG, RTC_INST_LOWER_BOUND);
   2052 	iwk_reg_write(sc, BSM_WR_DWCOUNT_REG, size / sizeof (uint32_t));
   2053 
   2054 	/*
   2055 	 * prepare to load initialize uCode
   2056 	 */
   2057 	iwk_reg_write(sc, BSM_WR_CTRL_REG, BSM_WR_CTRL_REG_BIT_START);
   2058 
   2059 	/* wait while the adapter is busy loading the firmware */
   2060 	for (n = 0; n < 1000; n++) {
   2061 		if (!(iwk_reg_read(sc, BSM_WR_CTRL_REG) &
   2062 		    BSM_WR_CTRL_REG_BIT_START))
   2063 			break;
   2064 		DELAY(10);
   2065 	}
   2066 	if (n == 1000) {
   2067 		cmn_err(CE_WARN, "timeout transferring firmware\n");
   2068 		err = ETIMEDOUT;
   2069 		return (err);
   2070 	}
   2071 
   2072 	/* for future power-save mode use */
   2073 	iwk_reg_write(sc, BSM_WR_CTRL_REG, BSM_WR_CTRL_REG_BIT_START_EN);
   2074 
   2075 	iwk_mac_access_exit(sc);
   2076 
   2077 	return (err);
   2078 }
   2079 
   2080 /*ARGSUSED*/
   2081 static void
   2082 iwk_rx_intr(iwk_sc_t *sc, iwk_rx_desc_t *desc, iwk_rx_data_t *data)
   2083 {
   2084 	ieee80211com_t *ic = &sc->sc_ic;
   2085 	iwk_rx_ring_t *ring = &sc->sc_rxq;
   2086 	iwk_rx_phy_res_t *stat;
   2087 	ieee80211_node_t *in;
   2088 	uint32_t *tail;
   2089 	struct ieee80211_frame *wh;
   2090 	mblk_t *mp;
   2091 	uint16_t len, rssi, mrssi, agc;
   2092 	int16_t t;
   2093 	uint32_t ants, i;
   2094 	struct iwk_rx_non_cfg_phy *phyinfo;
   2095 	uint32_t crc;
   2096 
   2097 	/* assuming not 11n here. cope with 11n in phase-II */
   2098 	stat = (iwk_rx_phy_res_t *)(desc + 1);
   2099 	if (stat->cfg_phy_cnt > 20) {
   2100 		return;
   2101 	}
   2102 
   2103 	for (i = 0; i < RX_RES_PHY_CNT; i++)
   2104 		stat->non_cfg_phy[i] = LE_16(stat->non_cfg_phy[i]);
   2105 
   2106 	phyinfo = (struct iwk_rx_non_cfg_phy *)stat->non_cfg_phy;
   2107 	agc = (phyinfo->agc_info & IWK_AGC_DB_MASK) >> IWK_AGC_DB_POS;
   2108 	mrssi = 0;
   2109 	ants = (LE_16(stat->phy_flags) & RX_PHY_FLAGS_ANTENNAE_MASK) >>
   2110 	    RX_PHY_FLAGS_ANTENNAE_OFFSET;
   2111 	for (i = 0; i < 3; i++) {
   2112 		if (ants & (1 << i))
   2113 			mrssi = MAX(mrssi, phyinfo->rssi_info[i << 1]);
   2114 	}
   2115 	t = mrssi - agc - 44; /* t is the dBM value */
   2116 	/*
   2117 	 * convert dBm to percentage ???
   2118 	 */
   2119 	rssi = (100 * 75 * 75 - (-20 - t) * (15 * 75 + 62 * (-20 - t))) /
   2120 	    (75 * 75);
   2121 	if (rssi > 100)
   2122 		rssi = 100;
   2123 	if (rssi < 1)
   2124 		rssi = 1;
   2125 	len = LE_16(stat->byte_count);
   2126 	tail = (uint32_t *)((caddr_t)(stat + 1) + stat->cfg_phy_cnt + len);
   2127 	bcopy(tail, &crc, 4);
   2128 
   2129 	IWK_DBG((IWK_DEBUG_RX, "rx intr: idx=%d phy_len=%x len=%d "
   2130 	    "rate=%x chan=%d tstamp=%x non_cfg_phy_count=%x "
   2131 	    "cfg_phy_count=%x tail=%x", ring->cur, sizeof (*stat),
   2132 	    len, stat->rate.r.s.rate, LE_16(stat->channel),
   2133 	    LE_32(stat->timestampl), stat->non_cfg_phy_cnt,
   2134 	    stat->cfg_phy_cnt, LE_32(crc)));
   2135 
   2136 	if ((len < 16) || (len > sc->sc_dmabuf_sz)) {
   2137 		IWK_DBG((IWK_DEBUG_RX, "rx frame oversize\n"));
   2138 		return;
   2139 	}
   2140 
   2141 	/*
   2142 	 * discard Rx frames with bad CRC
   2143 	 */
   2144 	if ((LE_32(crc) &
   2145 	    (RX_RES_STATUS_NO_CRC32_ERROR | RX_RES_STATUS_NO_RXE_OVERFLOW)) !=
   2146 	    (RX_RES_STATUS_NO_CRC32_ERROR | RX_RES_STATUS_NO_RXE_OVERFLOW)) {
   2147 		IWK_DBG((IWK_DEBUG_RX, "rx crc error tail: %x\n",
   2148 		    LE_32(crc)));
   2149 		sc->sc_rx_err++;
   2150 		return;
   2151 	}
   2152 
   2153 	wh = (struct ieee80211_frame *)
   2154 	    ((uint8_t *)(stat + 1)+ stat->cfg_phy_cnt);
   2155 	if (*(uint8_t *)wh == IEEE80211_FC0_SUBTYPE_ASSOC_RESP) {
   2156 		sc->sc_assoc_id = *((uint16_t *)(wh + 1) + 2);
   2157 		IWK_DBG((IWK_DEBUG_RX, "rx : association id = %x\n",
   2158 		    sc->sc_assoc_id));
   2159 	}
   2160 #ifdef DEBUG
   2161 	if (iwk_dbg_flags & IWK_DEBUG_RX)
   2162 		ieee80211_dump_pkt((uint8_t *)wh, len, 0, 0);
   2163 #endif
   2164 	in = ieee80211_find_rxnode(ic, wh);
   2165 	mp = allocb(len, BPRI_MED);
   2166 	if (mp) {
   2167 		(void) memcpy(mp->b_wptr, wh, len);
   2168 		mp->b_wptr += len;
   2169 
   2170 		/* send the frame to the 802.11 layer */
   2171 		(void) ieee80211_input(ic, mp, in, rssi, 0);
   2172 	} else {
   2173 		sc->sc_rx_nobuf++;
   2174 		IWK_DBG((IWK_DEBUG_RX,
   2175 		    "iwk_rx_intr(): alloc rx buf failed\n"));
   2176 	}
   2177 	/* release node reference */
   2178 	ieee80211_free_node(in);
   2179 }
   2180 
   2181 /*ARGSUSED*/
   2182 static void
   2183 iwk_tx_intr(iwk_sc_t *sc, iwk_rx_desc_t *desc, iwk_rx_data_t *data)
   2184 {
   2185 	ieee80211com_t *ic = &sc->sc_ic;
   2186 	iwk_tx_ring_t *ring = &sc->sc_txq[desc->hdr.qid & 0x3];
   2187 	iwk_tx_stat_t *stat = (iwk_tx_stat_t *)(desc + 1);
   2188 	iwk_amrr_t *amrr = (iwk_amrr_t *)ic->ic_bss;
   2189 
   2190 	IWK_DBG((IWK_DEBUG_TX, "tx done: qid=%d idx=%d"
   2191 	    " retries=%d frame_count=%x nkill=%d "
   2192 	    "rate=%x duration=%d status=%x\n",
   2193 	    desc->hdr.qid, desc->hdr.idx, stat->ntries, stat->frame_count,
   2194 	    stat->bt_kill_count, stat->rate.r.s.rate,
   2195 	    LE_16(stat->duration), LE_32(stat->status)));
   2196 
   2197 	amrr->txcnt++;
   2198 	IWK_DBG((IWK_DEBUG_RATECTL, "tx: %d cnt\n", amrr->txcnt));
   2199 	if (stat->ntries > 0) {
   2200 		amrr->retrycnt++;
   2201 		sc->sc_tx_retries++;
   2202 		IWK_DBG((IWK_DEBUG_TX, "tx: %d retries\n",
   2203 		    sc->sc_tx_retries));
   2204 	}
   2205 
   2206 	sc->sc_tx_timer = 0;
   2207 
   2208 	mutex_enter(&sc->sc_tx_lock);
   2209 	ring->queued--;
   2210 	if (ring->queued < 0)
   2211 		ring->queued = 0;
   2212 	if ((sc->sc_need_reschedule) && (ring->queued <= (ring->count << 3))) {
   2213 		sc->sc_need_reschedule = 0;
   2214 		mutex_exit(&sc->sc_tx_lock);
   2215 		mac_tx_update(ic->ic_mach);
   2216 		mutex_enter(&sc->sc_tx_lock);
   2217 	}
   2218 	mutex_exit(&sc->sc_tx_lock);
   2219 }
   2220 
   2221 static void
   2222 iwk_cmd_intr(iwk_sc_t *sc, iwk_rx_desc_t *desc)
   2223 {
   2224 	if ((desc->hdr.qid & 7) != 4) {
   2225 		return;
   2226 	}
   2227 	mutex_enter(&sc->sc_glock);
   2228 	sc->sc_flags |= IWK_F_CMD_DONE;
   2229 	cv_signal(&sc->sc_cmd_cv);
   2230 	mutex_exit(&sc->sc_glock);
   2231 	IWK_DBG((IWK_DEBUG_CMD, "rx cmd: "
   2232 	    "qid=%x idx=%d flags=%x type=0x%x\n",
   2233 	    desc->hdr.qid, desc->hdr.idx, desc->hdr.flags,
   2234 	    desc->hdr.type));
   2235 }
   2236 
   2237 static void
   2238 iwk_ucode_alive(iwk_sc_t *sc, iwk_rx_desc_t *desc)
   2239 {
   2240 	uint32_t base, i;
   2241 	struct iwk_alive_resp *ar =
   2242 	    (struct iwk_alive_resp *)(desc + 1);
   2243 
   2244 	/* the microcontroller is ready */
   2245 	IWK_DBG((IWK_DEBUG_FW,
   2246 	    "microcode alive notification minor: %x major: %x type:"
   2247 	    " %x subtype: %x\n",
   2248 	    ar->ucode_minor, ar->ucode_minor, ar->ver_type, ar->ver_subtype));
   2249 
   2250 	if (LE_32(ar->is_valid) != UCODE_VALID_OK) {
   2251 		IWK_DBG((IWK_DEBUG_FW,
   2252 		    "microcontroller initialization failed\n"));
   2253 	}
   2254 	if (ar->ver_subtype == INITIALIZE_SUBTYPE) {
   2255 		IWK_DBG((IWK_DEBUG_FW,
   2256 		    "initialization alive received.\n"));
   2257 		(void) memcpy(&sc->sc_card_alive_init, ar,
   2258 		    sizeof (struct iwk_init_alive_resp));
   2259 		/* XXX get temperature */
   2260 		iwk_mac_access_enter(sc);
   2261 		iwk_reg_write(sc, BSM_DRAM_INST_PTR_REG,
   2262 		    sc->sc_dma_fw_text.cookie.dmac_address >> 4);
   2263 		iwk_reg_write(sc, BSM_DRAM_DATA_PTR_REG,
   2264 		    sc->sc_dma_fw_data_bak.cookie.dmac_address >> 4);
   2265 		iwk_reg_write(sc, BSM_DRAM_DATA_BYTECOUNT_REG,
   2266 		    sc->sc_dma_fw_data.cookie.dmac_size);
   2267 		iwk_reg_write(sc, BSM_DRAM_INST_BYTECOUNT_REG,
   2268 		    sc->sc_dma_fw_text.cookie.dmac_size | 0x80000000);
   2269 		iwk_mac_access_exit(sc);
   2270 	} else {
   2271 		IWK_DBG((IWK_DEBUG_FW, "runtime alive received.\n"));
   2272 		(void) memcpy(&sc->sc_card_alive_run, ar,
   2273 		    sizeof (struct iwk_alive_resp));
   2274 
   2275 		/*
   2276 		 * Init SCD related registers to make Tx work. XXX
   2277 		 */
   2278 		iwk_mac_access_enter(sc);
   2279 
   2280 		/* read sram address of data base */
   2281 		sc->sc_scd_base = iwk_reg_read(sc, SCD_SRAM_BASE_ADDR);
   2282 
   2283 		/* clear and init SCD_CONTEXT_DATA_OFFSET area. 128 bytes */
   2284 		for (base = sc->sc_scd_base + SCD_CONTEXT_DATA_OFFSET, i = 0;
   2285 		    i < 128; i += 4)
   2286 			iwk_mem_write(sc, base + i, 0);
   2287 
   2288 		/* clear and init SCD_TX_STTS_BITMAP_OFFSET area. 256 bytes */
   2289 		for (base = sc->sc_scd_base + SCD_TX_STTS_BITMAP_OFFSET;
   2290 		    i < 256; i += 4)
   2291 			iwk_mem_write(sc, base + i, 0);
   2292 
   2293 		/* clear and init SCD_TRANSLATE_TBL_OFFSET area. 32 bytes */
   2294 		for (base = sc->sc_scd_base + SCD_TRANSLATE_TBL_OFFSET;
   2295 		    i < sizeof (uint16_t) * IWK_NUM_QUEUES; i += 4)
   2296 			iwk_mem_write(sc, base + i, 0);
   2297 
   2298 		iwk_reg_write(sc, SCD_DRAM_BASE_ADDR,
   2299 		    sc->sc_dma_sh.cookie.dmac_address >> 10);
   2300 		iwk_reg_write(sc, SCD_QUEUECHAIN_SEL, 0);
   2301 
   2302 		/* initiate the tx queues */
   2303 		for (i = 0; i < IWK_NUM_QUEUES; i++) {
   2304 			iwk_reg_write(sc, SCD_QUEUE_RDPTR(i), 0);
   2305 			IWK_WRITE(sc, HBUS_TARG_WRPTR, (i << 8));
   2306 			iwk_mem_write(sc, sc->sc_scd_base +
   2307 			    SCD_CONTEXT_QUEUE_OFFSET(i),
   2308 			    (SCD_WIN_SIZE & 0x7f));
   2309 			iwk_mem_write(sc, sc->sc_scd_base +
   2310 			    SCD_CONTEXT_QUEUE_OFFSET(i) + sizeof (uint32_t),
   2311 			    (SCD_FRAME_LIMIT & 0x7f) << 16);
   2312 		}
   2313 		/* interrupt enable on each queue0-7 */
   2314 		iwk_reg_write(sc, SCD_INTERRUPT_MASK,
   2315 		    (1 << IWK_NUM_QUEUES) - 1);
   2316 		/* enable  each channel 0-7 */
   2317 		iwk_reg_write(sc, SCD_TXFACT,
   2318 		    SCD_TXFACT_REG_TXFIFO_MASK(0, 7));
   2319 		/*
   2320 		 * queue 0-7 maps to FIFO 0-7 and
   2321 		 * all queues work under FIFO mode (none-scheduler-ack)
   2322 		 */
   2323 		for (i = 0; i < 7; i++) {
   2324 			iwk_reg_write(sc,
   2325 			    SCD_QUEUE_STATUS_BITS(i),
   2326 			    (1 << SCD_QUEUE_STTS_REG_POS_ACTIVE)|
   2327 			    (i << SCD_QUEUE_STTS_REG_POS_TXF)|
   2328 			    SCD_QUEUE_STTS_REG_MSK);
   2329 		}
   2330 		iwk_mac_access_exit(sc);
   2331 
   2332 		sc->sc_flags |= IWK_F_FW_INIT;
   2333 		cv_signal(&sc->sc_fw_cv);
   2334 	}
   2335 
   2336 }
   2337 
   2338 static uint_t
   2339 /* LINTED: argument unused in function: unused */
   2340 iwk_rx_softintr(caddr_t arg, caddr_t unused)
   2341 {
   2342 	iwk_sc_t *sc = (iwk_sc_t *)arg;
   2343 	ieee80211com_t *ic = &sc->sc_ic;
   2344 	iwk_rx_desc_t *desc;
   2345 	iwk_rx_data_t *data;
   2346 	uint32_t index;
   2347 
   2348 	mutex_enter(&sc->sc_glock);
   2349 	if (sc->sc_rx_softint_pending != 1) {
   2350 		mutex_exit(&sc->sc_glock);
   2351 		return (DDI_INTR_UNCLAIMED);
   2352 	}
   2353 	/* disable interrupts */
   2354 	IWK_WRITE(sc, CSR_INT_MASK, 0);
   2355 	mutex_exit(&sc->sc_glock);
   2356 
   2357 	/*
   2358 	 * firmware has moved the index of the rx queue, driver get it,
   2359 	 * and deal with it.
   2360 	 */
   2361 	index = sc->sc_shared->val0 & 0xfff;
   2362 
   2363 	while (sc->sc_rxq.cur != index) {
   2364 		data = &sc->sc_rxq.data[sc->sc_rxq.cur];
   2365 		desc = (iwk_rx_desc_t *)data->dma_data.mem_va;
   2366 
   2367 		IWK_DBG((IWK_DEBUG_INTR, "rx notification index = %d"
   2368 		    " cur = %d qid=%x idx=%d flags=%x type=%x len=%d\n",
   2369 		    index, sc->sc_rxq.cur, desc->hdr.qid, desc->hdr.idx,
   2370 		    desc->hdr.flags, desc->hdr.type, LE_32(desc->len)));
   2371 
   2372 		/* a command other than a tx need to be replied */
   2373 		if (!(desc->hdr.qid & 0x80) &&
   2374 		    (desc->hdr.type != REPLY_RX_PHY_CMD) &&
   2375 		    (desc->hdr.type != REPLY_TX) &&
   2376 		    (desc->hdr.type != REPLY_TX_PWR_TABLE_CMD) &&
   2377 		    (desc->hdr.type != REPLY_PHY_CALIBRATION_CMD) &&
   2378 		    (desc->hdr.type != SENSITIVITY_CMD))
   2379 			iwk_cmd_intr(sc, desc);
   2380 
   2381 		switch (desc->hdr.type) {
   2382 		case REPLY_4965_RX:
   2383 			iwk_rx_intr(sc, desc, data);
   2384 			break;
   2385 
   2386 		case REPLY_TX:
   2387 			iwk_tx_intr(sc, desc, data);
   2388 			break;
   2389 
   2390 		case REPLY_ALIVE:
   2391 			iwk_ucode_alive(sc, desc);
   2392 			break;
   2393 
   2394 		case CARD_STATE_NOTIFICATION:
   2395 		{
   2396 			uint32_t *status = (uint32_t *)(desc + 1);
   2397 
   2398 			IWK_DBG((IWK_DEBUG_RADIO, "state changed to %x\n",
   2399 			    LE_32(*status)));
   2400 
   2401 			if (LE_32(*status) & 1) {
   2402 				/*
   2403 				 * the radio button has to be pushed(OFF). It
   2404 				 * is considered as a hw error, the
   2405 				 * iwk_thread() tries to recover it after the
   2406 				 * button is pushed again(ON)
   2407 				 */
   2408 				cmn_err(CE_NOTE,
   2409 				    "iwk_rx_softintr(): "
   2410 				    "Radio transmitter is off\n");
   2411 				sc->sc_ostate = sc->sc_ic.ic_state;
   2412 				ieee80211_new_state(&sc->sc_ic,
   2413 				    IEEE80211_S_INIT, -1);
   2414 				sc->sc_flags |=
   2415 				    (IWK_F_HW_ERR_RECOVER | IWK_F_RADIO_OFF);
   2416 			}
   2417 			break;
   2418 		}
   2419 		case SCAN_START_NOTIFICATION:
   2420 		{
   2421 			iwk_start_scan_t *scan =
   2422 			    (iwk_start_scan_t *)(desc + 1);
   2423 
   2424 			IWK_DBG((IWK_DEBUG_SCAN,
   2425 			    "scanning channel %d status %x\n",
   2426 			    scan->chan, LE_32(scan->status)));
   2427 
   2428 			ic->ic_curchan = &ic->ic_sup_channels[scan->chan];
   2429 			break;
   2430 		}
   2431 		case SCAN_COMPLETE_NOTIFICATION:
   2432 		{
   2433 			iwk_stop_scan_t *scan =
   2434 			    (iwk_stop_scan_t *)(desc + 1);
   2435 
   2436 			IWK_DBG((IWK_DEBUG_SCAN,
   2437 			    "completed channel %d (burst of %d) status %02x\n",
   2438 			    scan->chan, scan->nchan, scan->status));
   2439 
   2440 			sc->sc_scan_pending++;
   2441 			break;
   2442 		}
   2443 		case STATISTICS_NOTIFICATION:
   2444 			/* handle statistics notification */
   2445 			iwk_statistics_notify(sc, desc);
   2446 			break;
   2447 		}
   2448 
   2449 		sc->sc_rxq.cur = (sc->sc_rxq.cur + 1) % RX_QUEUE_SIZE;
   2450 	}
   2451 
   2452 	/*
   2453 	 * driver dealt with what reveived in rx queue and tell the information
   2454 	 * to the firmware.
   2455 	 */
   2456 	index = (index == 0) ? RX_QUEUE_SIZE - 1 : index - 1;
   2457 	IWK_WRITE(sc, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, index & (~7));
   2458 
   2459 	mutex_enter(&sc->sc_glock);
   2460 	/* re-enable interrupts */
   2461 	IWK_WRITE(sc, CSR_INT_MASK, CSR_INI_SET_MASK);
   2462 	sc->sc_rx_softint_pending = 0;
   2463 	mutex_exit(&sc->sc_glock);
   2464 
   2465 	return (DDI_INTR_CLAIMED);
   2466 }
   2467 
   2468 static uint_t
   2469 /* LINTED: argument unused in function: unused */
   2470 iwk_intr(caddr_t arg, caddr_t unused)
   2471 {
   2472 	iwk_sc_t *sc = (iwk_sc_t *)arg;
   2473 	uint32_t r, rfh;
   2474 
   2475 	mutex_enter(&sc->sc_glock);
   2476 
   2477 	if (sc->sc_flags & IWK_F_SUSPEND) {
   2478 		mutex_exit(&sc->sc_glock);
   2479 		return (DDI_INTR_UNCLAIMED);
   2480 	}
   2481 
   2482 	r = IWK_READ(sc, CSR_INT);
   2483 	if (r == 0 || r == 0xffffffff) {
   2484 		mutex_exit(&sc->sc_glock);
   2485 		return (DDI_INTR_UNCLAIMED);
   2486 	}
   2487 
   2488 	IWK_DBG((IWK_DEBUG_INTR, "interrupt reg %x\n", r));
   2489 
   2490 	rfh = IWK_READ(sc, CSR_FH_INT_STATUS);
   2491 	IWK_DBG((IWK_DEBUG_INTR, "FH interrupt reg %x\n", rfh));
   2492 	/* disable interrupts */
   2493 	IWK_WRITE(sc, CSR_INT_MASK, 0);
   2494 	/* ack interrupts */
   2495 	IWK_WRITE(sc, CSR_INT, r);
   2496 	IWK_WRITE(sc, CSR_FH_INT_STATUS, rfh);
   2497 
   2498 	if (sc->sc_soft_hdl == NULL) {
   2499 		mutex_exit(&sc->sc_glock);
   2500 		return (DDI_INTR_CLAIMED);
   2501 	}
   2502 	if (r & (BIT_INT_SWERROR | BIT_INT_ERR)) {
   2503 		cmn_err(CE_WARN, "fatal firmware error\n");
   2504 		mutex_exit(&sc->sc_glock);
   2505 #ifdef DEBUG
   2506 		/* dump event and error logs to dmesg */
   2507 		iwk_write_error_log(sc);
   2508 		iwk_write_event_log(sc);
   2509 #endif /* DEBUG */
   2510 		iwk_stop(sc);
   2511 		sc->sc_ostate = sc->sc_ic.ic_state;
   2512 
   2513 		/* not capable of fast recovery */
   2514 		if (!IWK_CHK_FAST_RECOVER(sc))
   2515 			ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
   2516 
   2517 		sc->sc_flags |= IWK_F_HW_ERR_RECOVER;
   2518 		return (DDI_INTR_CLAIMED);
   2519 	}
   2520 
   2521 	if (r & BIT_INT_RF_KILL) {
   2522 		uint32_t tmp = IWK_READ(sc, CSR_GP_CNTRL);
   2523 		if (tmp & (1 << 27))
   2524 			cmn_err(CE_NOTE, "RF switch: radio on\n");
   2525 	}
   2526 
   2527 	if ((r & (BIT_INT_FH_RX | BIT_INT_SW_RX)) ||
   2528 	    (rfh & FH_INT_RX_MASK)) {
   2529 		sc->sc_rx_softint_pending = 1;
   2530 		(void) ddi_intr_trigger_softint(sc->sc_soft_hdl, NULL);
   2531 	}
   2532 
   2533 	if (r & BIT_INT_ALIVE)	{
   2534 		IWK_DBG((IWK_DEBUG_FW, "firmware initialized.\n"));
   2535 	}
   2536 
   2537 	/* re-enable interrupts */
   2538 	IWK_WRITE(sc, CSR_INT_MASK, CSR_INI_SET_MASK);
   2539 	mutex_exit(&sc->sc_glock);
   2540 
   2541 	return (DDI_INTR_CLAIMED);
   2542 }
   2543 
   2544 static uint8_t
   2545 iwk_rate_to_plcp(int rate)
   2546 {
   2547 	uint8_t ret;
   2548 
   2549 	switch (rate) {
   2550 	/* CCK rates */
   2551 	case 2:
   2552 		ret = 0xa;
   2553 		break;
   2554 	case 4:
   2555 		ret = 0x14;
   2556 		break;
   2557 	case 11:
   2558 		ret = 0x37;
   2559 		break;
   2560 	case 22:
   2561 		ret = 0x6e;
   2562 		break;
   2563 	/* OFDM rates */
   2564 	case 12:
   2565 		ret = 0xd;
   2566 		break;
   2567 	case 18:
   2568 		ret = 0xf;
   2569 		break;
   2570 	case 24:
   2571 		ret = 0x5;
   2572 		break;
   2573 	case 36:
   2574 		ret = 0x7;
   2575 		break;
   2576 	case 48:
   2577 		ret = 0x9;
   2578 		break;
   2579 	case 72:
   2580 		ret = 0xb;
   2581 		break;
   2582 	case 96:
   2583 		ret = 0x1;
   2584 		break;
   2585 	case 108:
   2586 		ret = 0x3;
   2587 		break;
   2588 	default:
   2589 		ret = 0;
   2590 		break;
   2591 	}
   2592 	return (ret);
   2593 }
   2594 
   2595 static mblk_t *
   2596 iwk_m_tx(void *arg, mblk_t *mp)
   2597 {
   2598 	iwk_sc_t	*sc = (iwk_sc_t *)arg;
   2599 	ieee80211com_t	*ic = &sc->sc_ic;
   2600 	mblk_t			*next;
   2601 
   2602 	if (sc->sc_flags & IWK_F_SUSPEND) {
   2603 		freemsgchain(mp);
   2604 		return (NULL);
   2605 	}
   2606 
   2607 	if (ic->ic_state != IEEE80211_S_RUN) {
   2608 		freemsgchain(mp);
   2609 		return (NULL);
   2610 	}
   2611 
   2612 	if ((sc->sc_flags & IWK_F_HW_ERR_RECOVER) &&
   2613 	    IWK_CHK_FAST_RECOVER(sc)) {
   2614 		IWK_DBG((IWK_DEBUG_FW, "iwk_m_tx(): hold queue\n"));
   2615 		return (mp);
   2616 	}
   2617 
   2618 	while (mp != NULL) {
   2619 		next = mp->b_next;
   2620 		mp->b_next = NULL;
   2621 		if (iwk_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != 0) {
   2622 			mp->b_next = next;
   2623 			break;
   2624 		}
   2625 		mp = next;
   2626 	}
   2627 	return (mp);
   2628 }
   2629 
   2630 /* ARGSUSED */
   2631 static int
   2632 iwk_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
   2633 {
   2634 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   2635 	iwk_tx_ring_t *ring;
   2636 	iwk_tx_desc_t *desc;
   2637 	iwk_tx_data_t *data;
   2638 	iwk_cmd_t *cmd;
   2639 	iwk_tx_cmd_t *tx;
   2640 	ieee80211_node_t *in;
   2641 	struct ieee80211_frame *wh;
   2642 	struct ieee80211_key *k = NULL;
   2643 	mblk_t *m, *m0;
   2644 	int rate, hdrlen, len, len0, mblen, off, err = IWK_SUCCESS;
   2645 	uint16_t masks = 0;
   2646 	uint8_t index, index1, index2;
   2647 
   2648 	ring = &sc->sc_txq[0];
   2649 	data = &ring->data[ring->cur];
   2650 	desc = data->desc;
   2651 	cmd = data->cmd;
   2652 	bzero(desc, sizeof (*desc));
   2653 	bzero(cmd, sizeof (*cmd));
   2654 
   2655 	mutex_enter(&sc->sc_tx_lock);
   2656 	if (sc->sc_flags & IWK_F_SUSPEND) {
   2657 		mutex_exit(&sc->sc_tx_lock);
   2658 		if ((type & IEEE80211_FC0_TYPE_MASK) !=
   2659 		    IEEE80211_FC0_TYPE_DATA) {
   2660 			freemsg(mp);
   2661 		}
   2662 		err = IWK_FAIL;
   2663 		goto exit;
   2664 	}
   2665 
   2666 	if (ring->queued > ring->count - 64) {
   2667 		IWK_DBG((IWK_DEBUG_TX, "iwk_send(): no txbuf\n"));
   2668 		sc->sc_need_reschedule = 1;
   2669 		mutex_exit(&sc->sc_tx_lock);
   2670 		if ((type & IEEE80211_FC0_TYPE_MASK) !=
   2671 		    IEEE80211_FC0_TYPE_DATA) {
   2672 			freemsg(mp);
   2673 		}
   2674 		sc->sc_tx_nobuf++;
   2675 		err = IWK_FAIL;
   2676 		goto exit;
   2677 	}
   2678 	mutex_exit(&sc->sc_tx_lock);
   2679 
   2680 	hdrlen = sizeof (struct ieee80211_frame);
   2681 
   2682 	m = allocb(msgdsize(mp) + 32, BPRI_MED);
   2683 	if (m == NULL) { /* can not alloc buf, drop this package */
   2684 		cmn_err(CE_WARN,
   2685 		    "iwk_send(): failed to allocate msgbuf\n");
   2686 		freemsg(mp);
   2687 		err = IWK_SUCCESS;
   2688 		goto exit;
   2689 	}
   2690 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
   2691 		mblen = MBLKL(m0);
   2692 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
   2693 		off += mblen;
   2694 	}
   2695 	m->b_wptr += off;
   2696 	freemsg(mp);
   2697 
   2698 	wh = (struct ieee80211_frame *)m->b_rptr;
   2699 
   2700 	if (ic->ic_opmode == IEEE80211_M_IBSS &&
   2701 	    (!(IEEE80211_IS_MULTICAST(wh->i_addr1)))) {
   2702 		mutex_enter(&sc->sc_glock);
   2703 		mutex_enter(&sc->sc_ibss.node_tb_lock);
   2704 
   2705 		/*
   2706 		 * search for node in ibss node table
   2707 		 */
   2708 		for (index1 = IWK_STA_ID;
   2709 		    index1 < IWK_STATION_COUNT; index1++) {
   2710 			if (sc->sc_ibss.ibss_node_tb[index1].used &&
   2711 			    IEEE80211_ADDR_EQ(sc->sc_ibss.
   2712 			    ibss_node_tb[index1].node.bssid,
   2713 			    wh->i_addr1)) {
   2714 				break;
   2715 			}
   2716 		}
   2717 
   2718 		/*
   2719 		 * if don't find in ibss node table
   2720 		 */
   2721 		if (index1 >= IWK_BROADCAST_ID) {
   2722 			err = iwk_clean_add_node_ibss(ic,
   2723 			    wh->i_addr1, &index2);
   2724 			if (err != IWK_SUCCESS) {
   2725 				cmn_err(CE_WARN, "iwk_send(): "
   2726 				    "failed to clean all nodes "
   2727 				    "and add one node\n");
   2728 				mutex_exit(&sc->sc_ibss.node_tb_lock);
   2729 				mutex_exit(&sc->sc_glock);
   2730 				freemsg(m);
   2731 				sc->sc_tx_err++;
   2732 				err = IWK_SUCCESS;
   2733 				goto exit;
   2734 			}
   2735 			index = index2;
   2736 		} else {
   2737 			index = index1;
   2738 		}
   2739 		mutex_exit(&sc->sc_ibss.node_tb_lock);
   2740 		mutex_exit(&sc->sc_glock);
   2741 	}
   2742 
   2743 	in = ieee80211_find_txnode(ic, wh->i_addr1);
   2744 	if (in == NULL) {
   2745 		cmn_err(CE_WARN, "iwk_send(): failed to find tx node\n");
   2746 		freemsg(m);
   2747 		sc->sc_tx_err++;
   2748 		err = IWK_SUCCESS;
   2749 		goto exit;
   2750 	}
   2751 	(void) ieee80211_encap(ic, m, in);
   2752 
   2753 	cmd->hdr.type = REPLY_TX;
   2754 	cmd->hdr.flags = 0;
   2755 	cmd->hdr.qid = ring->qid;
   2756 	cmd->hdr.idx = ring->cur;
   2757 
   2758 	tx = (iwk_tx_cmd_t *)cmd->data;
   2759 	tx->tx_flags = 0;
   2760 
   2761 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
   2762 		tx->tx_flags &= ~(LE_32(TX_CMD_FLG_ACK_MSK));
   2763 	} else {
   2764 		tx->tx_flags |= LE_32(TX_CMD_FLG_ACK_MSK);
   2765 	}
   2766 
   2767 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
   2768 		k = ieee80211_crypto_encap(ic, m);
   2769 		if (k == NULL) {
   2770 			freemsg(m);
   2771 			sc->sc_tx_err++;
   2772 			err = IWK_SUCCESS;
   2773 			goto exit;
   2774 		}
   2775 
   2776 		if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_AES_CCM) {
   2777 			tx->sec_ctl = 2; /* for CCMP */
   2778 			tx->tx_flags |= LE_32(TX_CMD_FLG_ACK_MSK);
   2779 			(void) memcpy(&tx->key, k->wk_key, k->wk_keylen);
   2780 		}
   2781 
   2782 		/* packet header may have moved, reset our local pointer */
   2783 		wh = (struct ieee80211_frame *)m->b_rptr;
   2784 	}
   2785 
   2786 	len = msgdsize(m);
   2787 
   2788 #ifdef DEBUG
   2789 	if (iwk_dbg_flags & IWK_DEBUG_TX)
   2790 		ieee80211_dump_pkt((uint8_t *)wh, hdrlen, 0, 0);
   2791 #endif
   2792 
   2793 	/* pickup a rate */
   2794 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
   2795 	    IEEE80211_FC0_TYPE_MGT) {
   2796 		/* mgmt frames are sent at 1M */
   2797 		rate = in->in_rates.ir_rates[0];
   2798 	} else {
   2799 		/*
   2800 		 * do it here for the software way rate control.
   2801 		 * later for rate scaling in hardware.
   2802 		 * maybe like the following, for management frame:
   2803 		 * tx->initial_rate_index = LINK_QUAL_MAX_RETRY_NUM - 1;
   2804 		 * for data frame:
   2805 		 * tx->tx_flags |= (LE_32(TX_CMD_FLG_STA_RATE_MSK));
   2806 		 * rate = in->in_rates.ir_rates[in->in_txrate];
   2807 		 * tx->initial_rate_index = 1;
   2808 		 *
   2809 		 * now the txrate is determined in tx cmd flags, set to the
   2810 		 * max value 54M for 11g and 11M for 11b.
   2811 		 */
   2812 
   2813 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
   2814 			rate = ic->ic_fixed_rate;
   2815 		} else {
   2816 			rate = in->in_rates.ir_rates[in->in_txrate];
   2817 		}
   2818 	}
   2819 	rate &= IEEE80211_RATE_VAL;
   2820 	IWK_DBG((IWK_DEBUG_TX, "tx rate[%d of %d] = %x",
   2821 	    in->in_txrate, in->in_rates.ir_nrates, rate));
   2822 
   2823 	tx->tx_flags |= (LE_32(TX_CMD_FLG_SEQ_CTL_MSK));
   2824 
   2825 	len0 = roundup(4 + sizeof (iwk_tx_cmd_t) + hdrlen, 4);
   2826 	if (len0 != (4 + sizeof (iwk_tx_cmd_t) + hdrlen))
   2827 		tx->tx_flags |= LE_32(TX_CMD_FLG_MH_PAD_MSK);
   2828 
   2829 	/* retrieve destination node's id */
   2830 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
   2831 		tx->sta_id = IWK_BROADCAST_ID;
   2832 	} else {
   2833 		if (ic->ic_opmode == IEEE80211_M_IBSS)
   2834 			tx->sta_id = index;
   2835 		else
   2836 			tx->sta_id = IWK_AP_ID;
   2837 	}
   2838 
   2839 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
   2840 	    IEEE80211_FC0_TYPE_MGT) {
   2841 		/* tell h/w to set timestamp in probe responses */
   2842 		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
   2843 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
   2844 			tx->tx_flags |= LE_32(TX_CMD_FLG_TSF_MSK);
   2845 
   2846 		if (((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
   2847 		    IEEE80211_FC0_SUBTYPE_ASSOC_REQ) ||
   2848 		    ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
   2849 		    IEEE80211_FC0_SUBTYPE_REASSOC_REQ))
   2850 			tx->timeout.pm_frame_timeout = LE_16(3);
   2851 		else
   2852 			tx->timeout.pm_frame_timeout = LE_16(2);
   2853 	} else
   2854 		tx->timeout.pm_frame_timeout = 0;
   2855 	if (rate == 2 || rate == 4 || rate == 11 || rate == 22)
   2856 		masks |= RATE_MCS_CCK_MSK;
   2857 
   2858 	masks |= RATE_MCS_ANT_B_MSK;
   2859 	tx->rate.r.rate_n_flags = LE_32(iwk_rate_to_plcp(rate) | masks);
   2860 
   2861 	IWK_DBG((IWK_DEBUG_TX, "tx flag = %x",
   2862 	    LE_32(tx->tx_flags)));
   2863 
   2864 	tx->rts_retry_limit = 60;
   2865 	tx->data_retry_limit = 15;
   2866 
   2867 	tx->stop_time.life_time  = LE_32(0xffffffff);
   2868 
   2869 	tx->len = LE_16(len);
   2870 
   2871 	tx->dram_lsb_ptr =
   2872 	    LE_32(data->paddr_cmd + 4 + offsetof(iwk_tx_cmd_t, scratch));
   2873 	tx->dram_msb_ptr = 0;
   2874 	tx->driver_txop = 0;
   2875 	tx->next_frame_len = 0;
   2876 
   2877 	(void) memcpy(tx + 1, m->b_rptr, hdrlen);
   2878 	m->b_rptr += hdrlen;
   2879 	(void) memcpy(data->dma_data.mem_va, m->b_rptr, len - hdrlen);
   2880 
   2881 	IWK_DBG((IWK_DEBUG_TX, "sending data: qid=%d idx=%d len=%d",
   2882 	    ring->qid, ring->cur, len));
   2883 
   2884 	/*
   2885 	 * first segment includes the tx cmd plus the 802.11 header,
   2886 	 * the second includes the remaining of the 802.11 frame.
   2887 	 */
   2888 	desc->val0 = 2 << 24;
   2889 	desc->pa[0].tb1_addr = data->paddr_cmd;
   2890 	desc->pa[0].val1 = ((len0 << 4) & 0xfff0) |
   2891 	    ((data->dma_data.cookie.dmac_address & 0xffff) << 16);
   2892 	desc->pa[0].val2 =
   2893 	    ((data->dma_data.cookie.dmac_address & 0xffff0000) >> 16) |
   2894 	    ((len - hdrlen) << 20);
   2895 	IWK_DBG((IWK_DEBUG_TX, "phy addr1 = 0x%x phy addr2 = 0x%x "
   2896 	    "len1 = 0x%x, len2 = 0x%x val1 = 0x%x val2 = 0x%x",
   2897 	    data->paddr_cmd, data->dma_data.cookie.dmac_address,
   2898 	    len0, len - hdrlen, LE_32(desc->pa[0].val1),
   2899 	    LE_32(desc->pa[0].val2)));
   2900 
   2901 	mutex_enter(&sc->sc_tx_lock);
   2902 	ring->queued++;
   2903 	mutex_exit(&sc->sc_tx_lock);
   2904 
   2905 	/* kick ring */
   2906 	sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   2907 	    tfd_offset[ring->cur].val = 8 + len;
   2908 	if (ring->cur < IWK_MAX_WIN_SIZE) {
   2909 		sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   2910 		    tfd_offset[IWK_QUEUE_SIZE + ring->cur].val = 8 + len;
   2911 	}
   2912 
   2913 	IWK_DMA_SYNC(data->dma_data, DDI_DMA_SYNC_FORDEV);
   2914 	IWK_DMA_SYNC(ring->dma_desc, DDI_DMA_SYNC_FORDEV);
   2915 
   2916 	ring->cur = (ring->cur + 1) % ring->count;
   2917 	IWK_WRITE(sc, HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
   2918 	freemsg(m);
   2919 	/* release node reference */
   2920 	ieee80211_free_node(in);
   2921 
   2922 	ic->ic_stats.is_tx_bytes += len;
   2923 	ic->ic_stats.is_tx_frags++;
   2924 
   2925 	if (sc->sc_tx_timer == 0)
   2926 		sc->sc_tx_timer = 4;
   2927 
   2928 exit:
   2929 	return (err);
   2930 }
   2931 
   2932 static void
   2933 iwk_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
   2934 {
   2935 	iwk_sc_t	*sc  = (iwk_sc_t *)arg;
   2936 	ieee80211com_t	*ic = &sc->sc_ic;
   2937 
   2938 	enum ieee80211_opmode		oldmod;
   2939 	iwk_tx_power_table_cmd_t	txpower;
   2940 	iwk_add_sta_t			node;
   2941 	iwk_link_quality_cmd_t		link_quality;
   2942 	uint16_t			masks = 0;
   2943 	int				i, err, err1;
   2944 
   2945 	oldmod = ic->ic_opmode;
   2946 
   2947 	err = ieee80211_ioctl(ic, wq, mp);
   2948 
   2949 	/*
   2950 	 * return to STA mode
   2951 	 */
   2952 	if ((0 == err || ENETRESET == err) && (oldmod != ic->ic_opmode) &&
   2953 	    (ic->ic_opmode == IEEE80211_M_STA)) {
   2954 		/* configure rxon */
   2955 		(void) memset(&sc->sc_config, 0, sizeof (iwk_rxon_cmd_t));
   2956 		IEEE80211_ADDR_COPY(sc->sc_config.node_addr, ic->ic_macaddr);
   2957 		IEEE80211_ADDR_COPY(sc->sc_config.wlap_bssid, ic->ic_macaddr);
   2958 		sc->sc_config.chan =
   2959 		    LE_16(ieee80211_chan2ieee(ic, ic->ic_curchan));
   2960 		sc->sc_config.flags = LE_32(RXON_FLG_TSF2HOST_MSK |
   2961 		    RXON_FLG_AUTO_DETECT_MSK |
   2962 		    RXON_FLG_BAND_24G_MSK);
   2963 		sc->sc_config.flags &= LE_32(~RXON_FLG_CCK_MSK);
   2964 		switch (ic->ic_opmode) {
   2965 		case IEEE80211_M_STA:
   2966 			sc->sc_config.dev_type = RXON_DEV_TYPE_ESS;
   2967 			sc->sc_config.filter_flags |=
   2968 			    LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   2969 			    RXON_FILTER_DIS_DECRYPT_MSK |
   2970 			    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   2971 			break;
   2972 		case IEEE80211_M_IBSS:
   2973 		case IEEE80211_M_AHDEMO:
   2974 			sc->sc_config.dev_type = RXON_DEV_TYPE_IBSS;
   2975 			sc->sc_config.flags |=
   2976 			    LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   2977 			sc->sc_config.filter_flags =
   2978 			    LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   2979 			    RXON_FILTER_DIS_DECRYPT_MSK |
   2980 			    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   2981 			break;
   2982 		case IEEE80211_M_HOSTAP:
   2983 			sc->sc_config.dev_type = RXON_DEV_TYPE_AP;
   2984 			break;
   2985 		case IEEE80211_M_MONITOR:
   2986 			sc->sc_config.dev_type = RXON_DEV_TYPE_SNIFFER;
   2987 			sc->sc_config.filter_flags |=
   2988 			    LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   2989 			    RXON_FILTER_CTL2HOST_MSK |
   2990 			    RXON_FILTER_PROMISC_MSK);
   2991 			break;
   2992 		}
   2993 		sc->sc_config.cck_basic_rates  = 0x0f;
   2994 		sc->sc_config.ofdm_basic_rates = 0xff;
   2995 		sc->sc_config.ofdm_ht_single_stream_basic_rates = 0xff;
   2996 		sc->sc_config.ofdm_ht_dual_stream_basic_rates = 0xff;
   2997 		/* set antenna */
   2998 		mutex_enter(&sc->sc_glock);
   2999 		sc->sc_config.rx_chain = LE_16(RXON_RX_CHAIN_DRIVER_FORCE_MSK |
   3000 		    (0x7 << RXON_RX_CHAIN_VALID_POS) |
   3001 		    (0x6 << RXON_RX_CHAIN_FORCE_SEL_POS) |
   3002 		    (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
   3003 		err1 = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   3004 		    sizeof (iwk_rxon_cmd_t), 1);
   3005 		if (err1 != IWK_SUCCESS) {
   3006 			cmn_err(CE_WARN, "iwk_m_ioctl(): "
   3007 			    "failed to set configure command"
   3008 			    " please run (ifconfig unplumb and"
   3009 			    " ifconfig plumb)\n");
   3010 		}
   3011 		/*
   3012 		 * set Tx power for 2.4GHz channels
   3013 		 * (need further investigation. fix tx power at present)
   3014 		 */
   3015 		(void) memset(&txpower, 0, sizeof (txpower));
   3016 		txpower.band = 1; /* for 2.4G */
   3017 		txpower.channel = sc->sc_config.chan;
   3018 		txpower.channel_normal_width = 0;
   3019 		for (i = 0; i < POWER_TABLE_NUM_HT_OFDM_ENTRIES; i++) {
   3020 			txpower.tx_power.ht_ofdm_power[i].
   3021 			    s.ramon_tx_gain = LE_16(0x3f3f);
   3022 			txpower.tx_power.ht_ofdm_power[i].
   3023 			    s.dsp_predis_atten = LE_16(110 | (110 << 8));
   3024 		}
   3025 		txpower.tx_power.legacy_cck_power.s.
   3026 		    ramon_tx_gain = LE_16(0x3f3f);
   3027 		txpower.tx_power.legacy_cck_power.s.
   3028 		    dsp_predis_atten = LE_16(110 | (110 << 8));
   3029 		err1 = iwk_cmd(sc, REPLY_TX_PWR_TABLE_CMD, &txpower,
   3030 		    sizeof (txpower), 1);
   3031 		if (err1 != IWK_SUCCESS) {
   3032 			cmn_err(CE_WARN, "iwk_m_ioctl(): failed to set txpower"
   3033 			    " please run (ifconfig unplumb "
   3034 			    "and ifconfig plumb)\n");
   3035 		}
   3036 		/* add broadcast node so that we can send broadcast frame */
   3037 		(void) memset(&node, 0, sizeof (node));
   3038 		(void) memset(node.bssid, 0xff, 6);
   3039 		node.id = IWK_BROADCAST_ID;
   3040 		err1 = iwk_cmd(sc, REPLY_ADD_STA, &node, sizeof (node), 1);
   3041 		if (err1 != IWK_SUCCESS) {
   3042 			cmn_err(CE_WARN, "iwk_m_ioctl(): "
   3043 			    "failed to add broadcast node\n");
   3044 		}
   3045 
   3046 		/* TX_LINK_QUALITY cmd */
   3047 		(void) memset(&link_quality, 0, sizeof (link_quality));
   3048 		for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
   3049 			masks |= RATE_MCS_CCK_MSK;
   3050 			masks |= RATE_MCS_ANT_B_MSK;
   3051 			masks &= ~RATE_MCS_ANT_A_MSK;
   3052 			link_quality.rate_n_flags[i] =
   3053 			    LE_32(iwk_rate_to_plcp(2) | masks);
   3054 		}
   3055 		link_quality.general_params.single_stream_ant_msk = 2;
   3056 		link_quality.general_params.dual_stream_ant_msk = 3;
   3057 		link_quality.agg_params.agg_dis_start_th = 3;
   3058 		link_quality.agg_params.agg_time_limit = LE_16(4000);
   3059 		link_quality.sta_id = IWK_BROADCAST_ID;
   3060 		err1 = iwk_cmd(sc, REPLY_TX_LINK_QUALITY_CMD, &link_quality,
   3061 		    sizeof (link_quality), 1);
   3062 		if (err1 != IWK_SUCCESS) {
   3063 			cmn_err(CE_WARN, "iwk_m_ioctl(): "
   3064 			    "failed to config link quality table\n");
   3065 		}
   3066 		mutex_exit(&sc->sc_glock);
   3067 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   3068 	}
   3069 
   3070 	if (err == ENETRESET) {
   3071 		/*
   3072 		 * This is special for the hidden AP connection.
   3073 		 * In any case, we should make sure only one 'scan'
   3074 		 * in the driver for a 'connect' CLI command. So
   3075 		 * when connecting to a hidden AP, the scan is just
   3076 		 * sent out to the air when we know the desired
   3077 		 * essid of the AP we want to connect.
   3078 		 */
   3079 		if (ic->ic_des_esslen) {
   3080 			if (sc->sc_flags & IWK_F_RUNNING) {
   3081 				iwk_m_stop(sc);
   3082 				(void) iwk_m_start(sc);
   3083 				(void) ieee80211_new_state(ic,
   3084 				    IEEE80211_S_SCAN, -1);
   3085 			}
   3086 		}
   3087 	}
   3088 }
   3089 
   3090 /*
   3091  * callback functions for set/get properties
   3092  */
   3093 /* ARGSUSED */
   3094 static int
   3095 iwk_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
   3096     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
   3097 {
   3098 	int		err = 0;
   3099 	iwk_sc_t	*sc = (iwk_sc_t *)arg;
   3100 
   3101 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
   3102 	    pr_flags, wldp_length, wldp_buf, perm);
   3103 
   3104 	return (err);
   3105 }
   3106 static int
   3107 iwk_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
   3108     uint_t wldp_length, const void *wldp_buf)
   3109 {
   3110 	int		err;
   3111 	iwk_sc_t	*sc = (iwk_sc_t *)arg;
   3112 	ieee80211com_t	*ic = &sc->sc_ic;
   3113 
   3114 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num, wldp_length,
   3115 	    wldp_buf);
   3116 
   3117 	if (err == ENETRESET) {
   3118 		if (ic->ic_des_esslen) {
   3119 			if (sc->sc_flags & IWK_F_RUNNING) {
   3120 				iwk_m_stop(sc);
   3121 				(void) iwk_m_start(sc);
   3122 				(void) ieee80211_new_state(ic,
   3123 				    IEEE80211_S_SCAN, -1);
   3124 			}
   3125 		}
   3126 		err = 0;
   3127 	}
   3128 
   3129 	return (err);
   3130 }
   3131 
   3132 /*ARGSUSED*/
   3133 static int
   3134 iwk_m_stat(void *arg, uint_t stat, uint64_t *val)
   3135 {
   3136 	iwk_sc_t	*sc  = (iwk_sc_t *)arg;
   3137 	ieee80211com_t	*ic = &sc->sc_ic;
   3138 	ieee80211_node_t *in;
   3139 
   3140 	mutex_enter(&sc->sc_glock);
   3141 	switch (stat) {
   3142 	case MAC_STAT_IFSPEED:
   3143 		in = ic->ic_bss;
   3144 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
   3145 		    IEEE80211_RATE(in->in_txrate) :
   3146 		    ic->ic_fixed_rate) / 2 * 1000000;
   3147 		break;
   3148 	case MAC_STAT_NOXMTBUF:
   3149 		*val = sc->sc_tx_nobuf;
   3150 		break;
   3151 	case MAC_STAT_NORCVBUF:
   3152 		*val = sc->sc_rx_nobuf;
   3153 		break;
   3154 	case MAC_STAT_IERRORS:
   3155 		*val = sc->sc_rx_err;
   3156 		break;
   3157 	case MAC_STAT_RBYTES:
   3158 		*val = ic->ic_stats.is_rx_bytes;
   3159 		break;
   3160 	case MAC_STAT_IPACKETS:
   3161 		*val = ic->ic_stats.is_rx_frags;
   3162 		break;
   3163 	case MAC_STAT_OBYTES:
   3164 		*val = ic->ic_stats.is_tx_bytes;
   3165 		break;
   3166 	case MAC_STAT_OPACKETS:
   3167 		*val = ic->ic_stats.is_tx_frags;
   3168 		break;
   3169 	case MAC_STAT_OERRORS:
   3170 	case WIFI_STAT_TX_FAILED:
   3171 		*val = sc->sc_tx_err;
   3172 		break;
   3173 	case WIFI_STAT_TX_RETRANS:
   3174 		*val = sc->sc_tx_retries;
   3175 		break;
   3176 	case WIFI_STAT_FCS_ERRORS:
   3177 	case WIFI_STAT_WEP_ERRORS:
   3178 	case WIFI_STAT_TX_FRAGS:
   3179 	case WIFI_STAT_MCAST_TX:
   3180 	case WIFI_STAT_RTS_SUCCESS:
   3181 	case WIFI_STAT_RTS_FAILURE:
   3182 	case WIFI_STAT_ACK_FAILURE:
   3183 	case WIFI_STAT_RX_FRAGS:
   3184 	case WIFI_STAT_MCAST_RX:
   3185 	case WIFI_STAT_RX_DUPS:
   3186 		mutex_exit(&sc->sc_glock);
   3187 		return (ieee80211_stat(ic, stat, val));
   3188 	default:
   3189 		mutex_exit(&sc->sc_glock);
   3190 		return (ENOTSUP);
   3191 	}
   3192 	mutex_exit(&sc->sc_glock);
   3193 
   3194 	return (IWK_SUCCESS);
   3195 
   3196 }
   3197 
   3198 static int
   3199 iwk_m_start(void *arg)
   3200 {
   3201 	iwk_sc_t *sc = (iwk_sc_t *)arg;
   3202 	ieee80211com_t	*ic = &sc->sc_ic;
   3203 	int err;
   3204 
   3205 	err = iwk_init(sc);
   3206 
   3207 	if (err != IWK_SUCCESS) {
   3208 		/*
   3209 		 * The hw init err(eg. RF is OFF). Return Success to make
   3210 		 * the 'plumb' succeed. The iwk_thread() tries to re-init
   3211 		 * background.
   3212 		 */
   3213 		mutex_enter(&sc->sc_glock);
   3214 		sc->sc_flags |= IWK_F_HW_ERR_RECOVER;
   3215 		mutex_exit(&sc->sc_glock);
   3216 		return (IWK_SUCCESS);
   3217 	}
   3218 
   3219 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   3220 
   3221 	mutex_enter(&sc->sc_glock);
   3222 	sc->sc_flags |= IWK_F_RUNNING;
   3223 	mutex_exit(&sc->sc_glock);
   3224 
   3225 	return (IWK_SUCCESS);
   3226 }
   3227 
   3228 static void
   3229 iwk_m_stop(void *arg)
   3230 {
   3231 	iwk_sc_t *sc = (iwk_sc_t *)arg;
   3232 	ieee80211com_t	*ic = &sc->sc_ic;
   3233 
   3234 	iwk_stop(sc);
   3235 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   3236 	ieee80211_stop_watchdog(ic);
   3237 	mutex_enter(&sc->sc_mt_lock);
   3238 	sc->sc_flags &= ~IWK_F_HW_ERR_RECOVER;
   3239 	sc->sc_flags &= ~IWK_F_RATE_AUTO_CTL;
   3240 	mutex_exit(&sc->sc_mt_lock);
   3241 	mutex_enter(&sc->sc_glock);
   3242 	sc->sc_flags &= ~IWK_F_RUNNING;
   3243 	mutex_exit(&sc->sc_glock);
   3244 }
   3245 
   3246 /*ARGSUSED*/
   3247 static int
   3248 iwk_m_unicst(void *arg, const uint8_t *macaddr)
   3249 {
   3250 	iwk_sc_t *sc = (iwk_sc_t *)arg;
   3251 	ieee80211com_t	*ic = &sc->sc_ic;
   3252 	int err;
   3253 
   3254 	if (!IEEE80211_ADDR_EQ(ic->ic_macaddr, macaddr)) {
   3255 		IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
   3256 		mutex_enter(&sc->sc_glock);
   3257 		err = iwk_config(sc);
   3258 		mutex_exit(&sc->sc_glock);
   3259 		if (err != IWK_SUCCESS) {
   3260 			cmn_err(CE_WARN,
   3261 			    "iwk_m_unicst(): "
   3262 			    "failed to configure device\n");
   3263 			goto fail;
   3264 		}
   3265 	}
   3266 	return (IWK_SUCCESS);
   3267 fail:
   3268 	return (err);
   3269 }
   3270 
   3271 /*ARGSUSED*/
   3272 static int
   3273 iwk_m_multicst(void *arg, boolean_t add, const uint8_t *m)
   3274 {
   3275 	return (IWK_SUCCESS);
   3276 }
   3277 
   3278 /*ARGSUSED*/
   3279 static int
   3280 iwk_m_promisc(void *arg, boolean_t on)
   3281 {
   3282 	return (IWK_SUCCESS);
   3283 }
   3284 
   3285 static void
   3286 iwk_thread(iwk_sc_t *sc)
   3287 {
   3288 	ieee80211com_t	*ic = &sc->sc_ic;
   3289 	clock_t clk;
   3290 	int times = 0, err, n = 0, timeout = 0;
   3291 	uint32_t tmp;
   3292 
   3293 	mutex_enter(&sc->sc_mt_lock);
   3294 	while (sc->sc_mf_thread_switch) {
   3295 		tmp = IWK_READ(sc, CSR_GP_CNTRL);
   3296 		if (tmp & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW) {
   3297 			sc->sc_flags &= ~IWK_F_RADIO_OFF;
   3298 		} else {
   3299 			sc->sc_flags |= IWK_F_RADIO_OFF;
   3300 		}
   3301 		/*
   3302 		 * If in SUSPEND or the RF is OFF, do nothing
   3303 		 */
   3304 		if ((sc->sc_flags & IWK_F_SUSPEND) ||
   3305 		    (sc->sc_flags & IWK_F_RADIO_OFF)) {
   3306 			mutex_exit(&sc->sc_mt_lock);
   3307 			delay(drv_usectohz(100000));
   3308 			mutex_enter(&sc->sc_mt_lock);
   3309 			continue;
   3310 		}
   3311 
   3312 		/*
   3313 		 * recovery fatal error
   3314 		 */
   3315 		if (ic->ic_mach &&
   3316 		    (sc->sc_flags & IWK_F_HW_ERR_RECOVER)) {
   3317 
   3318 			IWK_DBG((IWK_DEBUG_FW,
   3319 			    "iwk_thread(): "
   3320 			    "try to recover fatal hw error: %d\n", times++));
   3321 
   3322 			iwk_stop(sc);
   3323 
   3324 			if (IWK_CHK_FAST_RECOVER(sc)) {
   3325 				/* save runtime configuration */
   3326 				bcopy(&sc->sc_config, &sc->sc_config_save,
   3327 				    sizeof (sc->sc_config));
   3328 			} else {
   3329 				mutex_exit(&sc->sc_mt_lock);
   3330 				ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   3331 				delay(drv_usectohz(2000000 + n*500000));
   3332 				mutex_enter(&sc->sc_mt_lock);
   3333 			}
   3334 
   3335 			err = iwk_init(sc);
   3336 			if (err != IWK_SUCCESS) {
   3337 				n++;
   3338 				if (n < 20)
   3339 					continue;
   3340 			}
   3341 			n = 0;
   3342 			if (!err)
   3343 				sc->sc_flags |= IWK_F_RUNNING;
   3344 
   3345 			if (!IWK_CHK_FAST_RECOVER(sc) ||
   3346 			    iwk_fast_recover(sc) != IWK_SUCCESS) {
   3347 				sc->sc_flags &= ~IWK_F_HW_ERR_RECOVER;
   3348 
   3349 				mutex_exit(&sc->sc_mt_lock);
   3350 				delay(drv_usectohz(2000000));
   3351 				if (sc->sc_ostate != IEEE80211_S_INIT)
   3352 					ieee80211_new_state(ic,
   3353 					    IEEE80211_S_SCAN, 0);
   3354 				mutex_enter(&sc->sc_mt_lock);
   3355 			}
   3356 		}
   3357 
   3358 		if (ic->ic_mach && (sc->sc_flags & IWK_F_LAZY_RESUME)) {
   3359 			IWK_DBG((IWK_DEBUG_RESUME,
   3360 			    "iwk_thread(): lazy resume\n"));
   3361 
   3362 			sc->sc_flags &= ~IWK_F_LAZY_RESUME;
   3363 			mutex_exit(&sc->sc_mt_lock);
   3364 			/*
   3365 			 * NB: under WPA mode, this call hangs (door problem?)
   3366 			 * when called in iwk_attach() and iwk_detach() while
   3367 			 * system is in the procedure of CPR. To be safe, let
   3368 			 * the thread do this.
   3369 			 */
   3370 			ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
   3371 			mutex_enter(&sc->sc_mt_lock);
   3372 		}
   3373 
   3374 		if (ic->ic_mach &&
   3375 		    (sc->sc_flags & IWK_F_SCANNING) && sc->sc_scan_pending) {
   3376 			IWK_DBG((IWK_DEBUG_SCAN,
   3377 			    "iwk_thread(): "
   3378 			    "wait for probe response\n"));
   3379 			sc->sc_scan_pending--;
   3380 			mutex_exit(&sc->sc_mt_lock);
   3381 			delay(drv_usectohz(200000));
   3382 			if (sc->sc_flags & IWK_F_SCANNING)
   3383 				ieee80211_next_scan(ic);
   3384 			mutex_enter(&sc->sc_mt_lock);
   3385 		}
   3386 
   3387 		/*
   3388 		 * rate ctl
   3389 		 */
   3390 		if (ic->ic_mach &&
   3391 		    (sc->sc_flags & IWK_F_RATE_AUTO_CTL)) {
   3392 			clk = ddi_get_lbolt();
   3393 			if (clk > sc->sc_clk + drv_usectohz(500000)) {
   3394 				iwk_amrr_timeout(sc);
   3395 			}
   3396 		}
   3397 
   3398 		if ((ic->ic_state == IEEE80211_S_RUN) &&
   3399 		    (ic->ic_beaconmiss++ > 50)) {	/* 5 seconds */
   3400 			cmn_err(CE_WARN, "iwk: beacon missed for 5 seconds\n");
   3401 			(void) ieee80211_new_state(ic,
   3402 			    IEEE80211_S_INIT, -1);
   3403 		}
   3404 
   3405 		mutex_exit(&sc->sc_mt_lock);
   3406 		delay(drv_usectohz(100000));
   3407 		mutex_enter(&sc->sc_mt_lock);
   3408 
   3409 		if (sc->sc_tx_timer) {
   3410 			timeout++;
   3411 			if (timeout == 10) {
   3412 				sc->sc_tx_timer--;
   3413 				if (sc->sc_tx_timer == 0) {
   3414 					sc->sc_flags |= IWK_F_HW_ERR_RECOVER;
   3415 					sc->sc_ostate = IEEE80211_S_RUN;
   3416 					IWK_DBG((IWK_DEBUG_FW,
   3417 					    "iwk_thread(): try to recover from"
   3418 					    " 'send fail\n"));
   3419 				}
   3420 				timeout = 0;
   3421 			}
   3422 		}
   3423 
   3424 	}
   3425 	sc->sc_mf_thread = NULL;
   3426 	cv_signal(&sc->sc_mt_cv);
   3427 	mutex_exit(&sc->sc_mt_lock);
   3428 }
   3429 
   3430 
   3431 /*
   3432  * Send a command to the firmware.
   3433  */
   3434 static int
   3435 iwk_cmd(iwk_sc_t *sc, int code, const void *buf, int size, int async)
   3436 {
   3437 	iwk_tx_ring_t *ring = &sc->sc_txq[IWK_CMD_QUEUE_NUM];
   3438 	iwk_tx_desc_t *desc;
   3439 	iwk_cmd_t *cmd;
   3440 	clock_t clk;
   3441 
   3442 	ASSERT(size <= sizeof (cmd->data));
   3443 	ASSERT(mutex_owned(&sc->sc_glock));
   3444 
   3445 	IWK_DBG((IWK_DEBUG_CMD, "iwk_cmd() code[%d]", code));
   3446 	desc = ring->data[ring->cur].desc;
   3447 	cmd = ring->data[ring->cur].cmd;
   3448 
   3449 	cmd->hdr.type = (uint8_t)code;
   3450 	cmd->hdr.flags = 0;
   3451 	cmd->hdr.qid = ring->qid;
   3452 	cmd->hdr.idx = ring->cur;
   3453 	(void) memcpy(cmd->data, buf, size);
   3454 	(void) memset(desc, 0, sizeof (*desc));
   3455 
   3456 	desc->val0 = 1 << 24;
   3457 	desc->pa[0].tb1_addr =
   3458 	    (uint32_t)(ring->data[ring->cur].paddr_cmd & 0xffffffff);
   3459 	desc->pa[0].val1 = ((4 + size) << 4) & 0xfff0;
   3460 
   3461 	/* kick cmd ring XXX */
   3462 	sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   3463 	    tfd_offset[ring->cur].val = 8;
   3464 	if (ring->cur < IWK_MAX_WIN_SIZE) {
   3465 		sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   3466 		    tfd_offset[IWK_QUEUE_SIZE + ring->cur].val = 8;
   3467 	}
   3468 	ring->cur = (ring->cur + 1) % ring->count;
   3469 	IWK_WRITE(sc, HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
   3470 
   3471 	if (async)
   3472 		return (IWK_SUCCESS);
   3473 	else {
   3474 		sc->sc_flags &= ~IWK_F_CMD_DONE;
   3475 		clk = ddi_get_lbolt() + drv_usectohz(2000000);
   3476 		while (!(sc->sc_flags & IWK_F_CMD_DONE)) {
   3477 			if (cv_timedwait(&sc->sc_cmd_cv, &sc->sc_glock, clk) <
   3478 			    0)
   3479 				break;
   3480 		}
   3481 		if (sc->sc_flags & IWK_F_CMD_DONE)
   3482 			return (IWK_SUCCESS);
   3483 		else
   3484 			return (IWK_FAIL);
   3485 	}
   3486 }
   3487 
   3488 static void
   3489 iwk_set_led(iwk_sc_t *sc, uint8_t id, uint8_t off, uint8_t on)
   3490 {
   3491 	iwk_led_cmd_t led;
   3492 
   3493 	led.interval = LE_32(100000);	/* unit: 100ms */
   3494 	led.id = id;
   3495 	led.off = off;
   3496 	led.on = on;
   3497 
   3498 	(void) iwk_cmd(sc, REPLY_LEDS_CMD, &led, sizeof (led), 1);
   3499 }
   3500 
   3501 static int
   3502 iwk_hw_set_before_auth(iwk_sc_t *sc)
   3503 {
   3504 	ieee80211com_t *ic = &sc->sc_ic;
   3505 	ieee80211_node_t *in = ic->ic_bss;
   3506 	iwk_add_sta_t node;
   3507 	iwk_link_quality_cmd_t link_quality;
   3508 	struct ieee80211_rateset rs;
   3509 	uint16_t masks = 0, rate;
   3510 	int i, err;
   3511 
   3512 	if (in->in_chan == IEEE80211_CHAN_ANYC) {
   3513 		cmn_err(CE_WARN, "iwk_hw_set_before_auth():"
   3514 		    "channel (%d) isn't in proper range\n",
   3515 		    LE_16(ieee80211_chan2ieee(ic, in->in_chan)));
   3516 		return (IWK_FAIL);
   3517 	}
   3518 
   3519 	/* update adapter's configuration according the info of target AP */
   3520 	IEEE80211_ADDR_COPY(sc->sc_config.bssid, in->in_bssid);
   3521 	sc->sc_config.chan = LE_16(ieee80211_chan2ieee(ic, in->in_chan));
   3522 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
   3523 		sc->sc_config.cck_basic_rates  = 0x03;
   3524 		sc->sc_config.ofdm_basic_rates = 0;
   3525 	} else if ((in->in_chan != IEEE80211_CHAN_ANYC) &&
   3526 	    (IEEE80211_IS_CHAN_5GHZ(in->in_chan))) {
   3527 		sc->sc_config.cck_basic_rates  = 0;
   3528 		sc->sc_config.ofdm_basic_rates = 0x15;
   3529 	} else { /* assume 802.11b/g */
   3530 		sc->sc_config.cck_basic_rates  = 0x0f;
   3531 		sc->sc_config.ofdm_basic_rates = 0xff;
   3532 	}
   3533 
   3534 	sc->sc_config.flags &= ~LE_32(RXON_FLG_SHORT_PREAMBLE_MSK |
   3535 	    RXON_FLG_SHORT_SLOT_MSK);
   3536 
   3537 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
   3538 		sc->sc_config.flags |= LE_32(RXON_FLG_SHORT_SLOT_MSK);
   3539 	else
   3540 		sc->sc_config.flags &= LE_32(~RXON_FLG_SHORT_SLOT_MSK);
   3541 
   3542 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
   3543 		sc->sc_config.flags |= LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   3544 	else
   3545 		sc->sc_config.flags &= LE_32(~RXON_FLG_SHORT_PREAMBLE_MSK);
   3546 
   3547 	IWK_DBG((IWK_DEBUG_80211, "config chan %d flags %x "
   3548 	    "filter_flags %x  cck %x ofdm %x"
   3549 	    " bssid:%02x:%02x:%02x:%02x:%02x:%2x\n",
   3550 	    LE_16(sc->sc_config.chan), LE_32(sc->sc_config.flags),
   3551 	    LE_32(sc->sc_config.filter_flags),
   3552 	    sc->sc_config.cck_basic_rates, sc->sc_config.ofdm_basic_rates,
   3553 	    sc->sc_config.bssid[0], sc->sc_config.bssid[1],
   3554 	    sc->sc_config.bssid[2], sc->sc_config.bssid[3],
   3555 	    sc->sc_config.bssid[4], sc->sc_config.bssid[5]));
   3556 	err = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   3557 	    sizeof (iwk_rxon_cmd_t), 1);
   3558 	if (err != IWK_SUCCESS) {
   3559 		cmn_err(CE_WARN, "iwk_hw_set_before_auth():"
   3560 		    " failed to config chan%d\n",
   3561 		    sc->sc_config.chan);
   3562 		return (err);
   3563 	}
   3564 
   3565 	/* obtain current temperature of chipset */
   3566 	sc->sc_tempera = iwk_curr_tempera(sc);
   3567 
   3568 	/* make Tx power calibration to determine the gains of DSP and radio */
   3569 	err = iwk_tx_power_calibration(sc);
   3570 	if (err) {
   3571 		cmn_err(CE_WARN, "iwk_hw_set_before_auth():"
   3572 		    "failed to set tx power table\n");
   3573 		return (err);
   3574 	}
   3575 
   3576 	/* add default AP node */
   3577 	(void) memset(&node, 0, sizeof (node));
   3578 	IEEE80211_ADDR_COPY(node.bssid, in->in_bssid);
   3579 	node.id = IWK_AP_ID;
   3580 	err = iwk_cmd(sc, REPLY_ADD_STA, &node, sizeof (node), 1);
   3581 	if (err != IWK_SUCCESS) {
   3582 		cmn_err(CE_WARN, "iwk_hw_set_before_auth(): "
   3583 		    "failed to add BSS node\n");
   3584 		return (err);
   3585 	}
   3586 
   3587 	/* TX_LINK_QUALITY cmd */
   3588 	(void) memset(&link_quality, 0, sizeof (link_quality));
   3589 	rs = ic->ic_sup_rates[ieee80211_chan2mode(ic, ic->ic_curchan)];
   3590 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
   3591 		if (i < rs.ir_nrates)
   3592 			rate = rs.ir_rates[rs.ir_nrates - i];
   3593 		else
   3594 			rate = 2;
   3595 		if (rate == 2 || rate == 4 || rate == 11 || rate == 22)
   3596 			masks |= RATE_MCS_CCK_MSK;
   3597 		masks |= RATE_MCS_ANT_B_MSK;
   3598 		masks &= ~RATE_MCS_ANT_A_MSK;
   3599 		link_quality.rate_n_flags[i] =
   3600 		    LE_32(iwk_rate_to_plcp(rate) | masks);
   3601 	}
   3602 
   3603 	link_quality.general_params.single_stream_ant_msk = 2;
   3604 	link_quality.general_params.dual_stream_ant_msk = 3;
   3605 	link_quality.agg_params.agg_dis_start_th = 3;
   3606 	link_quality.agg_params.agg_time_limit = LE_16(4000);
   3607 	link_quality.sta_id = IWK_AP_ID;
   3608 	err = iwk_cmd(sc, REPLY_TX_LINK_QUALITY_CMD, &link_quality,
   3609 	    sizeof (link_quality), 1);
   3610 	if (err != IWK_SUCCESS) {
   3611 		cmn_err(CE_WARN, "iwk_hw_set_before_auth(): "
   3612 		    "failed to config link quality table\n");
   3613 		return (err);
   3614 	}
   3615 
   3616 	return (IWK_SUCCESS);
   3617 }
   3618 
   3619 /*
   3620  * Send a scan request(assembly scan cmd) to the firmware.
   3621  */
   3622 static int
   3623 iwk_scan(iwk_sc_t *sc)
   3624 {
   3625 	ieee80211com_t *ic = &sc->sc_ic;
   3626 	iwk_tx_ring_t *ring = &sc->sc_txq[IWK_CMD_QUEUE_NUM];
   3627 	iwk_tx_desc_t *desc;
   3628 	iwk_tx_data_t *data;
   3629 	iwk_cmd_t *cmd;
   3630 	iwk_scan_hdr_t *hdr;
   3631 	iwk_scan_chan_t *chan;
   3632 	struct ieee80211_frame *wh;
   3633 	ieee80211_node_t *in = ic->ic_bss;
   3634 	uint8_t essid[IEEE80211_NWID_LEN+1];
   3635 	struct ieee80211_rateset *rs;
   3636 	enum ieee80211_phymode mode;
   3637 	uint8_t *frm;
   3638 	int i, pktlen, nrates;
   3639 
   3640 	data = &ring->data[ring->cur];
   3641 	desc = data->desc;
   3642 	cmd = (iwk_cmd_t *)data->dma_data.mem_va;
   3643 
   3644 	cmd->hdr.type = REPLY_SCAN_CMD;
   3645 	cmd->hdr.flags = 0;
   3646 	cmd->hdr.qid = ring->qid;
   3647 	cmd->hdr.idx = ring->cur | 0x40;
   3648 
   3649 	hdr = (iwk_scan_hdr_t *)cmd->data;
   3650 	(void) memset(hdr, 0, sizeof (iwk_scan_hdr_t));
   3651 	hdr->nchan = 1;
   3652 	hdr->quiet_time = LE_16(50);
   3653 	hdr->quiet_plcp_th = LE_16(1);
   3654 
   3655 	hdr->flags = LE_32(RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK);
   3656 	hdr->rx_chain = LE_16(RXON_RX_CHAIN_DRIVER_FORCE_MSK |
   3657 	    (0x7 << RXON_RX_CHAIN_VALID_POS) |
   3658 	    (0x6 << RXON_RX_CHAIN_FORCE_SEL_POS) |
   3659 	    (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
   3660 
   3661 	hdr->tx_cmd.tx_flags = LE_32(TX_CMD_FLG_SEQ_CTL_MSK);
   3662 	hdr->tx_cmd.sta_id = IWK_BROADCAST_ID;
   3663 	hdr->tx_cmd.stop_time.life_time = LE_32(0xffffffff);
   3664 	hdr->tx_cmd.tx_flags |= LE_32(0x200);
   3665 	hdr->tx_cmd.rate.r.rate_n_flags = LE_32(iwk_rate_to_plcp(2));
   3666 	hdr->tx_cmd.rate.r.rate_n_flags |=
   3667 	    LE_32(RATE_MCS_ANT_B_MSK|RATE_MCS_CCK_MSK);
   3668 	hdr->direct_scan[0].len = ic->ic_des_esslen;
   3669 	hdr->direct_scan[0].id  = IEEE80211_ELEMID_SSID;
   3670 
   3671 	if (ic->ic_des_esslen) {
   3672 		bcopy(ic->ic_des_essid, essid, ic->ic_des_esslen);
   3673 		essid[ic->ic_des_esslen] = '\0';
   3674 		IWK_DBG((IWK_DEBUG_SCAN, "directed scan %s\n", essid));
   3675 
   3676 		bcopy(ic->ic_des_essid, hdr->direct_scan[0].ssid,
   3677 		    ic->ic_des_esslen);
   3678 	} else {
   3679 		bzero(hdr->direct_scan[0].ssid,
   3680 		    sizeof (hdr->direct_scan[0].ssid));
   3681 	}
   3682 	/*
   3683 	 * a probe request frame is required after the REPLY_SCAN_CMD
   3684 	 */
   3685 	wh = (struct ieee80211_frame *)(hdr + 1);
   3686 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
   3687 	    IEEE80211_FC0_SUBTYPE_PROBE_REQ;
   3688 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
   3689 	(void) memset(wh->i_addr1, 0xff, 6);
   3690 	IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_macaddr);
   3691 	(void) memset(wh->i_addr3, 0xff, 6);
   3692 	*(uint16_t *)&wh->i_dur[0] = 0;
   3693 	*(uint16_t *)&wh->i_seq[0] = 0;
   3694 
   3695 	frm = (uint8_t *)(wh + 1);
   3696 
   3697 	/* essid IE */
   3698 	if (in->in_esslen) {
   3699 		bcopy(in->in_essid, essid, in->in_esslen);
   3700 		essid[in->in_esslen] = '\0';
   3701 		IWK_DBG((IWK_DEBUG_SCAN, "probe with ESSID %s\n",
   3702 		    essid));
   3703 	}
   3704 	*frm++ = IEEE80211_ELEMID_SSID;
   3705 	*frm++ = in->in_esslen;
   3706 	(void) memcpy(frm, in->in_essid, in->in_esslen);
   3707 	frm += in->in_esslen;
   3708 
   3709 	mode = ieee80211_chan2mode(ic, ic->ic_curchan);
   3710 	rs = &ic->ic_sup_rates[mode];
   3711 
   3712 	/* supported rates IE */
   3713 	*frm++ = IEEE80211_ELEMID_RATES;
   3714 	nrates = rs->ir_nrates;
   3715 	if (nrates > IEEE80211_RATE_SIZE)
   3716 		nrates = IEEE80211_RATE_SIZE;
   3717 	*frm++ = (uint8_t)nrates;
   3718 	(void) memcpy(frm, rs->ir_rates, nrates);
   3719 	frm += nrates;
   3720 
   3721 	/* supported xrates IE */
   3722 	if (rs->ir_nrates > IEEE80211_RATE_SIZE) {
   3723 		nrates = rs->ir_nrates - IEEE80211_RATE_SIZE;
   3724 		*frm++ = IEEE80211_ELEMID_XRATES;
   3725 		*frm++ = (uint8_t)nrates;
   3726 		(void) memcpy(frm, rs->ir_rates + IEEE80211_RATE_SIZE, nrates);
   3727 		frm += nrates;
   3728 	}
   3729 
   3730 	/* optionnal IE (usually for wpa) */
   3731 	if (ic->ic_opt_ie != NULL) {
   3732 		(void) memcpy(frm, ic->ic_opt_ie, ic->ic_opt_ie_len);
   3733 		frm += ic->ic_opt_ie_len;
   3734 	}
   3735 
   3736 	/* setup length of probe request */
   3737 	hdr->tx_cmd.len = LE_16(_PTRDIFF(frm, wh));
   3738 	hdr->len = LE_16(hdr->nchan * sizeof (iwk_scan_chan_t) +
   3739 	    LE_16(hdr->tx_cmd.len) + sizeof (iwk_scan_hdr_t));
   3740 
   3741 	/*
   3742 	 * the attribute of the scan channels are required after the probe
   3743 	 * request frame.
   3744 	 */
   3745 	chan = (iwk_scan_chan_t *)frm;
   3746 	for (i = 1; i <= hdr->nchan; i++, chan++) {
   3747 		if (ic->ic_des_esslen) {
   3748 			chan->type = 3;
   3749 		} else {
   3750 			chan->type = 1;
   3751 		}
   3752 
   3753 		chan->chan = ieee80211_chan2ieee(ic, ic->ic_curchan);
   3754 		chan->tpc.tx_gain = 0x3f;
   3755 		chan->tpc.dsp_atten = 110;
   3756 		chan->active_dwell = LE_16(50);
   3757 		chan->passive_dwell = LE_16(120);
   3758 
   3759 		frm += sizeof (iwk_scan_chan_t);
   3760 	}
   3761 
   3762 	pktlen = _PTRDIFF(frm, cmd);
   3763 
   3764 	(void) memset(desc, 0, sizeof (*desc));
   3765 	desc->val0 = 1 << 24;
   3766 	desc->pa[0].tb1_addr =
   3767 	    (uint32_t)(data->dma_data.cookie.dmac_address & 0xffffffff);
   3768 	desc->pa[0].val1 = (pktlen << 4) & 0xfff0;
   3769 
   3770 	/*
   3771 	 * maybe for cmd, filling the byte cnt table is not necessary.
   3772 	 * anyway, we fill it here.
   3773 	 */
   3774 	sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   3775 	    tfd_offset[ring->cur].val = 8;
   3776 	if (ring->cur < IWK_MAX_WIN_SIZE) {
   3777 		sc->sc_shared->queues_byte_cnt_tbls[ring->qid].
   3778 		    tfd_offset[IWK_QUEUE_SIZE + ring->cur].val = 8;
   3779 	}
   3780 
   3781 	/* kick cmd ring */
   3782 	ring->cur = (ring->cur + 1) % ring->count;
   3783 	IWK_WRITE(sc, HBUS_TARG_WRPTR, ring->qid << 8 | ring->cur);
   3784 
   3785 	return (IWK_SUCCESS);
   3786 }
   3787 
   3788 static int
   3789 iwk_config(iwk_sc_t *sc)
   3790 {
   3791 	ieee80211com_t *ic = &sc->sc_ic;
   3792 	iwk_powertable_cmd_t powertable;
   3793 	iwk_bt_cmd_t bt;
   3794 	iwk_add_sta_t node;
   3795 	iwk_link_quality_cmd_t link_quality;
   3796 	int i, err;
   3797 	uint16_t masks = 0;
   3798 
   3799 	/*
   3800 	 * set power mode. Disable power management at present, do it later
   3801 	 */
   3802 	(void) memset(&powertable, 0, sizeof (powertable));
   3803 	powertable.flags = LE_16(0x8);
   3804 	err = iwk_cmd(sc, POWER_TABLE_CMD, &powertable,
   3805 	    sizeof (powertable), 0);
   3806 	if (err != IWK_SUCCESS) {
   3807 		cmn_err(CE_WARN, "iwk_config(): failed to set power mode\n");
   3808 		return (err);
   3809 	}
   3810 
   3811 	/* configure bt coexistence */
   3812 	(void) memset(&bt, 0, sizeof (bt));
   3813 	bt.flags = 3;
   3814 	bt.lead_time = 0xaa;
   3815 	bt.max_kill = 1;
   3816 	err = iwk_cmd(sc, REPLY_BT_CONFIG, &bt,
   3817 	    sizeof (bt), 0);
   3818 	if (err != IWK_SUCCESS) {
   3819 		cmn_err(CE_WARN,
   3820 		    "iwk_config(): "
   3821 		    "failed to configurate bt coexistence\n");
   3822 		return (err);
   3823 	}
   3824 
   3825 	/* configure rxon */
   3826 	(void) memset(&sc->sc_config, 0, sizeof (iwk_rxon_cmd_t));
   3827 	IEEE80211_ADDR_COPY(sc->sc_config.node_addr, ic->ic_macaddr);
   3828 	IEEE80211_ADDR_COPY(sc->sc_config.wlap_bssid, ic->ic_macaddr);
   3829 	sc->sc_config.chan = LE_16(ieee80211_chan2ieee(ic, ic->ic_curchan));
   3830 	sc->sc_config.flags = LE_32(RXON_FLG_TSF2HOST_MSK |
   3831 	    RXON_FLG_AUTO_DETECT_MSK | RXON_FLG_BAND_24G_MSK);
   3832 	sc->sc_config.flags &= LE_32(~RXON_FLG_CCK_MSK);
   3833 	switch (ic->ic_opmode) {
   3834 	case IEEE80211_M_STA:
   3835 		sc->sc_config.dev_type = RXON_DEV_TYPE_ESS;
   3836 		sc->sc_config.filter_flags |= LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   3837 		    RXON_FILTER_DIS_DECRYPT_MSK |
   3838 		    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   3839 		break;
   3840 	case IEEE80211_M_IBSS:
   3841 	case IEEE80211_M_AHDEMO:
   3842 		sc->sc_config.dev_type = RXON_DEV_TYPE_IBSS;
   3843 		sc->sc_config.flags |= LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   3844 		sc->sc_config.filter_flags = LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   3845 		    RXON_FILTER_DIS_DECRYPT_MSK |
   3846 		    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   3847 		break;
   3848 	case IEEE80211_M_HOSTAP:
   3849 		sc->sc_config.dev_type = RXON_DEV_TYPE_AP;
   3850 		break;
   3851 	case IEEE80211_M_MONITOR:
   3852 		sc->sc_config.dev_type = RXON_DEV_TYPE_SNIFFER;
   3853 		sc->sc_config.filter_flags |= LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   3854 		    RXON_FILTER_CTL2HOST_MSK | RXON_FILTER_PROMISC_MSK);
   3855 		break;
   3856 	}
   3857 	sc->sc_config.cck_basic_rates  = 0x0f;
   3858 	sc->sc_config.ofdm_basic_rates = 0xff;
   3859 
   3860 	sc->sc_config.ofdm_ht_single_stream_basic_rates = 0xff;
   3861 	sc->sc_config.ofdm_ht_dual_stream_basic_rates = 0xff;
   3862 
   3863 	/* set antenna */
   3864 
   3865 	sc->sc_config.rx_chain = LE_16(RXON_RX_CHAIN_DRIVER_FORCE_MSK |
   3866 	    (0x7 << RXON_RX_CHAIN_VALID_POS) |
   3867 	    (0x6 << RXON_RX_CHAIN_FORCE_SEL_POS) |
   3868 	    (0x7 << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS));
   3869 
   3870 	err = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   3871 	    sizeof (iwk_rxon_cmd_t), 0);
   3872 	if (err != IWK_SUCCESS) {
   3873 		cmn_err(CE_WARN, "iwk_config(): "
   3874 		    "failed to set configure command\n");
   3875 		return (err);
   3876 	}
   3877 	/* obtain current temperature of chipset */
   3878 	sc->sc_tempera = iwk_curr_tempera(sc);
   3879 
   3880 	/* make Tx power calibration to determine the gains of DSP and radio */
   3881 	err = iwk_tx_power_calibration(sc);
   3882 	if (err) {
   3883 		cmn_err(CE_WARN, "iwk_config(): "
   3884 		    "failed to set tx power table\n");
   3885 		return (err);
   3886 	}
   3887 
   3888 	/* add broadcast node so that we can send broadcast frame */
   3889 	(void) memset(&node, 0, sizeof (node));
   3890 	(void) memset(node.bssid, 0xff, 6);
   3891 	node.id = IWK_BROADCAST_ID;
   3892 	err = iwk_cmd(sc, REPLY_ADD_STA, &node, sizeof (node), 0);
   3893 	if (err != IWK_SUCCESS) {
   3894 		cmn_err(CE_WARN, "iwk_config(): "
   3895 		    "failed to add broadcast node\n");
   3896 		return (err);
   3897 	}
   3898 
   3899 	/* TX_LINK_QUALITY cmd ? */
   3900 	(void) memset(&link_quality, 0, sizeof (link_quality));
   3901 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
   3902 		masks |= RATE_MCS_CCK_MSK;
   3903 		masks |= RATE_MCS_ANT_B_MSK;
   3904 		masks &= ~RATE_MCS_ANT_A_MSK;
   3905 		link_quality.rate_n_flags[i] =
   3906 		    LE_32(iwk_rate_to_plcp(2) | masks);
   3907 	}
   3908 
   3909 	link_quality.general_params.single_stream_ant_msk = 2;
   3910 	link_quality.general_params.dual_stream_ant_msk = 3;
   3911 	link_quality.agg_params.agg_dis_start_th = 3;
   3912 	link_quality.agg_params.agg_time_limit = LE_16(4000);
   3913 	link_quality.sta_id = IWK_BROADCAST_ID;
   3914 	err = iwk_cmd(sc, REPLY_TX_LINK_QUALITY_CMD, &link_quality,
   3915 	    sizeof (link_quality), 0);
   3916 	if (err != IWK_SUCCESS) {
   3917 		cmn_err(CE_WARN, "iwk_config(): "
   3918 		    "failed to config link quality table\n");
   3919 		return (err);
   3920 	}
   3921 
   3922 	return (IWK_SUCCESS);
   3923 }
   3924 
   3925 static void
   3926 iwk_stop_master(iwk_sc_t *sc)
   3927 {
   3928 	uint32_t tmp;
   3929 	int n;
   3930 
   3931 	tmp = IWK_READ(sc, CSR_RESET);
   3932 	IWK_WRITE(sc, CSR_RESET, tmp | CSR_RESET_REG_FLAG_STOP_MASTER);
   3933 
   3934 	tmp = IWK_READ(sc, CSR_GP_CNTRL);
   3935 	if ((tmp & CSR_GP_CNTRL_REG_MSK_POWER_SAVE_TYPE) ==
   3936 	    CSR_GP_CNTRL_REG_FLAG_MAC_POWER_SAVE)
   3937 		return;
   3938 
   3939 	for (n = 0; n < 2000; n++) {
   3940 		if (IWK_READ(sc, CSR_RESET) &
   3941 		    CSR_RESET_REG_FLAG_MASTER_DISABLED)
   3942 			break;
   3943 		DELAY(1000);
   3944 	}
   3945 	if (n == 2000)
   3946 		IWK_DBG((IWK_DEBUG_HW,
   3947 		    "timeout waiting for master stop\n"));
   3948 }
   3949 
   3950 static int
   3951 iwk_power_up(iwk_sc_t *sc)
   3952 {
   3953 	uint32_t tmp;
   3954 
   3955 	iwk_mac_access_enter(sc);
   3956 	tmp = iwk_reg_read(sc, ALM_APMG_PS_CTL);
   3957 	tmp &= ~APMG_PS_CTRL_REG_MSK_POWER_SRC;
   3958 	tmp |= APMG_PS_CTRL_REG_VAL_POWER_SRC_VMAIN;
   3959 	iwk_reg_write(sc, ALM_APMG_PS_CTL, tmp);
   3960 	iwk_mac_access_exit(sc);
   3961 
   3962 	DELAY(5000);
   3963 	return (IWK_SUCCESS);
   3964 }
   3965 
   3966 static int
   3967 iwk_preinit(iwk_sc_t *sc)
   3968 {
   3969 	uint32_t tmp;
   3970 	int n;
   3971 	uint8_t vlink;
   3972 
   3973 	/* clear any pending interrupts */
   3974 	IWK_WRITE(sc, CSR_INT, 0xffffffff);
   3975 
   3976 	tmp = IWK_READ(sc, CSR_GIO_CHICKEN_BITS);
   3977 	IWK_WRITE(sc, CSR_GIO_CHICKEN_BITS,
   3978 	    tmp | CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER);
   3979 
   3980 	tmp = IWK_READ(sc, CSR_GP_CNTRL);
   3981 	IWK_WRITE(sc, CSR_GP_CNTRL, tmp | CSR_GP_CNTRL_REG_FLAG_INIT_DONE);
   3982 
   3983 	/* wait for clock ready */
   3984 	for (n = 0; n < 1000; n++) {
   3985 		if (IWK_READ(sc, CSR_GP_CNTRL) &
   3986 		    CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY)
   3987 			break;
   3988 		DELAY(10);
   3989 	}
   3990 	if (n == 1000) {
   3991 		cmn_err(CE_WARN,
   3992 		    "iwk_preinit(): timeout waiting for clock ready\n");
   3993 		return (ETIMEDOUT);
   3994 	}
   3995 	iwk_mac_access_enter(sc);
   3996 	tmp = iwk_reg_read(sc, APMG_CLK_CTRL_REG);
   3997 	iwk_reg_write(sc, APMG_CLK_CTRL_REG, tmp |
   3998 	    APMG_CLK_REG_VAL_DMA_CLK_RQT | APMG_CLK_REG_VAL_BSM_CLK_RQT);
   3999 
   4000 	DELAY(20);
   4001 	tmp = iwk_reg_read(sc, ALM_APMG_PCIDEV_STT);
   4002 	iwk_reg_write(sc, ALM_APMG_PCIDEV_STT, tmp |
   4003 	    APMG_DEV_STATE_REG_VAL_L1_ACTIVE_DISABLE);
   4004 	iwk_mac_access_exit(sc);
   4005 
   4006 	IWK_WRITE(sc, CSR_INT_COALESCING, 512 / 32); /* ??? */
   4007 
   4008 	(void) iwk_power_up(sc);
   4009 
   4010 	if ((sc->sc_rev & 0x80) == 0x80 && (sc->sc_rev & 0x7f) < 8) {
   4011 		tmp = ddi_get32(sc->sc_cfg_handle,
   4012 		    (uint32_t *)(sc->sc_cfg_base + 0xe8));
   4013 		ddi_put32(sc->sc_cfg_handle,
   4014 		    (uint32_t *)(sc->sc_cfg_base + 0xe8),
   4015 		    tmp & ~(1 << 11));
   4016 	}
   4017 
   4018 
   4019 	vlink = ddi_get8(sc->sc_cfg_handle,
   4020 	    (uint8_t *)(sc->sc_cfg_base + 0xf0));
   4021 	ddi_put8(sc->sc_cfg_handle, (uint8_t *)(sc->sc_cfg_base + 0xf0),
   4022 	    vlink & ~2);
   4023 
   4024 	tmp = IWK_READ(sc, CSR_SW_VER);
   4025 	tmp |= CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
   4026 	    CSR_HW_IF_CONFIG_REG_BIT_MAC_SI |
   4027 	    CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R;
   4028 	IWK_WRITE(sc, CSR_SW_VER, tmp);
   4029 
   4030 	/* make sure power supply on each part of the hardware */
   4031 	iwk_mac_access_enter(sc);
   4032 	tmp = iwk_reg_read(sc, ALM_APMG_PS_CTL);
   4033 	tmp |= APMG_PS_CTRL_REG_VAL_ALM_R_RESET_REQ;
   4034 	iwk_reg_write(sc, ALM_APMG_PS_CTL, tmp);
   4035 	DELAY(5);
   4036 	tmp = iwk_reg_read(sc, ALM_APMG_PS_CTL);
   4037 	tmp &= ~APMG_PS_CTRL_REG_VAL_ALM_R_RESET_REQ;
   4038 	iwk_reg_write(sc, ALM_APMG_PS_CTL, tmp);
   4039 	iwk_mac_access_exit(sc);
   4040 	return (IWK_SUCCESS);
   4041 }
   4042 
   4043 /*
   4044  * set up semphore flag to own EEPROM
   4045  */
   4046 static int iwk_eep_sem_down(iwk_sc_t *sc)
   4047 {
   4048 	int count1, count2;
   4049 	uint32_t tmp;
   4050 
   4051 	for (count1 = 0; count1 < 1000; count1++) {
   4052 		tmp = IWK_READ(sc, CSR_HW_IF_CONFIG_REG);
   4053 		IWK_WRITE(sc, CSR_HW_IF_CONFIG_REG,
   4054 		    tmp | CSR_HW_IF_CONFIG_REG_EEP_SEM);
   4055 
   4056 		for (count2 = 0; count2 < 2; count2++) {
   4057 			if (IWK_READ(sc, CSR_HW_IF_CONFIG_REG) &
   4058 			    CSR_HW_IF_CONFIG_REG_EEP_SEM)
   4059 				return (IWK_SUCCESS);
   4060 			DELAY(10000);
   4061 		}
   4062 	}
   4063 	return (IWK_FAIL);
   4064 }
   4065 
   4066 /*
   4067  * reset semphore flag to release EEPROM
   4068  */
   4069 static void iwk_eep_sem_up(iwk_sc_t *sc)
   4070 {
   4071 	uint32_t tmp;
   4072 
   4073 	tmp = IWK_READ(sc, CSR_HW_IF_CONFIG_REG);
   4074 	IWK_WRITE(sc, CSR_HW_IF_CONFIG_REG,
   4075 	    tmp & (~CSR_HW_IF_CONFIG_REG_EEP_SEM));
   4076 }
   4077 
   4078 /*
   4079  * This function load all infomation in eeprom into iwk_eep
   4080  * structure in iwk_sc_t structure
   4081  */
   4082 static int iwk_eep_load(iwk_sc_t *sc)
   4083 {
   4084 	int i, rr;
   4085 	uint32_t rv, tmp, eep_gp;
   4086 	uint16_t addr, eep_sz = sizeof (sc->sc_eep_map);
   4087 	uint16_t *eep_p = (uint16_t *)&sc->sc_eep_map;
   4088 
   4089 	/* read eeprom gp register in CSR */
   4090 	eep_gp = IWK_READ(sc, CSR_EEPROM_GP);
   4091 	if ((eep_gp & CSR_EEPROM_GP_VALID_MSK) ==
   4092 	    CSR_EEPROM_GP_BAD_SIGNATURE) {
   4093 		cmn_err(CE_WARN, "EEPROM not found\n");
   4094 		return (IWK_FAIL);
   4095 	}
   4096 
   4097 	rr = iwk_eep_sem_down(sc);
   4098 	if (rr != 0) {
   4099 		cmn_err(CE_WARN, "failed to own EEPROM\n");
   4100 		return (IWK_FAIL);
   4101 	}
   4102 
   4103 	for (addr = 0; addr < eep_sz; addr += 2) {
   4104 		IWK_WRITE(sc, CSR_EEPROM_REG, addr<<1);
   4105 		tmp = IWK_READ(sc, CSR_EEPROM_REG);
   4106 		IWK_WRITE(sc, CSR_EEPROM_REG, tmp & ~(0x2));
   4107 
   4108 		for (i = 0; i < 10; i++) {
   4109 			rv = IWK_READ(sc, CSR_EEPROM_REG);
   4110 			if (rv & 1)
   4111 				break;
   4112 			DELAY(10);
   4113 		}
   4114 
   4115 		if (!(rv & 1)) {
   4116 			cmn_err(CE_WARN, "time out when read EEPROM\n");
   4117 			iwk_eep_sem_up(sc);
   4118 			return (IWK_FAIL);
   4119 		}
   4120 
   4121 		eep_p[addr/2] = LE_16(rv >> 16);
   4122 	}
   4123 
   4124 	iwk_eep_sem_up(sc);
   4125 	return (IWK_SUCCESS);
   4126 }
   4127 
   4128 /*
   4129  * init mac address in ieee80211com_t struct
   4130  */
   4131 static void iwk_get_mac_from_eep(iwk_sc_t *sc)
   4132 {
   4133 	ieee80211com_t *ic = &sc->sc_ic;
   4134 	struct iwk_eep *ep = &sc->sc_eep_map;
   4135 
   4136 	IEEE80211_ADDR_COPY(ic->ic_macaddr, ep->mac_address);
   4137 
   4138 	IWK_DBG((IWK_DEBUG_EEPROM, "mac:%2x:%2x:%2x:%2x:%2x:%2x\n",
   4139 	    ic->ic_macaddr[0], ic->ic_macaddr[1], ic->ic_macaddr[2],
   4140 	    ic->ic_macaddr[3], ic->ic_macaddr[4], ic->ic_macaddr[5]));
   4141 }
   4142 
   4143 static int
   4144 iwk_init(iwk_sc_t *sc)
   4145 {
   4146 	int qid, n, err;
   4147 	clock_t clk;
   4148 	uint32_t tmp;
   4149 
   4150 	mutex_enter(&sc->sc_glock);
   4151 	sc->sc_flags &= ~IWK_F_FW_INIT;
   4152 
   4153 	(void) iwk_preinit(sc);
   4154 
   4155 	tmp = IWK_READ(sc, CSR_GP_CNTRL);
   4156 	if (!(tmp & CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW)) {
   4157 		cmn_err(CE_NOTE, "iwk_init(): Radio transmitter is off\n");
   4158 		goto fail1;
   4159 	}
   4160 
   4161 	/* init Rx ring */
   4162 	iwk_mac_access_enter(sc);
   4163 	IWK_WRITE(sc, FH_MEM_RCSR_CHNL0_CONFIG_REG, 0);
   4164 
   4165 	IWK_WRITE(sc, FH_RSCSR_CHNL0_RBDCB_WPTR_REG, 0);
   4166 	IWK_WRITE(sc, FH_RSCSR_CHNL0_RBDCB_BASE_REG,
   4167 	    sc->sc_rxq.dma_desc.cookie.dmac_address >> 8);
   4168 
   4169 	IWK_WRITE(sc, FH_RSCSR_CHNL0_STTS_WPTR_REG,
   4170 	    ((uint32_t)(sc->sc_dma_sh.cookie.dmac_address +
   4171 	    offsetof(struct iwk_shared, val0)) >> 4));
   4172 
   4173 	IWK_WRITE(sc, FH_MEM_RCSR_CHNL0_CONFIG_REG,
   4174 	    FH_RCSR_RX_CONFIG_CHNL_EN_ENABLE_VAL |
   4175 	    FH_RCSR_CHNL0_RX_CONFIG_IRQ_DEST_INT_HOST_VAL |
   4176 	    IWK_FH_RCSR_RX_CONFIG_REG_VAL_RB_SIZE_4K |
   4177 	    (RX_QUEUE_SIZE_LOG <<
   4178 	    FH_RCSR_RX_CONFIG_RBDCB_SIZE_BITSHIFT));
   4179 	iwk_mac_access_exit(sc);
   4180 	IWK_WRITE(sc, FH_RSCSR_CHNL0_RBDCB_WPTR_REG,
   4181 	    (RX_QUEUE_SIZE - 1) & ~0x7);
   4182 
   4183 	/* init Tx rings */
   4184 	iwk_mac_access_enter(sc);
   4185 	iwk_reg_write(sc, SCD_TXFACT, 0);
   4186 
   4187 	/* keep warm page */
   4188 	iwk_reg_write(sc, IWK_FH_KW_MEM_ADDR_REG,
   4189 	    sc->sc_dma_kw.cookie.dmac_address >> 4);
   4190 
   4191 	for (qid = 0; qid < IWK_NUM_QUEUES; qid++) {
   4192 		IWK_WRITE(sc, FH_MEM_CBBC_QUEUE(qid),
   4193 		    sc->sc_txq[qid].dma_desc.cookie.dmac_address >> 8);
   4194 		IWK_WRITE(sc, IWK_FH_TCSR_CHNL_TX_CONFIG_REG(qid),
   4195 		    IWK_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CHNL_ENABLE |
   4196 		    IWK_FH_TCSR_TX_CONFIG_REG_VAL_DMA_CREDIT_ENABLE_VAL);
   4197 	}
   4198 	iwk_mac_access_exit(sc);
   4199 
   4200 	/* clear "radio off" and "disable command" bits */
   4201 	IWK_WRITE(sc, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
   4202 	IWK_WRITE(sc, CSR_UCODE_DRV_GP1_CLR,
   4203 	    CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED);
   4204 
   4205 	/* clear any pending interrupts */
   4206 	IWK_WRITE(sc, CSR_INT, 0xffffffff);
   4207 
   4208 	/* enable interrupts */
   4209 	IWK_WRITE(sc, CSR_INT_MASK, CSR_INI_SET_MASK);
   4210 
   4211 	IWK_WRITE(sc, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
   4212 	IWK_WRITE(sc, CSR_UCODE_DRV_GP1_CLR, CSR_UCODE_SW_BIT_RFKILL);
   4213 
   4214 	/*
   4215 	 * backup ucode data part for future use.
   4216 	 */
   4217 	(void) memcpy(sc->sc_dma_fw_data_bak.mem_va,
   4218 	    sc->sc_dma_fw_data.mem_va,
   4219 	    sc->sc_dma_fw_data.alength);
   4220 
   4221 	for (n = 0; n < 2; n++) {
   4222 		/* load firmware init segment into NIC */
   4223 		err = iwk_load_firmware(sc);
   4224 		if (err != IWK_SUCCESS) {
   4225 			cmn_err(CE_WARN, "iwk_init(): "
   4226 			    "failed to setup boot firmware\n");
   4227 			continue;
   4228 		}
   4229 
   4230 		/* now press "execute" start running */
   4231 		IWK_WRITE(sc, CSR_RESET, 0);
   4232 		break;
   4233 	}
   4234 	if (n == 2) {
   4235 		cmn_err(CE_WARN, "iwk_init(): failed to load firmware\n");
   4236 		goto fail1;
   4237 	}
   4238 	/* ..and wait at most one second for adapter to initialize */
   4239 	clk = ddi_get_lbolt() + drv_usectohz(2000000);
   4240 	while (!(sc->sc_flags & IWK_F_FW_INIT)) {
   4241 		if (cv_timedwait(&sc->sc_fw_cv, &sc->sc_glock, clk) < 0)
   4242 			break;
   4243 	}
   4244 	if (!(sc->sc_flags & IWK_F_FW_INIT)) {
   4245 		cmn_err(CE_WARN,
   4246 		    "iwk_init(): timeout waiting for firmware init\n");
   4247 		goto fail1;
   4248 	}
   4249 
   4250 	/*
   4251 	 * at this point, the firmware is loaded OK, then config the hardware
   4252 	 * with the ucode API, including rxon, txpower, etc.
   4253 	 */
   4254 	err = iwk_config(sc);
   4255 	if (err) {
   4256 		cmn_err(CE_WARN, "iwk_init(): failed to configure device\n");
   4257 		goto fail1;
   4258 	}
   4259 
   4260 	/* at this point, hardware may receive beacons :) */
   4261 	mutex_exit(&sc->sc_glock);
   4262 	return (IWK_SUCCESS);
   4263 
   4264 fail1:
   4265 	err = IWK_FAIL;
   4266 	mutex_exit(&sc->sc_glock);
   4267 	return (err);
   4268 }
   4269 
   4270 static void
   4271 iwk_stop(iwk_sc_t *sc)
   4272 {
   4273 	uint32_t tmp;
   4274 	int i;
   4275 
   4276 	if (!(sc->sc_flags & IWK_F_QUIESCED))
   4277 		mutex_enter(&sc->sc_glock);
   4278 
   4279 	IWK_WRITE(sc, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
   4280 	/* disable interrupts */
   4281 	IWK_WRITE(sc, CSR_INT_MASK, 0);
   4282 	IWK_WRITE(sc, CSR_INT, CSR_INI_SET_MASK);
   4283 	IWK_WRITE(sc, CSR_FH_INT_STATUS, 0xffffffff);
   4284 
   4285 	/* reset all Tx rings */
   4286 	for (i = 0; i < IWK_NUM_QUEUES; i++)
   4287 		iwk_reset_tx_ring(sc, &sc->sc_txq[i]);
   4288 
   4289 	/* reset Rx ring */
   4290 	iwk_reset_rx_ring(sc);
   4291 
   4292 	iwk_mac_access_enter(sc);
   4293 	iwk_reg_write(sc, ALM_APMG_CLK_DIS, APMG_CLK_REG_VAL_DMA_CLK_RQT);
   4294 	iwk_mac_access_exit(sc);
   4295 
   4296 	DELAY(5);
   4297 
   4298 	iwk_stop_master(sc);
   4299 
   4300 	sc->sc_tx_timer = 0;
   4301 	sc->sc_flags &= ~IWK_F_SCANNING;
   4302 	sc->sc_scan_pending = 0;
   4303 
   4304 	tmp = IWK_READ(sc, CSR_RESET);
   4305 	IWK_WRITE(sc, CSR_RESET, tmp | CSR_RESET_REG_FLAG_SW_RESET);
   4306 
   4307 	if (!(sc->sc_flags & IWK_F_QUIESCED))
   4308 		mutex_exit(&sc->sc_glock);
   4309 }
   4310 
   4311 /*
   4312  * Naive implementation of the Adaptive Multi Rate Retry algorithm:
   4313  * "IEEE 802.11 Rate Adaptation: A Practical Approach"
   4314  * Mathieu Lacage, Hossein Manshaei, Thierry Turletti
   4315  * INRIA Sophia - Projet Planete
   4316  * http://www-sop.inria.fr/rapports/sophia/RR-5208.html
   4317  */
   4318 #define	is_success(amrr)	\
   4319 	((amrr)->retrycnt < (amrr)->txcnt / 10)
   4320 #define	is_failure(amrr)	\
   4321 	((amrr)->retrycnt > (amrr)->txcnt / 3)
   4322 #define	is_enough(amrr)		\
   4323 	((amrr)->txcnt > 100)
   4324 #define	is_min_rate(in)		\
   4325 	((in)->in_txrate == 0)
   4326 #define	is_max_rate(in)		\
   4327 	((in)->in_txrate == (in)->in_rates.ir_nrates - 1)
   4328 #define	increase_rate(in)	\
   4329 	((in)->in_txrate++)
   4330 #define	decrease_rate(in)	\
   4331 	((in)->in_txrate--)
   4332 #define	reset_cnt(amrr)		\
   4333 	{ (amrr)->txcnt = (amrr)->retrycnt = 0; }
   4334 
   4335 #define	IWK_AMRR_MIN_SUCCESS_THRESHOLD	 1
   4336 #define	IWK_AMRR_MAX_SUCCESS_THRESHOLD	15
   4337 
   4338 static void
   4339 iwk_amrr_init(iwk_amrr_t *amrr)
   4340 {
   4341 	amrr->success = 0;
   4342 	amrr->recovery = 0;
   4343 	amrr->txcnt = amrr->retrycnt = 0;
   4344 	amrr->success_threshold = IWK_AMRR_MIN_SUCCESS_THRESHOLD;
   4345 }
   4346 
   4347 static void
   4348 iwk_amrr_timeout(iwk_sc_t *sc)
   4349 {
   4350 	ieee80211com_t *ic = &sc->sc_ic;
   4351 
   4352 	IWK_DBG((IWK_DEBUG_RATECTL, "iwk_amrr_timeout() enter\n"));
   4353 	if (ic->ic_opmode == IEEE80211_M_STA)
   4354 		iwk_amrr_ratectl(NULL, ic->ic_bss);
   4355 	else
   4356 		ieee80211_iterate_nodes(&ic->ic_sta, iwk_amrr_ratectl, NULL);
   4357 	sc->sc_clk = ddi_get_lbolt();
   4358 }
   4359 
   4360 /* ARGSUSED */
   4361 static void
   4362 iwk_amrr_ratectl(void *arg, ieee80211_node_t *in)
   4363 {
   4364 	iwk_amrr_t *amrr = (iwk_amrr_t *)in;
   4365 	int need_change = 0;
   4366 
   4367 	if (is_success(amrr) && is_enough(amrr)) {
   4368 		amrr->success++;
   4369 		if (amrr->success >= amrr->success_threshold &&
   4370 		    !is_max_rate(in)) {
   4371 			amrr->recovery = 1;
   4372 			amrr->success = 0;
   4373 			increase_rate(in);
   4374 			IWK_DBG((IWK_DEBUG_RATECTL,
   4375 			    "AMRR increasing rate %d (txcnt=%d retrycnt=%d)\n",
   4376 			    in->in_txrate, amrr->txcnt, amrr->retrycnt));
   4377 			need_change = 1;
   4378 		} else {
   4379 			amrr->recovery = 0;
   4380 		}
   4381 	} else if (is_failure(amrr)) {
   4382 		amrr->success = 0;
   4383 		if (!is_min_rate(in)) {
   4384 			if (amrr->recovery) {
   4385 				amrr->success_threshold++;
   4386 				if (amrr->success_threshold >
   4387 				    IWK_AMRR_MAX_SUCCESS_THRESHOLD)
   4388 					amrr->success_threshold =
   4389 					    IWK_AMRR_MAX_SUCCESS_THRESHOLD;
   4390 			} else {
   4391 				amrr->success_threshold =
   4392 				    IWK_AMRR_MIN_SUCCESS_THRESHOLD;
   4393 			}
   4394 			decrease_rate(in);
   4395 			IWK_DBG((IWK_DEBUG_RATECTL,
   4396 			    "AMRR decreasing rate %d (txcnt=%d retrycnt=%d)\n",
   4397 			    in->in_txrate, amrr->txcnt, amrr->retrycnt));
   4398 			need_change = 1;
   4399 		}
   4400 		amrr->recovery = 0;	/* paper is incorrect */
   4401 	}
   4402 
   4403 	if (is_enough(amrr) || need_change)
   4404 		reset_cnt(amrr);
   4405 }
   4406 
   4407 /*
   4408  * calculate 4965 chipset's kelvin temperature according to
   4409  * the data of init alive and satistics notification.
   4410  * The details is described in iwk_calibration.h file
   4411  */
   4412 static int32_t iwk_curr_tempera(iwk_sc_t *sc)
   4413 {
   4414 	int32_t  tempera;
   4415 	int32_t  r1, r2, r3;
   4416 	uint32_t  r4_u;
   4417 	int32_t   r4_s;
   4418 
   4419 	if (iwk_is_fat_channel(sc)) {
   4420 		r1 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r1[1]);
   4421 		r2 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r2[1]);
   4422 		r3 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r3[1]);
   4423 		r4_u = LE_32(sc->sc_card_alive_init.therm_r4[1]);
   4424 	} else {
   4425 		r1 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r1[0]);
   4426 		r2 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r2[0]);
   4427 		r3 = (int32_t)LE_32(sc->sc_card_alive_init.therm_r3[0]);
   4428 		r4_u = LE_32(sc->sc_card_alive_init.therm_r4[0]);
   4429 	}
   4430 
   4431 	if (sc->sc_flags & IWK_F_STATISTICS) {
   4432 		r4_s = (int32_t)(LE_32(sc->sc_statistics.general.temperature) <<
   4433 		    (31-23)) >> (31-23);
   4434 	} else {
   4435 		r4_s = (int32_t)(r4_u << (31-23)) >> (31-23);
   4436 	}
   4437 
   4438 	IWK_DBG((IWK_DEBUG_CALIBRATION, "temperature R[1-4]: %d %d %d %d\n",
   4439 	    r1, r2, r3, r4_s));
   4440 
   4441 	if (r3 == r1) {
   4442 		cmn_err(CE_WARN, "iwk_curr_tempera(): "
   4443 		    "failed to calculate temperature"
   4444 		    "because r3 = r1\n");
   4445 		return (DDI_FAILURE);
   4446 	}
   4447 
   4448 	tempera = TEMPERATURE_CALIB_A_VAL * (r4_s - r2);
   4449 	tempera /= (r3 - r1);
   4450 	tempera = (tempera*97) / 100 + TEMPERATURE_CALIB_KELVIN_OFFSET;
   4451 
   4452 	IWK_DBG((IWK_DEBUG_CALIBRATION, "calculated temperature: %dK, %dC\n",
   4453 	    tempera, KELVIN_TO_CELSIUS(tempera)));
   4454 
   4455 	return (tempera);
   4456 }
   4457 
   4458 /* Determine whether 4965 is using 2.4 GHz band */
   4459 static inline int iwk_is_24G_band(iwk_sc_t *sc)
   4460 {
   4461 	return (LE_32(sc->sc_config.flags) & RXON_FLG_BAND_24G_MSK);
   4462 }
   4463 
   4464 /* Determine whether 4965 is using fat channel */
   4465 static inline int iwk_is_fat_channel(iwk_sc_t *sc)
   4466 {
   4467 	return ((LE_32(sc->sc_config.flags) &
   4468 	    RXON_FLG_CHANNEL_MODE_PURE_40_MSK) ||
   4469 	    (LE_32(sc->sc_config.flags) & RXON_FLG_CHANNEL_MODE_MIXED_MSK));
   4470 }
   4471 
   4472 /*
   4473  * In MIMO mode, determine which group 4965's current channel belong to.
   4474  * For more infomation about "channel group",
   4475  * please refer to iwk_calibration.h file
   4476  */
   4477 static int iwk_txpower_grp(uint16_t channel)
   4478 {
   4479 	if (channel >= CALIB_IWK_TX_ATTEN_GR5_FCH &&
   4480 	    channel <= CALIB_IWK_TX_ATTEN_GR5_LCH) {
   4481 		return (CALIB_CH_GROUP_5);
   4482 	}
   4483 
   4484 	if (channel >= CALIB_IWK_TX_ATTEN_GR1_FCH &&
   4485 	    channel <= CALIB_IWK_TX_ATTEN_GR1_LCH) {
   4486 		return (CALIB_CH_GROUP_1);
   4487 	}
   4488 
   4489 	if (channel >= CALIB_IWK_TX_ATTEN_GR2_FCH &&
   4490 	    channel <= CALIB_IWK_TX_ATTEN_GR2_LCH) {
   4491 		return (CALIB_CH_GROUP_2);
   4492 	}
   4493 
   4494 	if (channel >= CALIB_IWK_TX_ATTEN_GR3_FCH &&
   4495 	    channel <= CALIB_IWK_TX_ATTEN_GR3_LCH) {
   4496 		return (CALIB_CH_GROUP_3);
   4497 	}
   4498 
   4499 	if (channel >= CALIB_IWK_TX_ATTEN_GR4_FCH &&
   4500 	    channel <= CALIB_IWK_TX_ATTEN_GR4_LCH) {
   4501 		return (CALIB_CH_GROUP_4);
   4502 	}
   4503 
   4504 	cmn_err(CE_WARN, "iwk_txpower_grp(): "
   4505 	    "can't find txpower group for channel %d.\n", channel);
   4506 
   4507 	return (DDI_FAILURE);
   4508 }
   4509 
   4510 /* 2.4 GHz */
   4511 static uint16_t iwk_eep_band_1[14] = {
   4512 	1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
   4513 };
   4514 
   4515 /* 5.2 GHz bands */
   4516 static uint16_t iwk_eep_band_2[13] = {
   4517 	183, 184, 185, 187, 188, 189, 192, 196, 7, 8, 11, 12, 16
   4518 };
   4519 
   4520 static uint16_t iwk_eep_band_3[12] = {
   4521 	34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
   4522 };
   4523 
   4524 static uint16_t iwk_eep_band_4[11] = {
   4525 	100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
   4526 };
   4527 
   4528 static uint16_t iwk_eep_band_5[6] = {
   4529 	145, 149, 153, 157, 161, 165
   4530 };
   4531 
   4532 static uint16_t iwk_eep_band_6[7] = {
   4533 	1, 2, 3, 4, 5, 6, 7
   4534 };
   4535 
   4536 static uint16_t iwk_eep_band_7[11] = {
   4537 	36, 44, 52, 60, 100, 108, 116, 124, 132, 149, 157
   4538 };
   4539 
   4540 /* Get regulatory data from eeprom for a given channel */
   4541 static struct iwk_eep_channel *iwk_get_eep_channel(iwk_sc_t *sc,
   4542     uint16_t channel,
   4543     int is_24G, int is_fat, int is_hi_chan)
   4544 {
   4545 	int32_t i;
   4546 	uint16_t chan;
   4547 
   4548 	if (is_fat) {  /* 11n mode */
   4549 
   4550 		if (is_hi_chan) {
   4551 			chan = channel - 4;
   4552 		} else {
   4553 			chan = channel;
   4554 		}
   4555 
   4556 		for (i = 0; i < 7; i++) {
   4557 			if (iwk_eep_band_6[i] == chan) {
   4558 				return (&sc->sc_eep_map.band_24_channels[i]);
   4559 			}
   4560 		}
   4561 		for (i = 0; i < 11; i++) {
   4562 			if (iwk_eep_band_7[i] == chan) {
   4563 				return (&sc->sc_eep_map.band_52_channels[i]);
   4564 			}
   4565 		}
   4566 	} else if (is_24G) {  /* 2.4 GHz band */
   4567 		for (i = 0; i < 14; i++) {
   4568 			if (iwk_eep_band_1[i] == channel) {
   4569 				return (&sc->sc_eep_map.band_1_channels[i]);
   4570 			}
   4571 		}
   4572 	} else {  /* 5 GHz band */
   4573 		for (i = 0; i < 13; i++) {
   4574 			if (iwk_eep_band_2[i] == channel) {
   4575 				return (&sc->sc_eep_map.band_2_channels[i]);
   4576 			}
   4577 		}
   4578 		for (i = 0; i < 12; i++) {
   4579 			if (iwk_eep_band_3[i] == channel) {
   4580 				return (&sc->sc_eep_map.band_3_channels[i]);
   4581 			}
   4582 		}
   4583 		for (i = 0; i < 11; i++) {
   4584 			if (iwk_eep_band_4[i] == channel) {
   4585 				return (&sc->sc_eep_map.band_4_channels[i]);
   4586 			}
   4587 		}
   4588 		for (i = 0; i < 6; i++) {
   4589 			if (iwk_eep_band_5[i] == channel) {
   4590 				return (&sc->sc_eep_map.band_5_channels[i]);
   4591 			}
   4592 		}
   4593 	}
   4594 
   4595 	return (NULL);
   4596 }
   4597 
   4598 /*
   4599  * Determine which subband a given channel belongs
   4600  * to in 2.4 GHz or 5 GHz band
   4601  */
   4602 static int32_t iwk_band_number(iwk_sc_t *sc, uint16_t channel)
   4603 {
   4604 	int32_t b_n = -1;
   4605 
   4606 	for (b_n = 0; b_n < EEP_TX_POWER_BANDS; b_n++) {
   4607 		if (0 == sc->sc_eep_map.calib_info.band_info_tbl[b_n].ch_from) {
   4608 			continue;
   4609 		}
   4610 
   4611 		if ((channel >=
   4612 		    (uint16_t)sc->sc_eep_map.calib_info.
   4613 		    band_info_tbl[b_n].ch_from) &&
   4614 		    (channel <=
   4615 		    (uint16_t)sc->sc_eep_map.calib_info.
   4616 		    band_info_tbl[b_n].ch_to)) {
   4617 			break;
   4618 		}
   4619 	}
   4620 
   4621 	return (b_n);
   4622 }
   4623 
   4624 /* Make a special division for interpolation operation */
   4625 static int iwk_division(int32_t num, int32_t denom, int32_t *res)
   4626 {
   4627 	int32_t sign = 1;
   4628 
   4629 	if (num < 0) {
   4630 		sign = -sign;
   4631 		num = -num;
   4632 	}
   4633 
   4634 	if (denom < 0) {
   4635 		sign = -sign;
   4636 		denom = -denom;
   4637 	}
   4638 
   4639 	*res = ((num*2 + denom) / (denom*2)) * sign;
   4640 
   4641 	return (IWK_SUCCESS);
   4642 }
   4643 
   4644 /* Make interpolation operation */
   4645 static int32_t iwk_interpolate_value(int32_t x, int32_t x1, int32_t y1,
   4646     int32_t x2, int32_t y2)
   4647 {
   4648 	int32_t val;
   4649 
   4650 	if (x2 == x1) {
   4651 		return (y1);
   4652 	} else {
   4653 		(void) iwk_division((x2-x)*(y1-y2), (x2-x1), &val);
   4654 		return (val + y2);
   4655 	}
   4656 }
   4657 
   4658 /* Get interpolation measurement data of a given channel for all chains. */
   4659 static int iwk_channel_interpolate(iwk_sc_t *sc, uint16_t channel,
   4660     struct iwk_eep_calib_channel_info *chan_info)
   4661 {
   4662 	int32_t ban_n;
   4663 	uint32_t ch1_n, ch2_n;
   4664 	int32_t c, m;
   4665 	struct iwk_eep_calib_measure *m1_p, *m2_p, *m_p;
   4666 
   4667 	/* determine subband number */
   4668 	ban_n = iwk_band_number(sc, channel);
   4669 	if (ban_n >= EEP_TX_POWER_BANDS) {
   4670 		return (DDI_FAILURE);
   4671 	}
   4672 
   4673 	ch1_n =
   4674 	    (uint32_t)sc->sc_eep_map.calib_info.band_info_tbl[ban_n].ch1.ch_num;
   4675 	ch2_n =
   4676 	    (uint32_t)sc->sc_eep_map.calib_info.band_info_tbl[ban_n].ch2.ch_num;
   4677 
   4678 	chan_info->ch_num = (uint8_t)channel;  /* given channel number */
   4679 
   4680 	/*
   4681 	 * go through all chains on chipset
   4682 	 */
   4683 	for (c = 0; c < EEP_TX_POWER_TX_CHAINS; c++) {
   4684 		/*
   4685 		 * go through all factory measurements
   4686 		 */
   4687 		for (m = 0; m < EEP_TX_POWER_MEASUREMENTS; m++) {
   4688 			m1_p =
   4689 			    &(sc->sc_eep_map.calib_info.
   4690 			    band_info_tbl[ban_n].ch1.measure[c][m]);
   4691 			m2_p =
   4692 			    &(sc->sc_eep_map.calib_info.band_info_tbl[ban_n].
   4693 			    ch2.measure[c][m]);
   4694 			m_p = &(chan_info->measure[c][m]);
   4695 
   4696 			/*
   4697 			 * make interpolation to get actual
   4698 			 * Tx power for given channel
   4699 			 */
   4700 			m_p->actual_pow = iwk_interpolate_value(channel,
   4701 			    ch1_n, m1_p->actual_pow,
   4702 			    ch2_n, m2_p->actual_pow);
   4703 
   4704 			/* make interpolation to get index into gain table */
   4705 			m_p->gain_idx = iwk_interpolate_value(channel,
   4706 			    ch1_n, m1_p->gain_idx,
   4707 			    ch2_n, m2_p->gain_idx);
   4708 
   4709 			/* make interpolation to get chipset temperature */
   4710 			m_p->temperature = iwk_interpolate_value(channel,
   4711 			    ch1_n, m1_p->temperature,
   4712 			    ch2_n, m2_p->temperature);
   4713 
   4714 			/*
   4715 			 * make interpolation to get power
   4716 			 * amp detector level
   4717 			 */
   4718 			m_p->pa_det = iwk_interpolate_value(channel, ch1_n,
   4719 			    m1_p->pa_det,
   4720 			    ch2_n, m2_p->pa_det);
   4721 		}
   4722 	}
   4723 
   4724 	return (IWK_SUCCESS);
   4725 }
   4726 
   4727 /*
   4728  * Calculate voltage compensation for Tx power. For more infomation,
   4729  * please refer to iwk_calibration.h file
   4730  */
   4731 static int32_t iwk_voltage_compensation(int32_t eep_voltage,
   4732     int32_t curr_voltage)
   4733 {
   4734 	int32_t vol_comp = 0;
   4735 
   4736 	if ((TX_POWER_IWK_ILLEGAL_VOLTAGE == eep_voltage) ||
   4737 	    (TX_POWER_IWK_ILLEGAL_VOLTAGE == curr_voltage)) {
   4738 		return (vol_comp);
   4739 	}
   4740 
   4741 	(void) iwk_division(curr_voltage-eep_voltage,
   4742 	    TX_POWER_IWK_VOLTAGE_CODES_PER_03V, &vol_comp);
   4743 
   4744 	if (curr_voltage > eep_voltage) {
   4745 		vol_comp *= 2;
   4746 	}
   4747 	if ((vol_comp < -2) || (vol_comp > 2)) {
   4748 		vol_comp = 0;
   4749 	}
   4750 
   4751 	return (vol_comp);
   4752 }
   4753 
   4754 /*
   4755  * Thermal compensation values for txpower for various frequency ranges ...
   4756  * ratios from 3:1 to 4.5:1 of degrees (Celsius) per half-dB gain adjust
   4757  */
   4758 static struct iwk_txpower_tempera_comp {
   4759 	int32_t degrees_per_05db_a;
   4760 	int32_t degrees_per_05db_a_denom;
   4761 } txpower_tempera_comp_table[CALIB_CH_GROUP_MAX] = {
   4762 	{9, 2},			/* group 0 5.2, ch  34-43 */
   4763 	{4, 1},			/* group 1 5.2, ch  44-70 */
   4764 	{4, 1},			/* group 2 5.2, ch  71-124 */
   4765 	{4, 1},			/* group 3 5.2, ch 125-200 */
   4766 	{3, 1}			/* group 4 2.4, ch   all */
   4767 };
   4768 
   4769 /*
   4770  * bit-rate-dependent table to prevent Tx distortion, in half-dB units,
   4771  * for OFDM 6, 12, 18, 24, 36, 48, 54, 60 MBit, and CCK all rates.
   4772  */
   4773 static int32_t back_off_table[] = {
   4774 	10, 10, 10, 10, 10, 15, 17, 20, /* OFDM SISO 20 MHz */
   4775 	10, 10, 10, 10, 10, 15, 17, 20, /* OFDM MIMO 20 MHz */
   4776 	10, 10, 10, 10, 10, 15, 17, 20, /* OFDM SISO 40 MHz */
   4777 	10, 10, 10, 10, 10, 15, 17, 20, /* OFDM MIMO 40 MHz */
   4778 	10			/* CCK */
   4779 };
   4780 
   4781 /* determine minimum Tx power index in gain table */
   4782 static int32_t iwk_min_power_index(int32_t rate_pow_idx, int32_t is_24G)
   4783 {
   4784 	if ((!is_24G) && ((rate_pow_idx & 7) <= 4)) {
   4785 		return (MIN_TX_GAIN_INDEX_52GHZ_EXT);
   4786 	}
   4787 
   4788 	return (MIN_TX_GAIN_INDEX);
   4789 }
   4790 
   4791 /*
   4792  * Determine DSP and radio gain according to temperature and other factors.
   4793  * This function is the majority of Tx power calibration
   4794  */
   4795 static int iwk_txpower_table_cmd_init(iwk_sc_t *sc,
   4796     struct iwk_tx_power_db *tp_db)
   4797 {
   4798 	int is_24G, is_fat, is_high_chan, is_mimo;
   4799 	int c, r;
   4800 	int32_t target_power;
   4801 	int32_t tx_grp = CALIB_CH_GROUP_MAX;
   4802 	uint16_t channel;
   4803 	uint8_t saturation_power;
   4804 	int32_t regu_power;
   4805 	int32_t curr_regu_power;
   4806 	struct iwk_eep_channel *eep_chan_p;
   4807 	struct iwk_eep_calib_channel_info eep_chan_calib;
   4808 	int32_t eep_voltage, init_voltage;
   4809 	int32_t voltage_compensation;
   4810 	int32_t temperature;
   4811 	int32_t degrees_per_05db_num;
   4812 	int32_t degrees_per_05db_denom;
   4813 	struct iwk_eep_calib_measure *measure_p;
   4814 	int32_t interpo_temp;
   4815 	int32_t power_limit;
   4816 	int32_t atten_value;
   4817 	int32_t tempera_comp[2];
   4818 	int32_t interpo_gain_idx[2];
   4819 	int32_t interpo_actual_pow[2];
   4820 	union iwk_tx_power_dual_stream txpower_gains;
   4821 	int32_t txpower_gains_idx;
   4822 
   4823 	channel = LE_16(sc->sc_config.chan);
   4824 
   4825 	/* 2.4 GHz or 5 GHz band */
   4826 	is_24G = iwk_is_24G_band(sc);
   4827 
   4828 	/* fat channel or not */
   4829 	is_fat = iwk_is_fat_channel(sc);
   4830 
   4831 	/*
   4832 	 * using low half channel number or high half channel number
   4833 	 * identify fat channel
   4834 	 */
   4835 	if (is_fat && (LE_32(sc->sc_config.flags) &
   4836 	    RXON_FLG_CONTROL_CHANNEL_LOC_HIGH_MSK)) {
   4837 		is_high_chan = 1;
   4838 	}
   4839 
   4840 	if ((channel > 0) && (channel < 200)) {
   4841 		/* get regulatory channel data from eeprom */
   4842 		eep_chan_p = iwk_get_eep_channel(sc, channel, is_24G,
   4843 		    is_fat, is_high_chan);
   4844 		if (NULL == eep_chan_p) {
   4845 			cmn_err(CE_WARN,
   4846 			    "iwk_txpower_table_cmd_init(): "
   4847 			    "can't get channel infomation\n");
   4848 			return (DDI_FAILURE);
   4849 		}
   4850 	} else {
   4851 		cmn_err(CE_WARN, "iwk_txpower_table_cmd_init(): "
   4852 		    "channel(%d) isn't in proper range\n",
   4853 		    channel);
   4854 		return (DDI_FAILURE);
   4855 	}
   4856 
   4857 	/* initial value of Tx power */
   4858 	sc->sc_user_txpower = (int32_t)eep_chan_p->max_power_avg;
   4859 	if (sc->sc_user_txpower < IWK_TX_POWER_TARGET_POWER_MIN) {
   4860 		cmn_err(CE_WARN, "iwk_txpower_table_cmd_init(): "
   4861 		    "user TX power is too weak\n");
   4862 		return (DDI_FAILURE);
   4863 	} else if (sc->sc_user_txpower > IWK_TX_POWER_TARGET_POWER_MAX) {
   4864 		cmn_err(CE_WARN, "iwk_txpower_table_cmd_init(): "
   4865 		    "user TX power is too strong\n");
   4866 		return (DDI_FAILURE);
   4867 	}
   4868 
   4869 	target_power = 2 * sc->sc_user_txpower;
   4870 
   4871 	/* determine which group current channel belongs to */
   4872 	tx_grp = iwk_txpower_grp(channel);
   4873 	if (tx_grp < 0) {
   4874 		return (tx_grp);
   4875 	}
   4876 
   4877 
   4878 	if (is_fat) {
   4879 		if (is_high_chan) {
   4880 			channel -= 2;
   4881 		} else {
   4882 			channel += 2;
   4883 		}
   4884 	}
   4885 
   4886 	/* determine saturation power */
   4887 	if (is_24G) {
   4888 		saturation_power =
   4889 		    sc->sc_eep_map.calib_info.saturation_power24;
   4890 	} else {
   4891 		saturation_power =
   4892 		    sc->sc_eep_map.calib_info.saturation_power52;
   4893 	}
   4894 
   4895 	if (saturation_power < IWK_TX_POWER_SATURATION_MIN ||
   4896 	    saturation_power > IWK_TX_POWER_SATURATION_MAX) {
   4897 		if (is_24G) {
   4898 			saturation_power = IWK_TX_POWER_DEFAULT_SATURATION_24;
   4899 		} else {
   4900 			saturation_power = IWK_TX_POWER_DEFAULT_SATURATION_52;
   4901 		}
   4902 	}
   4903 
   4904 	/* determine regulatory power */
   4905 	regu_power = (int32_t)eep_chan_p->max_power_avg * 2;
   4906 	if ((regu_power < IWK_TX_POWER_REGULATORY_MIN) ||
   4907 	    (regu_power > IWK_TX_POWER_REGULATORY_MAX)) {
   4908 		if (is_24G) {
   4909 			regu_power = IWK_TX_POWER_DEFAULT_REGULATORY_24;
   4910 		} else {
   4911 			regu_power = IWK_TX_POWER_DEFAULT_REGULATORY_52;
   4912 		}
   4913 	}
   4914 
   4915 	/*
   4916 	 * get measurement data for current channel
   4917 	 * suach as temperature,index to gain table,actual Tx power
   4918 	 */
   4919 	(void) iwk_channel_interpolate(sc, channel, &eep_chan_calib);
   4920 
   4921 	eep_voltage = (int32_t)LE_16(sc->sc_eep_map.calib_info.voltage);
   4922 	init_voltage = (int32_t)LE_32(sc->sc_card_alive_init.voltage);
   4923 
   4924 	/* calculate voltage compensation to Tx power */
   4925 	voltage_compensation =
   4926 	    iwk_voltage_compensation(eep_voltage, init_voltage);
   4927 
   4928 	if (sc->sc_tempera >= IWK_TX_POWER_TEMPERATURE_MIN) {
   4929 		temperature = sc->sc_tempera;
   4930 	} else {
   4931 		temperature = IWK_TX_POWER_TEMPERATURE_MIN;
   4932 	}
   4933 	if (sc->sc_tempera <= IWK_TX_POWER_TEMPERATURE_MAX) {
   4934 		temperature = sc->sc_tempera;
   4935 	} else {
   4936 		temperature = IWK_TX_POWER_TEMPERATURE_MAX;
   4937 	}
   4938 	temperature = KELVIN_TO_CELSIUS(temperature);
   4939 
   4940 	degrees_per_05db_num =
   4941 	    txpower_tempera_comp_table[tx_grp].degrees_per_05db_a;
   4942 	degrees_per_05db_denom =
   4943 	    txpower_tempera_comp_table[tx_grp].degrees_per_05db_a_denom;
   4944 
   4945 	for (c = 0; c < 2; c++) {  /* go through all chains */
   4946 		measure_p = &eep_chan_calib.measure[c][1];
   4947 		interpo_temp = measure_p->temperature;
   4948 
   4949 		/* determine temperature compensation to Tx power */
   4950 		(void) iwk_division(
   4951 		    (temperature-interpo_temp)*degrees_per_05db_denom,
   4952 		    degrees_per_05db_num, &tempera_comp[c]);
   4953 
   4954 		interpo_gain_idx[c] = measure_p->gain_idx;
   4955 		interpo_actual_pow[c] = measure_p->actual_pow;
   4956 	}
   4957 
   4958 	/*
   4959 	 * go through all rate entries in Tx power table
   4960 	 */
   4961 	for (r = 0; r < POWER_TABLE_NUM_ENTRIES; r++) {
   4962 		if (r & 0x8) {
   4963 			/* need to lower regulatory power for MIMO mode */
   4964 			curr_regu_power = regu_power -
   4965 			    IWK_TX_POWER_MIMO_REGULATORY_COMPENSATION;
   4966 			is_mimo = 1;
   4967 		} else {
   4968 			curr_regu_power = regu_power;
   4969 			is_mimo = 0;
   4970 		}
   4971 
   4972 		power_limit = saturation_power - back_off_table[r];
   4973 		if (power_limit > curr_regu_power) {
   4974 			/* final Tx power limit */
   4975 			power_limit = curr_regu_power;
   4976 		}
   4977 
   4978 		if (target_power > power_limit) {
   4979 			target_power = power_limit; /* final target Tx power */
   4980 		}
   4981 
   4982 		for (c = 0; c < 2; c++) {	  /* go through all Tx chains */
   4983 			if (is_mimo) {
   4984 				atten_value =
   4985 				    LE_32(sc->sc_card_alive_init.
   4986 				    tx_atten[tx_grp][c]);
   4987 			} else {
   4988 				atten_value = 0;
   4989 			}
   4990 
   4991 			/*
   4992 			 * calculate index in gain table
   4993 			 * this step is very important
   4994 			 */
   4995 			txpower_gains_idx = interpo_gain_idx[c] -
   4996 			    (target_power - interpo_actual_pow[c]) -
   4997 			    tempera_comp[c] - voltage_compensation +
   4998 			    atten_value;
   4999 
   5000 			if (txpower_gains_idx <
   5001 			    iwk_min_power_index(r, is_24G)) {
   5002 				txpower_gains_idx =
   5003 				    iwk_min_power_index(r, is_24G);
   5004 			}
   5005 
   5006 			if (!is_24G) {
   5007 				/*
   5008 				 * support negative index for 5 GHz
   5009 				 * band
   5010 				 */
   5011 				txpower_gains_idx += 9;
   5012 			}
   5013 
   5014 			if (POWER_TABLE_CCK_ENTRY == r) {
   5015 				/* for CCK mode, make necessary attenuaton */
   5016 				txpower_gains_idx +=
   5017 				    IWK_TX_POWER_CCK_COMPENSATION_C_STEP;
   5018 			}
   5019 
   5020 			if (txpower_gains_idx > 107) {
   5021 				txpower_gains_idx = 107;
   5022 			} else if (txpower_gains_idx < 0) {
   5023 				txpower_gains_idx = 0;
   5024 			}
   5025 
   5026 			/* search DSP and radio gains in gain table */
   5027 			txpower_gains.s.radio_tx_gain[c] =
   5028 			    gains_table[is_24G][txpower_gains_idx].radio;
   5029 			txpower_gains.s.dsp_predis_atten[c] =
   5030 			    gains_table[is_24G][txpower_gains_idx].dsp;
   5031 
   5032 			IWK_DBG((IWK_DEBUG_CALIBRATION,
   5033 			    "rate_index: %d, "
   5034 			    "gain_index %d, c: %d,is_mimo: %d\n",
   5035 			    r, txpower_gains_idx, c, is_mimo));
   5036 		}
   5037 
   5038 		/* initialize Tx power table */
   5039 		if (r < POWER_TABLE_NUM_HT_OFDM_ENTRIES) {
   5040 			tp_db->ht_ofdm_power[r].dw = LE_32(txpower_gains.dw);
   5041 		} else {
   5042 			tp_db->legacy_cck_power.dw = LE_32(txpower_gains.dw);
   5043 		}
   5044 	}
   5045 
   5046 	return (IWK_SUCCESS);
   5047 }
   5048 
   5049 /*
   5050  * make Tx power calibration to adjust Tx power.
   5051  * This is completed by sending out Tx power table command.
   5052  */
   5053 static int iwk_tx_power_calibration(iwk_sc_t *sc)
   5054 {
   5055 	iwk_tx_power_table_cmd_t cmd;
   5056 	int rv;
   5057 
   5058 	if (sc->sc_flags & IWK_F_SCANNING) {
   5059 		return (IWK_SUCCESS);
   5060 	}
   5061 
   5062 	/* necessary initialization to Tx power table command */
   5063 	cmd.band = (uint8_t)iwk_is_24G_band(sc);
   5064 	cmd.channel = sc->sc_config.chan;
   5065 	cmd.channel_normal_width = 0;
   5066 
   5067 	/* initialize Tx power table */
   5068 	rv = iwk_txpower_table_cmd_init(sc, &cmd.tx_power);
   5069 	if (rv) {
   5070 		cmn_err(CE_NOTE, "rv= %d\n", rv);
   5071 		return (rv);
   5072 	}
   5073 
   5074 	/* send out Tx power table command */
   5075 	rv = iwk_cmd(sc, REPLY_TX_PWR_TABLE_CMD, &cmd, sizeof (cmd), 1);
   5076 	if (rv) {
   5077 		return (rv);
   5078 	}
   5079 
   5080 	/* record current temperature */
   5081 	sc->sc_last_tempera = sc->sc_tempera;
   5082 
   5083 	return (IWK_SUCCESS);
   5084 }
   5085 
   5086 /* This function is the handler of statistics notification from uCode */
   5087 static void iwk_statistics_notify(iwk_sc_t *sc, iwk_rx_desc_t *desc)
   5088 {
   5089 	int is_diff;
   5090 	struct iwk_notif_statistics *statistics_p =
   5091 	    (struct iwk_notif_statistics *)(desc + 1);
   5092 
   5093 	mutex_enter(&sc->sc_glock);
   5094 
   5095 	is_diff = (sc->sc_statistics.general.temperature !=
   5096 	    statistics_p->general.temperature) ||
   5097 	    (LE_32(sc->sc_statistics.flag) &
   5098 	    STATISTICS_REPLY_FLG_FAT_MODE_MSK) !=
   5099 	    (LE_32(statistics_p->flag) & STATISTICS_REPLY_FLG_FAT_MODE_MSK);
   5100 
   5101 	/* update statistics data */
   5102 	(void) memcpy(&sc->sc_statistics, statistics_p,
   5103 	    sizeof (struct iwk_notif_statistics));
   5104 
   5105 	sc->sc_flags |= IWK_F_STATISTICS;
   5106 
   5107 	if (!(sc->sc_flags & IWK_F_SCANNING)) {
   5108 		/* make Receiver gain balance calibration */
   5109 		(void) iwk_rxgain_diff(sc);
   5110 
   5111 		/* make Receiver sensitivity calibration */
   5112 		(void) iwk_rx_sens(sc);
   5113 	}
   5114 
   5115 
   5116 	if (!is_diff) {
   5117 		mutex_exit(&sc->sc_glock);
   5118 		return;
   5119 	}
   5120 
   5121 	/* calibration current temperature of 4965 chipset */
   5122 	sc->sc_tempera = iwk_curr_tempera(sc);
   5123 
   5124 	/* distinct temperature change will trigger Tx power calibration */
   5125 	if (((sc->sc_tempera - sc->sc_last_tempera) >= 3) ||
   5126 	    ((sc->sc_last_tempera - sc->sc_tempera) >= 3)) {
   5127 		/* make Tx power calibration */
   5128 		(void) iwk_tx_power_calibration(sc);
   5129 	}
   5130 
   5131 	mutex_exit(&sc->sc_glock);
   5132 }
   5133 
   5134 /* Determine this station is in associated state or not */
   5135 static int iwk_is_associated(iwk_sc_t *sc)
   5136 {
   5137 	return (LE_32(sc->sc_config.filter_flags) & RXON_FILTER_ASSOC_MSK);
   5138 }
   5139 
   5140 /* Make necessary preparation for Receiver gain balance calibration */
   5141 static int iwk_rxgain_diff_init(iwk_sc_t *sc)
   5142 {
   5143 	int i, rv;
   5144 	struct iwk_calibration_cmd cmd;
   5145 	struct iwk_rx_gain_diff *gain_diff_p;
   5146 
   5147 	gain_diff_p = &sc->sc_rxgain_diff;
   5148 
   5149 	(void) memset(gain_diff_p, 0, sizeof (struct iwk_rx_gain_diff));
   5150 	(void) memset(&cmd, 0, sizeof (struct iwk_calibration_cmd));
   5151 
   5152 	for (i = 0; i < RX_CHAINS_NUM; i++) {
   5153 		gain_diff_p->gain_diff_chain[i] = CHAIN_GAIN_DIFF_INIT_VAL;
   5154 	}
   5155 
   5156 	if (iwk_is_associated(sc)) {
   5157 		cmd.opCode = PHY_CALIBRATE_DIFF_GAIN_CMD;
   5158 		cmd.diff_gain_a = 0;
   5159 		cmd.diff_gain_b = 0;
   5160 		cmd.diff_gain_c = 0;
   5161 
   5162 		/* assume the gains of every Rx chains is balanceable */
   5163 		rv = iwk_cmd(sc, REPLY_PHY_CALIBRATION_CMD, &cmd,
   5164 		    sizeof (cmd), 1);
   5165 		if (rv) {
   5166 			return (rv);
   5167 		}
   5168 
   5169 		gain_diff_p->state = IWK_GAIN_DIFF_ACCUMULATE;
   5170 	}
   5171 
   5172 	return (IWK_SUCCESS);
   5173 }
   5174 
   5175 /*
   5176  * make Receiver gain balance to balance Rx gain between Rx chains
   5177  * and determine which chain is disconnected
   5178  */
   5179 static int iwk_rxgain_diff(iwk_sc_t *sc)
   5180 {
   5181 	int i, is_24G, rv;
   5182 	int max_beacon_chain_n;
   5183 	int min_noise_chain_n;
   5184 	uint16_t channel_n;
   5185 	int32_t beacon_diff;
   5186 	int32_t noise_diff;
   5187 	uint32_t noise_chain_a, noise_chain_b, noise_chain_c;
   5188 	uint32_t beacon_chain_a, beacon_chain_b, beacon_chain_c;
   5189 	struct iwk_calibration_cmd cmd;
   5190 	uint32_t beacon_aver[RX_CHAINS_NUM] = {0xFFFFFFFF};
   5191 	uint32_t noise_aver[RX_CHAINS_NUM] = {0xFFFFFFFF};
   5192 	struct statistics_rx_non_phy *rx_general_p =
   5193 	    &sc->sc_statistics.rx.general;
   5194 	struct iwk_rx_gain_diff *gain_diff_p = &sc->sc_rxgain_diff;
   5195 
   5196 	if (INTERFERENCE_DATA_AVAILABLE !=
   5197 	    LE_32(rx_general_p->interference_data_flag)) {
   5198 		return (IWK_SUCCESS);
   5199 	}
   5200 
   5201 	if (IWK_GAIN_DIFF_ACCUMULATE != gain_diff_p->state) {
   5202 		return (IWK_SUCCESS);
   5203 	}
   5204 
   5205 	is_24G = iwk_is_24G_band(sc);
   5206 	channel_n = sc->sc_config.chan;	 /* channel number */
   5207 
   5208 	if ((channel_n != (LE_32(sc->sc_statistics.flag) >> 16)) ||
   5209 	    ((STATISTICS_REPLY_FLG_BAND_24G_MSK ==
   5210 	    (LE_32(sc->sc_statistics.flag) &
   5211 	    STATISTICS_REPLY_FLG_BAND_24G_MSK)) &&
   5212 	    !is_24G)) {
   5213 		return (IWK_SUCCESS);
   5214 	}
   5215 
   5216 	/* Rx chain's noise strength from statistics notification */
   5217 	noise_chain_a = LE_32(rx_general_p->beacon_silence_rssi_a) & 0xFF;
   5218 	noise_chain_b = LE_32(rx_general_p->beacon_silence_rssi_b) & 0xFF;
   5219 	noise_chain_c = LE_32(rx_general_p->beacon_silence_rssi_c) & 0xFF;
   5220 
   5221 	/* Rx chain's beacon strength from statistics notification */
   5222 	beacon_chain_a = LE_32(rx_general_p->beacon_rssi_a) & 0xFF;
   5223 	beacon_chain_b = LE_32(rx_general_p->beacon_rssi_b) & 0xFF;
   5224 	beacon_chain_c = LE_32(rx_general_p->beacon_rssi_c) & 0xFF;
   5225 
   5226 	gain_diff_p->beacon_count++;
   5227 
   5228 	/* accumulate chain's noise strength */
   5229 	gain_diff_p->noise_stren_a += noise_chain_a;
   5230 	gain_diff_p->noise_stren_b += noise_chain_b;
   5231 	gain_diff_p->noise_stren_c += noise_chain_c;
   5232 
   5233 	/* accumulate chain's beacon strength */
   5234 	gain_diff_p->beacon_stren_a += beacon_chain_a;
   5235 	gain_diff_p->beacon_stren_b += beacon_chain_b;
   5236 	gain_diff_p->beacon_stren_c += beacon_chain_c;
   5237 
   5238 	if (BEACON_NUM_20 == gain_diff_p->beacon_count) {
   5239 		/* calculate average beacon strength */
   5240 		beacon_aver[0] = (gain_diff_p->beacon_stren_a) / BEACON_NUM_20;
   5241 		beacon_aver[1] = (gain_diff_p->beacon_stren_b) / BEACON_NUM_20;
   5242 		beacon_aver[2] = (gain_diff_p->beacon_stren_c) / BEACON_NUM_20;
   5243 
   5244 		/* calculate average noise strength */
   5245 		noise_aver[0] = (gain_diff_p->noise_stren_a) / BEACON_NUM_20;
   5246 		noise_aver[1] = (gain_diff_p->noise_stren_b) / BEACON_NUM_20;
   5247 		noise_aver[2] = (gain_diff_p->noise_stren_b) / BEACON_NUM_20;
   5248 
   5249 		/* determine maximum beacon strength among 3 chains */
   5250 		if ((beacon_aver[0] >= beacon_aver[1]) &&
   5251 		    (beacon_aver[0] >= beacon_aver[2])) {
   5252 			max_beacon_chain_n = 0;
   5253 			gain_diff_p->connected_chains = 1 << 0;
   5254 		} else if (beacon_aver[1] >= beacon_aver[2]) {
   5255 			max_beacon_chain_n = 1;
   5256 			gain_diff_p->connected_chains = 1 << 1;
   5257 		} else {
   5258 			max_beacon_chain_n = 2;
   5259 			gain_diff_p->connected_chains = 1 << 2;
   5260 		}
   5261 
   5262 		/* determine which chain is disconnected */
   5263 		for (i = 0; i < RX_CHAINS_NUM; i++) {
   5264 			if (i != max_beacon_chain_n) {
   5265 				beacon_diff = beacon_aver[max_beacon_chain_n] -
   5266 				    beacon_aver[i];
   5267 				if (beacon_diff > MAX_ALLOWED_DIFF) {
   5268 					gain_diff_p->disconnect_chain[i] = 1;
   5269 				} else {
   5270 					gain_diff_p->connected_chains |=
   5271 					    (1 << i);
   5272 				}
   5273 			}
   5274 		}
   5275 
   5276 		/*
   5277 		 * if chain A and B are both disconnected,
   5278 		 * assume the stronger in beacon strength is connected
   5279 		 */
   5280 		if (gain_diff_p->disconnect_chain[0] &&
   5281 		    gain_diff_p->disconnect_chain[1]) {
   5282 			if (beacon_aver[0] >= beacon_aver[1]) {
   5283 				gain_diff_p->disconnect_chain[0] = 0;
   5284 				gain_diff_p->connected_chains |= (1 << 0);
   5285 			} else {
   5286 				gain_diff_p->disconnect_chain[1] = 0;
   5287 				gain_diff_p->connected_chains |= (1 << 1);
   5288 			}
   5289 		}
   5290 
   5291 		/* determine minimum noise strength among 3 chains */
   5292 		if (!gain_diff_p->disconnect_chain[0]) {
   5293 			min_noise_chain_n = 0;
   5294 
   5295 			for (i = 0; i < RX_CHAINS_NUM; i++) {
   5296 				if (!gain_diff_p->disconnect_chain[i] &&
   5297 				    (noise_aver[i] <=
   5298 				    noise_aver[min_noise_chain_n])) {
   5299 					min_noise_chain_n = i;
   5300 				}
   5301 
   5302 			}
   5303 		} else {
   5304 			min_noise_chain_n = 1;
   5305 
   5306 			for (i = 0; i < RX_CHAINS_NUM; i++) {
   5307 				if (!gain_diff_p->disconnect_chain[i] &&
   5308 				    (noise_aver[i] <=
   5309 				    noise_aver[min_noise_chain_n])) {
   5310 					min_noise_chain_n = i;
   5311 				}
   5312 			}
   5313 		}
   5314 
   5315 		gain_diff_p->gain_diff_chain[min_noise_chain_n] = 0;
   5316 
   5317 		/* determine gain difference between chains */
   5318 		for (i = 0; i < RX_CHAINS_NUM; i++) {
   5319 			if (!gain_diff_p->disconnect_chain[i] &&
   5320 			    (CHAIN_GAIN_DIFF_INIT_VAL ==
   5321 			    gain_diff_p->gain_diff_chain[i])) {
   5322 
   5323 				noise_diff = noise_aver[i] -
   5324 				    noise_aver[min_noise_chain_n];
   5325 				gain_diff_p->gain_diff_chain[i] =
   5326 				    (uint8_t)((noise_diff * 10) / 15);
   5327 
   5328 				if (gain_diff_p->gain_diff_chain[i] > 3) {
   5329 					gain_diff_p->gain_diff_chain[i] = 3;
   5330 				}
   5331 
   5332 				gain_diff_p->gain_diff_chain[i] |= (1 << 2);
   5333 			} else {
   5334 				gain_diff_p->gain_diff_chain[i] = 0;
   5335 			}
   5336 		}
   5337 
   5338 		if (!gain_diff_p->gain_diff_send) {
   5339 			gain_diff_p->gain_diff_send = 1;
   5340 
   5341 			(void) memset(&cmd, 0, sizeof (cmd));
   5342 
   5343 			cmd.opCode = PHY_CALIBRATE_DIFF_GAIN_CMD;
   5344 			cmd.diff_gain_a = gain_diff_p->gain_diff_chain[0];
   5345 			cmd.diff_gain_b = gain_diff_p->gain_diff_chain[1];
   5346 			cmd.diff_gain_c = gain_diff_p->gain_diff_chain[2];
   5347 
   5348 			/*
   5349 			 * send out PHY calibration command to
   5350 			 * adjust every chain's Rx gain
   5351 			 */
   5352 			rv = iwk_cmd(sc, REPLY_PHY_CALIBRATION_CMD,
   5353 			    &cmd, sizeof (cmd), 1);
   5354 			if (rv) {
   5355 				return (rv);
   5356 			}
   5357 
   5358 			gain_diff_p->state = IWK_GAIN_DIFF_CALIBRATED;
   5359 		}
   5360 
   5361 		gain_diff_p->beacon_stren_a = 0;
   5362 		gain_diff_p->beacon_stren_b = 0;
   5363 		gain_diff_p->beacon_stren_c = 0;
   5364 
   5365 		gain_diff_p->noise_stren_a = 0;
   5366 		gain_diff_p->noise_stren_b = 0;
   5367 		gain_diff_p->noise_stren_c = 0;
   5368 	}
   5369 
   5370 	return (IWK_SUCCESS);
   5371 }
   5372 
   5373 /* Make necessary preparation for Receiver sensitivity calibration */
   5374 static int iwk_rx_sens_init(iwk_sc_t *sc)
   5375 {
   5376 	int i, rv;
   5377 	struct iwk_rx_sensitivity_cmd cmd;
   5378 	struct iwk_rx_sensitivity *rx_sens_p = &sc->sc_rx_sens;
   5379 
   5380 	(void) memset(&cmd, 0, sizeof (struct iwk_rx_sensitivity_cmd));
   5381 	(void) memset(rx_sens_p, 0, sizeof (struct iwk_rx_sensitivity));
   5382 
   5383 	rx_sens_p->auto_corr_ofdm_x4 = 90;
   5384 	rx_sens_p->auto_corr_mrc_ofdm_x4 = 170;
   5385 	rx_sens_p->auto_corr_ofdm_x1 = 105;
   5386 	rx_sens_p->auto_corr_mrc_ofdm_x1 = 220;
   5387 
   5388 	rx_sens_p->auto_corr_cck_x4 = 125;
   5389 	rx_sens_p->auto_corr_mrc_cck_x4 = 200;
   5390 	rx_sens_p->min_energy_det_cck = 100;
   5391 
   5392 	rx_sens_p->flags &= (~IWK_SENSITIVITY_CALIB_ALLOW_MSK);
   5393 	rx_sens_p->flags &= (~IWK_SENSITIVITY_OFDM_UPDATE_MSK);
   5394 	rx_sens_p->flags &= (~IWK_SENSITIVITY_CCK_UPDATE_MSK);
   5395 
   5396 	rx_sens_p->last_bad_plcp_cnt_ofdm = 0;
   5397 	rx_sens_p->last_false_alarm_cnt_ofdm = 0;
   5398 	rx_sens_p->last_bad_plcp_cnt_cck = 0;
   5399 	rx_sens_p->last_false_alarm_cnt_cck = 0;
   5400 
   5401 	rx_sens_p->cck_curr_state = IWK_TOO_MANY_FALSE_ALARM;
   5402 	rx_sens_p->cck_prev_state = IWK_TOO_MANY_FALSE_ALARM;
   5403 	rx_sens_p->cck_no_false_alarm_num = 0;
   5404 	rx_sens_p->cck_beacon_idx = 0;
   5405 
   5406 	for (i = 0; i < 10; i++) {
   5407 		rx_sens_p->cck_beacon_min[i] = 0;
   5408 	}
   5409 
   5410 	rx_sens_p->cck_noise_idx = 0;
   5411 	rx_sens_p->cck_noise_ref = 0;
   5412 
   5413 	for (i = 0; i < 20; i++) {
   5414 		rx_sens_p->cck_noise_max[i] = 0;
   5415 	}
   5416 
   5417 	rx_sens_p->cck_noise_diff = 0;
   5418 	rx_sens_p->cck_no_false_alarm_num = 0;
   5419 
   5420 	cmd.control = LE_16(IWK_SENSITIVITY_CONTROL_WORK_TABLE);
   5421 
   5422 	cmd.table[AUTO_CORR32_X4_TH_ADD_MIN_IDX] =
   5423 	    LE_16(rx_sens_p->auto_corr_ofdm_x4);
   5424 	cmd.table[AUTO_CORR32_X4_TH_ADD_MIN_MRC_IDX] =
   5425 	    LE_16(rx_sens_p->auto_corr_mrc_ofdm_x4);
   5426 	cmd.table[AUTO_CORR32_X1_TH_ADD_MIN_IDX] =
   5427 	    LE_16(rx_sens_p->auto_corr_ofdm_x1);
   5428 	cmd.table[AUTO_CORR32_X1_TH_ADD_MIN_MRC_IDX] =
   5429 	    LE_16(rx_sens_p->auto_corr_mrc_ofdm_x1);
   5430 
   5431 	cmd.table[AUTO_CORR40_X4_TH_ADD_MIN_IDX] =
   5432 	    LE_16(rx_sens_p->auto_corr_cck_x4);
   5433 	cmd.table[AUTO_CORR40_X4_TH_ADD_MIN_MRC_IDX] =
   5434 	    LE_16(rx_sens_p->auto_corr_mrc_cck_x4);
   5435 	cmd.table[MIN_ENERGY_CCK_DET_IDX] =
   5436 	    LE_16(rx_sens_p->min_energy_det_cck);
   5437 
   5438 	cmd.table[MIN_ENERGY_OFDM_DET_IDX] = LE_16(100);
   5439 	cmd.table[BARKER_CORR_TH_ADD_MIN_IDX] = LE_16(190);
   5440 	cmd.table[BARKER_CORR_TH_ADD_MIN_MRC_IDX] = LE_16(390);
   5441 	cmd.table[PTAM_ENERGY_TH_IDX] = LE_16(62);
   5442 
   5443 	/* at first, set up Rx to maximum sensitivity */
   5444 	rv = iwk_cmd(sc, SENSITIVITY_CMD, &cmd, sizeof (cmd), 1);
   5445 	if (rv) {
   5446 		cmn_err(CE_WARN, "iwk_rx_sens_init(): "
   5447 		    "in the process of initialization, "
   5448 		    "failed to send rx sensitivity command\n");
   5449 		return (rv);
   5450 	}
   5451 
   5452 	rx_sens_p->flags |= IWK_SENSITIVITY_CALIB_ALLOW_MSK;
   5453 
   5454 	return (IWK_SUCCESS);
   5455 }
   5456 
   5457 /*
   5458  * make Receiver sensitivity calibration to adjust every chain's Rx sensitivity.
   5459  * for more infomation, please refer to iwk_calibration.h file
   5460  */
   5461 static int iwk_rx_sens(iwk_sc_t *sc)
   5462 {
   5463 	int rv;
   5464 	uint32_t actual_rx_time;
   5465 	struct statistics_rx_non_phy *rx_general_p =
   5466 	    &sc->sc_statistics.rx.general;
   5467 	struct iwk_rx_sensitivity *rx_sens_p = &sc->sc_rx_sens;
   5468 	struct iwk_rx_sensitivity_cmd cmd;
   5469 
   5470 	if (!(rx_sens_p->flags & IWK_SENSITIVITY_CALIB_ALLOW_MSK)) {
   5471 		cmn_err(CE_WARN, "iwk_rx_sens(): "
   5472 		    "sensitivity initialization has not finished.\n");
   5473 		return (DDI_FAILURE);
   5474 	}
   5475 
   5476 	if (INTERFERENCE_DATA_AVAILABLE !=
   5477 	    LE_32(rx_general_p->interference_data_flag)) {
   5478 		cmn_err(CE_WARN, "iwk_rx_sens(): "
   5479 		    "can't make rx sensitivity calibration,"
   5480 		    "because of invalid statistics\n");
   5481 		return (DDI_FAILURE);
   5482 	}
   5483 
   5484 	actual_rx_time = LE_32(rx_general_p->channel_load);
   5485 	if (!actual_rx_time) {
   5486 		IWK_DBG((IWK_DEBUG_CALIBRATION, "iwk_rx_sens(): "
   5487 		    "can't make rx sensitivity calibration,"
   5488 		    "because has not enough rx time\n"));
   5489 		return (DDI_FAILURE);
   5490 	}
   5491 
   5492 	/* make Rx sensitivity calibration for OFDM mode */
   5493 	rv = iwk_ofdm_sens(sc, actual_rx_time);
   5494 	if (rv) {
   5495 		return (rv);
   5496 	}
   5497 
   5498 	/* make Rx sensitivity calibration for CCK mode */
   5499 	rv = iwk_cck_sens(sc, actual_rx_time);
   5500 	if (rv) {
   5501 		return (rv);
   5502 	}
   5503 
   5504 	/*
   5505 	 * if the sum of false alarm had not changed, nothing will be done
   5506 	 */
   5507 	if ((!(rx_sens_p->flags & IWK_SENSITIVITY_OFDM_UPDATE_MSK)) &&
   5508 	    (!(rx_sens_p->flags & IWK_SENSITIVITY_CCK_UPDATE_MSK))) {
   5509 		return (IWK_SUCCESS);
   5510 	}
   5511 
   5512 	cmd.control = IWK_SENSITIVITY_CONTROL_WORK_TABLE;
   5513 
   5514 	cmd.table[AUTO_CORR32_X4_TH_ADD_MIN_IDX] =
   5515 	    rx_sens_p->auto_corr_ofdm_x4;
   5516 	cmd.table[AUTO_CORR32_X4_TH_ADD_MIN_MRC_IDX] =
   5517 	    rx_sens_p->auto_corr_mrc_ofdm_x4;
   5518 	cmd.table[AUTO_CORR32_X1_TH_ADD_MIN_IDX] =
   5519 	    rx_sens_p->auto_corr_ofdm_x1;
   5520 	cmd.table[AUTO_CORR32_X1_TH_ADD_MIN_MRC_IDX] =
   5521 	    rx_sens_p->auto_corr_mrc_ofdm_x1;
   5522 
   5523 	cmd.table[AUTO_CORR40_X4_TH_ADD_MIN_IDX] =
   5524 	    rx_sens_p->auto_corr_cck_x4;
   5525 	cmd.table[AUTO_CORR40_X4_TH_ADD_MIN_MRC_IDX] =
   5526 	    rx_sens_p->auto_corr_mrc_cck_x4;
   5527 	cmd.table[MIN_ENERGY_CCK_DET_IDX] =
   5528 	    rx_sens_p->min_energy_det_cck;
   5529 
   5530 	cmd.table[MIN_ENERGY_OFDM_DET_IDX] = 100;
   5531 	cmd.table[BARKER_CORR_TH_ADD_MIN_IDX] = 190;
   5532 	cmd.table[BARKER_CORR_TH_ADD_MIN_MRC_IDX] = 390;
   5533 	cmd.table[PTAM_ENERGY_TH_IDX] = 62;
   5534 
   5535 	/*
   5536 	 * send sensitivity command to complete actual sensitivity calibration
   5537 	 */
   5538 	rv = iwk_cmd(sc, SENSITIVITY_CMD, &cmd, sizeof (cmd), 1);
   5539 	if (rv) {
   5540 		cmn_err(CE_WARN, "iwk_rx_sens(): "
   5541 		    "fail to send rx sensitivity command\n");
   5542 		return (rv);
   5543 	}
   5544 
   5545 	return (IWK_SUCCESS);
   5546 
   5547 }
   5548 
   5549 /*
   5550  * make Rx sensitivity calibration for CCK mode.
   5551  * This is preparing parameters for Sensitivity command
   5552  */
   5553 static int iwk_cck_sens(iwk_sc_t *sc, uint32_t actual_rx_time)
   5554 {
   5555 	int i;
   5556 	uint8_t noise_a, noise_b, noise_c;
   5557 	uint8_t max_noise_abc, max_noise_20;
   5558 	uint32_t beacon_a, beacon_b, beacon_c;
   5559 	uint32_t min_beacon_abc, max_beacon_10;
   5560 	uint32_t cck_fa, cck_bp;
   5561 	uint32_t cck_sum_fa_bp;
   5562 	uint32_t temp;
   5563 	struct statistics_rx_non_phy *rx_general_p =
   5564 	    &sc->sc_statistics.rx.general;
   5565 	struct iwk_rx_sensitivity *rx_sens_p = &sc->sc_rx_sens;
   5566 
   5567 	cck_fa = LE_32(sc->sc_statistics.rx.cck.false_alarm_cnt);
   5568 	cck_bp = LE_32(sc->sc_statistics.rx.cck.plcp_err);
   5569 
   5570 	/* accumulate false alarm */
   5571 	if (rx_sens_p->last_false_alarm_cnt_cck > cck_fa) {
   5572 		temp = rx_sens_p->last_false_alarm_cnt_cck;
   5573 		rx_sens_p->last_false_alarm_cnt_cck = cck_fa;
   5574 		cck_fa += (0xFFFFFFFF - temp);
   5575 	} else {
   5576 		cck_fa -= rx_sens_p->last_false_alarm_cnt_cck;
   5577 		rx_sens_p->last_false_alarm_cnt_cck += cck_fa;
   5578 	}
   5579 
   5580 	/* accumulate bad plcp */
   5581 	if (rx_sens_p->last_bad_plcp_cnt_cck > cck_bp) {
   5582 		temp = rx_sens_p->last_bad_plcp_cnt_cck;
   5583 		rx_sens_p->last_bad_plcp_cnt_cck = cck_bp;
   5584 		cck_bp += (0xFFFFFFFF - temp);
   5585 	} else {
   5586 		cck_bp -= rx_sens_p->last_bad_plcp_cnt_cck;
   5587 		rx_sens_p->last_bad_plcp_cnt_cck += cck_bp;
   5588 	}
   5589 
   5590 	/*
   5591 	 * calculate relative value
   5592 	 */
   5593 	cck_sum_fa_bp = (cck_fa + cck_bp) * 200 * 1024;
   5594 	rx_sens_p->cck_noise_diff = 0;
   5595 
   5596 	noise_a =
   5597 	    (uint8_t)((LE_32(rx_general_p->beacon_silence_rssi_a) & 0xFF00) >>
   5598 	    8);
   5599 	noise_b =
   5600 	    (uint8_t)((LE_32(rx_general_p->beacon_silence_rssi_b) & 0xFF00) >>
   5601 	    8);
   5602 	noise_c =
   5603 	    (uint8_t)((LE_32(rx_general_p->beacon_silence_rssi_c) & 0xFF00) >>
   5604 	    8);
   5605 
   5606 	beacon_a = LE_32(rx_general_p->beacon_energy_a);
   5607 	beacon_b = LE_32(rx_general_p->beacon_energy_b);
   5608 	beacon_c = LE_32(rx_general_p->beacon_energy_c);
   5609 
   5610 	/* determine maximum noise among 3 chains */
   5611 	if ((noise_a >= noise_b) && (noise_a >= noise_c)) {
   5612 		max_noise_abc = noise_a;
   5613 	} else if (noise_b >= noise_c) {
   5614 		max_noise_abc = noise_b;
   5615 	} else {
   5616 		max_noise_abc = noise_c;
   5617 	}
   5618 
   5619 	/* record maximum noise among 3 chains */
   5620 	rx_sens_p->cck_noise_max[rx_sens_p->cck_noise_idx] = max_noise_abc;
   5621 	rx_sens_p->cck_noise_idx++;
   5622 	if (rx_sens_p->cck_noise_idx >= 20) {
   5623 		rx_sens_p->cck_noise_idx = 0;
   5624 	}
   5625 
   5626 	/* determine maximum noise among 20 max noise */
   5627 	max_noise_20 = rx_sens_p->cck_noise_max[0];
   5628 	for (i = 0; i < 20; i++) {
   5629 		if (rx_sens_p->cck_noise_max[i] >= max_noise_20) {
   5630 			max_noise_20 = rx_sens_p->cck_noise_max[i];
   5631 		}
   5632 	}
   5633 
   5634 	/* determine minimum beacon among 3 chains */
   5635 	if ((beacon_a <= beacon_b) && (beacon_a <= beacon_c)) {
   5636 		min_beacon_abc = beacon_a;
   5637 	} else if (beacon_b <= beacon_c) {
   5638 		min_beacon_abc = beacon_b;
   5639 	} else {
   5640 		min_beacon_abc = beacon_c;
   5641 	}
   5642 
   5643 	/* record miminum beacon among 3 chains */
   5644 	rx_sens_p->cck_beacon_min[rx_sens_p->cck_beacon_idx] = min_beacon_abc;
   5645 	rx_sens_p->cck_beacon_idx++;
   5646 	if (rx_sens_p->cck_beacon_idx >= 10) {
   5647 		rx_sens_p->cck_beacon_idx = 0;
   5648 	}
   5649 
   5650 	/* determine maximum beacon among 10 miminum beacon among 3 chains */
   5651 	max_beacon_10 = rx_sens_p->cck_beacon_min[0];
   5652 	for (i = 0; i < 10; i++) {
   5653 		if (rx_sens_p->cck_beacon_min[i] >= max_beacon_10) {
   5654 			max_beacon_10 = rx_sens_p->cck_beacon_min[i];
   5655 		}
   5656 	}
   5657 
   5658 	/* add a little margin */
   5659 	max_beacon_10 += 6;
   5660 
   5661 	/* record the count of having no false alarms */
   5662 	if (cck_sum_fa_bp < (5 * actual_rx_time)) {
   5663 		rx_sens_p->cck_no_false_alarm_num++;
   5664 	} else {
   5665 		rx_sens_p->cck_no_false_alarm_num = 0;
   5666 	}
   5667 
   5668 	/*
   5669 	 * adjust parameters in sensitivity command
   5670 	 * according to different status.
   5671 	 * for more infomation, please refer to iwk_calibration.h file
   5672 	 */
   5673 	if (cck_sum_fa_bp > (50 * actual_rx_time)) {
   5674 		rx_sens_p->cck_curr_state = IWK_TOO_MANY_FALSE_ALARM;
   5675 
   5676 		if (rx_sens_p->auto_corr_cck_x4 > 160) {
   5677 			rx_sens_p->cck_noise_ref = max_noise_20;
   5678 
   5679 			if (rx_sens_p->min_energy_det_cck > 2) {
   5680 				rx_sens_p->min_energy_det_cck -= 2;
   5681 			}
   5682 		}
   5683 
   5684 		if (rx_sens_p->auto_corr_cck_x4 < 160) {
   5685 			rx_sens_p->auto_corr_cck_x4 = 160 + 1;
   5686 		} else {
   5687 			if ((rx_sens_p->auto_corr_cck_x4 + 3) < 200) {
   5688 				rx_sens_p->auto_corr_cck_x4 += 3;
   5689 			} else {
   5690 				rx_sens_p->auto_corr_cck_x4 = 200;
   5691 			}
   5692 		}
   5693 
   5694 		if ((rx_sens_p->auto_corr_mrc_cck_x4 + 3) < 400) {
   5695 			rx_sens_p->auto_corr_mrc_cck_x4 += 3;
   5696 		} else {
   5697 			rx_sens_p->auto_corr_mrc_cck_x4 = 400;
   5698 		}
   5699 
   5700 		rx_sens_p->flags |= IWK_SENSITIVITY_CCK_UPDATE_MSK;
   5701 
   5702 	} else if (cck_sum_fa_bp < (5 * actual_rx_time)) {
   5703 		rx_sens_p->cck_curr_state = IWK_TOO_FEW_FALSE_ALARM;
   5704 
   5705 		rx_sens_p->cck_noise_diff = (int32_t)rx_sens_p->cck_noise_ref -
   5706 		    (int32_t)max_noise_20;
   5707 
   5708 		if ((rx_sens_p->cck_prev_state != IWK_TOO_MANY_FALSE_ALARM) &&
   5709 		    ((rx_sens_p->cck_noise_diff > 2) ||
   5710 		    (rx_sens_p->cck_no_false_alarm_num > 100))) {
   5711 			if ((rx_sens_p->min_energy_det_cck + 2) < 97) {
   5712 				rx_sens_p->min_energy_det_cck += 2;
   5713 			} else {
   5714 				rx_sens_p->min_energy_det_cck = 97;
   5715 			}
   5716 
   5717 			if ((rx_sens_p->auto_corr_cck_x4 - 3) > 125) {
   5718 				rx_sens_p->auto_corr_cck_x4 -= 3;
   5719 			} else {
   5720 				rx_sens_p->auto_corr_cck_x4 = 125;
   5721 			}
   5722 
   5723 			if ((rx_sens_p->auto_corr_mrc_cck_x4 -3) > 200) {
   5724 				rx_sens_p->auto_corr_mrc_cck_x4 -= 3;
   5725 			} else {
   5726 				rx_sens_p->auto_corr_mrc_cck_x4 = 200;
   5727 			}
   5728 
   5729 			rx_sens_p->flags |= IWK_SENSITIVITY_CCK_UPDATE_MSK;
   5730 		} else {
   5731 			rx_sens_p->flags &= (~IWK_SENSITIVITY_CCK_UPDATE_MSK);
   5732 		}
   5733 	} else {
   5734 		rx_sens_p->cck_curr_state = IWK_GOOD_RANGE_FALSE_ALARM;
   5735 
   5736 		rx_sens_p->cck_noise_ref = max_noise_20;
   5737 
   5738 		if (IWK_TOO_MANY_FALSE_ALARM == rx_sens_p->cck_prev_state) {
   5739 			rx_sens_p->min_energy_det_cck -= 8;
   5740 		}
   5741 
   5742 		rx_sens_p->flags &= (~IWK_SENSITIVITY_CCK_UPDATE_MSK);
   5743 	}
   5744 
   5745 	if (rx_sens_p->min_energy_det_cck < max_beacon_10) {
   5746 		rx_sens_p->min_energy_det_cck = (uint16_t)max_beacon_10;
   5747 	}
   5748 
   5749 	rx_sens_p->cck_prev_state = rx_sens_p->cck_curr_state;
   5750 
   5751 	return (IWK_SUCCESS);
   5752 }
   5753 
   5754 /*
   5755  * make Rx sensitivity calibration for OFDM mode.
   5756  * This is preparing parameters for Sensitivity command
   5757  */
   5758 static int iwk_ofdm_sens(iwk_sc_t *sc, uint32_t actual_rx_time)
   5759 {
   5760 	uint32_t temp;
   5761 	uint16_t temp1;
   5762 	uint32_t ofdm_fa, ofdm_bp;
   5763 	uint32_t ofdm_sum_fa_bp;
   5764 	struct iwk_rx_sensitivity *rx_sens_p = &sc->sc_rx_sens;
   5765 
   5766 	ofdm_fa = LE_32(sc->sc_statistics.rx.ofdm.false_alarm_cnt);
   5767 	ofdm_bp = LE_32(sc->sc_statistics.rx.ofdm.plcp_err);
   5768 
   5769 	/* accumulate false alarm */
   5770 	if (rx_sens_p->last_false_alarm_cnt_ofdm > ofdm_fa) {
   5771 		temp = rx_sens_p->last_false_alarm_cnt_ofdm;
   5772 		rx_sens_p->last_false_alarm_cnt_ofdm = ofdm_fa;
   5773 		ofdm_fa += (0xFFFFFFFF - temp);
   5774 	} else {
   5775 		ofdm_fa -= rx_sens_p->last_false_alarm_cnt_ofdm;
   5776 		rx_sens_p->last_false_alarm_cnt_ofdm += ofdm_fa;
   5777 	}
   5778 
   5779 	/* accumulate bad plcp */
   5780 	if (rx_sens_p->last_bad_plcp_cnt_ofdm > ofdm_bp) {
   5781 		temp = rx_sens_p->last_bad_plcp_cnt_ofdm;
   5782 		rx_sens_p->last_bad_plcp_cnt_ofdm = ofdm_bp;
   5783 		ofdm_bp += (0xFFFFFFFF - temp);
   5784 	} else {
   5785 		ofdm_bp -= rx_sens_p->last_bad_plcp_cnt_ofdm;
   5786 		rx_sens_p->last_bad_plcp_cnt_ofdm += ofdm_bp;
   5787 	}
   5788 
   5789 	ofdm_sum_fa_bp = (ofdm_fa + ofdm_bp) * 200 * 1024; /* relative value */
   5790 
   5791 	/*
   5792 	 * adjust parameter in sensitivity command according to different status
   5793 	 */
   5794 	if (ofdm_sum_fa_bp > (50 * actual_rx_time)) {
   5795 		temp1 = rx_sens_p->auto_corr_ofdm_x4 + 1;
   5796 		rx_sens_p->auto_corr_ofdm_x4 = (temp1 <= 120) ? temp1 : 120;
   5797 
   5798 		temp1 = rx_sens_p->auto_corr_mrc_ofdm_x4 + 1;
   5799 		rx_sens_p->auto_corr_mrc_ofdm_x4 =
   5800 		    (temp1 <= 210) ? temp1 : 210;
   5801 
   5802 		temp1 = rx_sens_p->auto_corr_ofdm_x1 + 1;
   5803 		rx_sens_p->auto_corr_ofdm_x1 = (temp1 <= 140) ? temp1 : 140;
   5804 
   5805 		temp1 = rx_sens_p->auto_corr_mrc_ofdm_x1 + 1;
   5806 		rx_sens_p->auto_corr_mrc_ofdm_x1 =
   5807 		    (temp1 <= 270) ? temp1 : 270;
   5808 
   5809 		rx_sens_p->flags |= IWK_SENSITIVITY_OFDM_UPDATE_MSK;
   5810 
   5811 	} else if (ofdm_sum_fa_bp < (5 * actual_rx_time)) {
   5812 		temp1 = rx_sens_p->auto_corr_ofdm_x4 - 1;
   5813 		rx_sens_p->auto_corr_ofdm_x4 = (temp1 >= 85) ? temp1 : 85;
   5814 
   5815 		temp1 = rx_sens_p->auto_corr_mrc_ofdm_x4 - 1;
   5816 		rx_sens_p->auto_corr_mrc_ofdm_x4 =
   5817 		    (temp1 >= 170) ? temp1 : 170;
   5818 
   5819 		temp1 = rx_sens_p->auto_corr_ofdm_x1 - 1;
   5820 		rx_sens_p->auto_corr_ofdm_x1 = (temp1 >= 105) ? temp1 : 105;
   5821 
   5822 		temp1 = rx_sens_p->auto_corr_mrc_ofdm_x1 - 1;
   5823 		rx_sens_p->auto_corr_mrc_ofdm_x1 =
   5824 		    (temp1 >= 220) ? temp1 : 220;
   5825 
   5826 		rx_sens_p->flags |= IWK_SENSITIVITY_OFDM_UPDATE_MSK;
   5827 
   5828 	} else {
   5829 		rx_sens_p->flags &= (~IWK_SENSITIVITY_OFDM_UPDATE_MSK);
   5830 	}
   5831 
   5832 	return (IWK_SUCCESS);
   5833 }
   5834 
   5835 /*
   5836  * additional process to management frames
   5837  */
   5838 static void iwk_recv_mgmt(struct ieee80211com *ic, mblk_t *mp,
   5839     struct ieee80211_node *in,
   5840     int subtype, int rssi, uint32_t rstamp)
   5841 {
   5842 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   5843 	struct ieee80211_frame *wh;
   5844 	uint8_t index1, index2;
   5845 	int err;
   5846 
   5847 	sc->sc_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
   5848 
   5849 	mutex_enter(&sc->sc_glock);
   5850 	switch (subtype) {
   5851 	case IEEE80211_FC0_SUBTYPE_BEACON:
   5852 		if (sc->sc_ibss.ibss_beacon.syncbeacon && in == ic->ic_bss &&
   5853 		    ic->ic_state == IEEE80211_S_RUN) {
   5854 			if (ieee80211_beacon_update(ic, in,
   5855 			    &sc->sc_ibss.ibss_beacon.iwk_boff,
   5856 			    sc->sc_ibss.ibss_beacon.mp, 0)) {
   5857 				bcopy(sc->sc_ibss.ibss_beacon.mp->b_rptr,
   5858 				    sc->sc_ibss.ibss_beacon.beacon_cmd.
   5859 				    bcon_frame,
   5860 				    MBLKL(sc->sc_ibss.ibss_beacon.mp));
   5861 			}
   5862 			err = iwk_cmd(sc, REPLY_TX_BEACON,
   5863 			    &sc->sc_ibss.ibss_beacon.beacon_cmd,
   5864 			    sc->sc_ibss.ibss_beacon.beacon_cmd_len, 1);
   5865 			if (err != IWK_SUCCESS) {
   5866 				cmn_err(CE_WARN, "iwk_recv_mgmt(): "
   5867 				    "failed to TX beacon.\n");
   5868 			}
   5869 			sc->sc_ibss.ibss_beacon.syncbeacon = 0;
   5870 		}
   5871 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
   5872 		    ic->ic_state == IEEE80211_S_RUN) {
   5873 			wh = (struct ieee80211_frame *)mp->b_rptr;
   5874 			mutex_enter(&sc->sc_ibss.node_tb_lock);
   5875 			/*
   5876 			 * search for node in ibss node table
   5877 			 */
   5878 			for (index1 = IWK_STA_ID; index1 < IWK_STATION_COUNT;
   5879 			    index1++) {
   5880 				if (sc->sc_ibss.ibss_node_tb[index1].used &&
   5881 				    IEEE80211_ADDR_EQ(sc->sc_ibss.
   5882 				    ibss_node_tb[index1].node.bssid,
   5883 				    wh->i_addr2)) {
   5884 					break;
   5885 				}
   5886 			}
   5887 			/*
   5888 			 * if don't find in ibss node table
   5889 			 */
   5890 			if (index1 >= IWK_BROADCAST_ID) {
   5891 				err = iwk_clean_add_node_ibss(ic,
   5892 				    wh->i_addr2, &index2);
   5893 				if (err != IWK_SUCCESS) {
   5894 					cmn_err(CE_WARN, "iwk_recv_mgmt(): "
   5895 					    "failed to clean all nodes "
   5896 					    "and add one node\n");
   5897 				}
   5898 			}
   5899 			mutex_exit(&sc->sc_ibss.node_tb_lock);
   5900 		}
   5901 		break;
   5902 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
   5903 		break;
   5904 	}
   5905 	mutex_exit(&sc->sc_glock);
   5906 }
   5907 
   5908 /*
   5909  * 1)  log_event_table_ptr indicates base of the event log.  This traces
   5910  *     a 256-entry history of uCode execution within a circular buffer.
   5911  *     Its header format is:
   5912  *
   5913  *	uint32_t log_size;	log capacity (in number of entries)
   5914  *	uint32_t type;	(1) timestamp with each entry, (0) no timestamp
   5915  *	uint32_t wraps;	# times uCode has wrapped to top of circular buffer
   5916  *      uint32_t write_index;	next circular buffer entry that uCode would fill
   5917  *
   5918  *     The header is followed by the circular buffer of log entries.  Entries
   5919  *     with timestamps have the following format:
   5920  *
   5921  *	uint32_t event_id;     range 0 - 1500
   5922  *	uint32_t timestamp;    low 32 bits of TSF (of network, if associated)
   5923  *	uint32_t data;         event_id-specific data value
   5924  *
   5925  *     Entries without timestamps contain only event_id and data.
   5926  */
   5927 
   5928 /*
   5929  * iwk_write_event_log - Write event log to dmesg
   5930  */
   5931 static void iwk_write_event_log(iwk_sc_t *sc)
   5932 {
   5933 	uint32_t log_event_table_ptr;	/* Start address of event table */
   5934 	uint32_t startptr;	/* Start address of log data */
   5935 	uint32_t logptr;	/* address of log data entry */
   5936 	uint32_t i, n, num_events;
   5937 	uint32_t event_id, data1, data2; /* log data */
   5938 
   5939 	uint32_t log_size;   /* log capacity (in number of entries) */
   5940 	uint32_t type;	/* (1)timestamp with each entry,(0) no timestamp */
   5941 	uint32_t wraps;	/* # times uCode has wrapped to */
   5942 			/* the top of circular buffer */
   5943 	uint32_t idx; /* index of entry to be filled in next */
   5944 
   5945 	log_event_table_ptr = LE_32(sc->sc_card_alive_run.log_event_table_ptr);
   5946 	if (!(log_event_table_ptr)) {
   5947 		IWK_DBG((IWK_DEBUG_EEPROM, "NULL event table pointer\n"));
   5948 		return;
   5949 	}
   5950 
   5951 	iwk_mac_access_enter(sc);
   5952 
   5953 	/* Read log header */
   5954 	log_size = iwk_mem_read(sc, log_event_table_ptr);
   5955 	log_event_table_ptr += sizeof (uint32_t); /* addr of "type" */
   5956 	type = iwk_mem_read(sc, log_event_table_ptr);
   5957 	log_event_table_ptr += sizeof (uint32_t); /* addr of "wraps" */
   5958 	wraps = iwk_mem_read(sc, log_event_table_ptr);
   5959 	log_event_table_ptr += sizeof (uint32_t); /* addr of "idx" */
   5960 	idx = iwk_mem_read(sc, log_event_table_ptr);
   5961 	startptr = log_event_table_ptr +
   5962 	    sizeof (uint32_t); /* addr of start of log data */
   5963 	if (!log_size & !wraps) {
   5964 		IWK_DBG((IWK_DEBUG_EEPROM, "Empty log\n"));
   5965 		iwk_mac_access_exit(sc);
   5966 		return;
   5967 	}
   5968 
   5969 	if (!wraps) {
   5970 		num_events = idx;
   5971 		logptr = startptr;
   5972 	} else {
   5973 		num_events = log_size - idx;
   5974 		n = type ? 2 : 3;
   5975 		logptr = startptr + (idx * n * sizeof (uint32_t));
   5976 	}
   5977 
   5978 	for (i = 0; i < num_events; i++) {
   5979 		event_id = iwk_mem_read(sc, logptr);
   5980 		logptr += sizeof (uint32_t);
   5981 		data1 = iwk_mem_read(sc, logptr);
   5982 		logptr += sizeof (uint32_t);
   5983 		if (type == 0) { /* no timestamp */
   5984 			IWK_DBG((IWK_DEBUG_EEPROM, "Event ID=%d, Data=%x0x",
   5985 			    event_id, data1));
   5986 		} else { /* timestamp */
   5987 			data2 = iwk_mem_read(sc, logptr);
   5988 			IWK_DBG((IWK_DEBUG_EEPROM,
   5989 			    "Time=%d, Event ID=%d, Data=0x%x\n",
   5990 			    data1, event_id, data2));
   5991 			logptr += sizeof (uint32_t);
   5992 		}
   5993 	}
   5994 
   5995 	/*
   5996 	 * Print the wrapped around entries, if any
   5997 	 */
   5998 	if (wraps) {
   5999 		logptr = startptr;
   6000 		for (i = 0; i < idx; i++) {
   6001 			event_id = iwk_mem_read(sc, logptr);
   6002 			logptr += sizeof (uint32_t);
   6003 			data1 = iwk_mem_read(sc, logptr);
   6004 			logptr += sizeof (uint32_t);
   6005 			if (type == 0) { /* no timestamp */
   6006 				IWK_DBG((IWK_DEBUG_EEPROM,
   6007 				    "Event ID=%d, Data=%x0x", event_id, data1));
   6008 			} else { /* timestamp */
   6009 				data2 = iwk_mem_read(sc, logptr);
   6010 				IWK_DBG((IWK_DEBUG_EEPROM,
   6011 				    "Time = %d, Event ID=%d, Data=0x%x\n",
   6012 				    data1, event_id, data2));
   6013 				logptr += sizeof (uint32_t);
   6014 			}
   6015 		}
   6016 	}
   6017 
   6018 	iwk_mac_access_exit(sc);
   6019 }
   6020 
   6021 /*
   6022  * error_event_table_ptr indicates base of the error log.  This contains
   6023  * information about any uCode error that occurs.  For 4965, the format is:
   6024  *
   6025  * uint32_t valid;        (nonzero) valid, (0) log is empty
   6026  * uint32_t error_id;     type of error
   6027  * uint32_t pc;           program counter
   6028  * uint32_t blink1;       branch link
   6029  * uint32_t blink2;       branch link
   6030  * uint32_t ilink1;       interrupt link
   6031  * uint32_t ilink2;       interrupt link
   6032  * uint32_t data1;        error-specific data
   6033  * uint32_t data2;        error-specific data
   6034  * uint32_t line;         source code line of error
   6035  * uint32_t bcon_time;    beacon timer
   6036  * uint32_t tsf_low;      network timestamp function timer
   6037  * uint32_t tsf_hi;       network timestamp function timer
   6038  */
   6039 /*
   6040  * iwk_write_error_log - Write error log to dmesg
   6041  */
   6042 static void iwk_write_error_log(iwk_sc_t *sc)
   6043 {
   6044 	uint32_t err_ptr;	/* Start address of error log */
   6045 	uint32_t valid;		/* is error log valid */
   6046 
   6047 	err_ptr = LE_32(sc->sc_card_alive_run.error_event_table_ptr);
   6048 	if (!(err_ptr)) {
   6049 		IWK_DBG((IWK_DEBUG_EEPROM, "NULL error table pointer\n"));
   6050 		return;
   6051 	}
   6052 
   6053 	iwk_mac_access_enter(sc);
   6054 
   6055 	valid = iwk_mem_read(sc, err_ptr);
   6056 	if (!(valid)) {
   6057 		IWK_DBG((IWK_DEBUG_EEPROM, "Error data not valid\n"));
   6058 		iwk_mac_access_exit(sc);
   6059 		return;
   6060 	}
   6061 	err_ptr += sizeof (uint32_t);
   6062 	IWK_DBG((IWK_DEBUG_EEPROM, "err=%d ", iwk_mem_read(sc, err_ptr)));
   6063 	err_ptr += sizeof (uint32_t);
   6064 	IWK_DBG((IWK_DEBUG_EEPROM, "pc=0x%X ", iwk_mem_read(sc, err_ptr)));
   6065 	err_ptr += sizeof (uint32_t);
   6066 	IWK_DBG((IWK_DEBUG_EEPROM,
   6067 	    "branch link1=0x%X ", iwk_mem_read(sc, err_ptr)));
   6068 	err_ptr += sizeof (uint32_t);
   6069 	IWK_DBG((IWK_DEBUG_EEPROM,
   6070 	    "branch link2=0x%X ", iwk_mem_read(sc, err_ptr)));
   6071 	err_ptr += sizeof (uint32_t);
   6072 	IWK_DBG((IWK_DEBUG_EEPROM,
   6073 	    "interrupt link1=0x%X ", iwk_mem_read(sc, err_ptr)));
   6074 	err_ptr += sizeof (uint32_t);
   6075 	IWK_DBG((IWK_DEBUG_EEPROM,
   6076 	    "interrupt link2=0x%X ", iwk_mem_read(sc, err_ptr)));
   6077 	err_ptr += sizeof (uint32_t);
   6078 	IWK_DBG((IWK_DEBUG_EEPROM, "data1=0x%X ", iwk_mem_read(sc, err_ptr)));
   6079 	err_ptr += sizeof (uint32_t);
   6080 	IWK_DBG((IWK_DEBUG_EEPROM, "data2=0x%X ", iwk_mem_read(sc, err_ptr)));
   6081 	err_ptr += sizeof (uint32_t);
   6082 	IWK_DBG((IWK_DEBUG_EEPROM, "line=%d ", iwk_mem_read(sc, err_ptr)));
   6083 	err_ptr += sizeof (uint32_t);
   6084 	IWK_DBG((IWK_DEBUG_EEPROM, "bcon_time=%d ", iwk_mem_read(sc, err_ptr)));
   6085 	err_ptr += sizeof (uint32_t);
   6086 	IWK_DBG((IWK_DEBUG_EEPROM, "tsf_low=%d ", iwk_mem_read(sc, err_ptr)));
   6087 	err_ptr += sizeof (uint32_t);
   6088 	IWK_DBG((IWK_DEBUG_EEPROM, "tsf_hi=%d\n", iwk_mem_read(sc, err_ptr)));
   6089 
   6090 	iwk_mac_access_exit(sc);
   6091 }
   6092 
   6093 static int
   6094 iwk_run_state_config_ibss(ieee80211com_t *ic)
   6095 {
   6096 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   6097 	ieee80211_node_t *in = ic->ic_bss;
   6098 	int i, err = IWK_SUCCESS;
   6099 
   6100 	mutex_enter(&sc->sc_ibss.node_tb_lock);
   6101 
   6102 	/*
   6103 	 * clean all nodes in ibss node table assure be
   6104 	 * consistent with hardware
   6105 	 */
   6106 	for (i = IWK_STA_ID; i < IWK_STATION_COUNT; i++) {
   6107 		sc->sc_ibss.ibss_node_tb[i].used = 0;
   6108 		(void) memset(&sc->sc_ibss.ibss_node_tb[i].node,
   6109 		    0,
   6110 		    sizeof (iwk_add_sta_t));
   6111 	}
   6112 
   6113 	sc->sc_ibss.node_number = 0;
   6114 
   6115 	mutex_exit(&sc->sc_ibss.node_tb_lock);
   6116 
   6117 	/*
   6118 	 * configure RX and TX
   6119 	 */
   6120 	sc->sc_config.dev_type = RXON_DEV_TYPE_IBSS;
   6121 
   6122 	sc->sc_config.flags |= LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   6123 	sc->sc_config.filter_flags =
   6124 	    LE_32(RXON_FILTER_ACCEPT_GRP_MSK |
   6125 	    RXON_FILTER_DIS_DECRYPT_MSK |
   6126 	    RXON_FILTER_DIS_GRP_DECRYPT_MSK);
   6127 
   6128 	sc->sc_config.assoc_id = 0;
   6129 
   6130 	IEEE80211_ADDR_COPY(sc->sc_config.bssid, in->in_bssid);
   6131 	sc->sc_config.chan = LE_16(ieee80211_chan2ieee(ic,
   6132 	    in->in_chan));
   6133 
   6134 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
   6135 		sc->sc_config.cck_basic_rates = 0x03;
   6136 		sc->sc_config.ofdm_basic_rates = 0;
   6137 	} else if ((in->in_chan != IEEE80211_CHAN_ANYC) &&
   6138 	    (IEEE80211_IS_CHAN_5GHZ(in->in_chan))) {
   6139 		sc->sc_config.cck_basic_rates = 0;
   6140 		sc->sc_config.ofdm_basic_rates = 0x15;
   6141 
   6142 	} else {
   6143 		sc->sc_config.cck_basic_rates = 0x0f;
   6144 		sc->sc_config.ofdm_basic_rates = 0xff;
   6145 	}
   6146 
   6147 	sc->sc_config.flags &=
   6148 	    ~LE_32(RXON_FLG_SHORT_PREAMBLE_MSK |
   6149 	    RXON_FLG_SHORT_SLOT_MSK);
   6150 
   6151 	if (ic->ic_flags & IEEE80211_F_SHSLOT) {
   6152 		sc->sc_config.flags |=
   6153 		    LE_32(RXON_FLG_SHORT_SLOT_MSK);
   6154 	}
   6155 
   6156 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
   6157 		sc->sc_config.flags |=
   6158 		    LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   6159 	}
   6160 
   6161 	sc->sc_config.filter_flags |=
   6162 	    LE_32(RXON_FILTER_ASSOC_MSK);
   6163 
   6164 	err = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   6165 	    sizeof (iwk_rxon_cmd_t), 1);
   6166 	if (err != IWK_SUCCESS) {
   6167 		cmn_err(CE_WARN, "iwk_run_state_config_ibss(): "
   6168 		    "failed to update configuration.\n");
   6169 		return (err);
   6170 	}
   6171 
   6172 	return (err);
   6173 
   6174 }
   6175 
   6176 static int
   6177 iwk_run_state_config_sta(ieee80211com_t *ic)
   6178 {
   6179 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   6180 	ieee80211_node_t *in = ic->ic_bss;
   6181 	int err = IWK_SUCCESS;
   6182 
   6183 	/* update adapter's configuration */
   6184 	if (sc->sc_assoc_id != in->in_associd) {
   6185 		cmn_err(CE_WARN, "iwk_run_state_config_sta(): "
   6186 		    "associate ID mismatch: expected %d, "
   6187 		    "got %d\n",
   6188 		    in->in_associd, sc->sc_assoc_id);
   6189 	}
   6190 	sc->sc_config.assoc_id = LE_16(in->in_associd & 0x3fff);
   6191 
   6192 	/*
   6193 	 * short preamble/slot time are
   6194 	 * negotiated when associating
   6195 	 */
   6196 	sc->sc_config.flags &=
   6197 	    ~LE_32(RXON_FLG_SHORT_PREAMBLE_MSK |
   6198 	    RXON_FLG_SHORT_SLOT_MSK);
   6199 
   6200 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
   6201 		sc->sc_config.flags |=
   6202 		    LE_32(RXON_FLG_SHORT_SLOT_MSK);
   6203 
   6204 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
   6205 		sc->sc_config.flags |=
   6206 		    LE_32(RXON_FLG_SHORT_PREAMBLE_MSK);
   6207 
   6208 	sc->sc_config.filter_flags |=
   6209 	    LE_32(RXON_FILTER_ASSOC_MSK);
   6210 
   6211 	if (ic->ic_opmode != IEEE80211_M_STA)
   6212 		sc->sc_config.filter_flags |=
   6213 		    LE_32(RXON_FILTER_BCON_AWARE_MSK);
   6214 
   6215 	IWK_DBG((IWK_DEBUG_80211, "config chan %d flags %x"
   6216 	    " filter_flags %x\n",
   6217 	    sc->sc_config.chan, sc->sc_config.flags,
   6218 	    sc->sc_config.filter_flags));
   6219 
   6220 	err = iwk_cmd(sc, REPLY_RXON, &sc->sc_config,
   6221 	    sizeof (iwk_rxon_cmd_t), 1);
   6222 	if (err != IWK_SUCCESS) {
   6223 		cmn_err(CE_WARN, "iwk_run_state_config_sta(): "
   6224 		    "failed to update configuration\n");
   6225 		return (err);
   6226 	}
   6227 
   6228 	return (err);
   6229 }
   6230 
   6231 static int
   6232 iwk_fast_recover(iwk_sc_t *sc)
   6233 {
   6234 	ieee80211com_t *ic = &sc->sc_ic;
   6235 	int err;
   6236 
   6237 	mutex_enter(&sc->sc_glock);
   6238 
   6239 	/* restore runtime configuration */
   6240 	bcopy(&sc->sc_config_save, &sc->sc_config,
   6241 	    sizeof (sc->sc_config));
   6242 
   6243 	/* reset state to handle reassociations correctly */
   6244 	sc->sc_config.assoc_id = 0;
   6245 	sc->sc_config.filter_flags &=
   6246 	    ~LE_32(RXON_FILTER_ASSOC_MSK);
   6247 
   6248 	if ((err = iwk_hw_set_before_auth(sc)) != 0) {
   6249 		cmn_err(CE_WARN, "iwk_fast_recover(): "
   6250 		    "failed to setup authentication\n");
   6251 		mutex_exit(&sc->sc_glock);
   6252 		return (err);
   6253 	}
   6254 
   6255 	bcopy(&sc->sc_config_save, &sc->sc_config,
   6256 	    sizeof (sc->sc_config));
   6257 
   6258 	/* update adapter's configuration */
   6259 	err = iwk_run_state_config_sta(ic);
   6260 	if (err != IWK_SUCCESS) {
   6261 		cmn_err(CE_WARN, "iwk_fast_recover(): "
   6262 		    "failed to setup association\n");
   6263 		mutex_exit(&sc->sc_glock);
   6264 		return (err);
   6265 	}
   6266 
   6267 	/* obtain current temperature of chipset */
   6268 	sc->sc_tempera = iwk_curr_tempera(sc);
   6269 
   6270 	/*
   6271 	 * make Tx power calibration to determine
   6272 	 * the gains of DSP and radio
   6273 	 */
   6274 	err = iwk_tx_power_calibration(sc);
   6275 	if (err) {
   6276 		cmn_err(CE_WARN, "iwk_fast_recover(): "
   6277 		    "failed to set tx power table\n");
   6278 		mutex_exit(&sc->sc_glock);
   6279 		return (err);
   6280 	}
   6281 
   6282 	/*
   6283 	 * make initialization for Receiver
   6284 	 * sensitivity calibration
   6285 	 */
   6286 	err = iwk_rx_sens_init(sc);
   6287 	if (err) {
   6288 		cmn_err(CE_WARN, "iwk_fast_recover(): "
   6289 		    "failed to init RX sensitivity\n");
   6290 		mutex_exit(&sc->sc_glock);
   6291 		return (err);
   6292 	}
   6293 
   6294 	/* make initialization for Receiver gain balance */
   6295 	err = iwk_rxgain_diff_init(sc);
   6296 	if (err) {
   6297 		cmn_err(CE_WARN, "iwk_fast_recover(): "
   6298 		    "failed to init phy calibration\n");
   6299 		mutex_exit(&sc->sc_glock);
   6300 		return (err);
   6301 
   6302 	}
   6303 	/* set LED on */
   6304 	iwk_set_led(sc, 2, 0, 1);
   6305 
   6306 	mutex_exit(&sc->sc_glock);
   6307 
   6308 	/* update keys */
   6309 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
   6310 		for (int i = 0; i < IEEE80211_KEY_MAX; i++) {
   6311 			if (ic->ic_nw_keys[i].wk_keyix == IEEE80211_KEYIX_NONE)
   6312 				continue;
   6313 			err = iwk_key_set(ic, &ic->ic_nw_keys[i],
   6314 			    ic->ic_bss->in_macaddr);
   6315 			/* failure */
   6316 			if (err == 0) {
   6317 				cmn_err(CE_WARN, "iwk_fast_recover(): "
   6318 				    "failed to setup hardware keys\n");
   6319 				return (IWK_FAIL);
   6320 			}
   6321 		}
   6322 	}
   6323 
   6324 	sc->sc_flags &= ~IWK_F_HW_ERR_RECOVER;
   6325 
   6326 	/* start queue */
   6327 	IWK_DBG((IWK_DEBUG_FW, "iwk_fast_recover(): resume xmit\n"));
   6328 	mac_tx_update(ic->ic_mach);
   6329 
   6330 
   6331 	return (IWK_SUCCESS);
   6332 }
   6333 
   6334 static int
   6335 iwk_start_tx_beacon(ieee80211com_t *ic)
   6336 {
   6337 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   6338 	ieee80211_node_t *in = ic->ic_bss;
   6339 	int err = IWK_SUCCESS;
   6340 	iwk_tx_beacon_cmd_t  *tx_beacon_p;
   6341 	uint16_t  masks = 0;
   6342 	mblk_t *mp;
   6343 	int rate;
   6344 
   6345 	/*
   6346 	 * allocate and transmit beacon frames
   6347 	 */
   6348 	tx_beacon_p = &sc->sc_ibss.ibss_beacon.beacon_cmd;
   6349 
   6350 	(void) memset(tx_beacon_p, 0,
   6351 	    sizeof (iwk_tx_beacon_cmd_t));
   6352 	rate = 0;
   6353 	masks = 0;
   6354 
   6355 	tx_beacon_p->config.sta_id = IWK_BROADCAST_ID;
   6356 	tx_beacon_p->config.stop_time.life_time =
   6357 	    LE_32(0xffffffff);
   6358 
   6359 	if (sc->sc_ibss.ibss_beacon.mp != NULL) {
   6360 		freemsg(sc->sc_ibss.ibss_beacon.mp);
   6361 		sc->sc_ibss.ibss_beacon.mp = NULL;
   6362 	}
   6363 
   6364 	sc->sc_ibss.ibss_beacon.mp =
   6365 	    ieee80211_beacon_alloc(ic, in,
   6366 	    &sc->sc_ibss.ibss_beacon.iwk_boff);
   6367 	if (sc->sc_ibss.ibss_beacon.mp == NULL) {
   6368 		cmn_err(CE_WARN, "iwk_start_tx_beacon(): "
   6369 		    "failed to get beacon frame.\n");
   6370 		return (IWK_FAIL);
   6371 	}
   6372 
   6373 	mp = sc->sc_ibss.ibss_beacon.mp;
   6374 
   6375 	ASSERT(mp->b_cont == NULL);
   6376 
   6377 	bcopy(mp->b_rptr, tx_beacon_p->bcon_frame, MBLKL(mp));
   6378 
   6379 	tx_beacon_p->config.len = LE_16((uint16_t)(MBLKL(mp)));
   6380 	sc->sc_ibss.ibss_beacon.beacon_cmd_len =
   6381 	    sizeof (iwk_tx_cmd_t) +
   6382 	    4 + LE_16(tx_beacon_p->config.len);
   6383 
   6384 	/*
   6385 	 * beacons are sent at 1M
   6386 	 */
   6387 	rate = in->in_rates.ir_rates[0];
   6388 	rate &= IEEE80211_RATE_VAL;
   6389 
   6390 	if (2 == rate || 4 == rate || 11 == rate ||
   6391 	    22 == rate) {
   6392 		masks |= RATE_MCS_CCK_MSK;
   6393 	}
   6394 
   6395 	masks |= RATE_MCS_ANT_B_MSK;
   6396 
   6397 	tx_beacon_p->config.rate.r.rate_n_flags =
   6398 	    LE_32(iwk_rate_to_plcp(rate) | masks);
   6399 
   6400 
   6401 	tx_beacon_p->config.tx_flags =
   6402 	    LE_32(TX_CMD_FLG_SEQ_CTL_MSK | TX_CMD_FLG_TSF_MSK);
   6403 
   6404 	if (ic->ic_bss->in_tstamp.tsf != 0) {
   6405 		sc->sc_ibss.ibss_beacon.syncbeacon = 1;
   6406 	} else {
   6407 		if (ieee80211_beacon_update(ic, in,
   6408 		    &sc->sc_ibss.ibss_beacon.iwk_boff,
   6409 		    mp, 0)) {
   6410 			bcopy(mp->b_rptr,
   6411 			    tx_beacon_p->bcon_frame,
   6412 			    MBLKL(mp));
   6413 		}
   6414 
   6415 		err = iwk_cmd(sc, REPLY_TX_BEACON,
   6416 		    tx_beacon_p,
   6417 		    sc->sc_ibss.ibss_beacon.beacon_cmd_len,
   6418 		    1);
   6419 		if (err != IWK_SUCCESS) {
   6420 			cmn_err(CE_WARN, "iwk_start_tx_beacon(): "
   6421 			    "failed to TX beacon.\n");
   6422 			return (err);
   6423 		}
   6424 
   6425 		sc->sc_ibss.ibss_beacon.syncbeacon = 0;
   6426 	}
   6427 
   6428 	return (err);
   6429 }
   6430 
   6431 static int
   6432 iwk_clean_add_node_ibss(struct ieee80211com *ic,
   6433     uint8_t addr[IEEE80211_ADDR_LEN], uint8_t *index2)
   6434 {
   6435 	iwk_sc_t *sc = (iwk_sc_t *)ic;
   6436 	uint8_t	index;
   6437 	iwk_add_sta_t bc_node;
   6438 	iwk_link_quality_cmd_t bc_link_quality;
   6439 	iwk_link_quality_cmd_t link_quality;
   6440 	uint16_t  bc_masks = 0;
   6441 	uint16_t  masks = 0;
   6442 	int i, rate;
   6443 	struct ieee80211_rateset rs;
   6444 	iwk_ibss_node_t *ibss_node_p;
   6445 	int err = IWK_SUCCESS;
   6446 
   6447 	/*
   6448 	 * find a location that is not
   6449 	 * used in ibss node table
   6450 	 */
   6451 	for (index = IWK_STA_ID;
   6452 	    index < IWK_STATION_COUNT; index++) {
   6453 		if (!sc->sc_ibss.ibss_node_tb[index].used) {
   6454 			break;
   6455 		}
   6456 	}
   6457 
   6458 	/*
   6459 	 * if have too many nodes in hardware, clean up
   6460 	 */
   6461 	if (index < IWK_BROADCAST_ID &&
   6462 	    sc->sc_ibss.node_number >= 25) {
   6463 		if (iwk_cmd(sc, REPLY_REMOVE_ALL_STA,
   6464 		    NULL, 0, 1) != IWK_SUCCESS) {
   6465 			cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6466 			    "failed to remove all nodes in hardware\n");
   6467 			return (IWK_FAIL);
   6468 		}
   6469 
   6470 		for (i = IWK_STA_ID; i < IWK_STATION_COUNT; i++) {
   6471 			sc->sc_ibss.ibss_node_tb[i].used = 0;
   6472 			(void) memset(&sc->sc_ibss.ibss_node_tb[i].node,
   6473 			    0, sizeof (iwk_add_sta_t));
   6474 		}
   6475 
   6476 		sc->sc_ibss.node_number = 0;
   6477 
   6478 		/*
   6479 		 * add broadcast node so that we
   6480 		 * can send broadcast frame
   6481 		 */
   6482 		(void) memset(&bc_node, 0, sizeof (bc_node));
   6483 		(void) memset(bc_node.bssid, 0xff, 6);
   6484 		bc_node.id = IWK_BROADCAST_ID;
   6485 
   6486 		err = iwk_cmd(sc, REPLY_ADD_STA, &bc_node, sizeof (bc_node), 1);
   6487 		if (err != IWK_SUCCESS) {
   6488 		cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6489 		    "failed to add broadcast node\n");
   6490 		return (err);
   6491 		}
   6492 
   6493 		/* TX_LINK_QUALITY cmd */
   6494 		(void) memset(&bc_link_quality, 0, sizeof (bc_link_quality));
   6495 		for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
   6496 			bc_masks |= RATE_MCS_CCK_MSK;
   6497 			bc_masks |= RATE_MCS_ANT_B_MSK;
   6498 			bc_masks &= ~RATE_MCS_ANT_A_MSK;
   6499 			bc_link_quality.rate_n_flags[i] =
   6500 			    LE_32(iwk_rate_to_plcp(2) | bc_masks);
   6501 		}
   6502 
   6503 		bc_link_quality.general_params.single_stream_ant_msk = 2;
   6504 		bc_link_quality.general_params.dual_stream_ant_msk = 3;
   6505 		bc_link_quality.agg_params.agg_dis_start_th = 3;
   6506 		bc_link_quality.agg_params.agg_time_limit = LE_16(4000);
   6507 		bc_link_quality.sta_id = IWK_BROADCAST_ID;
   6508 
   6509 		err = iwk_cmd(sc, REPLY_TX_LINK_QUALITY_CMD,
   6510 		    &bc_link_quality, sizeof (bc_link_quality), 1);
   6511 		if (err != IWK_SUCCESS) {
   6512 			cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6513 			    "failed to config link quality table\n");
   6514 			return (err);
   6515 		}
   6516 	}
   6517 
   6518 	if (index >= IWK_BROADCAST_ID) {
   6519 		cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6520 		    "the count of node in hardware is too much\n");
   6521 		return (IWK_FAIL);
   6522 	}
   6523 
   6524 	/*
   6525 	 * add a node into hardware
   6526 	 */
   6527 	ibss_node_p = &sc->sc_ibss.ibss_node_tb[index];
   6528 
   6529 	ibss_node_p->used = 1;
   6530 
   6531 	(void) memset(&ibss_node_p->node, 0,
   6532 	    sizeof (iwk_add_sta_t));
   6533 
   6534 	IEEE80211_ADDR_COPY(ibss_node_p->node.bssid, addr);
   6535 	ibss_node_p->node.id = index;
   6536 	ibss_node_p->node.control = 0;
   6537 	ibss_node_p->node.flags = 0;
   6538 
   6539 	err = iwk_cmd(sc, REPLY_ADD_STA, &ibss_node_p->node,
   6540 	    sizeof (iwk_add_sta_t), 1);
   6541 	if (err != IWK_SUCCESS) {
   6542 		cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6543 		    "failed to add IBSS node\n");
   6544 		ibss_node_p->used = 0;
   6545 		(void) memset(&ibss_node_p->node, 0,
   6546 		    sizeof (iwk_add_sta_t));
   6547 		return (err);
   6548 	}
   6549 
   6550 	sc->sc_ibss.node_number++;
   6551 
   6552 	(void) memset(&link_quality, 0, sizeof (link_quality));
   6553 
   6554 	rs = ic->ic_sup_rates[ieee80211_chan2mode(ic,
   6555 	    ic->ic_curchan)];
   6556 
   6557 	for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
   6558 		if (i < rs.ir_nrates) {
   6559 			rate = rs.
   6560 			    ir_rates[rs.ir_nrates - i];
   6561 		} else {
   6562 			rate = 2;
   6563 		}
   6564 
   6565 		if (2 == rate || 4 == rate ||
   6566 		    11 == rate || 22 == rate) {
   6567 			masks |= RATE_MCS_CCK_MSK;
   6568 		}
   6569 
   6570 		masks |= RATE_MCS_ANT_B_MSK;
   6571 		masks &= ~RATE_MCS_ANT_A_MSK;
   6572 
   6573 		link_quality.rate_n_flags[i] =
   6574 		    LE_32(iwk_rate_to_plcp(rate) | masks);
   6575 	}
   6576 
   6577 	link_quality.general_params.single_stream_ant_msk = 2;
   6578 	link_quality.general_params.dual_stream_ant_msk = 3;
   6579 	link_quality.agg_params.agg_dis_start_th = 3;
   6580 	link_quality.agg_params.agg_time_limit = LE_16(4000);
   6581 	link_quality.sta_id = ibss_node_p->node.id;
   6582 
   6583 	err = iwk_cmd(sc, REPLY_TX_LINK_QUALITY_CMD,
   6584 	    &link_quality, sizeof (link_quality), 1);
   6585 	if (err != IWK_SUCCESS) {
   6586 		cmn_err(CE_WARN, "iwk_clean_add_node_ibss(): "
   6587 		    "failed to set up TX link quality\n");
   6588 		ibss_node_p->used = 0;
   6589 		(void) memset(ibss_node_p->node.bssid, 0, 6);
   6590 		return (err);
   6591 	}
   6592 
   6593 	*index2 = index;
   6594 
   6595 	return (err);
   6596 }
   6597