xref: /illumos-gate/usr/src/uts/common/io/iwn/if_iwn.c (revision 8d548c7a)
1 /*	$NetBSD: if_iwn.c,v 1.78 2016/06/10 13:27:14 ozaki-r Exp $	*/
2 /*	$OpenBSD: if_iwn.c,v 1.135 2014/09/10 07:22:09 dcoppa Exp $	*/
3 
4 /*-
5  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
22  */
23 
24 /*
25  * Driver for Intel WiFi Link 4965 and 100/1000/2000/5000/6000 Series 802.11
26  * network adapters.
27  */
28 
29 /*
30  * TODO:
31  * - turn tunables into driver properties
32  */
33 
34 #undef IWN_HWCRYPTO	/* XXX does not even compile yet */
35 
36 #include <sys/modctl.h>
37 #include <sys/ddi.h>
38 #include <sys/sunddi.h>
39 #include <sys/stat.h>
40 
41 #include <sys/param.h>
42 #include <sys/sockio.h>
43 #include <sys/proc.h>
44 #include <sys/socket.h>
45 #include <sys/systm.h>
46 #include <sys/mutex.h>
47 #include <sys/conf.h>
48 
49 #include <sys/pci.h>
50 #include <sys/pcie.h>
51 
52 #include <net/if.h>
53 #include <net/if_arp.h>
54 #include <net/if_dl.h>
55 #include <net/if_types.h>
56 
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 
62 #include <sys/dlpi.h>
63 #include <sys/mac_provider.h>
64 #include <sys/mac_wifi.h>
65 #include <sys/net80211.h>
66 #include <sys/firmload.h>
67 #include <sys/queue.h>
68 #include <sys/strsun.h>
69 #include <sys/strsubr.h>
70 #include <sys/sysmacros.h>
71 #include <sys/types.h>
72 #include <sys/kstat.h>
73 
74 #include <sys/sdt.h>
75 
76 #include "if_iwncompat.h"
77 #include "if_iwnreg.h"
78 #include "if_iwnvar.h"
79 #include <inet/wifi_ioctl.h>
80 
81 #ifdef DEBUG
82 #define IWN_DEBUG
83 #endif
84 
85 /*
86  * regs access attributes
87  */
88 static ddi_device_acc_attr_t iwn_reg_accattr = {
89 	.devacc_attr_version	= DDI_DEVICE_ATTR_V0,
90 	.devacc_attr_endian_flags = DDI_STRUCTURE_LE_ACC,
91 	.devacc_attr_dataorder	= DDI_STRICTORDER_ACC,
92 	.devacc_attr_access	= DDI_DEFAULT_ACC
93 };
94 
95 /*
96  * DMA access attributes for descriptor
97  */
98 static ddi_device_acc_attr_t iwn_dma_descattr = {
99 	.devacc_attr_version	= DDI_DEVICE_ATTR_V0,
100 	.devacc_attr_endian_flags = DDI_STRUCTURE_LE_ACC,
101 	.devacc_attr_dataorder	= DDI_STRICTORDER_ACC,
102 	.devacc_attr_access	= DDI_DEFAULT_ACC
103 };
104 
105 /*
106  * DMA access attributes
107  */
108 static ddi_device_acc_attr_t iwn_dma_accattr = {
109 	.devacc_attr_version	= DDI_DEVICE_ATTR_V0,
110 	.devacc_attr_endian_flags = DDI_NEVERSWAP_ACC,
111 	.devacc_attr_dataorder	= DDI_STRICTORDER_ACC,
112 	.devacc_attr_access	= DDI_DEFAULT_ACC
113 };
114 
115 
116 /*
117  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
118  */
119 static const struct ieee80211_rateset iwn_rateset_11a =
120 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
121 
122 static const struct ieee80211_rateset iwn_rateset_11b =
123 	{ 4, { 2, 4, 11, 22 } };
124 
125 static const struct ieee80211_rateset iwn_rateset_11g =
126 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
127 
128 static void	iwn_kstat_create(struct iwn_softc *, const char *, size_t,
129     kstat_t **, void **);
130 static void	iwn_kstat_free(kstat_t *, void *, size_t);
131 static void	iwn_kstat_init(struct iwn_softc *);
132 static void	iwn_kstat_init_2000(struct iwn_softc *);
133 static void	iwn_kstat_init_4965(struct iwn_softc *);
134 static void	iwn_kstat_init_6000(struct iwn_softc *);
135 static void	iwn_intr_teardown(struct iwn_softc *);
136 static int	iwn_intr_add(struct iwn_softc *, int);
137 static int	iwn_intr_setup(struct iwn_softc *);
138 static int	iwn_attach(dev_info_t *, ddi_attach_cmd_t);
139 static int	iwn4965_attach(struct iwn_softc *);
140 static int	iwn5000_attach(struct iwn_softc *, uint16_t);
141 static int	iwn_detach(dev_info_t *, ddi_detach_cmd_t);
142 static int	iwn_quiesce(dev_info_t *);
143 static int	iwn_nic_lock(struct iwn_softc *);
144 static int	iwn_eeprom_lock(struct iwn_softc *);
145 static int	iwn_init_otprom(struct iwn_softc *);
146 static int	iwn_read_prom_data(struct iwn_softc *, uint32_t, void *, int);
147 static int	iwn_dma_contig_alloc(struct iwn_softc *, struct iwn_dma_info *,
148     uint_t, uint_t, void **, ddi_device_acc_attr_t *, uint_t);
149 static void	iwn_dma_contig_free(struct iwn_dma_info *);
150 static int	iwn_alloc_sched(struct iwn_softc *);
151 static void	iwn_free_sched(struct iwn_softc *);
152 static int	iwn_alloc_kw(struct iwn_softc *);
153 static void	iwn_free_kw(struct iwn_softc *);
154 static int	iwn_alloc_ict(struct iwn_softc *);
155 static void	iwn_free_ict(struct iwn_softc *);
156 static int	iwn_alloc_fwmem(struct iwn_softc *);
157 static void	iwn_free_fwmem(struct iwn_softc *);
158 static int	iwn_alloc_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
159 static void	iwn_reset_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
160 static void	iwn_free_rx_ring(struct iwn_softc *, struct iwn_rx_ring *);
161 static int	iwn_alloc_tx_ring(struct iwn_softc *, struct iwn_tx_ring *,
162 		    int);
163 static void	iwn_reset_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
164 static void	iwn_free_tx_ring(struct iwn_softc *, struct iwn_tx_ring *);
165 static void	iwn5000_ict_reset(struct iwn_softc *);
166 static int	iwn_read_eeprom(struct iwn_softc *);
167 static void	iwn4965_read_eeprom(struct iwn_softc *);
168 
169 #ifdef IWN_DEBUG
170 static void	iwn4965_print_power_group(struct iwn_softc *, int);
171 #endif
172 static void	iwn5000_read_eeprom(struct iwn_softc *);
173 static void	iwn_read_eeprom_channels(struct iwn_softc *, int, uint32_t);
174 static void	iwn_read_eeprom_enhinfo(struct iwn_softc *);
175 static struct	ieee80211_node *iwn_node_alloc(ieee80211com_t *);
176 static void	iwn_node_free(ieee80211_node_t *);
177 static void	iwn_newassoc(struct ieee80211_node *, int);
178 static int	iwn_newstate(struct ieee80211com *, enum ieee80211_state, int);
179 static void	iwn_iter_func(void *, struct ieee80211_node *);
180 static void	iwn_calib_timeout(void *);
181 static void	iwn_rx_phy(struct iwn_softc *, struct iwn_rx_desc *,
182 		    struct iwn_rx_data *);
183 static void	iwn_rx_done(struct iwn_softc *, struct iwn_rx_desc *,
184 		    struct iwn_rx_data *);
185 #ifndef IEEE80211_NO_HT
186 static void	iwn_rx_compressed_ba(struct iwn_softc *, struct iwn_rx_desc *,
187 		    struct iwn_rx_data *);
188 #endif
189 static void	iwn5000_rx_calib_results(struct iwn_softc *,
190 		    struct iwn_rx_desc *, struct iwn_rx_data *);
191 static void	iwn_rx_statistics(struct iwn_softc *, struct iwn_rx_desc *,
192 		    struct iwn_rx_data *);
193 static void	iwn4965_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
194 		    struct iwn_rx_data *);
195 static void	iwn5000_tx_done(struct iwn_softc *, struct iwn_rx_desc *,
196 		    struct iwn_rx_data *);
197 static void	iwn_tx_done(struct iwn_softc *, struct iwn_rx_desc *, int,
198 		    uint8_t);
199 static void	iwn_cmd_done(struct iwn_softc *, struct iwn_rx_desc *);
200 static void	iwn_notif_intr(struct iwn_softc *);
201 static void	iwn_wakeup_intr(struct iwn_softc *);
202 static void	iwn_fatal_intr(struct iwn_softc *);
203 static uint_t	iwn_intr(caddr_t, caddr_t);
204 static void	iwn4965_update_sched(struct iwn_softc *, int, int, uint8_t,
205 		    uint16_t);
206 static void	iwn5000_update_sched(struct iwn_softc *, int, int, uint8_t,
207 		    uint16_t);
208 #ifdef notyet
209 static void	iwn5000_reset_sched(struct iwn_softc *, int, int);
210 #endif
211 static int	iwn_send(ieee80211com_t *, mblk_t *, uint8_t);
212 static void	iwn_watchdog(void *);
213 static int	iwn_cmd(struct iwn_softc *, uint8_t, void *, int, int);
214 static int	iwn4965_add_node(struct iwn_softc *, struct iwn_node_info *,
215 		    int);
216 static int	iwn5000_add_node(struct iwn_softc *, struct iwn_node_info *,
217 		    int);
218 static int	iwn_set_link_quality(struct iwn_softc *,
219 		    struct ieee80211_node *);
220 static int	iwn_add_broadcast_node(struct iwn_softc *, int);
221 static void	iwn_set_led(struct iwn_softc *, uint8_t, uint8_t, uint8_t);
222 static int	iwn_set_critical_temp(struct iwn_softc *);
223 static int	iwn_set_timing(struct iwn_softc *, struct ieee80211_node *);
224 static void	iwn4965_power_calibration(struct iwn_softc *, int);
225 static int	iwn4965_set_txpower(struct iwn_softc *, int);
226 static int	iwn5000_set_txpower(struct iwn_softc *, int);
227 static int	iwn4965_get_rssi(const struct iwn_rx_stat *);
228 static int	iwn5000_get_rssi(const struct iwn_rx_stat *);
229 static int	iwn_get_noise(const struct iwn_rx_general_stats *);
230 static int	iwn4965_get_temperature(struct iwn_softc *);
231 static int	iwn5000_get_temperature(struct iwn_softc *);
232 static int	iwn_init_sensitivity(struct iwn_softc *);
233 static void	iwn_collect_noise(struct iwn_softc *,
234 		    const struct iwn_rx_general_stats *);
235 static int	iwn4965_init_gains(struct iwn_softc *);
236 static int	iwn5000_init_gains(struct iwn_softc *);
237 static int	iwn4965_set_gains(struct iwn_softc *);
238 static int	iwn5000_set_gains(struct iwn_softc *);
239 static void	iwn_tune_sensitivity(struct iwn_softc *,
240 		    const struct iwn_rx_stats *);
241 static int	iwn_send_sensitivity(struct iwn_softc *);
242 static int	iwn_set_pslevel(struct iwn_softc *, int, int, int);
243 static int	iwn5000_runtime_calib(struct iwn_softc *);
244 
245 static int	iwn_config_bt_coex_bluetooth(struct iwn_softc *);
246 static int	iwn_config_bt_coex_prio_table(struct iwn_softc *);
247 static int	iwn_config_bt_coex_adv1(struct iwn_softc *);
248 static int	iwn_config_bt_coex_adv2(struct iwn_softc *);
249 
250 static int	iwn_config(struct iwn_softc *);
251 static uint16_t	iwn_get_active_dwell_time(struct iwn_softc *, uint16_t,
252 		    uint8_t);
253 static uint16_t	iwn_limit_dwell(struct iwn_softc *, uint16_t);
254 static uint16_t	iwn_get_passive_dwell_time(struct iwn_softc *, uint16_t);
255 static int	iwn_scan(struct iwn_softc *, uint16_t);
256 static int	iwn_auth(struct iwn_softc *);
257 static int	iwn_run(struct iwn_softc *);
258 #ifdef IWN_HWCRYPTO
259 static int	iwn_set_key(struct ieee80211com *, struct ieee80211_node *,
260 		    struct ieee80211_key *);
261 static void	iwn_delete_key(struct ieee80211com *, struct ieee80211_node *,
262 		    struct ieee80211_key *);
263 #endif
264 static int	iwn_wme_update(struct ieee80211com *);
265 #ifndef IEEE80211_NO_HT
266 static int	iwn_ampdu_rx_start(struct ieee80211com *,
267 		    struct ieee80211_node *, uint8_t);
268 static void	iwn_ampdu_rx_stop(struct ieee80211com *,
269 		    struct ieee80211_node *, uint8_t);
270 static int	iwn_ampdu_tx_start(struct ieee80211com *,
271 		    struct ieee80211_node *, uint8_t);
272 static void	iwn_ampdu_tx_stop(struct ieee80211com *,
273 		    struct ieee80211_node *, uint8_t);
274 static void	iwn4965_ampdu_tx_start(struct iwn_softc *,
275 		    struct ieee80211_node *, uint8_t, uint16_t);
276 static void	iwn4965_ampdu_tx_stop(struct iwn_softc *,
277 		    uint8_t, uint16_t);
278 static void	iwn5000_ampdu_tx_start(struct iwn_softc *,
279 		    struct ieee80211_node *, uint8_t, uint16_t);
280 static void	iwn5000_ampdu_tx_stop(struct iwn_softc *,
281 		    uint8_t, uint16_t);
282 #endif
283 static int	iwn5000_query_calibration(struct iwn_softc *);
284 static int	iwn5000_send_calibration(struct iwn_softc *);
285 static int	iwn5000_send_wimax_coex(struct iwn_softc *);
286 static int	iwn6000_temp_offset_calib(struct iwn_softc *);
287 static int	iwn2000_temp_offset_calib(struct iwn_softc *);
288 static int	iwn4965_post_alive(struct iwn_softc *);
289 static int	iwn5000_post_alive(struct iwn_softc *);
290 static int	iwn4965_load_bootcode(struct iwn_softc *, const uint8_t *,
291 		    int);
292 static int	iwn4965_load_firmware(struct iwn_softc *);
293 static int	iwn5000_load_firmware_section(struct iwn_softc *, uint32_t,
294 		    const uint8_t *, int);
295 static int	iwn5000_load_firmware(struct iwn_softc *);
296 static int	iwn_read_firmware_leg(struct iwn_softc *,
297 		    struct iwn_fw_info *);
298 static int	iwn_read_firmware_tlv(struct iwn_softc *,
299 		    struct iwn_fw_info *, uint16_t);
300 static int	iwn_read_firmware(struct iwn_softc *);
301 static int	iwn_clock_wait(struct iwn_softc *);
302 static int	iwn_apm_init(struct iwn_softc *);
303 static void	iwn_apm_stop_master(struct iwn_softc *);
304 static void	iwn_apm_stop(struct iwn_softc *);
305 static int	iwn4965_nic_config(struct iwn_softc *);
306 static int	iwn5000_nic_config(struct iwn_softc *);
307 static int	iwn_hw_prepare(struct iwn_softc *);
308 static int	iwn_hw_init(struct iwn_softc *);
309 static void	iwn_hw_stop(struct iwn_softc *, boolean_t);
310 static int	iwn_init(struct iwn_softc *);
311 static void	iwn_abort_scan(void *);
312 static void	iwn_periodic(void *);
313 static int	iwn_fast_recover(struct iwn_softc *);
314 
315 static uint8_t	*ieee80211_add_ssid(uint8_t *, const uint8_t *, uint32_t);
316 static uint8_t	*ieee80211_add_rates(uint8_t *,
317     const struct ieee80211_rateset *);
318 static uint8_t	*ieee80211_add_xrates(uint8_t *,
319     const struct ieee80211_rateset *);
320 
321 static void	iwn_fix_channel(struct iwn_softc *, mblk_t *,
322 		    struct iwn_rx_stat *);
323 
324 #ifdef IWN_DEBUG
325 
326 #define	IWN_DBG(...)	iwn_dbg("?" __VA_ARGS__)
327 
328 static int iwn_dbg_print = 0;
329 
330 static void
331 iwn_dbg(const char *fmt, ...)
332 {
333 	va_list	ap;
334 
335 	if (iwn_dbg_print != 0) {
336 		va_start(ap, fmt);
337 		vcmn_err(CE_CONT, fmt, ap);
338 		va_end(ap);
339 	}
340 }
341 
342 #else
343 #define	IWN_DBG(...)
344 #endif
345 
346 /*
347  * tunables
348  */
349 
350 /*
351  * enable 5GHz scanning
352  */
353 int iwn_enable_5ghz = 1;
354 
355 /*
356  * If more than 50 consecutive beacons are missed,
357  * we've probably lost our connection.
358  * If more than 5 consecutive beacons are missed,
359  * reinitialize the sensitivity state machine.
360  */
361 int iwn_beacons_missed_disconnect = 50;
362 int iwn_beacons_missed_sensitivity = 5;
363 
364 /*
365  * iwn_periodic interval, in units of msec
366  */
367 int iwn_periodic_interval = 100;
368 
369 /*
370  * scan timeout in sec
371  */
372 int iwn_scan_timeout = 20;
373 
374 static ether_addr_t etherbroadcastaddr = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
375 
376 static void *iwn_state = NULL;
377 
378 /*
379  * Mac Call Back entries
380  */
381 static int	iwn_m_stat(void *, uint_t, uint64_t *);
382 static int	iwn_m_start(void *);
383 static void	iwn_m_stop(void *);
384 static int	iwn_m_unicst(void *, const uint8_t *);
385 static int	iwn_m_multicst(void *, boolean_t, const uint8_t *);
386 static int	iwn_m_promisc(void *, boolean_t);
387 static mblk_t	*iwn_m_tx(void *, mblk_t *);
388 static void	iwn_m_ioctl(void *, queue_t *, mblk_t *);
389 static int	iwn_m_setprop(void *, const char *, mac_prop_id_t, uint_t,
390     const void *);
391 static int	iwn_m_getprop(void *, const char *, mac_prop_id_t, uint_t,
392     void *);
393 static void	iwn_m_propinfo(void *, const char *, mac_prop_id_t,
394     mac_prop_info_handle_t);
395 
396 mac_callbacks_t	iwn_m_callbacks = {
397 	.mc_callbacks	= MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
398 	.mc_getstat	= iwn_m_stat,
399 	.mc_start	= iwn_m_start,
400 	.mc_stop	= iwn_m_stop,
401 	.mc_setpromisc	= iwn_m_promisc,
402 	.mc_multicst	= iwn_m_multicst,
403 	.mc_unicst	= iwn_m_unicst,
404 	.mc_tx		= iwn_m_tx,
405 	.mc_reserved	= NULL,
406 	.mc_ioctl	= iwn_m_ioctl,
407 	.mc_getcapab	= NULL,
408 	.mc_open	= NULL,
409 	.mc_close	= NULL,
410 	.mc_setprop	= iwn_m_setprop,
411 	.mc_getprop	= iwn_m_getprop,
412 	.mc_propinfo	= iwn_m_propinfo
413 };
414 
415 static inline uint32_t
416 iwn_read(struct iwn_softc *sc, int reg)
417 {
418 	/*LINTED: E_PTR_BAD_CAST_ALIGN*/
419 	return (ddi_get32(sc->sc_regh, (uint32_t *)(sc->sc_base + reg)));
420 }
421 
422 static inline void
423 iwn_write(struct iwn_softc *sc, int reg, uint32_t val)
424 {
425 	/*LINTED: E_PTR_BAD_CAST_ALIGN*/
426 	ddi_put32(sc->sc_regh, (uint32_t *)(sc->sc_base + reg), val);
427 }
428 
429 static inline void
430 iwn_write_1(struct iwn_softc *sc, int reg, uint8_t val)
431 {
432 	ddi_put8(sc->sc_regh, (uint8_t *)(sc->sc_base + reg), val);
433 }
434 
435 static void
436 iwn_kstat_create(struct iwn_softc *sc, const char *name, size_t size,
437     kstat_t **ks, void **data)
438 {
439 	*ks = kstat_create(ddi_driver_name(sc->sc_dip),
440 	    ddi_get_instance(sc->sc_dip), name, "misc", KSTAT_TYPE_NAMED,
441 	    size / sizeof (kstat_named_t), 0);
442 	if (*ks == NULL)
443 		*data = kmem_zalloc(size, KM_SLEEP);
444 	else
445 		*data = (*ks)->ks_data;
446 }
447 
448 static void
449 iwn_kstat_free(kstat_t *ks, void *data, size_t size)
450 {
451 	if (ks != NULL)
452 		kstat_delete(ks);
453 	else if (data != NULL)
454 		kmem_free(data, size);
455 }
456 
457 static void
458 iwn_kstat_init(struct iwn_softc *sc)
459 {
460 	if (sc->sc_ks_misc != NULL)
461 		sc->sc_ks_misc->ks_lock = &sc->sc_mtx;
462 	if (sc->sc_ks_ant != NULL)
463 		sc->sc_ks_ant->ks_lock = &sc->sc_mtx;
464 	if (sc->sc_ks_sens != NULL)
465 		sc->sc_ks_sens->ks_lock = &sc->sc_mtx;
466 	if (sc->sc_ks_timing != NULL)
467 		sc->sc_ks_timing->ks_lock = &sc->sc_mtx;
468 	if (sc->sc_ks_edca != NULL)
469 		sc->sc_ks_edca->ks_lock = &sc->sc_mtx;
470 
471 	kstat_named_init(&sc->sc_misc->temp,
472 	    "temperature", KSTAT_DATA_ULONG);
473 	kstat_named_init(&sc->sc_misc->crit_temp,
474 	    "critical temperature", KSTAT_DATA_ULONG);
475 	kstat_named_init(&sc->sc_misc->pslevel,
476 	    "power saving level", KSTAT_DATA_ULONG);
477 	kstat_named_init(&sc->sc_misc->noise,
478 	    "noise", KSTAT_DATA_LONG);
479 
480 
481 	kstat_named_init(&sc->sc_ant->tx_ant,
482 	    "TX mask", KSTAT_DATA_ULONG);
483 	kstat_named_init(&sc->sc_ant->rx_ant,
484 	    "RX mask", KSTAT_DATA_ULONG);
485 	kstat_named_init(&sc->sc_ant->conn_ant,
486 	    "connected mask", KSTAT_DATA_ULONG);
487 	kstat_named_init(&sc->sc_ant->gain[0],
488 	    "gain A", KSTAT_DATA_ULONG);
489 	kstat_named_init(&sc->sc_ant->gain[1],
490 	    "gain B", KSTAT_DATA_ULONG);
491 	kstat_named_init(&sc->sc_ant->gain[2],
492 	    "gain C", KSTAT_DATA_ULONG);
493 
494 	kstat_named_init(&sc->sc_sens->ofdm_x1,
495 	    "OFDM X1", KSTAT_DATA_ULONG);
496 	kstat_named_init(&sc->sc_sens->ofdm_mrc_x1,
497 	    "OFDM MRC X1", KSTAT_DATA_ULONG);
498 	kstat_named_init(&sc->sc_sens->ofdm_x4,
499 	    "OFDM X4", KSTAT_DATA_ULONG);
500 	kstat_named_init(&sc->sc_sens->ofdm_mrc_x4,
501 	    "OFDM MRC X4", KSTAT_DATA_ULONG);
502 	kstat_named_init(&sc->sc_sens->cck_x4,
503 	    "CCK X4", KSTAT_DATA_ULONG);
504 	kstat_named_init(&sc->sc_sens->cck_mrc_x4,
505 	    "CCK MRC X4", KSTAT_DATA_ULONG);
506 	kstat_named_init(&sc->sc_sens->energy_cck,
507 	    "energy CCK", KSTAT_DATA_ULONG);
508 
509 	kstat_named_init(&sc->sc_timing->bintval,
510 	    "bintval", KSTAT_DATA_ULONG);
511 	kstat_named_init(&sc->sc_timing->tstamp,
512 	    "timestamp", KSTAT_DATA_ULONGLONG);
513 	kstat_named_init(&sc->sc_timing->init,
514 	    "init", KSTAT_DATA_ULONG);
515 
516 	kstat_named_init(&sc->sc_edca->ac[0].cwmin,
517 	    "background cwmin", KSTAT_DATA_ULONG);
518 	kstat_named_init(&sc->sc_edca->ac[0].cwmax,
519 	    "background cwmax", KSTAT_DATA_ULONG);
520 	kstat_named_init(&sc->sc_edca->ac[0].aifsn,
521 	    "background aifsn", KSTAT_DATA_ULONG);
522 	kstat_named_init(&sc->sc_edca->ac[0].txop,
523 	    "background txop", KSTAT_DATA_ULONG);
524 	kstat_named_init(&sc->sc_edca->ac[1].cwmin,
525 	    "best effort cwmin", KSTAT_DATA_ULONG);
526 	kstat_named_init(&sc->sc_edca->ac[1].cwmax,
527 	    "best effort cwmax", KSTAT_DATA_ULONG);
528 	kstat_named_init(&sc->sc_edca->ac[1].aifsn,
529 	    "best effort aifsn", KSTAT_DATA_ULONG);
530 	kstat_named_init(&sc->sc_edca->ac[1].txop,
531 	    "best effort txop", KSTAT_DATA_ULONG);
532 	kstat_named_init(&sc->sc_edca->ac[2].cwmin,
533 	    "video cwmin", KSTAT_DATA_ULONG);
534 	kstat_named_init(&sc->sc_edca->ac[2].cwmax,
535 	    "video cwmax", KSTAT_DATA_ULONG);
536 	kstat_named_init(&sc->sc_edca->ac[2].aifsn,
537 	    "video aifsn", KSTAT_DATA_ULONG);
538 	kstat_named_init(&sc->sc_edca->ac[2].txop,
539 	    "video txop", KSTAT_DATA_ULONG);
540 	kstat_named_init(&sc->sc_edca->ac[3].cwmin,
541 	    "voice cwmin", KSTAT_DATA_ULONG);
542 	kstat_named_init(&sc->sc_edca->ac[3].cwmax,
543 	    "voice cwmax", KSTAT_DATA_ULONG);
544 	kstat_named_init(&sc->sc_edca->ac[3].aifsn,
545 	    "voice aifsn", KSTAT_DATA_ULONG);
546 	kstat_named_init(&sc->sc_edca->ac[3].txop,
547 	    "voice txop", KSTAT_DATA_ULONG);
548 }
549 
550 static void
551 iwn_kstat_init_2000(struct iwn_softc *sc)
552 {
553 	if (sc->sc_ks_toff != NULL)
554 		sc->sc_ks_toff->ks_lock = &sc->sc_mtx;
555 
556 	kstat_named_init(&sc->sc_toff.t2000->toff_lo,
557 	    "temperature offset low", KSTAT_DATA_LONG);
558 	kstat_named_init(&sc->sc_toff.t2000->toff_hi,
559 	    "temperature offset high", KSTAT_DATA_LONG);
560 	kstat_named_init(&sc->sc_toff.t2000->volt,
561 	    "reference voltage", KSTAT_DATA_LONG);
562 }
563 
564 static void
565 iwn_kstat_init_4965(struct iwn_softc *sc)
566 {
567 	int i, r;
568 
569 	if (sc->sc_ks_txpower != NULL)
570 		sc->sc_ks_txpower->ks_lock = &sc->sc_mtx;
571 
572 	kstat_named_init(&sc->sc_txpower->vdiff,
573 	    "voltage comp", KSTAT_DATA_LONG);
574 	kstat_named_init(&sc->sc_txpower->chan,
575 	    "channel", KSTAT_DATA_LONG);
576 	kstat_named_init(&sc->sc_txpower->group,
577 	    "attenuation group", KSTAT_DATA_LONG);
578 	kstat_named_init(&sc->sc_txpower->subband,
579 	    "sub-band", KSTAT_DATA_LONG);
580 	for (i = 0; i != 2; i++) {
581 		char tmp[KSTAT_STRLEN];
582 
583 		(void) snprintf(tmp, KSTAT_STRLEN - 1, "Ant %d power", i);
584 		kstat_named_init(&sc->sc_txpower->txchain[i].power,
585 		    tmp, KSTAT_DATA_LONG);
586 
587 		(void) snprintf(tmp, KSTAT_STRLEN - 1, "Ant %d gain", i);
588 		kstat_named_init(&sc->sc_txpower->txchain[i].gain,
589 		    tmp, KSTAT_DATA_LONG);
590 
591 		(void) snprintf(tmp, KSTAT_STRLEN - 1, "Ant %d temperature", i);
592 		kstat_named_init(&sc->sc_txpower->txchain[i].temp,
593 		    tmp, KSTAT_DATA_LONG);
594 
595 		(void) snprintf(tmp, KSTAT_STRLEN - 1,
596 		    "Ant %d temperature compensation", i);
597 		kstat_named_init(&sc->sc_txpower->txchain[i].tcomp,
598 		    tmp, KSTAT_DATA_LONG);
599 
600 		for (r = 0; r != IWN_RIDX_MAX; r++) {
601 			(void) snprintf(tmp, KSTAT_STRLEN - 1,
602 			    "Ant %d Rate %d RF gain", i, r);
603 			kstat_named_init(
604 			    &sc->sc_txpower->txchain[i].rate[r].rf_gain,
605 			    tmp, KSTAT_DATA_LONG);
606 
607 			(void) snprintf(tmp, KSTAT_STRLEN - 1,
608 			    "Ant %d Rate %d DSP gain", i, r);
609 			kstat_named_init(
610 			    &sc->sc_txpower->txchain[0].rate[0].dsp_gain,
611 			    tmp, KSTAT_DATA_LONG);
612 		}
613 	}
614 }
615 
616 static void
617 iwn_kstat_init_6000(struct iwn_softc *sc)
618 {
619 	if (sc->sc_ks_toff != NULL)
620 		sc->sc_ks_toff->ks_lock = &sc->sc_mtx;
621 
622 	kstat_named_init(&sc->sc_toff.t6000->toff,
623 	    "temperature offset", KSTAT_DATA_LONG);
624 }
625 
626 static void
627 iwn_intr_teardown(struct iwn_softc *sc)
628 {
629 	if (sc->sc_intr_htable != NULL) {
630 		if ((sc->sc_intr_cap & DDI_INTR_FLAG_BLOCK) != 0) {
631 			(void) ddi_intr_block_disable(sc->sc_intr_htable,
632 			    sc->sc_intr_count);
633 		} else {
634 			(void) ddi_intr_disable(sc->sc_intr_htable[0]);
635 		}
636 		(void) ddi_intr_remove_handler(sc->sc_intr_htable[0]);
637 		(void) ddi_intr_free(sc->sc_intr_htable[0]);
638 		sc->sc_intr_htable[0] = NULL;
639 
640 		kmem_free(sc->sc_intr_htable, sc->sc_intr_size);
641 		sc->sc_intr_size = 0;
642 		sc->sc_intr_htable = NULL;
643 	}
644 }
645 
646 static int
647 iwn_intr_add(struct iwn_softc *sc, int intr_type)
648 {
649 	int ni, na;
650 	int ret;
651 	char *func;
652 
653 	if (ddi_intr_get_nintrs(sc->sc_dip, intr_type, &ni) != DDI_SUCCESS)
654 		return (DDI_FAILURE);
655 
656 
657 	if (ddi_intr_get_navail(sc->sc_dip, intr_type, &na) != DDI_SUCCESS)
658 		return (DDI_FAILURE);
659 
660 	sc->sc_intr_size = sizeof (ddi_intr_handle_t);
661 	sc->sc_intr_htable = kmem_zalloc(sc->sc_intr_size, KM_SLEEP);
662 
663 	ret = ddi_intr_alloc(sc->sc_dip, sc->sc_intr_htable, intr_type, 0, 1,
664 	    &sc->sc_intr_count, DDI_INTR_ALLOC_STRICT);
665 	if (ret != DDI_SUCCESS) {
666 		dev_err(sc->sc_dip, CE_WARN, "!ddi_intr_alloc() failed");
667 		return (DDI_FAILURE);
668 	}
669 
670 	ret = ddi_intr_get_pri(sc->sc_intr_htable[0], &sc->sc_intr_pri);
671 	if (ret != DDI_SUCCESS) {
672 		dev_err(sc->sc_dip, CE_WARN, "!ddi_intr_get_pri() failed");
673 		return (DDI_FAILURE);
674 	}
675 
676 	ret = ddi_intr_add_handler(sc->sc_intr_htable[0], iwn_intr, (caddr_t)sc,
677 	    NULL);
678 	if (ret != DDI_SUCCESS) {
679 		dev_err(sc->sc_dip, CE_WARN, "!ddi_intr_add_handler() failed");
680 		return (DDI_FAILURE);
681 	}
682 
683 	ret = ddi_intr_get_cap(sc->sc_intr_htable[0], &sc->sc_intr_cap);
684 	if (ret != DDI_SUCCESS) {
685 		dev_err(sc->sc_dip, CE_WARN, "!ddi_intr_get_cap() failed");
686 		return (DDI_FAILURE);
687 	}
688 
689 	if ((sc->sc_intr_cap & DDI_INTR_FLAG_BLOCK) != 0) {
690 		ret = ddi_intr_block_enable(sc->sc_intr_htable,
691 		    sc->sc_intr_count);
692 		func = "ddi_intr_enable_block";
693 	} else {
694 		ret = ddi_intr_enable(sc->sc_intr_htable[0]);
695 		func = "ddi_intr_enable";
696 	}
697 
698 	if (ret != DDI_SUCCESS) {
699 		dev_err(sc->sc_dip, CE_WARN, "!%s() failed", func);
700 		return (DDI_FAILURE);
701 	}
702 
703 	return (DDI_SUCCESS);
704 }
705 
706 static int
707 iwn_intr_setup(struct iwn_softc *sc)
708 {
709 	int intr_type;
710 	int ret;
711 
712 	ret = ddi_intr_get_supported_types(sc->sc_dip, &intr_type);
713 	if (ret != DDI_SUCCESS) {
714 		dev_err(sc->sc_dip, CE_WARN,
715 		    "!ddi_intr_get_supported_types() failed");
716 		return (DDI_FAILURE);
717 	}
718 
719 	if ((intr_type & DDI_INTR_TYPE_MSIX)) {
720 		if (iwn_intr_add(sc, DDI_INTR_TYPE_MSIX) == DDI_SUCCESS)
721 			return (DDI_SUCCESS);
722 		iwn_intr_teardown(sc);
723 	}
724 
725 	if ((intr_type & DDI_INTR_TYPE_MSI)) {
726 		if (iwn_intr_add(sc, DDI_INTR_TYPE_MSI) == DDI_SUCCESS)
727 			return (DDI_SUCCESS);
728 		iwn_intr_teardown(sc);
729 	}
730 
731 	if ((intr_type & DDI_INTR_TYPE_FIXED)) {
732 		if (iwn_intr_add(sc, DDI_INTR_TYPE_FIXED) == DDI_SUCCESS)
733 			return (DDI_SUCCESS);
734 		iwn_intr_teardown(sc);
735 	}
736 
737 	dev_err(sc->sc_dip, CE_WARN, "!iwn_intr_setup() failed");
738 	return (DDI_FAILURE);
739 }
740 
741 static int
742 iwn_pci_get_capability(ddi_acc_handle_t pcih, int cap, int *cap_off)
743 {
744 	uint8_t ptr;
745 	uint8_t val;
746 
747 	for (ptr = pci_config_get8(pcih, PCI_CONF_CAP_PTR);
748 	    ptr != 0 && ptr != 0xff;
749 	    ptr = pci_config_get8(pcih, ptr + PCI_CAP_NEXT_PTR)) {
750 		val = pci_config_get8(pcih, ptr + PCIE_CAP_ID);
751 		if (val == 0xff)
752 			return (DDI_FAILURE);
753 
754 		if (cap != val)
755 			continue;
756 
757 		*cap_off = ptr;
758 		return (DDI_SUCCESS);
759 	}
760 
761 	return (DDI_FAILURE);
762 }
763 
764 static int
765 iwn_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
766 {
767 	int instance;
768 
769 	struct iwn_softc *sc;
770 	struct ieee80211com *ic;
771 	char strbuf[32];
772 	wifi_data_t wd = { 0 };
773 	mac_register_t *macp;
774 	uint32_t reg;
775 	int i, error;
776 
777 	switch (cmd) {
778 	case DDI_ATTACH:
779 		break;
780 
781 	case DDI_RESUME:
782 		instance = ddi_get_instance(dip);
783 		sc = ddi_get_soft_state(iwn_state,
784 		    instance);
785 		ASSERT(sc != NULL);
786 
787 		if (sc->sc_flags & IWN_FLAG_RUNNING) {
788 			(void) iwn_init(sc);
789 		}
790 
791 		sc->sc_flags &= ~IWN_FLAG_SUSPEND;
792 
793 		return (DDI_SUCCESS);
794 	default:
795 		return (DDI_FAILURE);
796 	}
797 
798 	instance = ddi_get_instance(dip);
799 
800 	if (ddi_soft_state_zalloc(iwn_state, instance) != DDI_SUCCESS) {
801 		dev_err(dip, CE_WARN, "!ddi_soft_state_zalloc() failed");
802 		return (DDI_FAILURE);
803 	}
804 
805 	sc = ddi_get_soft_state(iwn_state, instance);
806 	ddi_set_driver_private(dip, (caddr_t)sc);
807 
808 	ic = &sc->sc_ic;
809 
810 	sc->sc_dip = dip;
811 
812 	iwn_kstat_create(sc, "hw_state", sizeof (struct iwn_ks_misc),
813 	    &sc->sc_ks_misc, (void **)&sc->sc_misc);
814 	iwn_kstat_create(sc, "antennas", sizeof (struct iwn_ks_ant),
815 	    &sc->sc_ks_ant, (void **)&sc->sc_ant);
816 	iwn_kstat_create(sc, "sensitivity", sizeof (struct iwn_ks_sens),
817 	    &sc->sc_ks_sens, (void **)&sc->sc_sens);
818 	iwn_kstat_create(sc, "timing", sizeof (struct iwn_ks_timing),
819 	    &sc->sc_ks_timing, (void **)&sc->sc_timing);
820 	iwn_kstat_create(sc, "edca", sizeof (struct iwn_ks_edca),
821 	    &sc->sc_ks_edca, (void **)&sc->sc_edca);
822 
823 	if (pci_config_setup(dip, &sc->sc_pcih) != DDI_SUCCESS) {
824 		dev_err(sc->sc_dip, CE_WARN, "!pci_config_setup() failed");
825 		goto fail_pci_config;
826 	}
827 
828 	/*
829 	 * Get the offset of the PCI Express Capability Structure in PCI
830 	 * Configuration Space.
831 	 */
832 	error = iwn_pci_get_capability(sc->sc_pcih, PCI_CAP_ID_PCI_E,
833 	    &sc->sc_cap_off);
834 	if (error != DDI_SUCCESS) {
835 		dev_err(sc->sc_dip, CE_WARN,
836 		    "!PCIe capability structure not found!");
837 		goto fail_pci_capab;
838 	}
839 
840 	/* Clear device-specific "PCI retry timeout" register (41h). */
841 	reg = pci_config_get8(sc->sc_pcih, 0x41);
842 	if (reg)
843 		pci_config_put8(sc->sc_pcih, 0x41, 0);
844 
845 	error = ddi_regs_map_setup(dip, 1, &sc->sc_base, 0, 0, &iwn_reg_accattr,
846 	    &sc->sc_regh);
847 	if (error != DDI_SUCCESS) {
848 		dev_err(sc->sc_dip, CE_WARN, "!ddi_regs_map_setup() failed");
849 		goto fail_regs_map;
850 	}
851 
852 	/* Clear pending interrupts. */
853 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
854 
855 	/* Disable all interrupts. */
856 	IWN_WRITE(sc, IWN_INT_MASK, 0);
857 
858 	/* Install interrupt handler. */
859 	if (iwn_intr_setup(sc) != DDI_SUCCESS)
860 		goto fail_intr;
861 
862 	mutex_init(&sc->sc_mtx, NULL, MUTEX_DRIVER,
863 	    DDI_INTR_PRI(sc->sc_intr_pri));
864 	mutex_init(&sc->sc_tx_mtx, NULL, MUTEX_DRIVER,
865 	    DDI_INTR_PRI(sc->sc_intr_pri));
866 	mutex_init(&sc->sc_mt_mtx, NULL, MUTEX_DRIVER,
867 	    DDI_INTR_PRI(sc->sc_intr_pri));
868 
869 	cv_init(&sc->sc_cmd_cv, NULL, CV_DRIVER, NULL);
870 	cv_init(&sc->sc_scan_cv, NULL, CV_DRIVER, NULL);
871 	cv_init(&sc->sc_fhdma_cv, NULL, CV_DRIVER, NULL);
872 	cv_init(&sc->sc_alive_cv, NULL, CV_DRIVER, NULL);
873 	cv_init(&sc->sc_calib_cv, NULL, CV_DRIVER, NULL);
874 
875 	iwn_kstat_init(sc);
876 
877 	/* Read hardware revision and attach. */
878 	sc->hw_type =
879 	    (IWN_READ(sc, IWN_HW_REV) & IWN_HW_REV_TYPE_MASK)
880 	      >> IWN_HW_REV_TYPE_SHIFT;
881 	if (sc->hw_type == IWN_HW_REV_TYPE_4965)
882 		error = iwn4965_attach(sc);
883 	else
884 		error = iwn5000_attach(sc, sc->sc_devid);
885 	if (error != 0) {
886 		dev_err(sc->sc_dip, CE_WARN, "!could not attach device");
887 		goto fail_hw;
888 	}
889 
890 	if ((error = iwn_hw_prepare(sc)) != 0) {
891 		dev_err(sc->sc_dip, CE_WARN, "!hardware not ready");
892 		goto fail_hw;
893 	}
894 
895 	/* Read MAC address, channels, etc from EEPROM. */
896 	if ((error = iwn_read_eeprom(sc)) != 0) {
897 		dev_err(sc->sc_dip, CE_WARN, "!could not read EEPROM");
898 		goto fail_hw;
899 	}
900 
901 	/* Allocate DMA memory for firmware transfers. */
902 	if ((error = iwn_alloc_fwmem(sc)) != 0) {
903 		dev_err(sc->sc_dip, CE_WARN,
904 		    "!could not allocate memory for firmware");
905 		goto fail_fwmem;
906 	}
907 
908 	/* Allocate "Keep Warm" page. */
909 	if ((error = iwn_alloc_kw(sc)) != 0) {
910 		dev_err(sc->sc_dip, CE_WARN,
911 		    "!could not allocate keep warm page");
912 		goto fail_kw;
913 	}
914 
915 	/* Allocate ICT table for 5000 Series. */
916 	if (sc->hw_type != IWN_HW_REV_TYPE_4965 &&
917 	    (error = iwn_alloc_ict(sc)) != 0) {
918 		dev_err(sc->sc_dip, CE_WARN, "!could not allocate ICT table");
919 		goto fail_ict;
920 	}
921 
922 	/* Allocate TX scheduler "rings". */
923 	if ((error = iwn_alloc_sched(sc)) != 0) {
924 		dev_err(sc->sc_dip, CE_WARN,
925 		    "!could not allocate TX scheduler rings");
926 		goto fail_sched;
927 	}
928 
929 	/* Allocate TX rings (16 on 4965AGN, 20 on >=5000). */
930 	for (i = 0; i < sc->ntxqs; i++) {
931 		if ((error = iwn_alloc_tx_ring(sc, &sc->txq[i], i)) != 0) {
932 			dev_err(sc->sc_dip, CE_WARN,
933 			    "!could not allocate TX ring %d", i);
934 			while (--i >= 0)
935 				iwn_free_tx_ring(sc, &sc->txq[i]);
936 			goto fail_txring;
937 		}
938 	}
939 
940 	/* Allocate RX ring. */
941 	if ((error = iwn_alloc_rx_ring(sc, &sc->rxq)) != 0) {
942 		dev_err(sc->sc_dip, CE_WARN, "!could not allocate RX ring");
943 		goto fail_rxring;
944 	}
945 
946 	/* Clear pending interrupts. */
947 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
948 
949 	/* Count the number of available chains. */
950 	sc->ntxchains =
951 	    ((sc->txchainmask >> 2) & 1) +
952 	    ((sc->txchainmask >> 1) & 1) +
953 	    ((sc->txchainmask >> 0) & 1);
954 	sc->nrxchains =
955 	    ((sc->rxchainmask >> 2) & 1) +
956 	    ((sc->rxchainmask >> 1) & 1) +
957 	    ((sc->rxchainmask >> 0) & 1);
958 	dev_err(sc->sc_dip, CE_CONT, "!MIMO %dT%dR, %s, address %s",
959 	    sc->ntxchains, sc->nrxchains, sc->eeprom_domain,
960 	    ieee80211_macaddr_sprintf(ic->ic_macaddr));
961 
962 	sc->sc_ant->tx_ant.value.ul = sc->txchainmask;
963 	sc->sc_ant->rx_ant.value.ul = sc->rxchainmask;
964 
965 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
966 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
967 	ic->ic_state = IEEE80211_S_INIT;
968 
969 	/* Set device capabilities. */
970 	/* XXX OpenBSD has IEEE80211_C_WEP, IEEE80211_C_RSN,
971 	 * and IEEE80211_C_PMGT too. */
972 	ic->ic_caps =
973 	    IEEE80211_C_IBSS |		/* IBSS mode support */
974 	    IEEE80211_C_WPA |		/* 802.11i */
975 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
976 	    IEEE80211_C_TXPMGT |	/* tx power management */
977 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
978 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
979 	    IEEE80211_C_WME;		/* 802.11e */
980 
981 #ifndef IEEE80211_NO_HT
982 	if (sc->sc_flags & IWN_FLAG_HAS_11N) {
983 		/* Set HT capabilities. */
984 		ic->ic_htcaps =
985 #if IWN_RBUF_SIZE == 8192
986 		    IEEE80211_HTCAP_AMSDU7935 |
987 #endif
988 		    IEEE80211_HTCAP_CBW20_40 |
989 		    IEEE80211_HTCAP_SGI20 |
990 		    IEEE80211_HTCAP_SGI40;
991 		if (sc->hw_type != IWN_HW_REV_TYPE_4965)
992 			ic->ic_htcaps |= IEEE80211_HTCAP_GF;
993 		if (sc->hw_type == IWN_HW_REV_TYPE_6050)
994 			ic->ic_htcaps |= IEEE80211_HTCAP_SMPS_DYN;
995 		else
996 			ic->ic_htcaps |= IEEE80211_HTCAP_SMPS_DIS;
997 	}
998 #endif	/* !IEEE80211_NO_HT */
999 
1000 	/* Set supported legacy rates. */
1001 	ic->ic_sup_rates[IEEE80211_MODE_11B] = iwn_rateset_11b;
1002 	ic->ic_sup_rates[IEEE80211_MODE_11G] = iwn_rateset_11g;
1003 	if (sc->sc_flags & IWN_FLAG_HAS_5GHZ) {
1004 		ic->ic_sup_rates[IEEE80211_MODE_11A] = iwn_rateset_11a;
1005 	}
1006 #ifndef IEEE80211_NO_HT
1007 	if (sc->sc_flags & IWN_FLAG_HAS_11N) {
1008 		/* Set supported HT rates. */
1009 		ic->ic_sup_mcs[0] = 0xff;		/* MCS 0-7 */
1010 		if (sc->nrxchains > 1)
1011 			ic->ic_sup_mcs[1] = 0xff;	/* MCS 7-15 */
1012 		if (sc->nrxchains > 2)
1013 			ic->ic_sup_mcs[2] = 0xff;	/* MCS 16-23 */
1014 	}
1015 #endif
1016 
1017 	/* IBSS channel undefined for now. */
1018 	ic->ic_ibss_chan = &ic->ic_sup_channels[0];
1019 
1020 	ic->ic_node_newassoc = iwn_newassoc;
1021 	ic->ic_xmit = iwn_send;
1022 #ifdef IWN_HWCRYPTO
1023 	ic->ic_crypto.cs_key_set = iwn_set_key;
1024 	ic->ic_crypto.cs_key_delete = iwn_delete_key;
1025 #endif
1026 	ic->ic_wme.wme_update = iwn_wme_update;
1027 #ifndef IEEE80211_NO_HT
1028 	ic->ic_ampdu_rx_start = iwn_ampdu_rx_start;
1029 	ic->ic_ampdu_rx_stop = iwn_ampdu_rx_stop;
1030 	ic->ic_ampdu_tx_start = iwn_ampdu_tx_start;
1031 	ic->ic_ampdu_tx_stop = iwn_ampdu_tx_stop;
1032 #endif
1033 	/*
1034 	 * attach to 802.11 module
1035 	 */
1036 	ieee80211_attach(ic);
1037 
1038 	ieee80211_register_door(ic, ddi_driver_name(dip), ddi_get_instance(dip));
1039 
1040 	/* Override 802.11 state transition machine. */
1041 	sc->sc_newstate = ic->ic_newstate;
1042 	ic->ic_newstate = iwn_newstate;
1043 	ic->ic_watchdog = iwn_watchdog;
1044 
1045 	ic->ic_node_alloc = iwn_node_alloc;
1046 	ic->ic_node_free = iwn_node_free;
1047 
1048 	ieee80211_media_init(ic);
1049 
1050 	/*
1051 	 * initialize default tx key
1052 	 */
1053 	ic->ic_def_txkey = 0;
1054 
1055 	sc->amrr.amrr_min_success_threshold =  1;
1056 	sc->amrr.amrr_max_success_threshold = 15;
1057 
1058 	/*
1059 	 * Initialize pointer to device specific functions
1060 	 */
1061 	wd.wd_secalloc = WIFI_SEC_NONE;
1062 	wd.wd_opmode = ic->ic_opmode;
1063 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_macaddr);
1064 
1065 	/*
1066 	 * create relation to GLD
1067 	 */
1068 	macp = mac_alloc(MAC_VERSION);
1069 	if (NULL == macp) {
1070 		dev_err(sc->sc_dip, CE_WARN, "!mac_alloc() failed");
1071 		goto fail_mac_alloc;
1072 	}
1073 
1074 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
1075 	macp->m_driver		= sc;
1076 	macp->m_dip		= dip;
1077 	macp->m_src_addr	= ic->ic_macaddr;
1078 	macp->m_callbacks	= &iwn_m_callbacks;
1079 	macp->m_min_sdu		= 0;
1080 	macp->m_max_sdu		= IEEE80211_MTU;
1081 	macp->m_pdata		= &wd;
1082 	macp->m_pdata_size	= sizeof (wd);
1083 
1084 	/*
1085 	 * Register the macp to mac
1086 	 */
1087 	error = mac_register(macp, &ic->ic_mach);
1088 	mac_free(macp);
1089 	if (error != DDI_SUCCESS) {
1090 		dev_err(sc->sc_dip, CE_WARN, "!mac_register() failed");
1091 		goto fail_mac_alloc;
1092 	}
1093 
1094 	/*
1095 	 * Create minor node of type DDI_NT_NET_WIFI
1096 	 */
1097 	(void) snprintf(strbuf, sizeof (strbuf), "iwn%d", instance);
1098 	error = ddi_create_minor_node(dip, strbuf, S_IFCHR,
1099 	    instance + 1, DDI_NT_NET_WIFI, 0);
1100 	if (error != DDI_SUCCESS) {
1101 		dev_err(sc->sc_dip, CE_WARN, "!ddi_create_minor_node() failed");
1102 		goto fail_minor;
1103 	}
1104 
1105 	/*
1106 	 * Notify link is down now
1107 	 */
1108 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
1109 
1110 	sc->sc_periodic = ddi_periodic_add(iwn_periodic, sc,
1111 	    iwn_periodic_interval * MICROSEC, 0);
1112 
1113 	if (sc->sc_ks_misc)
1114 		kstat_install(sc->sc_ks_misc);
1115 	if (sc->sc_ks_ant)
1116 		kstat_install(sc->sc_ks_ant);
1117 	if (sc->sc_ks_sens)
1118 		kstat_install(sc->sc_ks_sens);
1119 	if (sc->sc_ks_timing)
1120 		kstat_install(sc->sc_ks_timing);
1121 	if (sc->sc_ks_edca)
1122 		kstat_install(sc->sc_ks_edca);
1123 	if (sc->sc_ks_txpower)
1124 		kstat_install(sc->sc_ks_txpower);
1125 	if (sc->sc_ks_toff)
1126 		kstat_install(sc->sc_ks_toff);
1127 
1128 	sc->sc_flags |= IWN_FLAG_ATTACHED;
1129 
1130 	return (DDI_SUCCESS);
1131 
1132 	/* Free allocated memory if something failed during attachment. */
1133 fail_minor:
1134 	mac_unregister(ic->ic_mach);
1135 
1136 fail_mac_alloc:
1137 	ieee80211_detach(ic);
1138 	iwn_free_rx_ring(sc, &sc->rxq);
1139 
1140 fail_rxring:
1141 	for (i = 0; i < sc->ntxqs; i++)
1142 		iwn_free_tx_ring(sc, &sc->txq[i]);
1143 
1144 fail_txring:
1145 	iwn_free_sched(sc);
1146 
1147 fail_sched:
1148 	if (sc->ict != NULL)
1149 		iwn_free_ict(sc);
1150 
1151 fail_ict:
1152 	iwn_free_kw(sc);
1153 
1154 fail_kw:
1155 	iwn_free_fwmem(sc);
1156 
1157 fail_fwmem:
1158 fail_hw:
1159 	iwn_intr_teardown(sc);
1160 
1161 	iwn_kstat_free(sc->sc_ks_txpower, sc->sc_txpower,
1162 	    sizeof (struct iwn_ks_txpower));
1163 
1164 	if (sc->hw_type == IWN_HW_REV_TYPE_6005)
1165 		iwn_kstat_free(sc->sc_ks_toff, sc->sc_toff.t6000,
1166 		    sizeof (struct iwn_ks_toff_6000));
1167 	else
1168 		iwn_kstat_free(sc->sc_ks_toff, sc->sc_toff.t2000,
1169 		    sizeof (struct iwn_ks_toff_2000));
1170 
1171 fail_intr:
1172 	ddi_regs_map_free(&sc->sc_regh);
1173 
1174 fail_regs_map:
1175 fail_pci_capab:
1176 	pci_config_teardown(&sc->sc_pcih);
1177 
1178 fail_pci_config:
1179 	iwn_kstat_free(sc->sc_ks_misc, sc->sc_misc,
1180 	    sizeof (struct iwn_ks_misc));
1181 	iwn_kstat_free(sc->sc_ks_ant, sc->sc_ant,
1182 	    sizeof (struct iwn_ks_ant));
1183 	iwn_kstat_free(sc->sc_ks_sens, sc->sc_sens,
1184 	    sizeof (struct iwn_ks_sens));
1185 	iwn_kstat_free(sc->sc_ks_timing, sc->sc_timing,
1186 	    sizeof (struct iwn_ks_timing));
1187 	iwn_kstat_free(sc->sc_ks_edca, sc->sc_edca,
1188 	    sizeof (struct iwn_ks_edca));
1189 
1190 	ddi_soft_state_free(iwn_state, instance);
1191 
1192 	return (DDI_FAILURE);
1193 }
1194 
1195 int
1196 iwn4965_attach(struct iwn_softc *sc)
1197 {
1198 	struct iwn_ops *ops = &sc->ops;
1199 
1200 	ops->load_firmware = iwn4965_load_firmware;
1201 	ops->read_eeprom = iwn4965_read_eeprom;
1202 	ops->post_alive = iwn4965_post_alive;
1203 	ops->nic_config = iwn4965_nic_config;
1204 	ops->config_bt_coex = iwn_config_bt_coex_bluetooth;
1205 	ops->update_sched = iwn4965_update_sched;
1206 	ops->get_temperature = iwn4965_get_temperature;
1207 	ops->get_rssi = iwn4965_get_rssi;
1208 	ops->set_txpower = iwn4965_set_txpower;
1209 	ops->init_gains = iwn4965_init_gains;
1210 	ops->set_gains = iwn4965_set_gains;
1211 	ops->add_node = iwn4965_add_node;
1212 	ops->tx_done = iwn4965_tx_done;
1213 #ifndef IEEE80211_NO_HT
1214 	ops->ampdu_tx_start = iwn4965_ampdu_tx_start;
1215 	ops->ampdu_tx_stop = iwn4965_ampdu_tx_stop;
1216 #endif
1217 	sc->ntxqs = IWN4965_NTXQUEUES;
1218 	sc->ndmachnls = IWN4965_NDMACHNLS;
1219 	sc->broadcast_id = IWN4965_ID_BROADCAST;
1220 	sc->rxonsz = IWN4965_RXONSZ;
1221 	sc->schedsz = IWN4965_SCHEDSZ;
1222 	sc->fw_text_maxsz = IWN4965_FW_TEXT_MAXSZ;
1223 	sc->fw_data_maxsz = IWN4965_FW_DATA_MAXSZ;
1224 	sc->fwsz = IWN4965_FWSZ;
1225 	sc->sched_txfact_addr = IWN4965_SCHED_TXFACT;
1226 	sc->limits = &iwn4965_sensitivity_limits;
1227 	sc->fwname = "iwlwifi-4965-2.ucode";
1228 	/* Override chains masks, ROM is known to be broken. */
1229 	sc->txchainmask = IWN_ANT_AB;
1230 	sc->rxchainmask = IWN_ANT_ABC;
1231 
1232 	iwn_kstat_create(sc, "txpower", sizeof (struct iwn_ks_txpower),
1233 	    &sc->sc_ks_txpower, (void **)&sc->sc_txpower);
1234 	iwn_kstat_init_4965(sc);
1235 
1236 	return 0;
1237 }
1238 
1239 int
1240 iwn5000_attach(struct iwn_softc *sc, uint16_t pid)
1241 {
1242 	struct iwn_ops *ops = &sc->ops;
1243 
1244 	ops->load_firmware = iwn5000_load_firmware;
1245 	ops->read_eeprom = iwn5000_read_eeprom;
1246 	ops->post_alive = iwn5000_post_alive;
1247 	ops->nic_config = iwn5000_nic_config;
1248 	ops->config_bt_coex = iwn_config_bt_coex_bluetooth;
1249 	ops->update_sched = iwn5000_update_sched;
1250 	ops->get_temperature = iwn5000_get_temperature;
1251 	ops->get_rssi = iwn5000_get_rssi;
1252 	ops->set_txpower = iwn5000_set_txpower;
1253 	ops->init_gains = iwn5000_init_gains;
1254 	ops->set_gains = iwn5000_set_gains;
1255 	ops->add_node = iwn5000_add_node;
1256 	ops->tx_done = iwn5000_tx_done;
1257 #ifndef IEEE80211_NO_HT
1258 	ops->ampdu_tx_start = iwn5000_ampdu_tx_start;
1259 	ops->ampdu_tx_stop = iwn5000_ampdu_tx_stop;
1260 #endif
1261 	sc->ntxqs = IWN5000_NTXQUEUES;
1262 	sc->ndmachnls = IWN5000_NDMACHNLS;
1263 	sc->broadcast_id = IWN5000_ID_BROADCAST;
1264 	sc->rxonsz = IWN5000_RXONSZ;
1265 	sc->schedsz = IWN5000_SCHEDSZ;
1266 	sc->fw_text_maxsz = IWN5000_FW_TEXT_MAXSZ;
1267 	sc->fw_data_maxsz = IWN5000_FW_DATA_MAXSZ;
1268 	sc->fwsz = IWN5000_FWSZ;
1269 	sc->sched_txfact_addr = IWN5000_SCHED_TXFACT;
1270 
1271 	switch (sc->hw_type) {
1272 	case IWN_HW_REV_TYPE_5100:
1273 		sc->limits = &iwn5000_sensitivity_limits;
1274 		sc->fwname = "iwlwifi-5000-2.ucode";
1275 		/* Override chains masks, ROM is known to be broken. */
1276 		sc->txchainmask = IWN_ANT_B;
1277 		sc->rxchainmask = IWN_ANT_AB;
1278 		break;
1279 	case IWN_HW_REV_TYPE_5150:
1280 		sc->limits = &iwn5150_sensitivity_limits;
1281 		sc->fwname = "iwlwifi-5150-2.ucode";
1282 		break;
1283 	case IWN_HW_REV_TYPE_5300:
1284 	case IWN_HW_REV_TYPE_5350:
1285 		sc->limits = &iwn5000_sensitivity_limits;
1286 		sc->fwname = "iwlwifi-5000-2.ucode";
1287 		break;
1288 	case IWN_HW_REV_TYPE_1000:
1289 		sc->limits = &iwn1000_sensitivity_limits;
1290 		if (pid == PCI_PRODUCT_INTEL_WIFI_LINK_100_1 ||
1291 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_100_2)
1292 			sc->fwname = "iwlwifi-100-5.ucode";
1293 		else
1294 			sc->fwname = "iwlwifi-1000-3.ucode";
1295 		break;
1296 	case IWN_HW_REV_TYPE_6000:
1297 		sc->limits = &iwn6000_sensitivity_limits;
1298 		sc->fwname = "iwlwifi-6000-4.ucode";
1299 		if (pid == PCI_PRODUCT_INTEL_WIFI_LINK_6000_IPA_1 ||
1300 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_6000_IPA_2) {
1301 			sc->sc_flags |= IWN_FLAG_INTERNAL_PA;
1302 			/* Override chains masks, ROM is known to be broken. */
1303 			sc->txchainmask = IWN_ANT_BC;
1304 			sc->rxchainmask = IWN_ANT_BC;
1305 		}
1306 		break;
1307 	case IWN_HW_REV_TYPE_6050:
1308 		sc->limits = &iwn6000_sensitivity_limits;
1309 		sc->fwname = "iwlwifi-6050-5.ucode";
1310 		break;
1311 	case IWN_HW_REV_TYPE_6005:
1312 		sc->limits = &iwn6000_sensitivity_limits;
1313 		/* Type 6030 cards return IWN_HW_REV_TYPE_6005 */
1314 		if (pid == PCI_PRODUCT_INTEL_WIFI_LINK_1030_1 ||
1315 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_1030_2 ||
1316 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_6230_1 ||
1317 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_6230_2 ||
1318 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_6235   ||
1319 		    pid == PCI_PRODUCT_INTEL_WIFI_LINK_6235_2) {
1320 			sc->fwname = "iwlwifi-6000g2b-6.ucode";
1321 			ops->config_bt_coex = iwn_config_bt_coex_adv1;
1322 		}
1323 		else
1324 			sc->fwname = "iwlwifi-6000g2a-6.ucode";
1325 
1326 		iwn_kstat_create(sc, "temp_offset",
1327 		    sizeof (struct iwn_ks_toff_6000),
1328 		    &sc->sc_ks_toff, (void **)&sc->sc_toff.t6000);
1329 		iwn_kstat_init_6000(sc);
1330 		break;
1331 	case IWN_HW_REV_TYPE_2030:
1332 		sc->limits = &iwn2000_sensitivity_limits;
1333 		sc->fwname = "iwlwifi-2030-6.ucode";
1334 		ops->config_bt_coex = iwn_config_bt_coex_adv2;
1335 
1336 		iwn_kstat_create(sc, "temp_offset",
1337 		    sizeof (struct iwn_ks_toff_2000),
1338 		    &sc->sc_ks_toff, (void **)&sc->sc_toff.t2000);
1339 		iwn_kstat_init_2000(sc);
1340 		break;
1341 	case IWN_HW_REV_TYPE_2000:
1342 		sc->limits = &iwn2000_sensitivity_limits;
1343 		sc->fwname = "iwlwifi-2000-6.ucode";
1344 
1345 		iwn_kstat_create(sc, "temp_offset",
1346 		    sizeof (struct iwn_ks_toff_2000),
1347 		    &sc->sc_ks_toff, (void **)&sc->sc_toff.t2000);
1348 		iwn_kstat_init_2000(sc);
1349 		break;
1350 	case IWN_HW_REV_TYPE_135:
1351 		sc->limits = &iwn2000_sensitivity_limits;
1352 		sc->fwname = "iwlwifi-135-6.ucode";
1353 		ops->config_bt_coex = iwn_config_bt_coex_adv2;
1354 
1355 		iwn_kstat_create(sc, "temp_offset",
1356 		    sizeof (struct iwn_ks_toff_2000),
1357 		    &sc->sc_ks_toff, (void **)&sc->sc_toff.t2000);
1358 		iwn_kstat_init_2000(sc);
1359 		break;
1360 	case IWN_HW_REV_TYPE_105:
1361 		sc->limits = &iwn2000_sensitivity_limits;
1362 		sc->fwname = "iwlwifi-105-6.ucode";
1363 
1364 		iwn_kstat_create(sc, "temp_offset",
1365 		    sizeof (struct iwn_ks_toff_2000),
1366 		    &sc->sc_ks_toff, (void **)&sc->sc_toff.t2000);
1367 		iwn_kstat_init_2000(sc);
1368 		break;
1369 	default:
1370 		dev_err(sc->sc_dip, CE_WARN, "!adapter type %d not supported",
1371 		    sc->hw_type);
1372 		return ENOTSUP;
1373 	}
1374 	return 0;
1375 }
1376 
1377 static int
1378 iwn_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
1379 {
1380 	struct iwn_softc *sc = ddi_get_driver_private(dip);
1381 	ieee80211com_t *ic = &sc->sc_ic;
1382 	int qid, error;
1383 
1384 	switch (cmd) {
1385 	case DDI_DETACH:
1386 		break;
1387 	case DDI_SUSPEND:
1388 		sc->sc_flags &= ~IWN_FLAG_HW_ERR_RECOVER;
1389 		sc->sc_flags &= ~IWN_FLAG_RATE_AUTO_CTL;
1390 
1391 		sc->sc_flags |= IWN_FLAG_SUSPEND;
1392 
1393 		if (sc->sc_flags & IWN_FLAG_RUNNING) {
1394 			iwn_hw_stop(sc, B_TRUE);
1395 			ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1396 
1397 		}
1398 
1399 		return (DDI_SUCCESS);
1400 	default:
1401 		return (DDI_FAILURE);
1402 	}
1403 
1404 	if (!(sc->sc_flags & IWN_FLAG_ATTACHED)) {
1405 		return (DDI_FAILURE);
1406 	}
1407 
1408 	error = mac_disable(ic->ic_mach);
1409 	if (error != DDI_SUCCESS)
1410 		return (error);
1411 
1412 	mutex_enter(&sc->sc_mtx);
1413 	sc->sc_flags |= IWN_FLAG_STOP_CALIB_TO;
1414 	mutex_exit(&sc->sc_mtx);
1415 
1416 	if (sc->calib_to != 0)
1417 		(void) untimeout(sc->calib_to);
1418 	sc->calib_to = 0;
1419 
1420 	if (sc->scan_to != 0)
1421 		(void) untimeout(sc->scan_to);
1422 	sc->scan_to = 0;
1423 
1424 	ddi_periodic_delete(sc->sc_periodic);
1425 
1426 	/*
1427 	 * stop chipset
1428 	 */
1429 	iwn_hw_stop(sc, B_TRUE);
1430 
1431 	/*
1432 	 * Unregister from GLD
1433 	 */
1434 	(void) mac_unregister(ic->ic_mach);
1435 	ieee80211_detach(ic);
1436 
1437 	/* Uninstall interrupt handler. */
1438 	iwn_intr_teardown(sc);
1439 
1440 	/* Free DMA resources. */
1441 	mutex_enter(&sc->sc_mtx);
1442 	iwn_free_rx_ring(sc, &sc->rxq);
1443 	for (qid = 0; qid < sc->ntxqs; qid++)
1444 		iwn_free_tx_ring(sc, &sc->txq[qid]);
1445 	iwn_free_sched(sc);
1446 	iwn_free_kw(sc);
1447 	if (sc->ict != NULL)
1448 		iwn_free_ict(sc);
1449 	iwn_free_fwmem(sc);
1450 	mutex_exit(&sc->sc_mtx);
1451 
1452 	iwn_kstat_free(sc->sc_ks_misc, sc->sc_misc,
1453 	    sizeof (struct iwn_ks_misc));
1454 	iwn_kstat_free(sc->sc_ks_ant, sc->sc_ant,
1455 	    sizeof (struct iwn_ks_ant));
1456 	iwn_kstat_free(sc->sc_ks_sens, sc->sc_sens,
1457 	    sizeof (struct iwn_ks_sens));
1458 	iwn_kstat_free(sc->sc_ks_timing, sc->sc_timing,
1459 	    sizeof (struct iwn_ks_timing));
1460 	iwn_kstat_free(sc->sc_ks_edca, sc->sc_edca,
1461 	    sizeof (struct iwn_ks_edca));
1462 	iwn_kstat_free(sc->sc_ks_txpower, sc->sc_txpower,
1463 	    sizeof (struct iwn_ks_txpower));
1464 
1465 	if (sc->hw_type == IWN_HW_REV_TYPE_6005)
1466 		iwn_kstat_free(sc->sc_ks_toff, sc->sc_toff.t6000,
1467 		    sizeof (struct iwn_ks_toff_6000));
1468 	else
1469 		iwn_kstat_free(sc->sc_ks_toff, sc->sc_toff.t2000,
1470 		    sizeof (struct iwn_ks_toff_2000));
1471 
1472 	ddi_regs_map_free(&sc->sc_regh);
1473 	pci_config_teardown(&sc->sc_pcih);
1474 	ddi_remove_minor_node(dip, NULL);
1475 	ddi_soft_state_free(iwn_state, ddi_get_instance(dip));
1476 
1477 	return 0;
1478 }
1479 
1480 static int
1481 iwn_quiesce(dev_info_t *dip)
1482 {
1483 	struct iwn_softc *sc;
1484 
1485 	sc = ddi_get_soft_state(iwn_state, ddi_get_instance(dip));
1486 	if (sc == NULL)
1487 		return (DDI_FAILURE);
1488 
1489 #ifdef IWN_DEBUG
1490 	/* bypass any messages */
1491 	iwn_dbg_print = 0;
1492 #endif
1493 
1494 	/*
1495 	 * No more blocking is allowed while we are in the
1496 	 * quiesce(9E) entry point.
1497 	 */
1498 	sc->sc_flags |= IWN_FLAG_QUIESCED;
1499 
1500 	/*
1501 	 * Disable and mask all interrupts.
1502 	 */
1503 	iwn_hw_stop(sc, B_FALSE);
1504 
1505 	return (DDI_SUCCESS);
1506 }
1507 
1508 static int
1509 iwn_nic_lock(struct iwn_softc *sc)
1510 {
1511 	int ntries;
1512 
1513 	/* Request exclusive access to NIC. */
1514 	IWN_SETBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1515 
1516 	/* Spin until we actually get the lock. */
1517 	for (ntries = 0; ntries < 1000; ntries++) {
1518 		if ((IWN_READ(sc, IWN_GP_CNTRL) &
1519 		     (IWN_GP_CNTRL_MAC_ACCESS_ENA | IWN_GP_CNTRL_SLEEP)) ==
1520 		    IWN_GP_CNTRL_MAC_ACCESS_ENA)
1521 			return 0;
1522 		DELAY(10);
1523 	}
1524 	return ETIMEDOUT;
1525 }
1526 
1527 static __inline void
1528 iwn_nic_unlock(struct iwn_softc *sc)
1529 {
1530 	IWN_CLRBITS(sc, IWN_GP_CNTRL, IWN_GP_CNTRL_MAC_ACCESS_REQ);
1531 }
1532 
1533 static __inline uint32_t
1534 iwn_prph_read(struct iwn_softc *sc, uint32_t addr)
1535 {
1536 	IWN_WRITE(sc, IWN_PRPH_RADDR, IWN_PRPH_DWORD | addr);
1537 	IWN_BARRIER_READ_WRITE(sc);
1538 	return IWN_READ(sc, IWN_PRPH_RDATA);
1539 }
1540 
1541 static __inline void
1542 iwn_prph_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1543 {
1544 	IWN_WRITE(sc, IWN_PRPH_WADDR, IWN_PRPH_DWORD | addr);
1545 	IWN_BARRIER_WRITE(sc);
1546 	IWN_WRITE(sc, IWN_PRPH_WDATA, data);
1547 }
1548 
1549 static __inline void
1550 iwn_prph_setbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1551 {
1552 	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) | mask);
1553 }
1554 
1555 static __inline void
1556 iwn_prph_clrbits(struct iwn_softc *sc, uint32_t addr, uint32_t mask)
1557 {
1558 	iwn_prph_write(sc, addr, iwn_prph_read(sc, addr) & ~mask);
1559 }
1560 
1561 static __inline void
1562 iwn_prph_write_region_4(struct iwn_softc *sc, uint32_t addr,
1563     const uint32_t *data, int count)
1564 {
1565 	for (; count > 0; count--, data++, addr += 4)
1566 		iwn_prph_write(sc, addr, *data);
1567 }
1568 
1569 static __inline uint32_t
1570 iwn_mem_read(struct iwn_softc *sc, uint32_t addr)
1571 {
1572 	IWN_WRITE(sc, IWN_MEM_RADDR, addr);
1573 	IWN_BARRIER_READ_WRITE(sc);
1574 	return IWN_READ(sc, IWN_MEM_RDATA);
1575 }
1576 
1577 static __inline void
1578 iwn_mem_write(struct iwn_softc *sc, uint32_t addr, uint32_t data)
1579 {
1580 	IWN_WRITE(sc, IWN_MEM_WADDR, addr);
1581 	IWN_BARRIER_WRITE(sc);
1582 	IWN_WRITE(sc, IWN_MEM_WDATA, data);
1583 }
1584 
1585 #ifndef IEEE80211_NO_HT
1586 static __inline void
1587 iwn_mem_write_2(struct iwn_softc *sc, uint32_t addr, uint16_t data)
1588 {
1589 	uint32_t tmp;
1590 
1591 	tmp = iwn_mem_read(sc, addr & ~3);
1592 	if (addr & 3)
1593 		tmp = (tmp & 0x0000ffff) | data << 16;
1594 	else
1595 		tmp = (tmp & 0xffff0000) | data;
1596 	iwn_mem_write(sc, addr & ~3, tmp);
1597 }
1598 #endif
1599 
1600 static __inline void
1601 iwn_mem_read_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t *data,
1602     int count)
1603 {
1604 	for (; count > 0; count--, addr += 4)
1605 		*data++ = iwn_mem_read(sc, addr);
1606 }
1607 
1608 static __inline void
1609 iwn_mem_set_region_4(struct iwn_softc *sc, uint32_t addr, uint32_t val,
1610     int count)
1611 {
1612 	for (; count > 0; count--, addr += 4)
1613 		iwn_mem_write(sc, addr, val);
1614 }
1615 
1616 static int
1617 iwn_eeprom_lock(struct iwn_softc *sc)
1618 {
1619 	int i, ntries;
1620 
1621 	for (i = 0; i < 100; i++) {
1622 		/* Request exclusive access to EEPROM. */
1623 		IWN_SETBITS(sc, IWN_HW_IF_CONFIG,
1624 		    IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1625 
1626 		/* Spin until we actually get the lock. */
1627 		for (ntries = 0; ntries < 100; ntries++) {
1628 			if (IWN_READ(sc, IWN_HW_IF_CONFIG) &
1629 			    IWN_HW_IF_CONFIG_EEPROM_LOCKED)
1630 				return 0;
1631 			DELAY(10);
1632 		}
1633 	}
1634 	return ETIMEDOUT;
1635 }
1636 
1637 static __inline void
1638 iwn_eeprom_unlock(struct iwn_softc *sc)
1639 {
1640 	IWN_CLRBITS(sc, IWN_HW_IF_CONFIG, IWN_HW_IF_CONFIG_EEPROM_LOCKED);
1641 }
1642 
1643 /*
1644  * Initialize access by host to One Time Programmable ROM.
1645  * NB: This kind of ROM can be found on 1000 or 6000 Series only.
1646  */
1647 static int
1648 iwn_init_otprom(struct iwn_softc *sc)
1649 {
1650 	uint16_t prev = 0, base, next;
1651 	int count, error;
1652 
1653 	/* Wait for clock stabilization before accessing prph. */
1654 	if ((error = iwn_clock_wait(sc)) != 0)
1655 		return error;
1656 
1657 	if ((error = iwn_nic_lock(sc)) != 0)
1658 		return error;
1659 	iwn_prph_setbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1660 	DELAY(5);
1661 	iwn_prph_clrbits(sc, IWN_APMG_PS, IWN_APMG_PS_RESET_REQ);
1662 	iwn_nic_unlock(sc);
1663 
1664 	/* Set auto clock gate disable bit for HW with OTP shadow RAM. */
1665 	if (sc->hw_type != IWN_HW_REV_TYPE_1000) {
1666 		IWN_SETBITS(sc, IWN_DBG_LINK_PWR_MGMT,
1667 		    IWN_RESET_LINK_PWR_MGMT_DIS);
1668 	}
1669 	IWN_CLRBITS(sc, IWN_EEPROM_GP, IWN_EEPROM_GP_IF_OWNER);
1670 	/* Clear ECC status. */
1671 	IWN_SETBITS(sc, IWN_OTP_GP,
1672 	    IWN_OTP_GP_ECC_CORR_STTS | IWN_OTP_GP_ECC_UNCORR_STTS);
1673 
1674 	/*
1675 	 * Find the block before last block (contains the EEPROM image)
1676 	 * for HW without OTP shadow RAM.
1677 	 */
1678 	if (sc->hw_type == IWN_HW_REV_TYPE_1000) {
1679 		/* Switch to absolute addressing mode. */
1680 		IWN_CLRBITS(sc, IWN_OTP_GP, IWN_OTP_GP_RELATIVE_ACCESS);
1681 		base = 0;
1682 		for (count = 0; count < IWN1000_OTP_NBLOCKS; count++) {
1683 			error = iwn_read_prom_data(sc, base, &next, 2);
1684 			if (error != 0)
1685 				return error;
1686 			if (next == 0)	/* End of linked-list. */
1687 				break;
1688 			prev = base;
1689 			base = le16toh(next);
1690 		}
1691 		if (count == 0 || count == IWN1000_OTP_NBLOCKS)
1692 			return EIO;
1693 		/* Skip "next" word. */
1694 		sc->prom_base = prev + 1;
1695 	}
1696 	return 0;
1697 }
1698 
1699 static int
1700 iwn_read_prom_data(struct iwn_softc *sc, uint32_t addr, void *data, int count)
1701 {
1702 	uint8_t *out = data;
1703 	uint32_t val, tmp;
1704 	int ntries;
1705 
1706 	addr += sc->prom_base;
1707 	for (; count > 0; count -= 2, addr++) {
1708 		IWN_WRITE(sc, IWN_EEPROM, addr << 2);
1709 		for (ntries = 0; ntries < 10; ntries++) {
1710 			val = IWN_READ(sc, IWN_EEPROM);
1711 			if (val & IWN_EEPROM_READ_VALID)
1712 				break;
1713 			DELAY(5);
1714 		}
1715 		if (ntries == 10) {
1716 			dev_err(sc->sc_dip, CE_WARN,
1717 			    "!timeout reading ROM at 0x%x", addr);
1718 			return ETIMEDOUT;
1719 		}
1720 		if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
1721 			/* OTPROM, check for ECC errors. */
1722 			tmp = IWN_READ(sc, IWN_OTP_GP);
1723 			if (tmp & IWN_OTP_GP_ECC_UNCORR_STTS) {
1724 				dev_err(sc->sc_dip, CE_WARN,
1725 				    "!OTPROM ECC error at 0x%x", addr);
1726 				return EIO;
1727 			}
1728 			if (tmp & IWN_OTP_GP_ECC_CORR_STTS) {
1729 				/* Correctable ECC error, clear bit. */
1730 				IWN_SETBITS(sc, IWN_OTP_GP,
1731 				    IWN_OTP_GP_ECC_CORR_STTS);
1732 			}
1733 		}
1734 		*out++ = val >> 16;
1735 		if (count > 1)
1736 			*out++ = val >> 24;
1737 	}
1738 	return 0;
1739 }
1740 
1741 static int
1742 iwn_dma_contig_alloc(struct iwn_softc *sc, struct iwn_dma_info *dma,
1743     uint_t size, uint_t flags, void **kvap, ddi_device_acc_attr_t *acc_attr,
1744     uint_t align)
1745 {
1746 	ddi_dma_attr_t dma_attr = {
1747 		.dma_attr_version	= DMA_ATTR_V0,
1748 		.dma_attr_addr_lo	= 0,
1749 		.dma_attr_addr_hi	= 0xfffffffffULL,
1750 		.dma_attr_count_max	= 0xfffffffffULL,
1751 		.dma_attr_align		= align,
1752 		.dma_attr_burstsizes	= 0x7ff,
1753 		.dma_attr_minxfer	= 1,
1754 		.dma_attr_maxxfer	= 0xfffffffffULL,
1755 		.dma_attr_seg		= 0xfffffffffULL,
1756 		.dma_attr_sgllen	= 1,
1757 		.dma_attr_granular	= 1,
1758 		.dma_attr_flags		= 0,
1759 	};
1760 	int error;
1761 
1762 	error = ddi_dma_alloc_handle(sc->sc_dip, &dma_attr, DDI_DMA_SLEEP, NULL,
1763 	    &dma->dma_hdl);
1764 	if (error != DDI_SUCCESS) {
1765 		dev_err(sc->sc_dip, CE_WARN,
1766 		    "ddi_dma_alloc_handle() failed, error = %d", error);
1767 		goto fail;
1768 	}
1769 
1770 	error = ddi_dma_mem_alloc(dma->dma_hdl, size, acc_attr,
1771 	    flags & (DDI_DMA_CONSISTENT | DDI_DMA_STREAMING), DDI_DMA_SLEEP, 0,
1772 	    &dma->vaddr, &dma->length, &dma->acc_hdl);
1773 	if (error != DDI_SUCCESS) {
1774 		dev_err(sc->sc_dip, CE_WARN,
1775 		    "ddi_dma_mem_alloc() failed, error = %d", error);
1776 		goto fail2;
1777 	}
1778 
1779 	bzero(dma->vaddr, dma->length);
1780 
1781 	error = ddi_dma_addr_bind_handle(dma->dma_hdl, NULL, dma->vaddr,
1782 	    dma->length, flags, DDI_DMA_SLEEP, NULL, &dma->cookie,
1783 	    &dma->ncookies);
1784 	if (error != DDI_DMA_MAPPED) {
1785 		dma->ncookies = 0;
1786 		dev_err(sc->sc_dip, CE_WARN,
1787 		    "ddi_dma_addr_bind_handle() failed, error = %d", error);
1788 		goto fail3;
1789 	}
1790 
1791 	dma->size = size;
1792 	dma->paddr = dma->cookie.dmac_laddress;
1793 
1794 	if (kvap != NULL)
1795 		*kvap = (void *)dma->vaddr;
1796 
1797 	return (DDI_SUCCESS);
1798 
1799 fail3:
1800 	ddi_dma_mem_free(&dma->acc_hdl);
1801 fail2:
1802 	ddi_dma_free_handle(&dma->dma_hdl);
1803 fail:
1804 	bzero(dma, sizeof (struct iwn_dma_info));
1805 	return (DDI_FAILURE);
1806 }
1807 
1808 static void
1809 iwn_dma_contig_free(struct iwn_dma_info *dma)
1810 {
1811 	if (dma->dma_hdl != NULL) {
1812 		if (dma->ncookies)
1813 			(void) ddi_dma_unbind_handle(dma->dma_hdl);
1814 		ddi_dma_free_handle(&dma->dma_hdl);
1815 	}
1816 
1817 	if (dma->acc_hdl != NULL)
1818 		ddi_dma_mem_free(&dma->acc_hdl);
1819 
1820 	bzero(dma, sizeof (struct iwn_dma_info));
1821 }
1822 
1823 static int
1824 iwn_alloc_sched(struct iwn_softc *sc)
1825 {
1826 	/* TX scheduler rings must be aligned on a 1KB boundary. */
1827 
1828 	return iwn_dma_contig_alloc(sc, &sc->sched_dma, sc->schedsz,
1829 	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, (void **)&sc->sched,
1830 	    &iwn_dma_accattr, 1024);
1831 }
1832 
1833 static void
1834 iwn_free_sched(struct iwn_softc *sc)
1835 {
1836 	iwn_dma_contig_free(&sc->sched_dma);
1837 }
1838 
1839 static int
1840 iwn_alloc_kw(struct iwn_softc *sc)
1841 {
1842 	/* "Keep Warm" page must be aligned on a 4KB boundary. */
1843 
1844 	return iwn_dma_contig_alloc(sc, &sc->kw_dma, IWN_KW_SIZE,
1845 	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, NULL, &iwn_dma_accattr, 4096);
1846 }
1847 
1848 static void
1849 iwn_free_kw(struct iwn_softc *sc)
1850 {
1851 	iwn_dma_contig_free(&sc->kw_dma);
1852 }
1853 
1854 static int
1855 iwn_alloc_ict(struct iwn_softc *sc)
1856 {
1857 	/* ICT table must be aligned on a 4KB boundary. */
1858 
1859 	return iwn_dma_contig_alloc(sc, &sc->ict_dma, IWN_ICT_SIZE,
1860 	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, (void **)&sc->ict,
1861 	    &iwn_dma_descattr, 4096);
1862 }
1863 
1864 static void
1865 iwn_free_ict(struct iwn_softc *sc)
1866 {
1867 	iwn_dma_contig_free(&sc->ict_dma);
1868 }
1869 
1870 static int
1871 iwn_alloc_fwmem(struct iwn_softc *sc)
1872 {
1873 	/* Must be aligned on a 16-byte boundary. */
1874 	return iwn_dma_contig_alloc(sc, &sc->fw_dma, sc->fwsz,
1875 	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, NULL, &iwn_dma_accattr, 16);
1876 }
1877 
1878 static void
1879 iwn_free_fwmem(struct iwn_softc *sc)
1880 {
1881 	iwn_dma_contig_free(&sc->fw_dma);
1882 }
1883 
1884 static int
1885 iwn_alloc_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1886 {
1887 	size_t size;
1888 	int i, error;
1889 
1890 	ring->cur = 0;
1891 
1892 	/* Allocate RX descriptors (256-byte aligned). */
1893 	size = IWN_RX_RING_COUNT * sizeof (uint32_t);
1894 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma, size,
1895 	    DDI_DMA_CONSISTENT | DDI_DMA_RDWR, (void **)&ring->desc,
1896 	    &iwn_dma_descattr, 256);
1897 	if (error != DDI_SUCCESS) {
1898 		dev_err(sc->sc_dip, CE_WARN,
1899 		    "!could not allocate RX ring DMA memory");
1900 		goto fail;
1901 	}
1902 
1903 	/* Allocate RX status area (16-byte aligned). */
1904 	error = iwn_dma_contig_alloc(sc, &ring->stat_dma,
1905 	    sizeof (struct iwn_rx_status), DDI_DMA_CONSISTENT | DDI_DMA_RDWR,
1906 	    (void **)&ring->stat, &iwn_dma_descattr, 16);
1907 	if (error != DDI_SUCCESS) {
1908 		dev_err(sc->sc_dip, CE_WARN,
1909 		    "!could not allocate RX status DMA memory");
1910 		goto fail;
1911 	}
1912 
1913 	/*
1914 	 * Allocate and map RX buffers.
1915 	 */
1916 	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1917 		struct iwn_rx_data *data = &ring->data[i];
1918 
1919 		error = iwn_dma_contig_alloc(sc, &data->dma_data, IWN_RBUF_SIZE,
1920 		    DDI_DMA_CONSISTENT | DDI_DMA_READ, NULL, &iwn_dma_accattr,
1921 		    256);
1922 		if (error != DDI_SUCCESS) {
1923 			dev_err(sc->sc_dip, CE_WARN,
1924 			    "!could not create RX buf DMA map");
1925 			goto fail;
1926 		}
1927 
1928 		/* Set physical address of RX buffer (256-byte aligned). */
1929 		ring->desc[i] = htole32(data->dma_data.paddr >> 8);
1930 	}
1931 
1932 	(void) ddi_dma_sync(ring->desc_dma.dma_hdl, 0, 0, DDI_DMA_SYNC_FORDEV);
1933 
1934 	return 0;
1935 
1936 fail:	iwn_free_rx_ring(sc, ring);
1937 	return error;
1938 }
1939 
1940 static void
1941 iwn_reset_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1942 {
1943 	int ntries;
1944 
1945 	if (iwn_nic_lock(sc) == 0) {
1946 		IWN_WRITE(sc, IWN_FH_RX_CONFIG, 0);
1947 		for (ntries = 0; ntries < 1000; ntries++) {
1948 			if (IWN_READ(sc, IWN_FH_RX_STATUS) &
1949 			    IWN_FH_RX_STATUS_IDLE)
1950 				break;
1951 			DELAY(10);
1952 		}
1953 		iwn_nic_unlock(sc);
1954 	}
1955 	ring->cur = 0;
1956 	sc->last_rx_valid = 0;
1957 }
1958 
1959 static void
1960 iwn_free_rx_ring(struct iwn_softc *sc, struct iwn_rx_ring *ring)
1961 {
1962 	_NOTE(ARGUNUSED(sc));
1963 	int i;
1964 
1965 	iwn_dma_contig_free(&ring->desc_dma);
1966 	iwn_dma_contig_free(&ring->stat_dma);
1967 
1968 	for (i = 0; i < IWN_RX_RING_COUNT; i++) {
1969 		struct iwn_rx_data *data = &ring->data[i];
1970 
1971 		if (data->dma_data.dma_hdl)
1972 			iwn_dma_contig_free(&data->dma_data);
1973 	}
1974 }
1975 
1976 static int
1977 iwn_alloc_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring, int qid)
1978 {
1979 	uintptr_t paddr;
1980 	size_t size;
1981 	int i, error;
1982 
1983 	ring->qid = qid;
1984 	ring->queued = 0;
1985 	ring->cur = 0;
1986 
1987 	/* Allocate TX descriptors (256-byte aligned). */
1988 	size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_desc);
1989 	error = iwn_dma_contig_alloc(sc, &ring->desc_dma, size,
1990 	    DDI_DMA_CONSISTENT | DDI_DMA_WRITE, (void **)&ring->desc,
1991 	    &iwn_dma_descattr, 256);
1992 	if (error != DDI_SUCCESS) {
1993 		dev_err(sc->sc_dip, CE_WARN,
1994 		    "!could not allocate TX ring DMA memory");
1995 		goto fail;
1996 	}
1997 	/*
1998 	 * We only use rings 0 through 4 (4 EDCA + cmd) so there is no need
1999 	 * to allocate commands space for other rings.
2000 	 * XXX Do we really need to allocate descriptors for other rings?
2001 	 */
2002 	if (qid > 4)
2003 		return 0;
2004 
2005 	size = IWN_TX_RING_COUNT * sizeof (struct iwn_tx_cmd);
2006 	error = iwn_dma_contig_alloc(sc, &ring->cmd_dma, size,
2007 	    DDI_DMA_CONSISTENT | DDI_DMA_WRITE, (void **)&ring->cmd,
2008 	    &iwn_dma_accattr, 4);
2009 	if (error != DDI_SUCCESS) {
2010 		dev_err(sc->sc_dip, CE_WARN,
2011 		    "!could not allocate TX cmd DMA memory");
2012 		goto fail;
2013 	}
2014 
2015 	paddr = ring->cmd_dma.paddr;
2016 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2017 		struct iwn_tx_data *data = &ring->data[i];
2018 
2019 		data->cmd_paddr = paddr;
2020 		data->scratch_paddr = paddr + 12;
2021 		paddr += sizeof (struct iwn_tx_cmd);
2022 
2023 		error = iwn_dma_contig_alloc(sc, &data->dma_data, IWN_TBUF_SIZE,
2024 		    DDI_DMA_CONSISTENT | DDI_DMA_WRITE, NULL, &iwn_dma_accattr,
2025 		    256);
2026 		if (error != DDI_SUCCESS) {
2027 			dev_err(sc->sc_dip, CE_WARN,
2028 			    "!could not create TX buf DMA map");
2029 			goto fail;
2030 		}
2031 	}
2032 	return 0;
2033 
2034 fail:	iwn_free_tx_ring(sc, ring);
2035 	return error;
2036 }
2037 
2038 static void
2039 iwn_reset_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2040 {
2041 	int i;
2042 
2043 	if (ring->qid < 4)
2044 		for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2045 			struct iwn_tx_data *data = &ring->data[i];
2046 
2047 			(void) ddi_dma_sync(data->dma_data.dma_hdl, 0, 0,
2048 			    DDI_DMA_SYNC_FORDEV);
2049 		}
2050 
2051 	/* Clear TX descriptors. */
2052 	memset(ring->desc, 0, ring->desc_dma.size);
2053 	(void) ddi_dma_sync(ring->desc_dma.dma_hdl, 0, 0, DDI_DMA_SYNC_FORDEV);
2054 	sc->qfullmsk &= ~(1 << ring->qid);
2055 	ring->queued = 0;
2056 	ring->cur = 0;
2057 }
2058 
2059 static void
2060 iwn_free_tx_ring(struct iwn_softc *sc, struct iwn_tx_ring *ring)
2061 {
2062 	_NOTE(ARGUNUSED(sc));
2063 	int i;
2064 
2065 	iwn_dma_contig_free(&ring->desc_dma);
2066 	iwn_dma_contig_free(&ring->cmd_dma);
2067 
2068 	for (i = 0; i < IWN_TX_RING_COUNT; i++) {
2069 		struct iwn_tx_data *data = &ring->data[i];
2070 
2071 		if (data->dma_data.dma_hdl)
2072 			iwn_dma_contig_free(&data->dma_data);
2073 	}
2074 }
2075 
2076 static void
2077 iwn5000_ict_reset(struct iwn_softc *sc)
2078 {
2079 	/* Disable interrupts. */
2080 	IWN_WRITE(sc, IWN_INT_MASK, 0);
2081 
2082 	/* Reset ICT table. */
2083 	memset(sc->ict, 0, IWN_ICT_SIZE);
2084 	sc->ict_cur = 0;
2085 
2086 	/* Set physical address of ICT table (4KB aligned). */
2087 	IWN_WRITE(sc, IWN_DRAM_INT_TBL, IWN_DRAM_INT_TBL_ENABLE |
2088 	    IWN_DRAM_INT_TBL_WRAP_CHECK | sc->ict_dma.paddr >> 12);
2089 
2090 	/* Enable periodic RX interrupt. */
2091 	sc->int_mask |= IWN_INT_RX_PERIODIC;
2092 	/* Switch to ICT interrupt mode in driver. */
2093 	sc->sc_flags |= IWN_FLAG_USE_ICT;
2094 
2095 	/* Re-enable interrupts. */
2096 	IWN_WRITE(sc, IWN_INT, 0xffffffff);
2097 	IWN_WRITE(sc, IWN_INT_MASK, sc->int_mask);
2098 }
2099 
2100 static int
2101 iwn_read_eeprom(struct iwn_softc *sc)
2102 {
2103 	struct iwn_ops *ops = &sc->ops;
2104 	struct ieee80211com *ic = &sc->sc_ic;
2105 	uint16_t val;
2106 	int error;
2107 
2108 	/* Check whether adapter has an EEPROM or an OTPROM. */
2109 	if (sc->hw_type >= IWN_HW_REV_TYPE_1000 &&
2110 	    (IWN_READ(sc, IWN_OTP_GP) & IWN_OTP_GP_DEV_SEL_OTP))
2111 		sc->sc_flags |= IWN_FLAG_HAS_OTPROM;
2112 	IWN_DBG("%s found",
2113 	    (sc->sc_flags & IWN_FLAG_HAS_OTPROM) ? "OTPROM" : "EEPROM");
2114 
2115 	/* Adapter has to be powered on for EEPROM access to work. */
2116 	if ((error = iwn_apm_init(sc)) != 0) {
2117 		dev_err(sc->sc_dip, CE_WARN,
2118 		    "!could not power ON adapter");
2119 		return error;
2120 	}
2121 
2122 	if ((IWN_READ(sc, IWN_EEPROM_GP) & 0x7) == 0) {
2123 		dev_err(sc->sc_dip, CE_WARN,
2124 		    "!bad ROM signature");
2125 		return EIO;
2126 	}
2127 	if ((error = iwn_eeprom_lock(sc)) != 0) {
2128 		dev_err(sc->sc_dip, CE_WARN,
2129 		    "!could not lock ROM (error=%d)", error);
2130 		return error;
2131 	}
2132 	if (sc->sc_flags & IWN_FLAG_HAS_OTPROM) {
2133 		if ((error = iwn_init_otprom(sc)) != 0) {
2134 			dev_err(sc->sc_dip, CE_WARN,
2135 			    "!could not initialize OTPROM");
2136 			return error;
2137 		}
2138 	}
2139 
2140 	iwn_read_prom_data(sc, IWN_EEPROM_SKU_CAP, &val, 2);
2141 	IWN_DBG("SKU capabilities=0x%04x", le16toh(val));
2142 	/* Check if HT support is bonded out. */
2143 	if (val & htole16(IWN_EEPROM_SKU_CAP_11N))
2144 		sc->sc_flags |= IWN_FLAG_HAS_11N;
2145 
2146 	iwn_read_prom_data(sc, IWN_EEPROM_RFCFG, &val, 2);
2147 	sc->rfcfg = le16toh(val);
2148 	IWN_DBG("radio config=0x%04x", sc->rfcfg);
2149 	/* Read Tx/Rx chains from ROM unless it's known to be broken. */
2150 	if (sc->txchainmask == 0)
2151 		sc->txchainmask = IWN_RFCFG_TXANTMSK(sc->rfcfg);
2152 	if (sc->rxchainmask == 0)
2153 		sc->rxchainmask = IWN_RFCFG_RXANTMSK(sc->rfcfg);
2154 
2155 	/* Read MAC address. */
2156 	iwn_read_prom_data(sc, IWN_EEPROM_MAC, ic->ic_macaddr, 6);
2157 
2158 	/* Read adapter-specific information from EEPROM. */
2159 	ops->read_eeprom(sc);
2160 
2161 	iwn_apm_stop(sc);	/* Power OFF adapter. */
2162 
2163 	iwn_eeprom_unlock(sc);
2164 	return 0;
2165 }
2166 
2167 static void
2168 iwn4965_read_eeprom(struct iwn_softc *sc)
2169 {
2170 	uint32_t addr;
2171 	uint16_t val;
2172 	int i;
2173 
2174 	/* Read regulatory domain (4 ASCII characters). */
2175 	iwn_read_prom_data(sc, IWN4965_EEPROM_DOMAIN, sc->eeprom_domain, 4);
2176 
2177 	/* Read the list of authorized channels (20MHz ones only). */
2178 	for (i = 0; i < 5; i++) {
2179 		addr = iwn4965_regulatory_bands[i];
2180 		iwn_read_eeprom_channels(sc, i, addr);
2181 	}
2182 
2183 	/* Read maximum allowed TX power for 2GHz and 5GHz bands. */
2184 	iwn_read_prom_data(sc, IWN4965_EEPROM_MAXPOW, &val, 2);
2185 	sc->maxpwr2GHz = val & 0xff;
2186 	sc->maxpwr5GHz = val >> 8;
2187 	/* Check that EEPROM values are within valid range. */
2188 	if (sc->maxpwr5GHz < 20 || sc->maxpwr5GHz > 50)
2189 		sc->maxpwr5GHz = 38;
2190 	if (sc->maxpwr2GHz < 20 || sc->maxpwr2GHz > 50)
2191 		sc->maxpwr2GHz = 38;
2192 	IWN_DBG("maxpwr 2GHz=%d 5GHz=%d", sc->maxpwr2GHz, sc->maxpwr5GHz);
2193 
2194 	/* Read samples for each TX power group. */
2195 	iwn_read_prom_data(sc, IWN4965_EEPROM_BANDS, sc->bands,
2196 	    sizeof sc->bands);
2197 
2198 	/* Read voltage at which samples were taken. */
2199 	iwn_read_prom_data(sc, IWN4965_EEPROM_VOLTAGE, &val, 2);
2200 	sc->eeprom_voltage = (int16_t)le16toh(val);
2201 	IWN_DBG("voltage=%d (in 0.3V)", sc->eeprom_voltage);
2202 
2203 #ifdef IWN_DEBUG
2204 	/* Print samples. */
2205 	if (iwn_dbg_print != 0) {
2206 		for (i = 0; i < IWN_NBANDS; i++)
2207 			iwn4965_print_power_group(sc, i);
2208 	}
2209 #endif
2210 }
2211 
2212 #ifdef IWN_DEBUG
2213 static void
2214 iwn4965_print_power_group(struct iwn_softc *sc, int i)
2215 {
2216 	struct iwn4965_eeprom_band *band = &sc->bands[i];
2217 	struct iwn4965_eeprom_chan_samples *chans = band->chans;
2218 	int j, c;
2219 
2220 	dev_err(sc->sc_dip, CE_CONT, "!===band %d===", i);
2221 	dev_err(sc->sc_dip, CE_CONT, "!chan lo=%d, chan hi=%d", band->lo,
2222 	    band->hi);
2223 	dev_err(sc->sc_dip, CE_CONT,  "!chan1 num=%d", chans[0].num);
2224 	for (c = 0; c < 2; c++) {
2225 		for (j = 0; j < IWN_NSAMPLES; j++) {
2226 			dev_err(sc->sc_dip, CE_CONT, "!chain %d, sample %d: "
2227 			    "temp=%d gain=%d power=%d pa_det=%d", c, j,
2228 			    chans[0].samples[c][j].temp,
2229 			    chans[0].samples[c][j].gain,
2230 			    chans[0].samples[c][j].power,
2231 			    chans[0].samples[c][j].pa_det);
2232 		}
2233 	}
2234 	dev_err(sc->sc_dip, CE_CONT, "!chan2 num=%d", chans[1].num);
2235 	for (c = 0; c < 2; c++) {
2236 		for (j = 0; j < IWN_NSAMPLES; j++) {
2237 			dev_err(sc->sc_dip, CE_CONT, "!chain %d, sample %d: "
2238 			    "temp=%d gain=%d power=%d pa_det=%d", c, j,
2239 			    chans[1].samples[c][j].temp,
2240 			    chans[1].samples[c][j].gain,
2241 			    chans[1].samples[c][j].power,
2242 			    chans[1].samples[c][j].pa_det);
2243 		}
2244 	}
2245 }
2246 #endif
2247 
2248 static void
2249 iwn5000_read_eeprom(struct iwn_softc *sc)
2250 {
2251 	struct iwn5000_eeprom_calib_hdr hdr;
2252 	int32_t volt;
2253 	uint32_t base, addr;
2254 	uint16_t val;
2255 	int i;
2256 
2257 	/* Read regulatory domain (4 ASCII characters). */
2258 	iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2259 	base = le16toh(val);
2260 	iwn_read_prom_data(sc, base + IWN5000_EEPROM_DOMAIN,
2261 	    sc->eeprom_domain, 4);
2262 
2263 	/* Read the list of authorized channels (20MHz ones only). */
2264 	for (i = 0; i < 5; i++) {
2265 		addr = base + iwn5000_regulatory_bands[i];
2266 		iwn_read_eeprom_channels(sc, i, addr);
2267 	}
2268 
2269 	/* Read enhanced TX power information for 6000 Series. */
2270 	if (sc->hw_type >= IWN_HW_REV_TYPE_6000)
2271 		iwn_read_eeprom_enhinfo(sc);
2272 
2273 	iwn_read_prom_data(sc, IWN5000_EEPROM_CAL, &val, 2);
2274 	base = le16toh(val);
2275 	iwn_read_prom_data(sc, base, &hdr, sizeof hdr);
2276 	IWN_DBG("calib version=%u pa type=%u voltage=%u",
2277 	    hdr.version, hdr.pa_type, le16toh(hdr.volt));
2278 	sc->calib_ver = hdr.version;
2279 
2280 	if (sc->hw_type == IWN_HW_REV_TYPE_2030 ||
2281 	    sc->hw_type == IWN_HW_REV_TYPE_2000 ||
2282 	    sc->hw_type == IWN_HW_REV_TYPE_135  ||
2283 	    sc->hw_type == IWN_HW_REV_TYPE_105) {
2284 		sc->eeprom_voltage = le16toh(hdr.volt);
2285 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2286 		sc->eeprom_temp = le16toh(val);
2287 		iwn_read_prom_data(sc, base + IWN2000_EEPROM_RAWTEMP, &val, 2);
2288 		sc->eeprom_rawtemp = le16toh(val);
2289 	}
2290 
2291 	if (sc->hw_type == IWN_HW_REV_TYPE_5150) {
2292 		/* Compute temperature offset. */
2293 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_TEMP, &val, 2);
2294 		sc->eeprom_temp = le16toh(val);
2295 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_VOLT, &val, 2);
2296 		volt = le16toh(val);
2297 		sc->temp_off = sc->eeprom_temp - (volt / -5);
2298 		IWN_DBG("temp=%d volt=%d offset=%dK",
2299 		    sc->eeprom_temp, volt, sc->temp_off);
2300 	} else {
2301 		/* Read crystal calibration. */
2302 		iwn_read_prom_data(sc, base + IWN5000_EEPROM_CRYSTAL,
2303 		    &sc->eeprom_crystal, sizeof (uint32_t));
2304 		IWN_DBG("crystal calibration 0x%08x",
2305 		    le32toh(sc->eeprom_crystal));
2306 	}
2307 }
2308 
2309 static void
2310 iwn_read_eeprom_channels(struct iwn_softc *sc, int n, uint32_t addr)
2311 {
2312 	struct ieee80211com *ic = &sc->sc_ic;
2313 	const struct iwn_chan_band *band = &iwn_bands[n];
2314 	struct iwn_eeprom_chan channels[IWN_MAX_CHAN_PER_BAND];
2315 	uint8_t chan;
2316 	int i;
2317 
2318 	iwn_read_prom_data(sc, addr, channels,
2319 	    band->nchan * sizeof (struct iwn_eeprom_chan));
2320 
2321 	for (i = 0; i < band->nchan; i++) {
2322 		if (!(channels[i].flags & IWN_EEPROM_CHAN_VALID))
2323 			continue;
2324 
2325 		chan = band->chan[i];
2326 
2327 		if (n == 0) {	/* 2GHz band */
2328 			ic->ic_sup_channels[chan].ich_freq =
2329 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
2330 			ic->ic_sup_channels[chan].ich_flags =
2331 			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2332 			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2333 
2334 		} else {	/* 5GHz band */
2335 			/*
2336 			 * Some adapters support channels 7, 8, 11 and 12
2337 			 * both in the 2GHz and 4.9GHz bands.
2338 			 * Because of limitations in our net80211 layer,
2339 			 * we don't support them in the 4.9GHz band.
2340 			 */
2341 			if (chan <= 14)
2342 				continue;
2343 
2344 			ic->ic_sup_channels[chan].ich_freq =
2345 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
2346 			ic->ic_sup_channels[chan].ich_flags =
2347 			    IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM;
2348 			/* We have at least one valid 5GHz channel. */
2349 			sc->sc_flags |= IWN_FLAG_HAS_5GHZ;
2350 		}
2351 
2352 		/* Is active scan allowed on this channel? */
2353 		if (!(channels[i].flags & IWN_EEPROM_CHAN_ACTIVE)) {
2354 			ic->ic_sup_channels[chan].ich_flags |=
2355 			    IEEE80211_CHAN_PASSIVE;
2356 		}
2357 
2358 		/* Save maximum allowed TX power for this channel. */
2359 		sc->maxpwr[chan] = channels[i].maxpwr;
2360 
2361 		IWN_DBG("adding chan %d flags=0x%x maxpwr=%d",
2362 		    chan, channels[i].flags, sc->maxpwr[chan]);
2363 	}
2364 }
2365 
2366 static void
2367 iwn_read_eeprom_enhinfo(struct iwn_softc *sc)
2368 {
2369 	struct iwn_eeprom_enhinfo enhinfo[35];
2370 	uint16_t val, base;
2371 	int8_t maxpwr;
2372 	int i;
2373 
2374 	iwn_read_prom_data(sc, IWN5000_EEPROM_REG, &val, 2);
2375 	base = le16toh(val);
2376 	iwn_read_prom_data(sc, base + IWN6000_EEPROM_ENHINFO,
2377 	    enhinfo, sizeof enhinfo);
2378 
2379 	memset(sc->enh_maxpwr, 0, sizeof sc->enh_maxpwr);
2380 	for (i = 0; i < __arraycount(enhinfo); i++) {
2381 		if (enhinfo[i].chan == 0 || enhinfo[i].reserved != 0)
2382 			continue;	/* Skip invalid entries. */
2383 
2384 		maxpwr = 0;
2385 		if (sc->txchainmask & IWN_ANT_A)
2386 			maxpwr = MAX(maxpwr, enhinfo[i].chain[0]);
2387 		if (sc->txchainmask & IWN_ANT_B)
2388 			maxpwr = MAX(maxpwr, enhinfo[i].chain[1]);
2389 		if (sc->txchainmask & IWN_ANT_C)
2390 			maxpwr = MAX(maxpwr, enhinfo[i].chain[2]);
2391 		if (sc->ntxchains == 2)
2392 			maxpwr = MAX(maxpwr, enhinfo[i].mimo2);
2393 		else if (sc->ntxchains == 3)
2394 			maxpwr = MAX(maxpwr, enhinfo[i].mimo3);
2395 		maxpwr /= 2;	/* Convert half-dBm to dBm. */
2396 
2397 		IWN_DBG("enhinfo %d, maxpwr=%d", i, maxpwr);
2398 		sc->enh_maxpwr[i] = maxpwr;
2399 	}
2400 }
2401 
2402 static struct ieee80211_node *
2403 iwn_node_alloc(ieee80211com_t *ic)
2404 {
2405 	_NOTE(ARGUNUSED(ic));
2406 	return (kmem_zalloc(sizeof (struct iwn_node), KM_NOSLEEP));
2407 }
2408 
2409 static void
2410 iwn_node_free(ieee80211_node_t *in)
2411 {
2412 	ASSERT(in != NULL);
2413 	ASSERT(in->in_ic != NULL);
2414 
2415 	if (in->in_wpa_ie != NULL)
2416 		ieee80211_free(in->in_wpa_ie);
2417 
2418 	if (in->in_wme_ie != NULL)
2419 		ieee80211_free(in->in_wme_ie);
2420 
2421 	if (in->in_htcap_ie != NULL)
2422 		ieee80211_free(in->in_htcap_ie);
2423 
2424 	kmem_free(in, sizeof (struct iwn_node));
2425 }
2426 
2427 static void
2428 iwn_newassoc(struct ieee80211_node *ni, int isnew)
2429 {
2430 	_NOTE(ARGUNUSED(isnew));
2431 	struct iwn_softc *sc = (struct iwn_softc *)&ni->in_ic;
2432 	struct iwn_node *wn = (void *)ni;
2433 	uint8_t rate, ridx;
2434 	int i;
2435 
2436 	ieee80211_amrr_node_init(&sc->amrr, &wn->amn);
2437 	/*
2438 	 * Select a medium rate and depend on AMRR to raise/lower it.
2439 	 */
2440 	ni->in_txrate = ni->in_rates.ir_nrates / 2;
2441 
2442 	for (i = 0; i < ni->in_rates.ir_nrates; i++) {
2443 		rate = ni->in_rates.ir_rates[i] & IEEE80211_RATE_VAL;
2444 		/* Map 802.11 rate to HW rate index. */
2445 		for (ridx = 0; ridx <= IWN_RIDX_MAX; ridx++)
2446 			if (iwn_rates[ridx].rate == rate)
2447 				break;
2448 		wn->ridx[i] = ridx;
2449 	}
2450 }
2451 
2452 static int
2453 iwn_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2454 {
2455 	struct iwn_softc *sc = (struct iwn_softc *)ic;
2456 	enum ieee80211_state ostate;
2457 	int error;
2458 
2459 	mutex_enter(&sc->sc_mtx);
2460 	sc->sc_flags |= IWN_FLAG_STOP_CALIB_TO;
2461 	mutex_exit(&sc->sc_mtx);
2462 
2463 	(void) untimeout(sc->calib_to);
2464 	sc->calib_to = 0;
2465 
2466 	mutex_enter(&sc->sc_mtx);
2467 	ostate = ic->ic_state;
2468 
2469 	DTRACE_PROBE5(new__state, int, sc->sc_flags,
2470 	    enum ieee80211_state, ostate,
2471 	    const char *, ieee80211_state_name[ostate],
2472 	    enum ieee80211_state, nstate,
2473 	    const char *, ieee80211_state_name[nstate]);
2474 
2475 	if ((sc->sc_flags & IWN_FLAG_RADIO_OFF) && nstate != IEEE80211_S_INIT) {
2476 		mutex_exit(&sc->sc_mtx);
2477 		return (IWN_FAIL);
2478 	}
2479 
2480 	if (!(sc->sc_flags & IWN_FLAG_HW_INITED) &&
2481 	    nstate != IEEE80211_S_INIT) {
2482 		mutex_exit(&sc->sc_mtx);
2483 		return (IWN_FAIL);
2484 	}
2485 
2486 	switch (nstate) {
2487 	case IEEE80211_S_SCAN:
2488 		/* XXX Do not abort a running scan. */
2489 		if (sc->sc_flags & IWN_FLAG_SCANNING) {
2490 			if (ostate != nstate)
2491 				dev_err(sc->sc_dip, CE_WARN, "!scan request(%d)"
2492 				    " while scanning(%d) ignored", nstate,
2493 				    ostate);
2494 			mutex_exit(&sc->sc_mtx);
2495 			return (0);
2496 		}
2497 
2498 		bcopy(&sc->rxon, &sc->rxon_save, sizeof (sc->rxon));
2499 		sc->sc_ostate = ostate;
2500 
2501 		/* XXX Not sure if call and flags are needed. */
2502 		ieee80211_node_table_reset(&ic->ic_scan);
2503 		ic->ic_flags |= IEEE80211_F_SCAN | IEEE80211_F_ASCAN;
2504 		sc->sc_flags |= IWN_FLAG_SCANNING_2GHZ;
2505 
2506 		/* Make the link LED blink while we're scanning. */
2507 		iwn_set_led(sc, IWN_LED_LINK, 10, 10);
2508 
2509 		ic->ic_state = nstate;
2510 
2511 		error = iwn_scan(sc, IEEE80211_CHAN_2GHZ);
2512 		if (error != 0) {
2513 			dev_err(sc->sc_dip, CE_WARN,
2514 			    "!could not initiate scan");
2515 			sc->sc_flags &= ~IWN_FLAG_SCANNING;
2516 			mutex_exit(&sc->sc_mtx);
2517 			return (error);
2518 		}
2519 
2520 		mutex_exit(&sc->sc_mtx);
2521 		sc->scan_to = timeout(iwn_abort_scan, sc, iwn_scan_timeout *
2522 		    drv_usectohz(MICROSEC));
2523 		return (error);
2524 
2525 	case IEEE80211_S_ASSOC:
2526 		if (ostate != IEEE80211_S_RUN) {
2527 			mutex_exit(&sc->sc_mtx);
2528 			break;
2529 		}
2530 		/* FALLTHROUGH */
2531 	case IEEE80211_S_AUTH:
2532 		/* Reset state to handle reassociations correctly. */
2533 		sc->rxon.associd = 0;
2534 		sc->rxon.filter &= ~htole32(IWN_FILTER_BSS);
2535 		sc->calib.state = IWN_CALIB_STATE_INIT;
2536 
2537 		if ((error = iwn_auth(sc)) != 0) {
2538 			mutex_exit(&sc->sc_mtx);
2539 			dev_err(sc->sc_dip, CE_WARN,
2540 			    "!could not move to auth state");
2541 			return error;
2542 		}
2543 		mutex_exit(&sc->sc_mtx);
2544 		break;
2545 
2546 	case IEEE80211_S_RUN:
2547 		if ((error = iwn_run(sc)) != 0) {
2548 			mutex_exit(&sc->sc_mtx);
2549 			dev_err(sc->sc_dip, CE_WARN,
2550 			    "!could not move to run state");
2551 			return error;
2552 		}
2553 		mutex_exit(&sc->sc_mtx);
2554 		break;
2555 
2556 	case IEEE80211_S_INIT:
2557 		sc->sc_flags &= ~IWN_FLAG_SCANNING;
2558 		sc->calib.state = IWN_CALIB_STATE_INIT;
2559 
2560 		/*
2561 		 * set LED off after init
2562 		 */
2563 		iwn_set_led(sc, IWN_LED_LINK, 1, 0);
2564 
2565 		cv_signal(&sc->sc_scan_cv);
2566 		mutex_exit(&sc->sc_mtx);
2567 		if (sc->scan_to != 0)
2568 			(void) untimeout(sc->scan_to);
2569 		sc->scan_to = 0;
2570 		break;
2571 	}
2572 
2573 	error = sc->sc_newstate(ic, nstate, arg);
2574 
2575 	if (nstate == IEEE80211_S_RUN)
2576 		ieee80211_start_watchdog(ic, 1);
2577 
2578 	return (error);
2579 }
2580 
2581 static void
2582 iwn_iter_func(void *arg, struct ieee80211_node *ni)
2583 {
2584 	struct iwn_softc *sc = arg;
2585 	struct iwn_node *wn = (struct iwn_node *)ni;
2586 
2587 	ieee80211_amrr_choose(&sc->amrr, ni, &wn->amn);
2588 }
2589 
2590 static void
2591 iwn_calib_timeout(void *arg)
2592 {
2593 	struct iwn_softc *sc = arg;
2594 	struct ieee80211com *ic = &sc->sc_ic;
2595 
2596 	mutex_enter(&sc->sc_mtx);
2597 
2598 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
2599 		if (ic->ic_opmode == IEEE80211_M_STA)
2600 			iwn_iter_func(sc, ic->ic_bss);
2601 		else
2602 			ieee80211_iterate_nodes(&ic->ic_sta, iwn_iter_func, sc);
2603 	}
2604 	/* Force automatic TX power calibration every 60 secs. */
2605 	if (++sc->calib_cnt >= 120) {
2606 		uint32_t flags = 0;
2607 
2608 		DTRACE_PROBE(get__statistics);
2609 		(void)iwn_cmd(sc, IWN_CMD_GET_STATISTICS, &flags,
2610 		    sizeof flags, 1);
2611 		sc->calib_cnt = 0;
2612 	}
2613 
2614 	/* Automatic rate control triggered every 500ms. */
2615 	if ((sc->sc_flags & IWN_FLAG_STOP_CALIB_TO) == 0)
2616 		sc->calib_to = timeout(iwn_calib_timeout, sc,
2617 		    drv_usectohz(500000));
2618 
2619 	mutex_exit(&sc->sc_mtx);
2620 }
2621 
2622 /*
2623  * Process an RX_PHY firmware notification.  This is usually immediately
2624  * followed by an MPDU_RX_DONE notification.
2625  */
2626 static void
2627 iwn_rx_phy(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2628     struct iwn_rx_data *data)
2629 {
2630 	struct iwn_rx_stat *stat = (struct iwn_rx_stat *)(desc + 1);
2631 
2632 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc),
2633 	    sizeof (*stat), DDI_DMA_SYNC_FORKERNEL);
2634 
2635 	DTRACE_PROBE1(rx__phy, struct iwn_rx_stat *, stat);
2636 
2637 	/* Save RX statistics, they will be used on MPDU_RX_DONE. */
2638 	memcpy(&sc->last_rx_stat, stat, sizeof (*stat));
2639 	sc->last_rx_valid = 1;
2640 }
2641 
2642 /*
2643  * Process an RX_DONE (4965AGN only) or MPDU_RX_DONE firmware notification.
2644  * Each MPDU_RX_DONE notification must be preceded by an RX_PHY one.
2645  */
2646 static void
2647 iwn_rx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2648     struct iwn_rx_data *data)
2649 {
2650 	struct iwn_ops *ops = &sc->ops;
2651 	struct ieee80211com *ic = &sc->sc_ic;
2652 	struct iwn_rx_ring *ring = &sc->rxq;
2653 	struct ieee80211_frame *wh;
2654 	struct ieee80211_node *ni;
2655 	mblk_t *m;
2656 	struct iwn_rx_stat *stat;
2657 	char	*head;
2658 	uint32_t flags;
2659 	int len, rssi;
2660 
2661 	if (desc->type == IWN_MPDU_RX_DONE) {
2662 		/* Check for prior RX_PHY notification. */
2663 		if (!sc->last_rx_valid) {
2664 			dev_err(sc->sc_dip, CE_WARN,
2665 			    "missing RX_PHY");
2666 			return;
2667 		}
2668 		sc->last_rx_valid = 0;
2669 		stat = &sc->last_rx_stat;
2670 	} else
2671 		stat = (struct iwn_rx_stat *)(desc + 1);
2672 
2673 	(void) ddi_dma_sync(data->dma_data.dma_hdl, 0, 0,
2674 	    DDI_DMA_SYNC_FORKERNEL);
2675 
2676 	if (stat->cfg_phy_len > IWN_STAT_MAXLEN) {
2677 		dev_err(sc->sc_dip, CE_WARN,
2678 		    "!invalid RX statistic header");
2679 		return;
2680 	}
2681 	if (desc->type == IWN_MPDU_RX_DONE) {
2682 		struct iwn_rx_mpdu *mpdu = (struct iwn_rx_mpdu *)(desc + 1);
2683 		head = (char *)(mpdu + 1);
2684 		len = le16toh(mpdu->len);
2685 	} else {
2686 		head = (char *)(stat + 1) + stat->cfg_phy_len;
2687 		len = le16toh(stat->len);
2688 	}
2689 	/*LINTED: E_PTR_BAD_CAST_ALIGN*/
2690 	flags = le32toh(*(uint32_t *)(head + len));
2691 
2692 	/* Discard frames with a bad FCS early. */
2693 	if ((flags & IWN_RX_NOERROR) != IWN_RX_NOERROR) {
2694 		sc->sc_rx_err++;
2695 		ic->ic_stats.is_fcs_errors++;
2696 		return;
2697 	}
2698 	/* Discard frames that are too short. */
2699 	if (len < sizeof (*wh)) {
2700 		sc->sc_rx_err++;
2701 		return;
2702 	}
2703 
2704 	m = allocb(len, BPRI_MED);
2705 	if (m == NULL) {
2706 		sc->sc_rx_nobuf++;
2707 		return;
2708 	}
2709 
2710 	/* Update RX descriptor. */
2711 	ring->desc[ring->cur] =
2712 	    htole32(data->dma_data.paddr >> 8);
2713 	(void) ddi_dma_sync(ring->desc_dma.dma_hdl,
2714 	    ring->cur * sizeof (uint32_t), sizeof (uint32_t),
2715 	    DDI_DMA_SYNC_FORDEV);
2716 
2717 	/* Grab a reference to the source node. */
2718 	wh = (struct ieee80211_frame*)head;
2719 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame *)wh);
2720 
2721 	/* XXX OpenBSD adds decryption here (see also comments in iwn_tx). */
2722 	/* NetBSD does decryption in ieee80211_input. */
2723 
2724 	rssi = ops->get_rssi(stat);
2725 
2726 	/*
2727 	 * convert dBm to percentage
2728 	 */
2729 	rssi = (100 * 75 * 75 - (-20 - rssi) * (15 * 75 + 62 * (-20 - rssi)))
2730 	    / (75 * 75);
2731 	if (rssi > 100)
2732 		rssi = 100;
2733 	else if (rssi < 1)
2734 		rssi = 1;
2735 
2736 	bcopy(wh, m->b_wptr, len);
2737 	m->b_wptr += len;
2738 
2739 	/* XXX Added for NetBSD: scans never stop without it */
2740 	if (ic->ic_state == IEEE80211_S_SCAN)
2741 		iwn_fix_channel(sc, m, stat);
2742 
2743 	/* Send the frame to the 802.11 layer. */
2744 	ieee80211_input(ic, m, ni, rssi, 0);
2745 
2746 	/* Node is no longer needed. */
2747 	ieee80211_free_node(ni);
2748 }
2749 
2750 #ifndef IEEE80211_NO_HT
2751 /* Process an incoming Compressed BlockAck. */
2752 static void
2753 iwn_rx_compressed_ba(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2754     struct iwn_rx_data *data)
2755 {
2756 	struct iwn_compressed_ba *ba = (struct iwn_compressed_ba *)(desc + 1);
2757 	struct iwn_tx_ring *txq;
2758 
2759 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc),
2760 	    sizeof (*ba), DDI_DMA_SYNC_FORKERNEL);
2761 
2762 	txq = &sc->txq[le16toh(ba->qid)];
2763 	/* XXX TBD */
2764 }
2765 #endif
2766 
2767 /*
2768  * Process a CALIBRATION_RESULT notification sent by the initialization
2769  * firmware on response to a CMD_CALIB_CONFIG command (5000 only).
2770  */
2771 static void
2772 iwn5000_rx_calib_results(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2773     struct iwn_rx_data *data)
2774 {
2775 	struct iwn_phy_calib *calib = (struct iwn_phy_calib *)(desc + 1);
2776 	int len, idx = -1;
2777 
2778 	/* Runtime firmware should not send such a notification. */
2779 	if (sc->sc_flags & IWN_FLAG_CALIB_DONE)
2780 		return;
2781 
2782 	len = (le32toh(desc->len) & 0x3fff) - 4;
2783 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc), len,
2784 	    DDI_DMA_SYNC_FORKERNEL);
2785 
2786 	switch (calib->code) {
2787 	case IWN5000_PHY_CALIB_DC:
2788 		if (sc->hw_type == IWN_HW_REV_TYPE_5150 ||
2789 		    sc->hw_type == IWN_HW_REV_TYPE_2030 ||
2790 		    sc->hw_type == IWN_HW_REV_TYPE_2000 ||
2791 		    sc->hw_type == IWN_HW_REV_TYPE_135  ||
2792 		    sc->hw_type == IWN_HW_REV_TYPE_105)
2793 			idx = 0;
2794 		break;
2795 	case IWN5000_PHY_CALIB_LO:
2796 		idx = 1;
2797 		break;
2798 	case IWN5000_PHY_CALIB_TX_IQ:
2799 		idx = 2;
2800 		break;
2801 	case IWN5000_PHY_CALIB_TX_IQ_PERIODIC:
2802 		if (sc->hw_type < IWN_HW_REV_TYPE_6000 &&
2803 		    sc->hw_type != IWN_HW_REV_TYPE_5150)
2804 			idx = 3;
2805 		break;
2806 	case IWN5000_PHY_CALIB_BASE_BAND:
2807 		idx = 4;
2808 		break;
2809 	}
2810 	if (idx == -1)	/* Ignore other results. */
2811 		return;
2812 
2813 	/* Save calibration result. */
2814 	if (sc->calibcmd[idx].buf != NULL)
2815 		kmem_free(sc->calibcmd[idx].buf, sc->calibcmd[idx].len);
2816 	sc->calibcmd[idx].buf = kmem_zalloc(len, KM_NOSLEEP);
2817 	if (sc->calibcmd[idx].buf == NULL) {
2818 		return;
2819 	}
2820 	sc->calibcmd[idx].len = len;
2821 	memcpy(sc->calibcmd[idx].buf, calib, len);
2822 }
2823 
2824 /*
2825  * Process an RX_STATISTICS or BEACON_STATISTICS firmware notification.
2826  * The latter is sent by the firmware after each received beacon.
2827  */
2828 static void
2829 iwn_rx_statistics(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2830     struct iwn_rx_data *data)
2831 {
2832 	struct iwn_ops *ops = &sc->ops;
2833 	struct ieee80211com *ic = &sc->sc_ic;
2834 	struct iwn_calib_state *calib = &sc->calib;
2835 	struct iwn_stats *stats = (struct iwn_stats *)(desc + 1);
2836 	int temp = 0;
2837 
2838 	/* Ignore statistics received during a scan. */
2839 	if (ic->ic_state != IEEE80211_S_RUN)
2840 		return;
2841 
2842 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc),
2843 	    sizeof (*stats), DDI_DMA_SYNC_FORKERNEL);
2844 
2845 	sc->calib_cnt = 0;	/* Reset TX power calibration timeout. */
2846 
2847 	/* Test if temperature has changed. */
2848 	if (stats->general.temp != sc->rawtemp) {
2849 		/* Convert "raw" temperature to degC. */
2850 		sc->rawtemp = stats->general.temp;
2851 		temp = ops->get_temperature(sc);
2852 		sc->sc_misc->temp.value.ul = temp;
2853 
2854 		/* Update TX power if need be (4965AGN only). */
2855 		if (sc->hw_type == IWN_HW_REV_TYPE_4965)
2856 			iwn4965_power_calibration(sc, temp);
2857 	}
2858 
2859 	DTRACE_PROBE2(rx__statistics, struct iwn_stats *, stats, int, temp);
2860 
2861 	if (desc->type != IWN_BEACON_STATISTICS)
2862 		return;	/* Reply to a statistics request. */
2863 
2864 	sc->noise = iwn_get_noise(&stats->rx.general);
2865 	sc->sc_misc->noise.value.l = sc->noise;
2866 
2867 	/* Test that RSSI and noise are present in stats report. */
2868 	if (le32toh(stats->rx.general.flags) != 1) {
2869 		return;
2870 	}
2871 
2872 	/*
2873 	 * XXX Differential gain calibration makes the 6005 firmware
2874 	 * crap out, so skip it for now.  This effectively disables
2875 	 * sensitivity tuning as well.
2876 	 */
2877 	if (sc->hw_type == IWN_HW_REV_TYPE_6005)
2878 		return;
2879 
2880 	if (calib->state == IWN_CALIB_STATE_ASSOC)
2881 		iwn_collect_noise(sc, &stats->rx.general);
2882 	else if (calib->state == IWN_CALIB_STATE_RUN)
2883 		iwn_tune_sensitivity(sc, &stats->rx);
2884 }
2885 
2886 /*
2887  * Process a TX_DONE firmware notification.  Unfortunately, the 4965AGN
2888  * and 5000 adapters have different incompatible TX status formats.
2889  */
2890 static void
2891 iwn4965_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2892     struct iwn_rx_data *data)
2893 {
2894 	struct iwn4965_tx_stat *stat = (struct iwn4965_tx_stat *)(desc + 1);
2895 
2896 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc),
2897 	    sizeof (*stat), DDI_DMA_SYNC_FORKERNEL);
2898 	iwn_tx_done(sc, desc, stat->ackfailcnt, le32toh(stat->status) & 0xff);
2899 }
2900 
2901 static void
2902 iwn5000_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc,
2903     struct iwn_rx_data *data)
2904 {
2905 	struct iwn5000_tx_stat *stat = (struct iwn5000_tx_stat *)(desc + 1);
2906 
2907 #ifdef notyet
2908 	/* Reset TX scheduler slot. */
2909 	iwn5000_reset_sched(sc, desc->qid & 0xf, desc->idx);
2910 #endif
2911 
2912 	(void) ddi_dma_sync(data->dma_data.dma_hdl, sizeof (*desc),
2913 	    sizeof (*stat), DDI_DMA_SYNC_FORKERNEL);
2914 	iwn_tx_done(sc, desc, stat->ackfailcnt, le16toh(stat->status) & 0xff);
2915 }
2916 
2917 /*
2918  * Adapter-independent backend for TX_DONE firmware notifications.
2919  */
2920 static void
2921 iwn_tx_done(struct iwn_softc *sc, struct iwn_rx_desc *desc, int ackfailcnt,
2922     uint8_t status)
2923 {
2924 	struct iwn_tx_ring *ring = &sc->txq[desc->qid & 0xf];
2925 	struct iwn_tx_data *data = &ring->data[desc->idx];
2926 	struct iwn_node *wn = (struct iwn_node *)data->ni;
2927 
2928 	/* Update rate control statistics. */
2929 	wn->amn.amn_txcnt++;
2930 	if (ackfailcnt > 0)
2931 		wn->amn.amn_retrycnt++;
2932 
2933 	if (status != 1 && status != 2)
2934