xref: /freebsd/sys/dev/ath/if_ath.c (revision 0fa02ea5f786ef02befd46f8f083f48c8cd9630b)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  *
43  * This software is derived from work of Atsushi Onoe; his contribution
44  * is greatly appreciated.
45  */
46 
47 #include "opt_inet.h"
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysctl.h>
52 #include <sys/mbuf.h>
53 #include <sys/malloc.h>
54 #include <sys/lock.h>
55 #include <sys/mutex.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/errno.h>
60 #include <sys/callout.h>
61 #include <sys/bus.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #include <net/ethernet.h>
71 #include <net/if_llc.h>
72 
73 #include <net80211/ieee80211_var.h>
74 
75 #include <net/bpf.h>
76 
77 #ifdef INET
78 #include <netinet/in.h>
79 #include <netinet/if_ether.h>
80 #endif
81 
82 #define	AR_DEBUG
83 #include <dev/ath/if_athvar.h>
84 #include <contrib/dev/ath/ah_desc.h>
85 
86 /* unalligned little endian access */
87 #define LE_READ_2(p)							\
88 	((u_int16_t)							\
89 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
90 #define LE_READ_4(p)							\
91 	((u_int32_t)							\
92 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
93 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
94 
95 static void	ath_init(void *);
96 static void	ath_stop(struct ifnet *);
97 static void	ath_start(struct ifnet *);
98 static void	ath_reset(struct ath_softc *);
99 static int	ath_media_change(struct ifnet *);
100 static void	ath_watchdog(struct ifnet *);
101 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
102 static void	ath_fatal_proc(void *, int);
103 static void	ath_rxorn_proc(void *, int);
104 static void	ath_bmiss_proc(void *, int);
105 static void	ath_initkeytable(struct ath_softc *);
106 static void	ath_mode_init(struct ath_softc *);
107 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
108 static void	ath_beacon_proc(void *, int);
109 static void	ath_beacon_free(struct ath_softc *);
110 static void	ath_beacon_config(struct ath_softc *);
111 static int	ath_desc_alloc(struct ath_softc *);
112 static void	ath_desc_free(struct ath_softc *);
113 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
114 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
115 static void	ath_node_copy(struct ieee80211com *,
116 			struct ieee80211_node *, const struct ieee80211_node *);
117 static u_int8_t	ath_node_getrssi(struct ieee80211com *,
118 			struct ieee80211_node *);
119 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
120 static void	ath_rx_proc(void *, int);
121 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
122 			     struct ath_buf *, struct mbuf *);
123 static void	ath_tx_proc(void *, int);
124 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
125 static void	ath_draintxq(struct ath_softc *);
126 static void	ath_stoprecv(struct ath_softc *);
127 static int	ath_startrecv(struct ath_softc *);
128 static void	ath_next_scan(void *);
129 static void	ath_calibrate(void *);
130 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
131 static void	ath_newassoc(struct ieee80211com *,
132 			struct ieee80211_node *, int);
133 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
134 
135 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
136 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
137 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
138 static void	ath_rate_ctl(void *, struct ieee80211_node *);
139 
140 SYSCTL_DECL(_hw_ath);
141 
142 /* XXX validate sysctl values */
143 static	int ath_dwelltime = 200;		/* 5 channels/second */
144 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
145 	    0, "channel dwell time (ms) for AP/station scanning");
146 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
147 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
148 	    0, "chip calibration interval (secs)");
149 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
150 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
151 	    0, "enable/disable outdoor operation");
152 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
153 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
154 	    0, "country code");
155 static	int ath_regdomain = 0;			/* regulatory domain */
156 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
157 	    0, "regulatory domain");
158 
159 #ifdef AR_DEBUG
160 int	ath_debug = 0;
161 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
162 	    0, "control debugging printfs");
163 #define	IFF_DUMPPKTS(_ifp) \
164 	(ath_debug || \
165 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
166 static	void ath_printrxbuf(struct ath_buf *bf, int);
167 static	void ath_printtxbuf(struct ath_buf *bf, int);
168 #define	DPRINTF(X)	if (ath_debug) printf X
169 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
170 #else
171 #define	IFF_DUMPPKTS(_ifp) \
172 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
173 #define	DPRINTF(X)
174 #define	DPRINTF2(X)
175 #endif
176 
177 int
178 ath_attach(u_int16_t devid, struct ath_softc *sc)
179 {
180 	struct ieee80211com *ic = &sc->sc_ic;
181 	struct ifnet *ifp = &ic->ic_if;
182 	struct ath_hal *ah;
183 	HAL_STATUS status;
184 	int error = 0;
185 
186 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
187 
188 	/* set these up early for if_printf use */
189 	if_initname(ifp, device_get_name(sc->sc_dev),
190 	    device_get_unit(sc->sc_dev));
191 
192 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
193 	if (ah == NULL) {
194 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
195 			status);
196 		error = ENXIO;
197 		goto bad;
198 	}
199 	if (ah->ah_abi != HAL_ABI_VERSION) {
200 		if_printf(ifp, "HAL ABI mismatch detected (0x%x != 0x%x)\n",
201 			ah->ah_abi, HAL_ABI_VERSION);
202 		error = ENXIO;
203 		goto bad;
204 	}
205 	if_printf(ifp, "mac %d.%d phy %d.%d",
206 		ah->ah_macVersion, ah->ah_macRev,
207 		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
208 	if (ah->ah_analog5GhzRev)
209 		printf(" 5ghz radio %d.%d",
210 			ah->ah_analog5GhzRev >> 4, ah->ah_analog5GhzRev & 0xf);
211 	if (ah->ah_analog2GhzRev)
212 		printf(" 2ghz radio %d.%d",
213 			ah->ah_analog2GhzRev >> 4, ah->ah_analog2GhzRev & 0xf);
214 	printf("\n");
215 	sc->sc_ah = ah;
216 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
217 
218 	/*
219 	 * Collect the channel list using the default country
220 	 * code and including outdoor channels.  The 802.11 layer
221 	 * is resposible for filtering this list based on settings
222 	 * like the phy mode.
223 	 */
224 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
225 	if (error != 0)
226 		goto bad;
227 	/*
228 	 * Copy these back; they are set as a side effect
229 	 * of constructing the channel list.
230 	 */
231 	ath_regdomain = ath_hal_getregdomain(ah);
232 	ath_countrycode = ath_hal_getcountrycode(ah);
233 
234 	/*
235 	 * Setup rate tables for all potential media types.
236 	 */
237 	ath_rate_setup(sc, IEEE80211_MODE_11A);
238 	ath_rate_setup(sc, IEEE80211_MODE_11B);
239 	ath_rate_setup(sc, IEEE80211_MODE_11G);
240 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
241 
242 	error = ath_desc_alloc(sc);
243 	if (error != 0) {
244 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
245 		goto bad;
246 	}
247 	callout_init(&sc->sc_scan_ch, CALLOUT_MPSAFE);
248 	callout_init(&sc->sc_cal_ch, CALLOUT_MPSAFE);
249 
250 	ATH_TXBUF_LOCK_INIT(sc);
251 	ATH_TXQ_LOCK_INIT(sc);
252 
253 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
254 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
255 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
256 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
257 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
258 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
259 
260 	/*
261 	 * For now just pre-allocate one data queue and one
262 	 * beacon queue.  Note that the HAL handles resetting
263 	 * them at the needed time.  Eventually we'll want to
264 	 * allocate more tx queues for splitting management
265 	 * frames and for QOS support.
266 	 */
267 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
268 		HAL_TX_QUEUE_DATA,
269 		AH_TRUE			/* enable interrupts */
270 	);
271 	if (sc->sc_txhalq == (u_int) -1) {
272 		if_printf(ifp, "unable to setup a data xmit queue!\n");
273 		goto bad;
274 	}
275 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
276 		HAL_TX_QUEUE_BEACON,
277 		AH_TRUE			/* enable interrupts */
278 	);
279 	if (sc->sc_bhalq == (u_int) -1) {
280 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
281 		goto bad;
282 	}
283 
284 	ifp->if_softc = sc;
285 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
286 	ifp->if_start = ath_start;
287 	ifp->if_watchdog = ath_watchdog;
288 	ifp->if_ioctl = ath_ioctl;
289 	ifp->if_init = ath_init;
290 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
291 
292 	ic->ic_softc = sc;
293 	ic->ic_newassoc = ath_newassoc;
294 	/* XXX not right but it's not used anywhere important */
295 	ic->ic_phytype = IEEE80211_T_OFDM;
296 	ic->ic_opmode = IEEE80211_M_STA;
297 	ic->ic_caps = IEEE80211_C_WEP		/* wep supported */
298 		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
299 		| IEEE80211_C_HOSTAP		/* hostap mode */
300 		| IEEE80211_C_MONITOR		/* monitor mode */
301 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
302 		| IEEE80211_C_RCVMGT;		/* recv management frames */
303 
304 	/* get mac address from hardware */
305 	ath_hal_getmac(ah, ic->ic_myaddr);
306 
307 	/* call MI attach routine. */
308 	ieee80211_ifattach(ifp);
309 	/* override default methods */
310 	ic->ic_node_alloc = ath_node_alloc;
311 	ic->ic_node_free = ath_node_free;
312 	ic->ic_node_copy = ath_node_copy;
313 	ic->ic_node_getrssi = ath_node_getrssi;
314 	sc->sc_newstate = ic->ic_newstate;
315 	ic->ic_newstate = ath_newstate;
316 	/* complete initialization */
317 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
318 
319 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
320 		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
321 		&sc->sc_drvbpf);
322 	/*
323 	 * Initialize constant fields.
324 	 *
325 	 * NB: the channel is setup each time we transition to the
326 	 *     RUN state to avoid filling it in for each frame.
327 	 */
328 	sc->sc_tx_th.wt_ihdr.it_len = sizeof(sc->sc_tx_th);
329 	sc->sc_tx_th.wt_ihdr.it_present = ATH_TX_RADIOTAP_PRESENT;
330 
331 	sc->sc_rx_th.wr_ihdr.it_len = sizeof(sc->sc_rx_th);
332 	sc->sc_rx_th.wr_ihdr.it_present = ATH_RX_RADIOTAP_PRESENT;
333 
334 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
335 
336 	return 0;
337 bad:
338 	if (ah)
339 		ath_hal_detach(ah);
340 	sc->sc_invalid = 1;
341 	return error;
342 }
343 
344 int
345 ath_detach(struct ath_softc *sc)
346 {
347 	struct ifnet *ifp = &sc->sc_ic.ic_if;
348 
349 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
350 
351 	ath_stop(ifp);
352 	bpfdetach(ifp);
353 	ath_desc_free(sc);
354 	ath_hal_detach(sc->sc_ah);
355 	ieee80211_ifdetach(ifp);
356 
357 	ATH_TXBUF_LOCK_DESTROY(sc);
358 	ATH_TXQ_LOCK_DESTROY(sc);
359 
360 	return 0;
361 }
362 
363 void
364 ath_suspend(struct ath_softc *sc)
365 {
366 	struct ifnet *ifp = &sc->sc_ic.ic_if;
367 
368 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
369 
370 	ath_stop(ifp);
371 }
372 
373 void
374 ath_resume(struct ath_softc *sc)
375 {
376 	struct ifnet *ifp = &sc->sc_ic.ic_if;
377 
378 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
379 
380 	if (ifp->if_flags & IFF_UP) {
381 		ath_init(ifp);
382 		if (ifp->if_flags & IFF_RUNNING)
383 			ath_start(ifp);
384 	}
385 }
386 
387 void
388 ath_shutdown(struct ath_softc *sc)
389 {
390 	struct ifnet *ifp = &sc->sc_ic.ic_if;
391 
392 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
393 
394 	ath_stop(ifp);
395 }
396 
397 void
398 ath_intr(void *arg)
399 {
400 	struct ath_softc *sc = arg;
401 	struct ieee80211com *ic = &sc->sc_ic;
402 	struct ifnet *ifp = &ic->ic_if;
403 	struct ath_hal *ah = sc->sc_ah;
404 	HAL_INT status;
405 
406 	if (sc->sc_invalid) {
407 		/*
408 		 * The hardware is not ready/present, don't touch anything.
409 		 * Note this can happen early on if the IRQ is shared.
410 		 */
411 		DPRINTF(("ath_intr: invalid; ignored\n"));
412 		return;
413 	}
414 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
415 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
416 		ath_hal_getisr(ah, &status);	/* clear ISR */
417 		ath_hal_intrset(ah, 0);		/* disable further intr's */
418 		return;
419 	}
420 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
421 	DPRINTF2(("ath_intr: status 0x%x\n", status));
422 #ifdef AR_DEBUG
423 	if (ath_debug &&
424 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
425 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
426 		ath_hal_dumpstate(ah);
427 	}
428 #endif /* AR_DEBUG */
429 	status &= sc->sc_imask;			/* discard unasked for bits */
430 	if (status & HAL_INT_FATAL) {
431 		sc->sc_stats.ast_hardware++;
432 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
433 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
434 	} else if (status & HAL_INT_RXORN) {
435 		sc->sc_stats.ast_rxorn++;
436 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
437 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
438 	} else {
439 		if (status & HAL_INT_RXEOL) {
440 			/*
441 			 * NB: the hardware should re-read the link when
442 			 *     RXE bit is written, but it doesn't work at
443 			 *     least on older hardware revs.
444 			 */
445 			sc->sc_stats.ast_rxeol++;
446 			sc->sc_rxlink = NULL;
447 		}
448 		if (status & HAL_INT_TXURN) {
449 			sc->sc_stats.ast_txurn++;
450 			/* bump tx trigger level */
451 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
452 		}
453 		if (status & HAL_INT_RX)
454 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
455 		if (status & HAL_INT_TX)
456 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
457 		if (status & HAL_INT_SWBA)
458 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
459 		if (status & HAL_INT_BMISS) {
460 			sc->sc_stats.ast_bmiss++;
461 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
462 		}
463 	}
464 }
465 
466 static void
467 ath_fatal_proc(void *arg, int pending)
468 {
469 	struct ath_softc *sc = arg;
470 
471 	device_printf(sc->sc_dev, "hardware error; resetting\n");
472 	ath_reset(sc);
473 }
474 
475 static void
476 ath_rxorn_proc(void *arg, int pending)
477 {
478 	struct ath_softc *sc = arg;
479 
480 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
481 	ath_reset(sc);
482 }
483 
484 static void
485 ath_bmiss_proc(void *arg, int pending)
486 {
487 	struct ath_softc *sc = arg;
488 	struct ieee80211com *ic = &sc->sc_ic;
489 
490 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
491 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
492 		("unexpect operating mode %u", ic->ic_opmode));
493 	if (ic->ic_state == IEEE80211_S_RUN) {
494 		/*
495 		 * Rather than go directly to scan state, try to
496 		 * reassociate first.  If that fails then the state
497 		 * machine will drop us into scanning after timing
498 		 * out waiting for a probe response.
499 		 */
500 		ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
501 	}
502 }
503 
504 static u_int
505 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
506 {
507 	static const u_int modeflags[] = {
508 		0,			/* IEEE80211_MODE_AUTO */
509 		CHANNEL_A,		/* IEEE80211_MODE_11A */
510 		CHANNEL_B,		/* IEEE80211_MODE_11B */
511 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
512 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
513 	};
514 	return modeflags[ieee80211_chan2mode(ic, chan)];
515 }
516 
517 static void
518 ath_init(void *arg)
519 {
520 	struct ath_softc *sc = (struct ath_softc *) arg;
521 	struct ieee80211com *ic = &sc->sc_ic;
522 	struct ifnet *ifp = &ic->ic_if;
523 	struct ieee80211_node *ni;
524 	enum ieee80211_phymode mode;
525 	struct ath_hal *ah = sc->sc_ah;
526 	HAL_STATUS status;
527 	HAL_CHANNEL hchan;
528 
529 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
530 
531 	ATH_LOCK(sc);
532 	/*
533 	 * Stop anything previously setup.  This is safe
534 	 * whether this is the first time through or not.
535 	 */
536 	ath_stop(ifp);
537 
538 	/*
539 	 * The basic interface to setting the hardware in a good
540 	 * state is ``reset''.  On return the hardware is known to
541 	 * be powered up and with interrupts disabled.  This must
542 	 * be followed by initialization of the appropriate bits
543 	 * and then setup of the interrupt mask.
544 	 */
545 	hchan.channel = ic->ic_ibss_chan->ic_freq;
546 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
547 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
548 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
549 			status);
550 		goto done;
551 	}
552 
553 	/*
554 	 * Setup the hardware after reset: the key cache
555 	 * is filled as needed and the receive engine is
556 	 * set going.  Frame transmit is handled entirely
557 	 * in the frame output path; there's nothing to do
558 	 * here except setup the interrupt mask.
559 	 */
560 	if (ic->ic_flags & IEEE80211_F_WEPON)
561 		ath_initkeytable(sc);
562 	if (ath_startrecv(sc) != 0) {
563 		if_printf(ifp, "unable to start recv logic\n");
564 		goto done;
565 	}
566 
567 	/*
568 	 * Enable interrupts.
569 	 */
570 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
571 		  | HAL_INT_RXEOL | HAL_INT_RXORN
572 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
573 	ath_hal_intrset(ah, sc->sc_imask);
574 
575 	ifp->if_flags |= IFF_RUNNING;
576 	ic->ic_state = IEEE80211_S_INIT;
577 
578 	/*
579 	 * The hardware should be ready to go now so it's safe
580 	 * to kick the 802.11 state machine as it's likely to
581 	 * immediately call back to us to send mgmt frames.
582 	 */
583 	ni = ic->ic_bss;
584 	ni->ni_chan = ic->ic_ibss_chan;
585 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
586 	if (mode != sc->sc_curmode)
587 		ath_setcurmode(sc, mode);
588 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
589 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
590 	else
591 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
592 done:
593 	ATH_UNLOCK(sc);
594 }
595 
596 static void
597 ath_stop(struct ifnet *ifp)
598 {
599 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
600 	struct ath_softc *sc = ifp->if_softc;
601 	struct ath_hal *ah = sc->sc_ah;
602 
603 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
604 		sc->sc_invalid, ifp->if_flags));
605 
606 	ATH_LOCK(sc);
607 	if (ifp->if_flags & IFF_RUNNING) {
608 		/*
609 		 * Shutdown the hardware and driver:
610 		 *    disable interrupts
611 		 *    turn off timers
612 		 *    clear transmit machinery
613 		 *    clear receive machinery
614 		 *    drain and release tx queues
615 		 *    reclaim beacon resources
616 		 *    reset 802.11 state machine
617 		 *    power down hardware
618 		 *
619 		 * Note that some of this work is not possible if the
620 		 * hardware is gone (invalid).
621 		 */
622 		ifp->if_flags &= ~IFF_RUNNING;
623 		ifp->if_timer = 0;
624 		if (!sc->sc_invalid)
625 			ath_hal_intrset(ah, 0);
626 		ath_draintxq(sc);
627 		if (!sc->sc_invalid)
628 			ath_stoprecv(sc);
629 		else
630 			sc->sc_rxlink = NULL;
631 		IF_DRAIN(&ifp->if_snd);
632 		ath_beacon_free(sc);
633 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
634 		if (!sc->sc_invalid)
635 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
636 	}
637 	ATH_UNLOCK(sc);
638 }
639 
640 /*
641  * Reset the hardware w/o losing operational state.  This is
642  * basically a more efficient way of doing ath_stop, ath_init,
643  * followed by state transitions to the current 802.11
644  * operational state.  Used to recover from errors rx overrun
645  * and to reset the hardware when rf gain settings must be reset.
646  */
647 static void
648 ath_reset(struct ath_softc *sc)
649 {
650 	struct ieee80211com *ic = &sc->sc_ic;
651 	struct ifnet *ifp = &ic->ic_if;
652 	struct ath_hal *ah = sc->sc_ah;
653 	struct ieee80211_channel *c;
654 	HAL_STATUS status;
655 	HAL_CHANNEL hchan;
656 
657 	/*
658 	 * Convert to a HAL channel description with the flags
659 	 * constrained to reflect the current operating mode.
660 	 */
661 	c = ic->ic_ibss_chan;
662 	hchan.channel = c->ic_freq;
663 	hchan.channelFlags = ath_chan2flags(ic, c);
664 
665 	ath_hal_intrset(ah, 0);		/* disable interrupts */
666 	ath_draintxq(sc);		/* stop xmit side */
667 	ath_stoprecv(sc);		/* stop recv side */
668 	/* NB: indicate channel change so we do a full reset */
669 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
670 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
671 			__func__, status);
672 	ath_hal_intrset(ah, sc->sc_imask);
673 	if (ath_startrecv(sc) != 0)	/* restart recv */
674 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
675 	ath_start(ifp);			/* restart xmit */
676 	if (ic->ic_state == IEEE80211_S_RUN)
677 		ath_beacon_config(sc);	/* restart beacons */
678 }
679 
680 static void
681 ath_start(struct ifnet *ifp)
682 {
683 	struct ath_softc *sc = ifp->if_softc;
684 	struct ath_hal *ah = sc->sc_ah;
685 	struct ieee80211com *ic = &sc->sc_ic;
686 	struct ieee80211_node *ni;
687 	struct ath_buf *bf;
688 	struct mbuf *m;
689 	struct ieee80211_frame *wh;
690 
691 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
692 		return;
693 	for (;;) {
694 		/*
695 		 * Grab a TX buffer and associated resources.
696 		 */
697 		ATH_TXBUF_LOCK(sc);
698 		bf = TAILQ_FIRST(&sc->sc_txbuf);
699 		if (bf != NULL)
700 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
701 		ATH_TXBUF_UNLOCK(sc);
702 		if (bf == NULL) {
703 			DPRINTF(("ath_start: out of xmit buffers\n"));
704 			sc->sc_stats.ast_tx_qstop++;
705 			ifp->if_flags |= IFF_OACTIVE;
706 			break;
707 		}
708 		/*
709 		 * Poll the management queue for frames; they
710 		 * have priority over normal data frames.
711 		 */
712 		IF_DEQUEUE(&ic->ic_mgtq, m);
713 		if (m == NULL) {
714 			/*
715 			 * No data frames go out unless we're associated.
716 			 */
717 			if (ic->ic_state != IEEE80211_S_RUN) {
718 				DPRINTF(("ath_start: ignore data packet, "
719 					"state %u\n", ic->ic_state));
720 				sc->sc_stats.ast_tx_discard++;
721 				ATH_TXBUF_LOCK(sc);
722 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
723 				ATH_TXBUF_UNLOCK(sc);
724 				break;
725 			}
726 			IF_DEQUEUE(&ifp->if_snd, m);
727 			if (m == NULL) {
728 				ATH_TXBUF_LOCK(sc);
729 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
730 				ATH_TXBUF_UNLOCK(sc);
731 				break;
732 			}
733 			ifp->if_opackets++;
734 			BPF_MTAP(ifp, m);
735 			/*
736 			 * Encapsulate the packet in prep for transmission.
737 			 */
738 			m = ieee80211_encap(ifp, m, &ni);
739 			if (m == NULL) {
740 				DPRINTF(("ath_start: encapsulation failure\n"));
741 				sc->sc_stats.ast_tx_encap++;
742 				goto bad;
743 			}
744 			wh = mtod(m, struct ieee80211_frame *);
745 			if (ic->ic_flags & IEEE80211_F_WEPON)
746 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
747 		} else {
748 			/*
749 			 * Hack!  The referenced node pointer is in the
750 			 * rcvif field of the packet header.  This is
751 			 * placed there by ieee80211_mgmt_output because
752 			 * we need to hold the reference with the frame
753 			 * and there's no other way (other than packet
754 			 * tags which we consider too expensive to use)
755 			 * to pass it along.
756 			 */
757 			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
758 			m->m_pkthdr.rcvif = NULL;
759 
760 			wh = mtod(m, struct ieee80211_frame *);
761 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
762 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
763 				/* fill time stamp */
764 				u_int64_t tsf;
765 				u_int32_t *tstamp;
766 
767 				tsf = ath_hal_gettsf64(ah);
768 				/* XXX: adjust 100us delay to xmit */
769 				tsf += 100;
770 				tstamp = (u_int32_t *)&wh[1];
771 				tstamp[0] = htole32(tsf & 0xffffffff);
772 				tstamp[1] = htole32(tsf >> 32);
773 			}
774 			sc->sc_stats.ast_tx_mgmt++;
775 		}
776 		if (ic->ic_rawbpf)
777 			bpf_mtap(ic->ic_rawbpf, m);
778 
779 		if (sc->sc_drvbpf) {
780 			struct mbuf *mb;
781 
782 			MGETHDR(mb, M_DONTWAIT, m->m_type);
783 			if (mb != NULL) {
784 				sc->sc_tx_th.wt_rate =
785 					ni->ni_rates.rs_rates[ni->ni_txrate];
786 
787 				mb->m_next = m;
788 				mb->m_data = (caddr_t)&sc->sc_tx_th;
789 				mb->m_len = sizeof(sc->sc_tx_th);
790 				mb->m_pkthdr.len += mb->m_len;
791 				bpf_mtap(sc->sc_drvbpf, mb);
792 				m_free(mb);
793 			}
794 		}
795 
796 		if (ath_tx_start(sc, ni, bf, m)) {
797 	bad:
798 			ATH_TXBUF_LOCK(sc);
799 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
800 			ATH_TXBUF_UNLOCK(sc);
801 			ifp->if_oerrors++;
802 			if (ni && ni != ic->ic_bss)
803 				ieee80211_free_node(ic, ni);
804 			continue;
805 		}
806 
807 		sc->sc_tx_timer = 5;
808 		ifp->if_timer = 1;
809 	}
810 }
811 
812 static int
813 ath_media_change(struct ifnet *ifp)
814 {
815 	int error;
816 
817 	error = ieee80211_media_change(ifp);
818 	if (error == ENETRESET) {
819 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
820 		    (IFF_RUNNING|IFF_UP))
821 			ath_init(ifp);		/* XXX lose error */
822 		error = 0;
823 	}
824 	return error;
825 }
826 
827 static void
828 ath_watchdog(struct ifnet *ifp)
829 {
830 	struct ath_softc *sc = ifp->if_softc;
831 	struct ieee80211com *ic = &sc->sc_ic;
832 
833 	ifp->if_timer = 0;
834 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
835 		return;
836 	if (sc->sc_tx_timer) {
837 		if (--sc->sc_tx_timer == 0) {
838 			if_printf(ifp, "device timeout\n");
839 #ifdef AR_DEBUG
840 			if (ath_debug)
841 				ath_hal_dumpstate(sc->sc_ah);
842 #endif /* AR_DEBUG */
843 			ath_init(ifp);		/* XXX ath_reset??? */
844 			ifp->if_oerrors++;
845 			sc->sc_stats.ast_watchdog++;
846 			return;
847 		}
848 		ifp->if_timer = 1;
849 	}
850 	if (ic->ic_fixed_rate == -1) {
851 		/*
852 		 * Run the rate control algorithm if we're not
853 		 * locked at a fixed rate.
854 		 */
855 		if (ic->ic_opmode == IEEE80211_M_STA)
856 			ath_rate_ctl(sc, ic->ic_bss);
857 		else
858 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
859 	}
860 	ieee80211_watchdog(ifp);
861 }
862 
863 static int
864 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
865 {
866 	struct ath_softc *sc = ifp->if_softc;
867 	struct ifreq *ifr = (struct ifreq *)data;
868 	int error = 0;
869 
870 	ATH_LOCK(sc);
871 	switch (cmd) {
872 	case SIOCSIFFLAGS:
873 		if (ifp->if_flags & IFF_UP) {
874 			if (ifp->if_flags & IFF_RUNNING) {
875 				/*
876 				 * To avoid rescanning another access point,
877 				 * do not call ath_init() here.  Instead,
878 				 * only reflect promisc mode settings.
879 				 */
880 				ath_mode_init(sc);
881 			} else {
882 				/*
883 				 * Beware of being called during detach to
884 				 * reset promiscuous mode.  In that case we
885 				 * will still be marked UP but not RUNNING.
886 				 * However trying to re-init the interface
887 				 * is the wrong thing to do as we've already
888 				 * torn down much of our state.  There's
889 				 * probably a better way to deal with this.
890 				 */
891 				if (!sc->sc_invalid)
892 					ath_init(ifp);	/* XXX lose error */
893 			}
894 		} else
895 			ath_stop(ifp);
896 		break;
897 	case SIOCADDMULTI:
898 	case SIOCDELMULTI:
899 		/*
900 		 * The upper layer has already installed/removed
901 		 * the multicast address(es), just recalculate the
902 		 * multicast filter for the card.
903 		 */
904 		if (ifp->if_flags & IFF_RUNNING)
905 			ath_mode_init(sc);
906 		break;
907 	case SIOCGATHSTATS:
908 		error = copyout(&sc->sc_stats,
909 				ifr->ifr_data, sizeof (sc->sc_stats));
910 		break;
911 	case SIOCGATHDIAG: {
912 		struct ath_diag *ad = (struct ath_diag *)data;
913 		struct ath_hal *ah = sc->sc_ah;
914 		void *data;
915 		u_int size;
916 
917 		if (ath_hal_getdiagstate(ah, ad->ad_id, &data, &size)) {
918 			if (size < ad->ad_size)
919 				ad->ad_size = size;
920 			if (data)
921 				error = copyout(data, ad->ad_data, ad->ad_size);
922 		} else
923 			error = EINVAL;
924 		break;
925 	}
926 	default:
927 		error = ieee80211_ioctl(ifp, cmd, data);
928 		if (error == ENETRESET) {
929 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
930 			    (IFF_RUNNING|IFF_UP))
931 				ath_init(ifp);		/* XXX lose error */
932 			error = 0;
933 		}
934 		break;
935 	}
936 	ATH_UNLOCK(sc);
937 	return error;
938 }
939 
940 /*
941  * Fill the hardware key cache with key entries.
942  */
943 static void
944 ath_initkeytable(struct ath_softc *sc)
945 {
946 	struct ieee80211com *ic = &sc->sc_ic;
947 	struct ath_hal *ah = sc->sc_ah;
948 	int i;
949 
950 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
951 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
952 		if (k->wk_len == 0)
953 			ath_hal_keyreset(ah, i);
954 		else
955 			/* XXX return value */
956 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
957 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
958 	}
959 }
960 
961 /*
962  * Calculate the receive filter according to the
963  * operating mode and state:
964  *
965  * o always accept unicast, broadcast, and multicast traffic
966  * o maintain current state of phy error reception
967  * o probe request frames are accepted only when operating in
968  *   hostap, adhoc, or monitor modes
969  * o enable promiscuous mode according to the interface state
970  * o accept beacons:
971  *   - when operating in adhoc mode so the 802.11 layer creates
972  *     node table entries for peers,
973  *   - when operating in station mode for collecting rssi data when
974  *     the station is otherwise quiet, or
975  *   - when scanning
976  */
977 static u_int32_t
978 ath_calcrxfilter(struct ath_softc *sc)
979 {
980 	struct ieee80211com *ic = &sc->sc_ic;
981 	struct ath_hal *ah = sc->sc_ah;
982 	struct ifnet *ifp = &ic->ic_if;
983 	u_int32_t rfilt;
984 
985 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
986 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
987 	if (ic->ic_opmode != IEEE80211_M_STA)
988 		rfilt |= HAL_RX_FILTER_PROBEREQ;
989 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
990 	    (ifp->if_flags & IFF_PROMISC))
991 		rfilt |= HAL_RX_FILTER_PROM;
992 	if (ic->ic_opmode == IEEE80211_M_STA ||
993 	    ic->ic_opmode == IEEE80211_M_IBSS ||
994 	    ic->ic_state == IEEE80211_S_SCAN)
995 		rfilt |= HAL_RX_FILTER_BEACON;
996 	return rfilt;
997 }
998 
999 static void
1000 ath_mode_init(struct ath_softc *sc)
1001 {
1002 	struct ieee80211com *ic = &sc->sc_ic;
1003 	struct ath_hal *ah = sc->sc_ah;
1004 	struct ifnet *ifp = &ic->ic_if;
1005 	u_int32_t rfilt, mfilt[2], val;
1006 	u_int8_t pos;
1007 	struct ifmultiaddr *ifma;
1008 
1009 	/* configure rx filter */
1010 	rfilt = ath_calcrxfilter(sc);
1011 	ath_hal_setrxfilter(ah, rfilt);
1012 
1013 	/* configure operational mode */
1014 	ath_hal_setopmode(ah, ic->ic_opmode);
1015 
1016 	/* calculate and install multicast filter */
1017 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
1018 		mfilt[0] = mfilt[1] = 0;
1019 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
1020 			caddr_t dl;
1021 
1022 			/* calculate XOR of eight 6bit values */
1023 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
1024 			val = LE_READ_4(dl + 0);
1025 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1026 			val = LE_READ_4(dl + 3);
1027 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
1028 			pos &= 0x3f;
1029 			mfilt[pos / 32] |= (1 << (pos % 32));
1030 		}
1031 	} else {
1032 		mfilt[0] = mfilt[1] = ~0;
1033 	}
1034 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
1035 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
1036 		rfilt, mfilt[0], mfilt[1]));
1037 }
1038 
1039 static void
1040 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
1041 {
1042 	struct ath_buf *bf = arg;
1043 
1044 	KASSERT(nseg <= ATH_MAX_SCATTER,
1045 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
1046 	bf->bf_mapsize = mapsize;
1047 	bf->bf_nseg = nseg;
1048 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
1049 }
1050 
1051 static int
1052 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
1053 {
1054 	struct ieee80211com *ic = &sc->sc_ic;
1055 	struct ifnet *ifp = &ic->ic_if;
1056 	struct ath_hal *ah = sc->sc_ah;
1057 	struct ieee80211_frame *wh;
1058 	struct ath_buf *bf;
1059 	struct ath_desc *ds;
1060 	struct mbuf *m;
1061 	int error, pktlen;
1062 	u_int8_t *frm, rate;
1063 	u_int16_t capinfo;
1064 	struct ieee80211_rateset *rs;
1065 	const HAL_RATE_TABLE *rt;
1066 
1067 	bf = sc->sc_bcbuf;
1068 	if (bf->bf_m != NULL) {
1069 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1070 		m_freem(bf->bf_m);
1071 		bf->bf_m = NULL;
1072 		bf->bf_node = NULL;
1073 	}
1074 	/*
1075 	 * NB: the beacon data buffer must be 32-bit aligned;
1076 	 * we assume the mbuf routines will return us something
1077 	 * with this alignment (perhaps should assert).
1078 	 */
1079 	rs = &ni->ni_rates;
1080 	pktlen = sizeof (struct ieee80211_frame)
1081 	       + 8 + 2 + 2 + 2+ni->ni_esslen + 2+rs->rs_nrates + 3 + 6;
1082 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
1083 		pktlen += 2;
1084 	if (pktlen <= MHLEN)
1085 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1086 	else
1087 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1088 	if (m == NULL) {
1089 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
1090 			pktlen));
1091 		sc->sc_stats.ast_be_nombuf++;
1092 		return ENOMEM;
1093 	}
1094 
1095 	wh = mtod(m, struct ieee80211_frame *);
1096 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1097 	    IEEE80211_FC0_SUBTYPE_BEACON;
1098 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1099 	*(u_int16_t *)wh->i_dur = 0;
1100 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
1101 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1102 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1103 	*(u_int16_t *)wh->i_seq = 0;
1104 
1105 	/*
1106 	 * beacon frame format
1107 	 *	[8] time stamp
1108 	 *	[2] beacon interval
1109 	 *	[2] cabability information
1110 	 *	[tlv] ssid
1111 	 *	[tlv] supported rates
1112 	 *	[tlv] parameter set (IBSS)
1113 	 *	[tlv] extended supported rates
1114 	 */
1115 	frm = (u_int8_t *)&wh[1];
1116 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1117 	frm += 8;
1118 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1119 	frm += 2;
1120 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1121 		capinfo = IEEE80211_CAPINFO_IBSS;
1122 	else
1123 		capinfo = IEEE80211_CAPINFO_ESS;
1124 	if (ic->ic_flags & IEEE80211_F_WEPON)
1125 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1126 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1127 	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
1128 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1129 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1130 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1131 	*(u_int16_t *)frm = htole16(capinfo);
1132 	frm += 2;
1133 	*frm++ = IEEE80211_ELEMID_SSID;
1134 	*frm++ = ni->ni_esslen;
1135 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1136 	frm += ni->ni_esslen;
1137 	frm = ieee80211_add_rates(frm, rs);
1138 	*frm++ = IEEE80211_ELEMID_DSPARMS;
1139 	*frm++ = 1;
1140 	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
1141 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1142 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1143 		*frm++ = 2;
1144 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1145 	} else {
1146 		/* TODO: TIM */
1147 		*frm++ = IEEE80211_ELEMID_TIM;
1148 		*frm++ = 4;	/* length */
1149 		*frm++ = 0;	/* DTIM count */
1150 		*frm++ = 1;	/* DTIM period */
1151 		*frm++ = 0;	/* bitmap control */
1152 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1153 	}
1154 	frm = ieee80211_add_xrates(frm, rs);
1155 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1156 	KASSERT(m->m_pkthdr.len <= pktlen,
1157 		("beacon bigger than expected, len %u calculated %u",
1158 		m->m_pkthdr.len, pktlen));
1159 
1160 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1161 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1162 				     ath_mbuf_load_cb, bf,
1163 				     BUS_DMA_NOWAIT);
1164 	if (error != 0) {
1165 		m_freem(m);
1166 		return error;
1167 	}
1168 	KASSERT(bf->bf_nseg == 1,
1169 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1170 		bf->bf_nseg));
1171 	bf->bf_m = m;
1172 
1173 	/* setup descriptors */
1174 	ds = bf->bf_desc;
1175 
1176 	ds->ds_link = 0;
1177 	ds->ds_data = bf->bf_segs[0].ds_addr;
1178 	/*
1179 	 * Calculate rate code.
1180 	 * XXX everything at min xmit rate
1181 	 */
1182 	rt = sc->sc_currates;
1183 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1184 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1185 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1186 	else
1187 		rate = rt->info[0].rateCode;
1188 	ath_hal_setuptxdesc(ah, ds
1189 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1190 		, sizeof(struct ieee80211_frame)	/* header length */
1191 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1192 		, 0x20				/* txpower XXX */
1193 		, rate, 1			/* series 0 rate/tries */
1194 		, HAL_TXKEYIX_INVALID		/* no encryption */
1195 		, 0				/* antenna mode */
1196 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1197 		, 0				/* rts/cts rate */
1198 		, 0				/* rts/cts duration */
1199 	);
1200 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1201 	/* XXX verify mbuf data area covers this roundup */
1202 	ath_hal_filltxdesc(ah, ds
1203 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1204 		, AH_TRUE				/* first segment */
1205 		, AH_TRUE				/* last segment */
1206 	);
1207 
1208 	return 0;
1209 }
1210 
1211 static void
1212 ath_beacon_proc(void *arg, int pending)
1213 {
1214 	struct ath_softc *sc = arg;
1215 	struct ieee80211com *ic = &sc->sc_ic;
1216 	struct ath_buf *bf = sc->sc_bcbuf;
1217 	struct ath_hal *ah = sc->sc_ah;
1218 
1219 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1220 	if (ic->ic_opmode == IEEE80211_M_STA ||
1221 	    bf == NULL || bf->bf_m == NULL) {
1222 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1223 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1224 		return;
1225 	}
1226 	/* TODO: update beacon to reflect PS poll state */
1227 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1228 		DPRINTF(("%s: beacon queue %u did not stop?",
1229 			__func__, sc->sc_bhalq));
1230 		return;			/* busy, XXX is this right? */
1231 	}
1232 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1233 
1234 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1235 	ath_hal_txstart(ah, sc->sc_bhalq);
1236 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1237 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1238 }
1239 
1240 static void
1241 ath_beacon_free(struct ath_softc *sc)
1242 {
1243 	struct ath_buf *bf = sc->sc_bcbuf;
1244 
1245 	if (bf->bf_m != NULL) {
1246 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1247 		m_freem(bf->bf_m);
1248 		bf->bf_m = NULL;
1249 		bf->bf_node = NULL;
1250 	}
1251 }
1252 
1253 /*
1254  * Configure the beacon and sleep timers.
1255  *
1256  * When operating as an AP this resets the TSF and sets
1257  * up the hardware to notify us when we need to issue beacons.
1258  *
1259  * When operating in station mode this sets up the beacon
1260  * timers according to the timestamp of the last received
1261  * beacon and the current TSF, configures PCF and DTIM
1262  * handling, programs the sleep registers so the hardware
1263  * will wakeup in time to receive beacons, and configures
1264  * the beacon miss handling so we'll receive a BMISS
1265  * interrupt when we stop seeing beacons from the AP
1266  * we've associated with.
1267  */
1268 static void
1269 ath_beacon_config(struct ath_softc *sc)
1270 {
1271 	struct ath_hal *ah = sc->sc_ah;
1272 	struct ieee80211com *ic = &sc->sc_ic;
1273 	struct ieee80211_node *ni = ic->ic_bss;
1274 	u_int32_t nexttbtt;
1275 
1276 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1277 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1278 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1279 	nexttbtt += ni->ni_intval;
1280 	if (ic->ic_opmode == IEEE80211_M_STA) {
1281 		HAL_BEACON_STATE bs;
1282 		u_int32_t bmisstime;
1283 
1284 		/* NB: no PCF support right now */
1285 		memset(&bs, 0, sizeof(bs));
1286 		bs.bs_intval = ni->ni_intval;
1287 		bs.bs_nexttbtt = nexttbtt;
1288 		bs.bs_dtimperiod = bs.bs_intval;
1289 		bs.bs_nextdtim = nexttbtt;
1290 		/*
1291 		 * Calculate the number of consecutive beacons to miss
1292 		 * before taking a BMISS interrupt.  The configuration
1293 		 * is specified in ms, so we need to convert that to
1294 		 * TU's and then calculate based on the beacon interval.
1295 		 * Note that we clamp the result to at most 10 beacons.
1296 		 */
1297 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1298 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1299 		if (bs.bs_bmissthreshold > 10)
1300 			bs.bs_bmissthreshold = 10;
1301 		else if (bs.bs_bmissthreshold <= 0)
1302 			bs.bs_bmissthreshold = 1;
1303 
1304 		/*
1305 		 * Calculate sleep duration.  The configuration is
1306 		 * given in ms.  We insure a multiple of the beacon
1307 		 * period is used.  Also, if the sleep duration is
1308 		 * greater than the DTIM period then it makes senses
1309 		 * to make it a multiple of that.
1310 		 *
1311 		 * XXX fixed at 100ms
1312 		 */
1313 		bs.bs_sleepduration =
1314 			roundup((100 * 1000) / 1024, bs.bs_intval);
1315 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1316 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1317 
1318 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1319 			, __func__
1320 			, bs.bs_intval
1321 			, bs.bs_nexttbtt
1322 			, bs.bs_dtimperiod
1323 			, bs.bs_nextdtim
1324 			, bs.bs_bmissthreshold
1325 			, bs.bs_sleepduration
1326 		));
1327 		ath_hal_intrset(ah, 0);
1328 		/*
1329 		 * Reset our tsf so the hardware will update the
1330 		 * tsf register to reflect timestamps found in
1331 		 * received beacons.
1332 		 */
1333 		ath_hal_resettsf(ah);
1334 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1335 		sc->sc_imask |= HAL_INT_BMISS;
1336 		ath_hal_intrset(ah, sc->sc_imask);
1337 	} else {
1338 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1339 			__func__, ni->ni_intval, nexttbtt));
1340 		ath_hal_intrset(ah, 0);
1341 		ath_hal_beaconinit(ah, ic->ic_opmode,
1342 			nexttbtt, ni->ni_intval);
1343 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1344 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1345 		ath_hal_intrset(ah, sc->sc_imask);
1346 	}
1347 }
1348 
1349 static void
1350 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1351 {
1352 	bus_addr_t *paddr = (bus_addr_t*) arg;
1353 	*paddr = segs->ds_addr;
1354 }
1355 
1356 static int
1357 ath_desc_alloc(struct ath_softc *sc)
1358 {
1359 	int i, bsize, error;
1360 	struct ath_desc *ds;
1361 	struct ath_buf *bf;
1362 
1363 	/* allocate descriptors */
1364 	sc->sc_desc_len = sizeof(struct ath_desc) *
1365 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1366 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1367 	if (error != 0)
1368 		return error;
1369 
1370 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1371 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1372 	if (error != 0)
1373 		goto fail0;
1374 
1375 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1376 				sc->sc_desc, sc->sc_desc_len,
1377 				ath_load_cb, &sc->sc_desc_paddr,
1378 				BUS_DMA_NOWAIT);
1379 	if (error != 0)
1380 		goto fail1;
1381 
1382 	ds = sc->sc_desc;
1383 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1384 	    ds, sc->sc_desc_len,
1385 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1386 
1387 	/* allocate buffers */
1388 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1389 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1390 	if (bf == NULL)
1391 		goto fail2;
1392 	sc->sc_bufptr = bf;
1393 
1394 	TAILQ_INIT(&sc->sc_rxbuf);
1395 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1396 		bf->bf_desc = ds;
1397 		bf->bf_daddr = sc->sc_desc_paddr +
1398 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1399 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1400 					  &bf->bf_dmamap);
1401 		if (error != 0)
1402 			break;
1403 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1404 	}
1405 
1406 	TAILQ_INIT(&sc->sc_txbuf);
1407 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1408 		bf->bf_desc = ds;
1409 		bf->bf_daddr = sc->sc_desc_paddr +
1410 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1411 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1412 					  &bf->bf_dmamap);
1413 		if (error != 0)
1414 			break;
1415 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1416 	}
1417 	TAILQ_INIT(&sc->sc_txq);
1418 
1419 	/* beacon buffer */
1420 	bf->bf_desc = ds;
1421 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1422 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1423 	if (error != 0)
1424 		return error;
1425 	sc->sc_bcbuf = bf;
1426 	return 0;
1427 
1428 fail2:
1429 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1430 fail1:
1431 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1432 fail0:
1433 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1434 	sc->sc_ddmamap = NULL;
1435 	return error;
1436 }
1437 
1438 static void
1439 ath_desc_free(struct ath_softc *sc)
1440 {
1441 	struct ath_buf *bf;
1442 
1443 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1444 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1445 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1446 
1447 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1448 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1449 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1450 		m_freem(bf->bf_m);
1451 	}
1452 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1453 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1454 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1455 		if (bf->bf_m) {
1456 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1457 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1458 			m_freem(bf->bf_m);
1459 			bf->bf_m = NULL;
1460 		}
1461 	}
1462 	if (sc->sc_bcbuf != NULL) {
1463 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1464 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1465 		sc->sc_bcbuf = NULL;
1466 	}
1467 
1468 	TAILQ_INIT(&sc->sc_rxbuf);
1469 	TAILQ_INIT(&sc->sc_txbuf);
1470 	TAILQ_INIT(&sc->sc_txq);
1471 	free(sc->sc_bufptr, M_DEVBUF);
1472 	sc->sc_bufptr = NULL;
1473 }
1474 
1475 static struct ieee80211_node *
1476 ath_node_alloc(struct ieee80211com *ic)
1477 {
1478 	struct ath_node *an =
1479 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1480 	if (an) {
1481 		int i;
1482 		for (i = 0; i < ATH_RHIST_SIZE; i++)
1483 			an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME;
1484 		an->an_rx_hist_next = ATH_RHIST_SIZE-1;
1485 		return &an->an_node;
1486 	} else
1487 		return NULL;
1488 }
1489 
1490 static void
1491 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1492 {
1493         struct ath_softc *sc = ic->ic_if.if_softc;
1494 	struct ath_buf *bf;
1495 
1496 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1497 		if (bf->bf_node == ni)
1498 			bf->bf_node = NULL;
1499 	}
1500 	free(ni, M_DEVBUF);
1501 }
1502 
1503 static void
1504 ath_node_copy(struct ieee80211com *ic,
1505 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1506 {
1507 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1508 }
1509 
1510 
1511 static u_int8_t
1512 ath_node_getrssi(struct ieee80211com *ic, struct ieee80211_node *ni)
1513 {
1514 	struct ath_node *an = ATH_NODE(ni);
1515 	int i, now, nsamples, rssi;
1516 
1517 	/*
1518 	 * Calculate the average over the last second of sampled data.
1519 	 */
1520 	now = ticks;
1521 	nsamples = 0;
1522 	rssi = 0;
1523 	i = an->an_rx_hist_next;
1524 	do {
1525 		struct ath_recv_hist *rh = &an->an_rx_hist[i];
1526 		if (rh->arh_ticks == ATH_RHIST_NOTIME)
1527 			goto done;
1528 		if (now - rh->arh_ticks > hz)
1529 			goto done;
1530 		rssi += rh->arh_rssi;
1531 		nsamples++;
1532 		if (i == 0)
1533 			i = ATH_RHIST_SIZE-1;
1534 		else
1535 			i--;
1536 	} while (i != an->an_rx_hist_next);
1537 done:
1538 	/*
1539 	 * Return either the average or the last known
1540 	 * value if there is no recent data.
1541 	 */
1542 	return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
1543 }
1544 
1545 static int
1546 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1547 {
1548 	struct ath_hal *ah = sc->sc_ah;
1549 	int error;
1550 	struct mbuf *m;
1551 	struct ath_desc *ds;
1552 
1553 	m = bf->bf_m;
1554 	if (m == NULL) {
1555 		/*
1556 		 * NB: by assigning a page to the rx dma buffer we
1557 		 * implicitly satisfy the Atheros requirement that
1558 		 * this buffer be cache-line-aligned and sized to be
1559 		 * multiple of the cache line size.  Not doing this
1560 		 * causes weird stuff to happen (for the 5210 at least).
1561 		 */
1562 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1563 		if (m == NULL) {
1564 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1565 			sc->sc_stats.ast_rx_nombuf++;
1566 			return ENOMEM;
1567 		}
1568 		bf->bf_m = m;
1569 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1570 
1571 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1572 					     ath_mbuf_load_cb, bf,
1573 					     BUS_DMA_NOWAIT);
1574 		if (error != 0) {
1575 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1576 				" error %d\n", error));
1577 			sc->sc_stats.ast_rx_busdma++;
1578 			return error;
1579 		}
1580 		KASSERT(bf->bf_nseg == 1,
1581 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1582 			bf->bf_nseg));
1583 	}
1584 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1585 
1586 	/*
1587 	 * Setup descriptors.  For receive we always terminate
1588 	 * the descriptor list with a self-linked entry so we'll
1589 	 * not get overrun under high load (as can happen with a
1590 	 * 5212 when ANI processing enables PHY errors).
1591 	 *
1592 	 * To insure the last descriptor is self-linked we create
1593 	 * each descriptor as self-linked and add it to the end.  As
1594 	 * each additional descriptor is added the previous self-linked
1595 	 * entry is ``fixed'' naturally.  This should be safe even
1596 	 * if DMA is happening.  When processing RX interrupts we
1597 	 * never remove/process the last, self-linked, entry on the
1598 	 * descriptor list.  This insures the hardware always has
1599 	 * someplace to write a new frame.
1600 	 */
1601 	ds = bf->bf_desc;
1602 	ds->ds_link = bf->bf_daddr;	/* link to self */
1603 	ds->ds_data = bf->bf_segs[0].ds_addr;
1604 	ath_hal_setuprxdesc(ah, ds
1605 		, m->m_len		/* buffer size */
1606 		, 0
1607 	);
1608 
1609 	if (sc->sc_rxlink != NULL)
1610 		*sc->sc_rxlink = bf->bf_daddr;
1611 	sc->sc_rxlink = &ds->ds_link;
1612 	return 0;
1613 }
1614 
1615 static void
1616 ath_rx_proc(void *arg, int npending)
1617 {
1618 #define	PA2DESC(_sc, _pa) \
1619 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
1620 		((_pa) - (_sc)->sc_desc_paddr)))
1621 	struct ath_softc *sc = arg;
1622 	struct ath_buf *bf;
1623 	struct ieee80211com *ic = &sc->sc_ic;
1624 	struct ifnet *ifp = &ic->ic_if;
1625 	struct ath_hal *ah = sc->sc_ah;
1626 	struct ath_desc *ds;
1627 	struct mbuf *m;
1628 	struct ieee80211_frame *wh, whbuf;
1629 	struct ieee80211_node *ni;
1630 	struct ath_node *an;
1631 	struct ath_recv_hist *rh;
1632 	int len;
1633 	u_int phyerr;
1634 	HAL_STATUS status;
1635 
1636 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1637 	do {
1638 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1639 		if (bf == NULL) {		/* NB: shouldn't happen */
1640 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1641 			break;
1642 		}
1643 		ds = bf->bf_desc;
1644 		if (ds->ds_link == bf->bf_daddr) {
1645 			/* NB: never process the self-linked entry at the end */
1646 			break;
1647 		}
1648 		m = bf->bf_m;
1649 		if (m == NULL) {		/* NB: shouldn't happen */
1650 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1651 			continue;
1652 		}
1653 		/* XXX sync descriptor memory */
1654 		/*
1655 		 * Must provide the virtual address of the current
1656 		 * descriptor, the physical address, and the virtual
1657 		 * address of the next descriptor in the h/w chain.
1658 		 * This allows the HAL to look ahead to see if the
1659 		 * hardware is done with a descriptor by checking the
1660 		 * done bit in the following descriptor and the address
1661 		 * of the current descriptor the DMA engine is working
1662 		 * on.  All this is necessary because of our use of
1663 		 * a self-linked list to avoid rx overruns.
1664 		 */
1665 		status = ath_hal_rxprocdesc(ah, ds,
1666 				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
1667 #ifdef AR_DEBUG
1668 		if (ath_debug > 1)
1669 			ath_printrxbuf(bf, status == HAL_OK);
1670 #endif
1671 		if (status == HAL_EINPROGRESS)
1672 			break;
1673 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1674 		if (ds->ds_rxstat.rs_status != 0) {
1675 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1676 				sc->sc_stats.ast_rx_crcerr++;
1677 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1678 				sc->sc_stats.ast_rx_fifoerr++;
1679 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1680 				sc->sc_stats.ast_rx_badcrypt++;
1681 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1682 				sc->sc_stats.ast_rx_phyerr++;
1683 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1684 				sc->sc_stats.ast_rx_phy[phyerr]++;
1685 			} else {
1686 				/*
1687 				 * NB: don't count PHY errors as input errors;
1688 				 * we enable them on the 5212 to collect info
1689 				 * about environmental noise and, in that
1690 				 * setting, they don't really reflect tx/rx
1691 				 * errors.
1692 				 */
1693 				ifp->if_ierrors++;
1694 			}
1695 			goto rx_next;
1696 		}
1697 
1698 		len = ds->ds_rxstat.rs_datalen;
1699 		if (len < IEEE80211_MIN_LEN) {
1700 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1701 			sc->sc_stats.ast_rx_tooshort++;
1702 			goto rx_next;
1703 		}
1704 
1705 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1706 		    BUS_DMASYNC_POSTREAD);
1707 
1708 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1709 		bf->bf_m = NULL;
1710 		m->m_pkthdr.rcvif = ifp;
1711 		m->m_pkthdr.len = m->m_len = len;
1712 
1713 		if (sc->sc_drvbpf) {
1714 			struct mbuf *mb;
1715 
1716 			/* XXX pre-allocate space when setting up recv's */
1717 			MGETHDR(mb, M_DONTWAIT, m->m_type);
1718 			if (mb != NULL) {
1719 				sc->sc_rx_th.wr_rate =
1720 					sc->sc_hwmap[ds->ds_rxstat.rs_rate];
1721 				sc->sc_rx_th.wr_antsignal =
1722 					ds->ds_rxstat.rs_rssi;
1723 				sc->sc_rx_th.wr_antenna =
1724 					ds->ds_rxstat.rs_antenna;
1725 				/* XXX TSF */
1726 
1727 				(void) m_dup_pkthdr(mb, m, M_DONTWAIT);
1728 				mb->m_next = m;
1729 				mb->m_data = (caddr_t)&sc->sc_rx_th;
1730 				mb->m_len = sizeof(sc->sc_rx_th);
1731 				mb->m_pkthdr.len += mb->m_len;
1732 				bpf_mtap(sc->sc_drvbpf, mb);
1733 				m_free(mb);
1734 			}
1735 		}
1736 
1737 		m_adj(m, -IEEE80211_CRC_LEN);
1738 		wh = mtod(m, struct ieee80211_frame *);
1739 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1740 			/*
1741 			 * WEP is decrypted by hardware. Clear WEP bit
1742 			 * and trim WEP header for ieee80211_input().
1743 			 */
1744 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1745 			memcpy(&whbuf, wh, sizeof(whbuf));
1746 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1747 			wh = mtod(m, struct ieee80211_frame *);
1748 			memcpy(wh, &whbuf, sizeof(whbuf));
1749 			/*
1750 			 * Also trim WEP ICV from the tail.
1751 			 */
1752 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1753 		}
1754 
1755 		/*
1756 		 * Locate the node for sender, track state, and
1757 		 * then pass this node (referenced) up to the 802.11
1758 		 * layer for its use.  We are required to pass
1759 		 * something so we fall back to ic_bss when this frame
1760 		 * is from an unknown sender.
1761 		 */
1762 		if (ic->ic_opmode != IEEE80211_M_STA) {
1763 			ni = ieee80211_find_node(ic, wh->i_addr2);
1764 			if (ni == NULL)
1765 				ni = ieee80211_ref_node(ic->ic_bss);
1766 		} else
1767 			ni = ieee80211_ref_node(ic->ic_bss);
1768 
1769 		/*
1770 		 * Record driver-specific state.
1771 		 */
1772 		an = ATH_NODE(ni);
1773 		if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE)
1774 			an->an_rx_hist_next = 0;
1775 		rh = &an->an_rx_hist[an->an_rx_hist_next];
1776 		rh->arh_ticks = ticks;
1777 		rh->arh_rssi = ds->ds_rxstat.rs_rssi;
1778 		rh->arh_antenna = ds->ds_rxstat.rs_antenna;
1779 
1780 		/*
1781 		 * Send frame up for processing.
1782 		 */
1783 		ieee80211_input(ifp, m, ni,
1784 			ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
1785 
1786 		/*
1787 		 * The frame may have caused the node to be marked for
1788 		 * reclamation (e.g. in response to a DEAUTH message)
1789 		 * so use free_node here instead of unref_node.
1790 		 */
1791 		if (ni == ic->ic_bss)
1792 			ieee80211_unref_node(&ni);
1793 		else
1794 			ieee80211_free_node(ic, ni);
1795   rx_next:
1796 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1797 	} while (ath_rxbuf_init(sc, bf) == 0);
1798 
1799 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1800 	ath_hal_rxena(ah);			/* in case of RXEOL */
1801 #undef PA2DESC
1802 }
1803 
1804 /*
1805  * XXX Size of an ACK control frame in bytes.
1806  */
1807 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1808 
1809 static int
1810 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1811     struct mbuf *m0)
1812 {
1813 	struct ieee80211com *ic = &sc->sc_ic;
1814 	struct ath_hal *ah = sc->sc_ah;
1815 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1816 	int i, error, iswep, hdrlen, pktlen;
1817 	u_int8_t rix, cix, txrate, ctsrate;
1818 	struct ath_desc *ds;
1819 	struct mbuf *m;
1820 	struct ieee80211_frame *wh;
1821 	u_int32_t iv;
1822 	u_int8_t *ivp;
1823 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1824 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1825 	u_int subtype, flags, ctsduration, antenna;
1826 	HAL_PKT_TYPE atype;
1827 	const HAL_RATE_TABLE *rt;
1828 	HAL_BOOL shortPreamble;
1829 	struct ath_node *an;
1830 
1831 	wh = mtod(m0, struct ieee80211_frame *);
1832 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1833 	hdrlen = sizeof(struct ieee80211_frame);
1834 	pktlen = m0->m_pkthdr.len;
1835 
1836 	if (iswep) {
1837 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1838 		m_adj(m0, hdrlen);
1839 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1840 		if (m0 == NULL) {
1841 			sc->sc_stats.ast_tx_nombuf++;
1842 			return ENOMEM;
1843 		}
1844 		ivp = hdrbuf + hdrlen;
1845 		wh = mtod(m0, struct ieee80211_frame *);
1846 		/*
1847 		 * XXX
1848 		 * IV must not duplicate during the lifetime of the key.
1849 		 * But no mechanism to renew keys is defined in IEEE 802.11
1850 		 * WEP.  And IV may be duplicated between other stations
1851 		 * because of the session key itself is shared.
1852 		 * So we use pseudo random IV for now, though it is not the
1853 		 * right way.
1854 		 */
1855                 iv = ic->ic_iv;
1856 		/*
1857 		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
1858 		 * (B, 255, N) with 3 <= B < 8
1859 		 */
1860 		if (iv >= 0x03ff00 && (iv & 0xf8ff00) == 0x00ff00)
1861 			iv += 0x000100;
1862 		ic->ic_iv = iv + 1;
1863 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1864 			ivp[i] = iv;
1865 			iv >>= 8;
1866 		}
1867 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1868 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1869 		/*
1870 		 * The ICV length must be included into hdrlen and pktlen.
1871 		 */
1872 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1873 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1874 	}
1875 	pktlen += IEEE80211_CRC_LEN;
1876 
1877 	/*
1878 	 * Load the DMA map so any coalescing is done.  This
1879 	 * also calculates the number of descriptors we need.
1880 	 */
1881 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1882 				     ath_mbuf_load_cb, bf,
1883 				     BUS_DMA_NOWAIT);
1884 	if (error == EFBIG) {
1885 		/* XXX packet requires too many descriptors */
1886 		bf->bf_nseg = ATH_TXDESC+1;
1887 	} else if (error != 0) {
1888 		sc->sc_stats.ast_tx_busdma++;
1889 		m_freem(m0);
1890 		return error;
1891 	}
1892 	/*
1893 	 * Discard null packets and check for packets that
1894 	 * require too many TX descriptors.  We try to convert
1895 	 * the latter to a cluster.
1896 	 */
1897 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1898 		sc->sc_stats.ast_tx_linear++;
1899 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1900 		if (m == NULL) {
1901 			sc->sc_stats.ast_tx_nombuf++;
1902 			m_freem(m0);
1903 			return ENOMEM;
1904 		}
1905 		M_MOVE_PKTHDR(m, m0);
1906 		MCLGET(m, M_DONTWAIT);
1907 		if ((m->m_flags & M_EXT) == 0) {
1908 			sc->sc_stats.ast_tx_nomcl++;
1909 			m_freem(m0);
1910 			m_free(m);
1911 			return ENOMEM;
1912 		}
1913 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1914 		m_freem(m0);
1915 		m->m_len = m->m_pkthdr.len;
1916 		m0 = m;
1917 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1918 					     ath_mbuf_load_cb, bf,
1919 					     BUS_DMA_NOWAIT);
1920 		if (error != 0) {
1921 			sc->sc_stats.ast_tx_busdma++;
1922 			m_freem(m0);
1923 			return error;
1924 		}
1925 		KASSERT(bf->bf_nseg == 1,
1926 			("ath_tx_start: packet not one segment; nseg %u",
1927 			bf->bf_nseg));
1928 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1929 		sc->sc_stats.ast_tx_nodata++;
1930 		m_freem(m0);
1931 		return EIO;
1932 	}
1933 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1934 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1935 	bf->bf_m = m0;
1936 	bf->bf_node = ni;			/* NB: held reference */
1937 
1938 	/* setup descriptors */
1939 	ds = bf->bf_desc;
1940 	rt = sc->sc_currates;
1941 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1942 
1943 	/*
1944 	 * Calculate Atheros packet type from IEEE80211 packet header
1945 	 * and setup for rate calculations.
1946 	 */
1947 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1948 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1949 	case IEEE80211_FC0_TYPE_MGT:
1950 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1951 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1952 			atype = HAL_PKT_TYPE_BEACON;
1953 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1954 			atype = HAL_PKT_TYPE_PROBE_RESP;
1955 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1956 			atype = HAL_PKT_TYPE_ATIM;
1957 		rix = 0;			/* XXX lowest rate */
1958 		break;
1959 	case IEEE80211_FC0_TYPE_CTL:
1960 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1961 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1962 			atype = HAL_PKT_TYPE_PSPOLL;
1963 		rix = 0;			/* XXX lowest rate */
1964 		break;
1965 	default:
1966 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1967 				IEEE80211_RATE_VAL];
1968 		if (rix == 0xff) {
1969 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1970 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1971 			sc->sc_stats.ast_tx_badrate++;
1972 			m_freem(m0);
1973 			return EIO;
1974 		}
1975 		break;
1976 	}
1977 	/*
1978 	 * NB: the 802.11 layer marks whether or not we should
1979 	 * use short preamble based on the current mode and
1980 	 * negotiated parameters.
1981 	 */
1982 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1983 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1984 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1985 		shortPreamble = AH_TRUE;
1986 		sc->sc_stats.ast_tx_shortpre++;
1987 	} else {
1988 		txrate = rt->info[rix].rateCode;
1989 		shortPreamble = AH_FALSE;
1990 	}
1991 
1992 	/*
1993 	 * Calculate miscellaneous flags.
1994 	 */
1995 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1996 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1997 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1998 		sc->sc_stats.ast_tx_noack++;
1999 	} else if (pktlen > ic->ic_rtsthreshold) {
2000 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
2001 		sc->sc_stats.ast_tx_rts++;
2002 	}
2003 
2004 	/*
2005 	 * Calculate duration.  This logically belongs in the 802.11
2006 	 * layer but it lacks sufficient information to calculate it.
2007 	 */
2008 	if ((flags & HAL_TXDESC_NOACK) == 0 &&
2009 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
2010 		u_int16_t dur;
2011 		/*
2012 		 * XXX not right with fragmentation.
2013 		 */
2014 		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
2015 				rix, shortPreamble);
2016 		*((u_int16_t*) wh->i_dur) = htole16(dur);
2017 	}
2018 
2019 	/*
2020 	 * Calculate RTS/CTS rate and duration if needed.
2021 	 */
2022 	ctsduration = 0;
2023 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
2024 		/*
2025 		 * CTS transmit rate is derived from the transmit rate
2026 		 * by looking in the h/w rate table.  We must also factor
2027 		 * in whether or not a short preamble is to be used.
2028 		 */
2029 		cix = rt->info[rix].controlRate;
2030 		ctsrate = rt->info[cix].rateCode;
2031 		if (shortPreamble)
2032 			ctsrate |= rt->info[cix].shortPreamble;
2033 		/*
2034 		 * Compute the transmit duration based on the size
2035 		 * of an ACK frame.  We call into the HAL to do the
2036 		 * computation since it depends on the characteristics
2037 		 * of the actual PHY being used.
2038 		 */
2039 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
2040 			ctsduration += ath_hal_computetxtime(ah,
2041 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2042 		}
2043 		/* SIFS + data */
2044 		ctsduration += ath_hal_computetxtime(ah,
2045 			rt, pktlen, rix, shortPreamble);
2046 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
2047 			ctsduration += ath_hal_computetxtime(ah,
2048 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
2049 		}
2050 	} else
2051 		ctsrate = 0;
2052 
2053 	/*
2054 	 * For now use the antenna on which the last good
2055 	 * frame was received on.  We assume this field is
2056 	 * initialized to 0 which gives us ``auto'' or the
2057 	 * ``default'' antenna.
2058 	 */
2059 	an = (struct ath_node *) ni;
2060 	if (an->an_tx_antenna)
2061 		antenna = an->an_tx_antenna;
2062 	else
2063 		antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
2064 
2065 	/*
2066 	 * Formulate first tx descriptor with tx controls.
2067 	 */
2068 	/* XXX check return value? */
2069 	ath_hal_setuptxdesc(ah, ds
2070 		, pktlen		/* packet length */
2071 		, hdrlen		/* header length */
2072 		, atype			/* Atheros packet type */
2073 		, 60			/* txpower XXX */
2074 		, txrate, 1+10		/* series 0 rate/tries */
2075 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
2076 		, antenna		/* antenna mode */
2077 		, flags			/* flags */
2078 		, ctsrate		/* rts/cts rate */
2079 		, ctsduration		/* rts/cts duration */
2080 	);
2081 #ifdef notyet
2082 	ath_hal_setupxtxdesc(ah, ds
2083 		, AH_FALSE		/* short preamble */
2084 		, 0, 0			/* series 1 rate/tries */
2085 		, 0, 0			/* series 2 rate/tries */
2086 		, 0, 0			/* series 3 rate/tries */
2087 	);
2088 #endif
2089 	/*
2090 	 * Fillin the remainder of the descriptor info.
2091 	 */
2092 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
2093 		ds->ds_data = bf->bf_segs[i].ds_addr;
2094 		if (i == bf->bf_nseg - 1)
2095 			ds->ds_link = 0;
2096 		else
2097 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
2098 		ath_hal_filltxdesc(ah, ds
2099 			, bf->bf_segs[i].ds_len	/* segment length */
2100 			, i == 0		/* first segment */
2101 			, i == bf->bf_nseg - 1	/* last segment */
2102 		);
2103 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
2104 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
2105 		    ds->ds_hw[0], ds->ds_hw[1]));
2106 	}
2107 
2108 	/*
2109 	 * Insert the frame on the outbound list and
2110 	 * pass it on to the hardware.
2111 	 */
2112 	ATH_TXQ_LOCK(sc);
2113 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
2114 	if (sc->sc_txlink == NULL) {
2115 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
2116 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
2117 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
2118 	} else {
2119 		*sc->sc_txlink = bf->bf_daddr;
2120 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
2121 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
2122 	}
2123 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
2124 	ATH_TXQ_UNLOCK(sc);
2125 
2126 	ath_hal_txstart(ah, sc->sc_txhalq);
2127 	return 0;
2128 }
2129 
2130 static void
2131 ath_tx_proc(void *arg, int npending)
2132 {
2133 	struct ath_softc *sc = arg;
2134 	struct ath_hal *ah = sc->sc_ah;
2135 	struct ath_buf *bf;
2136 	struct ieee80211com *ic = &sc->sc_ic;
2137 	struct ifnet *ifp = &ic->ic_if;
2138 	struct ath_desc *ds;
2139 	struct ieee80211_node *ni;
2140 	struct ath_node *an;
2141 	int sr, lr;
2142 	HAL_STATUS status;
2143 
2144 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
2145 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
2146 		sc->sc_txlink));
2147 	for (;;) {
2148 		ATH_TXQ_LOCK(sc);
2149 		bf = TAILQ_FIRST(&sc->sc_txq);
2150 		if (bf == NULL) {
2151 			sc->sc_txlink = NULL;
2152 			ATH_TXQ_UNLOCK(sc);
2153 			break;
2154 		}
2155 		/* only the last descriptor is needed */
2156 		ds = &bf->bf_desc[bf->bf_nseg - 1];
2157 		status = ath_hal_txprocdesc(ah, ds);
2158 #ifdef AR_DEBUG
2159 		if (ath_debug > 1)
2160 			ath_printtxbuf(bf, status == HAL_OK);
2161 #endif
2162 		if (status == HAL_EINPROGRESS) {
2163 			ATH_TXQ_UNLOCK(sc);
2164 			break;
2165 		}
2166 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2167 		ATH_TXQ_UNLOCK(sc);
2168 
2169 		ni = bf->bf_node;
2170 		if (ni != NULL) {
2171 			an = (struct ath_node *) ni;
2172 			if (ds->ds_txstat.ts_status == 0) {
2173 				an->an_tx_ok++;
2174 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
2175 			} else {
2176 				an->an_tx_err++;
2177 				ifp->if_oerrors++;
2178 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
2179 					sc->sc_stats.ast_tx_xretries++;
2180 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
2181 					sc->sc_stats.ast_tx_fifoerr++;
2182 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
2183 					sc->sc_stats.ast_tx_filtered++;
2184 				an->an_tx_antenna = 0;	/* invalidate */
2185 			}
2186 			sr = ds->ds_txstat.ts_shortretry;
2187 			lr = ds->ds_txstat.ts_longretry;
2188 			sc->sc_stats.ast_tx_shortretry += sr;
2189 			sc->sc_stats.ast_tx_longretry += lr;
2190 			if (sr + lr)
2191 				an->an_tx_retr++;
2192 			/*
2193 			 * Reclaim reference to node.
2194 			 *
2195 			 * NB: the node may be reclaimed here if, for example
2196 			 *     this is a DEAUTH message that was sent and the
2197 			 *     node was timed out due to inactivity.
2198 			 */
2199 			if (ni != ic->ic_bss)
2200 				ieee80211_free_node(ic, ni);
2201 		}
2202 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
2203 		    BUS_DMASYNC_POSTWRITE);
2204 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2205 		m_freem(bf->bf_m);
2206 		bf->bf_m = NULL;
2207 		bf->bf_node = NULL;
2208 
2209 		ATH_TXBUF_LOCK(sc);
2210 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2211 		ATH_TXBUF_UNLOCK(sc);
2212 	}
2213 	ifp->if_flags &= ~IFF_OACTIVE;
2214 	sc->sc_tx_timer = 0;
2215 
2216 	ath_start(ifp);
2217 }
2218 
2219 /*
2220  * Drain the transmit queue and reclaim resources.
2221  */
2222 static void
2223 ath_draintxq(struct ath_softc *sc)
2224 {
2225 	struct ath_hal *ah = sc->sc_ah;
2226 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2227 	struct ath_buf *bf;
2228 
2229 	/* XXX return value */
2230 	if (!sc->sc_invalid) {
2231 		/* don't touch the hardware if marked invalid */
2232 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
2233 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
2234 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
2235 		    sc->sc_txlink));
2236 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
2237 		DPRINTF(("ath_draintxq: beacon queue %p\n",
2238 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
2239 	}
2240 	for (;;) {
2241 		ATH_TXQ_LOCK(sc);
2242 		bf = TAILQ_FIRST(&sc->sc_txq);
2243 		if (bf == NULL) {
2244 			sc->sc_txlink = NULL;
2245 			ATH_TXQ_UNLOCK(sc);
2246 			break;
2247 		}
2248 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
2249 		ATH_TXQ_UNLOCK(sc);
2250 #ifdef AR_DEBUG
2251 		if (ath_debug)
2252 			ath_printtxbuf(bf,
2253 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
2254 #endif /* AR_DEBUG */
2255 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
2256 		m_freem(bf->bf_m);
2257 		bf->bf_m = NULL;
2258 		bf->bf_node = NULL;
2259 		ATH_TXBUF_LOCK(sc);
2260 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
2261 		ATH_TXBUF_UNLOCK(sc);
2262 	}
2263 	ifp->if_flags &= ~IFF_OACTIVE;
2264 	sc->sc_tx_timer = 0;
2265 }
2266 
2267 /*
2268  * Disable the receive h/w in preparation for a reset.
2269  */
2270 static void
2271 ath_stoprecv(struct ath_softc *sc)
2272 {
2273 #define	PA2DESC(_sc, _pa) \
2274 	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
2275 		((_pa) - (_sc)->sc_desc_paddr)))
2276 	struct ath_hal *ah = sc->sc_ah;
2277 
2278 	ath_hal_stoppcurecv(ah);	/* disable PCU */
2279 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
2280 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
2281 	DELAY(3000);			/* long enough for 1 frame */
2282 #ifdef AR_DEBUG
2283 	if (ath_debug) {
2284 		struct ath_buf *bf;
2285 
2286 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
2287 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
2288 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2289 			struct ath_desc *ds = bf->bf_desc;
2290 			if (ath_hal_rxprocdesc(ah, ds, bf->bf_daddr,
2291 			    PA2DESC(sc, ds->ds_link)) == HAL_OK)
2292 				ath_printrxbuf(bf, 1);
2293 		}
2294 	}
2295 #endif
2296 	sc->sc_rxlink = NULL;		/* just in case */
2297 #undef PA2DESC
2298 }
2299 
2300 /*
2301  * Enable the receive h/w following a reset.
2302  */
2303 static int
2304 ath_startrecv(struct ath_softc *sc)
2305 {
2306 	struct ath_hal *ah = sc->sc_ah;
2307 	struct ath_buf *bf;
2308 
2309 	sc->sc_rxlink = NULL;
2310 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2311 		int error = ath_rxbuf_init(sc, bf);
2312 		if (error != 0) {
2313 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2314 				error));
2315 			return error;
2316 		}
2317 	}
2318 
2319 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2320 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2321 	ath_hal_rxena(ah);		/* enable recv descriptors */
2322 	ath_mode_init(sc);		/* set filters, etc. */
2323 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2324 	return 0;
2325 }
2326 
2327 /*
2328  * Set/change channels.  If the channel is really being changed,
2329  * it's done by resetting the chip.  To accomplish this we must
2330  * first cleanup any pending DMA, then restart stuff after a la
2331  * ath_init.
2332  */
2333 static int
2334 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2335 {
2336 	struct ath_hal *ah = sc->sc_ah;
2337 	struct ieee80211com *ic = &sc->sc_ic;
2338 
2339 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2340 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2341 		ic->ic_ibss_chan->ic_freq,
2342 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2343 	if (chan != ic->ic_ibss_chan) {
2344 		HAL_STATUS status;
2345 		HAL_CHANNEL hchan;
2346 		enum ieee80211_phymode mode;
2347 
2348 		/*
2349 		 * To switch channels clear any pending DMA operations;
2350 		 * wait long enough for the RX fifo to drain, reset the
2351 		 * hardware at the new frequency, and then re-enable
2352 		 * the relevant bits of the h/w.
2353 		 */
2354 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2355 		ath_draintxq(sc);		/* clear pending tx frames */
2356 		ath_stoprecv(sc);		/* turn off frame recv */
2357 		/*
2358 		 * Convert to a HAL channel description with
2359 		 * the flags constrained to reflect the current
2360 		 * operating mode.
2361 		 */
2362 		hchan.channel = chan->ic_freq;
2363 		hchan.channelFlags = ath_chan2flags(ic, chan);
2364 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2365 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2366 				"channel %u (%u Mhz)\n",
2367 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2368 			return EIO;
2369 		}
2370 		/*
2371 		 * Re-enable rx framework.
2372 		 */
2373 		if (ath_startrecv(sc) != 0) {
2374 			if_printf(&ic->ic_if,
2375 				"ath_chan_set: unable to restart recv logic\n");
2376 			return EIO;
2377 		}
2378 
2379 		/*
2380 		 * Update BPF state.
2381 		 */
2382 		sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
2383 			htole16(chan->ic_freq);
2384 		sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
2385 			htole16(chan->ic_flags);
2386 
2387 		/*
2388 		 * Change channels and update the h/w rate map
2389 		 * if we're switching; e.g. 11a to 11b/g.
2390 		 */
2391 		ic->ic_ibss_chan = chan;
2392 		mode = ieee80211_chan2mode(ic, chan);
2393 		if (mode != sc->sc_curmode)
2394 			ath_setcurmode(sc, mode);
2395 
2396 		/*
2397 		 * Re-enable interrupts.
2398 		 */
2399 		ath_hal_intrset(ah, sc->sc_imask);
2400 	}
2401 	return 0;
2402 }
2403 
2404 static void
2405 ath_next_scan(void *arg)
2406 {
2407 	struct ath_softc *sc = arg;
2408 	struct ieee80211com *ic = &sc->sc_ic;
2409 	struct ifnet *ifp = &ic->ic_if;
2410 
2411 	if (ic->ic_state == IEEE80211_S_SCAN)
2412 		ieee80211_next_scan(ifp);
2413 }
2414 
2415 /*
2416  * Periodically recalibrate the PHY to account
2417  * for temperature/environment changes.
2418  */
2419 static void
2420 ath_calibrate(void *arg)
2421 {
2422 	struct ath_softc *sc = arg;
2423 	struct ath_hal *ah = sc->sc_ah;
2424 	struct ieee80211com *ic = &sc->sc_ic;
2425 	struct ieee80211_channel *c;
2426 	HAL_CHANNEL hchan;
2427 
2428 	sc->sc_stats.ast_per_cal++;
2429 
2430 	/*
2431 	 * Convert to a HAL channel description with the flags
2432 	 * constrained to reflect the current operating mode.
2433 	 */
2434 	c = ic->ic_ibss_chan;
2435 	hchan.channel = c->ic_freq;
2436 	hchan.channelFlags = ath_chan2flags(ic, c);
2437 
2438 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2439 
2440 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2441 		/*
2442 		 * Rfgain is out of bounds, reset the chip
2443 		 * to load new gain values.
2444 		 */
2445 		sc->sc_stats.ast_per_rfgain++;
2446 		ath_reset(sc);
2447 	}
2448 	if (!ath_hal_calibrate(ah, &hchan)) {
2449 		DPRINTF(("%s: calibration of channel %u failed\n",
2450 			__func__, c->ic_freq));
2451 		sc->sc_stats.ast_per_calfail++;
2452 	}
2453 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2454 }
2455 
2456 static int
2457 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2458 {
2459 	struct ifnet *ifp = &ic->ic_if;
2460 	struct ath_softc *sc = ifp->if_softc;
2461 	struct ath_hal *ah = sc->sc_ah;
2462 	struct ieee80211_node *ni;
2463 	int i, error;
2464 	const u_int8_t *bssid;
2465 	u_int32_t rfilt;
2466 	static const HAL_LED_STATE leds[] = {
2467 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2468 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2469 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2470 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2471 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2472 	};
2473 
2474 	DPRINTF(("%s: %s -> %s\n", __func__,
2475 		ieee80211_state_name[ic->ic_state],
2476 		ieee80211_state_name[nstate]));
2477 
2478 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2479 
2480 	if (nstate == IEEE80211_S_INIT) {
2481 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2482 		ath_hal_intrset(ah, sc->sc_imask);
2483 		callout_stop(&sc->sc_scan_ch);
2484 		callout_stop(&sc->sc_cal_ch);
2485 		return (*sc->sc_newstate)(ic, nstate, arg);
2486 	}
2487 	ni = ic->ic_bss;
2488 	error = ath_chan_set(sc, ni->ni_chan);
2489 	if (error != 0)
2490 		goto bad;
2491 	rfilt = ath_calcrxfilter(sc);
2492 	if (nstate == IEEE80211_S_SCAN) {
2493 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2494 			ath_next_scan, sc);
2495 		bssid = ifp->if_broadcastaddr;
2496 	} else {
2497 		callout_stop(&sc->sc_scan_ch);
2498 		bssid = ni->ni_bssid;
2499 	}
2500 	ath_hal_setrxfilter(ah, rfilt);
2501 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2502 		 __func__, rfilt, ether_sprintf(bssid)));
2503 
2504 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2505 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2506 	else
2507 		ath_hal_setassocid(ah, bssid, 0);
2508 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2509 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2510 			if (ath_hal_keyisvalid(ah, i))
2511 				ath_hal_keysetmac(ah, i, bssid);
2512 	}
2513 
2514 	if (nstate == IEEE80211_S_RUN) {
2515 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2516 			"capinfo=0x%04x chan=%d\n"
2517 			 , __func__
2518 			 , ic->ic_flags
2519 			 , ni->ni_intval
2520 			 , ether_sprintf(ni->ni_bssid)
2521 			 , ni->ni_capinfo
2522 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2523 
2524 		/*
2525 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2526 		 */
2527 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2528 		    ic->ic_opmode == IEEE80211_M_IBSS) {
2529 			error = ath_beacon_alloc(sc, ni);
2530 			if (error != 0)
2531 				goto bad;
2532 		}
2533 
2534 		/*
2535 		 * Configure the beacon and sleep timers.
2536 		 */
2537 		ath_beacon_config(sc);
2538 
2539 		/* start periodic recalibration timer */
2540 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2541 			ath_calibrate, sc);
2542 	} else {
2543 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2544 		ath_hal_intrset(ah, sc->sc_imask);
2545 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2546 	}
2547 	/*
2548 	 * Reset the rate control state.
2549 	 */
2550 	ath_rate_ctl_reset(sc, nstate);
2551 	/*
2552 	 * Invoke the parent method to complete the work.
2553 	 */
2554 	return (*sc->sc_newstate)(ic, nstate, arg);
2555 bad:
2556 	callout_stop(&sc->sc_scan_ch);
2557 	callout_stop(&sc->sc_cal_ch);
2558 	/* NB: do not invoke the parent */
2559 	return error;
2560 }
2561 
2562 /*
2563  * Setup driver-specific state for a newly associated node.
2564  * Note that we're called also on a re-associate, the isnew
2565  * param tells us if this is the first time or not.
2566  */
2567 static void
2568 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2569 {
2570 	if (isnew) {
2571 		struct ath_node *an = (struct ath_node *) ni;
2572 
2573 		an->an_tx_ok = an->an_tx_err =
2574 			an->an_tx_retr = an->an_tx_upper = 0;
2575 		/* start with highest negotiated rate */
2576 		/*
2577 		 * XXX should do otherwise but only when
2578 		 * the rate control algorithm is better.
2579 		 */
2580 		KASSERT(ni->ni_rates.rs_nrates > 0,
2581 			("new association w/ no rates!"));
2582 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2583 	}
2584 }
2585 
2586 static int
2587 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2588 {
2589 	struct ieee80211com *ic = &sc->sc_ic;
2590 	struct ifnet *ifp = &ic->ic_if;
2591 	struct ath_hal *ah = sc->sc_ah;
2592 	HAL_CHANNEL *chans;
2593 	int i, ix, nchan;
2594 
2595 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2596 			M_TEMP, M_NOWAIT);
2597 	if (chans == NULL) {
2598 		if_printf(ifp, "unable to allocate channel table\n");
2599 		return ENOMEM;
2600 	}
2601 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2602 	    cc, HAL_MODE_ALL, outdoor)) {
2603 		if_printf(ifp, "unable to collect channel list from hal\n");
2604 		free(chans, M_TEMP);
2605 		return EINVAL;
2606 	}
2607 
2608 	/*
2609 	 * Convert HAL channels to ieee80211 ones and insert
2610 	 * them in the table according to their channel number.
2611 	 */
2612 	for (i = 0; i < nchan; i++) {
2613 		HAL_CHANNEL *c = &chans[i];
2614 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2615 		if (ix > IEEE80211_CHAN_MAX) {
2616 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2617 				ix, c->channel, c->channelFlags);
2618 			continue;
2619 		}
2620 		/* NB: flags are known to be compatible */
2621 		if (ic->ic_channels[ix].ic_freq == 0) {
2622 			ic->ic_channels[ix].ic_freq = c->channel;
2623 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2624 		} else {
2625 			/* channels overlap; e.g. 11g and 11b */
2626 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2627 		}
2628 	}
2629 	free(chans, M_TEMP);
2630 	return 0;
2631 }
2632 
2633 static int
2634 ath_rate_setup(struct ath_softc *sc, u_int mode)
2635 {
2636 	struct ath_hal *ah = sc->sc_ah;
2637 	struct ieee80211com *ic = &sc->sc_ic;
2638 	const HAL_RATE_TABLE *rt;
2639 	struct ieee80211_rateset *rs;
2640 	int i, maxrates;
2641 
2642 	switch (mode) {
2643 	case IEEE80211_MODE_11A:
2644 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2645 		break;
2646 	case IEEE80211_MODE_11B:
2647 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2648 		break;
2649 	case IEEE80211_MODE_11G:
2650 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2651 		break;
2652 	case IEEE80211_MODE_TURBO:
2653 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2654 		break;
2655 	default:
2656 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2657 		return 0;
2658 	}
2659 	rt = sc->sc_rates[mode];
2660 	if (rt == NULL)
2661 		return 0;
2662 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2663 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2664 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2665 		maxrates = IEEE80211_RATE_MAXSIZE;
2666 	} else
2667 		maxrates = rt->rateCount;
2668 	rs = &ic->ic_sup_rates[mode];
2669 	for (i = 0; i < maxrates; i++)
2670 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2671 	rs->rs_nrates = maxrates;
2672 	return 1;
2673 }
2674 
2675 static void
2676 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2677 {
2678 	const HAL_RATE_TABLE *rt;
2679 	int i;
2680 
2681 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2682 	rt = sc->sc_rates[mode];
2683 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2684 	for (i = 0; i < rt->rateCount; i++)
2685 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2686 	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
2687 	for (i = 0; i < 32; i++)
2688 		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
2689 	sc->sc_currates = rt;
2690 	sc->sc_curmode = mode;
2691 }
2692 
2693 /*
2694  * Reset the rate control state for each 802.11 state transition.
2695  */
2696 static void
2697 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2698 {
2699 	struct ieee80211com *ic = &sc->sc_ic;
2700 	struct ieee80211_node *ni;
2701 	struct ath_node *an;
2702 
2703 	if (ic->ic_opmode != IEEE80211_M_STA) {
2704 		/*
2705 		 * When operating as a station the node table holds
2706 		 * the AP's that were discovered during scanning.
2707 		 * For any other operating mode we want to reset the
2708 		 * tx rate state of each node.
2709 		 */
2710 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2711 			ni->ni_txrate = 0;		/* use lowest rate */
2712 			an = (struct ath_node *) ni;
2713 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2714 			    an->an_tx_upper = 0;
2715 		}
2716 	}
2717 	/*
2718 	 * Reset local xmit state; this is really only meaningful
2719 	 * when operating in station or adhoc mode.
2720 	 */
2721 	ni = ic->ic_bss;
2722 	an = (struct ath_node *) ni;
2723 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2724 	if (state == IEEE80211_S_RUN) {
2725 		/* start with highest negotiated rate */
2726 		KASSERT(ni->ni_rates.rs_nrates > 0,
2727 			("transition to RUN state w/ no rates!"));
2728 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2729 	} else {
2730 		/* use lowest rate */
2731 		ni->ni_txrate = 0;
2732 	}
2733 }
2734 
2735 /*
2736  * Examine and potentially adjust the transmit rate.
2737  */
2738 static void
2739 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2740 {
2741 	struct ath_softc *sc = arg;
2742 	struct ath_node *an = (struct ath_node *) ni;
2743 	struct ieee80211_rateset *rs = &ni->ni_rates;
2744 	int mod = 0, orate, enough;
2745 
2746 	/*
2747 	 * Rate control
2748 	 * XXX: very primitive version.
2749 	 */
2750 	sc->sc_stats.ast_rate_calls++;
2751 
2752 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2753 
2754 	/* no packet reached -> down */
2755 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2756 		mod = -1;
2757 
2758 	/* all packets needs retry in average -> down */
2759 	if (enough && an->an_tx_ok < an->an_tx_retr)
2760 		mod = -1;
2761 
2762 	/* no error and less than 10% of packets needs retry -> up */
2763 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2764 		mod = 1;
2765 
2766 	orate = ni->ni_txrate;
2767 	switch (mod) {
2768 	case 0:
2769 		if (enough && an->an_tx_upper > 0)
2770 			an->an_tx_upper--;
2771 		break;
2772 	case -1:
2773 		if (ni->ni_txrate > 0) {
2774 			ni->ni_txrate--;
2775 			sc->sc_stats.ast_rate_drop++;
2776 		}
2777 		an->an_tx_upper = 0;
2778 		break;
2779 	case 1:
2780 		if (++an->an_tx_upper < 2)
2781 			break;
2782 		an->an_tx_upper = 0;
2783 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2784 			ni->ni_txrate++;
2785 			sc->sc_stats.ast_rate_raise++;
2786 		}
2787 		break;
2788 	}
2789 
2790 	if (ni->ni_txrate != orate) {
2791 		DPRINTF(("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2792 		    __func__,
2793 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2794 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2795 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr));
2796 	}
2797 	if (ni->ni_txrate != orate || enough)
2798 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2799 }
2800 
2801 #ifdef AR_DEBUG
2802 static int
2803 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2804 {
2805 	char dmode[64];
2806 	int error;
2807 
2808 	strncpy(dmode, "", sizeof(dmode) - 1);
2809 	dmode[sizeof(dmode) - 1] = '\0';
2810 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2811 
2812 	if (error == 0 && req->newptr != NULL) {
2813 		struct ifnet *ifp;
2814 		struct ath_softc *sc;
2815 
2816 		ifp = ifunit("ath0");		/* XXX */
2817 		if (!ifp)
2818 			return EINVAL;
2819 		sc = ifp->if_softc;
2820 		if (strcmp(dmode, "hal") == 0)
2821 			ath_hal_dumpstate(sc->sc_ah);
2822 		else
2823 			return EINVAL;
2824 	}
2825 	return error;
2826 }
2827 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2828 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2829 
2830 static void
2831 ath_printrxbuf(struct ath_buf *bf, int done)
2832 {
2833 	struct ath_desc *ds;
2834 	int i;
2835 
2836 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2837 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2838 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2839 		    ds->ds_link, ds->ds_data,
2840 		    ds->ds_ctl0, ds->ds_ctl1,
2841 		    ds->ds_hw[0], ds->ds_hw[1],
2842 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2843 	}
2844 }
2845 
2846 static void
2847 ath_printtxbuf(struct ath_buf *bf, int done)
2848 {
2849 	struct ath_desc *ds;
2850 	int i;
2851 
2852 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2853 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2854 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2855 		    ds->ds_link, ds->ds_data,
2856 		    ds->ds_ctl0, ds->ds_ctl1,
2857 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2858 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2859 	}
2860 }
2861 #endif /* AR_DEBUG */
2862