xref: /openbsd-src/sys/dev/ic/ath.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*      $OpenBSD: ath.c,v 1.101 2014/07/12 18:48:17 tedu Exp $  */
2 /*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer,
13  *    without modification.
14  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
15  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
16  *    redistribution must be conditioned upon including a substantially
17  *    similar Disclaimer requirement for further binary redistribution.
18  * 3. Neither the names of the above-listed copyright holders nor the names
19  *    of any contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * NO WARRANTY
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
26  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
27  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
28  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
31  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
33  * THE POSSIBILITY OF SUCH DAMAGES.
34  */
35 
36 /*
37  * Driver for the Atheros Wireless LAN controller.
38  *
39  * This software is derived from work of Atsushi Onoe; his contribution
40  * is greatly appreciated. It has been modified for OpenBSD to use an
41  * open source HAL instead of the original binary-only HAL.
42  */
43 
44 #include "bpfilter.h"
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/mbuf.h>
49 #include <sys/malloc.h>
50 #include <sys/lock.h>
51 #include <sys/kernel.h>
52 #include <sys/socket.h>
53 #include <sys/sockio.h>
54 #include <sys/device.h>
55 #include <sys/errno.h>
56 #include <sys/timeout.h>
57 #include <sys/gpio.h>
58 
59 #include <machine/endian.h>
60 #include <machine/bus.h>
61 
62 #include <net/if.h>
63 #include <net/if_dl.h>
64 #include <net/if_media.h>
65 #include <net/if_arp.h>
66 #if NBPFILTER > 0
67 #include <net/bpf.h>
68 #endif
69 #ifdef INET
70 #include <netinet/in.h>
71 #include <netinet/if_ether.h>
72 #endif
73 
74 #include <net80211/ieee80211_var.h>
75 #include <net80211/ieee80211_rssadapt.h>
76 
77 #include <dev/pci/pcidevs.h>
78 #include <dev/gpio/gpiovar.h>
79 
80 #include <dev/ic/athvar.h>
81 
82 int	ath_init(struct ifnet *);
83 int	ath_init1(struct ath_softc *);
84 int	ath_intr1(struct ath_softc *);
85 void	ath_stop(struct ifnet *);
86 void	ath_start(struct ifnet *);
87 void	ath_reset(struct ath_softc *, int);
88 int	ath_media_change(struct ifnet *);
89 void	ath_watchdog(struct ifnet *);
90 int	ath_ioctl(struct ifnet *, u_long, caddr_t);
91 void	ath_fatal_proc(void *, int);
92 void	ath_rxorn_proc(void *, int);
93 void	ath_bmiss_proc(void *, int);
94 u_int   ath_chan2flags(struct ieee80211com *, struct ieee80211_channel *);
95 int	ath_initkeytable(struct ath_softc *);
96 void    ath_mcastfilter_accum(caddr_t, u_int32_t (*)[2]);
97 void    ath_mcastfilter_compute(struct ath_softc *, u_int32_t (*)[2]);
98 u_int32_t ath_calcrxfilter(struct ath_softc *);
99 void	ath_mode_init(struct ath_softc *);
100 #ifndef IEEE80211_STA_ONLY
101 int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
102 void	ath_beacon_proc(void *, int);
103 void	ath_beacon_free(struct ath_softc *);
104 #endif
105 void	ath_beacon_config(struct ath_softc *);
106 int	ath_desc_alloc(struct ath_softc *);
107 void	ath_desc_free(struct ath_softc *);
108 struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
109 struct mbuf *ath_getmbuf(int, int, u_int);
110 void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
111 void	ath_node_copy(struct ieee80211com *,
112 	    struct ieee80211_node *, const struct ieee80211_node *);
113 u_int8_t ath_node_getrssi(struct ieee80211com *,
114 	    const struct ieee80211_node *);
115 int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
116 void	ath_rx_proc(void *, int);
117 int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
118 	    struct ath_buf *, struct mbuf *);
119 void	ath_tx_proc(void *, int);
120 int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
121 void	ath_draintxq(struct ath_softc *);
122 void	ath_stoprecv(struct ath_softc *);
123 int	ath_startrecv(struct ath_softc *);
124 void	ath_next_scan(void *);
125 int	ath_set_slot_time(struct ath_softc *);
126 void	ath_calibrate(void *);
127 void	ath_ledstate(struct ath_softc *, enum ieee80211_state);
128 int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
129 void	ath_newassoc(struct ieee80211com *,
130 	    struct ieee80211_node *, int);
131 int	ath_getchannels(struct ath_softc *, HAL_BOOL outdoor,
132 	    HAL_BOOL xchanmode);
133 int	ath_rate_setup(struct ath_softc *sc, u_int mode);
134 void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
135 void	ath_rssadapt_updatenode(void *, struct ieee80211_node *);
136 void	ath_rssadapt_updatestats(void *);
137 #ifndef IEEE80211_STA_ONLY
138 void	ath_recv_mgmt(struct ieee80211com *, struct mbuf *,
139 	    struct ieee80211_node *, struct ieee80211_rxinfo *, int);
140 #endif
141 void	ath_disable(struct ath_softc *);
142 
143 int	ath_gpio_attach(struct ath_softc *, u_int16_t);
144 int	ath_gpio_pin_read(void *, int);
145 void	ath_gpio_pin_write(void *, int, int);
146 void	ath_gpio_pin_ctl(void *, int, int);
147 
148 #ifdef AR_DEBUG
149 void	ath_printrxbuf(struct ath_buf *, int);
150 void	ath_printtxbuf(struct ath_buf *, int);
151 int ath_debug = 0;
152 #endif
153 
154 int ath_dwelltime = 200;		/* 5 channels/second */
155 int ath_calinterval = 30;		/* calibrate every 30 secs */
156 int ath_outdoor = AH_TRUE;		/* outdoor operation */
157 int ath_xchanmode = AH_TRUE;		/* enable extended channels */
158 int ath_softcrypto = 1;			/* 1=enable software crypto */
159 
160 struct cfdriver ath_cd = {
161 	NULL, "ath", DV_IFNET
162 };
163 
164 int
165 ath_activate(struct device *self, int act)
166 {
167 	struct ath_softc *sc = (struct ath_softc *)self;
168 	struct ifnet *ifp = &sc->sc_ic.ic_if;
169 
170 	switch (act) {
171 	case DVACT_SUSPEND:
172 		if (ifp->if_flags & IFF_RUNNING) {
173 			ath_stop(ifp);
174 			if (sc->sc_power != NULL)
175 				(*sc->sc_power)(sc, act);
176 		}
177 		break;
178 	case DVACT_RESUME:
179 		if (ifp->if_flags & IFF_UP) {
180 			ath_init(ifp);
181 			if (ifp->if_flags & IFF_RUNNING)
182 				ath_start(ifp);
183 		}
184 		break;
185 	}
186 	return 0;
187 }
188 
189 int
190 ath_enable(struct ath_softc *sc)
191 {
192 	if (ATH_IS_ENABLED(sc) == 0) {
193 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
194 			printf("%s: device enable failed\n",
195 				sc->sc_dev.dv_xname);
196 			return (EIO);
197 		}
198 		sc->sc_flags |= ATH_ENABLED;
199 	}
200 	return (0);
201 }
202 
203 void
204 ath_disable(struct ath_softc *sc)
205 {
206 	if (!ATH_IS_ENABLED(sc))
207 		return;
208 	if (sc->sc_disable != NULL)
209 		(*sc->sc_disable)(sc);
210 	sc->sc_flags &= ~ATH_ENABLED;
211 }
212 
213 int
214 ath_attach(u_int16_t devid, struct ath_softc *sc)
215 {
216 	struct ieee80211com *ic = &sc->sc_ic;
217 	struct ifnet *ifp = &ic->ic_if;
218 	struct ath_hal *ah;
219 	HAL_STATUS status;
220 	HAL_TXQ_INFO qinfo;
221 	int error = 0, i;
222 
223 	DPRINTF(ATH_DEBUG_ANY, ("%s: devid 0x%x\n", __func__, devid));
224 
225 	bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ);
226 	sc->sc_flags &= ~ATH_ATTACHED;	/* make sure that it's not attached */
227 
228 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh,
229 	    sc->sc_pcie, &status);
230 	if (ah == NULL) {
231 		printf("%s: unable to attach hardware; HAL status %d\n",
232 			ifp->if_xname, status);
233 		error = ENXIO;
234 		goto bad;
235 	}
236 	if (ah->ah_abi != HAL_ABI_VERSION) {
237 		printf("%s: HAL ABI mismatch detected (0x%x != 0x%x)\n",
238 			ifp->if_xname, ah->ah_abi, HAL_ABI_VERSION);
239 		error = ENXIO;
240 		goto bad;
241 	}
242 
243 	if (ah->ah_single_chip == AH_TRUE) {
244 		printf("%s: AR%s %u.%u phy %u.%u rf %u.%u", ifp->if_xname,
245 		    ar5k_printver(AR5K_VERSION_DEV, devid),
246 		    ah->ah_mac_version, ah->ah_mac_revision,
247 		    ah->ah_phy_revision >> 4, ah->ah_phy_revision & 0xf,
248 		    ah->ah_radio_5ghz_revision >> 4,
249 		    ah->ah_radio_5ghz_revision & 0xf);
250 	} else {
251 		printf("%s: AR%s %u.%u phy %u.%u", ifp->if_xname,
252 		    ar5k_printver(AR5K_VERSION_VER, ah->ah_mac_srev),
253 		    ah->ah_mac_version, ah->ah_mac_revision,
254 		    ah->ah_phy_revision >> 4, ah->ah_phy_revision & 0xf);
255 		printf(" rf%s %u.%u",
256 		    ar5k_printver(AR5K_VERSION_RAD, ah->ah_radio_5ghz_revision),
257 		    ah->ah_radio_5ghz_revision >> 4,
258 		    ah->ah_radio_5ghz_revision & 0xf);
259 		if (ah->ah_radio_2ghz_revision != 0) {
260 			printf(" rf%s %u.%u",
261 			    ar5k_printver(AR5K_VERSION_RAD,
262 			    ah->ah_radio_2ghz_revision),
263 			    ah->ah_radio_2ghz_revision >> 4,
264 			    ah->ah_radio_2ghz_revision & 0xf);
265 		}
266 	}
267 	if (ah->ah_ee_version == AR5K_EEPROM_VERSION_4_7)
268 		printf(" eeprom 4.7");
269 	else
270 		printf(" eeprom %1x.%1x", ah->ah_ee_version >> 12,
271 		    ah->ah_ee_version & 0xff);
272 
273 #if 0
274 	if (ah->ah_radio_5ghz_revision >= AR5K_SREV_RAD_UNSUPP ||
275 	    ah->ah_radio_2ghz_revision >= AR5K_SREV_RAD_UNSUPP) {
276 		printf(": RF radio not supported\n");
277 		error = EOPNOTSUPP;
278 		goto bad;
279 	}
280 #endif
281 
282 	sc->sc_ah = ah;
283 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
284 
285 	/*
286 	 * Get regulation domain either stored in the EEPROM or defined
287 	 * as the default value. Some devices are known to have broken
288 	 * regulation domain values in their EEPROM.
289 	 */
290 	ath_hal_get_regdomain(ah, &ah->ah_regdomain);
291 
292 	/*
293 	 * Construct channel list based on the current regulation domain.
294 	 */
295 	error = ath_getchannels(sc, ath_outdoor, ath_xchanmode);
296 	if (error != 0)
297 		goto bad;
298 
299 	/*
300 	 * Setup rate tables for all potential media types.
301 	 */
302 	ath_rate_setup(sc, IEEE80211_MODE_11A);
303 	ath_rate_setup(sc, IEEE80211_MODE_11B);
304 	ath_rate_setup(sc, IEEE80211_MODE_11G);
305 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
306 
307 	error = ath_desc_alloc(sc);
308 	if (error != 0) {
309 		printf(": failed to allocate descriptors: %d\n", error);
310 		goto bad;
311 	}
312 	timeout_set(&sc->sc_scan_to, ath_next_scan, sc);
313 	timeout_set(&sc->sc_cal_to, ath_calibrate, sc);
314 	timeout_set(&sc->sc_rssadapt_to, ath_rssadapt_updatestats, sc);
315 
316 #ifdef __FreeBSD__
317 	ATH_TXBUF_LOCK_INIT(sc);
318 	ATH_TXQ_LOCK_INIT(sc);
319 #endif
320 
321 	ATH_TASK_INIT(&sc->sc_txtask, ath_tx_proc, sc);
322 	ATH_TASK_INIT(&sc->sc_rxtask, ath_rx_proc, sc);
323 	ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc);
324 	ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc);
325 	ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc);
326 #ifndef IEEE80211_STA_ONLY
327 	ATH_TASK_INIT(&sc->sc_swbatask, ath_beacon_proc, sc);
328 #endif
329 
330 	/*
331 	 * For now just pre-allocate one data queue and one
332 	 * beacon queue.  Note that the HAL handles resetting
333 	 * them at the needed time.  Eventually we'll want to
334 	 * allocate more tx queues for splitting management
335 	 * frames and for QOS support.
336 	 */
337 	sc->sc_bhalq = ath_hal_setup_tx_queue(ah, HAL_TX_QUEUE_BEACON, NULL);
338 	if (sc->sc_bhalq == (u_int) -1) {
339 		printf(": unable to setup a beacon xmit queue!\n");
340 		goto bad2;
341 	}
342 
343 	for (i = 0; i <= HAL_TX_QUEUE_ID_DATA_MAX; i++) {
344 		bzero(&qinfo, sizeof(qinfo));
345 		qinfo.tqi_type = HAL_TX_QUEUE_DATA;
346 		qinfo.tqi_subtype = i; /* should be mapped to WME types */
347 		sc->sc_txhalq[i] = ath_hal_setup_tx_queue(ah,
348 		    HAL_TX_QUEUE_DATA, &qinfo);
349 		if (sc->sc_txhalq[i] == (u_int) -1) {
350 			printf(": unable to setup a data xmit queue %u!\n", i);
351 			goto bad2;
352 		}
353 	}
354 
355 	ifp->if_softc = sc;
356 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST
357 	    | IFF_NOTRAILERS;
358 	ifp->if_start = ath_start;
359 	ifp->if_watchdog = ath_watchdog;
360 	ifp->if_ioctl = ath_ioctl;
361 #ifndef __OpenBSD__
362 	ifp->if_stop = ath_stop;		/* XXX */
363 #endif
364 	IFQ_SET_MAXLEN(&ifp->if_snd, ATH_TXBUF * ATH_TXDESC);
365 	IFQ_SET_READY(&ifp->if_snd);
366 
367 	ic->ic_softc = sc;
368 	ic->ic_newassoc = ath_newassoc;
369 	/* XXX not right but it's not used anywhere important */
370 	ic->ic_phytype = IEEE80211_T_OFDM;
371 	ic->ic_opmode = IEEE80211_M_STA;
372 	ic->ic_caps = IEEE80211_C_WEP	/* wep supported */
373 	    | IEEE80211_C_PMGT		/* power management */
374 #ifndef IEEE80211_STA_ONLY
375 	    | IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
376 	    | IEEE80211_C_HOSTAP	/* hostap mode */
377 #endif
378 	    | IEEE80211_C_MONITOR	/* monitor mode */
379 	    | IEEE80211_C_SHSLOT	/* short slot time supported */
380 	    | IEEE80211_C_SHPREAMBLE;	/* short preamble supported */
381 	if (ath_softcrypto)
382 		ic->ic_caps |= IEEE80211_C_RSN;	/* wpa/rsn supported */
383 
384 	/*
385 	 * Not all chips have the VEOL support we want to use with
386 	 * IBSS beacon; check here for it.
387 	 */
388 	sc->sc_veol = ath_hal_has_veol(ah);
389 
390 	/* get mac address from hardware */
391 	ath_hal_get_lladdr(ah, ic->ic_myaddr);
392 
393 	if_attach(ifp);
394 
395 	/* call MI attach routine. */
396 	ieee80211_ifattach(ifp);
397 
398 	/* override default methods */
399 	ic->ic_node_alloc = ath_node_alloc;
400 	sc->sc_node_free = ic->ic_node_free;
401 	ic->ic_node_free = ath_node_free;
402 	sc->sc_node_copy = ic->ic_node_copy;
403 	ic->ic_node_copy = ath_node_copy;
404 	ic->ic_node_getrssi = ath_node_getrssi;
405 	sc->sc_newstate = ic->ic_newstate;
406 	ic->ic_newstate = ath_newstate;
407 #ifndef IEEE80211_STA_ONLY
408 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
409 	ic->ic_recv_mgmt = ath_recv_mgmt;
410 #endif
411 	ic->ic_max_rssi = AR5K_MAX_RSSI;
412 	bcopy(etherbroadcastaddr, sc->sc_broadcast_addr, IEEE80211_ADDR_LEN);
413 
414 	/* complete initialization */
415 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
416 
417 #if NBPFILTER > 0
418 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
419 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
420 
421 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
422 	bzero(&sc->sc_rxtapu, sc->sc_rxtap_len);
423 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
424 	sc->sc_rxtap.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
425 
426 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
427 	bzero(&sc->sc_txtapu, sc->sc_txtap_len);
428 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
429 	sc->sc_txtap.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
430 #endif
431 
432 	sc->sc_flags |= ATH_ATTACHED;
433 
434 	/*
435 	 * Print regulation domain and the mac address. The regulation domain
436 	 * will be marked with a * if the EEPROM value has been overwritten.
437 	 */
438 	printf(", %s%s, address %s\n",
439 	    ieee80211_regdomain2name(ah->ah_regdomain),
440 	    ah->ah_regdomain != ah->ah_regdomain_hw ? "*" : "",
441 	    ether_sprintf(ic->ic_myaddr));
442 
443 	if (ath_gpio_attach(sc, devid) == 0)
444 		sc->sc_flags |= ATH_GPIO;
445 
446 	return 0;
447 bad2:
448 	ath_desc_free(sc);
449 bad:
450 	if (ah)
451 		ath_hal_detach(ah);
452 	sc->sc_invalid = 1;
453 	return error;
454 }
455 
456 int
457 ath_detach(struct ath_softc *sc, int flags)
458 {
459 	struct ifnet *ifp = &sc->sc_ic.ic_if;
460 	int s;
461 
462 	if ((sc->sc_flags & ATH_ATTACHED) == 0)
463 		return (0);
464 
465 	config_detach_children(&sc->sc_dev, flags);
466 
467 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
468 
469 	timeout_del(&sc->sc_scan_to);
470 	timeout_del(&sc->sc_cal_to);
471 	timeout_del(&sc->sc_rssadapt_to);
472 
473 	s = splnet();
474 	ath_stop(ifp);
475 	ath_desc_free(sc);
476 	ath_hal_detach(sc->sc_ah);
477 
478 	ieee80211_ifdetach(ifp);
479 	if_detach(ifp);
480 
481 	splx(s);
482 #ifdef __FreeBSD__
483 	ATH_TXBUF_LOCK_DESTROY(sc);
484 	ATH_TXQ_LOCK_DESTROY(sc);
485 #endif
486 
487 	return 0;
488 }
489 
490 int
491 ath_intr(void *arg)
492 {
493 	return ath_intr1((struct ath_softc *)arg);
494 }
495 
496 int
497 ath_intr1(struct ath_softc *sc)
498 {
499 	struct ieee80211com *ic = &sc->sc_ic;
500 	struct ifnet *ifp = &ic->ic_if;
501 	struct ath_hal *ah = sc->sc_ah;
502 	HAL_INT status;
503 
504 	if (sc->sc_invalid) {
505 		/*
506 		 * The hardware is not ready/present, don't touch anything.
507 		 * Note this can happen early on if the IRQ is shared.
508 		 */
509 		DPRINTF(ATH_DEBUG_ANY, ("%s: invalid; ignored\n", __func__));
510 		return 0;
511 	}
512 	if (!ath_hal_is_intr_pending(ah))		/* shared irq, not for us */
513 		return 0;
514 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
515 		DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
516 		    __func__, ifp->if_flags));
517 		ath_hal_get_isr(ah, &status);	/* clear ISR */
518 		ath_hal_set_intr(ah, 0);		/* disable further intr's */
519 		return 1; /* XXX */
520 	}
521 	ath_hal_get_isr(ah, &status);		/* NB: clears ISR too */
522 	DPRINTF(ATH_DEBUG_INTR, ("%s: status 0x%x\n", __func__, status));
523 	status &= sc->sc_imask;			/* discard unasked for bits */
524 	if (status & HAL_INT_FATAL) {
525 		sc->sc_stats.ast_hardware++;
526 		ath_hal_set_intr(ah, 0);		/* disable intr's until reset */
527 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_fataltask);
528 	} else if (status & HAL_INT_RXORN) {
529 		sc->sc_stats.ast_rxorn++;
530 		ath_hal_set_intr(ah, 0);		/* disable intr's until reset */
531 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxorntask);
532 	} else if (status & HAL_INT_MIB) {
533 		DPRINTF(ATH_DEBUG_INTR,
534 		    ("%s: resetting MIB counters\n", __func__));
535 		sc->sc_stats.ast_mib++;
536 		ath_hal_update_mib_counters(ah, &sc->sc_mib_stats);
537 	} else {
538 		if (status & HAL_INT_RXEOL) {
539 			/*
540 			 * NB: the hardware should re-read the link when
541 			 *     RXE bit is written, but it doesn't work at
542 			 *     least on older hardware revs.
543 			 */
544 			sc->sc_stats.ast_rxeol++;
545 			sc->sc_rxlink = NULL;
546 		}
547 		if (status & HAL_INT_TXURN) {
548 			sc->sc_stats.ast_txurn++;
549 			/* bump tx trigger level */
550 			ath_hal_update_tx_triglevel(ah, AH_TRUE);
551 		}
552 		if (status & HAL_INT_RX)
553 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask);
554 		if (status & HAL_INT_TX)
555 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask);
556 		if (status & HAL_INT_SWBA)
557 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_swbatask);
558 		if (status & HAL_INT_BMISS) {
559 			sc->sc_stats.ast_bmiss++;
560 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask);
561 		}
562 	}
563 	return 1;
564 }
565 
566 void
567 ath_fatal_proc(void *arg, int pending)
568 {
569 	struct ath_softc *sc = arg;
570 	struct ieee80211com *ic = &sc->sc_ic;
571 	struct ifnet *ifp = &ic->ic_if;
572 
573 	if (ifp->if_flags & IFF_DEBUG)
574 		printf("%s: hardware error; resetting\n", ifp->if_xname);
575 	ath_reset(sc, 1);
576 }
577 
578 void
579 ath_rxorn_proc(void *arg, int pending)
580 {
581 	struct ath_softc *sc = arg;
582 	struct ieee80211com *ic = &sc->sc_ic;
583 	struct ifnet *ifp = &ic->ic_if;
584 
585 	if (ifp->if_flags & IFF_DEBUG)
586 		printf("%s: rx FIFO overrun; resetting\n", ifp->if_xname);
587 	ath_reset(sc, 1);
588 }
589 
590 void
591 ath_bmiss_proc(void *arg, int pending)
592 {
593 	struct ath_softc *sc = arg;
594 	struct ieee80211com *ic = &sc->sc_ic;
595 
596 	DPRINTF(ATH_DEBUG_ANY, ("%s: pending %u\n", __func__, pending));
597 	if (ic->ic_opmode != IEEE80211_M_STA)
598 		return;
599 	if (ic->ic_state == IEEE80211_S_RUN) {
600 		/*
601 		 * Rather than go directly to scan state, try to
602 		 * reassociate first.  If that fails then the state
603 		 * machine will drop us into scanning after timing
604 		 * out waiting for a probe response.
605 		 */
606 		ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
607 	}
608 }
609 
610 u_int
611 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
612 {
613 	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
614 
615 	switch (mode) {
616 	case IEEE80211_MODE_AUTO:
617 		return 0;
618 	case IEEE80211_MODE_11A:
619 		return CHANNEL_A;
620 	case IEEE80211_MODE_11B:
621 		return CHANNEL_B;
622 	case IEEE80211_MODE_11G:
623 		return CHANNEL_G;
624 	case IEEE80211_MODE_TURBO:
625 		return CHANNEL_T;
626 	default:
627 		panic("%s: unsupported mode %d", __func__, mode);
628 		return 0;
629 	}
630 }
631 
632 int
633 ath_init(struct ifnet *ifp)
634 {
635 	return ath_init1((struct ath_softc *)ifp->if_softc);
636 }
637 
638 int
639 ath_init1(struct ath_softc *sc)
640 {
641 	struct ieee80211com *ic = &sc->sc_ic;
642 	struct ifnet *ifp = &ic->ic_if;
643 	struct ieee80211_node *ni;
644 	enum ieee80211_phymode mode;
645 	struct ath_hal *ah = sc->sc_ah;
646 	HAL_STATUS status;
647 	HAL_CHANNEL hchan;
648 	int error = 0, s;
649 
650 	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
651 	    __func__, ifp->if_flags));
652 
653 	if ((error = ath_enable(sc)) != 0)
654 		return error;
655 
656 	s = splnet();
657 	/*
658 	 * Stop anything previously setup.  This is safe
659 	 * whether this is the first time through or not.
660 	 */
661 	ath_stop(ifp);
662 
663 	/*
664 	 * Reset the link layer address to the latest value.
665 	 */
666 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
667 	ath_hal_set_lladdr(ah, ic->ic_myaddr);
668 
669 	/*
670 	 * The basic interface to setting the hardware in a good
671 	 * state is ``reset''.  On return the hardware is known to
672 	 * be powered up and with interrupts disabled.  This must
673 	 * be followed by initialization of the appropriate bits
674 	 * and then setup of the interrupt mask.
675 	 */
676 	hchan.channel = ic->ic_ibss_chan->ic_freq;
677 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
678 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
679 		printf("%s: unable to reset hardware; hal status %u\n",
680 			ifp->if_xname, status);
681 		error = EIO;
682 		goto done;
683 	}
684 	ath_set_slot_time(sc);
685 
686 	if ((error = ath_initkeytable(sc)) != 0) {
687 		printf("%s: unable to reset the key cache\n",
688 		    ifp->if_xname);
689 		goto done;
690 	}
691 
692 	if ((error = ath_startrecv(sc)) != 0) {
693 		printf("%s: unable to start recv logic\n", ifp->if_xname);
694 		goto done;
695 	}
696 
697 	/*
698 	 * Enable interrupts.
699 	 */
700 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
701 	    | HAL_INT_RXEOL | HAL_INT_RXORN
702 	    | HAL_INT_FATAL | HAL_INT_GLOBAL;
703 #ifndef IEEE80211_STA_ONLY
704 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
705 		sc->sc_imask |= HAL_INT_MIB;
706 #endif
707 	ath_hal_set_intr(ah, sc->sc_imask);
708 
709 	ifp->if_flags |= IFF_RUNNING;
710 	ic->ic_state = IEEE80211_S_INIT;
711 
712 	/*
713 	 * The hardware should be ready to go now so it's safe
714 	 * to kick the 802.11 state machine as it's likely to
715 	 * immediately call back to us to send mgmt frames.
716 	 */
717 	ni = ic->ic_bss;
718 	ni->ni_chan = ic->ic_ibss_chan;
719 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
720 	if (mode != sc->sc_curmode)
721 		ath_setcurmode(sc, mode);
722 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
723 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
724 	} else {
725 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
726 	}
727 done:
728 	splx(s);
729 	return error;
730 }
731 
732 void
733 ath_stop(struct ifnet *ifp)
734 {
735 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
736 	struct ath_softc *sc = ifp->if_softc;
737 	struct ath_hal *ah = sc->sc_ah;
738 	int s;
739 
740 	DPRINTF(ATH_DEBUG_ANY, ("%s: invalid %u if_flags 0x%x\n",
741 	    __func__, sc->sc_invalid, ifp->if_flags));
742 
743 	s = splnet();
744 	if (ifp->if_flags & IFF_RUNNING) {
745 		/*
746 		 * Shutdown the hardware and driver:
747 		 *    disable interrupts
748 		 *    turn off timers
749 		 *    clear transmit machinery
750 		 *    clear receive machinery
751 		 *    drain and release tx queues
752 		 *    reclaim beacon resources
753 		 *    reset 802.11 state machine
754 		 *    power down hardware
755 		 *
756 		 * Note that some of this work is not possible if the
757 		 * hardware is gone (invalid).
758 		 */
759 		ifp->if_flags &= ~IFF_RUNNING;
760 		ifp->if_timer = 0;
761 		if (!sc->sc_invalid)
762 			ath_hal_set_intr(ah, 0);
763 		ath_draintxq(sc);
764 		if (!sc->sc_invalid) {
765 			ath_stoprecv(sc);
766 		} else {
767 			sc->sc_rxlink = NULL;
768 		}
769 		IFQ_PURGE(&ifp->if_snd);
770 #ifndef IEEE80211_STA_ONLY
771 		ath_beacon_free(sc);
772 #endif
773 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
774 		if (!sc->sc_invalid) {
775 			ath_hal_set_power(ah, HAL_PM_FULL_SLEEP, 0);
776 		}
777 		ath_disable(sc);
778 	}
779 	splx(s);
780 }
781 
782 /*
783  * Reset the hardware w/o losing operational state.  This is
784  * basically a more efficient way of doing ath_stop, ath_init,
785  * followed by state transitions to the current 802.11
786  * operational state.  Used to recover from errors rx overrun
787  * and to reset the hardware when rf gain settings must be reset.
788  */
789 void
790 ath_reset(struct ath_softc *sc, int full)
791 {
792 	struct ieee80211com *ic = &sc->sc_ic;
793 	struct ifnet *ifp = &ic->ic_if;
794 	struct ath_hal *ah = sc->sc_ah;
795 	struct ieee80211_channel *c;
796 	HAL_STATUS status;
797 	HAL_CHANNEL hchan;
798 
799 	/*
800 	 * Convert to a HAL channel description with the flags
801 	 * constrained to reflect the current operating mode.
802 	 */
803 	c = ic->ic_ibss_chan;
804 	hchan.channel = c->ic_freq;
805 	hchan.channelFlags = ath_chan2flags(ic, c);
806 
807 	ath_hal_set_intr(ah, 0);		/* disable interrupts */
808 	ath_draintxq(sc);		/* stop xmit side */
809 	ath_stoprecv(sc);		/* stop recv side */
810 	/* NB: indicate channel change so we do a full reset */
811 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan,
812 	    full ? AH_TRUE : AH_FALSE, &status)) {
813 		printf("%s: %s: unable to reset hardware; hal status %u\n",
814 			ifp->if_xname, __func__, status);
815 	}
816 	ath_set_slot_time(sc);
817 	/* In case channel changed, save as a node channel */
818 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
819 	ath_hal_set_intr(ah, sc->sc_imask);
820 	if (ath_startrecv(sc) != 0)	/* restart recv */
821 		printf("%s: %s: unable to start recv logic\n", ifp->if_xname,
822 		    __func__);
823 	ath_start(ifp);			/* restart xmit */
824 	if (ic->ic_state == IEEE80211_S_RUN)
825 		ath_beacon_config(sc);	/* restart beacons */
826 }
827 
828 void
829 ath_start(struct ifnet *ifp)
830 {
831 	struct ath_softc *sc = ifp->if_softc;
832 	struct ath_hal *ah = sc->sc_ah;
833 	struct ieee80211com *ic = &sc->sc_ic;
834 	struct ieee80211_node *ni;
835 	struct ath_buf *bf;
836 	struct mbuf *m;
837 	struct ieee80211_frame *wh;
838 	int s;
839 
840 	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING ||
841 	    sc->sc_invalid)
842 		return;
843 	for (;;) {
844 		/*
845 		 * Grab a TX buffer and associated resources.
846 		 */
847 		s = splnet();
848 		bf = TAILQ_FIRST(&sc->sc_txbuf);
849 		if (bf != NULL)
850 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
851 		splx(s);
852 		if (bf == NULL) {
853 			DPRINTF(ATH_DEBUG_ANY, ("%s: out of xmit buffers\n",
854 			    __func__));
855 			sc->sc_stats.ast_tx_qstop++;
856 			ifp->if_flags |= IFF_OACTIVE;
857 			break;
858 		}
859 		/*
860 		 * Poll the management queue for frames; they
861 		 * have priority over normal data frames.
862 		 */
863 		IF_DEQUEUE(&ic->ic_mgtq, m);
864 		if (m == NULL) {
865 			/*
866 			 * No data frames go out unless we're associated.
867 			 */
868 			if (ic->ic_state != IEEE80211_S_RUN) {
869 				DPRINTF(ATH_DEBUG_ANY,
870 				    ("%s: ignore data packet, state %u\n",
871 				    __func__, ic->ic_state));
872 				sc->sc_stats.ast_tx_discard++;
873 				s = splnet();
874 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
875 				splx(s);
876 				break;
877 			}
878 			IFQ_DEQUEUE(&ifp->if_snd, m);
879 			if (m == NULL) {
880 				s = splnet();
881 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
882 				splx(s);
883 				break;
884 			}
885 			ifp->if_opackets++;
886 
887 #if NBPFILTER > 0
888 			if (ifp->if_bpf)
889 				bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
890 #endif
891 
892 			/*
893 			 * Encapsulate the packet in prep for transmission.
894 			 */
895 			m = ieee80211_encap(ifp, m, &ni);
896 			if (m == NULL) {
897 				DPRINTF(ATH_DEBUG_ANY,
898 				    ("%s: encapsulation failure\n",
899 				    __func__));
900 				sc->sc_stats.ast_tx_encap++;
901 				goto bad;
902 			}
903 			wh = mtod(m, struct ieee80211_frame *);
904 		} else {
905 			ni = m->m_pkthdr.ph_cookie;
906 
907 			wh = mtod(m, struct ieee80211_frame *);
908 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
909 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
910 				/* fill time stamp */
911 				u_int64_t tsf;
912 				u_int32_t *tstamp;
913 
914 				tsf = ath_hal_get_tsf64(ah);
915 				/* XXX: adjust 100us delay to xmit */
916 				tsf += 100;
917 				tstamp = (u_int32_t *)&wh[1];
918 				tstamp[0] = htole32(tsf & 0xffffffff);
919 				tstamp[1] = htole32(tsf >> 32);
920 			}
921 			sc->sc_stats.ast_tx_mgmt++;
922 		}
923 
924 		if (ath_tx_start(sc, ni, bf, m)) {
925 	bad:
926 			s = splnet();
927 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
928 			splx(s);
929 			ifp->if_oerrors++;
930 			if (ni != NULL)
931 				ieee80211_release_node(ic, ni);
932 			continue;
933 		}
934 
935 		sc->sc_tx_timer = 5;
936 		ifp->if_timer = 1;
937 	}
938 }
939 
940 int
941 ath_media_change(struct ifnet *ifp)
942 {
943 	int error;
944 
945 	error = ieee80211_media_change(ifp);
946 	if (error == ENETRESET) {
947 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
948 		    (IFF_RUNNING|IFF_UP))
949 			ath_init(ifp);		/* XXX lose error */
950 		error = 0;
951 	}
952 	return error;
953 }
954 
955 void
956 ath_watchdog(struct ifnet *ifp)
957 {
958 	struct ath_softc *sc = ifp->if_softc;
959 
960 	ifp->if_timer = 0;
961 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
962 		return;
963 	if (sc->sc_tx_timer) {
964 		if (--sc->sc_tx_timer == 0) {
965 			printf("%s: device timeout\n", ifp->if_xname);
966 			ath_reset(sc, 1);
967 			ifp->if_oerrors++;
968 			sc->sc_stats.ast_watchdog++;
969 			return;
970 		}
971 		ifp->if_timer = 1;
972 	}
973 
974 	ieee80211_watchdog(ifp);
975 }
976 
977 int
978 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
979 {
980 	struct ath_softc *sc = ifp->if_softc;
981 	struct ieee80211com *ic = &sc->sc_ic;
982 	struct ifreq *ifr = (struct ifreq *)data;
983 	struct ifaddr *ifa = (struct ifaddr *)data;
984 	int error = 0, s;
985 
986 	s = splnet();
987 	switch (cmd) {
988 	case SIOCSIFADDR:
989 		ifp->if_flags |= IFF_UP;
990 #ifdef INET
991 		if (ifa->ifa_addr->sa_family == AF_INET) {
992 			arp_ifinit(&ic->ic_ac, ifa);
993 		}
994 #endif  /* INET */
995 		/* FALLTHROUGH */
996 	case SIOCSIFFLAGS:
997 		if (ifp->if_flags & IFF_UP) {
998 			if (ifp->if_flags & IFF_RUNNING) {
999 				/*
1000 				 * To avoid rescanning another access point,
1001 				 * do not call ath_init() here.  Instead,
1002 				 * only reflect promisc mode settings.
1003 				 */
1004 				ath_mode_init(sc);
1005 			} else {
1006 				/*
1007 				 * Beware of being called during detach to
1008 				 * reset promiscuous mode.  In that case we
1009 				 * will still be marked UP but not RUNNING.
1010 				 * However trying to re-init the interface
1011 				 * is the wrong thing to do as we've already
1012 				 * torn down much of our state.  There's
1013 				 * probably a better way to deal with this.
1014 				 */
1015 				if (!sc->sc_invalid)
1016 					ath_init(ifp);	/* XXX lose error */
1017 			}
1018 		} else
1019 			ath_stop(ifp);
1020 		break;
1021 	case SIOCADDMULTI:
1022 	case SIOCDELMULTI:
1023 #ifdef __FreeBSD__
1024 		/*
1025 		 * The upper layer has already installed/removed
1026 		 * the multicast address(es), just recalculate the
1027 		 * multicast filter for the card.
1028 		 */
1029 		if (ifp->if_flags & IFF_RUNNING)
1030 			ath_mode_init(sc);
1031 #endif
1032 		error = (cmd == SIOCADDMULTI) ?
1033 		    ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
1034 		    ether_delmulti(ifr, &sc->sc_ic.ic_ac);
1035 		if (error == ENETRESET) {
1036 			if (ifp->if_flags & IFF_RUNNING)
1037 				ath_mode_init(sc);
1038 			error = 0;
1039 		}
1040 		break;
1041 	case SIOCGATHSTATS:
1042 		error = copyout(&sc->sc_stats,
1043 		    ifr->ifr_data, sizeof (sc->sc_stats));
1044 		break;
1045 	default:
1046 		error = ieee80211_ioctl(ifp, cmd, data);
1047 		if (error == ENETRESET) {
1048 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
1049 			    (IFF_RUNNING|IFF_UP)) {
1050 				if (ic->ic_opmode != IEEE80211_M_MONITOR)
1051 					ath_init(ifp);	/* XXX lose error */
1052 				else
1053 					ath_reset(sc, 1);
1054 			}
1055 			error = 0;
1056 		}
1057 		break;
1058 	}
1059 	splx(s);
1060 	return error;
1061 }
1062 
1063 /*
1064  * Fill the hardware key cache with key entries.
1065  */
1066 int
1067 ath_initkeytable(struct ath_softc *sc)
1068 {
1069 	struct ieee80211com *ic = &sc->sc_ic;
1070 	struct ath_hal *ah = sc->sc_ah;
1071 	int i;
1072 
1073 	if (ath_softcrypto) {
1074 		/*
1075 		 * Disable the hardware crypto engine and reset the key cache
1076 		 * to allow software crypto operation for WEP/RSN/WPA2
1077 		 */
1078 		if (ic->ic_flags & (IEEE80211_F_WEPON|IEEE80211_F_RSNON))
1079 			(void)ath_hal_softcrypto(ah, AH_TRUE);
1080 		else
1081 			(void)ath_hal_softcrypto(ah, AH_FALSE);
1082 		return (0);
1083 	}
1084 
1085 	/* WEP is disabled, we only support WEP in hardware yet */
1086 	if ((ic->ic_flags & IEEE80211_F_WEPON) == 0)
1087 		return (0);
1088 
1089 	/*
1090 	 * Setup the hardware after reset: the key cache is filled as
1091 	 * needed and the receive engine is set going.  Frame transmit
1092 	 * is handled entirely in the frame output path; there's nothing
1093 	 * to do here except setup the interrupt mask.
1094 	 */
1095 
1096 	/* XXX maybe should reset all keys when !WEPON */
1097 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1098 		struct ieee80211_key *k = &ic->ic_nw_keys[i];
1099 		if (k->k_len == 0)
1100 			ath_hal_reset_key(ah, i);
1101 		else {
1102 			HAL_KEYVAL hk;
1103 
1104 			bzero(&hk, sizeof(hk));
1105 			/*
1106 			 * Pad the key to a supported key length. It
1107 			 * is always a good idea to use full-length
1108 			 * keys without padded zeros but this seems
1109 			 * to be the default behaviour used by many
1110 			 * implementations.
1111 			 */
1112 			if (k->k_cipher == IEEE80211_CIPHER_WEP40)
1113 				hk.wk_len = AR5K_KEYVAL_LENGTH_40;
1114 			else if (k->k_cipher == IEEE80211_CIPHER_WEP104)
1115 				hk.wk_len = AR5K_KEYVAL_LENGTH_104;
1116 			else
1117 				return (EINVAL);
1118 			bcopy(k->k_key, hk.wk_key, hk.wk_len);
1119 
1120 			if (ath_hal_set_key(ah, i, &hk) != AH_TRUE)
1121 				return (EINVAL);
1122 		}
1123 	}
1124 
1125 	return (0);
1126 }
1127 
1128 void
1129 ath_mcastfilter_accum(caddr_t dl, u_int32_t (*mfilt)[2])
1130 {
1131 	u_int32_t val;
1132 	u_int8_t pos;
1133 
1134 	val = LE_READ_4(dl + 0);
1135 	pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1136 	val = LE_READ_4(dl + 3);
1137 	pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1138 	pos &= 0x3f;
1139 	(*mfilt)[pos / 32] |= (1 << (pos % 32));
1140 }
1141 
1142 void
1143 ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
1144 {
1145 	struct arpcom *ac = &sc->sc_ic.ic_ac;
1146 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1147 	struct ether_multi *enm;
1148 	struct ether_multistep estep;
1149 
1150 	if (ac->ac_multirangecnt > 0) {
1151 		/* XXX Punt on ranges. */
1152 		(*mfilt)[0] = (*mfilt)[1] = ~((u_int32_t)0);
1153 		ifp->if_flags |= IFF_ALLMULTI;
1154 		return;
1155 	}
1156 
1157 	ETHER_FIRST_MULTI(estep, ac, enm);
1158 	while (enm != NULL) {
1159 		ath_mcastfilter_accum(enm->enm_addrlo, mfilt);
1160 		ETHER_NEXT_MULTI(estep, enm);
1161 	}
1162 	ifp->if_flags &= ~IFF_ALLMULTI;
1163 }
1164 
1165 /*
1166  * Calculate the receive filter according to the
1167  * operating mode and state:
1168  *
1169  * o always accept unicast, broadcast, and multicast traffic
1170  * o maintain current state of phy error reception
1171  * o probe request frames are accepted only when operating in
1172  *   hostap, adhoc, or monitor modes
1173  * o enable promiscuous mode according to the interface state
1174  * o accept beacons:
1175  *   - when operating in adhoc mode so the 802.11 layer creates
1176  *     node table entries for peers,
1177  *   - when operating in station mode for collecting rssi data when
1178  *     the station is otherwise quiet, or
1179  *   - when scanning
1180  */
1181 u_int32_t
1182 ath_calcrxfilter(struct ath_softc *sc)
1183 {
1184 	struct ieee80211com *ic = &sc->sc_ic;
1185 	struct ath_hal *ah = sc->sc_ah;
1186 	struct ifnet *ifp = &ic->ic_if;
1187 	u_int32_t rfilt;
1188 
1189 	rfilt = (ath_hal_get_rx_filter(ah) & HAL_RX_FILTER_PHYERR)
1190 	    | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
1191 	if (ic->ic_opmode != IEEE80211_M_STA)
1192 		rfilt |= HAL_RX_FILTER_PROBEREQ;
1193 #ifndef IEEE80211_STA_ONLY
1194 	if (ic->ic_opmode != IEEE80211_M_AHDEMO)
1195 #endif
1196 		rfilt |= HAL_RX_FILTER_BEACON;
1197 	if (ifp->if_flags & IFF_PROMISC)
1198 		rfilt |= HAL_RX_FILTER_PROM;
1199 	return rfilt;
1200 }
1201 
1202 void
1203 ath_mode_init(struct ath_softc *sc)
1204 {
1205 	struct ath_hal *ah = sc->sc_ah;
1206 	u_int32_t rfilt, mfilt[2];
1207 
1208 	/* configure rx filter */
1209 	rfilt = ath_calcrxfilter(sc);
1210 	ath_hal_set_rx_filter(ah, rfilt);
1211 
1212 	/* configure operational mode */
1213 	ath_hal_set_opmode(ah);
1214 
1215 	/* calculate and install multicast filter */
1216 	mfilt[0] = mfilt[1] = 0;
1217 	ath_mcastfilter_compute(sc, &mfilt);
1218 	ath_hal_set_mcast_filter(ah, mfilt[0], mfilt[1]);
1219 	DPRINTF(ATH_DEBUG_MODE, ("%s: RX filter 0x%x, MC filter %08x:%08x\n",
1220 	    __func__, rfilt, mfilt[0], mfilt[1]));
1221 }
1222 
1223 struct mbuf *
1224 ath_getmbuf(int flags, int type, u_int pktlen)
1225 {
1226 	struct mbuf *m;
1227 
1228 	KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
1229 #ifdef __FreeBSD__
1230 	if (pktlen <= MHLEN) {
1231 		MGETHDR(m, flags, type);
1232 	} else {
1233 		m = m_getcl(flags, type, M_PKTHDR);
1234 	}
1235 #else
1236 	MGETHDR(m, flags, type);
1237 	if (m != NULL && pktlen > MHLEN) {
1238 		MCLGET(m, flags);
1239 		if ((m->m_flags & M_EXT) == 0) {
1240 			m_free(m);
1241 			m = NULL;
1242 		}
1243 	}
1244 #endif
1245 	return m;
1246 }
1247 
1248 #ifndef IEEE80211_STA_ONLY
1249 int
1250 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
1251 {
1252 	struct ieee80211com *ic = &sc->sc_ic;
1253 	struct ath_hal *ah = sc->sc_ah;
1254 	struct ath_buf *bf;
1255 	struct ath_desc *ds;
1256 	struct mbuf *m;
1257 	int error;
1258 	u_int8_t rate;
1259 	const HAL_RATE_TABLE *rt;
1260 	u_int flags = 0;
1261 
1262 	bf = sc->sc_bcbuf;
1263 	if (bf->bf_m != NULL) {
1264 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1265 		m_freem(bf->bf_m);
1266 		bf->bf_m = NULL;
1267 		bf->bf_node = NULL;
1268 	}
1269 	/*
1270 	 * NB: the beacon data buffer must be 32-bit aligned;
1271 	 * we assume the mbuf routines will return us something
1272 	 * with this alignment (perhaps should assert).
1273 	 */
1274 	m = ieee80211_beacon_alloc(ic, ni);
1275 	if (m == NULL) {
1276 		DPRINTF(ATH_DEBUG_BEACON, ("%s: cannot get mbuf/cluster\n",
1277 		    __func__));
1278 		sc->sc_stats.ast_be_nombuf++;
1279 		return ENOMEM;
1280 	}
1281 
1282 	DPRINTF(ATH_DEBUG_BEACON, ("%s: m %p len %u\n", __func__, m, m->m_len));
1283 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1284 	    BUS_DMA_NOWAIT);
1285 	if (error != 0) {
1286 		m_freem(m);
1287 		return error;
1288 	}
1289 	KASSERT(bf->bf_nseg == 1,
1290 		("%s: multi-segment packet; nseg %u", __func__, bf->bf_nseg));
1291 	bf->bf_m = m;
1292 
1293 	/* setup descriptors */
1294 	ds = bf->bf_desc;
1295 	bzero(ds, sizeof(struct ath_desc));
1296 
1297 	if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_veol) {
1298 		ds->ds_link = bf->bf_daddr;	/* link to self */
1299 		flags |= HAL_TXDESC_VEOL;
1300 	} else {
1301 		ds->ds_link = 0;
1302 	}
1303 	ds->ds_data = bf->bf_segs[0].ds_addr;
1304 
1305 	DPRINTF(ATH_DEBUG_ANY, ("%s: segaddr %p seglen %u\n", __func__,
1306 	    (caddr_t)bf->bf_segs[0].ds_addr, (u_int)bf->bf_segs[0].ds_len));
1307 
1308 	/*
1309 	 * Calculate rate code.
1310 	 * XXX everything at min xmit rate
1311 	 */
1312 	rt = sc->sc_currates;
1313 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1314 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1315 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1316 	} else {
1317 		rate = rt->info[0].rateCode;
1318 	}
1319 
1320 	flags = HAL_TXDESC_NOACK;
1321 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1322 		flags |= HAL_TXDESC_VEOL;
1323 
1324 	if (!ath_hal_setup_tx_desc(ah, ds
1325 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1326 		, sizeof(struct ieee80211_frame)	/* header length */
1327 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1328 		, 60				/* txpower XXX */
1329 		, rate, 1			/* series 0 rate/tries */
1330 		, HAL_TXKEYIX_INVALID		/* no encryption */
1331 		, 0				/* antenna mode */
1332 		, flags				/* no ack for beacons */
1333 		, 0				/* rts/cts rate */
1334 		, 0				/* rts/cts duration */
1335 	)) {
1336 		printf("%s: ath_hal_setup_tx_desc failed\n", __func__);
1337 		return -1;
1338 	}
1339 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1340 	/* XXX verify mbuf data area covers this roundup */
1341 	if (!ath_hal_fill_tx_desc(ah, ds
1342 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1343 		, AH_TRUE				/* first segment */
1344 		, AH_TRUE				/* last segment */
1345 	)) {
1346 		printf("%s: ath_hal_fill_tx_desc failed\n", __func__);
1347 		return -1;
1348 	}
1349 
1350 	/* XXX it is not appropriate to bus_dmamap_sync? -dcy */
1351 
1352 	return 0;
1353 }
1354 
1355 void
1356 ath_beacon_proc(void *arg, int pending)
1357 {
1358 	struct ath_softc *sc = arg;
1359 	struct ieee80211com *ic = &sc->sc_ic;
1360 	struct ath_buf *bf = sc->sc_bcbuf;
1361 	struct ath_hal *ah = sc->sc_ah;
1362 
1363 	DPRINTF(ATH_DEBUG_BEACON_PROC, ("%s: pending %u\n", __func__, pending));
1364 	if (ic->ic_opmode == IEEE80211_M_STA ||
1365 	    bf == NULL || bf->bf_m == NULL) {
1366 		DPRINTF(ATH_DEBUG_ANY, ("%s: ic_flags=%x bf=%p bf_m=%p\n",
1367 		    __func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1368 		return;
1369 	}
1370 	/* TODO: update beacon to reflect PS poll state */
1371 	if (!ath_hal_stop_tx_dma(ah, sc->sc_bhalq)) {
1372 		DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
1373 		    __func__, sc->sc_bhalq));
1374 	}
1375 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
1376 	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);
1377 
1378 	ath_hal_put_tx_buf(ah, sc->sc_bhalq, bf->bf_daddr);
1379 	ath_hal_tx_start(ah, sc->sc_bhalq);
1380 	DPRINTF(ATH_DEBUG_BEACON_PROC,
1381 	    ("%s: TXDP%u = %p (%p)\n", __func__,
1382 	    sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1383 }
1384 
1385 void
1386 ath_beacon_free(struct ath_softc *sc)
1387 {
1388 	struct ath_buf *bf = sc->sc_bcbuf;
1389 
1390 	if (bf->bf_m != NULL) {
1391 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1392 		m_freem(bf->bf_m);
1393 		bf->bf_m = NULL;
1394 		bf->bf_node = NULL;
1395 	}
1396 }
1397 #endif	/* IEEE80211_STA_ONLY */
1398 
1399 /*
1400  * Configure the beacon and sleep timers.
1401  *
1402  * When operating as an AP this resets the TSF and sets
1403  * up the hardware to notify us when we need to issue beacons.
1404  *
1405  * When operating in station mode this sets up the beacon
1406  * timers according to the timestamp of the last received
1407  * beacon and the current TSF, configures PCF and DTIM
1408  * handling, programs the sleep registers so the hardware
1409  * will wakeup in time to receive beacons, and configures
1410  * the beacon miss handling so we'll receive a BMISS
1411  * interrupt when we stop seeing beacons from the AP
1412  * we've associated with.
1413  */
1414 void
1415 ath_beacon_config(struct ath_softc *sc)
1416 {
1417 #define MS_TO_TU(x)	(((x) * 1000) / 1024)
1418 	struct ath_hal *ah = sc->sc_ah;
1419 	struct ieee80211com *ic = &sc->sc_ic;
1420 	struct ieee80211_node *ni = ic->ic_bss;
1421 	u_int32_t nexttbtt, intval;
1422 
1423 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1424 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1425 	intval = MAX(1, ni->ni_intval) & HAL_BEACON_PERIOD;
1426 	if (nexttbtt == 0) {	/* e.g. for ap mode */
1427 		nexttbtt = intval;
1428 	} else if (intval) {
1429 		nexttbtt = roundup(nexttbtt, intval);
1430 	}
1431 	DPRINTF(ATH_DEBUG_BEACON, ("%s: intval %u nexttbtt %u\n",
1432 	    __func__, ni->ni_intval, nexttbtt));
1433 	if (ic->ic_opmode == IEEE80211_M_STA) {
1434 		HAL_BEACON_STATE bs;
1435 		u_int32_t bmisstime;
1436 
1437 		/* NB: no PCF support right now */
1438 		bzero(&bs, sizeof(bs));
1439 		bs.bs_intval = intval;
1440 		bs.bs_nexttbtt = nexttbtt;
1441 		bs.bs_dtimperiod = bs.bs_intval;
1442 		bs.bs_nextdtim = nexttbtt;
1443 		/*
1444 		 * Calculate the number of consecutive beacons to miss
1445 		 * before taking a BMISS interrupt.  The configuration
1446 		 * is specified in ms, so we need to convert that to
1447 		 * TU's and then calculate based on the beacon interval.
1448 		 * Note that we clamp the result to at most 10 beacons.
1449 		 */
1450 		bmisstime = MAX(7, ic->ic_bmisstimeout);
1451 		bs.bs_bmissthreshold = howmany(bmisstime, intval);
1452 		if (bs.bs_bmissthreshold > 7) {
1453 			bs.bs_bmissthreshold = 7;
1454 		} else if (bs.bs_bmissthreshold <= 0) {
1455 			bs.bs_bmissthreshold = 1;
1456 		}
1457 
1458 		/*
1459 		 * Calculate sleep duration.  The configuration is
1460 		 * given in ms.  We insure a multiple of the beacon
1461 		 * period is used.  Also, if the sleep duration is
1462 		 * greater than the DTIM period then it makes senses
1463 		 * to make it a multiple of that.
1464 		 *
1465 		 * XXX fixed at 100ms
1466 		 */
1467 		bs.bs_sleepduration =
1468 			roundup(MS_TO_TU(100), bs.bs_intval);
1469 		if (bs.bs_sleepduration > bs.bs_dtimperiod) {
1470 			bs.bs_sleepduration =
1471 			    roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1472 		}
1473 
1474 		DPRINTF(ATH_DEBUG_BEACON,
1475 		    ("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u"
1476 		    " sleep %u\n"
1477 		    , __func__
1478 		    , bs.bs_intval
1479 		    , bs.bs_nexttbtt
1480 		    , bs.bs_dtimperiod
1481 		    , bs.bs_nextdtim
1482 		    , bs.bs_bmissthreshold
1483 		    , bs.bs_sleepduration
1484 		));
1485 		ath_hal_set_intr(ah, 0);
1486 		ath_hal_set_beacon_timers(ah, &bs, 0/*XXX*/, 0, 0);
1487 		sc->sc_imask |= HAL_INT_BMISS;
1488 		ath_hal_set_intr(ah, sc->sc_imask);
1489 	}
1490 #ifndef IEEE80211_STA_ONLY
1491 	else {
1492 		ath_hal_set_intr(ah, 0);
1493 		if (nexttbtt == intval)
1494 			intval |= HAL_BEACON_RESET_TSF;
1495 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
1496 			/*
1497 			 * In IBSS mode enable the beacon timers but only
1498 			 * enable SWBA interrupts if we need to manually
1499 			 * prepare beacon frames. Otherwise we use a
1500 			 * self-linked tx descriptor and let the hardware
1501 			 * deal with things.
1502 			 */
1503 			intval |= HAL_BEACON_ENA;
1504 			if (!sc->sc_veol)
1505 				sc->sc_imask |= HAL_INT_SWBA;
1506 		} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1507 			/*
1508 			 * In AP mode we enable the beacon timers and
1509 			 * SWBA interrupts to prepare beacon frames.
1510 			 */
1511 			intval |= HAL_BEACON_ENA;
1512 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1513 		}
1514 		ath_hal_init_beacon(ah, nexttbtt, intval);
1515 		ath_hal_set_intr(ah, sc->sc_imask);
1516 		/*
1517 		 * When using a self-linked beacon descriptor in IBBS
1518 		 * mode load it once here.
1519 		 */
1520 		if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_veol)
1521 			ath_beacon_proc(sc, 0);
1522 	}
1523 #endif
1524 }
1525 
1526 int
1527 ath_desc_alloc(struct ath_softc *sc)
1528 {
1529 	int i, bsize, error = -1;
1530 	struct ath_desc *ds;
1531 	struct ath_buf *bf;
1532 
1533 	/* allocate descriptors */
1534 	sc->sc_desc_len = sizeof(struct ath_desc) *
1535 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1536 	if ((error = bus_dmamem_alloc(sc->sc_dmat, sc->sc_desc_len, PAGE_SIZE,
1537 	    0, &sc->sc_dseg, 1, &sc->sc_dnseg, 0)) != 0) {
1538 		printf("%s: unable to allocate control data, error = %d\n",
1539 		    sc->sc_dev.dv_xname, error);
1540 		goto fail0;
1541 	}
1542 
1543 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg,
1544 	    sc->sc_desc_len, (caddr_t *)&sc->sc_desc, BUS_DMA_COHERENT)) != 0) {
1545 		printf("%s: unable to map control data, error = %d\n",
1546 		    sc->sc_dev.dv_xname, error);
1547 		goto fail1;
1548 	}
1549 
1550 	if ((error = bus_dmamap_create(sc->sc_dmat, sc->sc_desc_len, 1,
1551 	    sc->sc_desc_len, 0, 0, &sc->sc_ddmamap)) != 0) {
1552 		printf("%s: unable to create control data DMA map, "
1553 		    "error = %d\n", sc->sc_dev.dv_xname, error);
1554 		goto fail2;
1555 	}
1556 
1557 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap, sc->sc_desc,
1558 	    sc->sc_desc_len, NULL, 0)) != 0) {
1559 		printf("%s: unable to load control data DMA map, error = %d\n",
1560 		    sc->sc_dev.dv_xname, error);
1561 		goto fail3;
1562 	}
1563 
1564 	ds = sc->sc_desc;
1565 	sc->sc_desc_paddr = sc->sc_ddmamap->dm_segs[0].ds_addr;
1566 
1567 	DPRINTF(ATH_DEBUG_XMIT_DESC|ATH_DEBUG_RECV_DESC,
1568 	    ("ath_desc_alloc: DMA map: %p (%lu) -> %p (%lu)\n",
1569 	    ds, (u_long)sc->sc_desc_len,
1570 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1571 
1572 	/* allocate buffers */
1573 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1574 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1575 	if (bf == NULL) {
1576 		printf("%s: unable to allocate Tx/Rx buffers\n",
1577 		    sc->sc_dev.dv_xname);
1578 		error = ENOMEM;
1579 		goto fail3;
1580 	}
1581 	sc->sc_bufptr = bf;
1582 
1583 	TAILQ_INIT(&sc->sc_rxbuf);
1584 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1585 		bf->bf_desc = ds;
1586 		bf->bf_daddr = sc->sc_desc_paddr +
1587 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1588 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
1589 		    MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
1590 			printf("%s: unable to create Rx dmamap, error = %d\n",
1591 			    sc->sc_dev.dv_xname, error);
1592 			goto fail4;
1593 		}
1594 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1595 	}
1596 
1597 	TAILQ_INIT(&sc->sc_txbuf);
1598 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1599 		bf->bf_desc = ds;
1600 		bf->bf_daddr = sc->sc_desc_paddr +
1601 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1602 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
1603 		    ATH_TXDESC, MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
1604 			printf("%s: unable to create Tx dmamap, error = %d\n",
1605 			    sc->sc_dev.dv_xname, error);
1606 			goto fail5;
1607 		}
1608 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1609 	}
1610 	TAILQ_INIT(&sc->sc_txq);
1611 
1612 	/* beacon buffer */
1613 	bf->bf_desc = ds;
1614 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1615 	if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
1616 	    &bf->bf_dmamap)) != 0) {
1617 		printf("%s: unable to create beacon dmamap, error = %d\n",
1618 		    sc->sc_dev.dv_xname, error);
1619 		goto fail5;
1620 	}
1621 	sc->sc_bcbuf = bf;
1622 	return 0;
1623 
1624 fail5:
1625 	for (i = ATH_RXBUF; i < ATH_RXBUF + ATH_TXBUF; i++) {
1626 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
1627 			continue;
1628 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
1629 	}
1630 fail4:
1631 	for (i = 0; i < ATH_RXBUF; i++) {
1632 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
1633 			continue;
1634 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
1635 	}
1636 fail3:
1637 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1638 fail2:
1639 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1640 	sc->sc_ddmamap = NULL;
1641 fail1:
1642 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_desc, sc->sc_desc_len);
1643 fail0:
1644 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
1645 	return error;
1646 }
1647 
1648 void
1649 ath_desc_free(struct ath_softc *sc)
1650 {
1651 	struct ath_buf *bf;
1652 
1653 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1654 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1655 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
1656 
1657 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1658 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1659 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1660 		m_freem(bf->bf_m);
1661 	}
1662 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1663 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1664 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1665 		if (bf->bf_m) {
1666 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1667 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1668 			m_freem(bf->bf_m);
1669 			bf->bf_m = NULL;
1670 		}
1671 	}
1672 	if (sc->sc_bcbuf != NULL) {
1673 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1674 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1675 		sc->sc_bcbuf = NULL;
1676 	}
1677 
1678 	TAILQ_INIT(&sc->sc_rxbuf);
1679 	TAILQ_INIT(&sc->sc_txbuf);
1680 	TAILQ_INIT(&sc->sc_txq);
1681 	free(sc->sc_bufptr, M_DEVBUF, 0);
1682 	sc->sc_bufptr = NULL;
1683 }
1684 
1685 struct ieee80211_node *
1686 ath_node_alloc(struct ieee80211com *ic)
1687 {
1688 	struct ath_node *an;
1689 
1690 	an = malloc(sizeof(*an), M_DEVBUF, M_NOWAIT | M_ZERO);
1691 	if (an) {
1692 		int i;
1693 		for (i = 0; i < ATH_RHIST_SIZE; i++)
1694 			an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME;
1695 		an->an_rx_hist_next = ATH_RHIST_SIZE-1;
1696 		return &an->an_node;
1697 	} else
1698 		return NULL;
1699 }
1700 
1701 void
1702 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1703 {
1704 	struct ath_softc *sc = ic->ic_if.if_softc;
1705 	struct ath_buf *bf;
1706 
1707 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1708 		if (bf->bf_node == ni)
1709 			bf->bf_node = NULL;
1710 	}
1711 	(*sc->sc_node_free)(ic, ni);
1712 }
1713 
1714 void
1715 ath_node_copy(struct ieee80211com *ic,
1716 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1717 {
1718 	struct ath_softc *sc = ic->ic_if.if_softc;
1719 
1720 	bcopy(&src[1], &dst[1],
1721 		sizeof(struct ath_node) - sizeof(struct ieee80211_node));
1722 	(*sc->sc_node_copy)(ic, dst, src);
1723 }
1724 
1725 u_int8_t
1726 ath_node_getrssi(struct ieee80211com *ic, const struct ieee80211_node *ni)
1727 {
1728 	const struct ath_node *an = ATH_NODE(ni);
1729 	int i, now, nsamples, rssi;
1730 
1731 	/*
1732 	 * Calculate the average over the last second of sampled data.
1733 	 */
1734 	now = ATH_TICKS();
1735 	nsamples = 0;
1736 	rssi = 0;
1737 	i = an->an_rx_hist_next;
1738 	do {
1739 		const struct ath_recv_hist *rh = &an->an_rx_hist[i];
1740 		if (rh->arh_ticks == ATH_RHIST_NOTIME)
1741 			goto done;
1742 		if (now - rh->arh_ticks > hz)
1743 			goto done;
1744 		rssi += rh->arh_rssi;
1745 		nsamples++;
1746 		if (i == 0) {
1747 			i = ATH_RHIST_SIZE-1;
1748 		} else {
1749 			i--;
1750 		}
1751 	} while (i != an->an_rx_hist_next);
1752 done:
1753 	/*
1754 	 * Return either the average or the last known
1755 	 * value if there is no recent data.
1756 	 */
1757 	return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
1758 }
1759 
1760 int
1761 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1762 {
1763 	struct ath_hal *ah = sc->sc_ah;
1764 	int error;
1765 	struct mbuf *m;
1766 	struct ath_desc *ds;
1767 
1768 	m = bf->bf_m;
1769 	if (m == NULL) {
1770 		/*
1771 		 * NB: by assigning a page to the rx dma buffer we
1772 		 * implicitly satisfy the Atheros requirement that
1773 		 * this buffer be cache-line-aligned and sized to be
1774 		 * multiple of the cache line size.  Not doing this
1775 		 * causes weird stuff to happen (for the 5210 at least).
1776 		 */
1777 		m = ath_getmbuf(M_DONTWAIT, MT_DATA, MCLBYTES);
1778 		if (m == NULL) {
1779 			DPRINTF(ATH_DEBUG_ANY,
1780 			    ("%s: no mbuf/cluster\n", __func__));
1781 			sc->sc_stats.ast_rx_nombuf++;
1782 			return ENOMEM;
1783 		}
1784 		bf->bf_m = m;
1785 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1786 
1787 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1788 		    BUS_DMA_NOWAIT);
1789 		if (error != 0) {
1790 			DPRINTF(ATH_DEBUG_ANY,
1791 			    ("%s: ath_bus_dmamap_load_mbuf failed;"
1792 			    " error %d\n", __func__, error));
1793 			sc->sc_stats.ast_rx_busdma++;
1794 			return error;
1795 		}
1796 		KASSERT(bf->bf_nseg == 1,
1797 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1798 			bf->bf_nseg));
1799 	}
1800 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
1801 	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
1802 
1803 	/*
1804 	 * Setup descriptors.  For receive we always terminate
1805 	 * the descriptor list with a self-linked entry so we'll
1806 	 * not get overrun under high load (as can happen with a
1807 	 * 5212 when ANI processing enables PHY errors).
1808 	 *
1809 	 * To insure the last descriptor is self-linked we create
1810 	 * each descriptor as self-linked and add it to the end.  As
1811 	 * each additional descriptor is added the previous self-linked
1812 	 * entry is ``fixed'' naturally.  This should be safe even
1813 	 * if DMA is happening.  When processing RX interrupts we
1814 	 * never remove/process the last, self-linked, entry on the
1815 	 * descriptor list.  This insures the hardware always has
1816 	 * someplace to write a new frame.
1817 	 */
1818 	ds = bf->bf_desc;
1819 	bzero(ds, sizeof(struct ath_desc));
1820 #ifndef IEEE80211_STA_ONLY
1821 	if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
1822 		ds->ds_link = bf->bf_daddr;	/* link to self */
1823 #endif
1824 	ds->ds_data = bf->bf_segs[0].ds_addr;
1825 	ath_hal_setup_rx_desc(ah, ds
1826 		, m->m_len		/* buffer size */
1827 		, 0
1828 	);
1829 
1830 	if (sc->sc_rxlink != NULL)
1831 		*sc->sc_rxlink = bf->bf_daddr;
1832 	sc->sc_rxlink = &ds->ds_link;
1833 	return 0;
1834 }
1835 
1836 void
1837 ath_rx_proc(void *arg, int npending)
1838 {
1839 #define	PA2DESC(_sc, _pa) \
1840 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
1841 		((_pa) - (_sc)->sc_desc_paddr)))
1842 	struct ath_softc *sc = arg;
1843 	struct ath_buf *bf;
1844 	struct ieee80211com *ic = &sc->sc_ic;
1845 	struct ifnet *ifp = &ic->ic_if;
1846 	struct ath_hal *ah = sc->sc_ah;
1847 	struct ath_desc *ds;
1848 	struct mbuf *m;
1849 	struct ieee80211_frame *wh;
1850 	struct ieee80211_frame whbuf;
1851 	struct ieee80211_rxinfo rxi;
1852 	struct ieee80211_node *ni;
1853 	struct ath_node *an;
1854 	struct ath_recv_hist *rh;
1855 	int len;
1856 	u_int phyerr;
1857 	HAL_STATUS status;
1858 
1859 	DPRINTF(ATH_DEBUG_RX_PROC, ("%s: pending %u\n", __func__, npending));
1860 	do {
1861 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1862 		if (bf == NULL) {		/* NB: shouldn't happen */
1863 			printf("%s: ath_rx_proc: no buffer!\n", ifp->if_xname);
1864 			break;
1865 		}
1866 		ds = bf->bf_desc;
1867 		if (ds->ds_link == bf->bf_daddr) {
1868 			/* NB: never process the self-linked entry at the end */
1869 			break;
1870 		}
1871 		m = bf->bf_m;
1872 		if (m == NULL) {		/* NB: shouldn't happen */
1873 			printf("%s: ath_rx_proc: no mbuf!\n", ifp->if_xname);
1874 			continue;
1875 		}
1876 		/* XXX sync descriptor memory */
1877 		/*
1878 		 * Must provide the virtual address of the current
1879 		 * descriptor, the physical address, and the virtual
1880 		 * address of the next descriptor in the h/w chain.
1881 		 * This allows the HAL to look ahead to see if the
1882 		 * hardware is done with a descriptor by checking the
1883 		 * done bit in the following descriptor and the address
1884 		 * of the current descriptor the DMA engine is working
1885 		 * on.  All this is necessary because of our use of
1886 		 * a self-linked list to avoid rx overruns.
1887 		 */
1888 		status = ath_hal_proc_rx_desc(ah, ds,
1889 		    bf->bf_daddr, PA2DESC(sc, ds->ds_link));
1890 #ifdef AR_DEBUG
1891 		if (ath_debug & ATH_DEBUG_RECV_DESC)
1892 		    ath_printrxbuf(bf, status == HAL_OK);
1893 #endif
1894 		if (status == HAL_EINPROGRESS)
1895 			break;
1896 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1897 
1898 		if (ds->ds_rxstat.rs_more) {
1899 			/*
1900 			 * Frame spans multiple descriptors; this
1901 			 * cannot happen yet as we don't support
1902 			 * jumbograms.  If not in monitor mode,
1903 			 * discard the frame.
1904 			 */
1905 
1906 			/*
1907 			 * Enable this if you want to see error
1908 			 * frames in Monitor mode.
1909 			 */
1910 #ifdef ERROR_FRAMES
1911 			if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1912 				/* XXX statistic */
1913 				goto rx_next;
1914 			}
1915 #endif
1916 			/* fall thru for monitor mode handling... */
1917 
1918 		} else if (ds->ds_rxstat.rs_status != 0) {
1919 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1920 				sc->sc_stats.ast_rx_crcerr++;
1921 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1922 				sc->sc_stats.ast_rx_fifoerr++;
1923 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1924 				sc->sc_stats.ast_rx_badcrypt++;
1925 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1926 				sc->sc_stats.ast_rx_phyerr++;
1927 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1928 				sc->sc_stats.ast_rx_phy[phyerr]++;
1929 			}
1930 
1931 			/*
1932 			 * reject error frames, we normally don't want
1933 			 * to see them in monitor mode.
1934 			 */
1935 			if ((ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT ) ||
1936 			    (ds->ds_rxstat.rs_status & HAL_RXERR_PHY))
1937 			    goto rx_next;
1938 
1939 			/*
1940 			 * In monitor mode, allow through packets that
1941 			 * cannot be decrypted
1942 			 */
1943 			if ((ds->ds_rxstat.rs_status & ~HAL_RXERR_DECRYPT) ||
1944 			    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
1945 				goto rx_next;
1946 		}
1947 
1948 		len = ds->ds_rxstat.rs_datalen;
1949 		if (len < IEEE80211_MIN_LEN) {
1950 			DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
1951 			    __func__, len));
1952 			sc->sc_stats.ast_rx_tooshort++;
1953 			goto rx_next;
1954 		}
1955 
1956 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
1957 		    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
1958 
1959 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1960 		bf->bf_m = NULL;
1961 		m->m_pkthdr.rcvif = ifp;
1962 		m->m_pkthdr.len = m->m_len = len;
1963 
1964 #if NBPFILTER > 0
1965 		if (sc->sc_drvbpf) {
1966 			struct mbuf mb;
1967 
1968 			sc->sc_rxtap.wr_flags = IEEE80211_RADIOTAP_F_FCS;
1969 			sc->sc_rxtap.wr_rate =
1970 			    sc->sc_hwmap[ds->ds_rxstat.rs_rate] &
1971 			    IEEE80211_RATE_VAL;
1972 			sc->sc_rxtap.wr_antenna = ds->ds_rxstat.rs_antenna;
1973 			sc->sc_rxtap.wr_rssi = ds->ds_rxstat.rs_rssi;
1974 			sc->sc_rxtap.wr_max_rssi = ic->ic_max_rssi;
1975 
1976 			mb.m_data = (caddr_t)&sc->sc_rxtap;
1977 			mb.m_len = sc->sc_rxtap_len;
1978 			mb.m_next = m;
1979 			mb.m_nextpkt = NULL;
1980 			mb.m_type = 0;
1981 			mb.m_flags = 0;
1982 			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1983 		}
1984 #endif
1985 		m_adj(m, -IEEE80211_CRC_LEN);
1986 		wh = mtod(m, struct ieee80211_frame *);
1987 		rxi.rxi_flags = 0;
1988 		if (!ath_softcrypto && (wh->i_fc[1] & IEEE80211_FC1_WEP)) {
1989 			/*
1990 			 * WEP is decrypted by hardware. Clear WEP bit
1991 			 * and trim WEP header for ieee80211_input().
1992 			 */
1993 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1994 			bcopy(wh, &whbuf, sizeof(whbuf));
1995 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1996 			wh = mtod(m, struct ieee80211_frame *);
1997 			bcopy(&whbuf, wh, sizeof(whbuf));
1998 			/*
1999 			 * Also trim WEP ICV from the tail.
2000 			 */
2001 			m_adj(m, -IEEE80211_WEP_CRCLEN);
2002 			/*
2003 			 * The header has probably moved.
2004 			 */
2005 			wh = mtod(m, struct ieee80211_frame *);
2006 
2007 			rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
2008 		}
2009 
2010 		/*
2011 		 * Locate the node for sender, track state, and
2012 		 * then pass this node (referenced) up to the 802.11
2013 		 * layer for its use.
2014 		 */
2015 		ni = ieee80211_find_rxnode(ic, wh);
2016 
2017 		/*
2018 		 * Record driver-specific state.
2019 		 */
2020 		an = ATH_NODE(ni);
2021 		if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE)
2022 			an->an_rx_hist_next = 0;
2023 		rh = &an->an_rx_hist[an->an_rx_hist_next];
2024 		rh->arh_ticks = ATH_TICKS();
2025 		rh->arh_rssi = ds->ds_rxstat.rs_rssi;
2026 		rh->arh_antenna = ds->ds_rxstat.rs_antenna;
2027 
2028 		/*
2029 		 * Send frame up for processing.
2030 		 */
2031 		rxi.rxi_rssi = ds->ds_rxstat.rs_rssi;
2032 		rxi.rxi_tstamp = ds->ds_rxstat.rs_tstamp;
2033 		ieee80211_input(ifp, m, ni, &rxi);
2034 
2035 		/* Handle the rate adaption */
2036 		ieee80211_rssadapt_input(ic, ni, &an->an_rssadapt,
2037 		    ds->ds_rxstat.rs_rssi);
2038 
2039 		/*
2040 		 * The frame may have caused the node to be marked for
2041 		 * reclamation (e.g. in response to a DEAUTH message)
2042 		 * so use release_node here instead of unref_node.
2043 		 */
2044 		ieee80211_release_node(ic, ni);
2045 
2046 	rx_next:
2047 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
2048 	} while (ath_rxbuf_init(sc, bf) == 0);
2049 
2050 	ath_hal_set_rx_signal(ah);		/* rx signal state monitoring */
2051 	ath_hal_start_rx(ah);			/* in case of RXEOL */
2052 #undef PA2DESC
2053 }
2054 
2055 /*
2056  * XXX Size of an ACK control frame in bytes.
2057  */
2058 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
2059 
2060 int
2061 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni,
2062     struct ath_buf *bf, struct mbuf *m0)
2063 {
2064 	struct ieee80211com *ic = &sc->sc_ic;
2065 	struct ath_hal *ah = sc->sc_ah;
2066 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2067 	int i, error, iswep, hdrlen, pktlen, len, s, tries;
2068 	u_int8_t rix, cix, txrate, ctsrate;
2069 	struct ath_desc *ds;
2070 	struct ieee80211_frame *wh;
2071 	struct ieee80211_key *k;
2072 	u_int32_t iv;
2073 	u_int8_t *ivp;
2074 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
2075 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
2076 	u_int subtype, flags, ctsduration, antenna;
2077 	HAL_PKT_TYPE atype;
2078 	const HAL_RATE_TABLE *rt;
2079 	HAL_BOOL shortPreamble;
2080 	struct ath_node *an;
2081 	u_int8_t hwqueue = HAL_TX_QUEUE_ID_DATA_MIN;
2082 
2083 	wh = mtod(m0, struct ieee80211_frame *);
2084 	iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
2085 	hdrlen = sizeof(struct ieee80211_frame);
2086 	pktlen = m0->m_pkthdr.len;
2087 
2088 	if (ath_softcrypto && iswep) {
2089 		k = ieee80211_get_txkey(ic, wh, ni);
2090 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2091 			return ENOMEM;
2092 		wh = mtod(m0, struct ieee80211_frame *);
2093 
2094 		/* reset len in case we got a new mbuf */
2095 		pktlen = m0->m_pkthdr.len;
2096 	} else if (!ath_softcrypto && iswep) {
2097 		bcopy(mtod(m0, caddr_t), hdrbuf, hdrlen);
2098 		m_adj(m0, hdrlen);
2099 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
2100 		if (m0 == NULL) {
2101 			sc->sc_stats.ast_tx_nombuf++;
2102 			return ENOMEM;
2103 		}
2104 		ivp = hdrbuf + hdrlen;
2105 		wh = mtod(m0, struct ieee80211_frame *);
2106 		/*
2107 		 * XXX
2108 		 * IV must not duplicate during the lifetime of the key.
2109 		 * But no mechanism to renew keys is defined in IEEE 802.11
2110 		 * for WEP.  And the IV may be duplicated at other stations
2111 		 * because the session key itself is shared.  So we use a
2112 		 * pseudo random IV for now, though it is not the right way.
2113 		 *
2114 		 * NB: Rather than use a strictly random IV we select a
2115 		 * random one to start and then increment the value for
2116 		 * each frame.  This is an explicit tradeoff between
2117 		 * overhead and security.  Given the basic insecurity of
2118 		 * WEP this seems worthwhile.
2119 		 */
2120 
2121 		/*
2122 		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
2123 		 * (B, 255, N) with 3 <= B < 16 and 0 <= N <= 255
2124 		 */
2125 		iv = ic->ic_iv;
2126 		if ((iv & 0xff00) == 0xff00) {
2127 			int B = (iv & 0xff0000) >> 16;
2128 			if (3 <= B && B < 16)
2129 				iv = (B+1) << 16;
2130 		}
2131 		ic->ic_iv = iv + 1;
2132 
2133 		/*
2134 		 * NB: Preserve byte order of IV for packet
2135 		 *     sniffers; it doesn't matter otherwise.
2136 		 */
2137 #if _BYTE_ORDER == _BIG_ENDIAN
2138 		ivp[0] = iv >> 0;
2139 		ivp[1] = iv >> 8;
2140 		ivp[2] = iv >> 16;
2141 #else
2142 		ivp[2] = iv >> 0;
2143 		ivp[1] = iv >> 8;
2144 		ivp[0] = iv >> 16;
2145 #endif
2146 		ivp[3] = ic->ic_wep_txkey << 6; /* Key ID and pad */
2147 		bcopy(hdrbuf, mtod(m0, caddr_t), sizeof(hdrbuf));
2148 		/*
2149 		 * The length of hdrlen and pktlen must be increased for WEP
2150 		 */
2151 		len = IEEE80211_WEP_IVLEN +
2152 		    IEEE80211_WEP_KIDLEN +
2153 		    IEEE80211_WEP_CRCLEN;
2154 		hdrlen += len;
2155 		pktlen += len;
2156 	}
2157 	pktlen += IEEE80211_CRC_LEN;
2158 
2159 	/*
2160 	 * Load the DMA map so any coalescing is done.  This
2161 	 * also calculates the number of descriptors we need.
2162 	 */
2163 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
2164 	    BUS_DMA_NOWAIT);
2165 	/*
2166 	 * Discard null packets and check for packets that
2167 	 * require too many TX descriptors.  We try to convert
2168 	 * the latter to a cluster.
2169 	 */
2170 	if (error == EFBIG) {		/* too many desc's, linearize */
2171 		sc->sc_stats.ast_tx_linear++;
2172 		if (m_defrag(m0, M_DONTWAIT)) {
2173 			sc->sc_stats.ast_tx_nomcl++;
2174 			m_freem(m0);
2175 			return ENOMEM;
2176 		}
2177 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
2178 		    BUS_DMA_NOWAIT);
2179 		if (error != 0) {
2180 			sc->sc_stats.ast_tx_busdma++;
2181 			m_freem(m0);
2182 			return error;
2183 		}
2184 		KASSERT(bf->bf_nseg == 1,
2185 			("ath_tx_start: packet not one segment; nseg %u",
2186 			bf->bf_nseg));
2187 	} else if (error != 0) {
2188 		sc->sc_stats.ast_tx_busdma++;
2189 		m_freem(m0);
2190 		return error;
2191 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
2192 		sc->sc_stats.ast_tx_nodata++;
2193 		m_freem(m0);
2194 		return EIO;
2195 	}
2196 	DPRINTF(ATH_DEBUG_XMIT, ("%s: m %p len %u\n", __func__, m0, pktlen));
2197 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
2198 	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);
2199 	bf->bf_m = m0;
2200 	bf->bf_node = ni;			/* NB: held reference */
2201 	an = ATH_NODE(ni);
2202 
2203 	/* setup descriptors */
2204 	ds = bf->bf_desc;
2205 	rt = sc->sc_currates;
2206 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
2207 
2208 	/*
2209 	 * Calculate Atheros packet type from IEEE80211 packet header
2210 	 * and setup for rate calculations.
2211 	 */
2212 	bf->bf_id.id_node = NULL;
2213 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
2214 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
2215 	case IEEE80211_FC0_TYPE_MGT:
2216 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2217 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
2218 			atype = HAL_PKT_TYPE_BEACON;
2219 		} else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
2220 			atype = HAL_PKT_TYPE_PROBE_RESP;
2221 		} else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM) {
2222 			atype = HAL_PKT_TYPE_ATIM;
2223 		}
2224 		rix = 0;			/* XXX lowest rate */
2225 		break;
2226 	case IEEE80211_FC0_TYPE_CTL:
2227 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2228 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
2229 			atype = HAL_PKT_TYPE_PSPOLL;
2230 		rix = 0;			/* XXX lowest rate */
2231 		break;
2232 	default:
2233 		/* remember link conditions for rate adaptation algorithm */
2234 		if (ic->ic_fixed_rate == -1) {
2235 			bf->bf_id.id_len = m0->m_pkthdr.len;
2236 			bf->bf_id.id_rateidx = ni->ni_txrate;
2237 			bf->bf_id.id_node = ni;
2238 			bf->bf_id.id_rssi = ath_node_getrssi(ic, ni);
2239 		}
2240 		ni->ni_txrate = ieee80211_rssadapt_choose(&an->an_rssadapt,
2241 		    &ni->ni_rates, wh, m0->m_pkthdr.len, ic->ic_fixed_rate,
2242 		    ifp->if_xname, 0);
2243 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
2244 		    IEEE80211_RATE_VAL];
2245 		if (rix == 0xff) {
2246 			printf("%s: bogus xmit rate 0x%x (idx 0x%x)\n",
2247 			    ifp->if_xname, ni->ni_rates.rs_rates[ni->ni_txrate],
2248 			    ni->ni_txrate);
2249 			sc->sc_stats.ast_tx_badrate++;
2250 			m_freem(m0);
2251 			return EIO;
2252 		}
2253 		break;
2254 	}
2255 
2256 	/*
2257 	 * NB: the 802.11 layer marks whether or not we should
2258 	 * use short preamble based on the current mode and
2259 	 * negotiated parameters.
2260 	 */
2261 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2262 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
2263 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
2264 		shortPreamble = AH_TRUE;
2265 		sc->sc_stats.ast_tx_shortpre++;
2266 	} else {
2267 		txrate = rt->info[rix].rateCode;
2268 		shortPreamble = AH_FALSE;
2269 	}
2270 
2271 	/*
2272 	 * Calculate miscellaneous flags.
2273 	 */
2274 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
2275 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2276 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
2277 		sc->sc_stats.ast_tx_noack++;
2278 	} else if (pktlen > ic->ic_rtsthreshold) {
2279 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
2280 		sc->sc_stats.ast_tx_rts++;
2281 	}
2282 
2283 	/*
2284 	 * Calculate duration.  This logically belongs in the 802.11
2285 	 * layer but it lacks sufficient information to calculate it.
2286 	 */
2287 	if ((flags & HAL_TXDESC_NOACK) == 0 &&
2288 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
2289 		u_int16_t dur;
2290 		/*
2291 		 * XXX not right with fragmentation.
2292 		 */
2293 		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
2294 				rix, shortPreamble);
2295 		*((u_int16_t*) wh->i_dur) = htole16(dur);
2296 	}
2297 
2298 	/*
2299 	 * Calculate RTS/CTS rate and duration if needed.
2300 	 */
2301 	ctsduration = 0;
2302 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
2303 		/*
2304 		 * CTS transmit rate is derived from the transmit rate
2305 		 * by looking in the h/w rate table.  We must also factor
2306 		 * in whether or not a short preamble is to be used.
2307 		 */
2308 		cix = rt->info[rix].controlRate;
2309 		ctsrate = rt->info[cix].rateCode;
2310 		if (shortPreamble)
2311 			ctsrate |= rt->info[cix].shortPreamble;
2312 		/*
2313 		 * Compute the transmit duration based on the size
2314 		 * of an ACK frame.  We call into the HAL to do the
2315 		 * computation since it depends on the characteristics
2316 		 * of the actual PHY being used.
2317 		 */
2318 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
2319 			ctsduration += ath_hal_computetxtime(ah,
2320 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2321 		}
2322 		/* SIFS + data */
2323 		ctsduration += ath_hal_computetxtime(ah,
2324 			rt, pktlen, rix, shortPreamble);
2325 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
2326 			ctsduration += ath_hal_computetxtime(ah,
2327 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2328 		}
2329 	} else
2330 		ctsrate = 0;
2331 
2332 	/*
2333 	 * For now use the antenna on which the last good
2334 	 * frame was received on.  We assume this field is
2335 	 * initialized to 0 which gives us ``auto'' or the
2336 	 * ``default'' antenna.
2337 	 */
2338 	if (an->an_tx_antenna) {
2339 		antenna = an->an_tx_antenna;
2340 	} else {
2341 		antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
2342 	}
2343 
2344 #if NBPFILTER > 0
2345 	if (ic->ic_rawbpf)
2346 		bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2347 
2348 	if (sc->sc_drvbpf) {
2349 		struct mbuf mb;
2350 
2351 		sc->sc_txtap.wt_flags = 0;
2352 		if (shortPreamble)
2353 			sc->sc_txtap.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2354 		if (!ath_softcrypto && iswep)
2355 			sc->sc_txtap.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2356 		sc->sc_txtap.wt_rate = ni->ni_rates.rs_rates[ni->ni_txrate] &
2357 		    IEEE80211_RATE_VAL;
2358 		sc->sc_txtap.wt_txpower = 30;
2359 		sc->sc_txtap.wt_antenna = antenna;
2360 		sc->sc_txtap.wt_hwqueue = hwqueue;
2361 
2362 		mb.m_data = (caddr_t)&sc->sc_txtap;
2363 		mb.m_len = sc->sc_txtap_len;
2364 		mb.m_next = m0;
2365 		mb.m_nextpkt = NULL;
2366 		mb.m_type = 0;
2367 		mb.m_flags = 0;
2368 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
2369 	}
2370 #endif
2371 
2372 	/*
2373 	 * Formulate first tx descriptor with tx controls.
2374 	 */
2375 	tries = IEEE80211_IS_MULTICAST(wh->i_addr1) ? 1 : 15;
2376 	/* XXX check return value? */
2377 	ath_hal_setup_tx_desc(ah, ds
2378 		, pktlen		/* packet length */
2379 		, hdrlen		/* header length */
2380 		, atype			/* Atheros packet type */
2381 		, 60			/* txpower XXX */
2382 		, txrate, tries		/* series 0 rate/tries */
2383 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
2384 		, antenna		/* antenna mode */
2385 		, flags			/* flags */
2386 		, ctsrate		/* rts/cts rate */
2387 		, ctsduration		/* rts/cts duration */
2388 	);
2389 #ifdef notyet
2390 	ath_hal_setup_xtx_desc(ah, ds
2391 		, AH_FALSE		/* short preamble */
2392 		, 0, 0			/* series 1 rate/tries */
2393 		, 0, 0			/* series 2 rate/tries */
2394 		, 0, 0			/* series 3 rate/tries */
2395 	);
2396 #endif
2397 	/*
2398 	 * Fillin the remainder of the descriptor info.
2399 	 */
2400 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
2401 		ds->ds_data = bf->bf_segs[i].ds_addr;
2402 		if (i == bf->bf_nseg - 1) {
2403 			ds->ds_link = 0;
2404 		} else {
2405 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
2406 		}
2407 		ath_hal_fill_tx_desc(ah, ds
2408 			, bf->bf_segs[i].ds_len	/* segment length */
2409 			, i == 0		/* first segment */
2410 			, i == bf->bf_nseg - 1	/* last segment */
2411 		);
2412 		DPRINTF(ATH_DEBUG_XMIT,
2413 		    ("%s: %d: %08x %08x %08x %08x %08x %08x\n",
2414 		    __func__, i, ds->ds_link, ds->ds_data,
2415 		    ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]));
2416 	}
2417 
2418 	/*
2419 	 * Insert the frame on the outbound list and
2420 	 * pass it on to the hardware.
2421 	 */
2422 	s = splnet();
2423 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
2424 	if (sc->sc_txlink == NULL) {
2425 		ath_hal_put_tx_buf(ah, sc->sc_txhalq[hwqueue], bf->bf_daddr);
2426 		DPRINTF(ATH_DEBUG_XMIT, ("%s: TXDP0 = %p (%p)\n", __func__,
2427 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
2428 	} else {
2429 		*sc->sc_txlink = bf->bf_daddr;
2430 		DPRINTF(ATH_DEBUG_XMIT, ("%s: link(%p)=%p (%p)\n", __func__,
2431 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
2432 	}
2433 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
2434 	splx(s);
2435 
2436 	ath_hal_tx_start(ah, sc->sc_txhalq[hwqueue]);
2437 	return 0;
2438 }
2439 
2440 void
2441 ath_tx_proc(void *arg, int npending)
2442 {
2443 	struct ath_softc *sc = arg;
2444 	struct ath_hal *ah = sc->sc_ah;
2445 	struct ath_buf *bf;
2446 	struct ieee80211com *ic = &sc->sc_ic;
2447 	struct ifnet *ifp = &ic->ic_if;
2448 	struct ath_desc *ds;
2449 	struct ieee80211_node *ni;
2450 	struct ath_node *an;
2451 	int sr, lr, s;
2452 	HAL_STATUS status;
2453 
2454 	for (;;) {
2455 		s = splnet();
2456 		bf = TAILQ_FIRST(&sc->sc_txq);
2457 		if (bf == NULL) {
2458 			sc->sc_txlink = NULL;
2459 			splx(s);
2460 			break;
2461 		}
2462 		/* only the last descriptor is needed */
2463 		ds = &bf->bf_desc[bf->bf_nseg - 1];
2464 		status = ath_hal_proc_tx_desc(ah, ds);
2465 #ifdef AR_DEBUG
2466 		if (ath_debug & ATH_DEBUG_XMIT_DESC)
2467 			ath_printtxbuf(bf, status == HAL_OK);
2468 #endif
2469 		if (status == HAL_EINPROGRESS) {
2470 			splx(s);
2471 			break;
2472 		}
2473 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2474 		splx(s);
2475 
2476 		ni = bf->bf_node;
2477 		if (ni != NULL) {
2478 			an = (struct ath_node *) ni;
2479 			if (ds->ds_txstat.ts_status == 0) {
2480 				if (bf->bf_id.id_node != NULL)
2481 					ieee80211_rssadapt_raise_rate(ic,
2482 					    &an->an_rssadapt, &bf->bf_id);
2483 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
2484 			} else {
2485 				if (bf->bf_id.id_node != NULL)
2486 					ieee80211_rssadapt_lower_rate(ic, ni,
2487 					    &an->an_rssadapt, &bf->bf_id);
2488 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
2489 					sc->sc_stats.ast_tx_xretries++;
2490 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
2491 					sc->sc_stats.ast_tx_fifoerr++;
2492 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
2493 					sc->sc_stats.ast_tx_filtered++;
2494 				an->an_tx_antenna = 0;	/* invalidate */
2495 			}
2496 			sr = ds->ds_txstat.ts_shortretry;
2497 			lr = ds->ds_txstat.ts_longretry;
2498 			sc->sc_stats.ast_tx_shortretry += sr;
2499 			sc->sc_stats.ast_tx_longretry += lr;
2500 			/*
2501 			 * Reclaim reference to node.
2502 			 *
2503 			 * NB: the node may be reclaimed here if, for example
2504 			 *     this is a DEAUTH message that was sent and the
2505 			 *     node was timed out due to inactivity.
2506 			 */
2507 			ieee80211_release_node(ic, ni);
2508 		}
2509 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
2510 		    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
2511 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2512 		m_freem(bf->bf_m);
2513 		bf->bf_m = NULL;
2514 		bf->bf_node = NULL;
2515 
2516 		s = splnet();
2517 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2518 		splx(s);
2519 	}
2520 	ifp->if_flags &= ~IFF_OACTIVE;
2521 	sc->sc_tx_timer = 0;
2522 
2523 	ath_start(ifp);
2524 }
2525 
2526 /*
2527  * Drain the transmit queue and reclaim resources.
2528  */
2529 void
2530 ath_draintxq(struct ath_softc *sc)
2531 {
2532 	struct ath_hal *ah = sc->sc_ah;
2533 	struct ieee80211com *ic = &sc->sc_ic;
2534 	struct ifnet *ifp = &ic->ic_if;
2535 	struct ieee80211_node *ni;
2536 	struct ath_buf *bf;
2537 	int s, i;
2538 
2539 	/* XXX return value */
2540 	if (!sc->sc_invalid) {
2541 		for (i = 0; i <= HAL_TX_QUEUE_ID_DATA_MAX; i++) {
2542 			/* don't touch the hardware if marked invalid */
2543 			(void) ath_hal_stop_tx_dma(ah, sc->sc_txhalq[i]);
2544 			DPRINTF(ATH_DEBUG_RESET,
2545 			    ("%s: tx queue %d (%p), link %p\n", __func__, i,
2546 			    (caddr_t)(u_intptr_t)ath_hal_get_tx_buf(ah,
2547 			    sc->sc_txhalq[i]), sc->sc_txlink));
2548 		}
2549 		(void) ath_hal_stop_tx_dma(ah, sc->sc_bhalq);
2550 		DPRINTF(ATH_DEBUG_RESET,
2551 		    ("%s: beacon queue (%p)\n", __func__,
2552 		    (caddr_t)(u_intptr_t)ath_hal_get_tx_buf(ah, sc->sc_bhalq)));
2553 	}
2554 	for (;;) {
2555 		s = splnet();
2556 		bf = TAILQ_FIRST(&sc->sc_txq);
2557 		if (bf == NULL) {
2558 			sc->sc_txlink = NULL;
2559 			splx(s);
2560 			break;
2561 		}
2562 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2563 		splx(s);
2564 #ifdef AR_DEBUG
2565 		if (ath_debug & ATH_DEBUG_RESET) {
2566 			ath_printtxbuf(bf,
2567 			    ath_hal_proc_tx_desc(ah, bf->bf_desc) == HAL_OK);
2568 		}
2569 #endif /* AR_DEBUG */
2570 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2571 		m_freem(bf->bf_m);
2572 		bf->bf_m = NULL;
2573 		ni = bf->bf_node;
2574 		bf->bf_node = NULL;
2575 		s = splnet();
2576 		if (ni != NULL) {
2577 			/*
2578 			 * Reclaim node reference.
2579 			 */
2580 			ieee80211_release_node(ic, ni);
2581 		}
2582 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2583 		splx(s);
2584 	}
2585 	ifp->if_flags &= ~IFF_OACTIVE;
2586 	sc->sc_tx_timer = 0;
2587 }
2588 
2589 /*
2590  * Disable the receive h/w in preparation for a reset.
2591  */
2592 void
2593 ath_stoprecv(struct ath_softc *sc)
2594 {
2595 #define	PA2DESC(_sc, _pa) \
2596 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
2597 		((_pa) - (_sc)->sc_desc_paddr)))
2598 	struct ath_hal *ah = sc->sc_ah;
2599 
2600 	ath_hal_stop_pcu_recv(ah);	/* disable PCU */
2601 	ath_hal_set_rx_filter(ah, 0);	/* clear recv filter */
2602 	ath_hal_stop_rx_dma(ah);	/* disable DMA engine */
2603 #ifdef AR_DEBUG
2604 	if (ath_debug & ATH_DEBUG_RESET) {
2605 		struct ath_buf *bf;
2606 
2607 		printf("%s: rx queue %p, link %p\n", __func__,
2608 		    (caddr_t)(u_intptr_t)ath_hal_get_rx_buf(ah), sc->sc_rxlink);
2609 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2610 			struct ath_desc *ds = bf->bf_desc;
2611 			if (ath_hal_proc_rx_desc(ah, ds, bf->bf_daddr,
2612 			    PA2DESC(sc, ds->ds_link)) == HAL_OK)
2613 				ath_printrxbuf(bf, 1);
2614 		}
2615 	}
2616 #endif
2617 	sc->sc_rxlink = NULL;		/* just in case */
2618 #undef PA2DESC
2619 }
2620 
2621 /*
2622  * Enable the receive h/w following a reset.
2623  */
2624 int
2625 ath_startrecv(struct ath_softc *sc)
2626 {
2627 	struct ath_hal *ah = sc->sc_ah;
2628 	struct ath_buf *bf;
2629 
2630 	sc->sc_rxlink = NULL;
2631 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2632 		int error = ath_rxbuf_init(sc, bf);
2633 		if (error != 0) {
2634 			DPRINTF(ATH_DEBUG_RECV,
2635 			    ("%s: ath_rxbuf_init failed %d\n",
2636 			    __func__, error));
2637 			return error;
2638 		}
2639 	}
2640 
2641 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2642 	ath_hal_put_rx_buf(ah, bf->bf_daddr);
2643 	ath_hal_start_rx(ah);		/* enable recv descriptors */
2644 	ath_mode_init(sc);		/* set filters, etc. */
2645 	ath_hal_start_rx_pcu(ah);	/* re-enable PCU/DMA engine */
2646 	return 0;
2647 }
2648 
2649 /*
2650  * Set/change channels.  If the channel is really being changed,
2651  * it's done by resetting the chip.  To accomplish this we must
2652  * first cleanup any pending DMA, then restart stuff after a la
2653  * ath_init.
2654  */
2655 int
2656 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2657 {
2658 	struct ath_hal *ah = sc->sc_ah;
2659 	struct ieee80211com *ic = &sc->sc_ic;
2660 	struct ifnet *ifp = &ic->ic_if;
2661 
2662 	DPRINTF(ATH_DEBUG_ANY, ("%s: %u (%u MHz) -> %u (%u MHz)\n", __func__,
2663 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2664 	    ic->ic_ibss_chan->ic_freq,
2665 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2666 	if (chan != ic->ic_ibss_chan) {
2667 		HAL_STATUS status;
2668 		HAL_CHANNEL hchan;
2669 		enum ieee80211_phymode mode;
2670 
2671 		/*
2672 		 * To switch channels clear any pending DMA operations;
2673 		 * wait long enough for the RX fifo to drain, reset the
2674 		 * hardware at the new frequency, and then re-enable
2675 		 * the relevant bits of the h/w.
2676 		 */
2677 		ath_hal_set_intr(ah, 0);		/* disable interrupts */
2678 		ath_draintxq(sc);		/* clear pending tx frames */
2679 		ath_stoprecv(sc);		/* turn off frame recv */
2680 		/*
2681 		 * Convert to a HAL channel description with
2682 		 * the flags constrained to reflect the current
2683 		 * operating mode.
2684 		 */
2685 		hchan.channel = chan->ic_freq;
2686 		hchan.channelFlags = ath_chan2flags(ic, chan);
2687 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE,
2688 		    &status)) {
2689 			printf("%s: ath_chan_set: unable to reset "
2690 				"channel %u (%u MHz)\n", ifp->if_xname,
2691 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2692 			return EIO;
2693 		}
2694 		ath_set_slot_time(sc);
2695 		/*
2696 		 * Re-enable rx framework.
2697 		 */
2698 		if (ath_startrecv(sc) != 0) {
2699 			printf("%s: ath_chan_set: unable to restart recv "
2700 			    "logic\n", ifp->if_xname);
2701 			return EIO;
2702 		}
2703 
2704 #if NBPFILTER > 0
2705 		/*
2706 		 * Update BPF state.
2707 		 */
2708 		sc->sc_txtap.wt_chan_freq = sc->sc_rxtap.wr_chan_freq =
2709 		    htole16(chan->ic_freq);
2710 		sc->sc_txtap.wt_chan_flags = sc->sc_rxtap.wr_chan_flags =
2711 		    htole16(chan->ic_flags);
2712 #endif
2713 
2714 		/*
2715 		 * Change channels and update the h/w rate map
2716 		 * if we're switching; e.g. 11a to 11b/g.
2717 		 */
2718 		ic->ic_ibss_chan = chan;
2719 		mode = ieee80211_chan2mode(ic, chan);
2720 		if (mode != sc->sc_curmode)
2721 			ath_setcurmode(sc, mode);
2722 
2723 		/*
2724 		 * Re-enable interrupts.
2725 		 */
2726 		ath_hal_set_intr(ah, sc->sc_imask);
2727 	}
2728 	return 0;
2729 }
2730 
2731 void
2732 ath_next_scan(void *arg)
2733 {
2734 	struct ath_softc *sc = arg;
2735 	struct ieee80211com *ic = &sc->sc_ic;
2736 	struct ifnet *ifp = &ic->ic_if;
2737 	int s;
2738 
2739 	/* don't call ath_start w/o network interrupts blocked */
2740 	s = splnet();
2741 
2742 	if (ic->ic_state == IEEE80211_S_SCAN)
2743 		ieee80211_next_scan(ifp);
2744 	splx(s);
2745 }
2746 
2747 int
2748 ath_set_slot_time(struct ath_softc *sc)
2749 {
2750 	struct ath_hal *ah = sc->sc_ah;
2751 	struct ieee80211com *ic = &sc->sc_ic;
2752 
2753 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
2754 		return (ath_hal_set_slot_time(ah, HAL_SLOT_TIME_9));
2755 
2756 	return (0);
2757 }
2758 
2759 /*
2760  * Periodically recalibrate the PHY to account
2761  * for temperature/environment changes.
2762  */
2763 void
2764 ath_calibrate(void *arg)
2765 {
2766 	struct ath_softc *sc = arg;
2767 	struct ath_hal *ah = sc->sc_ah;
2768 	struct ieee80211com *ic = &sc->sc_ic;
2769 	struct ieee80211_channel *c;
2770 	HAL_CHANNEL hchan;
2771 	int s;
2772 
2773 	sc->sc_stats.ast_per_cal++;
2774 
2775 	/*
2776 	 * Convert to a HAL channel description with the flags
2777 	 * constrained to reflect the current operating mode.
2778 	 */
2779 	c = ic->ic_ibss_chan;
2780 	hchan.channel = c->ic_freq;
2781 	hchan.channelFlags = ath_chan2flags(ic, c);
2782 
2783 	s = splnet();
2784 	DPRINTF(ATH_DEBUG_CALIBRATE,
2785 	    ("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2786 
2787 	if (ath_hal_get_rf_gain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2788 		/*
2789 		 * Rfgain is out of bounds, reset the chip
2790 		 * to load new gain values.
2791 		 */
2792 		sc->sc_stats.ast_per_rfgain++;
2793 		ath_reset(sc, 1);
2794 	}
2795 	if (!ath_hal_calibrate(ah, &hchan)) {
2796 		DPRINTF(ATH_DEBUG_ANY,
2797 		    ("%s: calibration of channel %u failed\n",
2798 		    __func__, c->ic_freq));
2799 		sc->sc_stats.ast_per_calfail++;
2800 	}
2801 	timeout_add_sec(&sc->sc_cal_to, ath_calinterval);
2802 	splx(s);
2803 }
2804 
2805 void
2806 ath_ledstate(struct ath_softc *sc, enum ieee80211_state state)
2807 {
2808 	HAL_LED_STATE led = HAL_LED_INIT;
2809 	u_int32_t softled = AR5K_SOFTLED_OFF;
2810 
2811 	switch (state) {
2812 	case IEEE80211_S_INIT:
2813 		break;
2814 	case IEEE80211_S_SCAN:
2815 		led = HAL_LED_SCAN;
2816 		break;
2817 	case IEEE80211_S_AUTH:
2818 		led = HAL_LED_AUTH;
2819 		break;
2820 	case IEEE80211_S_ASSOC:
2821 		led = HAL_LED_ASSOC;
2822 		softled = AR5K_SOFTLED_ON;
2823 		break;
2824 	case IEEE80211_S_RUN:
2825 		led = HAL_LED_RUN;
2826 		softled = AR5K_SOFTLED_ON;
2827 		break;
2828 	}
2829 
2830 	ath_hal_set_ledstate(sc->sc_ah, led);
2831 	if (sc->sc_softled) {
2832 		ath_hal_set_gpio_output(sc->sc_ah, AR5K_SOFTLED_PIN);
2833 		ath_hal_set_gpio(sc->sc_ah, AR5K_SOFTLED_PIN, softled);
2834 	}
2835 }
2836 
2837 int
2838 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2839 {
2840 	struct ifnet *ifp = &ic->ic_if;
2841 	struct ath_softc *sc = ifp->if_softc;
2842 	struct ath_hal *ah = sc->sc_ah;
2843 	struct ieee80211_node *ni;
2844 	const u_int8_t *bssid;
2845 	int error, i;
2846 
2847 	u_int32_t rfilt;
2848 
2849 	DPRINTF(ATH_DEBUG_ANY, ("%s: %s -> %s\n", __func__,
2850 	    ieee80211_state_name[ic->ic_state],
2851 	    ieee80211_state_name[nstate]));
2852 
2853 	timeout_del(&sc->sc_scan_to);
2854 	timeout_del(&sc->sc_cal_to);
2855 	ath_ledstate(sc, nstate);
2856 
2857 	if (nstate == IEEE80211_S_INIT) {
2858 		timeout_del(&sc->sc_rssadapt_to);
2859 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2860 		ath_hal_set_intr(ah, sc->sc_imask);
2861 		return (*sc->sc_newstate)(ic, nstate, arg);
2862 	}
2863 	ni = ic->ic_bss;
2864 	error = ath_chan_set(sc, ni->ni_chan);
2865 	if (error != 0)
2866 		goto bad;
2867 	rfilt = ath_calcrxfilter(sc);
2868 	if (nstate == IEEE80211_S_SCAN ||
2869 	    ic->ic_opmode == IEEE80211_M_MONITOR) {
2870 		bssid = sc->sc_broadcast_addr;
2871 	} else {
2872 		bssid = ni->ni_bssid;
2873 	}
2874 	ath_hal_set_rx_filter(ah, rfilt);
2875 	DPRINTF(ATH_DEBUG_ANY, ("%s: RX filter 0x%x bssid %s\n",
2876 	    __func__, rfilt, ether_sprintf((u_char*)bssid)));
2877 
2878 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA) {
2879 		ath_hal_set_associd(ah, bssid, ni->ni_associd);
2880 	} else {
2881 		ath_hal_set_associd(ah, bssid, 0);
2882 	}
2883 
2884 	if (!ath_softcrypto && (ic->ic_flags & IEEE80211_F_WEPON)) {
2885 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2886 			if (ath_hal_is_key_valid(ah, i))
2887 				ath_hal_set_key_lladdr(ah, i, bssid);
2888 		}
2889 	}
2890 
2891 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2892 		/* nothing to do */
2893 	} else if (nstate == IEEE80211_S_RUN) {
2894 		DPRINTF(ATH_DEBUG_ANY, ("%s(RUN): "
2895 		    "ic_flags=0x%08x iv=%d bssid=%s "
2896 		    "capinfo=0x%04x chan=%d\n",
2897 		    __func__,
2898 		    ic->ic_flags,
2899 		    ni->ni_intval,
2900 		    ether_sprintf(ni->ni_bssid),
2901 		    ni->ni_capinfo,
2902 		    ieee80211_chan2ieee(ic, ni->ni_chan)));
2903 
2904 		/*
2905 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2906 		 */
2907 #ifndef IEEE80211_STA_ONLY
2908 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2909 		    ic->ic_opmode == IEEE80211_M_IBSS) {
2910 			error = ath_beacon_alloc(sc, ni);
2911 			if (error != 0)
2912 				goto bad;
2913 		}
2914 #endif
2915 		/*
2916 		 * Configure the beacon and sleep timers.
2917 		 */
2918 		ath_beacon_config(sc);
2919 	} else {
2920 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2921 		ath_hal_set_intr(ah, sc->sc_imask);
2922 	}
2923 
2924 	/*
2925 	 * Invoke the parent method to complete the work.
2926 	 */
2927 	error = (*sc->sc_newstate)(ic, nstate, arg);
2928 
2929 	if (nstate == IEEE80211_S_RUN) {
2930 		/* start periodic recalibration timer */
2931 		timeout_add_sec(&sc->sc_cal_to, ath_calinterval);
2932 
2933 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
2934 			timeout_add_msec(&sc->sc_rssadapt_to, 100);
2935 	} else if (nstate == IEEE80211_S_SCAN) {
2936 		/* start ap/neighbor scan timer */
2937 		timeout_add_msec(&sc->sc_scan_to, ath_dwelltime);
2938 	}
2939 bad:
2940 	return error;
2941 }
2942 
2943 #ifndef IEEE80211_STA_ONLY
2944 void
2945 ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
2946     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
2947 {
2948 	struct ath_softc *sc = (struct ath_softc*)ic->ic_softc;
2949 	struct ath_hal *ah = sc->sc_ah;
2950 
2951 	(*sc->sc_recv_mgmt)(ic, m, ni, rxi, subtype);
2952 
2953 	switch (subtype) {
2954 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
2955 	case IEEE80211_FC0_SUBTYPE_BEACON:
2956 		if (ic->ic_opmode != IEEE80211_M_IBSS ||
2957 		    ic->ic_state != IEEE80211_S_RUN)
2958 			break;
2959 		if (ieee80211_ibss_merge(ic, ni, ath_hal_get_tsf64(ah)) ==
2960 		    ENETRESET)
2961 			ath_hal_set_associd(ah, ic->ic_bss->ni_bssid, 0);
2962 		break;
2963 	default:
2964 		break;
2965 	}
2966 	return;
2967 }
2968 #endif
2969 
2970 /*
2971  * Setup driver-specific state for a newly associated node.
2972  * Note that we're called also on a re-associate, the isnew
2973  * param tells us if this is the first time or not.
2974  */
2975 void
2976 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2977 {
2978 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2979 		return;
2980 }
2981 
2982 int
2983 ath_getchannels(struct ath_softc *sc, HAL_BOOL outdoor, HAL_BOOL xchanmode)
2984 {
2985 	struct ieee80211com *ic = &sc->sc_ic;
2986 	struct ifnet *ifp = &ic->ic_if;
2987 	struct ath_hal *ah = sc->sc_ah;
2988 	HAL_CHANNEL *chans;
2989 	int i, ix, nchan;
2990 
2991 	sc->sc_nchan = 0;
2992 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2993 			M_TEMP, M_NOWAIT);
2994 	if (chans == NULL) {
2995 		printf("%s: unable to allocate channel table\n", ifp->if_xname);
2996 		return ENOMEM;
2997 	}
2998 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2999 	    HAL_MODE_ALL, outdoor, xchanmode)) {
3000 		printf("%s: unable to collect channel list from hal\n",
3001 		    ifp->if_xname);
3002 		free(chans, M_TEMP, 0);
3003 		return EINVAL;
3004 	}
3005 
3006 	/*
3007 	 * Convert HAL channels to ieee80211 ones and insert
3008 	 * them in the table according to their channel number.
3009 	 */
3010 	for (i = 0; i < nchan; i++) {
3011 		HAL_CHANNEL *c = &chans[i];
3012 		ix = ieee80211_mhz2ieee(c->channel, c->channelFlags);
3013 		if (ix > IEEE80211_CHAN_MAX) {
3014 			printf("%s: bad hal channel %u (%u/%x) ignored\n",
3015 				ifp->if_xname, ix, c->channel, c->channelFlags);
3016 			continue;
3017 		}
3018 		DPRINTF(ATH_DEBUG_ANY,
3019 		    ("%s: HAL channel %d/%d freq %d flags %#04x idx %d\n",
3020 		    sc->sc_dev.dv_xname, i, nchan, c->channel, c->channelFlags,
3021 		    ix));
3022 		/* NB: flags are known to be compatible */
3023 		if (ic->ic_channels[ix].ic_freq == 0) {
3024 			ic->ic_channels[ix].ic_freq = c->channel;
3025 			ic->ic_channels[ix].ic_flags = c->channelFlags;
3026 		} else {
3027 			/* channels overlap; e.g. 11g and 11b */
3028 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
3029 		}
3030 		/* count valid channels */
3031 		sc->sc_nchan++;
3032 	}
3033 	free(chans, M_TEMP, 0);
3034 
3035 	if (sc->sc_nchan < 1) {
3036 		printf("%s: no valid channels for regdomain %s(%u)\n",
3037 		    ifp->if_xname, ieee80211_regdomain2name(ah->ah_regdomain),
3038 		    ah->ah_regdomain);
3039 		return ENOENT;
3040 	}
3041 
3042 	/* set an initial channel */
3043 	ic->ic_ibss_chan = &ic->ic_channels[0];
3044 
3045 	return 0;
3046 }
3047 
3048 int
3049 ath_rate_setup(struct ath_softc *sc, u_int mode)
3050 {
3051 	struct ath_hal *ah = sc->sc_ah;
3052 	struct ieee80211com *ic = &sc->sc_ic;
3053 	const HAL_RATE_TABLE *rt;
3054 	struct ieee80211_rateset *rs;
3055 	int i, maxrates;
3056 
3057 	switch (mode) {
3058 	case IEEE80211_MODE_11A:
3059 		sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11A);
3060 		break;
3061 	case IEEE80211_MODE_11B:
3062 		sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11B);
3063 		break;
3064 	case IEEE80211_MODE_11G:
3065 		sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11G);
3066 		break;
3067 	case IEEE80211_MODE_TURBO:
3068 		sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_TURBO);
3069 		break;
3070 	default:
3071 		DPRINTF(ATH_DEBUG_ANY,
3072 		    ("%s: invalid mode %u\n", __func__, mode));
3073 		return 0;
3074 	}
3075 	rt = sc->sc_rates[mode];
3076 	if (rt == NULL)
3077 		return 0;
3078 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
3079 		DPRINTF(ATH_DEBUG_ANY,
3080 		    ("%s: rate table too small (%u > %u)\n",
3081 		    __func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
3082 		maxrates = IEEE80211_RATE_MAXSIZE;
3083 	} else {
3084 		maxrates = rt->rateCount;
3085 	}
3086 	rs = &ic->ic_sup_rates[mode];
3087 	for (i = 0; i < maxrates; i++)
3088 		rs->rs_rates[i] = rt->info[i].dot11Rate;
3089 	rs->rs_nrates = maxrates;
3090 	return 1;
3091 }
3092 
3093 void
3094 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
3095 {
3096 	const HAL_RATE_TABLE *rt;
3097 	struct ieee80211com *ic = &sc->sc_ic;
3098 	struct ieee80211_node *ni;
3099 	int i;
3100 
3101 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
3102 	rt = sc->sc_rates[mode];
3103 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
3104 	for (i = 0; i < rt->rateCount; i++)
3105 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
3106 	bzero(sc->sc_hwmap, sizeof(sc->sc_hwmap));
3107 	for (i = 0; i < 32; i++)
3108 		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
3109 	sc->sc_currates = rt;
3110 	sc->sc_curmode = mode;
3111 	ni = ic->ic_bss;
3112 	ni->ni_rates.rs_nrates = sc->sc_currates->rateCount;
3113 	if (ni->ni_txrate >= ni->ni_rates.rs_nrates)
3114 		ni->ni_txrate = 0;
3115 }
3116 
3117 void
3118 ath_rssadapt_updatenode(void *arg, struct ieee80211_node *ni)
3119 {
3120 	struct ath_node *an = ATH_NODE(ni);
3121 
3122 	ieee80211_rssadapt_updatestats(&an->an_rssadapt);
3123 }
3124 
3125 void
3126 ath_rssadapt_updatestats(void *arg)
3127 {
3128 	struct ath_softc *sc = (struct ath_softc *)arg;
3129 	struct ieee80211com *ic = &sc->sc_ic;
3130 
3131 	if (ic->ic_opmode == IEEE80211_M_STA) {
3132 		ath_rssadapt_updatenode(arg, ic->ic_bss);
3133 	} else {
3134 		ieee80211_iterate_nodes(ic, ath_rssadapt_updatenode, arg);
3135 	}
3136 
3137 	timeout_add_msec(&sc->sc_rssadapt_to, 100);
3138 }
3139 
3140 #ifdef AR_DEBUG
3141 void
3142 ath_printrxbuf(struct ath_buf *bf, int done)
3143 {
3144 	struct ath_desc *ds;
3145 	int i;
3146 
3147 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
3148 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
3149 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
3150 		    ds->ds_link, ds->ds_data,
3151 		    ds->ds_ctl0, ds->ds_ctl1,
3152 		    ds->ds_hw[0], ds->ds_hw[1],
3153 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
3154 	}
3155 }
3156 
3157 void
3158 ath_printtxbuf(struct ath_buf *bf, int done)
3159 {
3160 	struct ath_desc *ds;
3161 	int i;
3162 
3163 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
3164 		printf("T%d (%p %p) "
3165 		    "%08x %08x %08x %08x %08x %08x %08x %08x %c\n",
3166 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
3167 		    ds->ds_link, ds->ds_data,
3168 		    ds->ds_ctl0, ds->ds_ctl1,
3169 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
3170 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
3171 	}
3172 }
3173 #endif /* AR_DEBUG */
3174 
3175 int
3176 ath_gpio_attach(struct ath_softc *sc, u_int16_t devid)
3177 {
3178 	struct ath_hal *ah = sc->sc_ah;
3179 	struct gpiobus_attach_args gba;
3180 	int i;
3181 
3182 	if (ah->ah_gpio_npins < 1)
3183 		return 0;
3184 
3185 	/* Initialize gpio pins array */
3186 	for (i = 0; i < ah->ah_gpio_npins && i < AR5K_MAX_GPIO; i++) {
3187 		sc->sc_gpio_pins[i].pin_num = i;
3188 		sc->sc_gpio_pins[i].pin_caps = GPIO_PIN_INPUT |
3189 		    GPIO_PIN_OUTPUT;
3190 
3191 		/* Set pin mode to input */
3192 		ath_hal_set_gpio_input(ah, i);
3193 		sc->sc_gpio_pins[i].pin_flags = GPIO_PIN_INPUT;
3194 
3195 		/* Get pin input */
3196 		sc->sc_gpio_pins[i].pin_state = ath_hal_get_gpio(ah, i) ?
3197 		    GPIO_PIN_HIGH : GPIO_PIN_LOW;
3198 	}
3199 
3200 	/* Enable GPIO-controlled software LED if available */
3201 	if ((ah->ah_version == AR5K_AR5211) ||
3202 	    (devid == PCI_PRODUCT_ATHEROS_AR5212_IBM)) {
3203 		sc->sc_softled = 1;
3204 		ath_hal_set_gpio_output(ah, AR5K_SOFTLED_PIN);
3205 		ath_hal_set_gpio(ah, AR5K_SOFTLED_PIN, AR5K_SOFTLED_OFF);
3206 	}
3207 
3208 	/* Create gpio controller tag */
3209 	sc->sc_gpio_gc.gp_cookie = sc;
3210 	sc->sc_gpio_gc.gp_pin_read = ath_gpio_pin_read;
3211 	sc->sc_gpio_gc.gp_pin_write = ath_gpio_pin_write;
3212 	sc->sc_gpio_gc.gp_pin_ctl = ath_gpio_pin_ctl;
3213 
3214 	gba.gba_name = "gpio";
3215 	gba.gba_gc = &sc->sc_gpio_gc;
3216 	gba.gba_pins = sc->sc_gpio_pins;
3217 	gba.gba_npins = ah->ah_gpio_npins;
3218 
3219 #ifdef notyet
3220 #if NGPIO > 0
3221 	if (config_found(&sc->sc_dev, &gba, gpiobus_print) == NULL)
3222 		return (ENODEV);
3223 #endif
3224 #endif
3225 
3226 	return (0);
3227 }
3228 
3229 int
3230 ath_gpio_pin_read(void *arg, int pin)
3231 {
3232 	struct ath_softc *sc = arg;
3233 	struct ath_hal *ah = sc->sc_ah;
3234 	return (ath_hal_get_gpio(ah, pin) ? GPIO_PIN_HIGH : GPIO_PIN_LOW);
3235 }
3236 
3237 void
3238 ath_gpio_pin_write(void *arg, int pin, int value)
3239 {
3240 	struct ath_softc *sc = arg;
3241 	struct ath_hal *ah = sc->sc_ah;
3242 	ath_hal_set_gpio(ah, pin, value ? GPIO_PIN_HIGH : GPIO_PIN_LOW);
3243 }
3244 
3245 void
3246 ath_gpio_pin_ctl(void *arg, int pin, int flags)
3247 {
3248 	struct ath_softc *sc = arg;
3249 	struct ath_hal *ah = sc->sc_ah;
3250 
3251 	if (flags & GPIO_PIN_INPUT) {
3252 		ath_hal_set_gpio_input(ah, pin);
3253 	} else if (flags & GPIO_PIN_OUTPUT) {
3254 		ath_hal_set_gpio_output(ah, pin);
3255 	}
3256 }
3257