xref: /freebsd/sys/dev/ath/if_ath.c (revision 45cabbdc582e0bb1e45c83ba033eaf3e4b4b3ee7)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  *
43  * This software is derived from work of Atsushi Onoe; his contribution
44  * is greatly appreciated.
45  */
46 
47 #include "opt_inet.h"
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysctl.h>
52 #include <sys/mbuf.h>
53 #include <sys/malloc.h>
54 #include <sys/lock.h>
55 #include <sys/mutex.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/errno.h>
60 #include <sys/callout.h>
61 #include <sys/bus.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #include <net/ethernet.h>
71 #include <net/if_llc.h>
72 
73 #include <net80211/ieee80211.h>
74 #include <net80211/ieee80211_crypto.h>
75 #include <net80211/ieee80211_node.h>
76 #include <net80211/ieee80211_proto.h>
77 #include <net80211/ieee80211_var.h>
78 
79 #include <net/bpf.h>
80 
81 #ifdef INET
82 #include <netinet/in.h>
83 #include <netinet/if_ether.h>
84 #endif
85 
86 #define	AR_DEBUG
87 #include <dev/ath/if_athvar.h>
88 #include <contrib/dev/ath/ah_desc.h>
89 
90 /* unalligned little endian access */
91 #define LE_READ_2(p)							\
92 	((u_int16_t)							\
93 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
94 #define LE_READ_4(p)							\
95 	((u_int32_t)							\
96 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
97 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
98 
99 static void	ath_init(void *);
100 static void	ath_stop(struct ifnet *);
101 static void	ath_start(struct ifnet *);
102 static void	ath_reset(struct ath_softc *);
103 static int	ath_media_change(struct ifnet *);
104 static void	ath_watchdog(struct ifnet *);
105 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
106 static void	ath_fatal_proc(void *, int);
107 static void	ath_rxorn_proc(void *, int);
108 static void	ath_bmiss_proc(void *, int);
109 static void	ath_initkeytable(struct ath_softc *);
110 static void	ath_mode_init(struct ath_softc *);
111 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
112 static void	ath_beacon_proc(void *, int);
113 static void	ath_beacon_free(struct ath_softc *);
114 static void	ath_beacon_config(struct ath_softc *);
115 static int	ath_desc_alloc(struct ath_softc *);
116 static void	ath_desc_free(struct ath_softc *);
117 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
118 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
119 static void	ath_node_copy(struct ieee80211com *,
120 			struct ieee80211_node *, const struct ieee80211_node *);
121 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
122 static void	ath_rx_proc(void *, int);
123 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
124 			     struct ath_buf *, struct mbuf *);
125 static void	ath_tx_proc(void *, int);
126 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
127 static void	ath_draintxq(struct ath_softc *);
128 static void	ath_stoprecv(struct ath_softc *);
129 static int	ath_startrecv(struct ath_softc *);
130 static void	ath_next_scan(void *);
131 static void	ath_calibrate(void *);
132 static int	ath_newstate(void *, enum ieee80211_state);
133 static void	ath_newassoc(struct ieee80211com *,
134 			struct ieee80211_node *, int);
135 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
136 
137 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
138 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
139 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
140 static void	ath_rate_ctl(void *, struct ieee80211_node *);
141 
142 SYSCTL_DECL(_hw_ath);
143 
144 /* XXX validate sysctl values */
145 static	int ath_dwelltime = 200;		/* 5 channels/second */
146 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
147 	    0, "channel dwell time (ms) for AP/station scanning");
148 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
149 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
150 	    0, "chip calibration interval (secs)");
151 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
152 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
153 	    0, "enable/disable outdoor operation");
154 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
155 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
156 	    0, "country code");
157 static	int ath_regdomain = 0;			/* regulatory domain */
158 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
159 	    0, "regulatory domain");
160 
161 static	int ath_bmisshack = 1;
162 SYSCTL_INT(_hw_ath, OID_AUTO, bmisshack, CTLFLAG_RW, &ath_bmisshack,
163 	    0, "enable/disable hack to discard bmiss interrupts");
164 
165 #ifdef AR_DEBUG
166 int	ath_debug = 0;
167 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
168 	    0, "control debugging printfs");
169 #define	IFF_DUMPPKTS(_ifp) \
170 	(ath_debug || \
171 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
172 static	void ath_printrxbuf(struct ath_buf *bf, int);
173 static	void ath_printtxbuf(struct ath_buf *bf, int);
174 #define	DPRINTF(X)	if (ath_debug) printf X
175 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
176 #else
177 #define	IFF_DUMPPKTS(_ifp) \
178 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
179 #define	DPRINTF(X)
180 #define	DPRINTF2(X)
181 #endif
182 
183 int
184 ath_attach(u_int16_t devid, struct ath_softc *sc)
185 {
186 	struct ieee80211com *ic = &sc->sc_ic;
187 	struct ifnet *ifp = &ic->ic_if;
188 	struct ath_hal *ah;
189 	HAL_STATUS status;
190 	int error = 0;
191 
192 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
193 
194 	/* set these up early for if_printf use */
195 	ifp->if_unit = device_get_unit(sc->sc_dev);
196 	ifp->if_name = "ath";
197 
198 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
199 	if (ah == NULL) {
200 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
201 			status);
202 		error = ENXIO;
203 		goto bad;
204 	}
205 	sc->sc_ah = ah;
206 
207 	/*
208 	 * Collect the channel list using the default country
209 	 * code and including outdoor channels.  The 802.11 layer
210 	 * is resposible for filtering this list based on settings
211 	 * like the phy mode.
212 	 */
213 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
214 	if (error != 0)
215 		goto bad;
216 	/*
217 	 * Copy these back; they are set as a side effect
218 	 * of constructing the channel list.
219 	 */
220 	ath_regdomain = ath_hal_getregdomain(ah);
221 	ath_countrycode = ath_hal_getcountrycode(ah);
222 
223 	/*
224 	 * Setup rate tables for all potential media types.
225 	 */
226 	ath_rate_setup(sc, IEEE80211_MODE_11A);
227 	ath_rate_setup(sc, IEEE80211_MODE_11B);
228 	ath_rate_setup(sc, IEEE80211_MODE_11G);
229 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
230 
231 	error = ath_desc_alloc(sc);
232 	if (error != 0) {
233 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
234 		goto bad;
235 	}
236 	callout_init(&sc->sc_scan_ch, 0);
237 	callout_init(&sc->sc_cal_ch, 0);
238 
239 	mtx_init(&sc->sc_txbuflock,
240 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
241 	mtx_init(&sc->sc_txqlock,
242 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
243 
244 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
245 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
246 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
247 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
248 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
249 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
250 
251 	/*
252 	 * For now just pre-allocate one data queue and one
253 	 * beacon queue.  Note that the HAL handles resetting
254 	 * them at the needed time.  Eventually we'll want to
255 	 * allocate more tx queues for splitting management
256 	 * frames and for QOS support.
257 	 */
258 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
259 		HAL_TX_QUEUE_DATA,
260 		AH_TRUE			/* enable interrupts */
261 	);
262 	if (sc->sc_txhalq == (u_int) -1) {
263 		if_printf(ifp, "unable to setup a data xmit queue!\n");
264 		goto bad;
265 	}
266 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
267 		HAL_TX_QUEUE_BEACON,
268 		AH_TRUE			/* enable interrupts */
269 	);
270 	if (sc->sc_bhalq == (u_int) -1) {
271 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
272 		goto bad;
273 	}
274 
275 	ifp->if_softc = sc;
276 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
277 	ifp->if_start = ath_start;
278 	ifp->if_watchdog = ath_watchdog;
279 	ifp->if_ioctl = ath_ioctl;
280 	ifp->if_init = ath_init;
281 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
282 
283 	ic->ic_softc = sc;
284 	ic->ic_newstate = ath_newstate;
285 	ic->ic_newassoc = ath_newassoc;
286 	/* XXX not right but it's not used anywhere important */
287 	ic->ic_phytype = IEEE80211_T_OFDM;
288 	ic->ic_opmode = IEEE80211_M_STA;
289 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP;
290 	/* NB: 11g support is identified when we fetch the channel set */
291 	if (sc->sc_have11g)
292 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
293 
294 	/* get mac address from hardware */
295 	ath_hal_getmac(ah, ic->ic_myaddr);
296 
297 	/* call MI attach routine. */
298 	ieee80211_ifattach(ifp);
299 	/* override default methods */
300 	ic->ic_node_alloc = ath_node_alloc;
301 	ic->ic_node_free = ath_node_free;
302 	ic->ic_node_copy = ath_node_copy;
303 
304 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
305 
306 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
307 
308 	return 0;
309 bad:
310 	if (ah)
311 		ath_hal_detach(ah);
312 	sc->sc_invalid = 1;
313 	return error;
314 }
315 
316 int
317 ath_detach(struct ath_softc *sc)
318 {
319 	struct ifnet *ifp = &sc->sc_ic.ic_if;
320 
321 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
322 
323 	mtx_lock(&sc->sc_mtx);
324 	ath_stop(ifp);
325 	ath_desc_free(sc);
326 	ath_hal_detach(sc->sc_ah);
327 	ieee80211_ifdetach(ifp);
328 	mtx_unlock(&sc->sc_mtx);
329 	return 0;
330 }
331 
332 void
333 ath_suspend(struct ath_softc *sc)
334 {
335 	struct ifnet *ifp = &sc->sc_ic.ic_if;
336 
337 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
338 
339 	ath_stop(ifp);
340 }
341 
342 void
343 ath_resume(struct ath_softc *sc)
344 {
345 	struct ifnet *ifp = &sc->sc_ic.ic_if;
346 
347 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
348 
349 	ath_init(ifp);
350 	if (ifp->if_flags & IFF_UP)
351 		ath_start(ifp);
352 }
353 
354 void
355 ath_shutdown(struct ath_softc *sc)
356 {
357 	struct ifnet *ifp = &sc->sc_ic.ic_if;
358 
359 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
360 
361 	ath_stop(ifp);
362 }
363 
364 void
365 ath_intr(void *arg)
366 {
367 	struct ath_softc *sc = arg;
368 	struct ieee80211com *ic = &sc->sc_ic;
369 	struct ifnet *ifp = &ic->ic_if;
370 	struct ath_hal *ah = sc->sc_ah;
371 	HAL_INT status;
372 
373 	if (sc->sc_invalid) {
374 		/*
375 		 * The hardware is gone, don't touch anything.
376 		 * XXX can this happen?
377 		 */
378 		DPRINTF(("ath_intr: invalid; ignored\n"));
379 		return;
380 	}
381 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
382 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
383 		ath_hal_getisr(ah, &status);	/* clear ISR */
384 		ath_hal_intrset(ah, 0);		/* disable further intr's */
385 		return;
386 	}
387 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
388 	DPRINTF2(("ath_intr: status 0x%x\n", status));
389 if (ath_bmisshack) status &= ~HAL_INT_BMISS; /*XXX*/
390 #ifdef AR_DEBUG
391 	if (ath_debug &&
392 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
393 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
394 		ath_hal_dumpstate(ah);
395 	}
396 #endif /* AR_DEBUG */
397 	if (status & HAL_INT_FATAL) {
398 		sc->sc_stats.ast_hardware++;
399 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
400 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
401 	} else if (status & HAL_INT_RXORN) {
402 		sc->sc_stats.ast_rxorn++;
403 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
404 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
405 	} else {
406 		if (status & HAL_INT_RXEOL) {
407 			/*
408 			 * NB: the hardware should re-read the link when
409 			 *     RXE bit is written, but it doesn't work at
410 			 *     least on older hardware revs.
411 			 */
412 			sc->sc_stats.ast_rxeol++;
413 			sc->sc_rxlink = NULL;
414 		}
415 		if (status & HAL_INT_TXURN) {
416 			sc->sc_stats.ast_txurn++;
417 			/* bump tx trigger level */
418 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
419 		}
420 		if (status & HAL_INT_RX)
421 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
422 		if (status & HAL_INT_TX)
423 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
424 		if (status & HAL_INT_SWBA)
425 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
426 		if (status & HAL_INT_BMISS) {
427 			sc->sc_stats.ast_bmiss++;
428 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
429 		}
430 	}
431 }
432 
433 static void
434 ath_fatal_proc(void *arg, int pending)
435 {
436 	struct ath_softc *sc = arg;
437 
438 	device_printf(sc->sc_dev, "hardware error; resetting\n");
439 	ath_reset(sc);
440 }
441 
442 static void
443 ath_rxorn_proc(void *arg, int pending)
444 {
445 	struct ath_softc *sc = arg;
446 
447 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
448 	ath_reset(sc);
449 }
450 
451 static void
452 ath_bmiss_proc(void *arg, int pending)
453 {
454 	struct ath_softc *sc = arg;
455 	struct ieee80211com *ic = &sc->sc_ic;
456 	struct ifnet *ifp = &ic->ic_if;
457 
458 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
459 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
460 		("unexpect operating mode %u", ic->ic_opmode));
461 	if (ic->ic_state == IEEE80211_S_RUN)
462 		ieee80211_new_state(ifp, IEEE80211_S_SCAN, -1);
463 }
464 
465 static u_int
466 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
467 {
468 	static const u_int modeflags[] = {
469 		0,			/* IEEE80211_MODE_AUTO */
470 		CHANNEL_A,		/* IEEE80211_MODE_11A */
471 		CHANNEL_B,		/* IEEE80211_MODE_11B */
472 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
473 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
474 	};
475 	return modeflags[ieee80211_chan2mode(ic, chan)];
476 }
477 
478 static void
479 ath_init(void *arg)
480 {
481 	struct ath_softc *sc = (struct ath_softc *) arg;
482 	struct ieee80211com *ic = &sc->sc_ic;
483 	struct ifnet *ifp = &ic->ic_if;
484 	struct ieee80211_node *ni;
485 	enum ieee80211_phymode mode;
486 	struct ath_hal *ah = sc->sc_ah;
487 	HAL_STATUS status;
488 	HAL_CHANNEL hchan;
489 
490 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
491 
492 	mtx_lock(&sc->sc_mtx);
493 	/*
494 	 * Stop anything previously setup.  This is safe
495 	 * whether this is the first time through or not.
496 	 */
497 	ath_stop(ifp);
498 
499 	/*
500 	 * The basic interface to setting the hardware in a good
501 	 * state is ``reset''.  On return the hardware is known to
502 	 * be powered up and with interrupts disabled.  This must
503 	 * be followed by initialization of the appropriate bits
504 	 * and then setup of the interrupt mask.
505 	 */
506 	hchan.channel = ic->ic_ibss_chan->ic_freq;
507 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
508 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
509 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
510 			status);
511 		goto done;
512 	}
513 
514 	/*
515 	 * Setup the hardware after reset: the key cache
516 	 * is filled as needed and the receive engine is
517 	 * set going.  Frame transmit is handled entirely
518 	 * in the frame output path; there's nothing to do
519 	 * here except setup the interrupt mask.
520 	 */
521 	if (ic->ic_flags & IEEE80211_F_WEPON)
522 		ath_initkeytable(sc);
523 	if (ath_startrecv(sc) != 0) {
524 		if_printf(ifp, "unable to start recv logic\n");
525 		goto done;
526 	}
527 
528 	/*
529 	 * Enable interrupts.
530 	 */
531 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
532 		  | HAL_INT_RXEOL | HAL_INT_RXORN
533 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
534 	ath_hal_intrset(ah, sc->sc_imask);
535 
536 	ifp->if_flags |= IFF_RUNNING;
537 	ic->ic_state = IEEE80211_S_INIT;
538 
539 	/*
540 	 * The hardware should be ready to go now so it's safe
541 	 * to kick the 802.11 state machine as it's likely to
542 	 * immediately call back to us to send mgmt frames.
543 	 */
544 	ni = ic->ic_bss;
545 	ni->ni_chan = ic->ic_ibss_chan;
546 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
547 	if (mode != sc->sc_curmode)
548 		ath_setcurmode(sc, mode);
549 	ieee80211_new_state(ifp, IEEE80211_S_SCAN, -1);
550 done:
551 	mtx_unlock(&sc->sc_mtx);
552 }
553 
554 static void
555 ath_stop(struct ifnet *ifp)
556 {
557 	struct ath_softc *sc = ifp->if_softc;
558 	struct ath_hal *ah = sc->sc_ah;
559 
560 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
561 		sc->sc_invalid, ifp->if_flags));
562 
563 	mtx_lock(&sc->sc_mtx);
564 	if (ifp->if_flags & IFF_RUNNING) {
565 		/*
566 		 * Shutdown the hardware and driver:
567 		 *    disable interrupts
568 		 *    turn off timers
569 		 *    clear transmit machinery
570 		 *    clear receive machinery
571 		 *    drain and release tx queues
572 		 *    reclaim beacon resources
573 		 *    reset 802.11 state machine
574 		 *    power down hardware
575 		 *
576 		 * Note that some of this work is not possible if the
577 		 * hardware is gone (invalid).
578 		 */
579 		ifp->if_flags &= ~IFF_RUNNING;
580 		ifp->if_timer = 0;
581 		if (!sc->sc_invalid)
582 			ath_hal_intrset(ah, 0);
583 		ath_draintxq(sc);
584 		if (!sc->sc_invalid)
585 			ath_stoprecv(sc);
586 		else
587 			sc->sc_rxlink = NULL;
588 		IF_DRAIN(&ifp->if_snd);
589 		ath_beacon_free(sc);
590 		ieee80211_new_state(ifp, IEEE80211_S_INIT, -1);
591 		if (!sc->sc_invalid)
592 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
593 	}
594 	mtx_unlock(&sc->sc_mtx);
595 }
596 
597 /*
598  * Reset the hardware w/o losing operational state.  This is
599  * basically a more efficient way of doing ath_stop, ath_init,
600  * followed by state transitions to the current 802.11
601  * operational state.  Used to recover from errors rx overrun
602  * and to reset the hardware when rf gain settings must be reset.
603  */
604 static void
605 ath_reset(struct ath_softc *sc)
606 {
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &ic->ic_if;
609 	struct ath_hal *ah = sc->sc_ah;
610 	struct ieee80211_channel *c;
611 	HAL_STATUS status;
612 	HAL_CHANNEL hchan;
613 
614 	/*
615 	 * Convert to a HAL channel description with the flags
616 	 * constrained to reflect the current operating mode.
617 	 */
618 	c = ic->ic_ibss_chan;
619 	hchan.channel = c->ic_freq;
620 	hchan.channelFlags = ath_chan2flags(ic, c);
621 
622 	ath_hal_intrset(ah, 0);		/* disable interrupts */
623 	ath_draintxq(sc);		/* stop xmit side */
624 	ath_stoprecv(sc);		/* stop recv side */
625 	/* NB: indicate channel change so we do a full reset */
626 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
627 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
628 			__func__, status);
629 	ath_hal_intrset(ah, sc->sc_imask);
630 	if (ath_startrecv(sc) != 0)	/* restart recv */
631 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
632 	ath_start(ifp);			/* restart xmit */
633 	if (ic->ic_state == IEEE80211_S_RUN)
634 		ath_beacon_config(sc);	/* restart beacons */
635 }
636 
637 static void
638 ath_start(struct ifnet *ifp)
639 {
640 	struct ath_softc *sc = ifp->if_softc;
641 	struct ath_hal *ah = sc->sc_ah;
642 	struct ieee80211com *ic = &sc->sc_ic;
643 	struct ieee80211_node *ni;
644 	struct ath_buf *bf;
645 	struct mbuf *m;
646 	struct ieee80211_frame *wh;
647 
648 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
649 		return;
650 	for (;;) {
651 		/*
652 		 * Grab a TX buffer and associated resources.
653 		 */
654 		mtx_lock(&sc->sc_txbuflock);
655 		bf = TAILQ_FIRST(&sc->sc_txbuf);
656 		if (bf != NULL)
657 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
658 		mtx_unlock(&sc->sc_txbuflock);
659 		if (bf == NULL) {
660 			DPRINTF(("ath_start: out of xmit buffers\n"));
661 			sc->sc_stats.ast_tx_qstop++;
662 			ifp->if_flags |= IFF_OACTIVE;
663 			break;
664 		}
665 		/*
666 		 * Poll the management queue for frames; they
667 		 * have priority over normal data frames.
668 		 */
669 		IF_DEQUEUE(&ic->ic_mgtq, m);
670 		if (m == NULL) {
671 			/*
672 			 * No data frames go out unless we're associated.
673 			 */
674 			if (ic->ic_state != IEEE80211_S_RUN) {
675 				DPRINTF(("ath_start: ignore data packet, "
676 					"state %u\n", ic->ic_state));
677 				sc->sc_stats.ast_tx_discard++;
678 				mtx_lock(&sc->sc_txbuflock);
679 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
680 				mtx_unlock(&sc->sc_txbuflock);
681 				break;
682 			}
683 			IF_DEQUEUE(&ifp->if_snd, m);
684 			if (m == NULL) {
685 				mtx_lock(&sc->sc_txbuflock);
686 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
687 				mtx_unlock(&sc->sc_txbuflock);
688 				break;
689 			}
690 			ifp->if_opackets++;
691 			BPF_MTAP(ifp, m);
692 			/*
693 			 * Encapsulate the packet in prep for transmission.
694 			 */
695 			m = ieee80211_encap(ifp, m);
696 			if (m == NULL) {
697 				DPRINTF(("ath_start: encapsulation failure\n"));
698 				sc->sc_stats.ast_tx_encap++;
699 				goto bad;
700 			}
701 			wh = mtod(m, struct ieee80211_frame *);
702 			if (ic->ic_flags & IEEE80211_F_WEPON)
703 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
704 		} else {
705 			wh = mtod(m, struct ieee80211_frame *);
706 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
707 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
708 				/* fill time stamp */
709 				u_int64_t tsf;
710 				u_int32_t *tstamp;
711 
712 				tsf = ath_hal_gettsf64(ah);
713 				/* XXX: adjust 100us delay to xmit */
714 				tsf += 100;
715 				tstamp = (u_int32_t *)&wh[1];
716 				tstamp[0] = htole32(tsf & 0xffffffff);
717 				tstamp[1] = htole32(tsf >> 32);
718 			}
719 			sc->sc_stats.ast_tx_mgmt++;
720 		}
721 		if (ic->ic_rawbpf)
722 			bpf_mtap(ic->ic_rawbpf, m);
723 
724 		if (ic->ic_opmode != IEEE80211_M_STA) {
725 			ni = ieee80211_find_node(ic, wh->i_addr1);
726 			if (ni == NULL) {
727 				/*
728 				 * When not in station mode the destination
729 				 * address should always be in the node table
730 				 * unless this is a multicast/broadcast frame.
731 				 */
732 				if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
733 				    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
734 				    IEEE80211_FC0_TYPE_DATA) {
735 					m_freem(m);
736 					sc->sc_stats.ast_tx_nonode++;
737 					goto bad;
738 				}
739 				ni = ic->ic_bss;
740 			}
741 		} else
742 			ni = ic->ic_bss;
743 
744 		/*
745 		 * TODO:
746 		 * The duration field of 802.11 header should be filled.
747 		 * XXX This may be done in the ieee80211 layer, but the upper
748 		 *     doesn't know the detail of parameters such as IFS
749 		 *     for now..
750 		 */
751 
752 		if (IFF_DUMPPKTS(ifp))
753 			ieee80211_dump_pkt(mtod(m, u_int8_t *), m->m_len,
754 			    ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL,
755 			    -1);
756 
757 		if (ath_tx_start(sc, ni, bf, m)) {
758 	bad:
759 			mtx_lock(&sc->sc_txbuflock);
760 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
761 			mtx_unlock(&sc->sc_txbuflock);
762 			ifp->if_oerrors++;
763 			continue;
764 		}
765 
766 		sc->sc_tx_timer = 5;
767 		ifp->if_timer = 1;
768 	}
769 }
770 
771 static int
772 ath_media_change(struct ifnet *ifp)
773 {
774 	int error;
775 
776 	error = ieee80211_media_change(ifp);
777 	if (error == ENETRESET) {
778 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
779 		    (IFF_RUNNING|IFF_UP))
780 			ath_init(ifp);		/* XXX lose error */
781 		error = 0;
782 	}
783 	return error;
784 }
785 
786 static void
787 ath_watchdog(struct ifnet *ifp)
788 {
789 	struct ath_softc *sc = ifp->if_softc;
790 	struct ieee80211com *ic = &sc->sc_ic;
791 
792 	ifp->if_timer = 0;
793 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
794 		return;
795 	if (sc->sc_tx_timer) {
796 		if (--sc->sc_tx_timer == 0) {
797 			if_printf(ifp, "device timeout\n");
798 #ifdef AR_DEBUG
799 			if (ath_debug)
800 				ath_hal_dumpstate(sc->sc_ah);
801 #endif /* AR_DEBUG */
802 			ath_init(ifp);		/* XXX ath_reset??? */
803 			ifp->if_oerrors++;
804 			sc->sc_stats.ast_watchdog++;
805 			return;
806 		}
807 		ifp->if_timer = 1;
808 	}
809 	if (ic->ic_fixed_rate == -1) {
810 		/*
811 		 * Run the rate control algorithm if we're not
812 		 * locked at a fixed rate.
813 		 */
814 		if (ic->ic_opmode == IEEE80211_M_STA)
815 			ath_rate_ctl(sc, ic->ic_bss);
816 		else
817 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
818 	}
819 	ieee80211_watchdog(ifp);
820 }
821 
822 static int
823 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
824 {
825 	struct ath_softc *sc = ifp->if_softc;
826 	struct ifreq *ifr = (struct ifreq *)data;
827 	int error = 0;
828 
829 	mtx_lock(&sc->sc_mtx);
830 	switch (cmd) {
831 	case SIOCSIFFLAGS:
832 		if (ifp->if_flags & IFF_UP) {
833 			if (ifp->if_flags & IFF_RUNNING) {
834 				/*
835 				 * To avoid rescanning another access point,
836 				 * do not call ath_init() here.  Instead,
837 				 * only reflect promisc mode settings.
838 				 */
839 				ath_mode_init(sc);
840 			} else
841 				ath_init(ifp);		/* XXX lose error */
842 		} else
843 			ath_stop(ifp);
844 		break;
845 	case SIOCADDMULTI:
846 	case SIOCDELMULTI:
847 		/*
848 		 * The upper layer has already installed/removed
849 		 * the multicast address(es), just recalculate the
850 		 * multicast filter for the card.
851 		 */
852 		if (ifp->if_flags & IFF_RUNNING)
853 			ath_mode_init(sc);
854 		break;
855 	case SIOCGATHSTATS:
856 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
857 		break;
858 	default:
859 		error = ieee80211_ioctl(ifp, cmd, data);
860 		if (error == ENETRESET) {
861 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
862 			    (IFF_RUNNING|IFF_UP))
863 				ath_init(ifp);		/* XXX lose error */
864 			error = 0;
865 		}
866 		break;
867 	}
868 	mtx_unlock(&sc->sc_mtx);
869 	return error;
870 }
871 
872 /*
873  * Fill the hardware key cache with key entries.
874  */
875 static void
876 ath_initkeytable(struct ath_softc *sc)
877 {
878 	struct ieee80211com *ic = &sc->sc_ic;
879 	struct ath_hal *ah = sc->sc_ah;
880 	int i;
881 
882 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
883 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
884 		if (k->wk_len == 0)
885 			ath_hal_keyreset(ah, i);
886 		else
887 			/* XXX return value */
888 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
889 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
890 	}
891 }
892 
893 static void
894 ath_mode_init(struct ath_softc *sc)
895 {
896 	struct ieee80211com *ic = &sc->sc_ic;
897 	struct ath_hal *ah = sc->sc_ah;
898 	struct ifnet *ifp = &ic->ic_if;
899 	u_int32_t rfilt, mfilt[2], val;
900 	u_int8_t pos;
901 	struct ifmultiaddr *ifma;
902 
903 	/* configure operational mode */
904 	ath_hal_setopmode(ah, ic->ic_opmode);
905 
906 	/* receive filter */
907 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
908 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
909 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
910 	    (ifp->if_flags & IFF_PROMISC))
911 		rfilt |= HAL_RX_FILTER_PROM;
912 	if (ic->ic_state == IEEE80211_S_SCAN)
913 		rfilt |= HAL_RX_FILTER_BEACON;
914 	ath_hal_setrxfilter(ah, rfilt);
915 
916 	/* calculate and install multicast filter */
917 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
918 		mfilt[0] = mfilt[1] = 0;
919 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
920 			caddr_t dl;
921 
922 			/* calculate XOR of eight 6bit values */
923 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
924 			val = LE_READ_4(dl + 0);
925 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
926 			val = LE_READ_4(dl + 3);
927 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
928 			pos &= 0x3f;
929 			mfilt[pos / 32] |= (1 << (pos % 32));
930 		}
931 	} else {
932 		mfilt[0] = mfilt[1] = ~0;
933 	}
934 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
935 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
936 		rfilt, mfilt[0], mfilt[1]));
937 }
938 
939 static void
940 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
941 {
942 	struct ath_buf *bf = arg;
943 
944 	KASSERT(nseg <= ATH_MAX_SCATTER,
945 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
946 	bf->bf_mapsize = mapsize;
947 	bf->bf_nseg = nseg;
948 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
949 }
950 
951 static int
952 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
953 {
954 	struct ieee80211com *ic = &sc->sc_ic;
955 	struct ifnet *ifp = &ic->ic_if;
956 	struct ath_hal *ah = sc->sc_ah;
957 	struct ieee80211_frame *wh;
958 	struct ath_buf *bf;
959 	struct ath_desc *ds;
960 	struct mbuf *m;
961 	int error, pktlen;
962 	u_int8_t *frm, rate;
963 	u_int16_t capinfo;
964 	struct ieee80211_rateset *rs;
965 	const HAL_RATE_TABLE *rt;
966 
967 	bf = sc->sc_bcbuf;
968 	if (bf->bf_m != NULL) {
969 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
970 		m_freem(bf->bf_m);
971 		bf->bf_m = NULL;
972 		bf->bf_node = NULL;
973 	}
974 	/*
975 	 * NB: the beacon data buffer must be 32-bit aligned;
976 	 * we assume the mbuf routines will return us something
977 	 * with this alignment (perhaps should assert).
978 	 */
979 	rs = &ni->ni_rates;
980 	pktlen = 8 + 2 + 2+ 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
981 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
982 		pktlen += 2;
983 	if (pktlen <= MHLEN)
984 		MGETHDR(m, M_DONTWAIT, MT_DATA);
985 	else
986 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
987 	if (m == NULL) {
988 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
989 			pktlen));
990 		sc->sc_stats.ast_be_nombuf++;
991 		return ENOMEM;
992 	}
993 
994 	wh = mtod(m, struct ieee80211_frame *);
995 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
996 	    IEEE80211_FC0_SUBTYPE_BEACON;
997 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
998 	*(u_int16_t *)wh->i_dur = 0;
999 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
1000 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1001 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1002 	*(u_int16_t *)wh->i_seq = 0;
1003 
1004 	/*
1005 	 * beacon frame format
1006 	 *	[8] time stamp
1007 	 *	[2] beacon interval
1008 	 *	[2] cabability information
1009 	 *	[tlv] ssid
1010 	 *	[tlv] supported rates
1011 	 *	[tlv] parameter set (IBSS)
1012 	 *	[tlv] extended supported rates
1013 	 */
1014 	frm = (u_int8_t *)&wh[1];
1015 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1016 	frm += 8;
1017 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1018 	frm += 2;
1019 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1020 		capinfo = IEEE80211_CAPINFO_IBSS;
1021 	else
1022 		capinfo = IEEE80211_CAPINFO_ESS;
1023 	if (ic->ic_flags & IEEE80211_F_WEPON)
1024 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1025 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1026 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1027 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1028 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1029 	*(u_int16_t *)frm = htole16(capinfo);
1030 	frm += 2;
1031 	*frm++ = IEEE80211_ELEMID_SSID;
1032 	*frm++ = ni->ni_esslen;
1033 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1034 	frm += ni->ni_esslen;
1035 	frm = ieee80211_add_rates(frm, rs);
1036 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1037 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1038 		*frm++ = 2;
1039 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1040 	} else {
1041 		/* TODO: TIM */
1042 		*frm++ = IEEE80211_ELEMID_TIM;
1043 		*frm++ = 4;	/* length */
1044 		*frm++ = 0;	/* DTIM count */
1045 		*frm++ = 1;	/* DTIM period */
1046 		*frm++ = 0;	/* bitmap control */
1047 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1048 	}
1049 	frm = ieee80211_add_xrates(frm, rs);
1050 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1051 
1052 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1053 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1054 				     ath_mbuf_load_cb, bf,
1055 				     BUS_DMA_NOWAIT);
1056 	if (error != 0) {
1057 		m_freem(m);
1058 		return error;
1059 	}
1060 	KASSERT(bf->bf_nseg == 1,
1061 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1062 		bf->bf_nseg));
1063 	bf->bf_m = m;
1064 
1065 	/* setup descriptors */
1066 	ds = bf->bf_desc;
1067 
1068 	ds->ds_link = 0;
1069 	ds->ds_data = bf->bf_segs[0].ds_addr;
1070 	/* XXX verify mbuf data area covers this roundup */
1071 	/*
1072 	 * Calculate rate code.
1073 	 * XXX everything at min xmit rate
1074 	 */
1075 	rt = sc->sc_currates;
1076 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1077 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) == 0)
1078 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1079 	else
1080 		rate = rt->info[0].rateCode;
1081 	ath_hal_setuptxdesc(ah, ds
1082 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1083 		, sizeof(struct ieee80211_frame)	/* header length */
1084 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1085 		, 0x20				/* txpower XXX */
1086 		, rate, 1			/* series 0 rate/tries */
1087 		, HAL_TXKEYIX_INVALID		/* no encryption */
1088 		, 0				/* antenna mode */
1089 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1090 		, 0				/* rts/cts rate */
1091 		, 0				/* rts/cts duration */
1092 	);
1093 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1094 	ath_hal_filltxdesc(ah, ds
1095 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1096 		, AH_TRUE				/* first segment */
1097 		, AH_TRUE				/* last segment */
1098 	);
1099 
1100 	return 0;
1101 }
1102 
1103 static void
1104 ath_beacon_proc(void *arg, int pending)
1105 {
1106 	struct ath_softc *sc = arg;
1107 	struct ieee80211com *ic = &sc->sc_ic;
1108 	struct ath_buf *bf = sc->sc_bcbuf;
1109 	struct ath_hal *ah = sc->sc_ah;
1110 
1111 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1112 	if (ic->ic_opmode == IEEE80211_M_STA || bf == NULL || bf->bf_m == NULL) {
1113 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1114 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1115 		return;
1116 	}
1117 	/* update beacon to reflect PS poll state */
1118 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1119 		DPRINTF(("%s: beacon queue %u did not stop?",
1120 			__func__, sc->sc_bhalq));
1121 		return;			/* busy, XXX is this right? */
1122 	}
1123 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1124 
1125 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1126 	ath_hal_txstart(ah, sc->sc_bhalq);
1127 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1128 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1129 }
1130 
1131 static void
1132 ath_beacon_free(struct ath_softc *sc)
1133 {
1134 	struct ath_buf *bf = sc->sc_bcbuf;
1135 
1136 	if (bf->bf_m != NULL) {
1137 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1138 		m_freem(bf->bf_m);
1139 		bf->bf_m = NULL;
1140 		bf->bf_node = NULL;
1141 	}
1142 }
1143 
1144 /*
1145  * Configure the beacon and sleep timers.
1146  *
1147  * When operating as an AP this resets the TSF and sets
1148  * up the hardware to notify us when we need to issue beacons.
1149  *
1150  * When operating in station mode this sets up the beacon
1151  * timers according to the timestamp of the last received
1152  * beacon and the current TSF, configures PCF and DTIM
1153  * handling, programs the sleep registers so the hardware
1154  * will wakeup in time to receive beacons, and configures
1155  * the beacon miss handling so we'll receive a BMISS
1156  * interrupt when we stop seeing beacons from the AP
1157  * we've associated with.
1158  */
1159 static void
1160 ath_beacon_config(struct ath_softc *sc)
1161 {
1162 	struct ath_hal *ah = sc->sc_ah;
1163 	struct ieee80211com *ic = &sc->sc_ic;
1164 	struct ieee80211_node *ni = ic->ic_bss;
1165 	u_int32_t nexttbtt;
1166 
1167 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1168 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1169 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1170 	nexttbtt += ni->ni_intval;
1171 	if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
1172 		HAL_BEACON_STATE bs;
1173 		u_int32_t bmisstime;
1174 
1175 		/* NB: no PCF support right now */
1176 		memset(&bs, 0, sizeof(bs));
1177 		bs.bs_intval = ni->ni_intval;
1178 		bs.bs_nexttbtt = nexttbtt;
1179 		bs.bs_dtimperiod = bs.bs_intval;
1180 		bs.bs_nextdtim = nexttbtt;
1181 		/*
1182 		 * Calculate the number of consecutive beacons to miss
1183 		 * before taking a BMISS interrupt.  The configuration
1184 		 * is specified in ms, so we need to convert that to
1185 		 * TU's and then calculate based on the beacon interval.
1186 		 * Note that we clamp the result to at most 10 beacons.
1187 		 */
1188 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1189 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1190 		if (bs.bs_bmissthreshold > 10)
1191 			bs.bs_bmissthreshold = 10;
1192 		else if (bs.bs_bmissthreshold <= 0)
1193 			bs.bs_bmissthreshold = 1;
1194 
1195 		/*
1196 		 * Calculate sleep duration.  The configuration is
1197 		 * given in ms.  We insure a multiple of the beacon
1198 		 * period is used.  Also, if the sleep duration is
1199 		 * greater than the DTIM period then it makes senses
1200 		 * to make it a multiple of that.
1201 		 *
1202 		 * XXX fixed at 100ms
1203 		 */
1204 		bs.bs_sleepduration =
1205 			roundup((100 * 1000) / 1024, bs.bs_intval);
1206 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1207 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1208 
1209 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1210 			, __func__
1211 			, bs.bs_intval
1212 			, bs.bs_nexttbtt
1213 			, bs.bs_dtimperiod
1214 			, bs.bs_nextdtim
1215 			, bs.bs_bmissthreshold
1216 			, bs.bs_sleepduration
1217 		));
1218 		ath_hal_intrset(ah, 0);
1219 		/*
1220 		 * Reset our tsf so the hardware will update the
1221 		 * tsf register to reflect timestamps found in
1222 		 * received beacons.
1223 		 */
1224 		ath_hal_resettsf(ah);
1225 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1226 		sc->sc_imask |= HAL_INT_BMISS;
1227 		ath_hal_intrset(ah, sc->sc_imask);
1228 	} else {
1229 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1230 			__func__, ni->ni_intval, nexttbtt));
1231 		ath_hal_intrset(ah, 0);
1232 		ath_hal_beaconinit(ah, ic->ic_opmode,
1233 			nexttbtt, ni->ni_intval);
1234 		sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1235 		ath_hal_intrset(ah, sc->sc_imask);
1236 	}
1237 }
1238 
1239 static void
1240 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1241 {
1242 	bus_addr_t *paddr = (bus_addr_t*) arg;
1243 	*paddr = segs->ds_addr;
1244 }
1245 
1246 static int
1247 ath_desc_alloc(struct ath_softc *sc)
1248 {
1249 	int i, bsize, error;
1250 	struct ath_desc *ds;
1251 	struct ath_buf *bf;
1252 
1253 	/* allocate descriptors */
1254 	sc->sc_desc_len = sizeof(struct ath_desc) *
1255 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1256 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1257 	if (error != 0)
1258 		return error;
1259 
1260 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1261 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1262 	if (error != 0)
1263 		goto fail0;
1264 
1265 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1266 				sc->sc_desc, sc->sc_desc_len,
1267 				ath_load_cb, &sc->sc_desc_paddr,
1268 				BUS_DMA_NOWAIT);
1269 	if (error != 0)
1270 		goto fail1;
1271 
1272 	ds = sc->sc_desc;
1273 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1274 	    ds, sc->sc_desc_len,
1275 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1276 
1277 	/* allocate buffers */
1278 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1279 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1280 	if (bf == NULL)
1281 		goto fail2;
1282 	sc->sc_bufptr = bf;
1283 
1284 	TAILQ_INIT(&sc->sc_rxbuf);
1285 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1286 		bf->bf_desc = ds;
1287 		bf->bf_daddr = sc->sc_desc_paddr +
1288 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1289 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1290 					  &bf->bf_dmamap);
1291 		if (error != 0)
1292 			break;
1293 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1294 	}
1295 
1296 	TAILQ_INIT(&sc->sc_txbuf);
1297 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1298 		bf->bf_desc = ds;
1299 		bf->bf_daddr = sc->sc_desc_paddr +
1300 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1301 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1302 					  &bf->bf_dmamap);
1303 		if (error != 0)
1304 			break;
1305 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1306 	}
1307 	TAILQ_INIT(&sc->sc_txq);
1308 
1309 	/* beacon buffer */
1310 	bf->bf_desc = ds;
1311 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1312 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1313 	if (error != 0)
1314 		return error;
1315 	sc->sc_bcbuf = bf;
1316 	return 0;
1317 
1318 fail2:
1319 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1320 fail1:
1321 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1322 fail0:
1323 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1324 	sc->sc_ddmamap = NULL;
1325 	return error;
1326 }
1327 
1328 static void
1329 ath_desc_free(struct ath_softc *sc)
1330 {
1331 	struct ath_buf *bf;
1332 
1333 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1334 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1335 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1336 
1337 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1338 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1339 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1340 		m_freem(bf->bf_m);
1341 	}
1342 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1343 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1344 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1345 		if (bf->bf_m) {
1346 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1347 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1348 			m_freem(bf->bf_m);
1349 			bf->bf_m = NULL;
1350 		}
1351 	}
1352 	if (sc->sc_bcbuf != NULL) {
1353 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1354 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1355 		sc->sc_bcbuf = NULL;
1356 	}
1357 
1358 	TAILQ_INIT(&sc->sc_rxbuf);
1359 	TAILQ_INIT(&sc->sc_txbuf);
1360 	TAILQ_INIT(&sc->sc_txq);
1361 	free(sc->sc_bufptr, M_DEVBUF);
1362 	sc->sc_bufptr = NULL;
1363 }
1364 
1365 static struct ieee80211_node *
1366 ath_node_alloc(struct ieee80211com *ic)
1367 {
1368 	struct ath_node *an =
1369 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1370 	return an ? &an->st_node : NULL;
1371 }
1372 
1373 static void
1374 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1375 {
1376         struct ath_softc *sc = ic->ic_if.if_softc;
1377 	struct ath_buf *bf;
1378 
1379 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1380 		if (bf->bf_node == ni)
1381 			bf->bf_node = NULL;
1382 	}
1383 	free(ni, M_DEVBUF);
1384 }
1385 
1386 static void
1387 ath_node_copy(struct ieee80211com *ic,
1388 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1389 {
1390 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1391 }
1392 
1393 static int
1394 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1395 {
1396 	struct ath_hal *ah = sc->sc_ah;
1397 	int error;
1398 	struct mbuf *m;
1399 	struct ath_desc *ds;
1400 
1401 	m = bf->bf_m;
1402 	if (m == NULL) {
1403 		/*
1404 		 * NB: by assigning a page to the rx dma buffer we
1405 		 * implicitly satisfy the Atheros requirement that
1406 		 * this buffer be cache-line-aligned and sized to be
1407 		 * multiple of the cache line size.  Not doing this
1408 		 * causes weird stuff to happen (for the 5210 at least).
1409 		 */
1410 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1411 		if (m == NULL) {
1412 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1413 			sc->sc_stats.ast_rx_nombuf++;
1414 			return ENOMEM;
1415 		}
1416 		bf->bf_m = m;
1417 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1418 
1419 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1420 					     ath_mbuf_load_cb, bf,
1421 					     BUS_DMA_NOWAIT);
1422 		if (error != 0) {
1423 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1424 				" error %d\n", error));
1425 			sc->sc_stats.ast_rx_busdma++;
1426 			return error;
1427 		}
1428 		KASSERT(bf->bf_nseg == 1,
1429 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1430 			bf->bf_nseg));
1431 	}
1432 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1433 
1434 	/* setup descriptors */
1435 	ds = bf->bf_desc;
1436 	ds->ds_link = 0;
1437 	ds->ds_data = bf->bf_segs[0].ds_addr;
1438 	ath_hal_setuprxdesc(ah, ds
1439 		, m->m_len		/* buffer size */
1440 		, 0
1441 	);
1442 
1443 	if (sc->sc_rxlink != NULL)
1444 		*sc->sc_rxlink = bf->bf_daddr;
1445 	sc->sc_rxlink = &ds->ds_link;
1446 	return 0;
1447 }
1448 
1449 static void
1450 ath_rx_proc(void *arg, int npending)
1451 {
1452 	struct ath_softc *sc = arg;
1453 	struct ath_buf *bf;
1454 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1455 	struct ath_hal *ah = sc->sc_ah;
1456 	struct ath_desc *ds;
1457 	struct mbuf *m;
1458 	struct ieee80211_frame *wh, whbuf;
1459 	int len;
1460 	u_int phyerr;
1461 	HAL_STATUS status;
1462 
1463 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1464 	do {
1465 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1466 		if (bf == NULL) {		/* NB: shouldn't happen */
1467 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1468 			break;
1469 		}
1470 		m = bf->bf_m;
1471 		if (m == NULL) {		/* NB: shouldn't happen */
1472 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1473 			continue;
1474 		}
1475 		ds = bf->bf_desc;
1476 		status = ath_hal_rxprocdesc(ah, ds);
1477 #ifdef AR_DEBUG
1478 		if (ath_debug > 1)
1479 			ath_printrxbuf(bf, status == HAL_OK);
1480 #endif
1481 		if (status == HAL_EINPROGRESS)
1482 			break;
1483 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1484 		if (ds->ds_rxstat.rs_status != 0) {
1485 			ifp->if_ierrors++;
1486 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1487 				sc->sc_stats.ast_rx_crcerr++;
1488 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1489 				sc->sc_stats.ast_rx_fifoerr++;
1490 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1491 				sc->sc_stats.ast_rx_badcrypt++;
1492 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1493 				sc->sc_stats.ast_rx_phyerr++;
1494 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1495 				sc->sc_stats.ast_rx_phy[phyerr]++;
1496 			}
1497 			goto rx_next;
1498 		}
1499 
1500 		len = ds->ds_rxstat.rs_datalen;
1501 		if (len < sizeof(struct ieee80211_frame)) {
1502 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1503 			goto rx_next;
1504 		}
1505 
1506 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1507 		    BUS_DMASYNC_POSTREAD);
1508 
1509 		wh = mtod(m, struct ieee80211_frame *);
1510 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1511 		    IEEE80211_FC0_TYPE_CTL) {
1512 			/*
1513 			 * Ignore control frame received in promisc mode.
1514 			 */
1515 			DPRINTF(("ath_rx_proc: control frame\n"));
1516 			goto rx_next;
1517 		}
1518 
1519 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1520 		bf->bf_m = NULL;
1521 		m->m_pkthdr.rcvif = ifp;
1522 		m->m_pkthdr.len = m->m_len = len;
1523 		if (IFF_DUMPPKTS(ifp)) {
1524 			struct ieee80211com *ic = &sc->sc_ic;
1525 			const HAL_RATE_TABLE *rt = sc->sc_rates[ic->ic_curmode];
1526 			ieee80211_dump_pkt(mtod(m, u_int8_t *), len,
1527 				rt ? rt->info[rt->rateCodeToIndex[ds->ds_rxstat.rs_rate]].dot11Rate & IEEE80211_RATE_VAL : 0,
1528 				ds->ds_rxstat.rs_rssi);
1529 		}
1530 		m_adj(m, -IEEE80211_CRC_LEN);
1531 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1532 			/*
1533 			 * WEP is decrypted by hardware. Clear WEP bit
1534 			 * and trim WEP header for ieee80211_input().
1535 			 */
1536 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1537 			memcpy(&whbuf, wh, sizeof(whbuf));
1538 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1539 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
1540 			/*
1541 			 * Also trim WEP ICV from the tail.
1542 			 */
1543 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1544 		}
1545 		ieee80211_input(ifp, m,
1546 			ds->ds_rxstat.rs_rssi,
1547 			ds->ds_rxstat.rs_tstamp,
1548 			ds->ds_rxstat.rs_antenna);
1549   rx_next:
1550 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1551 	} while (ath_rxbuf_init(sc, bf) == 0);
1552 
1553 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1554 	ath_hal_rxena(ah);			/* in case of RXEOL */
1555 }
1556 
1557 /*
1558  * XXX Size of an ACK control frame in bytes.
1559  */
1560 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1561 
1562 static int
1563 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1564     struct mbuf *m0)
1565 {
1566 	struct ieee80211com *ic = &sc->sc_ic;
1567 	struct ath_hal *ah = sc->sc_ah;
1568 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1569 	int i, error, iswep, hdrlen, pktlen;
1570 	u_int8_t rix, cix, txrate, ctsrate;
1571 	struct ath_desc *ds;
1572 	struct mbuf *m;
1573 	struct ieee80211_frame *wh;
1574 	u_int32_t iv;
1575 	u_int8_t *ivp;
1576 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1577 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1578 	u_int subtype, flags, ctsduration, antenna;
1579 	HAL_PKT_TYPE atype;
1580 	const HAL_RATE_TABLE *rt;
1581 	HAL_BOOL shortPreamble;
1582 	struct ath_node *an;
1583 
1584 	wh = mtod(m0, struct ieee80211_frame *);
1585 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1586 	hdrlen = sizeof(struct ieee80211_frame);
1587 	pktlen = m0->m_pkthdr.len;
1588 
1589 	if (iswep) {
1590 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1591 		m_adj(m0, hdrlen);
1592 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1593 		if (m0 == NULL) {
1594 			sc->sc_stats.ast_tx_nombuf++;
1595 			return ENOMEM;
1596 		}
1597 		ivp = hdrbuf + hdrlen;
1598 		/*
1599 		 * XXX
1600 		 * IV must not duplicate during the lifetime of the key.
1601 		 * But no mechanism to renew keys is defined in IEEE 802.11
1602 		 * WEP.  And IV may be duplicated between other stations
1603 		 * because of the session key itself is shared.
1604 		 * So we use pseudo random IV for now, though it is not the
1605 		 * right way.
1606 		 */
1607 		iv = arc4random();
1608 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1609 			ivp[i] = iv;
1610 			iv >>= 8;
1611 		}
1612 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1613 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1614 		/*
1615 		 * The ICV length must be included into hdrlen and pktlen.
1616 		 */
1617 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1618 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1619 	}
1620 	pktlen += IEEE80211_CRC_LEN;
1621 
1622 	/*
1623 	 * Load the DMA map so any coalescing is done.  This
1624 	 * also calculates the number of descriptors we need.
1625 	 */
1626 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1627 				     ath_mbuf_load_cb, bf,
1628 				     BUS_DMA_NOWAIT);
1629 	if (error != 0) {
1630 		sc->sc_stats.ast_tx_busdma++;
1631 		m_freem(m0);
1632 		return error;
1633 	}
1634 	/*
1635 	 * Discard null packets and check for packets that
1636 	 * require too many TX descriptors.  We try to convert
1637 	 * the latter to a cluster.
1638 	 */
1639 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1640 		sc->sc_stats.ast_tx_linear++;
1641 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1642 		if (m == NULL) {
1643 			sc->sc_stats.ast_tx_nombuf++;
1644 			m_freem(m0);
1645 			return ENOMEM;
1646 		}
1647 		M_MOVE_PKTHDR(m, m0);
1648 		MCLGET(m, M_DONTWAIT);
1649 		if ((m->m_flags & M_EXT) == 0) {
1650 			sc->sc_stats.ast_tx_nomcl++;
1651 			m_freem(m0);
1652 			m_free(m);
1653 			return ENOMEM;
1654 		}
1655 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1656 		m_freem(m0);
1657 		m->m_len = m->m_pkthdr.len;
1658 		m0 = m;
1659 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1660 					     ath_mbuf_load_cb, bf,
1661 					     BUS_DMA_NOWAIT);
1662 		if (error != 0) {
1663 			sc->sc_stats.ast_tx_busdma++;
1664 			m_freem(m0);
1665 			return error;
1666 		}
1667 		KASSERT(bf->bf_nseg == 1,
1668 			("ath_tx_start: packet not one segment; nseg %u",
1669 			bf->bf_nseg));
1670 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1671 		sc->sc_stats.ast_tx_nodata++;
1672 		m_freem(m0);
1673 		return EIO;
1674 	}
1675 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1676 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1677 	bf->bf_m = m0;
1678 	bf->bf_node = ni;
1679 
1680 	/* setup descriptors */
1681 	ds = bf->bf_desc;
1682 	rt = sc->sc_currates;
1683 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1684 
1685 	/*
1686 	 * Calculate Atheros packet type from IEEE80211 packet header
1687 	 * and setup for rate calculations.
1688 	 */
1689 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1690 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1691 	case IEEE80211_FC0_TYPE_MGT:
1692 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1693 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1694 			atype = HAL_PKT_TYPE_BEACON;
1695 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1696 			atype = HAL_PKT_TYPE_PROBE_RESP;
1697 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1698 			atype = HAL_PKT_TYPE_ATIM;
1699 		rix = 0;			/* XXX lowest rate */
1700 		break;
1701 	case IEEE80211_FC0_TYPE_CTL:
1702 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1703 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1704 			atype = HAL_PKT_TYPE_PSPOLL;
1705 		rix = 0;			/* XXX lowest rate */
1706 		break;
1707 	default:
1708 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1709 				IEEE80211_RATE_VAL];
1710 		if (rix == 0xff) {
1711 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1712 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1713 			sc->sc_stats.ast_tx_badrate++;
1714 			m_freem(m0);
1715 			return EIO;
1716 		}
1717 		break;
1718 	}
1719 	/*
1720 	 * NB: the 802.11 layer marks whether or not we should
1721 	 * use short preamble based on the current mode and
1722 	 * negotiated parameters.
1723 	 */
1724 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1725 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1726 		shortPreamble = AH_TRUE;
1727 		sc->sc_stats.ast_tx_shortpre++;
1728 	} else {
1729 		txrate = rt->info[rix].rateCode;
1730 		shortPreamble = AH_FALSE;
1731 	}
1732 
1733 	/*
1734 	 * Calculate miscellaneous flags.
1735 	 */
1736 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1737 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1738 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1739 		sc->sc_stats.ast_tx_noack++;
1740 	} else if (pktlen > ic->ic_rtsthreshold) {
1741 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
1742 		sc->sc_stats.ast_tx_rts++;
1743 	}
1744 
1745 	/*
1746 	 * Calculate RTS/CTS rate and duration if needed.
1747 	 */
1748 	ctsduration = 0;
1749 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
1750 		/*
1751 		 * CTS transmit rate is derived from the transmit rate
1752 		 * by looking in the h/w rate table.  We must also factor
1753 		 * in whether or not a short preamble is to be used.
1754 		 */
1755 		cix = rt->info[rix].controlRate;
1756 		ctsrate = rt->info[cix].rateCode;
1757 		if (shortPreamble)
1758 			ctsrate |= rt->info[cix].shortPreamble;
1759 		/*
1760 		 * Compute the transmit duration based on the size
1761 		 * of an ACK frame.  We call into the HAL to do the
1762 		 * computation since it depends on the characteristics
1763 		 * of the actual PHY being used.
1764 		 */
1765 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
1766 			ctsduration += ath_hal_computetxtime(ah,
1767 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1768 		}
1769 		/* SIFS + data */
1770 		ctsduration += ath_hal_computetxtime(ah,
1771 			rt, pktlen, rix, shortPreamble);
1772 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
1773 			ctsduration += ath_hal_computetxtime(ah,
1774 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1775 		}
1776 	} else
1777 		ctsrate = 0;
1778 
1779 	/*
1780 	 * For now use the antenna on which the last good
1781 	 * frame was received on.  We assume this field is
1782 	 * initialized to 0 which gives us ``auto'' or the
1783 	 * ``default'' antenna.
1784 	 */
1785 	an = (struct ath_node *) ni;
1786 	if (an->an_tx_antenna)
1787 		antenna = an->an_tx_antenna;
1788 	else
1789 		antenna = ni->ni_rantenna;
1790 
1791 	/*
1792 	 * Formulate first tx descriptor with tx controls.
1793 	 */
1794 	/* XXX check return value? */
1795 	ath_hal_setuptxdesc(ah, ds
1796 		, pktlen		/* packet length */
1797 		, hdrlen		/* header length */
1798 		, atype			/* Atheros packet type */
1799 		, 60			/* txpower XXX */
1800 		, txrate, 1+10		/* series 0 rate/tries */
1801 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
1802 		, antenna		/* antenna mode */
1803 		, flags			/* flags */
1804 		, ctsrate		/* rts/cts rate */
1805 		, ctsduration		/* rts/cts duration */
1806 	);
1807 #ifdef notyet
1808 	ath_hal_setupxtxdesc(ah, ds
1809 		, AH_FALSE		/* short preamble */
1810 		, 0, 0			/* series 1 rate/tries */
1811 		, 0, 0			/* series 2 rate/tries */
1812 		, 0, 0			/* series 3 rate/tries */
1813 	);
1814 #endif
1815 	/*
1816 	 * Fillin the remainder of the descriptor info.
1817 	 */
1818 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
1819 		ds->ds_data = bf->bf_segs[i].ds_addr;
1820 		if (i == bf->bf_nseg - 1)
1821 			ds->ds_link = 0;
1822 		else
1823 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
1824 		ath_hal_filltxdesc(ah, ds
1825 			, bf->bf_segs[i].ds_len	/* segment length */
1826 			, i == 0		/* first segment */
1827 			, i == bf->bf_nseg - 1	/* last segment */
1828 		);
1829 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
1830 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
1831 		    ds->ds_hw[0], ds->ds_hw[1]));
1832 	}
1833 
1834 	/*
1835 	 * Insert the frame on the outbound list and
1836 	 * pass it on to the hardware.
1837 	 */
1838 	mtx_lock(&sc->sc_txqlock);
1839 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
1840 	if (sc->sc_txlink == NULL) {
1841 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
1842 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
1843 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
1844 	} else {
1845 		*sc->sc_txlink = bf->bf_daddr;
1846 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
1847 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
1848 	}
1849 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
1850 	mtx_unlock(&sc->sc_txqlock);
1851 
1852 	ath_hal_txstart(ah, sc->sc_txhalq);
1853 	return 0;
1854 }
1855 
1856 static void
1857 ath_tx_proc(void *arg, int npending)
1858 {
1859 	struct ath_softc *sc = arg;
1860 	struct ath_hal *ah = sc->sc_ah;
1861 	struct ath_buf *bf;
1862 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1863 	struct ath_desc *ds;
1864 	struct ieee80211_node *ni;
1865 	struct ath_node *an;
1866 	int sr, lr;
1867 	HAL_STATUS status;
1868 
1869 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
1870 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
1871 		sc->sc_txlink));
1872 	for (;;) {
1873 		mtx_lock(&sc->sc_txqlock);
1874 		bf = TAILQ_FIRST(&sc->sc_txq);
1875 		if (bf == NULL) {
1876 			sc->sc_txlink = NULL;
1877 			mtx_unlock(&sc->sc_txqlock);
1878 			break;
1879 		}
1880 		/* only the last descriptor is needed */
1881 		ds = &bf->bf_desc[bf->bf_nseg - 1];
1882 		status = ath_hal_txprocdesc(ah, ds);
1883 #ifdef AR_DEBUG
1884 		if (ath_debug > 1)
1885 			ath_printtxbuf(bf, status == HAL_OK);
1886 #endif
1887 		if (status == HAL_EINPROGRESS) {
1888 			mtx_unlock(&sc->sc_txqlock);
1889 			break;
1890 		}
1891 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1892 		mtx_unlock(&sc->sc_txqlock);
1893 
1894 		ni = bf->bf_node;
1895 		if (ni != NULL) {
1896 			an = (struct ath_node *) ni;
1897 			if (ds->ds_txstat.ts_status == 0) {
1898 				an->an_tx_ok++;
1899 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
1900 			} else {
1901 				an->an_tx_err++;
1902 				ifp->if_oerrors++;
1903 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
1904 					sc->sc_stats.ast_tx_xretries++;
1905 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
1906 					sc->sc_stats.ast_tx_fifoerr++;
1907 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
1908 					sc->sc_stats.ast_tx_filtered++;
1909 				an->an_tx_antenna = 0;	/* invalidate */
1910 			}
1911 			sr = ds->ds_txstat.ts_shortretry;
1912 			lr = ds->ds_txstat.ts_longretry;
1913 			sc->sc_stats.ast_tx_shortretry += sr;
1914 			sc->sc_stats.ast_tx_longretry += lr;
1915 			if (sr + lr)
1916 				an->an_tx_retr++;
1917 		}
1918 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1919 		    BUS_DMASYNC_POSTWRITE);
1920 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1921 		m_freem(bf->bf_m);
1922 		bf->bf_m = NULL;
1923 		bf->bf_node = NULL;
1924 
1925 		mtx_lock(&sc->sc_txbuflock);
1926 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1927 		mtx_unlock(&sc->sc_txbuflock);
1928 	}
1929 	ifp->if_flags &= ~IFF_OACTIVE;
1930 	sc->sc_tx_timer = 0;
1931 
1932 	ath_start(ifp);
1933 }
1934 
1935 /*
1936  * Drain the transmit queue and reclaim resources.
1937  */
1938 static void
1939 ath_draintxq(struct ath_softc *sc)
1940 {
1941 	struct ath_hal *ah = sc->sc_ah;
1942 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1943 	struct ath_buf *bf;
1944 
1945 	/* XXX return value */
1946 	if (!sc->sc_invalid) {
1947 		/* don't touch the hardware if marked invalid */
1948 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
1949 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
1950 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
1951 		    sc->sc_txlink));
1952 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
1953 		DPRINTF(("ath_draintxq: beacon queue %p\n",
1954 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
1955 	}
1956 	for (;;) {
1957 		mtx_lock(&sc->sc_txqlock);
1958 		bf = TAILQ_FIRST(&sc->sc_txq);
1959 		if (bf == NULL) {
1960 			sc->sc_txlink = NULL;
1961 			mtx_unlock(&sc->sc_txqlock);
1962 			break;
1963 		}
1964 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1965 		mtx_unlock(&sc->sc_txqlock);
1966 #ifdef AR_DEBUG
1967 		if (ath_debug)
1968 			ath_printtxbuf(bf,
1969 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
1970 #endif /* AR_DEBUG */
1971 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1972 		m_freem(bf->bf_m);
1973 		bf->bf_m = NULL;
1974 		bf->bf_node = NULL;
1975 		mtx_lock(&sc->sc_txbuflock);
1976 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1977 		mtx_unlock(&sc->sc_txbuflock);
1978 	}
1979 	ifp->if_flags &= ~IFF_OACTIVE;
1980 	sc->sc_tx_timer = 0;
1981 }
1982 
1983 /*
1984  * Disable the receive h/w in preparation for a reset.
1985  */
1986 static void
1987 ath_stoprecv(struct ath_softc *sc)
1988 {
1989 	struct ath_hal *ah = sc->sc_ah;
1990 
1991 	ath_hal_stoppcurecv(ah);	/* disable PCU */
1992 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
1993 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
1994 	DELAY(3000);			/* long enough for 1 frame */
1995 #ifdef AR_DEBUG
1996 	if (ath_debug) {
1997 		struct ath_buf *bf;
1998 
1999 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
2000 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
2001 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2002 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
2003 				ath_printrxbuf(bf, 1);
2004 		}
2005 	}
2006 #endif
2007 	sc->sc_rxlink = NULL;		/* just in case */
2008 }
2009 
2010 /*
2011  * Enable the receive h/w following a reset.
2012  */
2013 static int
2014 ath_startrecv(struct ath_softc *sc)
2015 {
2016 	struct ath_hal *ah = sc->sc_ah;
2017 	struct ath_buf *bf;
2018 
2019 	sc->sc_rxlink = NULL;
2020 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2021 		int error = ath_rxbuf_init(sc, bf);
2022 		if (error != 0) {
2023 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2024 				error));
2025 			return error;
2026 		}
2027 	}
2028 
2029 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2030 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2031 	ath_hal_rxena(ah);		/* enable recv descriptors */
2032 	ath_mode_init(sc);		/* set filters, etc. */
2033 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2034 	return 0;
2035 }
2036 
2037 /*
2038  * Set/change channels.  If the channel is really being changed,
2039  * it's done by resetting the chip.  To accomplish this we must
2040  * first cleanup any pending DMA, then restart stuff after a la
2041  * ath_init.
2042  */
2043 static int
2044 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2045 {
2046 	struct ath_hal *ah = sc->sc_ah;
2047 	struct ieee80211com *ic = &sc->sc_ic;
2048 
2049 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2050 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2051 		ic->ic_ibss_chan->ic_freq,
2052 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2053 	if (chan != ic->ic_ibss_chan) {
2054 		HAL_STATUS status;
2055 		HAL_CHANNEL hchan;
2056 		enum ieee80211_phymode mode;
2057 
2058 		/*
2059 		 * To switch channels clear any pending DMA operations;
2060 		 * wait long enough for the RX fifo to drain, reset the
2061 		 * hardware at the new frequency, and then re-enable
2062 		 * the relevant bits of the h/w.
2063 		 */
2064 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2065 		ath_draintxq(sc);		/* clear pending tx frames */
2066 		ath_stoprecv(sc);		/* turn off frame recv */
2067 		/*
2068 		 * Convert to a HAL channel description with
2069 		 * the flags constrained to reflect the current
2070 		 * operating mode.
2071 		 */
2072 		hchan.channel = chan->ic_freq;
2073 		hchan.channelFlags = ath_chan2flags(ic, chan);
2074 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2075 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2076 				"channel %u (%u Mhz)\n",
2077 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2078 			return EIO;
2079 		}
2080 		/*
2081 		 * Re-enable rx framework.
2082 		 */
2083 		if (ath_startrecv(sc) != 0) {
2084 			if_printf(&ic->ic_if,
2085 				"ath_chan_set: unable to restart recv logic\n");
2086 			return EIO;
2087 		}
2088 
2089 		/*
2090 		 * Re-enable interrupts.
2091 		 */
2092 		ath_hal_intrset(ah, sc->sc_imask);
2093 
2094 		/*
2095 		 * Change channels and update the h/w rate map
2096 		 * if we're switching; e.g. 11a to 11b/g.
2097 		 */
2098 		ic->ic_ibss_chan = chan;
2099 		mode = ieee80211_chan2mode(ic, chan);
2100 		if (mode != sc->sc_curmode)
2101 			ath_setcurmode(sc, mode);
2102 	}
2103 	return 0;
2104 }
2105 
2106 static void
2107 ath_next_scan(void *arg)
2108 {
2109 	struct ath_softc *sc = arg;
2110 	struct ieee80211com *ic = &sc->sc_ic;
2111 	struct ifnet *ifp = &ic->ic_if;
2112 
2113 	if (ic->ic_state == IEEE80211_S_SCAN)
2114 		ieee80211_next_scan(ifp);
2115 }
2116 
2117 /*
2118  * Periodically recalibrate the PHY to account
2119  * for temperature/environment changes.
2120  */
2121 static void
2122 ath_calibrate(void *arg)
2123 {
2124 	struct ath_softc *sc = arg;
2125 	struct ath_hal *ah = sc->sc_ah;
2126 	struct ieee80211com *ic = &sc->sc_ic;
2127 	struct ieee80211_channel *c;
2128 	HAL_CHANNEL hchan;
2129 
2130 	sc->sc_stats.ast_per_cal++;
2131 
2132 	/*
2133 	 * Convert to a HAL channel description with the flags
2134 	 * constrained to reflect the current operating mode.
2135 	 */
2136 	c = ic->ic_ibss_chan;
2137 	hchan.channel = c->ic_freq;
2138 	hchan.channelFlags = ath_chan2flags(ic, c);
2139 
2140 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2141 
2142 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2143 		/*
2144 		 * Rfgain is out of bounds, reset the chip
2145 		 * to load new gain values.
2146 		 */
2147 		sc->sc_stats.ast_per_rfgain++;
2148 		ath_reset(sc);
2149 	}
2150 	if (!ath_hal_calibrate(ah, &hchan)) {
2151 		DPRINTF(("%s: calibration of channel %u failed\n",
2152 			__func__, c->ic_freq));
2153 		sc->sc_stats.ast_per_calfail++;
2154 	}
2155 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2156 }
2157 
2158 static int
2159 ath_newstate(void *arg, enum ieee80211_state nstate)
2160 {
2161 	struct ath_softc *sc = arg;
2162 	struct ath_hal *ah = sc->sc_ah;
2163 	struct ieee80211com *ic = &sc->sc_ic;
2164 	struct ifnet *ifp = &ic->ic_if;
2165 	struct ieee80211_node *ni;
2166 	int i, error;
2167 	u_int8_t *bssid;
2168 	u_int32_t rfilt;
2169 	enum ieee80211_state ostate;
2170 #ifdef AR_DEBUG
2171 	static const char *stname[] =
2172 	    { "INIT", "SCAN", "AUTH", "ASSOC", "RUN" };
2173 #endif /* AR_DEBUG */
2174 	static const HAL_LED_STATE leds[] = {
2175 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2176 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2177 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2178 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2179 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2180 	};
2181 
2182 	ostate = ic->ic_state;
2183 
2184 	DPRINTF(("%s: %s -> %s\n", __func__, stname[ostate], stname[nstate]));
2185 
2186 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2187 
2188 	if (nstate == IEEE80211_S_INIT) {
2189 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2190 		ath_hal_intrset(ah, sc->sc_imask);
2191 		error = 0;			/* cheat + use error return */
2192 		goto bad;
2193 	}
2194 	ni = ic->ic_bss;
2195 	error = ath_chan_set(sc, ni->ni_chan);
2196 	if (error != 0)
2197 		goto bad;
2198 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
2199 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
2200 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2201 	    (ifp->if_flags & IFF_PROMISC))
2202 		rfilt |= HAL_RX_FILTER_PROM;
2203 	if (nstate == IEEE80211_S_SCAN) {
2204 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2205 			ath_next_scan, sc);
2206 		bssid = ifp->if_broadcastaddr;
2207 		rfilt |= HAL_RX_FILTER_BEACON;
2208 	} else {
2209 		callout_stop(&sc->sc_scan_ch);
2210 		bssid = ni->ni_bssid;
2211 	}
2212 	ath_hal_setrxfilter(ah, rfilt);
2213 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2214 		 __func__, rfilt, ether_sprintf(bssid)));
2215 
2216 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2217 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2218 	else
2219 		ath_hal_setassocid(ah, bssid, 0);
2220 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2221 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2222 			if (ath_hal_keyisvalid(ah, i))
2223 				ath_hal_keysetmac(ah, i, bssid);
2224 	}
2225 
2226 	if (nstate == IEEE80211_S_RUN) {
2227 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2228 			"capinfo=0x%04x chan=%d\n"
2229 			 , __func__
2230 			 , ic->ic_flags
2231 			 , ni->ni_intval
2232 			 , ether_sprintf(ni->ni_bssid)
2233 			 , ni->ni_capinfo
2234 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2235 
2236 		/*
2237 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2238 		 */
2239 		if (ic->ic_opmode != IEEE80211_M_STA) {
2240 			error = ath_beacon_alloc(sc, ni);
2241 			if (error != 0)
2242 				goto bad;
2243 		}
2244 
2245 		/*
2246 		 * Configure the beacon and sleep timers.
2247 		 */
2248 		ath_beacon_config(sc);
2249 
2250 		/* start periodic recalibration timer */
2251 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2252 			ath_calibrate, sc);
2253 	} else {
2254 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2255 		ath_hal_intrset(ah, sc->sc_imask);
2256 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2257 	}
2258 	/*
2259 	 * Reset the rate control state.
2260 	 */
2261 	ath_rate_ctl_reset(sc, nstate);
2262 	return 0;
2263 bad:
2264 	callout_stop(&sc->sc_scan_ch);
2265 	callout_stop(&sc->sc_cal_ch);
2266 	return error;
2267 }
2268 
2269 /*
2270  * Setup driver-specific state for a newly associated node.
2271  * Note that we're called also on a re-associate, the isnew
2272  * param tells us if this is the first time or not.
2273  */
2274 static void
2275 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2276 {
2277 	if (isnew) {
2278 		struct ath_node *an = (struct ath_node *) ni;
2279 
2280 		an->an_tx_ok = an->an_tx_err =
2281 			an->an_tx_retr = an->an_tx_upper = 0;
2282 		/* start with highest negotiated rate */
2283 		/*
2284 		 * XXX should do otherwise but only when
2285 		 * the rate control algorithm is better.
2286 		 */
2287 		KASSERT(ni->ni_rates.rs_nrates > 0,
2288 			("new association w/ no rates!"));
2289 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2290 	}
2291 }
2292 
2293 static int
2294 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2295 {
2296 	struct ieee80211com *ic = &sc->sc_ic;
2297 	struct ifnet *ifp = &ic->ic_if;
2298 	struct ath_hal *ah = sc->sc_ah;
2299 	HAL_CHANNEL *chans;
2300 	int i, ix, nchan;
2301 
2302 	sc->sc_have11g = 0;
2303 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2304 			M_TEMP, M_NOWAIT);
2305 	if (chans == NULL) {
2306 		if_printf(ifp, "unable to allocate channel table\n");
2307 		return ENOMEM;
2308 	}
2309 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2310 	    cc, HAL_MODE_ALL, outdoor)) {
2311 		if_printf(ifp, "unable to collect channel list from hal\n");
2312 		free(chans, M_TEMP);
2313 		return EINVAL;
2314 	}
2315 
2316 	/*
2317 	 * Convert HAL channels to ieee80211 ones and insert
2318 	 * them in the table according to their channel number.
2319 	 */
2320 	for (i = 0; i < nchan; i++) {
2321 		HAL_CHANNEL *c = &chans[i];
2322 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2323 		if (ix > IEEE80211_CHAN_MAX) {
2324 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2325 				ix, c->channel, c->channelFlags);
2326 			continue;
2327 		}
2328 		/* NB: flags are known to be compatible */
2329 		if (ic->ic_channels[ix].ic_freq == 0) {
2330 			ic->ic_channels[ix].ic_freq = c->channel;
2331 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2332 		} else {
2333 			/* channels overlap; e.g. 11g and 11b */
2334 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2335 		}
2336 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
2337 			sc->sc_have11g = 1;
2338 	}
2339 	free(chans, M_TEMP);
2340 	return 0;
2341 }
2342 
2343 static int
2344 ath_rate_setup(struct ath_softc *sc, u_int mode)
2345 {
2346 	struct ath_hal *ah = sc->sc_ah;
2347 	struct ieee80211com *ic = &sc->sc_ic;
2348 	const HAL_RATE_TABLE *rt;
2349 	struct ieee80211_rateset *rs;
2350 	int i, maxrates;
2351 
2352 	switch (mode) {
2353 	case IEEE80211_MODE_11A:
2354 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2355 		break;
2356 	case IEEE80211_MODE_11B:
2357 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2358 		break;
2359 	case IEEE80211_MODE_11G:
2360 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2361 		break;
2362 	case IEEE80211_MODE_TURBO:
2363 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2364 		break;
2365 	default:
2366 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2367 		return 0;
2368 	}
2369 	rt = sc->sc_rates[mode];
2370 	if (rt == NULL)
2371 		return 0;
2372 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2373 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2374 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2375 		maxrates = IEEE80211_RATE_MAXSIZE;
2376 	} else
2377 		maxrates = rt->rateCount;
2378 	rs = &ic->ic_sup_rates[mode];
2379 	for (i = 0; i < maxrates; i++)
2380 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2381 	rs->rs_nrates = maxrates;
2382 	return 1;
2383 }
2384 
2385 static void
2386 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2387 {
2388 	const HAL_RATE_TABLE *rt;
2389 	int i;
2390 
2391 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2392 	rt = sc->sc_rates[mode];
2393 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2394 	for (i = 0; i < rt->rateCount; i++)
2395 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2396 	sc->sc_currates = rt;
2397 	sc->sc_curmode = mode;
2398 }
2399 
2400 /*
2401  * Reset the rate control state for each 802.11 state transition.
2402  */
2403 static void
2404 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2405 {
2406 	struct ieee80211com *ic = &sc->sc_ic;
2407 	struct ieee80211_node *ni;
2408 	struct ath_node *an;
2409 
2410 	an = (struct ath_node *) ic->ic_bss;
2411 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2412 	if (ic->ic_opmode == IEEE80211_M_STA) {
2413 		ni = ic->ic_bss;
2414 		if (state == IEEE80211_S_RUN) {
2415 			/* start with highest negotiated rate */
2416 			KASSERT(ni->ni_rates.rs_nrates > 0,
2417 				("transition to RUN state w/ no rates!"));
2418 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2419 		} else {
2420 			/* use lowest rate */
2421 			ni->ni_txrate = 0;
2422 		}
2423 	} else {
2424 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2425 			ni->ni_txrate = 0;		/* use lowest rate */
2426 			an = (struct ath_node *) ni;
2427 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2428 			    an->an_tx_upper = 0;
2429 		}
2430 	}
2431 }
2432 
2433 /*
2434  * Examine and potentially adjust the transmit rate.
2435  */
2436 static void
2437 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2438 {
2439 	struct ath_softc *sc = arg;
2440 	struct ath_node *an = (struct ath_node *) ni;
2441 	struct ieee80211_rateset *rs = &ni->ni_rates;
2442 	int mod = 0, orate, enough;
2443 
2444 	/*
2445 	 * Rate control
2446 	 * XXX: very primitive version.
2447 	 */
2448 	sc->sc_stats.ast_rate_calls++;
2449 
2450 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2451 
2452 	/* no packet reached -> down */
2453 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2454 		mod = -1;
2455 
2456 	/* all packets needs retry in average -> down */
2457 	if (enough && an->an_tx_ok < an->an_tx_retr)
2458 		mod = -1;
2459 
2460 	/* no error and less than 10% of packets needs retry -> up */
2461 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2462 		mod = 1;
2463 
2464 	orate = ni->ni_txrate;
2465 	switch (mod) {
2466 	case 0:
2467 		if (enough && an->an_tx_upper > 0)
2468 			an->an_tx_upper--;
2469 		break;
2470 	case -1:
2471 		if (ni->ni_txrate > 0) {
2472 			ni->ni_txrate--;
2473 			sc->sc_stats.ast_rate_drop++;
2474 		}
2475 		an->an_tx_upper = 0;
2476 		break;
2477 	case 1:
2478 		if (++an->an_tx_upper < 2)
2479 			break;
2480 		an->an_tx_upper = 0;
2481 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2482 			ni->ni_txrate++;
2483 			sc->sc_stats.ast_rate_raise++;
2484 		}
2485 		break;
2486 	}
2487 
2488 	if (ni->ni_txrate != orate) {
2489 		printf("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2490 		    __func__,
2491 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2492 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2493 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr);
2494 	}
2495 	if (ni->ni_txrate != orate || enough)
2496 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2497 }
2498 
2499 #ifdef AR_DEBUG
2500 static int
2501 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2502 {
2503 	char dmode[64];
2504 	int error;
2505 
2506 	strncpy(dmode, "", sizeof(dmode) - 1);
2507 	dmode[sizeof(dmode) - 1] = '\0';
2508 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2509 
2510 	if (error == 0 && req->newptr != NULL) {
2511 		struct ifnet *ifp;
2512 		struct ath_softc *sc;
2513 
2514 		ifp = ifunit("ath0");		/* XXX */
2515 		if (!ifp)
2516 			return EINVAL;
2517 		sc = ifp->if_softc;
2518 		if (strcmp(dmode, "hal") == 0)
2519 			ath_hal_dumpstate(sc->sc_ah);
2520 		else if (strcmp(dmode, "eeprom") == 0)
2521 			ath_hal_dumpeeprom(sc->sc_ah);
2522 		else if (strcmp(dmode, "rfgain") == 0)
2523 			ath_hal_dumprfgain(sc->sc_ah);
2524 		else if (strcmp(dmode, "ani") == 0)
2525 			ath_hal_dumpani(sc->sc_ah);
2526 		else
2527 			return EINVAL;
2528 	}
2529 	return error;
2530 }
2531 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2532 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2533 
2534 static void
2535 ath_printrxbuf(struct ath_buf *bf, int done)
2536 {
2537 	struct ath_desc *ds;
2538 	int i;
2539 
2540 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2541 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2542 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2543 		    ds->ds_link, ds->ds_data,
2544 		    ds->ds_ctl0, ds->ds_ctl1,
2545 		    ds->ds_hw[0], ds->ds_hw[1],
2546 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2547 	}
2548 }
2549 
2550 static void
2551 ath_printtxbuf(struct ath_buf *bf, int done)
2552 {
2553 	struct ath_desc *ds;
2554 	int i;
2555 
2556 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2557 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2558 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2559 		    ds->ds_link, ds->ds_data,
2560 		    ds->ds_ctl0, ds->ds_ctl1,
2561 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2562 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2563 	}
2564 }
2565 #endif /* AR_DEBUG */
2566