xref: /freebsd/sys/dev/ath/if_ath.c (revision 2274d8c88547321ad1b9457d5561dea701aa41ac)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  *
43  * This software is derived from work of Atsushi Onoe; his contribution
44  * is greatly appreciated.
45  */
46 
47 #include "opt_inet.h"
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysctl.h>
52 #include <sys/mbuf.h>
53 #include <sys/malloc.h>
54 #include <sys/lock.h>
55 #include <sys/mutex.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/errno.h>
60 #include <sys/callout.h>
61 #include <sys/bus.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #include <net/ethernet.h>
71 #include <net/if_llc.h>
72 
73 #include <net80211/ieee80211_var.h>
74 
75 #include <net/bpf.h>
76 
77 #ifdef INET
78 #include <netinet/in.h>
79 #include <netinet/if_ether.h>
80 #endif
81 
82 #define	AR_DEBUG
83 #include <dev/ath/if_athvar.h>
84 #include <contrib/dev/ath/ah_desc.h>
85 
86 /* unalligned little endian access */
87 #define LE_READ_2(p)							\
88 	((u_int16_t)							\
89 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
90 #define LE_READ_4(p)							\
91 	((u_int32_t)							\
92 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
93 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
94 
95 static void	ath_init(void *);
96 static void	ath_stop(struct ifnet *);
97 static void	ath_start(struct ifnet *);
98 static void	ath_reset(struct ath_softc *);
99 static int	ath_media_change(struct ifnet *);
100 static void	ath_watchdog(struct ifnet *);
101 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
102 static void	ath_fatal_proc(void *, int);
103 static void	ath_rxorn_proc(void *, int);
104 static void	ath_bmiss_proc(void *, int);
105 static void	ath_initkeytable(struct ath_softc *);
106 static void	ath_mode_init(struct ath_softc *);
107 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
108 static void	ath_beacon_proc(void *, int);
109 static void	ath_beacon_free(struct ath_softc *);
110 static void	ath_beacon_config(struct ath_softc *);
111 static int	ath_desc_alloc(struct ath_softc *);
112 static void	ath_desc_free(struct ath_softc *);
113 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
114 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
115 static void	ath_node_copy(struct ieee80211com *,
116 			struct ieee80211_node *, const struct ieee80211_node *);
117 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
118 static void	ath_rx_proc(void *, int);
119 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
120 			     struct ath_buf *, struct mbuf *);
121 static void	ath_tx_proc(void *, int);
122 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
123 static void	ath_draintxq(struct ath_softc *);
124 static void	ath_stoprecv(struct ath_softc *);
125 static int	ath_startrecv(struct ath_softc *);
126 static void	ath_next_scan(void *);
127 static void	ath_calibrate(void *);
128 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
129 static void	ath_newassoc(struct ieee80211com *,
130 			struct ieee80211_node *, int);
131 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
132 
133 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
134 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
135 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
136 static void	ath_rate_ctl(void *, struct ieee80211_node *);
137 
138 SYSCTL_DECL(_hw_ath);
139 
140 /* XXX validate sysctl values */
141 static	int ath_dwelltime = 200;		/* 5 channels/second */
142 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
143 	    0, "channel dwell time (ms) for AP/station scanning");
144 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
145 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
146 	    0, "chip calibration interval (secs)");
147 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
148 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
149 	    0, "enable/disable outdoor operation");
150 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
151 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
152 	    0, "country code");
153 static	int ath_regdomain = 0;			/* regulatory domain */
154 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
155 	    0, "regulatory domain");
156 
157 #ifdef AR_DEBUG
158 int	ath_debug = 0;
159 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
160 	    0, "control debugging printfs");
161 #define	IFF_DUMPPKTS(_ifp) \
162 	(ath_debug || \
163 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
164 static	void ath_printrxbuf(struct ath_buf *bf, int);
165 static	void ath_printtxbuf(struct ath_buf *bf, int);
166 #define	DPRINTF(X)	if (ath_debug) printf X
167 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
168 #else
169 #define	IFF_DUMPPKTS(_ifp) \
170 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
171 #define	DPRINTF(X)
172 #define	DPRINTF2(X)
173 #endif
174 
175 int
176 ath_attach(u_int16_t devid, struct ath_softc *sc)
177 {
178 	struct ieee80211com *ic = &sc->sc_ic;
179 	struct ifnet *ifp = &ic->ic_if;
180 	struct ath_hal *ah;
181 	HAL_STATUS status;
182 	int error = 0;
183 
184 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
185 
186 	/* set these up early for if_printf use */
187 	ifp->if_unit = device_get_unit(sc->sc_dev);
188 	ifp->if_name = "ath";
189 
190 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
191 	if (ah == NULL) {
192 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
193 			status);
194 		error = ENXIO;
195 		goto bad;
196 	}
197 	sc->sc_ah = ah;
198 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
199 
200 	/*
201 	 * Collect the channel list using the default country
202 	 * code and including outdoor channels.  The 802.11 layer
203 	 * is resposible for filtering this list based on settings
204 	 * like the phy mode.
205 	 */
206 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
207 	if (error != 0)
208 		goto bad;
209 	/*
210 	 * Copy these back; they are set as a side effect
211 	 * of constructing the channel list.
212 	 */
213 	ath_regdomain = ath_hal_getregdomain(ah);
214 	ath_countrycode = ath_hal_getcountrycode(ah);
215 
216 	/*
217 	 * Setup rate tables for all potential media types.
218 	 */
219 	ath_rate_setup(sc, IEEE80211_MODE_11A);
220 	ath_rate_setup(sc, IEEE80211_MODE_11B);
221 	ath_rate_setup(sc, IEEE80211_MODE_11G);
222 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
223 
224 	error = ath_desc_alloc(sc);
225 	if (error != 0) {
226 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
227 		goto bad;
228 	}
229 	callout_init(&sc->sc_scan_ch, CALLOUT_MPSAFE);
230 	callout_init(&sc->sc_cal_ch, CALLOUT_MPSAFE);
231 
232 	mtx_init(&sc->sc_txbuflock,
233 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
234 	mtx_init(&sc->sc_txqlock,
235 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
236 
237 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
238 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
239 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
240 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
241 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
242 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
243 
244 	/*
245 	 * For now just pre-allocate one data queue and one
246 	 * beacon queue.  Note that the HAL handles resetting
247 	 * them at the needed time.  Eventually we'll want to
248 	 * allocate more tx queues for splitting management
249 	 * frames and for QOS support.
250 	 */
251 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
252 		HAL_TX_QUEUE_DATA,
253 		AH_TRUE			/* enable interrupts */
254 	);
255 	if (sc->sc_txhalq == (u_int) -1) {
256 		if_printf(ifp, "unable to setup a data xmit queue!\n");
257 		goto bad;
258 	}
259 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
260 		HAL_TX_QUEUE_BEACON,
261 		AH_TRUE			/* enable interrupts */
262 	);
263 	if (sc->sc_bhalq == (u_int) -1) {
264 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
265 		goto bad;
266 	}
267 
268 	ifp->if_softc = sc;
269 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
270 	ifp->if_start = ath_start;
271 	ifp->if_watchdog = ath_watchdog;
272 	ifp->if_ioctl = ath_ioctl;
273 	ifp->if_init = ath_init;
274 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
275 
276 	ic->ic_softc = sc;
277 	ic->ic_newassoc = ath_newassoc;
278 	/* XXX not right but it's not used anywhere important */
279 	ic->ic_phytype = IEEE80211_T_OFDM;
280 	ic->ic_opmode = IEEE80211_M_STA;
281 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP
282 		| IEEE80211_C_MONITOR;
283 	/* NB: 11g support is identified when we fetch the channel set */
284 	if (sc->sc_have11g)
285 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
286 
287 	/* get mac address from hardware */
288 	ath_hal_getmac(ah, ic->ic_myaddr);
289 
290 	/* call MI attach routine. */
291 	ieee80211_ifattach(ifp);
292 	/* override default methods */
293 	ic->ic_node_alloc = ath_node_alloc;
294 	ic->ic_node_free = ath_node_free;
295 	ic->ic_node_copy = ath_node_copy;
296 	sc->sc_newstate = ic->ic_newstate;
297 	ic->ic_newstate = ath_newstate;
298 	/* complete initialization */
299 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
300 
301 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
302 
303 	return 0;
304 bad:
305 	if (ah)
306 		ath_hal_detach(ah);
307 	sc->sc_invalid = 1;
308 	return error;
309 }
310 
311 int
312 ath_detach(struct ath_softc *sc)
313 {
314 	struct ifnet *ifp = &sc->sc_ic.ic_if;
315 
316 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
317 
318 	mtx_lock(&sc->sc_mtx);
319 	ath_stop(ifp);
320 	ath_desc_free(sc);
321 	ath_hal_detach(sc->sc_ah);
322 	ieee80211_ifdetach(ifp);
323 	mtx_unlock(&sc->sc_mtx);
324 	return 0;
325 }
326 
327 void
328 ath_suspend(struct ath_softc *sc)
329 {
330 	struct ifnet *ifp = &sc->sc_ic.ic_if;
331 
332 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
333 
334 	ath_stop(ifp);
335 }
336 
337 void
338 ath_resume(struct ath_softc *sc)
339 {
340 	struct ifnet *ifp = &sc->sc_ic.ic_if;
341 
342 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
343 
344 	if (ifp->if_flags & IFF_UP) {
345 		ath_init(ifp);
346 		if (ifp->if_flags & IFF_RUNNING)
347 			ath_start(ifp);
348 	}
349 }
350 
351 void
352 ath_shutdown(struct ath_softc *sc)
353 {
354 	struct ifnet *ifp = &sc->sc_ic.ic_if;
355 
356 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
357 
358 	ath_stop(ifp);
359 }
360 
361 void
362 ath_intr(void *arg)
363 {
364 	struct ath_softc *sc = arg;
365 	struct ieee80211com *ic = &sc->sc_ic;
366 	struct ifnet *ifp = &ic->ic_if;
367 	struct ath_hal *ah = sc->sc_ah;
368 	HAL_INT status;
369 
370 	if (sc->sc_invalid) {
371 		/*
372 		 * The hardware is not ready/present, don't touch anything.
373 		 * Note this can happen early on if the IRQ is shared.
374 		 */
375 		DPRINTF(("ath_intr: invalid; ignored\n"));
376 		return;
377 	}
378 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
379 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
380 		ath_hal_getisr(ah, &status);	/* clear ISR */
381 		ath_hal_intrset(ah, 0);		/* disable further intr's */
382 		return;
383 	}
384 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
385 	DPRINTF2(("ath_intr: status 0x%x\n", status));
386 #ifdef AR_DEBUG
387 	if (ath_debug &&
388 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
389 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
390 		ath_hal_dumpstate(ah);
391 	}
392 #endif /* AR_DEBUG */
393 	if (status & HAL_INT_FATAL) {
394 		sc->sc_stats.ast_hardware++;
395 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
396 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
397 	} else if (status & HAL_INT_RXORN) {
398 		sc->sc_stats.ast_rxorn++;
399 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
400 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
401 	} else {
402 		if (status & HAL_INT_RXEOL) {
403 			/*
404 			 * NB: the hardware should re-read the link when
405 			 *     RXE bit is written, but it doesn't work at
406 			 *     least on older hardware revs.
407 			 */
408 			sc->sc_stats.ast_rxeol++;
409 			sc->sc_rxlink = NULL;
410 		}
411 		if (status & HAL_INT_TXURN) {
412 			sc->sc_stats.ast_txurn++;
413 			/* bump tx trigger level */
414 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
415 		}
416 		if (status & HAL_INT_RX)
417 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
418 		if (status & HAL_INT_TX)
419 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
420 		if (status & HAL_INT_SWBA)
421 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
422 		if (status & HAL_INT_BMISS) {
423 			sc->sc_stats.ast_bmiss++;
424 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
425 		}
426 	}
427 }
428 
429 static void
430 ath_fatal_proc(void *arg, int pending)
431 {
432 	struct ath_softc *sc = arg;
433 
434 	device_printf(sc->sc_dev, "hardware error; resetting\n");
435 	ath_reset(sc);
436 }
437 
438 static void
439 ath_rxorn_proc(void *arg, int pending)
440 {
441 	struct ath_softc *sc = arg;
442 
443 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
444 	ath_reset(sc);
445 }
446 
447 static void
448 ath_bmiss_proc(void *arg, int pending)
449 {
450 	struct ath_softc *sc = arg;
451 	struct ieee80211com *ic = &sc->sc_ic;
452 
453 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
454 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
455 		("unexpect operating mode %u", ic->ic_opmode));
456 	if (ic->ic_state == IEEE80211_S_RUN)
457 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
458 }
459 
460 static u_int
461 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
462 {
463 	static const u_int modeflags[] = {
464 		0,			/* IEEE80211_MODE_AUTO */
465 		CHANNEL_A,		/* IEEE80211_MODE_11A */
466 		CHANNEL_B,		/* IEEE80211_MODE_11B */
467 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
468 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
469 	};
470 	return modeflags[ieee80211_chan2mode(ic, chan)];
471 }
472 
473 static void
474 ath_init(void *arg)
475 {
476 	struct ath_softc *sc = (struct ath_softc *) arg;
477 	struct ieee80211com *ic = &sc->sc_ic;
478 	struct ifnet *ifp = &ic->ic_if;
479 	struct ieee80211_node *ni;
480 	enum ieee80211_phymode mode;
481 	struct ath_hal *ah = sc->sc_ah;
482 	HAL_STATUS status;
483 	HAL_CHANNEL hchan;
484 
485 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
486 
487 	mtx_lock(&sc->sc_mtx);
488 	/*
489 	 * Stop anything previously setup.  This is safe
490 	 * whether this is the first time through or not.
491 	 */
492 	ath_stop(ifp);
493 
494 	/*
495 	 * The basic interface to setting the hardware in a good
496 	 * state is ``reset''.  On return the hardware is known to
497 	 * be powered up and with interrupts disabled.  This must
498 	 * be followed by initialization of the appropriate bits
499 	 * and then setup of the interrupt mask.
500 	 */
501 	hchan.channel = ic->ic_ibss_chan->ic_freq;
502 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
503 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
504 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
505 			status);
506 		goto done;
507 	}
508 
509 	/*
510 	 * Setup the hardware after reset: the key cache
511 	 * is filled as needed and the receive engine is
512 	 * set going.  Frame transmit is handled entirely
513 	 * in the frame output path; there's nothing to do
514 	 * here except setup the interrupt mask.
515 	 */
516 	if (ic->ic_flags & IEEE80211_F_WEPON)
517 		ath_initkeytable(sc);
518 	if (ath_startrecv(sc) != 0) {
519 		if_printf(ifp, "unable to start recv logic\n");
520 		goto done;
521 	}
522 
523 	/*
524 	 * Enable interrupts.
525 	 */
526 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
527 		  | HAL_INT_RXEOL | HAL_INT_RXORN
528 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
529 	ath_hal_intrset(ah, sc->sc_imask);
530 
531 	ifp->if_flags |= IFF_RUNNING;
532 	ic->ic_state = IEEE80211_S_INIT;
533 
534 	/*
535 	 * The hardware should be ready to go now so it's safe
536 	 * to kick the 802.11 state machine as it's likely to
537 	 * immediately call back to us to send mgmt frames.
538 	 */
539 	ni = ic->ic_bss;
540 	ni->ni_chan = ic->ic_ibss_chan;
541 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
542 	if (mode != sc->sc_curmode)
543 		ath_setcurmode(sc, mode);
544 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
545 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
546 	else
547 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
548 done:
549 	mtx_unlock(&sc->sc_mtx);
550 }
551 
552 static void
553 ath_stop(struct ifnet *ifp)
554 {
555 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
556 	struct ath_softc *sc = ifp->if_softc;
557 	struct ath_hal *ah = sc->sc_ah;
558 
559 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
560 		sc->sc_invalid, ifp->if_flags));
561 
562 	mtx_lock(&sc->sc_mtx);
563 	if (ifp->if_flags & IFF_RUNNING) {
564 		/*
565 		 * Shutdown the hardware and driver:
566 		 *    disable interrupts
567 		 *    turn off timers
568 		 *    clear transmit machinery
569 		 *    clear receive machinery
570 		 *    drain and release tx queues
571 		 *    reclaim beacon resources
572 		 *    reset 802.11 state machine
573 		 *    power down hardware
574 		 *
575 		 * Note that some of this work is not possible if the
576 		 * hardware is gone (invalid).
577 		 */
578 		ifp->if_flags &= ~IFF_RUNNING;
579 		ifp->if_timer = 0;
580 		if (!sc->sc_invalid)
581 			ath_hal_intrset(ah, 0);
582 		ath_draintxq(sc);
583 		if (!sc->sc_invalid)
584 			ath_stoprecv(sc);
585 		else
586 			sc->sc_rxlink = NULL;
587 		IF_DRAIN(&ifp->if_snd);
588 		ath_beacon_free(sc);
589 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
590 		if (!sc->sc_invalid)
591 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
592 	}
593 	mtx_unlock(&sc->sc_mtx);
594 }
595 
596 /*
597  * Reset the hardware w/o losing operational state.  This is
598  * basically a more efficient way of doing ath_stop, ath_init,
599  * followed by state transitions to the current 802.11
600  * operational state.  Used to recover from errors rx overrun
601  * and to reset the hardware when rf gain settings must be reset.
602  */
603 static void
604 ath_reset(struct ath_softc *sc)
605 {
606 	struct ieee80211com *ic = &sc->sc_ic;
607 	struct ifnet *ifp = &ic->ic_if;
608 	struct ath_hal *ah = sc->sc_ah;
609 	struct ieee80211_channel *c;
610 	HAL_STATUS status;
611 	HAL_CHANNEL hchan;
612 
613 	/*
614 	 * Convert to a HAL channel description with the flags
615 	 * constrained to reflect the current operating mode.
616 	 */
617 	c = ic->ic_ibss_chan;
618 	hchan.channel = c->ic_freq;
619 	hchan.channelFlags = ath_chan2flags(ic, c);
620 
621 	ath_hal_intrset(ah, 0);		/* disable interrupts */
622 	ath_draintxq(sc);		/* stop xmit side */
623 	ath_stoprecv(sc);		/* stop recv side */
624 	/* NB: indicate channel change so we do a full reset */
625 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
626 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
627 			__func__, status);
628 	ath_hal_intrset(ah, sc->sc_imask);
629 	if (ath_startrecv(sc) != 0)	/* restart recv */
630 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
631 	ath_start(ifp);			/* restart xmit */
632 	if (ic->ic_state == IEEE80211_S_RUN)
633 		ath_beacon_config(sc);	/* restart beacons */
634 }
635 
636 static void
637 ath_start(struct ifnet *ifp)
638 {
639 	struct ath_softc *sc = ifp->if_softc;
640 	struct ath_hal *ah = sc->sc_ah;
641 	struct ieee80211com *ic = &sc->sc_ic;
642 	struct ieee80211_node *ni;
643 	struct ath_buf *bf;
644 	struct mbuf *m;
645 	struct ieee80211_frame *wh;
646 
647 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
648 		return;
649 	for (;;) {
650 		/*
651 		 * Grab a TX buffer and associated resources.
652 		 */
653 		mtx_lock(&sc->sc_txbuflock);
654 		bf = TAILQ_FIRST(&sc->sc_txbuf);
655 		if (bf != NULL)
656 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
657 		mtx_unlock(&sc->sc_txbuflock);
658 		if (bf == NULL) {
659 			DPRINTF(("ath_start: out of xmit buffers\n"));
660 			sc->sc_stats.ast_tx_qstop++;
661 			ifp->if_flags |= IFF_OACTIVE;
662 			break;
663 		}
664 		/*
665 		 * Poll the management queue for frames; they
666 		 * have priority over normal data frames.
667 		 */
668 		IF_DEQUEUE(&ic->ic_mgtq, m);
669 		if (m == NULL) {
670 			/*
671 			 * No data frames go out unless we're associated.
672 			 */
673 			if (ic->ic_state != IEEE80211_S_RUN) {
674 				DPRINTF(("ath_start: ignore data packet, "
675 					"state %u\n", ic->ic_state));
676 				sc->sc_stats.ast_tx_discard++;
677 				mtx_lock(&sc->sc_txbuflock);
678 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
679 				mtx_unlock(&sc->sc_txbuflock);
680 				break;
681 			}
682 			IF_DEQUEUE(&ifp->if_snd, m);
683 			if (m == NULL) {
684 				mtx_lock(&sc->sc_txbuflock);
685 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
686 				mtx_unlock(&sc->sc_txbuflock);
687 				break;
688 			}
689 			ifp->if_opackets++;
690 			BPF_MTAP(ifp, m);
691 			/*
692 			 * Encapsulate the packet in prep for transmission.
693 			 */
694 			m = ieee80211_encap(ifp, m);
695 			if (m == NULL) {
696 				DPRINTF(("ath_start: encapsulation failure\n"));
697 				sc->sc_stats.ast_tx_encap++;
698 				goto bad;
699 			}
700 			wh = mtod(m, struct ieee80211_frame *);
701 			if (ic->ic_flags & IEEE80211_F_WEPON)
702 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
703 		} else {
704 			wh = mtod(m, struct ieee80211_frame *);
705 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
706 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
707 				/* fill time stamp */
708 				u_int64_t tsf;
709 				u_int32_t *tstamp;
710 
711 				tsf = ath_hal_gettsf64(ah);
712 				/* XXX: adjust 100us delay to xmit */
713 				tsf += 100;
714 				tstamp = (u_int32_t *)&wh[1];
715 				tstamp[0] = htole32(tsf & 0xffffffff);
716 				tstamp[1] = htole32(tsf >> 32);
717 			}
718 			sc->sc_stats.ast_tx_mgmt++;
719 		}
720 		if (ic->ic_rawbpf)
721 			bpf_mtap(ic->ic_rawbpf, m);
722 
723 		if (ic->ic_opmode != IEEE80211_M_STA) {
724 			ni = ieee80211_find_node(ic, wh->i_addr1);
725 			if (ni == NULL) {
726 				/*
727 				 * When not in station mode the destination
728 				 * address should always be in the node table
729 				 * unless this is a multicast/broadcast frame.
730 				 */
731 				if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
732 				    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
733 				    IEEE80211_FC0_TYPE_DATA) {
734 					m_freem(m);
735 					sc->sc_stats.ast_tx_nonode++;
736 					goto bad;
737 				}
738 				ni = ic->ic_bss;
739 			}
740 		} else
741 			ni = ic->ic_bss;
742 
743 		/*
744 		 * TODO:
745 		 * The duration field of 802.11 header should be filled.
746 		 * XXX This may be done in the ieee80211 layer, but the upper
747 		 *     doesn't know the detail of parameters such as IFS
748 		 *     for now..
749 		 */
750 
751 		if (IFF_DUMPPKTS(ifp))
752 			ieee80211_dump_pkt(mtod(m, u_int8_t *), m->m_len,
753 			    ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL,
754 			    -1);
755 
756 		if (ath_tx_start(sc, ni, bf, m)) {
757 	bad:
758 			mtx_lock(&sc->sc_txbuflock);
759 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
760 			mtx_unlock(&sc->sc_txbuflock);
761 			ifp->if_oerrors++;
762 			continue;
763 		}
764 
765 		sc->sc_tx_timer = 5;
766 		ifp->if_timer = 1;
767 	}
768 }
769 
770 static int
771 ath_media_change(struct ifnet *ifp)
772 {
773 	int error;
774 
775 	error = ieee80211_media_change(ifp);
776 	if (error == ENETRESET) {
777 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
778 		    (IFF_RUNNING|IFF_UP))
779 			ath_init(ifp);		/* XXX lose error */
780 		error = 0;
781 	}
782 	return error;
783 }
784 
785 static void
786 ath_watchdog(struct ifnet *ifp)
787 {
788 	struct ath_softc *sc = ifp->if_softc;
789 	struct ieee80211com *ic = &sc->sc_ic;
790 
791 	ifp->if_timer = 0;
792 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
793 		return;
794 	if (sc->sc_tx_timer) {
795 		if (--sc->sc_tx_timer == 0) {
796 			if_printf(ifp, "device timeout\n");
797 #ifdef AR_DEBUG
798 			if (ath_debug)
799 				ath_hal_dumpstate(sc->sc_ah);
800 #endif /* AR_DEBUG */
801 			ath_init(ifp);		/* XXX ath_reset??? */
802 			ifp->if_oerrors++;
803 			sc->sc_stats.ast_watchdog++;
804 			return;
805 		}
806 		ifp->if_timer = 1;
807 	}
808 	if (ic->ic_fixed_rate == -1) {
809 		/*
810 		 * Run the rate control algorithm if we're not
811 		 * locked at a fixed rate.
812 		 */
813 		if (ic->ic_opmode == IEEE80211_M_STA)
814 			ath_rate_ctl(sc, ic->ic_bss);
815 		else
816 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
817 	}
818 	ieee80211_watchdog(ifp);
819 }
820 
821 static int
822 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
823 {
824 	struct ath_softc *sc = ifp->if_softc;
825 	struct ifreq *ifr = (struct ifreq *)data;
826 	int error = 0;
827 
828 	mtx_lock(&sc->sc_mtx);
829 	switch (cmd) {
830 	case SIOCSIFFLAGS:
831 		if (ifp->if_flags & IFF_UP) {
832 			if (ifp->if_flags & IFF_RUNNING) {
833 				/*
834 				 * To avoid rescanning another access point,
835 				 * do not call ath_init() here.  Instead,
836 				 * only reflect promisc mode settings.
837 				 */
838 				ath_mode_init(sc);
839 			} else
840 				ath_init(ifp);		/* XXX lose error */
841 		} else
842 			ath_stop(ifp);
843 		break;
844 	case SIOCADDMULTI:
845 	case SIOCDELMULTI:
846 		/*
847 		 * The upper layer has already installed/removed
848 		 * the multicast address(es), just recalculate the
849 		 * multicast filter for the card.
850 		 */
851 		if (ifp->if_flags & IFF_RUNNING)
852 			ath_mode_init(sc);
853 		break;
854 	case SIOCGATHSTATS:
855 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
856 		break;
857 	default:
858 		error = ieee80211_ioctl(ifp, cmd, data);
859 		if (error == ENETRESET) {
860 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
861 			    (IFF_RUNNING|IFF_UP))
862 				ath_init(ifp);		/* XXX lose error */
863 			error = 0;
864 		}
865 		break;
866 	}
867 	mtx_unlock(&sc->sc_mtx);
868 	return error;
869 }
870 
871 /*
872  * Fill the hardware key cache with key entries.
873  */
874 static void
875 ath_initkeytable(struct ath_softc *sc)
876 {
877 	struct ieee80211com *ic = &sc->sc_ic;
878 	struct ath_hal *ah = sc->sc_ah;
879 	int i;
880 
881 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
882 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
883 		if (k->wk_len == 0)
884 			ath_hal_keyreset(ah, i);
885 		else
886 			/* XXX return value */
887 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
888 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
889 	}
890 }
891 
892 static void
893 ath_mode_init(struct ath_softc *sc)
894 {
895 	struct ieee80211com *ic = &sc->sc_ic;
896 	struct ath_hal *ah = sc->sc_ah;
897 	struct ifnet *ifp = &ic->ic_if;
898 	u_int32_t rfilt, mfilt[2], val;
899 	u_int8_t pos;
900 	struct ifmultiaddr *ifma;
901 
902 	/* configure operational mode */
903 	ath_hal_setopmode(ah, ic->ic_opmode);
904 
905 	/* receive filter */
906 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
907 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
908 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
909 	    (ifp->if_flags & IFF_PROMISC))
910 		rfilt |= HAL_RX_FILTER_PROM;
911 	if (ic->ic_state == IEEE80211_S_SCAN)
912 		rfilt |= HAL_RX_FILTER_BEACON;
913 	ath_hal_setrxfilter(ah, rfilt);
914 
915 	/* calculate and install multicast filter */
916 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
917 		mfilt[0] = mfilt[1] = 0;
918 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
919 			caddr_t dl;
920 
921 			/* calculate XOR of eight 6bit values */
922 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
923 			val = LE_READ_4(dl + 0);
924 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
925 			val = LE_READ_4(dl + 3);
926 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
927 			pos &= 0x3f;
928 			mfilt[pos / 32] |= (1 << (pos % 32));
929 		}
930 	} else {
931 		mfilt[0] = mfilt[1] = ~0;
932 	}
933 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
934 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
935 		rfilt, mfilt[0], mfilt[1]));
936 }
937 
938 static void
939 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
940 {
941 	struct ath_buf *bf = arg;
942 
943 	KASSERT(nseg <= ATH_MAX_SCATTER,
944 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
945 	bf->bf_mapsize = mapsize;
946 	bf->bf_nseg = nseg;
947 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
948 }
949 
950 static int
951 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
952 {
953 	struct ieee80211com *ic = &sc->sc_ic;
954 	struct ifnet *ifp = &ic->ic_if;
955 	struct ath_hal *ah = sc->sc_ah;
956 	struct ieee80211_frame *wh;
957 	struct ath_buf *bf;
958 	struct ath_desc *ds;
959 	struct mbuf *m;
960 	int error, pktlen;
961 	u_int8_t *frm, rate;
962 	u_int16_t capinfo;
963 	struct ieee80211_rateset *rs;
964 	const HAL_RATE_TABLE *rt;
965 
966 	bf = sc->sc_bcbuf;
967 	if (bf->bf_m != NULL) {
968 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
969 		m_freem(bf->bf_m);
970 		bf->bf_m = NULL;
971 		bf->bf_node = NULL;
972 	}
973 	/*
974 	 * NB: the beacon data buffer must be 32-bit aligned;
975 	 * we assume the mbuf routines will return us something
976 	 * with this alignment (perhaps should assert).
977 	 */
978 	rs = &ni->ni_rates;
979 	pktlen = 8 + 2 + 2+ 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
980 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
981 		pktlen += 2;
982 	if (pktlen <= MHLEN)
983 		MGETHDR(m, M_DONTWAIT, MT_DATA);
984 	else
985 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
986 	if (m == NULL) {
987 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
988 			pktlen));
989 		sc->sc_stats.ast_be_nombuf++;
990 		return ENOMEM;
991 	}
992 
993 	wh = mtod(m, struct ieee80211_frame *);
994 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
995 	    IEEE80211_FC0_SUBTYPE_BEACON;
996 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
997 	*(u_int16_t *)wh->i_dur = 0;
998 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
999 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1000 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1001 	*(u_int16_t *)wh->i_seq = 0;
1002 
1003 	/*
1004 	 * beacon frame format
1005 	 *	[8] time stamp
1006 	 *	[2] beacon interval
1007 	 *	[2] cabability information
1008 	 *	[tlv] ssid
1009 	 *	[tlv] supported rates
1010 	 *	[tlv] parameter set (IBSS)
1011 	 *	[tlv] extended supported rates
1012 	 */
1013 	frm = (u_int8_t *)&wh[1];
1014 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1015 	frm += 8;
1016 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1017 	frm += 2;
1018 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1019 		capinfo = IEEE80211_CAPINFO_IBSS;
1020 	else
1021 		capinfo = IEEE80211_CAPINFO_ESS;
1022 	if (ic->ic_flags & IEEE80211_F_WEPON)
1023 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1024 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1025 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1026 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1027 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1028 	*(u_int16_t *)frm = htole16(capinfo);
1029 	frm += 2;
1030 	*frm++ = IEEE80211_ELEMID_SSID;
1031 	*frm++ = ni->ni_esslen;
1032 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1033 	frm += ni->ni_esslen;
1034 	frm = ieee80211_add_rates(frm, rs);
1035 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1036 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1037 		*frm++ = 2;
1038 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1039 	} else {
1040 		/* TODO: TIM */
1041 		*frm++ = IEEE80211_ELEMID_TIM;
1042 		*frm++ = 4;	/* length */
1043 		*frm++ = 0;	/* DTIM count */
1044 		*frm++ = 1;	/* DTIM period */
1045 		*frm++ = 0;	/* bitmap control */
1046 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1047 	}
1048 	frm = ieee80211_add_xrates(frm, rs);
1049 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1050 
1051 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1052 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1053 				     ath_mbuf_load_cb, bf,
1054 				     BUS_DMA_NOWAIT);
1055 	if (error != 0) {
1056 		m_freem(m);
1057 		return error;
1058 	}
1059 	KASSERT(bf->bf_nseg == 1,
1060 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1061 		bf->bf_nseg));
1062 	bf->bf_m = m;
1063 
1064 	/* setup descriptors */
1065 	ds = bf->bf_desc;
1066 
1067 	ds->ds_link = 0;
1068 	ds->ds_data = bf->bf_segs[0].ds_addr;
1069 	/* XXX verify mbuf data area covers this roundup */
1070 	/*
1071 	 * Calculate rate code.
1072 	 * XXX everything at min xmit rate
1073 	 */
1074 	rt = sc->sc_currates;
1075 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1076 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1077 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1078 	else
1079 		rate = rt->info[0].rateCode;
1080 	ath_hal_setuptxdesc(ah, ds
1081 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1082 		, sizeof(struct ieee80211_frame)	/* header length */
1083 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1084 		, 0x20				/* txpower XXX */
1085 		, rate, 1			/* series 0 rate/tries */
1086 		, HAL_TXKEYIX_INVALID		/* no encryption */
1087 		, 0				/* antenna mode */
1088 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1089 		, 0				/* rts/cts rate */
1090 		, 0				/* rts/cts duration */
1091 	);
1092 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1093 	ath_hal_filltxdesc(ah, ds
1094 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1095 		, AH_TRUE				/* first segment */
1096 		, AH_TRUE				/* last segment */
1097 	);
1098 
1099 	return 0;
1100 }
1101 
1102 static void
1103 ath_beacon_proc(void *arg, int pending)
1104 {
1105 	struct ath_softc *sc = arg;
1106 	struct ieee80211com *ic = &sc->sc_ic;
1107 	struct ath_buf *bf = sc->sc_bcbuf;
1108 	struct ath_hal *ah = sc->sc_ah;
1109 
1110 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1111 	if (ic->ic_opmode == IEEE80211_M_STA || bf == NULL || bf->bf_m == NULL) {
1112 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1113 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1114 		return;
1115 	}
1116 	/* update beacon to reflect PS poll state */
1117 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1118 		DPRINTF(("%s: beacon queue %u did not stop?",
1119 			__func__, sc->sc_bhalq));
1120 		return;			/* busy, XXX is this right? */
1121 	}
1122 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1123 
1124 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1125 	ath_hal_txstart(ah, sc->sc_bhalq);
1126 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1127 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1128 }
1129 
1130 static void
1131 ath_beacon_free(struct ath_softc *sc)
1132 {
1133 	struct ath_buf *bf = sc->sc_bcbuf;
1134 
1135 	if (bf->bf_m != NULL) {
1136 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1137 		m_freem(bf->bf_m);
1138 		bf->bf_m = NULL;
1139 		bf->bf_node = NULL;
1140 	}
1141 }
1142 
1143 /*
1144  * Configure the beacon and sleep timers.
1145  *
1146  * When operating as an AP this resets the TSF and sets
1147  * up the hardware to notify us when we need to issue beacons.
1148  *
1149  * When operating in station mode this sets up the beacon
1150  * timers according to the timestamp of the last received
1151  * beacon and the current TSF, configures PCF and DTIM
1152  * handling, programs the sleep registers so the hardware
1153  * will wakeup in time to receive beacons, and configures
1154  * the beacon miss handling so we'll receive a BMISS
1155  * interrupt when we stop seeing beacons from the AP
1156  * we've associated with.
1157  */
1158 static void
1159 ath_beacon_config(struct ath_softc *sc)
1160 {
1161 	struct ath_hal *ah = sc->sc_ah;
1162 	struct ieee80211com *ic = &sc->sc_ic;
1163 	struct ieee80211_node *ni = ic->ic_bss;
1164 	u_int32_t nexttbtt;
1165 
1166 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1167 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1168 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1169 	nexttbtt += ni->ni_intval;
1170 	if (ic->ic_opmode == IEEE80211_M_STA) {
1171 		HAL_BEACON_STATE bs;
1172 		u_int32_t bmisstime;
1173 
1174 		/* NB: no PCF support right now */
1175 		memset(&bs, 0, sizeof(bs));
1176 		bs.bs_intval = ni->ni_intval;
1177 		bs.bs_nexttbtt = nexttbtt;
1178 		bs.bs_dtimperiod = bs.bs_intval;
1179 		bs.bs_nextdtim = nexttbtt;
1180 		/*
1181 		 * Calculate the number of consecutive beacons to miss
1182 		 * before taking a BMISS interrupt.  The configuration
1183 		 * is specified in ms, so we need to convert that to
1184 		 * TU's and then calculate based on the beacon interval.
1185 		 * Note that we clamp the result to at most 10 beacons.
1186 		 */
1187 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1188 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1189 		if (bs.bs_bmissthreshold > 10)
1190 			bs.bs_bmissthreshold = 10;
1191 		else if (bs.bs_bmissthreshold <= 0)
1192 			bs.bs_bmissthreshold = 1;
1193 
1194 		/*
1195 		 * Calculate sleep duration.  The configuration is
1196 		 * given in ms.  We insure a multiple of the beacon
1197 		 * period is used.  Also, if the sleep duration is
1198 		 * greater than the DTIM period then it makes senses
1199 		 * to make it a multiple of that.
1200 		 *
1201 		 * XXX fixed at 100ms
1202 		 */
1203 		bs.bs_sleepduration =
1204 			roundup((100 * 1000) / 1024, bs.bs_intval);
1205 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1206 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1207 
1208 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1209 			, __func__
1210 			, bs.bs_intval
1211 			, bs.bs_nexttbtt
1212 			, bs.bs_dtimperiod
1213 			, bs.bs_nextdtim
1214 			, bs.bs_bmissthreshold
1215 			, bs.bs_sleepduration
1216 		));
1217 		ath_hal_intrset(ah, 0);
1218 		/*
1219 		 * Reset our tsf so the hardware will update the
1220 		 * tsf register to reflect timestamps found in
1221 		 * received beacons.
1222 		 */
1223 		ath_hal_resettsf(ah);
1224 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1225 		sc->sc_imask |= HAL_INT_BMISS;
1226 		ath_hal_intrset(ah, sc->sc_imask);
1227 	} else {
1228 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1229 			__func__, ni->ni_intval, nexttbtt));
1230 		ath_hal_intrset(ah, 0);
1231 		ath_hal_beaconinit(ah, ic->ic_opmode,
1232 			nexttbtt, ni->ni_intval);
1233 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1234 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1235 		ath_hal_intrset(ah, sc->sc_imask);
1236 	}
1237 }
1238 
1239 static void
1240 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1241 {
1242 	bus_addr_t *paddr = (bus_addr_t*) arg;
1243 	*paddr = segs->ds_addr;
1244 }
1245 
1246 static int
1247 ath_desc_alloc(struct ath_softc *sc)
1248 {
1249 	int i, bsize, error;
1250 	struct ath_desc *ds;
1251 	struct ath_buf *bf;
1252 
1253 	/* allocate descriptors */
1254 	sc->sc_desc_len = sizeof(struct ath_desc) *
1255 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1256 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1257 	if (error != 0)
1258 		return error;
1259 
1260 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1261 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1262 	if (error != 0)
1263 		goto fail0;
1264 
1265 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1266 				sc->sc_desc, sc->sc_desc_len,
1267 				ath_load_cb, &sc->sc_desc_paddr,
1268 				BUS_DMA_NOWAIT);
1269 	if (error != 0)
1270 		goto fail1;
1271 
1272 	ds = sc->sc_desc;
1273 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1274 	    ds, sc->sc_desc_len,
1275 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1276 
1277 	/* allocate buffers */
1278 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1279 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1280 	if (bf == NULL)
1281 		goto fail2;
1282 	sc->sc_bufptr = bf;
1283 
1284 	TAILQ_INIT(&sc->sc_rxbuf);
1285 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1286 		bf->bf_desc = ds;
1287 		bf->bf_daddr = sc->sc_desc_paddr +
1288 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1289 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1290 					  &bf->bf_dmamap);
1291 		if (error != 0)
1292 			break;
1293 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1294 	}
1295 
1296 	TAILQ_INIT(&sc->sc_txbuf);
1297 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1298 		bf->bf_desc = ds;
1299 		bf->bf_daddr = sc->sc_desc_paddr +
1300 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1301 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1302 					  &bf->bf_dmamap);
1303 		if (error != 0)
1304 			break;
1305 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1306 	}
1307 	TAILQ_INIT(&sc->sc_txq);
1308 
1309 	/* beacon buffer */
1310 	bf->bf_desc = ds;
1311 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1312 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1313 	if (error != 0)
1314 		return error;
1315 	sc->sc_bcbuf = bf;
1316 	return 0;
1317 
1318 fail2:
1319 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1320 fail1:
1321 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1322 fail0:
1323 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1324 	sc->sc_ddmamap = NULL;
1325 	return error;
1326 }
1327 
1328 static void
1329 ath_desc_free(struct ath_softc *sc)
1330 {
1331 	struct ath_buf *bf;
1332 
1333 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1334 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1335 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1336 
1337 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1338 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1339 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1340 		m_freem(bf->bf_m);
1341 	}
1342 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1343 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1344 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1345 		if (bf->bf_m) {
1346 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1347 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1348 			m_freem(bf->bf_m);
1349 			bf->bf_m = NULL;
1350 		}
1351 	}
1352 	if (sc->sc_bcbuf != NULL) {
1353 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1354 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1355 		sc->sc_bcbuf = NULL;
1356 	}
1357 
1358 	TAILQ_INIT(&sc->sc_rxbuf);
1359 	TAILQ_INIT(&sc->sc_txbuf);
1360 	TAILQ_INIT(&sc->sc_txq);
1361 	free(sc->sc_bufptr, M_DEVBUF);
1362 	sc->sc_bufptr = NULL;
1363 }
1364 
1365 static struct ieee80211_node *
1366 ath_node_alloc(struct ieee80211com *ic)
1367 {
1368 	struct ath_node *an =
1369 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1370 	return an ? &an->st_node : NULL;
1371 }
1372 
1373 static void
1374 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1375 {
1376         struct ath_softc *sc = ic->ic_if.if_softc;
1377 	struct ath_buf *bf;
1378 
1379 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1380 		if (bf->bf_node == ni)
1381 			bf->bf_node = NULL;
1382 	}
1383 	free(ni, M_DEVBUF);
1384 }
1385 
1386 static void
1387 ath_node_copy(struct ieee80211com *ic,
1388 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1389 {
1390 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1391 }
1392 
1393 static int
1394 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1395 {
1396 	struct ath_hal *ah = sc->sc_ah;
1397 	int error;
1398 	struct mbuf *m;
1399 	struct ath_desc *ds;
1400 
1401 	m = bf->bf_m;
1402 	if (m == NULL) {
1403 		/*
1404 		 * NB: by assigning a page to the rx dma buffer we
1405 		 * implicitly satisfy the Atheros requirement that
1406 		 * this buffer be cache-line-aligned and sized to be
1407 		 * multiple of the cache line size.  Not doing this
1408 		 * causes weird stuff to happen (for the 5210 at least).
1409 		 */
1410 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1411 		if (m == NULL) {
1412 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1413 			sc->sc_stats.ast_rx_nombuf++;
1414 			return ENOMEM;
1415 		}
1416 		bf->bf_m = m;
1417 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1418 
1419 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1420 					     ath_mbuf_load_cb, bf,
1421 					     BUS_DMA_NOWAIT);
1422 		if (error != 0) {
1423 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1424 				" error %d\n", error));
1425 			sc->sc_stats.ast_rx_busdma++;
1426 			return error;
1427 		}
1428 		KASSERT(bf->bf_nseg == 1,
1429 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1430 			bf->bf_nseg));
1431 	}
1432 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1433 
1434 	/* setup descriptors */
1435 	ds = bf->bf_desc;
1436 	ds->ds_link = 0;
1437 	ds->ds_data = bf->bf_segs[0].ds_addr;
1438 	ath_hal_setuprxdesc(ah, ds
1439 		, m->m_len		/* buffer size */
1440 		, 0
1441 	);
1442 
1443 	if (sc->sc_rxlink != NULL)
1444 		*sc->sc_rxlink = bf->bf_daddr;
1445 	sc->sc_rxlink = &ds->ds_link;
1446 	return 0;
1447 }
1448 
1449 static void
1450 ath_rx_proc(void *arg, int npending)
1451 {
1452 	struct ath_softc *sc = arg;
1453 	struct ath_buf *bf;
1454 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1455 	struct ath_hal *ah = sc->sc_ah;
1456 	struct ath_desc *ds;
1457 	struct mbuf *m;
1458 	struct ieee80211_frame *wh, whbuf;
1459 	int len;
1460 	u_int phyerr;
1461 	HAL_STATUS status;
1462 
1463 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1464 	do {
1465 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1466 		if (bf == NULL) {		/* NB: shouldn't happen */
1467 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1468 			break;
1469 		}
1470 		m = bf->bf_m;
1471 		if (m == NULL) {		/* NB: shouldn't happen */
1472 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1473 			continue;
1474 		}
1475 		ds = bf->bf_desc;
1476 		status = ath_hal_rxprocdesc(ah, ds);
1477 #ifdef AR_DEBUG
1478 		if (ath_debug > 1)
1479 			ath_printrxbuf(bf, status == HAL_OK);
1480 #endif
1481 		if (status == HAL_EINPROGRESS)
1482 			break;
1483 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1484 		if (ds->ds_rxstat.rs_status != 0) {
1485 			ifp->if_ierrors++;
1486 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1487 				sc->sc_stats.ast_rx_crcerr++;
1488 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1489 				sc->sc_stats.ast_rx_fifoerr++;
1490 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1491 				sc->sc_stats.ast_rx_badcrypt++;
1492 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1493 				sc->sc_stats.ast_rx_phyerr++;
1494 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1495 				sc->sc_stats.ast_rx_phy[phyerr]++;
1496 			}
1497 			goto rx_next;
1498 		}
1499 
1500 		len = ds->ds_rxstat.rs_datalen;
1501 		if (len < sizeof(struct ieee80211_frame)) {
1502 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1503 			goto rx_next;
1504 		}
1505 
1506 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1507 		    BUS_DMASYNC_POSTREAD);
1508 
1509 		wh = mtod(m, struct ieee80211_frame *);
1510 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1511 		    IEEE80211_FC0_TYPE_CTL) {
1512 			/*
1513 			 * Ignore control frame received in promisc mode.
1514 			 */
1515 			DPRINTF(("ath_rx_proc: control frame\n"));
1516 			goto rx_next;
1517 		}
1518 
1519 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1520 		bf->bf_m = NULL;
1521 		m->m_pkthdr.rcvif = ifp;
1522 		m->m_pkthdr.len = m->m_len = len;
1523 		if (IFF_DUMPPKTS(ifp)) {
1524 			struct ieee80211com *ic = &sc->sc_ic;
1525 			const HAL_RATE_TABLE *rt = sc->sc_rates[ic->ic_curmode];
1526 			ieee80211_dump_pkt(mtod(m, u_int8_t *), len,
1527 				rt ? rt->info[rt->rateCodeToIndex[ds->ds_rxstat.rs_rate]].dot11Rate & IEEE80211_RATE_VAL : 0,
1528 				ds->ds_rxstat.rs_rssi);
1529 		}
1530 		m_adj(m, -IEEE80211_CRC_LEN);
1531 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1532 			/*
1533 			 * WEP is decrypted by hardware. Clear WEP bit
1534 			 * and trim WEP header for ieee80211_input().
1535 			 */
1536 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1537 			memcpy(&whbuf, wh, sizeof(whbuf));
1538 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1539 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
1540 			/*
1541 			 * Also trim WEP ICV from the tail.
1542 			 */
1543 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1544 		}
1545 		ieee80211_input(ifp, m,
1546 			ds->ds_rxstat.rs_rssi,
1547 			ds->ds_rxstat.rs_tstamp,
1548 			ds->ds_rxstat.rs_antenna);
1549   rx_next:
1550 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1551 	} while (ath_rxbuf_init(sc, bf) == 0);
1552 
1553 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1554 	ath_hal_rxena(ah);			/* in case of RXEOL */
1555 }
1556 
1557 /*
1558  * XXX Size of an ACK control frame in bytes.
1559  */
1560 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1561 
1562 static int
1563 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1564     struct mbuf *m0)
1565 {
1566 	struct ieee80211com *ic = &sc->sc_ic;
1567 	struct ath_hal *ah = sc->sc_ah;
1568 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1569 	int i, error, iswep, hdrlen, pktlen;
1570 	u_int8_t rix, cix, txrate, ctsrate;
1571 	struct ath_desc *ds;
1572 	struct mbuf *m;
1573 	struct ieee80211_frame *wh;
1574 	u_int32_t iv;
1575 	u_int8_t *ivp;
1576 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1577 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1578 	u_int subtype, flags, ctsduration, antenna;
1579 	HAL_PKT_TYPE atype;
1580 	const HAL_RATE_TABLE *rt;
1581 	HAL_BOOL shortPreamble;
1582 	struct ath_node *an;
1583 
1584 	wh = mtod(m0, struct ieee80211_frame *);
1585 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1586 	hdrlen = sizeof(struct ieee80211_frame);
1587 	pktlen = m0->m_pkthdr.len;
1588 
1589 	if (iswep) {
1590 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1591 		m_adj(m0, hdrlen);
1592 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1593 		if (m0 == NULL) {
1594 			sc->sc_stats.ast_tx_nombuf++;
1595 			return ENOMEM;
1596 		}
1597 		ivp = hdrbuf + hdrlen;
1598 		/*
1599 		 * XXX
1600 		 * IV must not duplicate during the lifetime of the key.
1601 		 * But no mechanism to renew keys is defined in IEEE 802.11
1602 		 * WEP.  And IV may be duplicated between other stations
1603 		 * because of the session key itself is shared.
1604 		 * So we use pseudo random IV for now, though it is not the
1605 		 * right way.
1606 		 */
1607 		iv = arc4random();
1608 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1609 			ivp[i] = iv;
1610 			iv >>= 8;
1611 		}
1612 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1613 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1614 		/*
1615 		 * The ICV length must be included into hdrlen and pktlen.
1616 		 */
1617 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1618 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1619 	}
1620 	pktlen += IEEE80211_CRC_LEN;
1621 
1622 	/*
1623 	 * Load the DMA map so any coalescing is done.  This
1624 	 * also calculates the number of descriptors we need.
1625 	 */
1626 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1627 				     ath_mbuf_load_cb, bf,
1628 				     BUS_DMA_NOWAIT);
1629 	if (error != 0) {
1630 		sc->sc_stats.ast_tx_busdma++;
1631 		m_freem(m0);
1632 		return error;
1633 	}
1634 	/*
1635 	 * Discard null packets and check for packets that
1636 	 * require too many TX descriptors.  We try to convert
1637 	 * the latter to a cluster.
1638 	 */
1639 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1640 		sc->sc_stats.ast_tx_linear++;
1641 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1642 		if (m == NULL) {
1643 			sc->sc_stats.ast_tx_nombuf++;
1644 			m_freem(m0);
1645 			return ENOMEM;
1646 		}
1647 		M_MOVE_PKTHDR(m, m0);
1648 		MCLGET(m, M_DONTWAIT);
1649 		if ((m->m_flags & M_EXT) == 0) {
1650 			sc->sc_stats.ast_tx_nomcl++;
1651 			m_freem(m0);
1652 			m_free(m);
1653 			return ENOMEM;
1654 		}
1655 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1656 		m_freem(m0);
1657 		m->m_len = m->m_pkthdr.len;
1658 		m0 = m;
1659 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1660 					     ath_mbuf_load_cb, bf,
1661 					     BUS_DMA_NOWAIT);
1662 		if (error != 0) {
1663 			sc->sc_stats.ast_tx_busdma++;
1664 			m_freem(m0);
1665 			return error;
1666 		}
1667 		KASSERT(bf->bf_nseg == 1,
1668 			("ath_tx_start: packet not one segment; nseg %u",
1669 			bf->bf_nseg));
1670 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1671 		sc->sc_stats.ast_tx_nodata++;
1672 		m_freem(m0);
1673 		return EIO;
1674 	}
1675 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1676 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1677 	bf->bf_m = m0;
1678 	bf->bf_node = ni;
1679 
1680 	/* setup descriptors */
1681 	ds = bf->bf_desc;
1682 	rt = sc->sc_currates;
1683 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1684 
1685 	/*
1686 	 * Calculate Atheros packet type from IEEE80211 packet header
1687 	 * and setup for rate calculations.
1688 	 */
1689 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1690 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1691 	case IEEE80211_FC0_TYPE_MGT:
1692 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1693 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1694 			atype = HAL_PKT_TYPE_BEACON;
1695 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1696 			atype = HAL_PKT_TYPE_PROBE_RESP;
1697 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1698 			atype = HAL_PKT_TYPE_ATIM;
1699 		rix = 0;			/* XXX lowest rate */
1700 		break;
1701 	case IEEE80211_FC0_TYPE_CTL:
1702 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1703 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1704 			atype = HAL_PKT_TYPE_PSPOLL;
1705 		rix = 0;			/* XXX lowest rate */
1706 		break;
1707 	default:
1708 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1709 				IEEE80211_RATE_VAL];
1710 		if (rix == 0xff) {
1711 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1712 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1713 			sc->sc_stats.ast_tx_badrate++;
1714 			m_freem(m0);
1715 			return EIO;
1716 		}
1717 		break;
1718 	}
1719 	/*
1720 	 * NB: the 802.11 layer marks whether or not we should
1721 	 * use short preamble based on the current mode and
1722 	 * negotiated parameters.
1723 	 */
1724 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1725 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1726 		shortPreamble = AH_TRUE;
1727 		sc->sc_stats.ast_tx_shortpre++;
1728 	} else {
1729 		txrate = rt->info[rix].rateCode;
1730 		shortPreamble = AH_FALSE;
1731 	}
1732 
1733 	/*
1734 	 * Calculate miscellaneous flags.
1735 	 */
1736 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1737 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1738 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1739 		sc->sc_stats.ast_tx_noack++;
1740 	} else if (pktlen > ic->ic_rtsthreshold) {
1741 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
1742 		sc->sc_stats.ast_tx_rts++;
1743 	}
1744 
1745 	/*
1746 	 * Calculate RTS/CTS rate and duration if needed.
1747 	 */
1748 	ctsduration = 0;
1749 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
1750 		/*
1751 		 * CTS transmit rate is derived from the transmit rate
1752 		 * by looking in the h/w rate table.  We must also factor
1753 		 * in whether or not a short preamble is to be used.
1754 		 */
1755 		cix = rt->info[rix].controlRate;
1756 		ctsrate = rt->info[cix].rateCode;
1757 		if (shortPreamble)
1758 			ctsrate |= rt->info[cix].shortPreamble;
1759 		/*
1760 		 * Compute the transmit duration based on the size
1761 		 * of an ACK frame.  We call into the HAL to do the
1762 		 * computation since it depends on the characteristics
1763 		 * of the actual PHY being used.
1764 		 */
1765 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
1766 			ctsduration += ath_hal_computetxtime(ah,
1767 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1768 		}
1769 		/* SIFS + data */
1770 		ctsduration += ath_hal_computetxtime(ah,
1771 			rt, pktlen, rix, shortPreamble);
1772 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
1773 			ctsduration += ath_hal_computetxtime(ah,
1774 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1775 		}
1776 	} else
1777 		ctsrate = 0;
1778 
1779 	/*
1780 	 * For now use the antenna on which the last good
1781 	 * frame was received on.  We assume this field is
1782 	 * initialized to 0 which gives us ``auto'' or the
1783 	 * ``default'' antenna.
1784 	 */
1785 	an = (struct ath_node *) ni;
1786 	if (an->an_tx_antenna)
1787 		antenna = an->an_tx_antenna;
1788 	else
1789 		antenna = ni->ni_rantenna;
1790 
1791 	/*
1792 	 * Formulate first tx descriptor with tx controls.
1793 	 */
1794 	/* XXX check return value? */
1795 	ath_hal_setuptxdesc(ah, ds
1796 		, pktlen		/* packet length */
1797 		, hdrlen		/* header length */
1798 		, atype			/* Atheros packet type */
1799 		, 60			/* txpower XXX */
1800 		, txrate, 1+10		/* series 0 rate/tries */
1801 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
1802 		, antenna		/* antenna mode */
1803 		, flags			/* flags */
1804 		, ctsrate		/* rts/cts rate */
1805 		, ctsduration		/* rts/cts duration */
1806 	);
1807 #ifdef notyet
1808 	ath_hal_setupxtxdesc(ah, ds
1809 		, AH_FALSE		/* short preamble */
1810 		, 0, 0			/* series 1 rate/tries */
1811 		, 0, 0			/* series 2 rate/tries */
1812 		, 0, 0			/* series 3 rate/tries */
1813 	);
1814 #endif
1815 	/*
1816 	 * Fillin the remainder of the descriptor info.
1817 	 */
1818 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
1819 		ds->ds_data = bf->bf_segs[i].ds_addr;
1820 		if (i == bf->bf_nseg - 1)
1821 			ds->ds_link = 0;
1822 		else
1823 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
1824 		ath_hal_filltxdesc(ah, ds
1825 			, bf->bf_segs[i].ds_len	/* segment length */
1826 			, i == 0		/* first segment */
1827 			, i == bf->bf_nseg - 1	/* last segment */
1828 		);
1829 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
1830 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
1831 		    ds->ds_hw[0], ds->ds_hw[1]));
1832 	}
1833 
1834 	/*
1835 	 * Insert the frame on the outbound list and
1836 	 * pass it on to the hardware.
1837 	 */
1838 	mtx_lock(&sc->sc_txqlock);
1839 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
1840 	if (sc->sc_txlink == NULL) {
1841 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
1842 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
1843 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
1844 	} else {
1845 		*sc->sc_txlink = bf->bf_daddr;
1846 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
1847 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
1848 	}
1849 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
1850 	mtx_unlock(&sc->sc_txqlock);
1851 
1852 	ath_hal_txstart(ah, sc->sc_txhalq);
1853 	return 0;
1854 }
1855 
1856 static void
1857 ath_tx_proc(void *arg, int npending)
1858 {
1859 	struct ath_softc *sc = arg;
1860 	struct ath_hal *ah = sc->sc_ah;
1861 	struct ath_buf *bf;
1862 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1863 	struct ath_desc *ds;
1864 	struct ieee80211_node *ni;
1865 	struct ath_node *an;
1866 	int sr, lr;
1867 	HAL_STATUS status;
1868 
1869 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
1870 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
1871 		sc->sc_txlink));
1872 	for (;;) {
1873 		mtx_lock(&sc->sc_txqlock);
1874 		bf = TAILQ_FIRST(&sc->sc_txq);
1875 		if (bf == NULL) {
1876 			sc->sc_txlink = NULL;
1877 			mtx_unlock(&sc->sc_txqlock);
1878 			break;
1879 		}
1880 		/* only the last descriptor is needed */
1881 		ds = &bf->bf_desc[bf->bf_nseg - 1];
1882 		status = ath_hal_txprocdesc(ah, ds);
1883 #ifdef AR_DEBUG
1884 		if (ath_debug > 1)
1885 			ath_printtxbuf(bf, status == HAL_OK);
1886 #endif
1887 		if (status == HAL_EINPROGRESS) {
1888 			mtx_unlock(&sc->sc_txqlock);
1889 			break;
1890 		}
1891 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1892 		mtx_unlock(&sc->sc_txqlock);
1893 
1894 		ni = bf->bf_node;
1895 		if (ni != NULL) {
1896 			an = (struct ath_node *) ni;
1897 			if (ds->ds_txstat.ts_status == 0) {
1898 				an->an_tx_ok++;
1899 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
1900 			} else {
1901 				an->an_tx_err++;
1902 				ifp->if_oerrors++;
1903 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
1904 					sc->sc_stats.ast_tx_xretries++;
1905 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
1906 					sc->sc_stats.ast_tx_fifoerr++;
1907 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
1908 					sc->sc_stats.ast_tx_filtered++;
1909 				an->an_tx_antenna = 0;	/* invalidate */
1910 			}
1911 			sr = ds->ds_txstat.ts_shortretry;
1912 			lr = ds->ds_txstat.ts_longretry;
1913 			sc->sc_stats.ast_tx_shortretry += sr;
1914 			sc->sc_stats.ast_tx_longretry += lr;
1915 			if (sr + lr)
1916 				an->an_tx_retr++;
1917 		}
1918 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1919 		    BUS_DMASYNC_POSTWRITE);
1920 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1921 		m_freem(bf->bf_m);
1922 		bf->bf_m = NULL;
1923 		bf->bf_node = NULL;
1924 
1925 		mtx_lock(&sc->sc_txbuflock);
1926 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1927 		mtx_unlock(&sc->sc_txbuflock);
1928 	}
1929 	ifp->if_flags &= ~IFF_OACTIVE;
1930 	sc->sc_tx_timer = 0;
1931 
1932 	ath_start(ifp);
1933 }
1934 
1935 /*
1936  * Drain the transmit queue and reclaim resources.
1937  */
1938 static void
1939 ath_draintxq(struct ath_softc *sc)
1940 {
1941 	struct ath_hal *ah = sc->sc_ah;
1942 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1943 	struct ath_buf *bf;
1944 
1945 	/* XXX return value */
1946 	if (!sc->sc_invalid) {
1947 		/* don't touch the hardware if marked invalid */
1948 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
1949 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
1950 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
1951 		    sc->sc_txlink));
1952 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
1953 		DPRINTF(("ath_draintxq: beacon queue %p\n",
1954 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
1955 	}
1956 	for (;;) {
1957 		mtx_lock(&sc->sc_txqlock);
1958 		bf = TAILQ_FIRST(&sc->sc_txq);
1959 		if (bf == NULL) {
1960 			sc->sc_txlink = NULL;
1961 			mtx_unlock(&sc->sc_txqlock);
1962 			break;
1963 		}
1964 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1965 		mtx_unlock(&sc->sc_txqlock);
1966 #ifdef AR_DEBUG
1967 		if (ath_debug)
1968 			ath_printtxbuf(bf,
1969 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
1970 #endif /* AR_DEBUG */
1971 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1972 		m_freem(bf->bf_m);
1973 		bf->bf_m = NULL;
1974 		bf->bf_node = NULL;
1975 		mtx_lock(&sc->sc_txbuflock);
1976 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1977 		mtx_unlock(&sc->sc_txbuflock);
1978 	}
1979 	ifp->if_flags &= ~IFF_OACTIVE;
1980 	sc->sc_tx_timer = 0;
1981 }
1982 
1983 /*
1984  * Disable the receive h/w in preparation for a reset.
1985  */
1986 static void
1987 ath_stoprecv(struct ath_softc *sc)
1988 {
1989 	struct ath_hal *ah = sc->sc_ah;
1990 
1991 	ath_hal_stoppcurecv(ah);	/* disable PCU */
1992 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
1993 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
1994 	DELAY(3000);			/* long enough for 1 frame */
1995 #ifdef AR_DEBUG
1996 	if (ath_debug) {
1997 		struct ath_buf *bf;
1998 
1999 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
2000 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
2001 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2002 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
2003 				ath_printrxbuf(bf, 1);
2004 		}
2005 	}
2006 #endif
2007 	sc->sc_rxlink = NULL;		/* just in case */
2008 }
2009 
2010 /*
2011  * Enable the receive h/w following a reset.
2012  */
2013 static int
2014 ath_startrecv(struct ath_softc *sc)
2015 {
2016 	struct ath_hal *ah = sc->sc_ah;
2017 	struct ath_buf *bf;
2018 
2019 	sc->sc_rxlink = NULL;
2020 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2021 		int error = ath_rxbuf_init(sc, bf);
2022 		if (error != 0) {
2023 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2024 				error));
2025 			return error;
2026 		}
2027 	}
2028 
2029 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2030 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2031 	ath_hal_rxena(ah);		/* enable recv descriptors */
2032 	ath_mode_init(sc);		/* set filters, etc. */
2033 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2034 	return 0;
2035 }
2036 
2037 /*
2038  * Set/change channels.  If the channel is really being changed,
2039  * it's done by resetting the chip.  To accomplish this we must
2040  * first cleanup any pending DMA, then restart stuff after a la
2041  * ath_init.
2042  */
2043 static int
2044 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2045 {
2046 	struct ath_hal *ah = sc->sc_ah;
2047 	struct ieee80211com *ic = &sc->sc_ic;
2048 
2049 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2050 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2051 		ic->ic_ibss_chan->ic_freq,
2052 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2053 	if (chan != ic->ic_ibss_chan) {
2054 		HAL_STATUS status;
2055 		HAL_CHANNEL hchan;
2056 		enum ieee80211_phymode mode;
2057 
2058 		/*
2059 		 * To switch channels clear any pending DMA operations;
2060 		 * wait long enough for the RX fifo to drain, reset the
2061 		 * hardware at the new frequency, and then re-enable
2062 		 * the relevant bits of the h/w.
2063 		 */
2064 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2065 		ath_draintxq(sc);		/* clear pending tx frames */
2066 		ath_stoprecv(sc);		/* turn off frame recv */
2067 		/*
2068 		 * Convert to a HAL channel description with
2069 		 * the flags constrained to reflect the current
2070 		 * operating mode.
2071 		 */
2072 		hchan.channel = chan->ic_freq;
2073 		hchan.channelFlags = ath_chan2flags(ic, chan);
2074 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2075 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2076 				"channel %u (%u Mhz)\n",
2077 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2078 			return EIO;
2079 		}
2080 		/*
2081 		 * Re-enable rx framework.
2082 		 */
2083 		if (ath_startrecv(sc) != 0) {
2084 			if_printf(&ic->ic_if,
2085 				"ath_chan_set: unable to restart recv logic\n");
2086 			return EIO;
2087 		}
2088 
2089 		/*
2090 		 * Re-enable interrupts.
2091 		 */
2092 		ath_hal_intrset(ah, sc->sc_imask);
2093 
2094 		/*
2095 		 * Change channels and update the h/w rate map
2096 		 * if we're switching; e.g. 11a to 11b/g.
2097 		 */
2098 		ic->ic_ibss_chan = chan;
2099 		mode = ieee80211_chan2mode(ic, chan);
2100 		if (mode != sc->sc_curmode)
2101 			ath_setcurmode(sc, mode);
2102 	}
2103 	return 0;
2104 }
2105 
2106 static void
2107 ath_next_scan(void *arg)
2108 {
2109 	struct ath_softc *sc = arg;
2110 	struct ieee80211com *ic = &sc->sc_ic;
2111 	struct ifnet *ifp = &ic->ic_if;
2112 
2113 	if (ic->ic_state == IEEE80211_S_SCAN)
2114 		ieee80211_next_scan(ifp);
2115 }
2116 
2117 /*
2118  * Periodically recalibrate the PHY to account
2119  * for temperature/environment changes.
2120  */
2121 static void
2122 ath_calibrate(void *arg)
2123 {
2124 	struct ath_softc *sc = arg;
2125 	struct ath_hal *ah = sc->sc_ah;
2126 	struct ieee80211com *ic = &sc->sc_ic;
2127 	struct ieee80211_channel *c;
2128 	HAL_CHANNEL hchan;
2129 
2130 	sc->sc_stats.ast_per_cal++;
2131 
2132 	/*
2133 	 * Convert to a HAL channel description with the flags
2134 	 * constrained to reflect the current operating mode.
2135 	 */
2136 	c = ic->ic_ibss_chan;
2137 	hchan.channel = c->ic_freq;
2138 	hchan.channelFlags = ath_chan2flags(ic, c);
2139 
2140 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2141 
2142 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2143 		/*
2144 		 * Rfgain is out of bounds, reset the chip
2145 		 * to load new gain values.
2146 		 */
2147 		sc->sc_stats.ast_per_rfgain++;
2148 		ath_reset(sc);
2149 	}
2150 	if (!ath_hal_calibrate(ah, &hchan)) {
2151 		DPRINTF(("%s: calibration of channel %u failed\n",
2152 			__func__, c->ic_freq));
2153 		sc->sc_stats.ast_per_calfail++;
2154 	}
2155 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2156 }
2157 
2158 static int
2159 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2160 {
2161 	struct ifnet *ifp = &ic->ic_if;
2162 	struct ath_softc *sc = ifp->if_softc;
2163 	struct ath_hal *ah = sc->sc_ah;
2164 	struct ieee80211_node *ni;
2165 	int i, error;
2166 	u_int8_t *bssid;
2167 	u_int32_t rfilt;
2168 	static const HAL_LED_STATE leds[] = {
2169 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2170 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2171 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2172 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2173 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2174 	};
2175 
2176 	DPRINTF(("%s: %s -> %s\n", __func__,
2177 		ieee80211_state_name[ic->ic_state],
2178 		ieee80211_state_name[nstate]));
2179 
2180 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2181 
2182 	if (nstate == IEEE80211_S_INIT) {
2183 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2184 		ath_hal_intrset(ah, sc->sc_imask);
2185 		callout_stop(&sc->sc_scan_ch);
2186 		callout_stop(&sc->sc_cal_ch);
2187 		return (*sc->sc_newstate)(ic, nstate, arg);
2188 	}
2189 	ni = ic->ic_bss;
2190 	error = ath_chan_set(sc, ni->ni_chan);
2191 	if (error != 0)
2192 		goto bad;
2193 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
2194 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
2195 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2196 	    (ifp->if_flags & IFF_PROMISC))
2197 		rfilt |= HAL_RX_FILTER_PROM;
2198 	if (nstate == IEEE80211_S_SCAN) {
2199 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2200 			ath_next_scan, sc);
2201 		bssid = ifp->if_broadcastaddr;
2202 		rfilt |= HAL_RX_FILTER_BEACON;
2203 	} else {
2204 		callout_stop(&sc->sc_scan_ch);
2205 		bssid = ni->ni_bssid;
2206 	}
2207 	ath_hal_setrxfilter(ah, rfilt);
2208 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2209 		 __func__, rfilt, ether_sprintf(bssid)));
2210 
2211 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2212 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2213 	else
2214 		ath_hal_setassocid(ah, bssid, 0);
2215 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2216 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2217 			if (ath_hal_keyisvalid(ah, i))
2218 				ath_hal_keysetmac(ah, i, bssid);
2219 	}
2220 
2221 	if (nstate == IEEE80211_S_RUN) {
2222 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2223 			"capinfo=0x%04x chan=%d\n"
2224 			 , __func__
2225 			 , ic->ic_flags
2226 			 , ni->ni_intval
2227 			 , ether_sprintf(ni->ni_bssid)
2228 			 , ni->ni_capinfo
2229 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2230 
2231 		/*
2232 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2233 		 */
2234 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2235 		    ic->ic_opmode == IEEE80211_M_IBSS) {
2236 			error = ath_beacon_alloc(sc, ni);
2237 			if (error != 0)
2238 				goto bad;
2239 		}
2240 
2241 		/*
2242 		 * Configure the beacon and sleep timers.
2243 		 */
2244 		ath_beacon_config(sc);
2245 
2246 		/* start periodic recalibration timer */
2247 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2248 			ath_calibrate, sc);
2249 	} else {
2250 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2251 		ath_hal_intrset(ah, sc->sc_imask);
2252 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2253 	}
2254 	/*
2255 	 * Reset the rate control state.
2256 	 */
2257 	ath_rate_ctl_reset(sc, nstate);
2258 	/*
2259 	 * Invoke the parent method to complete the work.
2260 	 */
2261 	return (*sc->sc_newstate)(ic, nstate, arg);
2262 bad:
2263 	callout_stop(&sc->sc_scan_ch);
2264 	callout_stop(&sc->sc_cal_ch);
2265 	/* NB: do not invoke the parent */
2266 	return error;
2267 }
2268 
2269 /*
2270  * Setup driver-specific state for a newly associated node.
2271  * Note that we're called also on a re-associate, the isnew
2272  * param tells us if this is the first time or not.
2273  */
2274 static void
2275 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2276 {
2277 	if (isnew) {
2278 		struct ath_node *an = (struct ath_node *) ni;
2279 
2280 		an->an_tx_ok = an->an_tx_err =
2281 			an->an_tx_retr = an->an_tx_upper = 0;
2282 		/* start with highest negotiated rate */
2283 		/*
2284 		 * XXX should do otherwise but only when
2285 		 * the rate control algorithm is better.
2286 		 */
2287 		KASSERT(ni->ni_rates.rs_nrates > 0,
2288 			("new association w/ no rates!"));
2289 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2290 	}
2291 }
2292 
2293 static int
2294 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2295 {
2296 	struct ieee80211com *ic = &sc->sc_ic;
2297 	struct ifnet *ifp = &ic->ic_if;
2298 	struct ath_hal *ah = sc->sc_ah;
2299 	HAL_CHANNEL *chans;
2300 	int i, ix, nchan;
2301 
2302 	sc->sc_have11g = 0;
2303 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2304 			M_TEMP, M_NOWAIT);
2305 	if (chans == NULL) {
2306 		if_printf(ifp, "unable to allocate channel table\n");
2307 		return ENOMEM;
2308 	}
2309 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2310 	    cc, HAL_MODE_ALL, outdoor)) {
2311 		if_printf(ifp, "unable to collect channel list from hal\n");
2312 		free(chans, M_TEMP);
2313 		return EINVAL;
2314 	}
2315 
2316 	/*
2317 	 * Convert HAL channels to ieee80211 ones and insert
2318 	 * them in the table according to their channel number.
2319 	 */
2320 	for (i = 0; i < nchan; i++) {
2321 		HAL_CHANNEL *c = &chans[i];
2322 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2323 		if (ix > IEEE80211_CHAN_MAX) {
2324 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2325 				ix, c->channel, c->channelFlags);
2326 			continue;
2327 		}
2328 		/* NB: flags are known to be compatible */
2329 		if (ic->ic_channels[ix].ic_freq == 0) {
2330 			ic->ic_channels[ix].ic_freq = c->channel;
2331 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2332 		} else {
2333 			/* channels overlap; e.g. 11g and 11b */
2334 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2335 		}
2336 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
2337 			sc->sc_have11g = 1;
2338 	}
2339 	free(chans, M_TEMP);
2340 	return 0;
2341 }
2342 
2343 static int
2344 ath_rate_setup(struct ath_softc *sc, u_int mode)
2345 {
2346 	struct ath_hal *ah = sc->sc_ah;
2347 	struct ieee80211com *ic = &sc->sc_ic;
2348 	const HAL_RATE_TABLE *rt;
2349 	struct ieee80211_rateset *rs;
2350 	int i, maxrates;
2351 
2352 	switch (mode) {
2353 	case IEEE80211_MODE_11A:
2354 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2355 		break;
2356 	case IEEE80211_MODE_11B:
2357 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2358 		break;
2359 	case IEEE80211_MODE_11G:
2360 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2361 		break;
2362 	case IEEE80211_MODE_TURBO:
2363 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2364 		break;
2365 	default:
2366 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2367 		return 0;
2368 	}
2369 	rt = sc->sc_rates[mode];
2370 	if (rt == NULL)
2371 		return 0;
2372 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2373 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2374 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2375 		maxrates = IEEE80211_RATE_MAXSIZE;
2376 	} else
2377 		maxrates = rt->rateCount;
2378 	rs = &ic->ic_sup_rates[mode];
2379 	for (i = 0; i < maxrates; i++)
2380 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2381 	rs->rs_nrates = maxrates;
2382 	return 1;
2383 }
2384 
2385 static void
2386 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2387 {
2388 	const HAL_RATE_TABLE *rt;
2389 	int i;
2390 
2391 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2392 	rt = sc->sc_rates[mode];
2393 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2394 	for (i = 0; i < rt->rateCount; i++)
2395 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2396 	sc->sc_currates = rt;
2397 	sc->sc_curmode = mode;
2398 }
2399 
2400 /*
2401  * Reset the rate control state for each 802.11 state transition.
2402  */
2403 static void
2404 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2405 {
2406 	struct ieee80211com *ic = &sc->sc_ic;
2407 	struct ieee80211_node *ni;
2408 	struct ath_node *an;
2409 
2410 	an = (struct ath_node *) ic->ic_bss;
2411 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2412 	if (ic->ic_opmode == IEEE80211_M_STA) {
2413 		ni = ic->ic_bss;
2414 		if (state == IEEE80211_S_RUN) {
2415 			/* start with highest negotiated rate */
2416 			KASSERT(ni->ni_rates.rs_nrates > 0,
2417 				("transition to RUN state w/ no rates!"));
2418 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2419 		} else {
2420 			/* use lowest rate */
2421 			ni->ni_txrate = 0;
2422 		}
2423 	} else {
2424 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2425 			ni->ni_txrate = 0;		/* use lowest rate */
2426 			an = (struct ath_node *) ni;
2427 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2428 			    an->an_tx_upper = 0;
2429 		}
2430 	}
2431 }
2432 
2433 /*
2434  * Examine and potentially adjust the transmit rate.
2435  */
2436 static void
2437 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2438 {
2439 	struct ath_softc *sc = arg;
2440 	struct ath_node *an = (struct ath_node *) ni;
2441 	struct ieee80211_rateset *rs = &ni->ni_rates;
2442 	int mod = 0, orate, enough;
2443 
2444 	/*
2445 	 * Rate control
2446 	 * XXX: very primitive version.
2447 	 */
2448 	sc->sc_stats.ast_rate_calls++;
2449 
2450 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2451 
2452 	/* no packet reached -> down */
2453 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2454 		mod = -1;
2455 
2456 	/* all packets needs retry in average -> down */
2457 	if (enough && an->an_tx_ok < an->an_tx_retr)
2458 		mod = -1;
2459 
2460 	/* no error and less than 10% of packets needs retry -> up */
2461 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2462 		mod = 1;
2463 
2464 	orate = ni->ni_txrate;
2465 	switch (mod) {
2466 	case 0:
2467 		if (enough && an->an_tx_upper > 0)
2468 			an->an_tx_upper--;
2469 		break;
2470 	case -1:
2471 		if (ni->ni_txrate > 0) {
2472 			ni->ni_txrate--;
2473 			sc->sc_stats.ast_rate_drop++;
2474 		}
2475 		an->an_tx_upper = 0;
2476 		break;
2477 	case 1:
2478 		if (++an->an_tx_upper < 2)
2479 			break;
2480 		an->an_tx_upper = 0;
2481 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2482 			ni->ni_txrate++;
2483 			sc->sc_stats.ast_rate_raise++;
2484 		}
2485 		break;
2486 	}
2487 
2488 	if (ni->ni_txrate != orate) {
2489 		printf("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2490 		    __func__,
2491 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2492 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2493 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr);
2494 	}
2495 	if (ni->ni_txrate != orate || enough)
2496 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2497 }
2498 
2499 #ifdef AR_DEBUG
2500 static int
2501 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2502 {
2503 	char dmode[64];
2504 	int error;
2505 
2506 	strncpy(dmode, "", sizeof(dmode) - 1);
2507 	dmode[sizeof(dmode) - 1] = '\0';
2508 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2509 
2510 	if (error == 0 && req->newptr != NULL) {
2511 		struct ifnet *ifp;
2512 		struct ath_softc *sc;
2513 
2514 		ifp = ifunit("ath0");		/* XXX */
2515 		if (!ifp)
2516 			return EINVAL;
2517 		sc = ifp->if_softc;
2518 		if (strcmp(dmode, "hal") == 0)
2519 			ath_hal_dumpstate(sc->sc_ah);
2520 		else if (strcmp(dmode, "eeprom") == 0)
2521 			ath_hal_dumpeeprom(sc->sc_ah);
2522 		else if (strcmp(dmode, "rfgain") == 0)
2523 			ath_hal_dumprfgain(sc->sc_ah);
2524 		else if (strcmp(dmode, "ani") == 0)
2525 			ath_hal_dumpani(sc->sc_ah);
2526 		else
2527 			return EINVAL;
2528 	}
2529 	return error;
2530 }
2531 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2532 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2533 
2534 static void
2535 ath_printrxbuf(struct ath_buf *bf, int done)
2536 {
2537 	struct ath_desc *ds;
2538 	int i;
2539 
2540 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2541 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2542 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2543 		    ds->ds_link, ds->ds_data,
2544 		    ds->ds_ctl0, ds->ds_ctl1,
2545 		    ds->ds_hw[0], ds->ds_hw[1],
2546 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2547 	}
2548 }
2549 
2550 static void
2551 ath_printtxbuf(struct ath_buf *bf, int done)
2552 {
2553 	struct ath_desc *ds;
2554 	int i;
2555 
2556 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2557 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2558 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2559 		    ds->ds_link, ds->ds_data,
2560 		    ds->ds_ctl0, ds->ds_ctl1,
2561 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2562 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2563 	}
2564 }
2565 #endif /* AR_DEBUG */
2566