xref: /netbsd-src/sys/dev/ic/ath.c (revision 21e37cc72a480a47828990a439cde7ac9ffaf0c6)
1 /*	$NetBSD: ath.c,v 1.27 2004/05/31 11:39:39 dyoung Exp $	*/
2 
3 /*-
4  * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer,
12  *    without modification.
13  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
14  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
15  *    redistribution must be conditioned upon including a substantially
16  *    similar Disclaimer requirement for further binary redistribution.
17  * 3. Neither the names of the above-listed copyright holders nor the names
18  *    of any contributors may be used to endorse or promote products derived
19  *    from this software without specific prior written permission.
20  *
21  * Alternatively, this software may be distributed under the terms of the
22  * GNU General Public License ("GPL") version 2 as published by the Free
23  * Software Foundation.
24  *
25  * NO WARRANTY
26  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
27  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
28  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
29  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
30  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
31  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
32  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
33  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
34  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
35  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
36  * THE POSSIBILITY OF SUCH DAMAGES.
37  */
38 
39 #include <sys/cdefs.h>
40 #ifdef __FreeBSD__
41 __FBSDID("$FreeBSD: src/sys/dev/ath/if_ath.c,v 1.54 2004/04/05 04:42:42 sam Exp $");
42 #endif
43 #ifdef __NetBSD__
44 __KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.27 2004/05/31 11:39:39 dyoung Exp $");
45 #endif
46 
47 /*
48  * Driver for the Atheros Wireless LAN controller.
49  *
50  * This software is derived from work of Atsushi Onoe; his contribution
51  * is greatly appreciated.
52  */
53 
54 #include "opt_inet.h"
55 
56 #ifdef __NetBSD__
57 #include "bpfilter.h"
58 #endif /* __NetBSD__ */
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/types.h>
63 #include <sys/sysctl.h>
64 #include <sys/mbuf.h>
65 #include <sys/malloc.h>
66 #include <sys/lock.h>
67 #ifdef __FreeBSD__
68 #include <sys/mutex.h>
69 #endif
70 #include <sys/kernel.h>
71 #include <sys/socket.h>
72 #include <sys/sockio.h>
73 #include <sys/errno.h>
74 #include <sys/callout.h>
75 #ifdef __FreeBSD__
76 #include <sys/bus.h>
77 #else
78 #include <machine/bus.h>
79 #endif
80 #include <sys/endian.h>
81 
82 #include <machine/bus.h>
83 
84 #include <net/if.h>
85 #include <net/if_dl.h>
86 #include <net/if_media.h>
87 #include <net/if_arp.h>
88 #ifdef __FreeBSD__
89 #include <net/ethernet.h>
90 #else
91 #include <net/if_ether.h>
92 #endif
93 #include <net/if_llc.h>
94 
95 #include <net80211/ieee80211_var.h>
96 #include <net80211/ieee80211_compat.h>
97 
98 #if NBPFILTER > 0
99 #include <net/bpf.h>
100 #endif
101 
102 #ifdef INET
103 #include <netinet/in.h>
104 #endif
105 
106 #include <dev/ic/athcompat.h>
107 
108 #define	AR_DEBUG
109 #ifdef __FreeBSD__
110 #include <dev/ath/if_athvar.h>
111 #include <contrib/dev/ath/ah_desc.h>
112 #else
113 #include <dev/ic/athvar.h>
114 #include <../contrib/sys/dev/ic/athhal_desc.h>
115 #endif
116 
117 /* unaligned little endian access */
118 #define LE_READ_2(p)							\
119 	((u_int16_t)							\
120 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
121 #define LE_READ_4(p)							\
122 	((u_int32_t)							\
123 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
124 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
125 
126 #ifdef __FreeBSD__
127 static void	ath_init(void *);
128 #else
129 static int	ath_init(struct ifnet *);
130 #endif
131 static int	ath_init1(struct ath_softc *);
132 static int	ath_intr1(struct ath_softc *);
133 static void	ath_stop(struct ifnet *);
134 static void	ath_start(struct ifnet *);
135 static void	ath_reset(struct ath_softc *);
136 static int	ath_media_change(struct ifnet *);
137 static void	ath_watchdog(struct ifnet *);
138 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
139 static void	ath_fatal_proc(void *, int);
140 static void	ath_rxorn_proc(void *, int);
141 static void	ath_bmiss_proc(void *, int);
142 static void	ath_initkeytable(struct ath_softc *);
143 static void	ath_mode_init(struct ath_softc *);
144 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
145 static void	ath_beacon_proc(void *, int);
146 static void	ath_beacon_free(struct ath_softc *);
147 static void	ath_beacon_config(struct ath_softc *);
148 static int	ath_desc_alloc(struct ath_softc *);
149 static void	ath_desc_free(struct ath_softc *);
150 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
151 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
152 static void	ath_node_copy(struct ieee80211com *,
153 			struct ieee80211_node *, const struct ieee80211_node *);
154 static u_int8_t	ath_node_getrssi(struct ieee80211com *,
155 			struct ieee80211_node *);
156 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
157 static void	ath_rx_proc(void *, int);
158 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
159 			     struct ath_buf *, struct mbuf *);
160 static void	ath_tx_proc(void *, int);
161 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
162 static void	ath_draintxq(struct ath_softc *);
163 static void	ath_stoprecv(struct ath_softc *);
164 static int	ath_startrecv(struct ath_softc *);
165 static void	ath_next_scan(void *);
166 static void	ath_calibrate(void *);
167 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
168 static void	ath_newassoc(struct ieee80211com *,
169 			struct ieee80211_node *, int);
170 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor,
171 			HAL_BOOL xchanmode);
172 
173 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
174 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
175 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
176 static void	ath_rate_ctl(void *, struct ieee80211_node *);
177 
178 #ifdef __NetBSD__
179 int	ath_enable(struct ath_softc *);
180 void	ath_disable(struct ath_softc *);
181 void	ath_power(int, void *);
182 #endif
183 
184 #ifdef __FreeBSD__
185 SYSCTL_DECL(_hw_ath);
186 /* XXX validate sysctl values */
187 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
188 	    0, "channel dwell time (ms) for AP/station scanning");
189 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
190 	    0, "chip calibration interval (secs)");
191 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
192 	    0, "enable/disable outdoor operation");
193 TUNABLE_INT("hw.ath.outdoor", &ath_outdoor);
194 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
195 	    0, "country code");
196 TUNABLE_INT("hw.ath.countrycode", &ath_countrycode);
197 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
198 	    0, "regulatory domain");
199 #endif /* __FreeBSD__ */
200 
201 #ifdef __NetBSD__
202 static int ath_dwelltime_nodenum, ath_calibrate_nodenum, ath_outdoor_nodenum,
203            ath_countrycode_nodenum, ath_regdomain_nodenum, ath_debug_nodenum;
204 #endif /* __NetBSD__ */
205 
206 static	int ath_dwelltime = 200;		/* 5 channels/second */
207 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
208 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
209 static	int ath_xchanmode = AH_TRUE;		/* enable extended channels */
210 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
211 static	int ath_regdomain = 0;			/* regulatory domain */
212 
213 #ifdef AR_DEBUG
214 int	ath_debug = 0;
215 #ifdef __FreeBSD__
216 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
217 	    0, "control debugging printfs");
218 TUNABLE_INT("hw.ath.debug", &ath_debug);
219 #endif /* __FreeBSD__ */
220 #define	IFF_DUMPPKTS(_ifp, _m) \
221 	((ath_debug & _m) || \
222 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
223 static	void ath_printrxbuf(struct ath_buf *bf, int);
224 static	void ath_printtxbuf(struct ath_buf *bf, int);
225 enum {
226 	ATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
227 	ATH_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
228 	ATH_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
229 	ATH_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
230 	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
231 	ATH_DEBUG_RESET		= 0x00000020,	/* reset processing */
232 	ATH_DEBUG_MODE		= 0x00000040,	/* mode init/setup */
233 	ATH_DEBUG_BEACON 	= 0x00000080,	/* beacon handling */
234 	ATH_DEBUG_WATCHDOG 	= 0x00000100,	/* watchdog timeout */
235 	ATH_DEBUG_INTR		= 0x00001000,	/* ISR */
236 	ATH_DEBUG_TX_PROC	= 0x00002000,	/* tx ISR proc */
237 	ATH_DEBUG_RX_PROC	= 0x00004000,	/* rx ISR proc */
238 	ATH_DEBUG_BEACON_PROC	= 0x00008000,	/* beacon ISR proc */
239 	ATH_DEBUG_CALIBRATE	= 0x00010000,	/* periodic calibration */
240 	ATH_DEBUG_ANY		= 0xffffffff
241 };
242 #define	DPRINTF(_m,X)	if (ath_debug & (_m)) printf X
243 #else
244 #define	IFF_DUMPPKTS(_ifp, _m) \
245 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
246 #define	DPRINTF(_m, X)
247 #endif
248 
249 #ifdef __NetBSD__
250 int
251 ath_activate(struct device *self, enum devact act)
252 {
253 	struct ath_softc *sc = (struct ath_softc *)self;
254 	int rv = 0, s;
255 
256 	s = splnet();
257 	switch (act) {
258 	case DVACT_ACTIVATE:
259 		rv = EOPNOTSUPP;
260 		break;
261 	case DVACT_DEACTIVATE:
262 		if_deactivate(&sc->sc_ic.ic_if);
263 		break;
264 	}
265 	splx(s);
266 	return rv;
267 }
268 
269 int
270 ath_enable(struct ath_softc *sc)
271 {
272 	if (ATH_IS_ENABLED(sc) == 0) {
273 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
274 			printf("%s: device enable failed\n",
275 				sc->sc_dev.dv_xname);
276 			return (EIO);
277 		}
278 		sc->sc_flags |= ATH_ENABLED;
279 	}
280 	return (0);
281 }
282 
283 void
284 ath_disable(struct ath_softc *sc)
285 {
286 	if (!ATH_IS_ENABLED(sc))
287 		return;
288 	if (sc->sc_disable != NULL)
289 		(*sc->sc_disable)(sc);
290 	sc->sc_flags &= ~ATH_ENABLED;
291 }
292 
293 static int
294 sysctl_ath_verify(SYSCTLFN_ARGS)
295 {
296 	int error, t;
297 	struct sysctlnode node;
298 
299 	node = *rnode;
300 	t = *(int*)rnode->sysctl_data;
301 	node.sysctl_data = &t;
302 	error = sysctl_lookup(SYSCTLFN_CALL(&node));
303 	if (error || newp == NULL)
304 		return (error);
305 
306 	DPRINTF(ATH_DEBUG_ANY, ("%s: t = %d, nodenum = %d, rnodenum = %d\n",
307 	    __func__, t, node.sysctl_num, rnode->sysctl_num));
308 
309 	if (node.sysctl_num == ath_dwelltime_nodenum) {
310 		if (t <= 0)
311 			return (EINVAL);
312 	} else if (node.sysctl_num == ath_calibrate_nodenum) {
313 		if (t <= 0)
314 			return (EINVAL);
315 #ifdef AR_DEBUG
316 	} else if (node.sysctl_num == ath_debug_nodenum) {
317 		if (t < 0 || t > 2)
318 			return (EINVAL);
319 #endif /* AR_DEBUG */
320 	} else
321 		return (EINVAL);
322 
323 	*(int*)rnode->sysctl_data = t;
324 
325 	return (0);
326 }
327 
328 /*
329  * Setup sysctl(3) MIB, ath.*.
330  *
331  * TBD condition CTLFLAG_PERMANENT on being an LKM or not
332  */
333 SYSCTL_SETUP(sysctl_ath, "sysctl ath subtree setup")
334 {
335 	int rc, ath_node_num;
336 	struct sysctlnode *node;
337 
338 	if ((rc = sysctl_createv(clog, 0, NULL, NULL,
339 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
340 	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
341 		goto err;
342 
343 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
344 	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "ath",
345 	    SYSCTL_DESCR("ath information and options"),
346 	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
347 		goto err;
348 
349 	ath_node_num = node->sysctl_num;
350 
351 	/* channel dwell time (ms) for AP/station scanning */
352 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
353 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
354 	    CTLTYPE_INT, "dwell",
355 	    SYSCTL_DESCR("Channel dwell time (ms) for AP/station scanning"),
356 	    sysctl_ath_verify, 0, &ath_dwelltime,
357 	    0, CTL_HW, ath_node_num, CTL_CREATE,
358 	    CTL_EOL)) != 0)
359 		goto err;
360 
361 	ath_dwelltime_nodenum = node->sysctl_num;
362 
363 	/* chip calibration interval (secs) */
364 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
365 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
366 	    CTLTYPE_INT, "calibrate",
367 	    SYSCTL_DESCR("Chip calibration interval (secs)"), sysctl_ath_verify,
368 	    0, &ath_calinterval, 0, CTL_HW,
369 	    ath_node_num, CTL_CREATE, CTL_EOL)) != 0)
370 		goto err;
371 
372 	ath_calibrate_nodenum = node->sysctl_num;
373 
374 	/* enable/disable outdoor operation */
375 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
376 	    CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT,
377 	    "outdoor", SYSCTL_DESCR("Enable/disable outdoor operation"),
378 	    NULL, 0, &ath_outdoor, 0,
379 	    CTL_HW, ath_node_num, CTL_CREATE,
380 	    CTL_EOL)) != 0)
381 		goto err;
382 
383 	ath_outdoor_nodenum = node->sysctl_num;
384 
385 	/* country code */
386 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
387 	    CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT,
388 	    "countrycode", SYSCTL_DESCR("Country code"),
389 	    NULL, 0, &ath_countrycode, 0,
390 	    CTL_HW, ath_node_num, CTL_CREATE,
391 	    CTL_EOL)) != 0)
392 		goto err;
393 
394 	ath_countrycode_nodenum = node->sysctl_num;
395 
396 	/* regulatory domain */
397 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
398 	    CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT,
399 	    "regdomain", SYSCTL_DESCR("Regulatory domain"),
400 	    NULL, 0, &ath_regdomain, 0,
401 	    CTL_HW, ath_node_num, CTL_CREATE,
402 	    CTL_EOL)) != 0)
403 		goto err;
404 
405 	ath_regdomain_nodenum = node->sysctl_num;
406 
407 #ifdef AR_DEBUG
408 
409 	/* control debugging printfs */
410 	if ((rc = sysctl_createv(clog, 0, NULL, &node,
411 	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
412 	    "debug", SYSCTL_DESCR("Enable/disable ath debugging output"),
413 	    sysctl_ath_verify, 0, &ath_debug, 0,
414 	    CTL_HW, ath_node_num, CTL_CREATE,
415 	    CTL_EOL)) != 0)
416 		goto err;
417 
418 	ath_debug_nodenum = node->sysctl_num;
419 
420 #endif /* AR_DEBUG */
421 	return;
422 err:
423 	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
424 }
425 #endif /* __NetBSD__ */
426 
427 int
428 ath_attach(u_int16_t devid, struct ath_softc *sc)
429 {
430 	struct ieee80211com *ic = &sc->sc_ic;
431 	struct ifnet *ifp = &ic->ic_if;
432 	struct ath_hal *ah;
433 	HAL_STATUS status;
434 	int error = 0;
435 
436 	DPRINTF(ATH_DEBUG_ANY, ("%s: devid 0x%x\n", __func__, devid));
437 
438 #ifdef __FreeBSD__
439 	/* set these up early for if_printf use */
440 	if_initname(ifp, device_get_name(sc->sc_dev),
441 	    device_get_unit(sc->sc_dev));
442 #else
443 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
444 #endif
445 
446 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
447 	if (ah == NULL) {
448 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
449 			status);
450 		error = ENXIO;
451 		goto bad;
452 	}
453 	if (ah->ah_abi != HAL_ABI_VERSION) {
454 		if_printf(ifp, "HAL ABI mismatch detected (0x%x != 0x%x)\n",
455 			ah->ah_abi, HAL_ABI_VERSION);
456 		error = ENXIO;
457 		goto bad;
458 	}
459 	if_printf(ifp, "mac %d.%d phy %d.%d",
460 		ah->ah_macVersion, ah->ah_macRev,
461 		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
462 	if (ah->ah_analog5GhzRev)
463 		printf(" 5ghz radio %d.%d",
464 			ah->ah_analog5GhzRev >> 4, ah->ah_analog5GhzRev & 0xf);
465 	if (ah->ah_analog2GhzRev)
466 		printf(" 2ghz radio %d.%d",
467 			ah->ah_analog2GhzRev >> 4, ah->ah_analog2GhzRev & 0xf);
468 	printf("\n");
469 	sc->sc_ah = ah;
470 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
471 
472 	/*
473 	 * Collect the channel list using the default country
474 	 * code and including outdoor channels.  The 802.11 layer
475 	 * is resposible for filtering this list based on settings
476 	 * like the phy mode.
477 	 */
478 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor,
479 	    ath_xchanmode);
480 	if (error != 0)
481 		goto bad;
482 	/*
483 	 * Copy these back; they are set as a side effect
484 	 * of constructing the channel list.
485 	 */
486 	ath_regdomain = ath_hal_getregdomain(ah);
487 	ath_countrycode = ath_hal_getcountrycode(ah);
488 
489 	/*
490 	 * Setup rate tables for all potential media types.
491 	 */
492 	ath_rate_setup(sc, IEEE80211_MODE_11A);
493 	ath_rate_setup(sc, IEEE80211_MODE_11B);
494 	ath_rate_setup(sc, IEEE80211_MODE_11G);
495 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
496 
497 	error = ath_desc_alloc(sc);
498 	if (error != 0) {
499 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
500 		goto bad;
501 	}
502 	ATH_CALLOUT_INIT(&sc->sc_scan_ch);
503 	ATH_CALLOUT_INIT(&sc->sc_cal_ch);
504 
505 #ifdef __FreeBSD__
506 	ATH_TXBUF_LOCK_INIT(sc);
507 	ATH_TXQ_LOCK_INIT(sc);
508 #endif
509 
510 	ATH_TASK_INIT(&sc->sc_txtask, ath_tx_proc, sc);
511 	ATH_TASK_INIT(&sc->sc_rxtask, ath_rx_proc, sc);
512 	ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc);
513 	ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc);
514 	ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc);
515 
516 	/*
517 	 * For now just pre-allocate one data queue and one
518 	 * beacon queue.  Note that the HAL handles resetting
519 	 * them at the needed time.  Eventually we'll want to
520 	 * allocate more tx queues for splitting management
521 	 * frames and for QOS support.
522 	 */
523 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
524 		HAL_TX_QUEUE_DATA,
525 		AH_TRUE			/* enable interrupts */
526 	);
527 	if (sc->sc_txhalq == (u_int) -1) {
528 		if_printf(ifp, "unable to setup a data xmit queue!\n");
529 		goto bad2;
530 	}
531 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
532 		HAL_TX_QUEUE_BEACON,
533 		AH_TRUE			/* enable interrupts */
534 	);
535 	if (sc->sc_bhalq == (u_int) -1) {
536 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
537 		goto bad2;
538 	}
539 
540 	ifp->if_softc = sc;
541 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
542 	ifp->if_start = ath_start;
543 	ifp->if_watchdog = ath_watchdog;
544 	ifp->if_ioctl = ath_ioctl;
545 	ifp->if_init = ath_init;
546 #ifdef __FreeBSD__
547 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
548 #else
549 #if 0
550 	ifp->if_stop = ath_stop;		/* XXX */
551 #endif
552 	IFQ_SET_READY(&ifp->if_snd);
553 #endif
554 
555 	ic->ic_softc = sc;
556 	ic->ic_newassoc = ath_newassoc;
557 	/* XXX not right but it's not used anywhere important */
558 	ic->ic_phytype = IEEE80211_T_OFDM;
559 	ic->ic_opmode = IEEE80211_M_STA;
560 	ic->ic_caps = IEEE80211_C_WEP		/* wep supported */
561 		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
562 		| IEEE80211_C_HOSTAP		/* hostap mode */
563 		| IEEE80211_C_MONITOR		/* monitor mode */
564 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
565 		;
566 
567 	/* get mac address from hardware */
568 	ath_hal_getmac(ah, ic->ic_myaddr);
569 
570 #ifdef __NetBSD__
571 	if_attach(ifp);
572 #endif
573 	/* call MI attach routine. */
574 	ieee80211_ifattach(ifp);
575 	/* override default methods */
576 	ic->ic_node_alloc = ath_node_alloc;
577 	sc->sc_node_free = ic->ic_node_free;
578 	ic->ic_node_free = ath_node_free;
579 	sc->sc_node_copy = ic->ic_node_copy;
580 	ic->ic_node_copy = ath_node_copy;
581 	ic->ic_node_getrssi = ath_node_getrssi;
582 	sc->sc_newstate = ic->ic_newstate;
583 	ic->ic_newstate = ath_newstate;
584 	/* complete initialization */
585 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
586 
587 #if NBPFILTER > 0
588 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
589 		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
590 		&sc->sc_drvbpf);
591 #endif
592 	/*
593 	 * Initialize constant fields.
594 	 * XXX make header lengths a multiple of 32-bits so subsequent
595 	 *     headers are properly aligned; this is a kludge to keep
596 	 *     certain applications happy.
597 	 *
598 	 * NB: the channel is setup each time we transition to the
599 	 *     RUN state to avoid filling it in for each frame.
600 	 */
601 	sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
602 	sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
603 	sc->sc_tx_th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
604 
605 	sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
606 	sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
607 	sc->sc_rx_th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
608 
609 #ifdef __NetBSD__
610 	sc->sc_flags |= ATH_ATTACHED;
611 	/*
612 	 * Make sure the interface is shutdown during reboot.
613 	 */
614 	sc->sc_sdhook = shutdownhook_establish(ath_shutdown, sc);
615 	if (sc->sc_sdhook == NULL)
616 		printf("%s: WARNING: unable to establish shutdown hook\n",
617 			sc->sc_dev.dv_xname);
618 	sc->sc_powerhook = powerhook_establish(ath_power, sc);
619 	if (sc->sc_powerhook == NULL)
620 		printf("%s: WARNING: unable to establish power hook\n",
621 			sc->sc_dev.dv_xname);
622 #endif
623 	return 0;
624 bad2:
625 	ath_desc_free(sc);
626 bad:
627 	if (ah)
628 		ath_hal_detach(ah);
629 	sc->sc_invalid = 1;
630 	return error;
631 }
632 
633 int
634 ath_detach(struct ath_softc *sc)
635 {
636 	struct ifnet *ifp = &sc->sc_ic.ic_if;
637 	ath_softc_critsect_decl(s);
638 
639 	if ((sc->sc_flags & ATH_ATTACHED) == 0)
640 		return (0);
641 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
642 
643 	ath_softc_critsect_begin(sc, s);
644 	ath_stop(ifp);
645 #if NBPFILTER > 0
646 	bpfdetach(ifp);
647 #endif
648 	ath_desc_free(sc);
649 	ath_hal_detach(sc->sc_ah);
650 	ieee80211_ifdetach(ifp);
651 #ifdef __NetBSD__
652 	if_detach(ifp);
653 #endif /* __NetBSD__ */
654 	ath_softc_critsect_end(sc, s);
655 #ifdef __NetBSD__
656 	powerhook_disestablish(sc->sc_powerhook);
657 	shutdownhook_disestablish(sc->sc_sdhook);
658 #endif /* __NetBSD__ */
659 #ifdef __FreeBSD__
660 
661 	ATH_TXBUF_LOCK_DESTROY(sc);
662 	ATH_TXQ_LOCK_DESTROY(sc);
663 
664 #endif /* __FreeBSD__ */
665 	return 0;
666 }
667 
668 #ifdef __NetBSD__
669 void
670 ath_power(int why, void *arg)
671 {
672 	struct ath_softc *sc = arg;
673 	int s;
674 
675 	DPRINTF(ATH_DEBUG_ANY, ("ath_power(%d)\n", why));
676 
677 	s = splnet();
678 	switch (why) {
679 	case PWR_SUSPEND:
680 	case PWR_STANDBY:
681 		ath_suspend(sc, why);
682 		break;
683 	case PWR_RESUME:
684 		ath_resume(sc, why);
685 		break;
686 	case PWR_SOFTSUSPEND:
687 	case PWR_SOFTSTANDBY:
688 	case PWR_SOFTRESUME:
689 		break;
690 	}
691 	splx(s);
692 }
693 #endif
694 
695 void
696 ath_suspend(struct ath_softc *sc, int why)
697 {
698 	struct ifnet *ifp = &sc->sc_ic.ic_if;
699 
700 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
701 
702 	ath_stop(ifp);
703 	if (sc->sc_power != NULL)
704 		(*sc->sc_power)(sc, why);
705 }
706 
707 void
708 ath_resume(struct ath_softc *sc, int why)
709 {
710 	struct ifnet *ifp = &sc->sc_ic.ic_if;
711 
712 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
713 
714 	if (ifp->if_flags & IFF_UP) {
715 		ath_init(ifp);
716 #if 0
717 		(void)ath_intr(sc);
718 #endif
719 		if (sc->sc_power != NULL)
720 			(*sc->sc_power)(sc, why);
721 		if (ifp->if_flags & IFF_RUNNING)
722 			ath_start(ifp);
723 	}
724 }
725 
726 #ifdef __NetBSD__
727 void
728 ath_shutdown(void *arg)
729 {
730 	struct ath_softc *sc = arg;
731 
732 	ath_stop(&sc->sc_ic.ic_if);
733 }
734 #else
735 void
736 ath_shutdown(struct ath_softc *sc)
737 {
738 #if 1
739 	return;
740 #else
741 	struct ifnet *ifp = &sc->sc_ic.ic_if;
742 
743 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
744 
745 	ath_stop(ifp);
746 #endif
747 }
748 #endif
749 
750 #ifdef __NetBSD__
751 int
752 ath_intr(void *arg)
753 {
754 	return ath_intr1((struct ath_softc *)arg);
755 }
756 #else
757 void
758 ath_intr(void *arg)
759 {
760 	(void)ath_intr1((struct ath_softc *)arg);
761 }
762 #endif
763 
764 static int
765 ath_intr1(struct ath_softc *sc)
766 {
767 	struct ieee80211com *ic = &sc->sc_ic;
768 	struct ifnet *ifp = &ic->ic_if;
769 	struct ath_hal *ah = sc->sc_ah;
770 	HAL_INT status;
771 
772 	if (sc->sc_invalid) {
773 		/*
774 		 * The hardware is not ready/present, don't touch anything.
775 		 * Note this can happen early on if the IRQ is shared.
776 		 */
777 		DPRINTF(ATH_DEBUG_ANY, ("%s: invalid; ignored\n", __func__));
778 		return 0;
779 	}
780 	if (!ath_hal_intrpend(ah))		/* shared irq, not for us */
781 		return 0;
782 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
783 		DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
784 			__func__, ifp->if_flags));
785 		ath_hal_getisr(ah, &status);	/* clear ISR */
786 		ath_hal_intrset(ah, 0);		/* disable further intr's */
787 		return 1; /* XXX */
788 	}
789 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
790 	DPRINTF(ATH_DEBUG_INTR, ("%s: status 0x%x\n", __func__, status));
791 #ifdef AR_DEBUG
792 	if (ath_debug &&
793 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
794 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
795 		ath_hal_dumpstate(ah);
796 	}
797 #endif /* AR_DEBUG */
798 	status &= sc->sc_imask;			/* discard unasked for bits */
799 	if (status & HAL_INT_FATAL) {
800 		sc->sc_stats.ast_hardware++;
801 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
802 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_fataltask);
803 	} else if (status & HAL_INT_RXORN) {
804 		sc->sc_stats.ast_rxorn++;
805 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
806 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxorntask);
807 	} else {
808 		if (status & HAL_INT_RXEOL) {
809 			/*
810 			 * NB: the hardware should re-read the link when
811 			 *     RXE bit is written, but it doesn't work at
812 			 *     least on older hardware revs.
813 			 */
814 			sc->sc_stats.ast_rxeol++;
815 			sc->sc_rxlink = NULL;
816 		}
817 		if (status & HAL_INT_TXURN) {
818 			sc->sc_stats.ast_txurn++;
819 			/* bump tx trigger level */
820 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
821 		}
822 		if (status & HAL_INT_RX)
823 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask);
824 		if (status & HAL_INT_TX)
825 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask);
826 		if (status & HAL_INT_SWBA) {
827 			/*
828 			 * Handle beacon transmission directly; deferring
829 			 * this is too slow to meet timing constraints
830 			 * under load.
831 			 */
832 			ath_beacon_proc(sc, 0);
833 		}
834 		if (status & HAL_INT_BMISS) {
835 			sc->sc_stats.ast_bmiss++;
836 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask);
837 		}
838 	}
839 	return 1;
840 }
841 
842 static void
843 ath_fatal_proc(void *arg, int pending)
844 {
845 	struct ath_softc *sc = arg;
846 
847 	device_printf(sc->sc_dev, "hardware error; resetting\n");
848 	ath_reset(sc);
849 }
850 
851 static void
852 ath_rxorn_proc(void *arg, int pending)
853 {
854 	struct ath_softc *sc = arg;
855 
856 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
857 	ath_reset(sc);
858 }
859 
860 static void
861 ath_bmiss_proc(void *arg, int pending)
862 {
863 	struct ath_softc *sc = arg;
864 	struct ieee80211com *ic = &sc->sc_ic;
865 
866 	DPRINTF(ATH_DEBUG_ANY, ("%s: pending %u\n", __func__, pending));
867 	if (ic->ic_opmode != IEEE80211_M_STA)
868 		return;
869 	if (ic->ic_state == IEEE80211_S_RUN) {
870 		/*
871 		 * Rather than go directly to scan state, try to
872 		 * reassociate first.  If that fails then the state
873 		 * machine will drop us into scanning after timing
874 		 * out waiting for a probe response.
875 		 */
876 		ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
877 	}
878 }
879 
880 static u_int
881 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
882 {
883 	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
884 
885 	switch (mode) {
886 	case IEEE80211_MODE_AUTO:
887 		return 0;
888 	case IEEE80211_MODE_11A:
889 		return CHANNEL_A;
890 	case IEEE80211_MODE_11B:
891 		return CHANNEL_B;
892 	case IEEE80211_MODE_11G:
893 		return CHANNEL_PUREG;
894 	case IEEE80211_MODE_TURBO:
895 		return CHANNEL_T;
896 	default:
897 		panic("%s: unsupported mode %d\n", __func__, mode);
898 		return 0;
899 	}
900 }
901 
902 #ifdef __NetBSD__
903 static int
904 ath_init(struct ifnet *ifp)
905 {
906 	return ath_init1((struct ath_softc *)ifp->if_softc);
907 }
908 #else
909 static void
910 ath_init(void *arg)
911 {
912 	(void)ath_init1((struct ath_softc *)arg);
913 }
914 #endif
915 
916 static int
917 ath_init1(struct ath_softc *sc)
918 {
919 	struct ieee80211com *ic = &sc->sc_ic;
920 	struct ifnet *ifp = &ic->ic_if;
921 	struct ieee80211_node *ni;
922 	enum ieee80211_phymode mode;
923 	struct ath_hal *ah = sc->sc_ah;
924 	HAL_STATUS status;
925 	HAL_CHANNEL hchan;
926 	int error = 0;
927 	ath_softc_critsect_decl(s);
928 
929 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
930 		__func__, ifp->if_flags));
931 
932 #ifdef __NetBSD__
933 	if ((error = ath_enable(sc)) != 0)
934 		return error;
935 #endif
936 
937 	ath_softc_critsect_begin(sc, s);
938 	/*
939 	 * Stop anything previously setup.  This is safe
940 	 * whether this is the first time through or not.
941 	 */
942 	ath_stop(ifp);
943 
944 	/*
945 	 * The basic interface to setting the hardware in a good
946 	 * state is ``reset''.  On return the hardware is known to
947 	 * be powered up and with interrupts disabled.  This must
948 	 * be followed by initialization of the appropriate bits
949 	 * and then setup of the interrupt mask.
950 	 */
951 	hchan.channel = ic->ic_ibss_chan->ic_freq;
952 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
953 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
954 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
955 			status);
956 		error = -1;
957 		goto done;
958 	}
959 
960 	/*
961 	 * Setup the hardware after reset: the key cache
962 	 * is filled as needed and the receive engine is
963 	 * set going.  Frame transmit is handled entirely
964 	 * in the frame output path; there's nothing to do
965 	 * here except setup the interrupt mask.
966 	 */
967 	if (ic->ic_flags & IEEE80211_F_WEPON)
968 		ath_initkeytable(sc);
969 	if ((error = ath_startrecv(sc)) != 0) {
970 		if_printf(ifp, "unable to start recv logic\n");
971 		goto done;
972 	}
973 
974 	/*
975 	 * Enable interrupts.
976 	 */
977 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
978 		  | HAL_INT_RXEOL | HAL_INT_RXORN
979 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
980 	ath_hal_intrset(ah, sc->sc_imask);
981 
982 	ifp->if_flags |= IFF_RUNNING;
983 	ic->ic_state = IEEE80211_S_INIT;
984 
985 	/*
986 	 * The hardware should be ready to go now so it's safe
987 	 * to kick the 802.11 state machine as it's likely to
988 	 * immediately call back to us to send mgmt frames.
989 	 */
990 	ni = ic->ic_bss;
991 	ni->ni_chan = ic->ic_ibss_chan;
992 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
993 	if (mode != sc->sc_curmode)
994 		ath_setcurmode(sc, mode);
995 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
996 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
997 	else
998 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
999 done:
1000 	ath_softc_critsect_end(sc, s);
1001 	return error;
1002 }
1003 
1004 static void
1005 ath_stop(struct ifnet *ifp)
1006 {
1007 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
1008 	struct ath_softc *sc = ifp->if_softc;
1009 	struct ath_hal *ah = sc->sc_ah;
1010 	ath_softc_critsect_decl(s);
1011 
1012 	DPRINTF(ATH_DEBUG_ANY, ("%s: invalid %u if_flags 0x%x\n",
1013 		__func__, sc->sc_invalid, ifp->if_flags));
1014 
1015 	ath_softc_critsect_begin(sc, s);
1016 	if (ifp->if_flags & IFF_RUNNING) {
1017 		/*
1018 		 * Shutdown the hardware and driver:
1019 		 *    disable interrupts
1020 		 *    turn off timers
1021 		 *    clear transmit machinery
1022 		 *    clear receive machinery
1023 		 *    drain and release tx queues
1024 		 *    reclaim beacon resources
1025 		 *    reset 802.11 state machine
1026 		 *    power down hardware
1027 		 *
1028 		 * Note that some of this work is not possible if the
1029 		 * hardware is gone (invalid).
1030 		 */
1031 		ifp->if_flags &= ~IFF_RUNNING;
1032 		ifp->if_timer = 0;
1033 		if (!sc->sc_invalid)
1034 			ath_hal_intrset(ah, 0);
1035 		ath_draintxq(sc);
1036 		if (!sc->sc_invalid)
1037 			ath_stoprecv(sc);
1038 		else
1039 			sc->sc_rxlink = NULL;
1040 #ifdef __FreeBSD__
1041 		IF_DRAIN(&ifp->if_snd);
1042 #else
1043 		IF_PURGE(&ifp->if_snd);
1044 #endif
1045 		ath_beacon_free(sc);
1046 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1047 		if (!sc->sc_invalid) {
1048 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
1049 		}
1050 #ifdef __NetBSD__
1051 		ath_disable(sc);
1052 #endif
1053 	}
1054 	ath_softc_critsect_end(sc, s);
1055 }
1056 
1057 /*
1058  * Reset the hardware w/o losing operational state.  This is
1059  * basically a more efficient way of doing ath_stop, ath_init,
1060  * followed by state transitions to the current 802.11
1061  * operational state.  Used to recover from errors rx overrun
1062  * and to reset the hardware when rf gain settings must be reset.
1063  */
1064 static void
1065 ath_reset(struct ath_softc *sc)
1066 {
1067 	struct ieee80211com *ic = &sc->sc_ic;
1068 	struct ifnet *ifp = &ic->ic_if;
1069 	struct ath_hal *ah = sc->sc_ah;
1070 	struct ieee80211_channel *c;
1071 	HAL_STATUS status;
1072 	HAL_CHANNEL hchan;
1073 
1074 	/*
1075 	 * Convert to a HAL channel description with the flags
1076 	 * constrained to reflect the current operating mode.
1077 	 */
1078 	c = ic->ic_ibss_chan;
1079 	hchan.channel = c->ic_freq;
1080 	hchan.channelFlags = ath_chan2flags(ic, c);
1081 
1082 	ath_hal_intrset(ah, 0);		/* disable interrupts */
1083 	ath_draintxq(sc);		/* stop xmit side */
1084 	ath_stoprecv(sc);		/* stop recv side */
1085 	/* NB: indicate channel change so we do a full reset */
1086 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
1087 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
1088 			__func__, status);
1089 	ath_hal_intrset(ah, sc->sc_imask);
1090 	if (ath_startrecv(sc) != 0)	/* restart recv */
1091 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
1092 	ath_start(ifp);			/* restart xmit */
1093 	if (ic->ic_state == IEEE80211_S_RUN)
1094 		ath_beacon_config(sc);	/* restart beacons */
1095 }
1096 
1097 static void
1098 ath_start(struct ifnet *ifp)
1099 {
1100 	struct ath_softc *sc = ifp->if_softc;
1101 	struct ath_hal *ah = sc->sc_ah;
1102 	struct ieee80211com *ic = &sc->sc_ic;
1103 	struct ieee80211_node *ni;
1104 	struct ath_buf *bf;
1105 	struct mbuf *m;
1106 	struct ieee80211_frame *wh;
1107 	ath_txbuf_critsect_decl(s);
1108 
1109 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
1110 		return;
1111 	for (;;) {
1112 		/*
1113 		 * Grab a TX buffer and associated resources.
1114 		 */
1115 		ath_txbuf_critsect_begin(sc, s);
1116 		bf = TAILQ_FIRST(&sc->sc_txbuf);
1117 		if (bf != NULL)
1118 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
1119 		ath_txbuf_critsect_end(sc, s);
1120 		if (bf == NULL) {
1121 			DPRINTF(ATH_DEBUG_ANY, ("%s: out of xmit buffers\n",
1122 				__func__));
1123 			sc->sc_stats.ast_tx_qstop++;
1124 			ifp->if_flags |= IFF_OACTIVE;
1125 			break;
1126 		}
1127 		/*
1128 		 * Poll the management queue for frames; they
1129 		 * have priority over normal data frames.
1130 		 */
1131 		IF_DEQUEUE(&ic->ic_mgtq, m);
1132 		if (m == NULL) {
1133 			/*
1134 			 * No data frames go out unless we're associated.
1135 			 */
1136 			if (ic->ic_state != IEEE80211_S_RUN) {
1137 				DPRINTF(ATH_DEBUG_ANY,
1138 					("%s: ignore data packet, state %u\n",
1139 					__func__, ic->ic_state));
1140 				sc->sc_stats.ast_tx_discard++;
1141 				ath_txbuf_critsect_begin(sc, s);
1142 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1143 				ath_txbuf_critsect_end(sc, s);
1144 				break;
1145 			}
1146 			IF_DEQUEUE(&ifp->if_snd, m);
1147 			if (m == NULL) {
1148 				ath_txbuf_critsect_begin(sc, s);
1149 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1150 				ath_txbuf_critsect_end(sc, s);
1151 				break;
1152 			}
1153 			ifp->if_opackets++;
1154 
1155 #ifdef __NetBSD__
1156 #if NBPFILTER > 0
1157 			if (ifp->if_bpf)
1158 				bpf_mtap(ifp->if_bpf, m);
1159 #endif
1160 #endif
1161 #ifdef __FreeBSD__
1162 			BPF_MTAP(ifp, m);
1163 #endif
1164 			/*
1165 			 * Encapsulate the packet in prep for transmission.
1166 			 */
1167 			m = ieee80211_encap(ifp, m, &ni);
1168 			if (m == NULL) {
1169 				DPRINTF(ATH_DEBUG_ANY,
1170 					("%s: encapsulation failure\n",
1171 					__func__));
1172 				sc->sc_stats.ast_tx_encap++;
1173 				goto bad;
1174 			}
1175 			wh = mtod(m, struct ieee80211_frame *);
1176 		} else {
1177 			/*
1178 			 * Hack!  The referenced node pointer is in the
1179 			 * rcvif field of the packet header.  This is
1180 			 * placed there by ieee80211_mgmt_output because
1181 			 * we need to hold the reference with the frame
1182 			 * and there's no other way (other than packet
1183 			 * tags which we consider too expensive to use)
1184 			 * to pass it along.
1185 			 */
1186 			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1187 			m->m_pkthdr.rcvif = NULL;
1188 
1189 			wh = mtod(m, struct ieee80211_frame *);
1190 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1191 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1192 				/* fill time stamp */
1193 				u_int64_t tsf;
1194 				u_int32_t *tstamp;
1195 
1196 				tsf = ath_hal_gettsf64(ah);
1197 				/* XXX: adjust 100us delay to xmit */
1198 				tsf += 100;
1199 				tstamp = (u_int32_t *)&wh[1];
1200 				tstamp[0] = htole32(tsf & 0xffffffff);
1201 				tstamp[1] = htole32(tsf >> 32);
1202 			}
1203 			sc->sc_stats.ast_tx_mgmt++;
1204 		}
1205 
1206 		if (ath_tx_start(sc, ni, bf, m)) {
1207 	bad:
1208 			ath_txbuf_critsect_begin(sc, s);
1209 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1210 			ath_txbuf_critsect_end(sc, s);
1211 			ifp->if_oerrors++;
1212 			if (ni && ni != ic->ic_bss)
1213 				ieee80211_free_node(ic, ni);
1214 			continue;
1215 		}
1216 
1217 		sc->sc_tx_timer = 5;
1218 		ifp->if_timer = 1;
1219 	}
1220 }
1221 
1222 static int
1223 ath_media_change(struct ifnet *ifp)
1224 {
1225 	int error;
1226 
1227 	error = ieee80211_media_change(ifp);
1228 	if (error == ENETRESET) {
1229 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
1230 		    (IFF_RUNNING|IFF_UP))
1231 			ath_init(ifp);		/* XXX lose error */
1232 		error = 0;
1233 	}
1234 	return error;
1235 }
1236 
1237 static void
1238 ath_watchdog(struct ifnet *ifp)
1239 {
1240 	struct ath_softc *sc = ifp->if_softc;
1241 	struct ieee80211com *ic = &sc->sc_ic;
1242 
1243 	ifp->if_timer = 0;
1244 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
1245 		return;
1246 	if (sc->sc_tx_timer) {
1247 		if (--sc->sc_tx_timer == 0) {
1248 			if_printf(ifp, "device timeout\n");
1249 #ifdef AR_DEBUG
1250 			if (ath_debug & ATH_DEBUG_WATCHDOG)
1251 				ath_hal_dumpstate(sc->sc_ah);
1252 #endif /* AR_DEBUG */
1253 			ath_reset(sc);
1254 			ifp->if_oerrors++;
1255 			sc->sc_stats.ast_watchdog++;
1256 			return;
1257 		}
1258 		ifp->if_timer = 1;
1259 	}
1260 	if (ic->ic_fixed_rate == -1) {
1261 		/*
1262 		 * Run the rate control algorithm if we're not
1263 		 * locked at a fixed rate.
1264 		 */
1265 		if (ic->ic_opmode == IEEE80211_M_STA)
1266 			ath_rate_ctl(sc, ic->ic_bss);
1267 		else
1268 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
1269 	}
1270 	ieee80211_watchdog(ifp);
1271 }
1272 
1273 static int
1274 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1275 {
1276 	struct ath_softc *sc = ifp->if_softc;
1277 	struct ifreq *ifr = (struct ifreq *)data;
1278 	int error = 0;
1279 	ath_softc_critsect_decl(s);
1280 
1281 	ath_softc_critsect_begin(sc, s);
1282 	switch (cmd) {
1283 	case SIOCSIFFLAGS:
1284 		if (ifp->if_flags & IFF_UP) {
1285 			if (ifp->if_flags & IFF_RUNNING) {
1286 				/*
1287 				 * To avoid rescanning another access point,
1288 				 * do not call ath_init() here.  Instead,
1289 				 * only reflect promisc mode settings.
1290 				 */
1291 				ath_mode_init(sc);
1292 			} else {
1293 				/*
1294 				 * Beware of being called during detach to
1295 				 * reset promiscuous mode.  In that case we
1296 				 * will still be marked UP but not RUNNING.
1297 				 * However trying to re-init the interface
1298 				 * is the wrong thing to do as we've already
1299 				 * torn down much of our state.  There's
1300 				 * probably a better way to deal with this.
1301 				 */
1302 				if (!sc->sc_invalid)
1303 					ath_init(ifp);	/* XXX lose error */
1304 			}
1305 		} else
1306 			ath_stop(ifp);
1307 		break;
1308 	case SIOCADDMULTI:
1309 	case SIOCDELMULTI:
1310 #ifdef __FreeBSD__
1311 		/*
1312 		 * The upper layer has already installed/removed
1313 		 * the multicast address(es), just recalculate the
1314 		 * multicast filter for the card.
1315 		 */
1316 		if (ifp->if_flags & IFF_RUNNING)
1317 			ath_mode_init(sc);
1318 #endif
1319 #ifdef __NetBSD__
1320 		error = (cmd == SIOCADDMULTI) ?
1321 		    ether_addmulti(ifr, &sc->sc_ic.ic_ec) :
1322 		    ether_delmulti(ifr, &sc->sc_ic.ic_ec);
1323 		if (error == ENETRESET) {
1324 			if (ifp->if_flags & IFF_RUNNING)
1325 				ath_mode_init(sc);
1326 			error = 0;
1327 		}
1328 #endif
1329 		break;
1330 	case SIOCGATHSTATS:
1331 		error = copyout(&sc->sc_stats,
1332 				ifr->ifr_data, sizeof (sc->sc_stats));
1333 		break;
1334 	case SIOCGATHDIAG: {
1335 		struct ath_diag *ad = (struct ath_diag *)data;
1336 		struct ath_hal *ah = sc->sc_ah;
1337 		void *data;
1338 		u_int size;
1339 
1340 		if (ath_hal_getdiagstate(ah, ad->ad_id, &data, &size)) {
1341 			if (size < ad->ad_size)
1342 				ad->ad_size = size;
1343 			if (data)
1344 				error = copyout(data, ad->ad_data, ad->ad_size);
1345 		} else
1346 			error = EINVAL;
1347 		break;
1348 	}
1349 	default:
1350 		error = ieee80211_ioctl(ifp, cmd, data);
1351 		if (error == ENETRESET) {
1352 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
1353 			    (IFF_RUNNING|IFF_UP))
1354 				ath_init(ifp);		/* XXX lose error */
1355 			error = 0;
1356 		}
1357 		break;
1358 	}
1359 	ath_softc_critsect_end(sc, s);
1360 	return error;
1361 }
1362 
1363 /*
1364  * Fill the hardware key cache with key entries.
1365  */
1366 static void
1367 ath_initkeytable(struct ath_softc *sc)
1368 {
1369 	struct ieee80211com *ic = &sc->sc_ic;
1370 	struct ath_hal *ah = sc->sc_ah;
1371 	int i;
1372 
1373 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1374 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
1375 		if (k->wk_len == 0)
1376 			ath_hal_keyreset(ah, i);
1377 		else
1378 			/* XXX return value */
1379 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
1380 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
1381 	}
1382 }
1383 
1384 static void
1385 ath_mcastfilter_accum(caddr_t dl, u_int32_t (*mfilt)[2])
1386 {
1387 	u_int32_t val;
1388 	u_int8_t pos;
1389 
1390 	val = LE_READ_4(dl + 0);
1391 	pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1392 	val = LE_READ_4(dl + 3);
1393 	pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1394 	pos &= 0x3f;
1395 	(*mfilt)[pos / 32] |= (1 << (pos % 32));
1396 }
1397 
1398 #ifdef __FreeBSD__
1399 static void
1400 ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
1401 {
1402 	struct ieee80211com *ic = &sc->sc_ic;
1403 	struct ifnet *ifp = &ic->ic_if;
1404 	struct ifmultiaddr *ifma;
1405 
1406 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1407 		caddr_t dl;
1408 
1409 		/* calculate XOR of eight 6bit values */
1410 		dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
1411 		ath_mcastfilter_accum(dl, &mfilt);
1412 	}
1413 }
1414 #else
1415 static void
1416 ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
1417 {
1418 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1419 	struct ether_multi *enm;
1420 	struct ether_multistep estep;
1421 
1422 	ETHER_FIRST_MULTI(estep, &sc->sc_ic.ic_ec, enm);
1423 	while (enm != NULL) {
1424 		/* XXX Punt on ranges. */
1425 		if (!IEEE80211_ADDR_EQ(enm->enm_addrlo, enm->enm_addrhi)) {
1426 			(*mfilt)[0] = (*mfilt)[1] = ~((u_int32_t)0);
1427 			ifp->if_flags |= IFF_ALLMULTI;
1428 			return;
1429 		}
1430 		ath_mcastfilter_accum(enm->enm_addrlo, mfilt);
1431 		ETHER_NEXT_MULTI(estep, enm);
1432 	}
1433 	ifp->if_flags &= ~IFF_ALLMULTI;
1434 }
1435 #endif
1436 
1437 /*
1438  * Calculate the receive filter according to the
1439  * operating mode and state:
1440  *
1441  * o always accept unicast, broadcast, and multicast traffic
1442  * o maintain current state of phy error reception
1443  * o probe request frames are accepted only when operating in
1444  *   hostap, adhoc, or monitor modes
1445  * o enable promiscuous mode according to the interface state
1446  * o accept beacons:
1447  *   - when operating in adhoc mode so the 802.11 layer creates
1448  *     node table entries for peers,
1449  *   - when operating in station mode for collecting rssi data when
1450  *     the station is otherwise quiet, or
1451  *   - when scanning
1452  */
1453 static u_int32_t
1454 ath_calcrxfilter(struct ath_softc *sc)
1455 {
1456 	struct ieee80211com *ic = &sc->sc_ic;
1457 	struct ath_hal *ah = sc->sc_ah;
1458 	struct ifnet *ifp = &ic->ic_if;
1459 	u_int32_t rfilt;
1460 
1461 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
1462 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
1463 	if (ic->ic_opmode != IEEE80211_M_STA)
1464 		rfilt |= HAL_RX_FILTER_PROBEREQ;
1465 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
1466 	    (ifp->if_flags & IFF_PROMISC))
1467 		rfilt |= HAL_RX_FILTER_PROM;
1468 	if (ic->ic_opmode == IEEE80211_M_STA ||
1469 	    ic->ic_opmode == IEEE80211_M_IBSS ||
1470 	    ic->ic_state == IEEE80211_S_SCAN)
1471 		rfilt |= HAL_RX_FILTER_BEACON;
1472 	return rfilt;
1473 }
1474 
1475 static void
1476 ath_mode_init(struct ath_softc *sc)
1477 {
1478 #ifdef __FreeBSD__
1479 	struct ieee80211com *ic = &sc->sc_ic;
1480 #endif
1481 	struct ath_hal *ah = sc->sc_ah;
1482 	u_int32_t rfilt, mfilt[2];
1483 
1484 	/* configure rx filter */
1485 	rfilt = ath_calcrxfilter(sc);
1486 	ath_hal_setrxfilter(ah, rfilt);
1487 
1488 	/* configure operational mode */
1489 	ath_hal_setopmode(ah);
1490 
1491 	/* calculate and install multicast filter */
1492 #ifdef __FreeBSD__
1493 	if ((ic->ic_if.if_flags & IFF_ALLMULTI) == 0) {
1494 		mfilt[0] = mfilt[1] = 0;
1495 		ath_mcastfilter_compute(sc, &mfilt);
1496 	} else {
1497 		mfilt[0] = mfilt[1] = ~0;
1498 	}
1499 #endif
1500 #ifdef __NetBSD__
1501 	mfilt[0] = mfilt[1] = 0;
1502 	ath_mcastfilter_compute(sc, &mfilt);
1503 #endif
1504 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
1505 	DPRINTF(ATH_DEBUG_MODE, ("%s: RX filter 0x%x, MC filter %08x:%08x\n",
1506 		__func__, rfilt, mfilt[0], mfilt[1]));
1507 }
1508 
1509 #ifdef __FreeBSD__
1510 static void
1511 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
1512 {
1513 	struct ath_buf *bf = arg;
1514 
1515 	KASSERT(nseg <= ATH_MAX_SCATTER,
1516 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
1517 	bf->bf_mapsize = mapsize;
1518 	bf->bf_nseg = nseg;
1519 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
1520 }
1521 #endif /* __FreeBSD__ */
1522 
1523 static struct mbuf *
1524 ath_getmbuf(int flags, int type, u_int pktlen)
1525 {
1526 	struct mbuf *m;
1527 
1528 	KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
1529 #ifdef __FreeBSD__
1530 	if (pktlen <= MHLEN)
1531 		MGETHDR(m, flags, type);
1532 	else
1533 		m = m_getcl(flags, type, M_PKTHDR);
1534 #else
1535 	MGETHDR(m, flags, type);
1536 	if (m != NULL && pktlen > MHLEN)
1537 		MCLGET(m, flags);
1538 #endif
1539 	return m;
1540 }
1541 
1542 static int
1543 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
1544 {
1545 	struct ieee80211com *ic = &sc->sc_ic;
1546 	struct ifnet *ifp = &ic->ic_if;
1547 	struct ath_hal *ah = sc->sc_ah;
1548 	struct ieee80211_frame *wh;
1549 	struct ath_buf *bf;
1550 	struct ath_desc *ds;
1551 	struct mbuf *m;
1552 	int error, pktlen;
1553 	u_int8_t *frm, rate;
1554 	u_int16_t capinfo;
1555 	struct ieee80211_rateset *rs;
1556 	const HAL_RATE_TABLE *rt;
1557 
1558 	bf = sc->sc_bcbuf;
1559 	if (bf->bf_m != NULL) {
1560 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1561 		m_freem(bf->bf_m);
1562 		bf->bf_m = NULL;
1563 		bf->bf_node = NULL;
1564 	}
1565 	/*
1566 	 * NB: the beacon data buffer must be 32-bit aligned;
1567 	 * we assume the mbuf routines will return us something
1568 	 * with this alignment (perhaps should assert).
1569 	 */
1570 	rs = &ni->ni_rates;
1571 	pktlen = sizeof (struct ieee80211_frame)
1572 	       + 8 + 2 + 2 + 2+ni->ni_esslen + 2+rs->rs_nrates + 3 + 6;
1573 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1574 		pktlen += 2;
1575 	m = ath_getmbuf(M_DONTWAIT, MT_DATA, pktlen);
1576 	if (m == NULL) {
1577 		DPRINTF(ATH_DEBUG_BEACON,
1578 			("%s: cannot get mbuf/cluster; size %u\n",
1579 			__func__, pktlen));
1580 		sc->sc_stats.ast_be_nombuf++;
1581 		return ENOMEM;
1582 	}
1583 
1584 	wh = mtod(m, struct ieee80211_frame *);
1585 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1586 	    IEEE80211_FC0_SUBTYPE_BEACON;
1587 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1588 	*(u_int16_t *)wh->i_dur = 0;
1589 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
1590 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1591 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1592 	*(u_int16_t *)wh->i_seq = 0;
1593 
1594 	/*
1595 	 * beacon frame format
1596 	 *	[8] time stamp
1597 	 *	[2] beacon interval
1598 	 *	[2] cabability information
1599 	 *	[tlv] ssid
1600 	 *	[tlv] supported rates
1601 	 *	[tlv] parameter set (IBSS)
1602 	 *	[tlv] extended supported rates
1603 	 */
1604 	frm = (u_int8_t *)&wh[1];
1605 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1606 	frm += 8;
1607 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1608 	frm += 2;
1609 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1610 		capinfo = IEEE80211_CAPINFO_IBSS;
1611 	else
1612 		capinfo = IEEE80211_CAPINFO_ESS;
1613 	if (ic->ic_flags & IEEE80211_F_WEPON)
1614 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1615 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1616 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1617 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1618 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1619 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1620 	*(u_int16_t *)frm = htole16(capinfo);
1621 	frm += 2;
1622 	*frm++ = IEEE80211_ELEMID_SSID;
1623 	*frm++ = ni->ni_esslen;
1624 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1625 	frm += ni->ni_esslen;
1626 	frm = ieee80211_add_rates(frm, rs);
1627 	*frm++ = IEEE80211_ELEMID_DSPARMS;
1628 	*frm++ = 1;
1629 	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
1630 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1631 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1632 		*frm++ = 2;
1633 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1634 	} else {
1635 		/* TODO: TIM */
1636 		*frm++ = IEEE80211_ELEMID_TIM;
1637 		*frm++ = 4;	/* length */
1638 		*frm++ = 0;	/* DTIM count */
1639 		*frm++ = 1;	/* DTIM period */
1640 		*frm++ = 0;	/* bitmap control */
1641 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1642 	}
1643 	frm = ieee80211_add_xrates(frm, rs);
1644 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1645 	KASSERT(m->m_pkthdr.len <= pktlen,
1646 		("beacon bigger than expected, len %u calculated %u",
1647 		m->m_pkthdr.len, pktlen));
1648 
1649 	DPRINTF(ATH_DEBUG_BEACON, ("%s: m %p len %u\n", __func__, m, m->m_len));
1650 	error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m, BUS_DMA_NOWAIT);
1651 	if (error != 0) {
1652 		m_freem(m);
1653 		return error;
1654 	}
1655 	KASSERT(bf->bf_nseg == 1,
1656 		("%s: multi-segment packet; nseg %u", __func__, bf->bf_nseg));
1657 	bf->bf_m = m;
1658 
1659 	/* setup descriptors */
1660 	ds = bf->bf_desc;
1661 
1662 	ds->ds_link = 0;
1663 	ds->ds_data = bf->bf_segs[0].ds_addr;
1664 
1665 	DPRINTF(ATH_DEBUG_ANY, ("%s: segaddr %p seglen %u\n", __func__,
1666 	    (caddr_t)bf->bf_segs[0].ds_addr, (u_int)bf->bf_segs[0].ds_len));
1667 
1668 	/*
1669 	 * Calculate rate code.
1670 	 * XXX everything at min xmit rate
1671 	 */
1672 	rt = sc->sc_currates;
1673 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1674 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1675 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1676 	else
1677 		rate = rt->info[0].rateCode;
1678 	if (!ath_hal_setuptxdesc(ah, ds
1679 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1680 		, sizeof(struct ieee80211_frame)	/* header length */
1681 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1682 		, 0x20				/* txpower XXX */
1683 		, rate, 1			/* series 0 rate/tries */
1684 		, HAL_TXKEYIX_INVALID		/* no encryption */
1685 		, 0				/* antenna mode */
1686 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1687 		, 0				/* rts/cts rate */
1688 		, 0				/* rts/cts duration */
1689 	)) {
1690 		printf("%s: ath_hal_setuptxdesc failed\n", __func__);
1691 		return -1;
1692 	}
1693 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1694 	/* XXX verify mbuf data area covers this roundup */
1695 	if (!ath_hal_filltxdesc(ah, ds
1696 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1697 		, AH_TRUE				/* first segment */
1698 		, AH_TRUE				/* last segment */
1699 	)) {
1700 		printf("%s: ath_hal_filltxdesc failed\n", __func__);
1701 		return -1;
1702 	}
1703 
1704 	/* XXX it is not appropriate to bus_dmamap_sync? -dcy */
1705 
1706 	return 0;
1707 }
1708 
1709 static void
1710 ath_beacon_proc(void *arg, int pending)
1711 {
1712 	struct ath_softc *sc = arg;
1713 	struct ieee80211com *ic = &sc->sc_ic;
1714 	struct ath_buf *bf = sc->sc_bcbuf;
1715 	struct ath_hal *ah = sc->sc_ah;
1716 
1717 	DPRINTF(ATH_DEBUG_BEACON_PROC, ("%s: pending %u\n", __func__, pending));
1718 	if (ic->ic_opmode == IEEE80211_M_STA ||
1719 	    bf == NULL || bf->bf_m == NULL) {
1720 		DPRINTF(ATH_DEBUG_ANY, ("%s: ic_flags=%x bf=%p bf_m=%p\n",
1721 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1722 		return;
1723 	}
1724 	/* TODO: update beacon to reflect PS poll state */
1725 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1726 		DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
1727 			__func__, sc->sc_bhalq));
1728 		/* NB: the HAL still stops DMA, so proceed */
1729 	}
1730 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREWRITE);
1731 
1732 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1733 	ath_hal_txstart(ah, sc->sc_bhalq);
1734 	DPRINTF(ATH_DEBUG_BEACON_PROC,
1735 		("%s: TXDP%u = %p (%p)\n", __func__,
1736 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1737 }
1738 
1739 static void
1740 ath_beacon_free(struct ath_softc *sc)
1741 {
1742 	struct ath_buf *bf = sc->sc_bcbuf;
1743 
1744 	if (bf->bf_m != NULL) {
1745 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1746 		m_freem(bf->bf_m);
1747 		bf->bf_m = NULL;
1748 		bf->bf_node = NULL;
1749 	}
1750 }
1751 
1752 /*
1753  * Configure the beacon and sleep timers.
1754  *
1755  * When operating as an AP this resets the TSF and sets
1756  * up the hardware to notify us when we need to issue beacons.
1757  *
1758  * When operating in station mode this sets up the beacon
1759  * timers according to the timestamp of the last received
1760  * beacon and the current TSF, configures PCF and DTIM
1761  * handling, programs the sleep registers so the hardware
1762  * will wakeup in time to receive beacons, and configures
1763  * the beacon miss handling so we'll receive a BMISS
1764  * interrupt when we stop seeing beacons from the AP
1765  * we've associated with.
1766  */
1767 static void
1768 ath_beacon_config(struct ath_softc *sc)
1769 {
1770 	struct ath_hal *ah = sc->sc_ah;
1771 	struct ieee80211com *ic = &sc->sc_ic;
1772 	struct ieee80211_node *ni = ic->ic_bss;
1773 	u_int32_t nexttbtt;
1774 
1775 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1776 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1777 	DPRINTF(ATH_DEBUG_BEACON, ("%s: nexttbtt=%u\n", __func__, nexttbtt));
1778 	nexttbtt += ni->ni_intval;
1779 	if (ic->ic_opmode == IEEE80211_M_STA) {
1780 		HAL_BEACON_STATE bs;
1781 		u_int32_t bmisstime;
1782 
1783 		/* NB: no PCF support right now */
1784 		memset(&bs, 0, sizeof(bs));
1785 		bs.bs_intval = ni->ni_intval;
1786 		bs.bs_nexttbtt = nexttbtt;
1787 		bs.bs_dtimperiod = bs.bs_intval;
1788 		bs.bs_nextdtim = nexttbtt;
1789 		/*
1790 		 * Calculate the number of consecutive beacons to miss
1791 		 * before taking a BMISS interrupt.  The configuration
1792 		 * is specified in ms, so we need to convert that to
1793 		 * TU's and then calculate based on the beacon interval.
1794 		 * Note that we clamp the result to at most 10 beacons.
1795 		 */
1796 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1797 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1798 		if (bs.bs_bmissthreshold > 10)
1799 			bs.bs_bmissthreshold = 10;
1800 		else if (bs.bs_bmissthreshold <= 0)
1801 			bs.bs_bmissthreshold = 1;
1802 
1803 		/*
1804 		 * Calculate sleep duration.  The configuration is
1805 		 * given in ms.  We insure a multiple of the beacon
1806 		 * period is used.  Also, if the sleep duration is
1807 		 * greater than the DTIM period then it makes senses
1808 		 * to make it a multiple of that.
1809 		 *
1810 		 * XXX fixed at 100ms
1811 		 */
1812 		bs.bs_sleepduration =
1813 			roundup((100 * 1000) / 1024, bs.bs_intval);
1814 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1815 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1816 
1817 		DPRINTF(ATH_DEBUG_BEACON,
1818 			("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1819 			, __func__
1820 			, bs.bs_intval
1821 			, bs.bs_nexttbtt
1822 			, bs.bs_dtimperiod
1823 			, bs.bs_nextdtim
1824 			, bs.bs_bmissthreshold
1825 			, bs.bs_sleepduration
1826 		));
1827 		ath_hal_intrset(ah, 0);
1828 		/*
1829 		 * Reset our tsf so the hardware will update the
1830 		 * tsf register to reflect timestamps found in
1831 		 * received beacons.
1832 		 */
1833 		ath_hal_resettsf(ah);
1834 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1835 		sc->sc_imask |= HAL_INT_BMISS;
1836 		ath_hal_intrset(ah, sc->sc_imask);
1837 	} else {
1838 		DPRINTF(ATH_DEBUG_BEACON, ("%s: intval %u nexttbtt %u\n",
1839 			__func__, ni->ni_intval, nexttbtt));
1840 		ath_hal_intrset(ah, 0);
1841 		ath_hal_beaconinit(ah, nexttbtt, ni->ni_intval);
1842 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1843 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1844 		ath_hal_intrset(ah, sc->sc_imask);
1845 	}
1846 }
1847 
1848 #ifdef __FreeBSD__
1849 static void
1850 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1851 {
1852 	bus_addr_t *paddr = (bus_addr_t*) arg;
1853 	*paddr = segs->ds_addr;
1854 }
1855 #endif
1856 
1857 #ifdef __FreeBSD__
1858 static int
1859 ath_desc_alloc(struct ath_softc *sc)
1860 {
1861 	int i, bsize, error;
1862 	struct ath_desc *ds;
1863 	struct ath_buf *bf;
1864 
1865 	/* allocate descriptors */
1866 	sc->sc_desc_len = sizeof(struct ath_desc) *
1867 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1868 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1869 	if (error != 0)
1870 		return error;
1871 
1872 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1873 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1874 
1875 	if (error != 0)
1876 		goto fail0;
1877 
1878 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1879 				sc->sc_desc, sc->sc_desc_len,
1880 				ath_load_cb, &sc->sc_desc_paddr,
1881 				BUS_DMA_NOWAIT);
1882 	if (error != 0)
1883 		goto fail1;
1884 
1885 	ds = sc->sc_desc;
1886 	DPRINTF(ATH_DEBUG_ANY, ("%s: DMA map: %p (%lu) -> %p (%lu)\n",
1887 	    __func__, ds, (u_long) sc->sc_desc_len, (caddr_t) sc->sc_desc_paddr,
1888 	    /*XXX*/ (u_long) sc->sc_desc_len));
1889 
1890 	/* allocate buffers */
1891 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1892 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1893 	if (bf == NULL) {
1894 		printf("%s: unable to allocate Tx/Rx buffers\n",
1895 		    sc->sc_dev.dv_xname);
1896 		error = -1;
1897 		goto fail2;
1898 	}
1899 	sc->sc_bufptr = bf;
1900 
1901 	TAILQ_INIT(&sc->sc_rxbuf);
1902 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1903 		bf->bf_desc = ds;
1904 		bf->bf_daddr = sc->sc_desc_paddr +
1905 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1906 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1907 					  &bf->bf_dmamap);
1908 		if (error != 0)
1909 			break;
1910 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1911 	}
1912 
1913 	TAILQ_INIT(&sc->sc_txbuf);
1914 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1915 		bf->bf_desc = ds;
1916 		bf->bf_daddr = sc->sc_desc_paddr +
1917 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1918 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1919 					  &bf->bf_dmamap);
1920 		if (error != 0)
1921 			break;
1922 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1923 	}
1924 	TAILQ_INIT(&sc->sc_txq);
1925 
1926 	/* beacon buffer */
1927 	bf->bf_desc = ds;
1928 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1929 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1930 	if (error != 0)
1931 		return error;
1932 	sc->sc_bcbuf = bf;
1933 	return 0;
1934 
1935 fail2:
1936 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1937 fail1:
1938 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1939 fail0:
1940 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1941 	sc->sc_ddmamap = NULL;
1942 	return error;
1943 }
1944 #else
1945 static int
1946 ath_desc_alloc(struct ath_softc *sc)
1947 {
1948 	int i, bsize, error = -1;
1949 	struct ath_desc *ds;
1950 	struct ath_buf *bf;
1951 
1952 	/* allocate descriptors */
1953 	sc->sc_desc_len = sizeof(struct ath_desc) *
1954 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1955 	if ((error = bus_dmamem_alloc(sc->sc_dmat, sc->sc_desc_len, PAGE_SIZE,
1956 	    0, &sc->sc_dseg, 1, &sc->sc_dnseg, 0)) != 0) {
1957 		printf("%s: unable to allocate control data, error = %d\n",
1958 		    sc->sc_dev.dv_xname, error);
1959 		goto fail0;
1960 	}
1961 
1962 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg,
1963 	    sc->sc_desc_len, (caddr_t *)&sc->sc_desc, BUS_DMA_COHERENT)) != 0) {
1964 		printf("%s: unable to map control data, error = %d\n",
1965 		    sc->sc_dev.dv_xname, error);
1966 		goto fail1;
1967 	}
1968 
1969 	if ((error = bus_dmamap_create(sc->sc_dmat, sc->sc_desc_len, 1,
1970 	    sc->sc_desc_len, 0, 0, &sc->sc_ddmamap)) != 0) {
1971 		printf("%s: unable to create control data DMA map, "
1972 		    "error = %d\n", sc->sc_dev.dv_xname, error);
1973 		goto fail2;
1974 	}
1975 
1976 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap, sc->sc_desc,
1977 	    sc->sc_desc_len, NULL, 0)) != 0) {
1978 		printf("%s: unable to load control data DMA map, error = %d\n",
1979 		    sc->sc_dev.dv_xname, error);
1980 		goto fail3;
1981 	}
1982 
1983 	ds = sc->sc_desc;
1984 	sc->sc_desc_paddr = sc->sc_ddmamap->dm_segs[0].ds_addr;
1985 
1986 	DPRINTF(ATH_DEBUG_XMIT_DESC|ATH_DEBUG_RECV_DESC,
1987 	    ("ath_desc_alloc: DMA map: %p (%lu) -> %p (%lu)\n",
1988 	    ds, (u_long)sc->sc_desc_len,
1989 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1990 
1991 	/* allocate buffers */
1992 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1993 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1994 	if (bf == NULL) {
1995 		printf("%s: unable to allocate Tx/Rx buffers\n",
1996 		    sc->sc_dev.dv_xname);
1997 		error = ENOMEM;
1998 		goto fail3;
1999 	}
2000 	sc->sc_bufptr = bf;
2001 
2002 	TAILQ_INIT(&sc->sc_rxbuf);
2003 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
2004 		bf->bf_desc = ds;
2005 		bf->bf_daddr = sc->sc_desc_paddr +
2006 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
2007 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
2008 		    MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
2009 			printf("%s: unable to create Rx dmamap, error = %d\n",
2010 			    sc->sc_dev.dv_xname, error);
2011 			goto fail4;
2012 		}
2013 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
2014 	}
2015 
2016 	TAILQ_INIT(&sc->sc_txbuf);
2017 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
2018 		bf->bf_desc = ds;
2019 		bf->bf_daddr = sc->sc_desc_paddr +
2020 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
2021 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
2022 		    ATH_TXDESC, MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
2023 			printf("%s: unable to create Tx dmamap, error = %d\n",
2024 			    sc->sc_dev.dv_xname, error);
2025 			goto fail5;
2026 		}
2027 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2028 	}
2029 	TAILQ_INIT(&sc->sc_txq);
2030 
2031 	/* beacon buffer */
2032 	bf->bf_desc = ds;
2033 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
2034 	if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
2035 	    &bf->bf_dmamap)) != 0) {
2036 		printf("%s: unable to create beacon dmamap, error = %d\n",
2037 		    sc->sc_dev.dv_xname, error);
2038 		goto fail5;
2039 	}
2040 	sc->sc_bcbuf = bf;
2041 	return 0;
2042 
2043 fail5:
2044 	for (i = ATH_RXBUF; i < ATH_RXBUF + ATH_TXBUF; i++) {
2045 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
2046 			continue;
2047 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
2048 	}
2049 fail4:
2050 	for (i = 0; i < ATH_RXBUF; i++) {
2051 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
2052 			continue;
2053 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
2054 	}
2055 fail3:
2056 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
2057 fail2:
2058 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
2059 	sc->sc_ddmamap = NULL;
2060 fail1:
2061 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_desc, sc->sc_desc_len);
2062 fail0:
2063 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
2064 	return error;
2065 }
2066 #endif
2067 
2068 static void
2069 ath_desc_free(struct ath_softc *sc)
2070 {
2071 	struct ath_buf *bf;
2072 
2073 #ifdef __FreeBSD__
2074 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
2075 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
2076 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
2077 #else
2078 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
2079 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
2080 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
2081 #endif
2082 
2083 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
2084 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2085 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
2086 		m_freem(bf->bf_m);
2087 	}
2088 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
2089 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
2090 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2091 		if (bf->bf_m) {
2092 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2093 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
2094 			m_freem(bf->bf_m);
2095 			bf->bf_m = NULL;
2096 		}
2097 	}
2098 	if (sc->sc_bcbuf != NULL) {
2099 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
2100 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
2101 		sc->sc_bcbuf = NULL;
2102 	}
2103 
2104 	TAILQ_INIT(&sc->sc_rxbuf);
2105 	TAILQ_INIT(&sc->sc_txbuf);
2106 	TAILQ_INIT(&sc->sc_txq);
2107 	free(sc->sc_bufptr, M_DEVBUF);
2108 	sc->sc_bufptr = NULL;
2109 }
2110 
2111 static struct ieee80211_node *
2112 ath_node_alloc(struct ieee80211com *ic)
2113 {
2114 	struct ath_node *an =
2115 		malloc(sizeof(struct ath_node), M_80211_NODE, M_NOWAIT|M_ZERO);
2116 	if (an) {
2117 		int i;
2118 		for (i = 0; i < ATH_RHIST_SIZE; i++)
2119 			an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME;
2120 		an->an_rx_hist_next = ATH_RHIST_SIZE-1;
2121 		return &an->an_node;
2122 	} else
2123 		return NULL;
2124 }
2125 
2126 static void
2127 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
2128 {
2129 	struct ath_softc *sc = ic->ic_if.if_softc;
2130 	struct ath_buf *bf;
2131 
2132 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
2133 		if (bf->bf_node == ni)
2134 			bf->bf_node = NULL;
2135 	}
2136 	(*sc->sc_node_free)(ic, ni);
2137 }
2138 
2139 static void
2140 ath_node_copy(struct ieee80211com *ic,
2141 	struct ieee80211_node *dst, const struct ieee80211_node *src)
2142 {
2143         struct ath_softc *sc = ic->ic_if.if_softc;
2144 
2145 	memcpy(&dst[1], &src[1],
2146 		sizeof(struct ath_node) - sizeof(struct ieee80211_node));
2147 	(*sc->sc_node_copy)(ic, dst, src);
2148 }
2149 
2150 static u_int8_t
2151 ath_node_getrssi(struct ieee80211com *ic, struct ieee80211_node *ni)
2152 {
2153 	struct ath_node *an = ATH_NODE(ni);
2154 	int i, now, nsamples, rssi;
2155 
2156 	/*
2157 	 * Calculate the average over the last second of sampled data.
2158 	 */
2159 	now = ATH_TICKS();
2160 	nsamples = 0;
2161 	rssi = 0;
2162 	i = an->an_rx_hist_next;
2163 	do {
2164 		struct ath_recv_hist *rh = &an->an_rx_hist[i];
2165 		if (rh->arh_ticks == ATH_RHIST_NOTIME)
2166 			goto done;
2167 		if (now - rh->arh_ticks > hz)
2168 			goto done;
2169 		rssi += rh->arh_rssi;
2170 		nsamples++;
2171 		if (i == 0)
2172 			i = ATH_RHIST_SIZE-1;
2173 		else
2174 			i--;
2175 	} while (i != an->an_rx_hist_next);
2176 done:
2177 	/*
2178 	 * Return either the average or the last known
2179 	 * value if there is no recent data.
2180 	 */
2181 	return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
2182 }
2183 
2184 static int
2185 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
2186 {
2187 	struct ath_hal *ah = sc->sc_ah;
2188 	int error;
2189 	struct mbuf *m;
2190 	struct ath_desc *ds;
2191 
2192 	m = bf->bf_m;
2193 	if (m == NULL) {
2194 		/*
2195 		 * NB: by assigning a page to the rx dma buffer we
2196 		 * implicitly satisfy the Atheros requirement that
2197 		 * this buffer be cache-line-aligned and sized to be
2198 		 * multiple of the cache line size.  Not doing this
2199 		 * causes weird stuff to happen (for the 5210 at least).
2200 		 */
2201 		m = ath_getmbuf(M_DONTWAIT, MT_DATA, MCLBYTES);
2202 		if (m == NULL) {
2203 			DPRINTF(ATH_DEBUG_ANY,
2204 				("%s: no mbuf/cluster\n", __func__));
2205 			sc->sc_stats.ast_rx_nombuf++;
2206 			return ENOMEM;
2207 		}
2208 		bf->bf_m = m;
2209 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
2210 
2211 		error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m,
2212 		                                 BUS_DMA_NOWAIT);
2213 		if (error != 0) {
2214 			DPRINTF(ATH_DEBUG_ANY,
2215 				("%s: ath_buf_dmamap_load_mbuf failed;"
2216 				" error %d\n", __func__, error));
2217 			sc->sc_stats.ast_rx_busdma++;
2218 			return error;
2219 		}
2220 		KASSERT(bf->bf_nseg == 1,
2221 			("ath_rxbuf_init: multi-segment packet; nseg %u",
2222 			bf->bf_nseg));
2223 	}
2224 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREREAD);
2225 
2226 	/*
2227 	 * Setup descriptors.  For receive we always terminate
2228 	 * the descriptor list with a self-linked entry so we'll
2229 	 * not get overrun under high load (as can happen with a
2230 	 * 5212 when ANI processing enables PHY errors).
2231 	 *
2232 	 * To insure the last descriptor is self-linked we create
2233 	 * each descriptor as self-linked and add it to the end.  As
2234 	 * each additional descriptor is added the previous self-linked
2235 	 * entry is ``fixed'' naturally.  This should be safe even
2236 	 * if DMA is happening.  When processing RX interrupts we
2237 	 * never remove/process the last, self-linked, entry on the
2238 	 * descriptor list.  This insures the hardware always has
2239 	 * someplace to write a new frame.
2240 	 */
2241 	ds = bf->bf_desc;
2242 	ds->ds_link = bf->bf_daddr;	/* link to self */
2243 	ds->ds_data = bf->bf_segs[0].ds_addr;
2244 	ath_hal_setuprxdesc(ah, ds
2245 		, m->m_len		/* buffer size */
2246 		, 0
2247 	);
2248 
2249 	if (sc->sc_rxlink != NULL)
2250 		*sc->sc_rxlink = bf->bf_daddr;
2251 	sc->sc_rxlink = &ds->ds_link;
2252 	return 0;
2253 }
2254 
2255 static void
2256 ath_rx_proc(void *arg, int npending)
2257 {
2258 #define	PA2DESC(_sc, _pa) \
2259 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
2260 		((_pa) - (_sc)->sc_desc_paddr)))
2261 	struct ath_softc *sc = arg;
2262 	struct ath_buf *bf;
2263 	struct ieee80211com *ic = &sc->sc_ic;
2264 	struct ifnet *ifp = &ic->ic_if;
2265 	struct ath_hal *ah = sc->sc_ah;
2266 	struct ath_desc *ds;
2267 	struct mbuf *m;
2268 	struct ieee80211_frame *wh, whbuf;
2269 	struct ieee80211_node *ni;
2270 	struct ath_node *an;
2271 	struct ath_recv_hist *rh;
2272 	int len;
2273 	u_int phyerr;
2274 	HAL_STATUS status;
2275 
2276 	DPRINTF(ATH_DEBUG_RX_PROC, ("%s: pending %u\n", __func__, npending));
2277 	do {
2278 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
2279 		if (bf == NULL) {		/* NB: shouldn't happen */
2280 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
2281 			break;
2282 		}
2283 		ds = bf->bf_desc;
2284 		if (ds->ds_link == bf->bf_daddr) {
2285 			/* NB: never process the self-linked entry at the end */
2286 			break;
2287 		}
2288 		m = bf->bf_m;
2289 		if (m == NULL) {		/* NB: shouldn't happen */
2290 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
2291 			continue;
2292 		}
2293 		/* XXX sync descriptor memory */
2294 		/*
2295 		 * Must provide the virtual address of the current
2296 		 * descriptor, the physical address, and the virtual
2297 		 * address of the next descriptor in the h/w chain.
2298 		 * This allows the HAL to look ahead to see if the
2299 		 * hardware is done with a descriptor by checking the
2300 		 * done bit in the following descriptor and the address
2301 		 * of the current descriptor the DMA engine is working
2302 		 * on.  All this is necessary because of our use of
2303 		 * a self-linked list to avoid rx overruns.
2304 		 */
2305 		status = ath_hal_rxprocdesc(ah, ds,
2306 				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
2307 #ifdef AR_DEBUG
2308 		if (ath_debug & ATH_DEBUG_RECV_DESC)
2309 			ath_printrxbuf(bf, status == HAL_OK);
2310 #endif
2311 		if (status == HAL_EINPROGRESS)
2312 			break;
2313 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
2314 		if (ds->ds_rxstat.rs_status != 0) {
2315 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
2316 				sc->sc_stats.ast_rx_crcerr++;
2317 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
2318 				sc->sc_stats.ast_rx_fifoerr++;
2319 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
2320 				sc->sc_stats.ast_rx_badcrypt++;
2321 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
2322 				sc->sc_stats.ast_rx_phyerr++;
2323 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
2324 				sc->sc_stats.ast_rx_phy[phyerr]++;
2325 			} else {
2326 				/*
2327 				 * NB: don't count PHY errors as input errors;
2328 				 * we enable them on the 5212 to collect info
2329 				 * about environmental noise and, in that
2330 				 * setting, they don't really reflect tx/rx
2331 				 * errors.
2332 				 */
2333 				ifp->if_ierrors++;
2334 			}
2335 			goto rx_next;
2336 		}
2337 
2338 		len = ds->ds_rxstat.rs_datalen;
2339 		if (len < IEEE80211_MIN_LEN) {
2340 			DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
2341 				__func__, len));
2342 			sc->sc_stats.ast_rx_tooshort++;
2343 			goto rx_next;
2344 		}
2345 
2346 		ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_POSTREAD);
2347 
2348 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2349 		bf->bf_m = NULL;
2350 		m->m_pkthdr.rcvif = ifp;
2351 		m->m_pkthdr.len = m->m_len = len;
2352 
2353 #if NBPFILTER > 0
2354 		if (sc->sc_drvbpf) {
2355 			sc->sc_rx_th.wr_rate =
2356 				sc->sc_hwmap[ds->ds_rxstat.rs_rate];
2357 			sc->sc_rx_th.wr_antsignal = ds->ds_rxstat.rs_rssi;
2358 			sc->sc_rx_th.wr_antenna = ds->ds_rxstat.rs_antenna;
2359 			/* XXX TSF */
2360 			bpf_mtap2(sc->sc_drvbpf,
2361 				&sc->sc_rx_th, sc->sc_rx_th_len, m);
2362 		}
2363 #endif
2364 
2365 		m_adj(m, -IEEE80211_CRC_LEN);
2366 		wh = mtod(m, struct ieee80211_frame *);
2367 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2368 			/*
2369 			 * WEP is decrypted by hardware. Clear WEP bit
2370 			 * and trim WEP header for ieee80211_input().
2371 			 */
2372 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
2373 			memcpy(&whbuf, wh, sizeof(whbuf));
2374 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
2375 			wh = mtod(m, struct ieee80211_frame *);
2376 			memcpy(wh, &whbuf, sizeof(whbuf));
2377 			/*
2378 			 * Also trim WEP ICV from the tail.
2379 			 */
2380 			m_adj(m, -IEEE80211_WEP_CRCLEN);
2381 			/*
2382 			 * The header has probably moved.
2383 			 */
2384 			wh = mtod(m, struct ieee80211_frame *);
2385 		}
2386 
2387 		/*
2388 		 * Locate the node for sender, track state, and
2389 		 * then pass this node (referenced) up to the 802.11
2390 		 * layer for its use.  We are required to pass
2391 		 * something so we fall back to ic_bss when this frame
2392 		 * is from an unknown sender.
2393 		 */
2394 		ni = ieee80211_find_rxnode(ic, wh);
2395 
2396 		/*
2397 		 * Record driver-specific state.
2398 		 */
2399 		an = ATH_NODE(ni);
2400 		if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE)
2401 			an->an_rx_hist_next = 0;
2402 		rh = &an->an_rx_hist[an->an_rx_hist_next];
2403 		rh->arh_ticks = ATH_TICKS();
2404 		rh->arh_rssi = ds->ds_rxstat.rs_rssi;
2405 		rh->arh_antenna = ds->ds_rxstat.rs_antenna;
2406 
2407 		/*
2408 		 * Send frame up for processing.
2409 		 */
2410 		ieee80211_input(ifp, m, ni,
2411 			ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
2412 
2413 		/*
2414 		 * The frame may have caused the node to be marked for
2415 		 * reclamation (e.g. in response to a DEAUTH message)
2416 		 * so use free_node here instead of unref_node.
2417 		 */
2418 		if (ni == ic->ic_bss)
2419 			ieee80211_unref_node(&ni);
2420 		else
2421 			ieee80211_free_node(ic, ni);
2422   rx_next:
2423 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
2424 	} while (ath_rxbuf_init(sc, bf) == 0);
2425 
2426 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
2427 	ath_hal_rxena(ah);			/* in case of RXEOL */
2428 
2429 #ifdef __NetBSD__
2430 	if ((ifp->if_flags & IFF_OACTIVE) == 0 && !IFQ_IS_EMPTY(&ifp->if_snd))
2431 		ath_start(ifp);
2432 #endif /* __NetBSD__ */
2433 #undef PA2DESC
2434 }
2435 
2436 /*
2437  * XXX Size of an ACK control frame in bytes.
2438  */
2439 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
2440 
2441 static int
2442 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
2443     struct mbuf *m0)
2444 {
2445 	struct ieee80211com *ic = &sc->sc_ic;
2446 	struct ath_hal *ah = sc->sc_ah;
2447 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2448 	int i, error, iswep, hdrlen, pktlen;
2449 	u_int8_t rix, cix, txrate, ctsrate;
2450 	struct ath_desc *ds;
2451 	struct mbuf *m;
2452 	struct ieee80211_frame *wh;
2453 	u_int32_t iv;
2454 	u_int8_t *ivp;
2455 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
2456 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
2457 	u_int subtype, flags, ctsduration, antenna;
2458 	HAL_PKT_TYPE atype;
2459 	const HAL_RATE_TABLE *rt;
2460 	HAL_BOOL shortPreamble;
2461 	struct ath_node *an;
2462 	ath_txq_critsect_decl(s);
2463 
2464 	wh = mtod(m0, struct ieee80211_frame *);
2465 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
2466 	hdrlen = sizeof(struct ieee80211_frame);
2467 	pktlen = m0->m_pkthdr.len;
2468 
2469 	if (iswep) {
2470 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
2471 		m_adj(m0, hdrlen);
2472 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
2473 		if (m0 == NULL) {
2474 			sc->sc_stats.ast_tx_nombuf++;
2475 			return ENOMEM;
2476 		}
2477 		ivp = hdrbuf + hdrlen;
2478 		wh = mtod(m0, struct ieee80211_frame *);
2479 		/*
2480 		 * XXX
2481 		 * IV must not duplicate during the lifetime of the key.
2482 		 * But no mechanism to renew keys is defined in IEEE 802.11
2483 		 * WEP.  And IV may be duplicated between other stations
2484 		 * because of the session key itself is shared.
2485 		 * So we use pseudo random IV for now, though it is not the
2486 		 * right way.
2487 		 */
2488                 iv = ic->ic_iv;
2489 		/*
2490 		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2491 		 * (B, 255, N) with 3 <= B < 8
2492 		 */
2493 		if (iv >= 0x03ff00 && (iv & 0xf8ff00) == 0x00ff00)
2494 			iv += 0x000100;
2495 		ic->ic_iv = iv + 1;
2496 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
2497 			ivp[i] = iv;
2498 			iv >>= 8;
2499 		}
2500 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
2501 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
2502 		/*
2503 		 * The ICV length must be included into hdrlen and pktlen.
2504 		 */
2505 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
2506 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
2507 	}
2508 	pktlen += IEEE80211_CRC_LEN;
2509 
2510 	/*
2511 	 * Load the DMA map so any coalescing is done.  This
2512 	 * also calculates the number of descriptors we need.
2513 	 */
2514 	error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m0, BUS_DMA_NOWAIT);
2515 	/*
2516 	 * Discard null packets and check for packets that
2517 	 * require too many TX descriptors.  We try to convert
2518 	 * the latter to a cluster.
2519 	 */
2520 	if (error == EFBIG) {		/* too many desc's, linearize */
2521 		sc->sc_stats.ast_tx_linear++;
2522 		MGETHDR(m, M_DONTWAIT, MT_DATA);
2523 		if (m == NULL) {
2524 			sc->sc_stats.ast_tx_nombuf++;
2525 			m_freem(m0);
2526 			return ENOMEM;
2527 		}
2528 #ifdef __FreeBSD__
2529 		M_MOVE_PKTHDR(m, m0);
2530 #else
2531 		M_COPY_PKTHDR(m, m0);
2532 #endif
2533 		MCLGET(m, M_DONTWAIT);
2534 		if ((m->m_flags & M_EXT) == 0) {
2535 			sc->sc_stats.ast_tx_nomcl++;
2536 			m_freem(m0);
2537 			m_free(m);
2538 			return ENOMEM;
2539 		}
2540 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
2541 		m_freem(m0);
2542 		m->m_len = m->m_pkthdr.len;
2543 		m0 = m;
2544 		error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m0,
2545 					         BUS_DMA_NOWAIT);
2546 		if (error != 0) {
2547 			sc->sc_stats.ast_tx_busdma++;
2548 			m_freem(m0);
2549 			return error;
2550 		}
2551 		KASSERT(bf->bf_nseg == 1,
2552 			("ath_tx_start: packet not one segment; nseg %u",
2553 			bf->bf_nseg));
2554 	} else if (error != 0) {
2555 		sc->sc_stats.ast_tx_busdma++;
2556 		m_freem(m0);
2557 		return error;
2558 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
2559 		sc->sc_stats.ast_tx_nodata++;
2560 		m_freem(m0);
2561 		return EIO;
2562 	}
2563 	DPRINTF(ATH_DEBUG_XMIT, ("%s: m %p len %u\n", __func__, m0, pktlen));
2564 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREWRITE);
2565 	bf->bf_m = m0;
2566 	bf->bf_node = ni;			/* NB: held reference */
2567 
2568 	/* setup descriptors */
2569 	ds = bf->bf_desc;
2570 	rt = sc->sc_currates;
2571 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
2572 
2573 	/*
2574 	 * Calculate Atheros packet type from IEEE80211 packet header
2575 	 * and setup for rate calculations.
2576 	 */
2577 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
2578 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
2579 	case IEEE80211_FC0_TYPE_MGT:
2580 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2581 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
2582 			atype = HAL_PKT_TYPE_BEACON;
2583 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2584 			atype = HAL_PKT_TYPE_PROBE_RESP;
2585 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
2586 			atype = HAL_PKT_TYPE_ATIM;
2587 		rix = 0;			/* XXX lowest rate */
2588 		break;
2589 	case IEEE80211_FC0_TYPE_CTL:
2590 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2591 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
2592 			atype = HAL_PKT_TYPE_PSPOLL;
2593 		rix = 0;			/* XXX lowest rate */
2594 		break;
2595 	default:
2596 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
2597 				IEEE80211_RATE_VAL];
2598 		if (rix == 0xff) {
2599 			if_printf(ifp, "bogus xmit rate 0x%x\n",
2600 				ni->ni_rates.rs_rates[ni->ni_txrate]);
2601 			sc->sc_stats.ast_tx_badrate++;
2602 			m_freem(m0);
2603 			return EIO;
2604 		}
2605 		break;
2606 	}
2607 	/*
2608 	 * NB: the 802.11 layer marks whether or not we should
2609 	 * use short preamble based on the current mode and
2610 	 * negotiated parameters.
2611 	 */
2612 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2613 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
2614 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
2615 		shortPreamble = AH_TRUE;
2616 		sc->sc_stats.ast_tx_shortpre++;
2617 	} else {
2618 		txrate = rt->info[rix].rateCode;
2619 		shortPreamble = AH_FALSE;
2620 	}
2621 
2622 	/*
2623 	 * Calculate miscellaneous flags.
2624 	 */
2625 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
2626 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2627 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
2628 		sc->sc_stats.ast_tx_noack++;
2629 	} else if (pktlen > ic->ic_rtsthreshold) {
2630 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
2631 		sc->sc_stats.ast_tx_rts++;
2632 	}
2633 
2634 	/*
2635 	 * Calculate duration.  This logically belongs in the 802.11
2636 	 * layer but it lacks sufficient information to calculate it.
2637 	 */
2638 	if ((flags & HAL_TXDESC_NOACK) == 0 &&
2639 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
2640 		u_int16_t dur;
2641 		/*
2642 		 * XXX not right with fragmentation.
2643 		 */
2644 		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
2645 				rix, shortPreamble);
2646 		*((u_int16_t*) wh->i_dur) = htole16(dur);
2647 	}
2648 
2649 	/*
2650 	 * Calculate RTS/CTS rate and duration if needed.
2651 	 */
2652 	ctsduration = 0;
2653 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
2654 		/*
2655 		 * CTS transmit rate is derived from the transmit rate
2656 		 * by looking in the h/w rate table.  We must also factor
2657 		 * in whether or not a short preamble is to be used.
2658 		 */
2659 		cix = rt->info[rix].controlRate;
2660 		ctsrate = rt->info[cix].rateCode;
2661 		if (shortPreamble)
2662 			ctsrate |= rt->info[cix].shortPreamble;
2663 		/*
2664 		 * Compute the transmit duration based on the size
2665 		 * of an ACK frame.  We call into the HAL to do the
2666 		 * computation since it depends on the characteristics
2667 		 * of the actual PHY being used.
2668 		 */
2669 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
2670 			ctsduration += ath_hal_computetxtime(ah,
2671 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2672 		}
2673 		/* SIFS + data */
2674 		ctsduration += ath_hal_computetxtime(ah,
2675 			rt, pktlen, rix, shortPreamble);
2676 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
2677 			ctsduration += ath_hal_computetxtime(ah,
2678 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2679 		}
2680 	} else
2681 		ctsrate = 0;
2682 
2683 	/*
2684 	 * For now use the antenna on which the last good
2685 	 * frame was received on.  We assume this field is
2686 	 * initialized to 0 which gives us ``auto'' or the
2687 	 * ``default'' antenna.
2688 	 */
2689 	an = (struct ath_node *) ni;
2690 	if (an->an_tx_antenna)
2691 		antenna = an->an_tx_antenna;
2692 	else
2693 		antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
2694 
2695 	if (ic->ic_rawbpf)
2696 		bpf_mtap(ic->ic_rawbpf, m0);
2697 	if (sc->sc_drvbpf) {
2698 		sc->sc_tx_th.wt_flags = 0;
2699 		if (shortPreamble)
2700 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2701 		if (iswep)
2702 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2703 		sc->sc_tx_th.wt_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
2704 		sc->sc_tx_th.wt_txpower = 60/2;		/* XXX */
2705 		sc->sc_tx_th.wt_antenna = antenna;
2706 
2707 		bpf_mtap2(sc->sc_drvbpf,
2708 			&sc->sc_tx_th, sc->sc_tx_th_len, m0);
2709 	}
2710 
2711 	/*
2712 	 * Formulate first tx descriptor with tx controls.
2713 	 */
2714 	/* XXX check return value? */
2715 	ath_hal_setuptxdesc(ah, ds
2716 		, pktlen		/* packet length */
2717 		, hdrlen		/* header length */
2718 		, atype			/* Atheros packet type */
2719 		, 60			/* txpower XXX */
2720 		, txrate, 1+10		/* series 0 rate/tries */
2721 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
2722 		, antenna		/* antenna mode */
2723 		, flags			/* flags */
2724 		, ctsrate		/* rts/cts rate */
2725 		, ctsduration		/* rts/cts duration */
2726 	);
2727 #ifdef notyet
2728 	ath_hal_setupxtxdesc(ah, ds
2729 		, AH_FALSE		/* short preamble */
2730 		, 0, 0			/* series 1 rate/tries */
2731 		, 0, 0			/* series 2 rate/tries */
2732 		, 0, 0			/* series 3 rate/tries */
2733 	);
2734 #endif
2735 	/*
2736 	 * Fillin the remainder of the descriptor info.
2737 	 */
2738 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
2739 		ds->ds_data = bf->bf_segs[i].ds_addr;
2740 		if (i == bf->bf_nseg - 1)
2741 			ds->ds_link = 0;
2742 		else
2743 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
2744 		ath_hal_filltxdesc(ah, ds
2745 			, bf->bf_segs[i].ds_len	/* segment length */
2746 			, i == 0		/* first segment */
2747 			, i == bf->bf_nseg - 1	/* last segment */
2748 		);
2749 		DPRINTF(ATH_DEBUG_XMIT,
2750 			("%s: %d: %08x %08x %08x %08x %08x %08x\n",
2751 			__func__, i, ds->ds_link, ds->ds_data,
2752 			ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]));
2753 	}
2754 
2755 	/*
2756 	 * Insert the frame on the outbound list and
2757 	 * pass it on to the hardware.
2758 	 */
2759 	ath_txq_critsect_begin(sc, s);
2760 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
2761 	if (sc->sc_txlink == NULL) {
2762 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
2763 		DPRINTF(ATH_DEBUG_XMIT, ("%s: TXDP0 = %p (%p)\n", __func__,
2764 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
2765 	} else {
2766 		*sc->sc_txlink = bf->bf_daddr;
2767 		DPRINTF(ATH_DEBUG_XMIT, ("%s: link(%p)=%p (%p)\n", __func__,
2768 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
2769 	}
2770 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
2771 	ath_txq_critsect_end(sc, s);
2772 
2773 	ath_hal_txstart(ah, sc->sc_txhalq);
2774 	return 0;
2775 }
2776 
2777 static void
2778 ath_tx_proc(void *arg, int npending)
2779 {
2780 	struct ath_softc *sc = arg;
2781 	struct ath_hal *ah = sc->sc_ah;
2782 	struct ath_buf *bf;
2783 	struct ieee80211com *ic = &sc->sc_ic;
2784 	struct ifnet *ifp = &ic->ic_if;
2785 	struct ath_desc *ds;
2786 	struct ieee80211_node *ni;
2787 	struct ath_node *an;
2788 	int sr, lr;
2789 	HAL_STATUS status;
2790 	ath_txq_critsect_decl(s);
2791 	ath_txbuf_critsect_decl(s2);
2792 
2793 	DPRINTF(ATH_DEBUG_TX_PROC, ("%s: pending %u tx queue %p, link %p\n",
2794 		__func__, npending,
2795 		(caddr_t)(uintptr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
2796 		sc->sc_txlink));
2797 	for (;;) {
2798 		ath_txq_critsect_begin(sc, s);
2799 		bf = TAILQ_FIRST(&sc->sc_txq);
2800 		if (bf == NULL) {
2801 			sc->sc_txlink = NULL;
2802 			ath_txq_critsect_end(sc, s);
2803 			break;
2804 		}
2805 		/* only the last descriptor is needed */
2806 		ds = &bf->bf_desc[bf->bf_nseg - 1];
2807 		status = ath_hal_txprocdesc(ah, ds);
2808 #ifdef AR_DEBUG
2809 		if (ath_debug & ATH_DEBUG_XMIT_DESC)
2810 			ath_printtxbuf(bf, status == HAL_OK);
2811 #endif
2812 		if (status == HAL_EINPROGRESS) {
2813 			ath_txq_critsect_end(sc, s);
2814 			break;
2815 		}
2816 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2817 		ath_txq_critsect_end(sc, s);
2818 
2819 		ni = bf->bf_node;
2820 		if (ni != NULL) {
2821 			an = (struct ath_node *) ni;
2822 			if (ds->ds_txstat.ts_status == 0) {
2823 				an->an_tx_ok++;
2824 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
2825 			} else {
2826 				an->an_tx_err++;
2827 				ifp->if_oerrors++;
2828 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
2829 					sc->sc_stats.ast_tx_xretries++;
2830 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
2831 					sc->sc_stats.ast_tx_fifoerr++;
2832 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
2833 					sc->sc_stats.ast_tx_filtered++;
2834 				an->an_tx_antenna = 0;	/* invalidate */
2835 			}
2836 			sr = ds->ds_txstat.ts_shortretry;
2837 			lr = ds->ds_txstat.ts_longretry;
2838 			sc->sc_stats.ast_tx_shortretry += sr;
2839 			sc->sc_stats.ast_tx_longretry += lr;
2840 			if (sr + lr)
2841 				an->an_tx_retr++;
2842 			/*
2843 			 * Reclaim reference to node.
2844 			 *
2845 			 * NB: the node may be reclaimed here if, for example
2846 			 *     this is a DEAUTH message that was sent and the
2847 			 *     node was timed out due to inactivity.
2848 			 */
2849 			if (ni != ic->ic_bss)
2850 				ieee80211_free_node(ic, ni);
2851 		}
2852 		ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_POSTWRITE);
2853 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2854 		m_freem(bf->bf_m);
2855 		bf->bf_m = NULL;
2856 		bf->bf_node = NULL;
2857 
2858 		ath_txbuf_critsect_begin(sc, s2);
2859 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2860 		ath_txbuf_critsect_end(sc, s2);
2861 	}
2862 	ifp->if_flags &= ~IFF_OACTIVE;
2863 	sc->sc_tx_timer = 0;
2864 
2865 	ath_start(ifp);
2866 }
2867 
2868 /*
2869  * Drain the transmit queue and reclaim resources.
2870  */
2871 static void
2872 ath_draintxq(struct ath_softc *sc)
2873 {
2874 	struct ath_hal *ah = sc->sc_ah;
2875 	struct ieee80211com *ic = &sc->sc_ic;
2876 	struct ifnet *ifp = &ic->ic_if;
2877 	struct ieee80211_node *ni;
2878 	struct ath_buf *bf;
2879 	ath_txq_critsect_decl(s);
2880 	ath_txbuf_critsect_decl(s2);
2881 
2882 	/* XXX return value */
2883 	if (!sc->sc_invalid) {
2884 		/* don't touch the hardware if marked invalid */
2885 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
2886 		DPRINTF(ATH_DEBUG_RESET,
2887 		    ("%s: tx queue %p, link %p\n", __func__,
2888 		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
2889 		    sc->sc_txlink));
2890 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
2891 		DPRINTF(ATH_DEBUG_RESET,
2892 		    ("%s: beacon queue %p\n", __func__,
2893 		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
2894 	}
2895 	for (;;) {
2896 		ath_txq_critsect_begin(sc, s);
2897 		bf = TAILQ_FIRST(&sc->sc_txq);
2898 		if (bf == NULL) {
2899 			sc->sc_txlink = NULL;
2900 			ath_txq_critsect_end(sc, s);
2901 			break;
2902 		}
2903 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2904 		ath_txq_critsect_end(sc, s);
2905 #ifdef AR_DEBUG
2906 		if (ath_debug & ATH_DEBUG_RESET)
2907 			ath_printtxbuf(bf,
2908 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
2909 #endif /* AR_DEBUG */
2910 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2911 		m_freem(bf->bf_m);
2912 		bf->bf_m = NULL;
2913 		ni = bf->bf_node;
2914 		bf->bf_node = NULL;
2915 		ath_txbuf_critsect_begin(sc, s2);
2916 		if (ni != NULL && ni != ic->ic_bss) {
2917 			/*
2918 			 * Reclaim node reference.
2919 			 */
2920 			ieee80211_free_node(ic, ni);
2921 		}
2922 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2923 		ath_txbuf_critsect_end(sc, s2);
2924 	}
2925 	ifp->if_flags &= ~IFF_OACTIVE;
2926 	sc->sc_tx_timer = 0;
2927 }
2928 
2929 /*
2930  * Disable the receive h/w in preparation for a reset.
2931  */
2932 static void
2933 ath_stoprecv(struct ath_softc *sc)
2934 {
2935 #define	PA2DESC(_sc, _pa) \
2936 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
2937 		((_pa) - (_sc)->sc_desc_paddr)))
2938 	struct ath_hal *ah = sc->sc_ah;
2939 
2940 	ath_hal_stoppcurecv(ah);	/* disable PCU */
2941 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
2942 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
2943 	DELAY(3000);			/* long enough for 1 frame */
2944 #ifdef AR_DEBUG
2945 	if (ath_debug & ATH_DEBUG_RESET) {
2946 		struct ath_buf *bf;
2947 
2948 		printf("%s: rx queue %p, link %p\n", __func__,
2949 			(caddr_t)(uintptr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink);
2950 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2951 			struct ath_desc *ds = bf->bf_desc;
2952 			if (ath_hal_rxprocdesc(ah, ds, bf->bf_daddr,
2953 			    PA2DESC(sc, ds->ds_link)) == HAL_OK)
2954 				ath_printrxbuf(bf, 1);
2955 		}
2956 	}
2957 #endif
2958 	sc->sc_rxlink = NULL;		/* just in case */
2959 #undef PA2DESC
2960 }
2961 
2962 /*
2963  * Enable the receive h/w following a reset.
2964  */
2965 static int
2966 ath_startrecv(struct ath_softc *sc)
2967 {
2968 	struct ath_hal *ah = sc->sc_ah;
2969 	struct ath_buf *bf;
2970 
2971 	sc->sc_rxlink = NULL;
2972 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2973 		int error = ath_rxbuf_init(sc, bf);
2974 		if (error != 0) {
2975 			DPRINTF(ATH_DEBUG_RECV,
2976 				("%s: ath_rxbuf_init failed %d\n",
2977 				__func__, error));
2978 			return error;
2979 		}
2980 	}
2981 
2982 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2983 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2984 	ath_hal_rxena(ah);		/* enable recv descriptors */
2985 	ath_mode_init(sc);		/* set filters, etc. */
2986 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2987 	return 0;
2988 }
2989 
2990 /*
2991  * Set/change channels.  If the channel is really being changed,
2992  * it's done by resetting the chip.  To accomplish this we must
2993  * first cleanup any pending DMA, then restart stuff after a la
2994  * ath_init.
2995  */
2996 static int
2997 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2998 {
2999 	struct ath_hal *ah = sc->sc_ah;
3000 	struct ieee80211com *ic = &sc->sc_ic;
3001 
3002 	DPRINTF(ATH_DEBUG_ANY, ("%s: %u (%u MHz) -> %u (%u MHz)\n", __func__,
3003 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
3004 		ic->ic_ibss_chan->ic_freq,
3005 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
3006 	if (chan != ic->ic_ibss_chan) {
3007 		HAL_STATUS status;
3008 		HAL_CHANNEL hchan;
3009 		enum ieee80211_phymode mode;
3010 
3011 		/*
3012 		 * To switch channels clear any pending DMA operations;
3013 		 * wait long enough for the RX fifo to drain, reset the
3014 		 * hardware at the new frequency, and then re-enable
3015 		 * the relevant bits of the h/w.
3016 		 */
3017 		ath_hal_intrset(ah, 0);		/* disable interrupts */
3018 		ath_draintxq(sc);		/* clear pending tx frames */
3019 		ath_stoprecv(sc);		/* turn off frame recv */
3020 		/*
3021 		 * Convert to a HAL channel description with
3022 		 * the flags constrained to reflect the current
3023 		 * operating mode.
3024 		 */
3025 		hchan.channel = chan->ic_freq;
3026 		hchan.channelFlags = ath_chan2flags(ic, chan);
3027 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
3028 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
3029 				"channel %u (%u Mhz)\n",
3030 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
3031 			return EIO;
3032 		}
3033 		/*
3034 		 * Re-enable rx framework.
3035 		 */
3036 		if (ath_startrecv(sc) != 0) {
3037 			if_printf(&ic->ic_if,
3038 				"ath_chan_set: unable to restart recv logic\n");
3039 			return EIO;
3040 		}
3041 
3042 		/*
3043 		 * Update BPF state.
3044 		 */
3045 		sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
3046 			htole16(chan->ic_freq);
3047 		sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
3048 			htole16(chan->ic_flags);
3049 
3050 		/*
3051 		 * Change channels and update the h/w rate map
3052 		 * if we're switching; e.g. 11a to 11b/g.
3053 		 */
3054 		ic->ic_ibss_chan = chan;
3055 		mode = ieee80211_chan2mode(ic, chan);
3056 		if (mode != sc->sc_curmode)
3057 			ath_setcurmode(sc, mode);
3058 
3059 		/*
3060 		 * Re-enable interrupts.
3061 		 */
3062 		ath_hal_intrset(ah, sc->sc_imask);
3063 	}
3064 	return 0;
3065 }
3066 
3067 static void
3068 ath_next_scan(void *arg)
3069 {
3070 	struct ath_softc *sc = arg;
3071 	struct ieee80211com *ic = &sc->sc_ic;
3072 	struct ifnet *ifp = &ic->ic_if;
3073 	int s;
3074 
3075 	/* don't call ath_start w/o network interrupts blocked */
3076 	s = splnet();
3077 
3078 	if (ic->ic_state == IEEE80211_S_SCAN)
3079 		ieee80211_next_scan(ifp);
3080 	splx(s);
3081 }
3082 
3083 /*
3084  * Periodically recalibrate the PHY to account
3085  * for temperature/environment changes.
3086  */
3087 static void
3088 ath_calibrate(void *arg)
3089 {
3090 	struct ath_softc *sc = arg;
3091 	struct ath_hal *ah = sc->sc_ah;
3092 	struct ieee80211com *ic = &sc->sc_ic;
3093 	struct ieee80211_channel *c;
3094 	HAL_CHANNEL hchan;
3095 
3096 	sc->sc_stats.ast_per_cal++;
3097 
3098 	/*
3099 	 * Convert to a HAL channel description with the flags
3100 	 * constrained to reflect the current operating mode.
3101 	 */
3102 	c = ic->ic_ibss_chan;
3103 	hchan.channel = c->ic_freq;
3104 	hchan.channelFlags = ath_chan2flags(ic, c);
3105 
3106 	DPRINTF(ATH_DEBUG_CALIBRATE,
3107 		("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
3108 
3109 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
3110 		/*
3111 		 * Rfgain is out of bounds, reset the chip
3112 		 * to load new gain values.
3113 		 */
3114 		sc->sc_stats.ast_per_rfgain++;
3115 		ath_reset(sc);
3116 	}
3117 	if (!ath_hal_calibrate(ah, &hchan)) {
3118 		DPRINTF(ATH_DEBUG_ANY,
3119 			("%s: calibration of channel %u failed\n",
3120 			__func__, c->ic_freq));
3121 		sc->sc_stats.ast_per_calfail++;
3122 	}
3123 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
3124 }
3125 
3126 static HAL_LED_STATE
3127 ath_state_to_led(enum ieee80211_state state)
3128 {
3129 	switch (state) {
3130 	case IEEE80211_S_INIT:
3131 		return HAL_LED_INIT;
3132 	case IEEE80211_S_SCAN:
3133 		return HAL_LED_SCAN;
3134 	case IEEE80211_S_AUTH:
3135 		return HAL_LED_AUTH;
3136 	case IEEE80211_S_ASSOC:
3137 		return HAL_LED_ASSOC;
3138 	case IEEE80211_S_RUN:
3139 		return HAL_LED_RUN;
3140 	default:
3141 		panic("%s: unknown 802.11 state %d\n", __func__, state);
3142 		return HAL_LED_INIT;
3143 	}
3144 }
3145 
3146 static int
3147 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
3148 {
3149 	struct ifnet *ifp = &ic->ic_if;
3150 	struct ath_softc *sc = ifp->if_softc;
3151 	struct ath_hal *ah = sc->sc_ah;
3152 	struct ieee80211_node *ni;
3153 	int i, error;
3154 	const u_int8_t *bssid;
3155 	u_int32_t rfilt;
3156 
3157 	DPRINTF(ATH_DEBUG_ANY, ("%s: %s -> %s\n", __func__,
3158 		ieee80211_state_name[ic->ic_state],
3159 		ieee80211_state_name[nstate]));
3160 
3161 	ath_hal_setledstate(ah, ath_state_to_led(nstate));	/* set LED */
3162 
3163 	if (nstate == IEEE80211_S_INIT) {
3164 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
3165 		ath_hal_intrset(ah, sc->sc_imask);
3166 		callout_stop(&sc->sc_scan_ch);
3167 		callout_stop(&sc->sc_cal_ch);
3168 		return (*sc->sc_newstate)(ic, nstate, arg);
3169 	}
3170 	ni = ic->ic_bss;
3171 	error = ath_chan_set(sc, ni->ni_chan);
3172 	if (error != 0)
3173 		goto bad;
3174 	rfilt = ath_calcrxfilter(sc);
3175 	if (nstate == IEEE80211_S_SCAN) {
3176 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
3177 			ath_next_scan, sc);
3178 		bssid = ifp->if_broadcastaddr;
3179 	} else {
3180 		callout_stop(&sc->sc_scan_ch);
3181 		bssid = ni->ni_bssid;
3182 	}
3183 	ath_hal_setrxfilter(ah, rfilt);
3184 	DPRINTF(ATH_DEBUG_ANY, ("%s: RX filter 0x%x bssid %s\n",
3185 		 __func__, rfilt, ether_sprintf(bssid)));
3186 
3187 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
3188 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
3189 	else
3190 		ath_hal_setassocid(ah, bssid, 0);
3191 	if (ic->ic_flags & IEEE80211_F_WEPON) {
3192 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
3193 			if (ath_hal_keyisvalid(ah, i))
3194 				ath_hal_keysetmac(ah, i, bssid);
3195 	}
3196 
3197 	if (nstate == IEEE80211_S_RUN) {
3198 		DPRINTF(ATH_DEBUG_ANY, ("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
3199 			"capinfo=0x%04x chan=%d\n"
3200 			 , __func__
3201 			 , ic->ic_flags
3202 			 , ni->ni_intval
3203 			 , ether_sprintf(ni->ni_bssid)
3204 			 , ni->ni_capinfo
3205 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
3206 
3207 		/*
3208 		 * Allocate and setup the beacon frame for AP or adhoc mode.
3209 		 */
3210 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
3211 		    ic->ic_opmode == IEEE80211_M_IBSS) {
3212 			error = ath_beacon_alloc(sc, ni);
3213 			if (error != 0)
3214 				goto bad;
3215 		}
3216 
3217 		/*
3218 		 * Configure the beacon and sleep timers.
3219 		 */
3220 		ath_beacon_config(sc);
3221 
3222 		/* start periodic recalibration timer */
3223 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
3224 			ath_calibrate, sc);
3225 	} else {
3226 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
3227 		ath_hal_intrset(ah, sc->sc_imask);
3228 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
3229 	}
3230 	/*
3231 	 * Reset the rate control state.
3232 	 */
3233 	ath_rate_ctl_reset(sc, nstate);
3234 	/*
3235 	 * Invoke the parent method to complete the work.
3236 	 */
3237 	return (*sc->sc_newstate)(ic, nstate, arg);
3238 bad:
3239 	callout_stop(&sc->sc_scan_ch);
3240 	callout_stop(&sc->sc_cal_ch);
3241 	/* NB: do not invoke the parent */
3242 	return error;
3243 }
3244 
3245 /*
3246  * Setup driver-specific state for a newly associated node.
3247  * Note that we're called also on a re-associate, the isnew
3248  * param tells us if this is the first time or not.
3249  */
3250 static void
3251 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
3252 {
3253 	if (isnew) {
3254 		struct ath_node *an = (struct ath_node *) ni;
3255 
3256 		an->an_tx_ok = an->an_tx_err =
3257 			an->an_tx_retr = an->an_tx_upper = 0;
3258 		/* start with highest negotiated rate */
3259 		/*
3260 		 * XXX should do otherwise but only when
3261 		 * the rate control algorithm is better.
3262 		 */
3263 		KASSERT(ni->ni_rates.rs_nrates > 0,
3264 			("new association w/ no rates!"));
3265 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
3266 	}
3267 }
3268 
3269 static int
3270 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor,
3271     HAL_BOOL xchanmode)
3272 {
3273 	struct ieee80211com *ic = &sc->sc_ic;
3274 	struct ifnet *ifp = &ic->ic_if;
3275 	struct ath_hal *ah = sc->sc_ah;
3276 	HAL_CHANNEL *chans;
3277 	int i, ix, nchan;
3278 
3279 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
3280 			M_TEMP, M_NOWAIT);
3281 	if (chans == NULL) {
3282 		if_printf(ifp, "unable to allocate channel table\n");
3283 		return ENOMEM;
3284 	}
3285 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
3286 	    cc, HAL_MODE_ALL, outdoor, xchanmode)) {
3287 		if_printf(ifp, "unable to collect channel list from hal\n");
3288 		free(chans, M_TEMP);
3289 		return EINVAL;
3290 	}
3291 
3292 	/*
3293 	 * Convert HAL channels to ieee80211 ones and insert
3294 	 * them in the table according to their channel number.
3295 	 */
3296 	for (i = 0; i < nchan; i++) {
3297 		HAL_CHANNEL *c = &chans[i];
3298 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
3299 		if (ix > IEEE80211_CHAN_MAX) {
3300 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
3301 				ix, c->channel, c->channelFlags);
3302 			continue;
3303 		}
3304 		DPRINTF(ATH_DEBUG_ANY,
3305 		    ("%s: HAL channel %d/%d freq %d flags %#04x idx %d\n",
3306 		    sc->sc_dev.dv_xname, i, nchan, c->channel, c->channelFlags,
3307 		    ix));
3308 		/* NB: flags are known to be compatible */
3309 		if (ic->ic_channels[ix].ic_freq == 0) {
3310 			ic->ic_channels[ix].ic_freq = c->channel;
3311 			ic->ic_channels[ix].ic_flags = c->channelFlags;
3312 		} else {
3313 			/* channels overlap; e.g. 11g and 11b */
3314 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
3315 		}
3316 	}
3317 	free(chans, M_TEMP);
3318 	return 0;
3319 }
3320 
3321 static int
3322 ath_rate_setup(struct ath_softc *sc, u_int mode)
3323 {
3324 	struct ath_hal *ah = sc->sc_ah;
3325 	struct ieee80211com *ic = &sc->sc_ic;
3326 	const HAL_RATE_TABLE *rt;
3327 	struct ieee80211_rateset *rs;
3328 	int i, maxrates;
3329 
3330 	switch (mode) {
3331 	case IEEE80211_MODE_11A:
3332 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
3333 		break;
3334 	case IEEE80211_MODE_11B:
3335 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
3336 		break;
3337 	case IEEE80211_MODE_11G:
3338 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
3339 		break;
3340 	case IEEE80211_MODE_TURBO:
3341 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
3342 		break;
3343 	default:
3344 		DPRINTF(ATH_DEBUG_ANY,
3345 			("%s: invalid mode %u\n", __func__, mode));
3346 		return 0;
3347 	}
3348 	rt = sc->sc_rates[mode];
3349 	if (rt == NULL)
3350 		return 0;
3351 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
3352 		DPRINTF(ATH_DEBUG_ANY,
3353 			("%s: rate table too small (%u > %u)\n",
3354 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
3355 		maxrates = IEEE80211_RATE_MAXSIZE;
3356 	} else
3357 		maxrates = rt->rateCount;
3358 	rs = &ic->ic_sup_rates[mode];
3359 	for (i = 0; i < maxrates; i++)
3360 		rs->rs_rates[i] = rt->info[i].dot11Rate;
3361 	rs->rs_nrates = maxrates;
3362 	return 1;
3363 }
3364 
3365 static void
3366 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
3367 {
3368 	const HAL_RATE_TABLE *rt;
3369 	int i;
3370 
3371 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
3372 	rt = sc->sc_rates[mode];
3373 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
3374 	for (i = 0; i < rt->rateCount; i++)
3375 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
3376 	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
3377 	for (i = 0; i < 32; i++)
3378 		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
3379 	sc->sc_currates = rt;
3380 	sc->sc_curmode = mode;
3381 }
3382 
3383 /*
3384  * Reset the rate control state for each 802.11 state transition.
3385  */
3386 static void
3387 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
3388 {
3389 	struct ieee80211com *ic = &sc->sc_ic;
3390 	struct ieee80211_node *ni;
3391 	struct ath_node *an;
3392 
3393 	if (ic->ic_opmode != IEEE80211_M_STA) {
3394 		/*
3395 		 * When operating as a station the node table holds
3396 		 * the AP's that were discovered during scanning.
3397 		 * For any other operating mode we want to reset the
3398 		 * tx rate state of each node.
3399 		 */
3400 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
3401 			ni->ni_txrate = 0;		/* use lowest rate */
3402 			an = (struct ath_node *) ni;
3403 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
3404 			    an->an_tx_upper = 0;
3405 		}
3406 	}
3407 	/*
3408 	 * Reset local xmit state; this is really only meaningful
3409 	 * when operating in station or adhoc mode.
3410 	 */
3411 	ni = ic->ic_bss;
3412 	an = (struct ath_node *) ni;
3413 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
3414 	if (state == IEEE80211_S_RUN) {
3415 		/* start with highest negotiated rate */
3416 		KASSERT(ni->ni_rates.rs_nrates > 0,
3417 			("transition to RUN state w/ no rates!"));
3418 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
3419 	} else {
3420 		/* use lowest rate */
3421 		ni->ni_txrate = 0;
3422 	}
3423 }
3424 
3425 /*
3426  * Examine and potentially adjust the transmit rate.
3427  */
3428 static void
3429 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
3430 {
3431 	struct ath_softc *sc = arg;
3432 	struct ath_node *an = (struct ath_node *) ni;
3433 	struct ieee80211_rateset *rs = &ni->ni_rates;
3434 	int mod = 0, orate, enough;
3435 
3436 	/*
3437 	 * Rate control
3438 	 * XXX: very primitive version.
3439 	 */
3440 	sc->sc_stats.ast_rate_calls++;
3441 
3442 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
3443 
3444 	/* no packet reached -> down */
3445 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
3446 		mod = -1;
3447 
3448 	/* all packets needs retry in average -> down */
3449 	if (enough && an->an_tx_ok < an->an_tx_retr)
3450 		mod = -1;
3451 
3452 	/* no error and less than 10% of packets needs retry -> up */
3453 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
3454 		mod = 1;
3455 
3456 	orate = ni->ni_txrate;
3457 	switch (mod) {
3458 	case 0:
3459 		if (enough && an->an_tx_upper > 0)
3460 			an->an_tx_upper--;
3461 		break;
3462 	case -1:
3463 		if (ni->ni_txrate > 0) {
3464 			ni->ni_txrate--;
3465 			sc->sc_stats.ast_rate_drop++;
3466 		}
3467 		an->an_tx_upper = 0;
3468 		break;
3469 	case 1:
3470 		if (++an->an_tx_upper < 2)
3471 			break;
3472 		an->an_tx_upper = 0;
3473 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
3474 			ni->ni_txrate++;
3475 			sc->sc_stats.ast_rate_raise++;
3476 		}
3477 		break;
3478 	}
3479 
3480 	if (ni->ni_txrate != orate) {
3481 		DPRINTF(ATH_DEBUG_RATE,
3482 		    ("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
3483 		    __func__,
3484 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
3485 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
3486 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr));
3487 	}
3488 	if (ni->ni_txrate != orate || enough)
3489 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
3490 }
3491 
3492 #ifdef AR_DEBUG
3493 #ifdef __FreeBSD__
3494 static int
3495 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
3496 {
3497 	char dmode[64];
3498 	int error;
3499 
3500 	strncpy(dmode, "", sizeof(dmode) - 1);
3501 	dmode[sizeof(dmode) - 1] = '\0';
3502 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
3503 
3504 	if (error == 0 && req->newptr != NULL) {
3505 		struct ifnet *ifp;
3506 		struct ath_softc *sc;
3507 
3508 		ifp = ifunit("ath0");		/* XXX */
3509 		if (!ifp)
3510 			return EINVAL;
3511 		sc = ifp->if_softc;
3512 		if (strcmp(dmode, "hal") == 0)
3513 			ath_hal_dumpstate(sc->sc_ah);
3514 		else
3515 			return EINVAL;
3516 	}
3517 	return error;
3518 }
3519 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
3520 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
3521 #endif /* __FreeBSD__ */
3522 
3523 #if 0 /* #ifdef __NetBSD__ */
3524 static int
3525 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
3526 {
3527 	char dmode[64];
3528 	int error;
3529 
3530 	strncpy(dmode, "", sizeof(dmode) - 1);
3531 	dmode[sizeof(dmode) - 1] = '\0';
3532 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
3533 
3534 	if (error == 0 && req->newptr != NULL) {
3535 		struct ifnet *ifp;
3536 		struct ath_softc *sc;
3537 
3538 		ifp = ifunit("ath0");		/* XXX */
3539 		if (!ifp)
3540 			return EINVAL;
3541 		sc = ifp->if_softc;
3542 		if (strcmp(dmode, "hal") == 0)
3543 			ath_hal_dumpstate(sc->sc_ah);
3544 		else
3545 			return EINVAL;
3546 	}
3547 	return error;
3548 }
3549 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
3550 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
3551 #endif /* __NetBSD__ */
3552 
3553 static void
3554 ath_printrxbuf(struct ath_buf *bf, int done)
3555 {
3556 	struct ath_desc *ds;
3557 	int i;
3558 
3559 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
3560 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
3561 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
3562 		    ds->ds_link, ds->ds_data,
3563 		    ds->ds_ctl0, ds->ds_ctl1,
3564 		    ds->ds_hw[0], ds->ds_hw[1],
3565 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
3566 	}
3567 }
3568 
3569 static void
3570 ath_printtxbuf(struct ath_buf *bf, int done)
3571 {
3572 	struct ath_desc *ds;
3573 	int i;
3574 
3575 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
3576 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
3577 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
3578 		    ds->ds_link, ds->ds_data,
3579 		    ds->ds_ctl0, ds->ds_ctl1,
3580 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
3581 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
3582 	}
3583 }
3584 #endif /* AR_DEBUG */
3585