xref: /freebsd/sys/dev/ath/if_ath.c (revision 6b59f5e3d08873cc7798798861d1a5805284ce22)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  *
43  * This software is derived from work of Atsushi Onoe; his contribution
44  * is greatly appreciated.
45  */
46 
47 #include "opt_inet.h"
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysctl.h>
52 #include <sys/mbuf.h>
53 #include <sys/malloc.h>
54 #include <sys/lock.h>
55 #include <sys/mutex.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/errno.h>
60 #include <sys/callout.h>
61 #include <sys/bus.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #include <net/ethernet.h>
71 #include <net/if_llc.h>
72 
73 #include <net80211/ieee80211.h>
74 #include <net80211/ieee80211_crypto.h>
75 #include <net80211/ieee80211_node.h>
76 #include <net80211/ieee80211_proto.h>
77 #include <net80211/ieee80211_var.h>
78 
79 #include <net/bpf.h>
80 
81 #ifdef INET
82 #include <netinet/in.h>
83 #include <netinet/if_ether.h>
84 #endif
85 
86 #define	AR_DEBUG
87 #include <dev/ath/if_athvar.h>
88 #include <contrib/dev/ath/ah_desc.h>
89 
90 /* unalligned little endian access */
91 #define LE_READ_2(p)							\
92 	((u_int16_t)							\
93 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
94 #define LE_READ_4(p)							\
95 	((u_int32_t)							\
96 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
97 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
98 
99 static void	ath_init(void *);
100 static void	ath_stop(struct ifnet *);
101 static void	ath_start(struct ifnet *);
102 static void	ath_reset(struct ath_softc *);
103 static int	ath_media_change(struct ifnet *);
104 static void	ath_watchdog(struct ifnet *);
105 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
106 static void	ath_fatal_proc(void *, int);
107 static void	ath_rxorn_proc(void *, int);
108 static void	ath_bmiss_proc(void *, int);
109 static void	ath_initkeytable(struct ath_softc *);
110 static void	ath_mode_init(struct ath_softc *);
111 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
112 static void	ath_beacon_proc(void *, int);
113 static void	ath_beacon_free(struct ath_softc *);
114 static void	ath_beacon_config(struct ath_softc *);
115 static int	ath_desc_alloc(struct ath_softc *);
116 static void	ath_desc_free(struct ath_softc *);
117 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
118 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
119 static void	ath_node_copy(struct ieee80211com *,
120 			struct ieee80211_node *, const struct ieee80211_node *);
121 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
122 static void	ath_rx_proc(void *, int);
123 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
124 			     struct ath_buf *, struct mbuf *);
125 static void	ath_tx_proc(void *, int);
126 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
127 static void	ath_draintxq(struct ath_softc *);
128 static void	ath_stoprecv(struct ath_softc *);
129 static int	ath_startrecv(struct ath_softc *);
130 static void	ath_next_scan(void *);
131 static void	ath_calibrate(void *);
132 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
133 static void	ath_newassoc(struct ieee80211com *,
134 			struct ieee80211_node *, int);
135 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
136 
137 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
138 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
139 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
140 static void	ath_rate_ctl(void *, struct ieee80211_node *);
141 
142 SYSCTL_DECL(_hw_ath);
143 
144 /* XXX validate sysctl values */
145 static	int ath_dwelltime = 200;		/* 5 channels/second */
146 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
147 	    0, "channel dwell time (ms) for AP/station scanning");
148 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
149 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
150 	    0, "chip calibration interval (secs)");
151 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
152 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
153 	    0, "enable/disable outdoor operation");
154 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
155 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
156 	    0, "country code");
157 static	int ath_regdomain = 0;			/* regulatory domain */
158 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
159 	    0, "regulatory domain");
160 
161 #ifdef AR_DEBUG
162 int	ath_debug = 0;
163 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
164 	    0, "control debugging printfs");
165 #define	IFF_DUMPPKTS(_ifp) \
166 	(ath_debug || \
167 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
168 static	void ath_printrxbuf(struct ath_buf *bf, int);
169 static	void ath_printtxbuf(struct ath_buf *bf, int);
170 #define	DPRINTF(X)	if (ath_debug) printf X
171 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
172 #else
173 #define	IFF_DUMPPKTS(_ifp) \
174 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
175 #define	DPRINTF(X)
176 #define	DPRINTF2(X)
177 #endif
178 
179 int
180 ath_attach(u_int16_t devid, struct ath_softc *sc)
181 {
182 	struct ieee80211com *ic = &sc->sc_ic;
183 	struct ifnet *ifp = &ic->ic_if;
184 	struct ath_hal *ah;
185 	HAL_STATUS status;
186 	int error = 0;
187 
188 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
189 
190 	/* set these up early for if_printf use */
191 	ifp->if_unit = device_get_unit(sc->sc_dev);
192 	ifp->if_name = "ath";
193 
194 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
195 	if (ah == NULL) {
196 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
197 			status);
198 		error = ENXIO;
199 		goto bad;
200 	}
201 	sc->sc_ah = ah;
202 
203 	/*
204 	 * Collect the channel list using the default country
205 	 * code and including outdoor channels.  The 802.11 layer
206 	 * is resposible for filtering this list based on settings
207 	 * like the phy mode.
208 	 */
209 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
210 	if (error != 0)
211 		goto bad;
212 	/*
213 	 * Copy these back; they are set as a side effect
214 	 * of constructing the channel list.
215 	 */
216 	ath_regdomain = ath_hal_getregdomain(ah);
217 	ath_countrycode = ath_hal_getcountrycode(ah);
218 
219 	/*
220 	 * Setup rate tables for all potential media types.
221 	 */
222 	ath_rate_setup(sc, IEEE80211_MODE_11A);
223 	ath_rate_setup(sc, IEEE80211_MODE_11B);
224 	ath_rate_setup(sc, IEEE80211_MODE_11G);
225 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
226 
227 	error = ath_desc_alloc(sc);
228 	if (error != 0) {
229 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
230 		goto bad;
231 	}
232 	callout_init(&sc->sc_scan_ch, 0);
233 	callout_init(&sc->sc_cal_ch, 0);
234 
235 	mtx_init(&sc->sc_txbuflock,
236 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
237 	mtx_init(&sc->sc_txqlock,
238 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
239 
240 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
241 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
242 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
243 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
244 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
245 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
246 
247 	/*
248 	 * For now just pre-allocate one data queue and one
249 	 * beacon queue.  Note that the HAL handles resetting
250 	 * them at the needed time.  Eventually we'll want to
251 	 * allocate more tx queues for splitting management
252 	 * frames and for QOS support.
253 	 */
254 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
255 		HAL_TX_QUEUE_DATA,
256 		AH_TRUE			/* enable interrupts */
257 	);
258 	if (sc->sc_txhalq == (u_int) -1) {
259 		if_printf(ifp, "unable to setup a data xmit queue!\n");
260 		goto bad;
261 	}
262 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
263 		HAL_TX_QUEUE_BEACON,
264 		AH_TRUE			/* enable interrupts */
265 	);
266 	if (sc->sc_bhalq == (u_int) -1) {
267 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
268 		goto bad;
269 	}
270 
271 	ifp->if_softc = sc;
272 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
273 	ifp->if_start = ath_start;
274 	ifp->if_watchdog = ath_watchdog;
275 	ifp->if_ioctl = ath_ioctl;
276 	ifp->if_init = ath_init;
277 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
278 
279 	ic->ic_softc = sc;
280 	ic->ic_newassoc = ath_newassoc;
281 	/* XXX not right but it's not used anywhere important */
282 	ic->ic_phytype = IEEE80211_T_OFDM;
283 	ic->ic_opmode = IEEE80211_M_STA;
284 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP
285 		| IEEE80211_C_MONITOR;
286 	/* NB: 11g support is identified when we fetch the channel set */
287 	if (sc->sc_have11g)
288 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
289 
290 	/* get mac address from hardware */
291 	ath_hal_getmac(ah, ic->ic_myaddr);
292 
293 	/* call MI attach routine. */
294 	ieee80211_ifattach(ifp);
295 	/* override default methods */
296 	ic->ic_node_alloc = ath_node_alloc;
297 	ic->ic_node_free = ath_node_free;
298 	ic->ic_node_copy = ath_node_copy;
299 	sc->sc_newstate = ic->ic_newstate;
300 	ic->ic_newstate = ath_newstate;
301 	/* complete initialization */
302 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
303 
304 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
305 
306 	return 0;
307 bad:
308 	if (ah)
309 		ath_hal_detach(ah);
310 	sc->sc_invalid = 1;
311 	return error;
312 }
313 
314 int
315 ath_detach(struct ath_softc *sc)
316 {
317 	struct ifnet *ifp = &sc->sc_ic.ic_if;
318 
319 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
320 
321 	mtx_lock(&sc->sc_mtx);
322 	ath_stop(ifp);
323 	ath_desc_free(sc);
324 	ath_hal_detach(sc->sc_ah);
325 	ieee80211_ifdetach(ifp);
326 	mtx_unlock(&sc->sc_mtx);
327 	return 0;
328 }
329 
330 void
331 ath_suspend(struct ath_softc *sc)
332 {
333 	struct ifnet *ifp = &sc->sc_ic.ic_if;
334 
335 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
336 
337 	ath_stop(ifp);
338 }
339 
340 void
341 ath_resume(struct ath_softc *sc)
342 {
343 	struct ifnet *ifp = &sc->sc_ic.ic_if;
344 
345 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
346 
347 	if (ifp->if_flags & IFF_UP) {
348 		ath_init(ifp);
349 		if (ifp->if_flags & IFF_RUNNING)
350 			ath_start(ifp);
351 	}
352 }
353 
354 void
355 ath_shutdown(struct ath_softc *sc)
356 {
357 	struct ifnet *ifp = &sc->sc_ic.ic_if;
358 
359 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
360 
361 	ath_stop(ifp);
362 }
363 
364 void
365 ath_intr(void *arg)
366 {
367 	struct ath_softc *sc = arg;
368 	struct ieee80211com *ic = &sc->sc_ic;
369 	struct ifnet *ifp = &ic->ic_if;
370 	struct ath_hal *ah = sc->sc_ah;
371 	HAL_INT status;
372 
373 	if (sc->sc_invalid) {
374 		/*
375 		 * The hardware is gone, don't touch anything.
376 		 * XXX can this happen?
377 		 */
378 		DPRINTF(("ath_intr: invalid; ignored\n"));
379 		return;
380 	}
381 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
382 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
383 		ath_hal_getisr(ah, &status);	/* clear ISR */
384 		ath_hal_intrset(ah, 0);		/* disable further intr's */
385 		return;
386 	}
387 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
388 	DPRINTF2(("ath_intr: status 0x%x\n", status));
389 #ifdef AR_DEBUG
390 	if (ath_debug &&
391 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
392 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
393 		ath_hal_dumpstate(ah);
394 	}
395 #endif /* AR_DEBUG */
396 	if (status & HAL_INT_FATAL) {
397 		sc->sc_stats.ast_hardware++;
398 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
399 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
400 	} else if (status & HAL_INT_RXORN) {
401 		sc->sc_stats.ast_rxorn++;
402 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
403 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
404 	} else {
405 		if (status & HAL_INT_RXEOL) {
406 			/*
407 			 * NB: the hardware should re-read the link when
408 			 *     RXE bit is written, but it doesn't work at
409 			 *     least on older hardware revs.
410 			 */
411 			sc->sc_stats.ast_rxeol++;
412 			sc->sc_rxlink = NULL;
413 		}
414 		if (status & HAL_INT_TXURN) {
415 			sc->sc_stats.ast_txurn++;
416 			/* bump tx trigger level */
417 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
418 		}
419 		if (status & HAL_INT_RX)
420 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
421 		if (status & HAL_INT_TX)
422 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
423 		if (status & HAL_INT_SWBA)
424 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
425 		if (status & HAL_INT_BMISS) {
426 			sc->sc_stats.ast_bmiss++;
427 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
428 		}
429 	}
430 }
431 
432 static void
433 ath_fatal_proc(void *arg, int pending)
434 {
435 	struct ath_softc *sc = arg;
436 
437 	device_printf(sc->sc_dev, "hardware error; resetting\n");
438 	ath_reset(sc);
439 }
440 
441 static void
442 ath_rxorn_proc(void *arg, int pending)
443 {
444 	struct ath_softc *sc = arg;
445 
446 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
447 	ath_reset(sc);
448 }
449 
450 static void
451 ath_bmiss_proc(void *arg, int pending)
452 {
453 	struct ath_softc *sc = arg;
454 	struct ieee80211com *ic = &sc->sc_ic;
455 
456 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
457 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
458 		("unexpect operating mode %u", ic->ic_opmode));
459 	if (ic->ic_state == IEEE80211_S_RUN)
460 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
461 }
462 
463 static u_int
464 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
465 {
466 	static const u_int modeflags[] = {
467 		0,			/* IEEE80211_MODE_AUTO */
468 		CHANNEL_A,		/* IEEE80211_MODE_11A */
469 		CHANNEL_B,		/* IEEE80211_MODE_11B */
470 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
471 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
472 	};
473 	return modeflags[ieee80211_chan2mode(ic, chan)];
474 }
475 
476 static void
477 ath_init(void *arg)
478 {
479 	struct ath_softc *sc = (struct ath_softc *) arg;
480 	struct ieee80211com *ic = &sc->sc_ic;
481 	struct ifnet *ifp = &ic->ic_if;
482 	struct ieee80211_node *ni;
483 	enum ieee80211_phymode mode;
484 	struct ath_hal *ah = sc->sc_ah;
485 	HAL_STATUS status;
486 	HAL_CHANNEL hchan;
487 
488 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
489 
490 	mtx_lock(&sc->sc_mtx);
491 	/*
492 	 * Stop anything previously setup.  This is safe
493 	 * whether this is the first time through or not.
494 	 */
495 	ath_stop(ifp);
496 
497 	/*
498 	 * The basic interface to setting the hardware in a good
499 	 * state is ``reset''.  On return the hardware is known to
500 	 * be powered up and with interrupts disabled.  This must
501 	 * be followed by initialization of the appropriate bits
502 	 * and then setup of the interrupt mask.
503 	 */
504 	hchan.channel = ic->ic_ibss_chan->ic_freq;
505 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
506 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
507 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
508 			status);
509 		goto done;
510 	}
511 
512 	/*
513 	 * Setup the hardware after reset: the key cache
514 	 * is filled as needed and the receive engine is
515 	 * set going.  Frame transmit is handled entirely
516 	 * in the frame output path; there's nothing to do
517 	 * here except setup the interrupt mask.
518 	 */
519 	if (ic->ic_flags & IEEE80211_F_WEPON)
520 		ath_initkeytable(sc);
521 	if (ath_startrecv(sc) != 0) {
522 		if_printf(ifp, "unable to start recv logic\n");
523 		goto done;
524 	}
525 
526 	/*
527 	 * Enable interrupts.
528 	 */
529 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
530 		  | HAL_INT_RXEOL | HAL_INT_RXORN
531 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
532 	ath_hal_intrset(ah, sc->sc_imask);
533 
534 	ifp->if_flags |= IFF_RUNNING;
535 	ic->ic_state = IEEE80211_S_INIT;
536 
537 	/*
538 	 * The hardware should be ready to go now so it's safe
539 	 * to kick the 802.11 state machine as it's likely to
540 	 * immediately call back to us to send mgmt frames.
541 	 */
542 	ni = ic->ic_bss;
543 	ni->ni_chan = ic->ic_ibss_chan;
544 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
545 	if (mode != sc->sc_curmode)
546 		ath_setcurmode(sc, mode);
547 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
548 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
549 	else
550 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
551 done:
552 	mtx_unlock(&sc->sc_mtx);
553 }
554 
555 static void
556 ath_stop(struct ifnet *ifp)
557 {
558 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
559 	struct ath_softc *sc = ifp->if_softc;
560 	struct ath_hal *ah = sc->sc_ah;
561 
562 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
563 		sc->sc_invalid, ifp->if_flags));
564 
565 	mtx_lock(&sc->sc_mtx);
566 	if (ifp->if_flags & IFF_RUNNING) {
567 		/*
568 		 * Shutdown the hardware and driver:
569 		 *    disable interrupts
570 		 *    turn off timers
571 		 *    clear transmit machinery
572 		 *    clear receive machinery
573 		 *    drain and release tx queues
574 		 *    reclaim beacon resources
575 		 *    reset 802.11 state machine
576 		 *    power down hardware
577 		 *
578 		 * Note that some of this work is not possible if the
579 		 * hardware is gone (invalid).
580 		 */
581 		ifp->if_flags &= ~IFF_RUNNING;
582 		ifp->if_timer = 0;
583 		if (!sc->sc_invalid)
584 			ath_hal_intrset(ah, 0);
585 		ath_draintxq(sc);
586 		if (!sc->sc_invalid)
587 			ath_stoprecv(sc);
588 		else
589 			sc->sc_rxlink = NULL;
590 		IF_DRAIN(&ifp->if_snd);
591 		ath_beacon_free(sc);
592 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
593 		if (!sc->sc_invalid)
594 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
595 	}
596 	mtx_unlock(&sc->sc_mtx);
597 }
598 
599 /*
600  * Reset the hardware w/o losing operational state.  This is
601  * basically a more efficient way of doing ath_stop, ath_init,
602  * followed by state transitions to the current 802.11
603  * operational state.  Used to recover from errors rx overrun
604  * and to reset the hardware when rf gain settings must be reset.
605  */
606 static void
607 ath_reset(struct ath_softc *sc)
608 {
609 	struct ieee80211com *ic = &sc->sc_ic;
610 	struct ifnet *ifp = &ic->ic_if;
611 	struct ath_hal *ah = sc->sc_ah;
612 	struct ieee80211_channel *c;
613 	HAL_STATUS status;
614 	HAL_CHANNEL hchan;
615 
616 	/*
617 	 * Convert to a HAL channel description with the flags
618 	 * constrained to reflect the current operating mode.
619 	 */
620 	c = ic->ic_ibss_chan;
621 	hchan.channel = c->ic_freq;
622 	hchan.channelFlags = ath_chan2flags(ic, c);
623 
624 	ath_hal_intrset(ah, 0);		/* disable interrupts */
625 	ath_draintxq(sc);		/* stop xmit side */
626 	ath_stoprecv(sc);		/* stop recv side */
627 	/* NB: indicate channel change so we do a full reset */
628 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
629 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
630 			__func__, status);
631 	ath_hal_intrset(ah, sc->sc_imask);
632 	if (ath_startrecv(sc) != 0)	/* restart recv */
633 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
634 	ath_start(ifp);			/* restart xmit */
635 	if (ic->ic_state == IEEE80211_S_RUN)
636 		ath_beacon_config(sc);	/* restart beacons */
637 }
638 
639 static void
640 ath_start(struct ifnet *ifp)
641 {
642 	struct ath_softc *sc = ifp->if_softc;
643 	struct ath_hal *ah = sc->sc_ah;
644 	struct ieee80211com *ic = &sc->sc_ic;
645 	struct ieee80211_node *ni;
646 	struct ath_buf *bf;
647 	struct mbuf *m;
648 	struct ieee80211_frame *wh;
649 
650 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
651 		return;
652 	for (;;) {
653 		/*
654 		 * Grab a TX buffer and associated resources.
655 		 */
656 		mtx_lock(&sc->sc_txbuflock);
657 		bf = TAILQ_FIRST(&sc->sc_txbuf);
658 		if (bf != NULL)
659 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
660 		mtx_unlock(&sc->sc_txbuflock);
661 		if (bf == NULL) {
662 			DPRINTF(("ath_start: out of xmit buffers\n"));
663 			sc->sc_stats.ast_tx_qstop++;
664 			ifp->if_flags |= IFF_OACTIVE;
665 			break;
666 		}
667 		/*
668 		 * Poll the management queue for frames; they
669 		 * have priority over normal data frames.
670 		 */
671 		IF_DEQUEUE(&ic->ic_mgtq, m);
672 		if (m == NULL) {
673 			/*
674 			 * No data frames go out unless we're associated.
675 			 */
676 			if (ic->ic_state != IEEE80211_S_RUN) {
677 				DPRINTF(("ath_start: ignore data packet, "
678 					"state %u\n", ic->ic_state));
679 				sc->sc_stats.ast_tx_discard++;
680 				mtx_lock(&sc->sc_txbuflock);
681 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
682 				mtx_unlock(&sc->sc_txbuflock);
683 				break;
684 			}
685 			IF_DEQUEUE(&ifp->if_snd, m);
686 			if (m == NULL) {
687 				mtx_lock(&sc->sc_txbuflock);
688 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
689 				mtx_unlock(&sc->sc_txbuflock);
690 				break;
691 			}
692 			ifp->if_opackets++;
693 			BPF_MTAP(ifp, m);
694 			/*
695 			 * Encapsulate the packet in prep for transmission.
696 			 */
697 			m = ieee80211_encap(ifp, m);
698 			if (m == NULL) {
699 				DPRINTF(("ath_start: encapsulation failure\n"));
700 				sc->sc_stats.ast_tx_encap++;
701 				goto bad;
702 			}
703 			wh = mtod(m, struct ieee80211_frame *);
704 			if (ic->ic_flags & IEEE80211_F_WEPON)
705 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
706 		} else {
707 			wh = mtod(m, struct ieee80211_frame *);
708 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
709 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
710 				/* fill time stamp */
711 				u_int64_t tsf;
712 				u_int32_t *tstamp;
713 
714 				tsf = ath_hal_gettsf64(ah);
715 				/* XXX: adjust 100us delay to xmit */
716 				tsf += 100;
717 				tstamp = (u_int32_t *)&wh[1];
718 				tstamp[0] = htole32(tsf & 0xffffffff);
719 				tstamp[1] = htole32(tsf >> 32);
720 			}
721 			sc->sc_stats.ast_tx_mgmt++;
722 		}
723 		if (ic->ic_rawbpf)
724 			bpf_mtap(ic->ic_rawbpf, m);
725 
726 		if (ic->ic_opmode != IEEE80211_M_STA) {
727 			ni = ieee80211_find_node(ic, wh->i_addr1);
728 			if (ni == NULL) {
729 				/*
730 				 * When not in station mode the destination
731 				 * address should always be in the node table
732 				 * unless this is a multicast/broadcast frame.
733 				 */
734 				if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
735 				    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
736 				    IEEE80211_FC0_TYPE_DATA) {
737 					m_freem(m);
738 					sc->sc_stats.ast_tx_nonode++;
739 					goto bad;
740 				}
741 				ni = ic->ic_bss;
742 			}
743 		} else
744 			ni = ic->ic_bss;
745 
746 		/*
747 		 * TODO:
748 		 * The duration field of 802.11 header should be filled.
749 		 * XXX This may be done in the ieee80211 layer, but the upper
750 		 *     doesn't know the detail of parameters such as IFS
751 		 *     for now..
752 		 */
753 
754 		if (IFF_DUMPPKTS(ifp))
755 			ieee80211_dump_pkt(mtod(m, u_int8_t *), m->m_len,
756 			    ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL,
757 			    -1);
758 
759 		if (ath_tx_start(sc, ni, bf, m)) {
760 	bad:
761 			mtx_lock(&sc->sc_txbuflock);
762 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
763 			mtx_unlock(&sc->sc_txbuflock);
764 			ifp->if_oerrors++;
765 			continue;
766 		}
767 
768 		sc->sc_tx_timer = 5;
769 		ifp->if_timer = 1;
770 	}
771 }
772 
773 static int
774 ath_media_change(struct ifnet *ifp)
775 {
776 	int error;
777 
778 	error = ieee80211_media_change(ifp);
779 	if (error == ENETRESET) {
780 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
781 		    (IFF_RUNNING|IFF_UP))
782 			ath_init(ifp);		/* XXX lose error */
783 		error = 0;
784 	}
785 	return error;
786 }
787 
788 static void
789 ath_watchdog(struct ifnet *ifp)
790 {
791 	struct ath_softc *sc = ifp->if_softc;
792 	struct ieee80211com *ic = &sc->sc_ic;
793 
794 	ifp->if_timer = 0;
795 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
796 		return;
797 	if (sc->sc_tx_timer) {
798 		if (--sc->sc_tx_timer == 0) {
799 			if_printf(ifp, "device timeout\n");
800 #ifdef AR_DEBUG
801 			if (ath_debug)
802 				ath_hal_dumpstate(sc->sc_ah);
803 #endif /* AR_DEBUG */
804 			ath_init(ifp);		/* XXX ath_reset??? */
805 			ifp->if_oerrors++;
806 			sc->sc_stats.ast_watchdog++;
807 			return;
808 		}
809 		ifp->if_timer = 1;
810 	}
811 	if (ic->ic_fixed_rate == -1) {
812 		/*
813 		 * Run the rate control algorithm if we're not
814 		 * locked at a fixed rate.
815 		 */
816 		if (ic->ic_opmode == IEEE80211_M_STA)
817 			ath_rate_ctl(sc, ic->ic_bss);
818 		else
819 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
820 	}
821 	ieee80211_watchdog(ifp);
822 }
823 
824 static int
825 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
826 {
827 	struct ath_softc *sc = ifp->if_softc;
828 	struct ifreq *ifr = (struct ifreq *)data;
829 	int error = 0;
830 
831 	mtx_lock(&sc->sc_mtx);
832 	switch (cmd) {
833 	case SIOCSIFFLAGS:
834 		if (ifp->if_flags & IFF_UP) {
835 			if (ifp->if_flags & IFF_RUNNING) {
836 				/*
837 				 * To avoid rescanning another access point,
838 				 * do not call ath_init() here.  Instead,
839 				 * only reflect promisc mode settings.
840 				 */
841 				ath_mode_init(sc);
842 			} else
843 				ath_init(ifp);		/* XXX lose error */
844 		} else
845 			ath_stop(ifp);
846 		break;
847 	case SIOCADDMULTI:
848 	case SIOCDELMULTI:
849 		/*
850 		 * The upper layer has already installed/removed
851 		 * the multicast address(es), just recalculate the
852 		 * multicast filter for the card.
853 		 */
854 		if (ifp->if_flags & IFF_RUNNING)
855 			ath_mode_init(sc);
856 		break;
857 	case SIOCGATHSTATS:
858 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
859 		break;
860 	default:
861 		error = ieee80211_ioctl(ifp, cmd, data);
862 		if (error == ENETRESET) {
863 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
864 			    (IFF_RUNNING|IFF_UP))
865 				ath_init(ifp);		/* XXX lose error */
866 			error = 0;
867 		}
868 		break;
869 	}
870 	mtx_unlock(&sc->sc_mtx);
871 	return error;
872 }
873 
874 /*
875  * Fill the hardware key cache with key entries.
876  */
877 static void
878 ath_initkeytable(struct ath_softc *sc)
879 {
880 	struct ieee80211com *ic = &sc->sc_ic;
881 	struct ath_hal *ah = sc->sc_ah;
882 	int i;
883 
884 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
885 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
886 		if (k->wk_len == 0)
887 			ath_hal_keyreset(ah, i);
888 		else
889 			/* XXX return value */
890 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
891 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
892 	}
893 }
894 
895 static void
896 ath_mode_init(struct ath_softc *sc)
897 {
898 	struct ieee80211com *ic = &sc->sc_ic;
899 	struct ath_hal *ah = sc->sc_ah;
900 	struct ifnet *ifp = &ic->ic_if;
901 	u_int32_t rfilt, mfilt[2], val;
902 	u_int8_t pos;
903 	struct ifmultiaddr *ifma;
904 
905 	/* configure operational mode */
906 	ath_hal_setopmode(ah, ic->ic_opmode);
907 
908 	/* receive filter */
909 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
910 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
911 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
912 	    (ifp->if_flags & IFF_PROMISC))
913 		rfilt |= HAL_RX_FILTER_PROM;
914 	if (ic->ic_state == IEEE80211_S_SCAN)
915 		rfilt |= HAL_RX_FILTER_BEACON;
916 	ath_hal_setrxfilter(ah, rfilt);
917 
918 	/* calculate and install multicast filter */
919 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
920 		mfilt[0] = mfilt[1] = 0;
921 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
922 			caddr_t dl;
923 
924 			/* calculate XOR of eight 6bit values */
925 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
926 			val = LE_READ_4(dl + 0);
927 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
928 			val = LE_READ_4(dl + 3);
929 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
930 			pos &= 0x3f;
931 			mfilt[pos / 32] |= (1 << (pos % 32));
932 		}
933 	} else {
934 		mfilt[0] = mfilt[1] = ~0;
935 	}
936 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
937 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
938 		rfilt, mfilt[0], mfilt[1]));
939 }
940 
941 static void
942 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
943 {
944 	struct ath_buf *bf = arg;
945 
946 	KASSERT(nseg <= ATH_MAX_SCATTER,
947 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
948 	bf->bf_mapsize = mapsize;
949 	bf->bf_nseg = nseg;
950 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
951 }
952 
953 static int
954 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
955 {
956 	struct ieee80211com *ic = &sc->sc_ic;
957 	struct ifnet *ifp = &ic->ic_if;
958 	struct ath_hal *ah = sc->sc_ah;
959 	struct ieee80211_frame *wh;
960 	struct ath_buf *bf;
961 	struct ath_desc *ds;
962 	struct mbuf *m;
963 	int error, pktlen;
964 	u_int8_t *frm, rate;
965 	u_int16_t capinfo;
966 	struct ieee80211_rateset *rs;
967 	const HAL_RATE_TABLE *rt;
968 
969 	bf = sc->sc_bcbuf;
970 	if (bf->bf_m != NULL) {
971 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
972 		m_freem(bf->bf_m);
973 		bf->bf_m = NULL;
974 		bf->bf_node = NULL;
975 	}
976 	/*
977 	 * NB: the beacon data buffer must be 32-bit aligned;
978 	 * we assume the mbuf routines will return us something
979 	 * with this alignment (perhaps should assert).
980 	 */
981 	rs = &ni->ni_rates;
982 	pktlen = 8 + 2 + 2+ 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
983 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
984 		pktlen += 2;
985 	if (pktlen <= MHLEN)
986 		MGETHDR(m, M_DONTWAIT, MT_DATA);
987 	else
988 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
989 	if (m == NULL) {
990 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
991 			pktlen));
992 		sc->sc_stats.ast_be_nombuf++;
993 		return ENOMEM;
994 	}
995 
996 	wh = mtod(m, struct ieee80211_frame *);
997 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
998 	    IEEE80211_FC0_SUBTYPE_BEACON;
999 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1000 	*(u_int16_t *)wh->i_dur = 0;
1001 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
1002 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1003 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1004 	*(u_int16_t *)wh->i_seq = 0;
1005 
1006 	/*
1007 	 * beacon frame format
1008 	 *	[8] time stamp
1009 	 *	[2] beacon interval
1010 	 *	[2] cabability information
1011 	 *	[tlv] ssid
1012 	 *	[tlv] supported rates
1013 	 *	[tlv] parameter set (IBSS)
1014 	 *	[tlv] extended supported rates
1015 	 */
1016 	frm = (u_int8_t *)&wh[1];
1017 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1018 	frm += 8;
1019 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1020 	frm += 2;
1021 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1022 		capinfo = IEEE80211_CAPINFO_IBSS;
1023 	else
1024 		capinfo = IEEE80211_CAPINFO_ESS;
1025 	if (ic->ic_flags & IEEE80211_F_WEPON)
1026 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1027 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1028 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1029 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1030 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1031 	*(u_int16_t *)frm = htole16(capinfo);
1032 	frm += 2;
1033 	*frm++ = IEEE80211_ELEMID_SSID;
1034 	*frm++ = ni->ni_esslen;
1035 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1036 	frm += ni->ni_esslen;
1037 	frm = ieee80211_add_rates(frm, rs);
1038 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1039 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1040 		*frm++ = 2;
1041 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1042 	} else {
1043 		/* TODO: TIM */
1044 		*frm++ = IEEE80211_ELEMID_TIM;
1045 		*frm++ = 4;	/* length */
1046 		*frm++ = 0;	/* DTIM count */
1047 		*frm++ = 1;	/* DTIM period */
1048 		*frm++ = 0;	/* bitmap control */
1049 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1050 	}
1051 	frm = ieee80211_add_xrates(frm, rs);
1052 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1053 
1054 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1055 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1056 				     ath_mbuf_load_cb, bf,
1057 				     BUS_DMA_NOWAIT);
1058 	if (error != 0) {
1059 		m_freem(m);
1060 		return error;
1061 	}
1062 	KASSERT(bf->bf_nseg == 1,
1063 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1064 		bf->bf_nseg));
1065 	bf->bf_m = m;
1066 
1067 	/* setup descriptors */
1068 	ds = bf->bf_desc;
1069 
1070 	ds->ds_link = 0;
1071 	ds->ds_data = bf->bf_segs[0].ds_addr;
1072 	/* XXX verify mbuf data area covers this roundup */
1073 	/*
1074 	 * Calculate rate code.
1075 	 * XXX everything at min xmit rate
1076 	 */
1077 	rt = sc->sc_currates;
1078 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1079 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1080 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1081 	else
1082 		rate = rt->info[0].rateCode;
1083 	ath_hal_setuptxdesc(ah, ds
1084 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1085 		, sizeof(struct ieee80211_frame)	/* header length */
1086 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1087 		, 0x20				/* txpower XXX */
1088 		, rate, 1			/* series 0 rate/tries */
1089 		, HAL_TXKEYIX_INVALID		/* no encryption */
1090 		, 0				/* antenna mode */
1091 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1092 		, 0				/* rts/cts rate */
1093 		, 0				/* rts/cts duration */
1094 	);
1095 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1096 	ath_hal_filltxdesc(ah, ds
1097 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1098 		, AH_TRUE				/* first segment */
1099 		, AH_TRUE				/* last segment */
1100 	);
1101 
1102 	return 0;
1103 }
1104 
1105 static void
1106 ath_beacon_proc(void *arg, int pending)
1107 {
1108 	struct ath_softc *sc = arg;
1109 	struct ieee80211com *ic = &sc->sc_ic;
1110 	struct ath_buf *bf = sc->sc_bcbuf;
1111 	struct ath_hal *ah = sc->sc_ah;
1112 
1113 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1114 	if (ic->ic_opmode == IEEE80211_M_STA || bf == NULL || bf->bf_m == NULL) {
1115 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1116 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1117 		return;
1118 	}
1119 	/* update beacon to reflect PS poll state */
1120 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1121 		DPRINTF(("%s: beacon queue %u did not stop?",
1122 			__func__, sc->sc_bhalq));
1123 		return;			/* busy, XXX is this right? */
1124 	}
1125 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1126 
1127 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1128 	ath_hal_txstart(ah, sc->sc_bhalq);
1129 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1130 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1131 }
1132 
1133 static void
1134 ath_beacon_free(struct ath_softc *sc)
1135 {
1136 	struct ath_buf *bf = sc->sc_bcbuf;
1137 
1138 	if (bf->bf_m != NULL) {
1139 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1140 		m_freem(bf->bf_m);
1141 		bf->bf_m = NULL;
1142 		bf->bf_node = NULL;
1143 	}
1144 }
1145 
1146 /*
1147  * Configure the beacon and sleep timers.
1148  *
1149  * When operating as an AP this resets the TSF and sets
1150  * up the hardware to notify us when we need to issue beacons.
1151  *
1152  * When operating in station mode this sets up the beacon
1153  * timers according to the timestamp of the last received
1154  * beacon and the current TSF, configures PCF and DTIM
1155  * handling, programs the sleep registers so the hardware
1156  * will wakeup in time to receive beacons, and configures
1157  * the beacon miss handling so we'll receive a BMISS
1158  * interrupt when we stop seeing beacons from the AP
1159  * we've associated with.
1160  */
1161 static void
1162 ath_beacon_config(struct ath_softc *sc)
1163 {
1164 	struct ath_hal *ah = sc->sc_ah;
1165 	struct ieee80211com *ic = &sc->sc_ic;
1166 	struct ieee80211_node *ni = ic->ic_bss;
1167 	u_int32_t nexttbtt;
1168 
1169 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1170 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1171 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1172 	nexttbtt += ni->ni_intval;
1173 	if (ic->ic_opmode == IEEE80211_M_STA) {
1174 		HAL_BEACON_STATE bs;
1175 		u_int32_t bmisstime;
1176 
1177 		/* NB: no PCF support right now */
1178 		memset(&bs, 0, sizeof(bs));
1179 		bs.bs_intval = ni->ni_intval;
1180 		bs.bs_nexttbtt = nexttbtt;
1181 		bs.bs_dtimperiod = bs.bs_intval;
1182 		bs.bs_nextdtim = nexttbtt;
1183 		/*
1184 		 * Calculate the number of consecutive beacons to miss
1185 		 * before taking a BMISS interrupt.  The configuration
1186 		 * is specified in ms, so we need to convert that to
1187 		 * TU's and then calculate based on the beacon interval.
1188 		 * Note that we clamp the result to at most 10 beacons.
1189 		 */
1190 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1191 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1192 		if (bs.bs_bmissthreshold > 10)
1193 			bs.bs_bmissthreshold = 10;
1194 		else if (bs.bs_bmissthreshold <= 0)
1195 			bs.bs_bmissthreshold = 1;
1196 
1197 		/*
1198 		 * Calculate sleep duration.  The configuration is
1199 		 * given in ms.  We insure a multiple of the beacon
1200 		 * period is used.  Also, if the sleep duration is
1201 		 * greater than the DTIM period then it makes senses
1202 		 * to make it a multiple of that.
1203 		 *
1204 		 * XXX fixed at 100ms
1205 		 */
1206 		bs.bs_sleepduration =
1207 			roundup((100 * 1000) / 1024, bs.bs_intval);
1208 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1209 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1210 
1211 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1212 			, __func__
1213 			, bs.bs_intval
1214 			, bs.bs_nexttbtt
1215 			, bs.bs_dtimperiod
1216 			, bs.bs_nextdtim
1217 			, bs.bs_bmissthreshold
1218 			, bs.bs_sleepduration
1219 		));
1220 		ath_hal_intrset(ah, 0);
1221 		/*
1222 		 * Reset our tsf so the hardware will update the
1223 		 * tsf register to reflect timestamps found in
1224 		 * received beacons.
1225 		 */
1226 		ath_hal_resettsf(ah);
1227 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1228 		sc->sc_imask |= HAL_INT_BMISS;
1229 		ath_hal_intrset(ah, sc->sc_imask);
1230 	} else {
1231 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1232 			__func__, ni->ni_intval, nexttbtt));
1233 		ath_hal_intrset(ah, 0);
1234 		ath_hal_beaconinit(ah, ic->ic_opmode,
1235 			nexttbtt, ni->ni_intval);
1236 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1237 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1238 		ath_hal_intrset(ah, sc->sc_imask);
1239 	}
1240 }
1241 
1242 static void
1243 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1244 {
1245 	bus_addr_t *paddr = (bus_addr_t*) arg;
1246 	*paddr = segs->ds_addr;
1247 }
1248 
1249 static int
1250 ath_desc_alloc(struct ath_softc *sc)
1251 {
1252 	int i, bsize, error;
1253 	struct ath_desc *ds;
1254 	struct ath_buf *bf;
1255 
1256 	/* allocate descriptors */
1257 	sc->sc_desc_len = sizeof(struct ath_desc) *
1258 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1259 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1260 	if (error != 0)
1261 		return error;
1262 
1263 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1264 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1265 	if (error != 0)
1266 		goto fail0;
1267 
1268 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1269 				sc->sc_desc, sc->sc_desc_len,
1270 				ath_load_cb, &sc->sc_desc_paddr,
1271 				BUS_DMA_NOWAIT);
1272 	if (error != 0)
1273 		goto fail1;
1274 
1275 	ds = sc->sc_desc;
1276 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1277 	    ds, sc->sc_desc_len,
1278 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1279 
1280 	/* allocate buffers */
1281 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1282 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1283 	if (bf == NULL)
1284 		goto fail2;
1285 	sc->sc_bufptr = bf;
1286 
1287 	TAILQ_INIT(&sc->sc_rxbuf);
1288 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1289 		bf->bf_desc = ds;
1290 		bf->bf_daddr = sc->sc_desc_paddr +
1291 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1292 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1293 					  &bf->bf_dmamap);
1294 		if (error != 0)
1295 			break;
1296 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1297 	}
1298 
1299 	TAILQ_INIT(&sc->sc_txbuf);
1300 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1301 		bf->bf_desc = ds;
1302 		bf->bf_daddr = sc->sc_desc_paddr +
1303 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1304 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1305 					  &bf->bf_dmamap);
1306 		if (error != 0)
1307 			break;
1308 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1309 	}
1310 	TAILQ_INIT(&sc->sc_txq);
1311 
1312 	/* beacon buffer */
1313 	bf->bf_desc = ds;
1314 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1315 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1316 	if (error != 0)
1317 		return error;
1318 	sc->sc_bcbuf = bf;
1319 	return 0;
1320 
1321 fail2:
1322 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1323 fail1:
1324 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1325 fail0:
1326 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1327 	sc->sc_ddmamap = NULL;
1328 	return error;
1329 }
1330 
1331 static void
1332 ath_desc_free(struct ath_softc *sc)
1333 {
1334 	struct ath_buf *bf;
1335 
1336 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1337 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1338 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1339 
1340 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1341 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1342 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1343 		m_freem(bf->bf_m);
1344 	}
1345 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1346 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1347 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1348 		if (bf->bf_m) {
1349 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1350 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1351 			m_freem(bf->bf_m);
1352 			bf->bf_m = NULL;
1353 		}
1354 	}
1355 	if (sc->sc_bcbuf != NULL) {
1356 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1357 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1358 		sc->sc_bcbuf = NULL;
1359 	}
1360 
1361 	TAILQ_INIT(&sc->sc_rxbuf);
1362 	TAILQ_INIT(&sc->sc_txbuf);
1363 	TAILQ_INIT(&sc->sc_txq);
1364 	free(sc->sc_bufptr, M_DEVBUF);
1365 	sc->sc_bufptr = NULL;
1366 }
1367 
1368 static struct ieee80211_node *
1369 ath_node_alloc(struct ieee80211com *ic)
1370 {
1371 	struct ath_node *an =
1372 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1373 	return an ? &an->st_node : NULL;
1374 }
1375 
1376 static void
1377 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1378 {
1379         struct ath_softc *sc = ic->ic_if.if_softc;
1380 	struct ath_buf *bf;
1381 
1382 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1383 		if (bf->bf_node == ni)
1384 			bf->bf_node = NULL;
1385 	}
1386 	free(ni, M_DEVBUF);
1387 }
1388 
1389 static void
1390 ath_node_copy(struct ieee80211com *ic,
1391 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1392 {
1393 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1394 }
1395 
1396 static int
1397 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1398 {
1399 	struct ath_hal *ah = sc->sc_ah;
1400 	int error;
1401 	struct mbuf *m;
1402 	struct ath_desc *ds;
1403 
1404 	m = bf->bf_m;
1405 	if (m == NULL) {
1406 		/*
1407 		 * NB: by assigning a page to the rx dma buffer we
1408 		 * implicitly satisfy the Atheros requirement that
1409 		 * this buffer be cache-line-aligned and sized to be
1410 		 * multiple of the cache line size.  Not doing this
1411 		 * causes weird stuff to happen (for the 5210 at least).
1412 		 */
1413 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1414 		if (m == NULL) {
1415 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1416 			sc->sc_stats.ast_rx_nombuf++;
1417 			return ENOMEM;
1418 		}
1419 		bf->bf_m = m;
1420 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1421 
1422 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1423 					     ath_mbuf_load_cb, bf,
1424 					     BUS_DMA_NOWAIT);
1425 		if (error != 0) {
1426 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1427 				" error %d\n", error));
1428 			sc->sc_stats.ast_rx_busdma++;
1429 			return error;
1430 		}
1431 		KASSERT(bf->bf_nseg == 1,
1432 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1433 			bf->bf_nseg));
1434 	}
1435 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1436 
1437 	/* setup descriptors */
1438 	ds = bf->bf_desc;
1439 	ds->ds_link = 0;
1440 	ds->ds_data = bf->bf_segs[0].ds_addr;
1441 	ath_hal_setuprxdesc(ah, ds
1442 		, m->m_len		/* buffer size */
1443 		, 0
1444 	);
1445 
1446 	if (sc->sc_rxlink != NULL)
1447 		*sc->sc_rxlink = bf->bf_daddr;
1448 	sc->sc_rxlink = &ds->ds_link;
1449 	return 0;
1450 }
1451 
1452 static void
1453 ath_rx_proc(void *arg, int npending)
1454 {
1455 	struct ath_softc *sc = arg;
1456 	struct ath_buf *bf;
1457 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1458 	struct ath_hal *ah = sc->sc_ah;
1459 	struct ath_desc *ds;
1460 	struct mbuf *m;
1461 	struct ieee80211_frame *wh, whbuf;
1462 	int len;
1463 	u_int phyerr;
1464 	HAL_STATUS status;
1465 
1466 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1467 	do {
1468 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1469 		if (bf == NULL) {		/* NB: shouldn't happen */
1470 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1471 			break;
1472 		}
1473 		m = bf->bf_m;
1474 		if (m == NULL) {		/* NB: shouldn't happen */
1475 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1476 			continue;
1477 		}
1478 		ds = bf->bf_desc;
1479 		status = ath_hal_rxprocdesc(ah, ds);
1480 #ifdef AR_DEBUG
1481 		if (ath_debug > 1)
1482 			ath_printrxbuf(bf, status == HAL_OK);
1483 #endif
1484 		if (status == HAL_EINPROGRESS)
1485 			break;
1486 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1487 		if (ds->ds_rxstat.rs_status != 0) {
1488 			ifp->if_ierrors++;
1489 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1490 				sc->sc_stats.ast_rx_crcerr++;
1491 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1492 				sc->sc_stats.ast_rx_fifoerr++;
1493 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1494 				sc->sc_stats.ast_rx_badcrypt++;
1495 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1496 				sc->sc_stats.ast_rx_phyerr++;
1497 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1498 				sc->sc_stats.ast_rx_phy[phyerr]++;
1499 			}
1500 			goto rx_next;
1501 		}
1502 
1503 		len = ds->ds_rxstat.rs_datalen;
1504 		if (len < sizeof(struct ieee80211_frame)) {
1505 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1506 			goto rx_next;
1507 		}
1508 
1509 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1510 		    BUS_DMASYNC_POSTREAD);
1511 
1512 		wh = mtod(m, struct ieee80211_frame *);
1513 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1514 		    IEEE80211_FC0_TYPE_CTL) {
1515 			/*
1516 			 * Ignore control frame received in promisc mode.
1517 			 */
1518 			DPRINTF(("ath_rx_proc: control frame\n"));
1519 			goto rx_next;
1520 		}
1521 
1522 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1523 		bf->bf_m = NULL;
1524 		m->m_pkthdr.rcvif = ifp;
1525 		m->m_pkthdr.len = m->m_len = len;
1526 		if (IFF_DUMPPKTS(ifp)) {
1527 			struct ieee80211com *ic = &sc->sc_ic;
1528 			const HAL_RATE_TABLE *rt = sc->sc_rates[ic->ic_curmode];
1529 			ieee80211_dump_pkt(mtod(m, u_int8_t *), len,
1530 				rt ? rt->info[rt->rateCodeToIndex[ds->ds_rxstat.rs_rate]].dot11Rate & IEEE80211_RATE_VAL : 0,
1531 				ds->ds_rxstat.rs_rssi);
1532 		}
1533 		m_adj(m, -IEEE80211_CRC_LEN);
1534 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1535 			/*
1536 			 * WEP is decrypted by hardware. Clear WEP bit
1537 			 * and trim WEP header for ieee80211_input().
1538 			 */
1539 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1540 			memcpy(&whbuf, wh, sizeof(whbuf));
1541 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1542 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
1543 			/*
1544 			 * Also trim WEP ICV from the tail.
1545 			 */
1546 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1547 		}
1548 		ieee80211_input(ifp, m,
1549 			ds->ds_rxstat.rs_rssi,
1550 			ds->ds_rxstat.rs_tstamp,
1551 			ds->ds_rxstat.rs_antenna);
1552   rx_next:
1553 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1554 	} while (ath_rxbuf_init(sc, bf) == 0);
1555 
1556 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1557 	ath_hal_rxena(ah);			/* in case of RXEOL */
1558 }
1559 
1560 /*
1561  * XXX Size of an ACK control frame in bytes.
1562  */
1563 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1564 
1565 static int
1566 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1567     struct mbuf *m0)
1568 {
1569 	struct ieee80211com *ic = &sc->sc_ic;
1570 	struct ath_hal *ah = sc->sc_ah;
1571 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1572 	int i, error, iswep, hdrlen, pktlen;
1573 	u_int8_t rix, cix, txrate, ctsrate;
1574 	struct ath_desc *ds;
1575 	struct mbuf *m;
1576 	struct ieee80211_frame *wh;
1577 	u_int32_t iv;
1578 	u_int8_t *ivp;
1579 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1580 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1581 	u_int subtype, flags, ctsduration, antenna;
1582 	HAL_PKT_TYPE atype;
1583 	const HAL_RATE_TABLE *rt;
1584 	HAL_BOOL shortPreamble;
1585 	struct ath_node *an;
1586 
1587 	wh = mtod(m0, struct ieee80211_frame *);
1588 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1589 	hdrlen = sizeof(struct ieee80211_frame);
1590 	pktlen = m0->m_pkthdr.len;
1591 
1592 	if (iswep) {
1593 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1594 		m_adj(m0, hdrlen);
1595 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1596 		if (m0 == NULL) {
1597 			sc->sc_stats.ast_tx_nombuf++;
1598 			return ENOMEM;
1599 		}
1600 		ivp = hdrbuf + hdrlen;
1601 		/*
1602 		 * XXX
1603 		 * IV must not duplicate during the lifetime of the key.
1604 		 * But no mechanism to renew keys is defined in IEEE 802.11
1605 		 * WEP.  And IV may be duplicated between other stations
1606 		 * because of the session key itself is shared.
1607 		 * So we use pseudo random IV for now, though it is not the
1608 		 * right way.
1609 		 */
1610 		iv = arc4random();
1611 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1612 			ivp[i] = iv;
1613 			iv >>= 8;
1614 		}
1615 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1616 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1617 		/*
1618 		 * The ICV length must be included into hdrlen and pktlen.
1619 		 */
1620 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1621 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1622 	}
1623 	pktlen += IEEE80211_CRC_LEN;
1624 
1625 	/*
1626 	 * Load the DMA map so any coalescing is done.  This
1627 	 * also calculates the number of descriptors we need.
1628 	 */
1629 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1630 				     ath_mbuf_load_cb, bf,
1631 				     BUS_DMA_NOWAIT);
1632 	if (error != 0) {
1633 		sc->sc_stats.ast_tx_busdma++;
1634 		m_freem(m0);
1635 		return error;
1636 	}
1637 	/*
1638 	 * Discard null packets and check for packets that
1639 	 * require too many TX descriptors.  We try to convert
1640 	 * the latter to a cluster.
1641 	 */
1642 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1643 		sc->sc_stats.ast_tx_linear++;
1644 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1645 		if (m == NULL) {
1646 			sc->sc_stats.ast_tx_nombuf++;
1647 			m_freem(m0);
1648 			return ENOMEM;
1649 		}
1650 		M_MOVE_PKTHDR(m, m0);
1651 		MCLGET(m, M_DONTWAIT);
1652 		if ((m->m_flags & M_EXT) == 0) {
1653 			sc->sc_stats.ast_tx_nomcl++;
1654 			m_freem(m0);
1655 			m_free(m);
1656 			return ENOMEM;
1657 		}
1658 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1659 		m_freem(m0);
1660 		m->m_len = m->m_pkthdr.len;
1661 		m0 = m;
1662 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1663 					     ath_mbuf_load_cb, bf,
1664 					     BUS_DMA_NOWAIT);
1665 		if (error != 0) {
1666 			sc->sc_stats.ast_tx_busdma++;
1667 			m_freem(m0);
1668 			return error;
1669 		}
1670 		KASSERT(bf->bf_nseg == 1,
1671 			("ath_tx_start: packet not one segment; nseg %u",
1672 			bf->bf_nseg));
1673 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1674 		sc->sc_stats.ast_tx_nodata++;
1675 		m_freem(m0);
1676 		return EIO;
1677 	}
1678 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1679 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1680 	bf->bf_m = m0;
1681 	bf->bf_node = ni;
1682 
1683 	/* setup descriptors */
1684 	ds = bf->bf_desc;
1685 	rt = sc->sc_currates;
1686 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1687 
1688 	/*
1689 	 * Calculate Atheros packet type from IEEE80211 packet header
1690 	 * and setup for rate calculations.
1691 	 */
1692 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1693 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1694 	case IEEE80211_FC0_TYPE_MGT:
1695 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1696 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1697 			atype = HAL_PKT_TYPE_BEACON;
1698 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1699 			atype = HAL_PKT_TYPE_PROBE_RESP;
1700 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1701 			atype = HAL_PKT_TYPE_ATIM;
1702 		rix = 0;			/* XXX lowest rate */
1703 		break;
1704 	case IEEE80211_FC0_TYPE_CTL:
1705 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1706 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1707 			atype = HAL_PKT_TYPE_PSPOLL;
1708 		rix = 0;			/* XXX lowest rate */
1709 		break;
1710 	default:
1711 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1712 				IEEE80211_RATE_VAL];
1713 		if (rix == 0xff) {
1714 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1715 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1716 			sc->sc_stats.ast_tx_badrate++;
1717 			m_freem(m0);
1718 			return EIO;
1719 		}
1720 		break;
1721 	}
1722 	/*
1723 	 * NB: the 802.11 layer marks whether or not we should
1724 	 * use short preamble based on the current mode and
1725 	 * negotiated parameters.
1726 	 */
1727 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1728 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1729 		shortPreamble = AH_TRUE;
1730 		sc->sc_stats.ast_tx_shortpre++;
1731 	} else {
1732 		txrate = rt->info[rix].rateCode;
1733 		shortPreamble = AH_FALSE;
1734 	}
1735 
1736 	/*
1737 	 * Calculate miscellaneous flags.
1738 	 */
1739 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1740 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1741 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1742 		sc->sc_stats.ast_tx_noack++;
1743 	} else if (pktlen > ic->ic_rtsthreshold) {
1744 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
1745 		sc->sc_stats.ast_tx_rts++;
1746 	}
1747 
1748 	/*
1749 	 * Calculate RTS/CTS rate and duration if needed.
1750 	 */
1751 	ctsduration = 0;
1752 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
1753 		/*
1754 		 * CTS transmit rate is derived from the transmit rate
1755 		 * by looking in the h/w rate table.  We must also factor
1756 		 * in whether or not a short preamble is to be used.
1757 		 */
1758 		cix = rt->info[rix].controlRate;
1759 		ctsrate = rt->info[cix].rateCode;
1760 		if (shortPreamble)
1761 			ctsrate |= rt->info[cix].shortPreamble;
1762 		/*
1763 		 * Compute the transmit duration based on the size
1764 		 * of an ACK frame.  We call into the HAL to do the
1765 		 * computation since it depends on the characteristics
1766 		 * of the actual PHY being used.
1767 		 */
1768 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
1769 			ctsduration += ath_hal_computetxtime(ah,
1770 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1771 		}
1772 		/* SIFS + data */
1773 		ctsduration += ath_hal_computetxtime(ah,
1774 			rt, pktlen, rix, shortPreamble);
1775 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
1776 			ctsduration += ath_hal_computetxtime(ah,
1777 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1778 		}
1779 	} else
1780 		ctsrate = 0;
1781 
1782 	/*
1783 	 * For now use the antenna on which the last good
1784 	 * frame was received on.  We assume this field is
1785 	 * initialized to 0 which gives us ``auto'' or the
1786 	 * ``default'' antenna.
1787 	 */
1788 	an = (struct ath_node *) ni;
1789 	if (an->an_tx_antenna)
1790 		antenna = an->an_tx_antenna;
1791 	else
1792 		antenna = ni->ni_rantenna;
1793 
1794 	/*
1795 	 * Formulate first tx descriptor with tx controls.
1796 	 */
1797 	/* XXX check return value? */
1798 	ath_hal_setuptxdesc(ah, ds
1799 		, pktlen		/* packet length */
1800 		, hdrlen		/* header length */
1801 		, atype			/* Atheros packet type */
1802 		, 60			/* txpower XXX */
1803 		, txrate, 1+10		/* series 0 rate/tries */
1804 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
1805 		, antenna		/* antenna mode */
1806 		, flags			/* flags */
1807 		, ctsrate		/* rts/cts rate */
1808 		, ctsduration		/* rts/cts duration */
1809 	);
1810 #ifdef notyet
1811 	ath_hal_setupxtxdesc(ah, ds
1812 		, AH_FALSE		/* short preamble */
1813 		, 0, 0			/* series 1 rate/tries */
1814 		, 0, 0			/* series 2 rate/tries */
1815 		, 0, 0			/* series 3 rate/tries */
1816 	);
1817 #endif
1818 	/*
1819 	 * Fillin the remainder of the descriptor info.
1820 	 */
1821 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
1822 		ds->ds_data = bf->bf_segs[i].ds_addr;
1823 		if (i == bf->bf_nseg - 1)
1824 			ds->ds_link = 0;
1825 		else
1826 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
1827 		ath_hal_filltxdesc(ah, ds
1828 			, bf->bf_segs[i].ds_len	/* segment length */
1829 			, i == 0		/* first segment */
1830 			, i == bf->bf_nseg - 1	/* last segment */
1831 		);
1832 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
1833 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
1834 		    ds->ds_hw[0], ds->ds_hw[1]));
1835 	}
1836 
1837 	/*
1838 	 * Insert the frame on the outbound list and
1839 	 * pass it on to the hardware.
1840 	 */
1841 	mtx_lock(&sc->sc_txqlock);
1842 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
1843 	if (sc->sc_txlink == NULL) {
1844 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
1845 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
1846 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
1847 	} else {
1848 		*sc->sc_txlink = bf->bf_daddr;
1849 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
1850 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
1851 	}
1852 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
1853 	mtx_unlock(&sc->sc_txqlock);
1854 
1855 	ath_hal_txstart(ah, sc->sc_txhalq);
1856 	return 0;
1857 }
1858 
1859 static void
1860 ath_tx_proc(void *arg, int npending)
1861 {
1862 	struct ath_softc *sc = arg;
1863 	struct ath_hal *ah = sc->sc_ah;
1864 	struct ath_buf *bf;
1865 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1866 	struct ath_desc *ds;
1867 	struct ieee80211_node *ni;
1868 	struct ath_node *an;
1869 	int sr, lr;
1870 	HAL_STATUS status;
1871 
1872 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
1873 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
1874 		sc->sc_txlink));
1875 	for (;;) {
1876 		mtx_lock(&sc->sc_txqlock);
1877 		bf = TAILQ_FIRST(&sc->sc_txq);
1878 		if (bf == NULL) {
1879 			sc->sc_txlink = NULL;
1880 			mtx_unlock(&sc->sc_txqlock);
1881 			break;
1882 		}
1883 		/* only the last descriptor is needed */
1884 		ds = &bf->bf_desc[bf->bf_nseg - 1];
1885 		status = ath_hal_txprocdesc(ah, ds);
1886 #ifdef AR_DEBUG
1887 		if (ath_debug > 1)
1888 			ath_printtxbuf(bf, status == HAL_OK);
1889 #endif
1890 		if (status == HAL_EINPROGRESS) {
1891 			mtx_unlock(&sc->sc_txqlock);
1892 			break;
1893 		}
1894 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1895 		mtx_unlock(&sc->sc_txqlock);
1896 
1897 		ni = bf->bf_node;
1898 		if (ni != NULL) {
1899 			an = (struct ath_node *) ni;
1900 			if (ds->ds_txstat.ts_status == 0) {
1901 				an->an_tx_ok++;
1902 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
1903 			} else {
1904 				an->an_tx_err++;
1905 				ifp->if_oerrors++;
1906 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
1907 					sc->sc_stats.ast_tx_xretries++;
1908 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
1909 					sc->sc_stats.ast_tx_fifoerr++;
1910 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
1911 					sc->sc_stats.ast_tx_filtered++;
1912 				an->an_tx_antenna = 0;	/* invalidate */
1913 			}
1914 			sr = ds->ds_txstat.ts_shortretry;
1915 			lr = ds->ds_txstat.ts_longretry;
1916 			sc->sc_stats.ast_tx_shortretry += sr;
1917 			sc->sc_stats.ast_tx_longretry += lr;
1918 			if (sr + lr)
1919 				an->an_tx_retr++;
1920 		}
1921 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1922 		    BUS_DMASYNC_POSTWRITE);
1923 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1924 		m_freem(bf->bf_m);
1925 		bf->bf_m = NULL;
1926 		bf->bf_node = NULL;
1927 
1928 		mtx_lock(&sc->sc_txbuflock);
1929 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1930 		mtx_unlock(&sc->sc_txbuflock);
1931 	}
1932 	ifp->if_flags &= ~IFF_OACTIVE;
1933 	sc->sc_tx_timer = 0;
1934 
1935 	ath_start(ifp);
1936 }
1937 
1938 /*
1939  * Drain the transmit queue and reclaim resources.
1940  */
1941 static void
1942 ath_draintxq(struct ath_softc *sc)
1943 {
1944 	struct ath_hal *ah = sc->sc_ah;
1945 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1946 	struct ath_buf *bf;
1947 
1948 	/* XXX return value */
1949 	if (!sc->sc_invalid) {
1950 		/* don't touch the hardware if marked invalid */
1951 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
1952 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
1953 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
1954 		    sc->sc_txlink));
1955 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
1956 		DPRINTF(("ath_draintxq: beacon queue %p\n",
1957 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
1958 	}
1959 	for (;;) {
1960 		mtx_lock(&sc->sc_txqlock);
1961 		bf = TAILQ_FIRST(&sc->sc_txq);
1962 		if (bf == NULL) {
1963 			sc->sc_txlink = NULL;
1964 			mtx_unlock(&sc->sc_txqlock);
1965 			break;
1966 		}
1967 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1968 		mtx_unlock(&sc->sc_txqlock);
1969 #ifdef AR_DEBUG
1970 		if (ath_debug)
1971 			ath_printtxbuf(bf,
1972 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
1973 #endif /* AR_DEBUG */
1974 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1975 		m_freem(bf->bf_m);
1976 		bf->bf_m = NULL;
1977 		bf->bf_node = NULL;
1978 		mtx_lock(&sc->sc_txbuflock);
1979 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1980 		mtx_unlock(&sc->sc_txbuflock);
1981 	}
1982 	ifp->if_flags &= ~IFF_OACTIVE;
1983 	sc->sc_tx_timer = 0;
1984 }
1985 
1986 /*
1987  * Disable the receive h/w in preparation for a reset.
1988  */
1989 static void
1990 ath_stoprecv(struct ath_softc *sc)
1991 {
1992 	struct ath_hal *ah = sc->sc_ah;
1993 
1994 	ath_hal_stoppcurecv(ah);	/* disable PCU */
1995 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
1996 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
1997 	DELAY(3000);			/* long enough for 1 frame */
1998 #ifdef AR_DEBUG
1999 	if (ath_debug) {
2000 		struct ath_buf *bf;
2001 
2002 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
2003 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
2004 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2005 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
2006 				ath_printrxbuf(bf, 1);
2007 		}
2008 	}
2009 #endif
2010 	sc->sc_rxlink = NULL;		/* just in case */
2011 }
2012 
2013 /*
2014  * Enable the receive h/w following a reset.
2015  */
2016 static int
2017 ath_startrecv(struct ath_softc *sc)
2018 {
2019 	struct ath_hal *ah = sc->sc_ah;
2020 	struct ath_buf *bf;
2021 
2022 	sc->sc_rxlink = NULL;
2023 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2024 		int error = ath_rxbuf_init(sc, bf);
2025 		if (error != 0) {
2026 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2027 				error));
2028 			return error;
2029 		}
2030 	}
2031 
2032 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2033 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2034 	ath_hal_rxena(ah);		/* enable recv descriptors */
2035 	ath_mode_init(sc);		/* set filters, etc. */
2036 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2037 	return 0;
2038 }
2039 
2040 /*
2041  * Set/change channels.  If the channel is really being changed,
2042  * it's done by resetting the chip.  To accomplish this we must
2043  * first cleanup any pending DMA, then restart stuff after a la
2044  * ath_init.
2045  */
2046 static int
2047 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2048 {
2049 	struct ath_hal *ah = sc->sc_ah;
2050 	struct ieee80211com *ic = &sc->sc_ic;
2051 
2052 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2053 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2054 		ic->ic_ibss_chan->ic_freq,
2055 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2056 	if (chan != ic->ic_ibss_chan) {
2057 		HAL_STATUS status;
2058 		HAL_CHANNEL hchan;
2059 		enum ieee80211_phymode mode;
2060 
2061 		/*
2062 		 * To switch channels clear any pending DMA operations;
2063 		 * wait long enough for the RX fifo to drain, reset the
2064 		 * hardware at the new frequency, and then re-enable
2065 		 * the relevant bits of the h/w.
2066 		 */
2067 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2068 		ath_draintxq(sc);		/* clear pending tx frames */
2069 		ath_stoprecv(sc);		/* turn off frame recv */
2070 		/*
2071 		 * Convert to a HAL channel description with
2072 		 * the flags constrained to reflect the current
2073 		 * operating mode.
2074 		 */
2075 		hchan.channel = chan->ic_freq;
2076 		hchan.channelFlags = ath_chan2flags(ic, chan);
2077 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2078 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2079 				"channel %u (%u Mhz)\n",
2080 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2081 			return EIO;
2082 		}
2083 		/*
2084 		 * Re-enable rx framework.
2085 		 */
2086 		if (ath_startrecv(sc) != 0) {
2087 			if_printf(&ic->ic_if,
2088 				"ath_chan_set: unable to restart recv logic\n");
2089 			return EIO;
2090 		}
2091 
2092 		/*
2093 		 * Re-enable interrupts.
2094 		 */
2095 		ath_hal_intrset(ah, sc->sc_imask);
2096 
2097 		/*
2098 		 * Change channels and update the h/w rate map
2099 		 * if we're switching; e.g. 11a to 11b/g.
2100 		 */
2101 		ic->ic_ibss_chan = chan;
2102 		mode = ieee80211_chan2mode(ic, chan);
2103 		if (mode != sc->sc_curmode)
2104 			ath_setcurmode(sc, mode);
2105 	}
2106 	return 0;
2107 }
2108 
2109 static void
2110 ath_next_scan(void *arg)
2111 {
2112 	struct ath_softc *sc = arg;
2113 	struct ieee80211com *ic = &sc->sc_ic;
2114 	struct ifnet *ifp = &ic->ic_if;
2115 
2116 	if (ic->ic_state == IEEE80211_S_SCAN)
2117 		ieee80211_next_scan(ifp);
2118 }
2119 
2120 /*
2121  * Periodically recalibrate the PHY to account
2122  * for temperature/environment changes.
2123  */
2124 static void
2125 ath_calibrate(void *arg)
2126 {
2127 	struct ath_softc *sc = arg;
2128 	struct ath_hal *ah = sc->sc_ah;
2129 	struct ieee80211com *ic = &sc->sc_ic;
2130 	struct ieee80211_channel *c;
2131 	HAL_CHANNEL hchan;
2132 
2133 	sc->sc_stats.ast_per_cal++;
2134 
2135 	/*
2136 	 * Convert to a HAL channel description with the flags
2137 	 * constrained to reflect the current operating mode.
2138 	 */
2139 	c = ic->ic_ibss_chan;
2140 	hchan.channel = c->ic_freq;
2141 	hchan.channelFlags = ath_chan2flags(ic, c);
2142 
2143 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2144 
2145 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2146 		/*
2147 		 * Rfgain is out of bounds, reset the chip
2148 		 * to load new gain values.
2149 		 */
2150 		sc->sc_stats.ast_per_rfgain++;
2151 		ath_reset(sc);
2152 	}
2153 	if (!ath_hal_calibrate(ah, &hchan)) {
2154 		DPRINTF(("%s: calibration of channel %u failed\n",
2155 			__func__, c->ic_freq));
2156 		sc->sc_stats.ast_per_calfail++;
2157 	}
2158 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2159 }
2160 
2161 static int
2162 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2163 {
2164 	struct ifnet *ifp = &ic->ic_if;
2165 	struct ath_softc *sc = ifp->if_softc;
2166 	struct ath_hal *ah = sc->sc_ah;
2167 	struct ieee80211_node *ni;
2168 	int i, error;
2169 	u_int8_t *bssid;
2170 	u_int32_t rfilt;
2171 	static const HAL_LED_STATE leds[] = {
2172 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2173 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2174 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2175 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2176 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2177 	};
2178 
2179 	DPRINTF(("%s: %s -> %s\n", __func__,
2180 		ieee80211_state_name[ic->ic_state],
2181 		ieee80211_state_name[nstate]));
2182 
2183 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2184 
2185 	if (nstate == IEEE80211_S_INIT) {
2186 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2187 		ath_hal_intrset(ah, sc->sc_imask);
2188 		callout_stop(&sc->sc_scan_ch);
2189 		callout_stop(&sc->sc_cal_ch);
2190 		return (*sc->sc_newstate)(ic, nstate, arg);
2191 	}
2192 	ni = ic->ic_bss;
2193 	error = ath_chan_set(sc, ni->ni_chan);
2194 	if (error != 0)
2195 		goto bad;
2196 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
2197 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
2198 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2199 	    (ifp->if_flags & IFF_PROMISC))
2200 		rfilt |= HAL_RX_FILTER_PROM;
2201 	if (nstate == IEEE80211_S_SCAN) {
2202 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2203 			ath_next_scan, sc);
2204 		bssid = ifp->if_broadcastaddr;
2205 		rfilt |= HAL_RX_FILTER_BEACON;
2206 	} else {
2207 		callout_stop(&sc->sc_scan_ch);
2208 		bssid = ni->ni_bssid;
2209 	}
2210 	ath_hal_setrxfilter(ah, rfilt);
2211 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2212 		 __func__, rfilt, ether_sprintf(bssid)));
2213 
2214 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2215 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2216 	else
2217 		ath_hal_setassocid(ah, bssid, 0);
2218 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2219 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2220 			if (ath_hal_keyisvalid(ah, i))
2221 				ath_hal_keysetmac(ah, i, bssid);
2222 	}
2223 
2224 	if (nstate == IEEE80211_S_RUN) {
2225 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2226 			"capinfo=0x%04x chan=%d\n"
2227 			 , __func__
2228 			 , ic->ic_flags
2229 			 , ni->ni_intval
2230 			 , ether_sprintf(ni->ni_bssid)
2231 			 , ni->ni_capinfo
2232 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2233 
2234 		/*
2235 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2236 		 */
2237 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
2238 		    ic->ic_opmode == IEEE80211_M_IBSS) {
2239 			error = ath_beacon_alloc(sc, ni);
2240 			if (error != 0)
2241 				goto bad;
2242 		}
2243 
2244 		/*
2245 		 * Configure the beacon and sleep timers.
2246 		 */
2247 		ath_beacon_config(sc);
2248 
2249 		/* start periodic recalibration timer */
2250 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2251 			ath_calibrate, sc);
2252 	} else {
2253 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2254 		ath_hal_intrset(ah, sc->sc_imask);
2255 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2256 	}
2257 	/*
2258 	 * Reset the rate control state.
2259 	 */
2260 	ath_rate_ctl_reset(sc, nstate);
2261 	/*
2262 	 * Invoke the parent method to complete the work.
2263 	 */
2264 	return (*sc->sc_newstate)(ic, nstate, arg);
2265 bad:
2266 	callout_stop(&sc->sc_scan_ch);
2267 	callout_stop(&sc->sc_cal_ch);
2268 	/* NB: do not invoke the parent */
2269 	return error;
2270 }
2271 
2272 /*
2273  * Setup driver-specific state for a newly associated node.
2274  * Note that we're called also on a re-associate, the isnew
2275  * param tells us if this is the first time or not.
2276  */
2277 static void
2278 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2279 {
2280 	if (isnew) {
2281 		struct ath_node *an = (struct ath_node *) ni;
2282 
2283 		an->an_tx_ok = an->an_tx_err =
2284 			an->an_tx_retr = an->an_tx_upper = 0;
2285 		/* start with highest negotiated rate */
2286 		/*
2287 		 * XXX should do otherwise but only when
2288 		 * the rate control algorithm is better.
2289 		 */
2290 		KASSERT(ni->ni_rates.rs_nrates > 0,
2291 			("new association w/ no rates!"));
2292 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2293 	}
2294 }
2295 
2296 static int
2297 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2298 {
2299 	struct ieee80211com *ic = &sc->sc_ic;
2300 	struct ifnet *ifp = &ic->ic_if;
2301 	struct ath_hal *ah = sc->sc_ah;
2302 	HAL_CHANNEL *chans;
2303 	int i, ix, nchan;
2304 
2305 	sc->sc_have11g = 0;
2306 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2307 			M_TEMP, M_NOWAIT);
2308 	if (chans == NULL) {
2309 		if_printf(ifp, "unable to allocate channel table\n");
2310 		return ENOMEM;
2311 	}
2312 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2313 	    cc, HAL_MODE_ALL, outdoor)) {
2314 		if_printf(ifp, "unable to collect channel list from hal\n");
2315 		free(chans, M_TEMP);
2316 		return EINVAL;
2317 	}
2318 
2319 	/*
2320 	 * Convert HAL channels to ieee80211 ones and insert
2321 	 * them in the table according to their channel number.
2322 	 */
2323 	for (i = 0; i < nchan; i++) {
2324 		HAL_CHANNEL *c = &chans[i];
2325 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2326 		if (ix > IEEE80211_CHAN_MAX) {
2327 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2328 				ix, c->channel, c->channelFlags);
2329 			continue;
2330 		}
2331 		/* NB: flags are known to be compatible */
2332 		if (ic->ic_channels[ix].ic_freq == 0) {
2333 			ic->ic_channels[ix].ic_freq = c->channel;
2334 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2335 		} else {
2336 			/* channels overlap; e.g. 11g and 11b */
2337 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2338 		}
2339 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
2340 			sc->sc_have11g = 1;
2341 	}
2342 	free(chans, M_TEMP);
2343 	return 0;
2344 }
2345 
2346 static int
2347 ath_rate_setup(struct ath_softc *sc, u_int mode)
2348 {
2349 	struct ath_hal *ah = sc->sc_ah;
2350 	struct ieee80211com *ic = &sc->sc_ic;
2351 	const HAL_RATE_TABLE *rt;
2352 	struct ieee80211_rateset *rs;
2353 	int i, maxrates;
2354 
2355 	switch (mode) {
2356 	case IEEE80211_MODE_11A:
2357 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2358 		break;
2359 	case IEEE80211_MODE_11B:
2360 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2361 		break;
2362 	case IEEE80211_MODE_11G:
2363 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2364 		break;
2365 	case IEEE80211_MODE_TURBO:
2366 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2367 		break;
2368 	default:
2369 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2370 		return 0;
2371 	}
2372 	rt = sc->sc_rates[mode];
2373 	if (rt == NULL)
2374 		return 0;
2375 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2376 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2377 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2378 		maxrates = IEEE80211_RATE_MAXSIZE;
2379 	} else
2380 		maxrates = rt->rateCount;
2381 	rs = &ic->ic_sup_rates[mode];
2382 	for (i = 0; i < maxrates; i++)
2383 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2384 	rs->rs_nrates = maxrates;
2385 	return 1;
2386 }
2387 
2388 static void
2389 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2390 {
2391 	const HAL_RATE_TABLE *rt;
2392 	int i;
2393 
2394 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2395 	rt = sc->sc_rates[mode];
2396 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2397 	for (i = 0; i < rt->rateCount; i++)
2398 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2399 	sc->sc_currates = rt;
2400 	sc->sc_curmode = mode;
2401 }
2402 
2403 /*
2404  * Reset the rate control state for each 802.11 state transition.
2405  */
2406 static void
2407 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2408 {
2409 	struct ieee80211com *ic = &sc->sc_ic;
2410 	struct ieee80211_node *ni;
2411 	struct ath_node *an;
2412 
2413 	an = (struct ath_node *) ic->ic_bss;
2414 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2415 	if (ic->ic_opmode == IEEE80211_M_STA) {
2416 		ni = ic->ic_bss;
2417 		if (state == IEEE80211_S_RUN) {
2418 			/* start with highest negotiated rate */
2419 			KASSERT(ni->ni_rates.rs_nrates > 0,
2420 				("transition to RUN state w/ no rates!"));
2421 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2422 		} else {
2423 			/* use lowest rate */
2424 			ni->ni_txrate = 0;
2425 		}
2426 	} else {
2427 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2428 			ni->ni_txrate = 0;		/* use lowest rate */
2429 			an = (struct ath_node *) ni;
2430 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2431 			    an->an_tx_upper = 0;
2432 		}
2433 	}
2434 }
2435 
2436 /*
2437  * Examine and potentially adjust the transmit rate.
2438  */
2439 static void
2440 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2441 {
2442 	struct ath_softc *sc = arg;
2443 	struct ath_node *an = (struct ath_node *) ni;
2444 	struct ieee80211_rateset *rs = &ni->ni_rates;
2445 	int mod = 0, orate, enough;
2446 
2447 	/*
2448 	 * Rate control
2449 	 * XXX: very primitive version.
2450 	 */
2451 	sc->sc_stats.ast_rate_calls++;
2452 
2453 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2454 
2455 	/* no packet reached -> down */
2456 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2457 		mod = -1;
2458 
2459 	/* all packets needs retry in average -> down */
2460 	if (enough && an->an_tx_ok < an->an_tx_retr)
2461 		mod = -1;
2462 
2463 	/* no error and less than 10% of packets needs retry -> up */
2464 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2465 		mod = 1;
2466 
2467 	orate = ni->ni_txrate;
2468 	switch (mod) {
2469 	case 0:
2470 		if (enough && an->an_tx_upper > 0)
2471 			an->an_tx_upper--;
2472 		break;
2473 	case -1:
2474 		if (ni->ni_txrate > 0) {
2475 			ni->ni_txrate--;
2476 			sc->sc_stats.ast_rate_drop++;
2477 		}
2478 		an->an_tx_upper = 0;
2479 		break;
2480 	case 1:
2481 		if (++an->an_tx_upper < 2)
2482 			break;
2483 		an->an_tx_upper = 0;
2484 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2485 			ni->ni_txrate++;
2486 			sc->sc_stats.ast_rate_raise++;
2487 		}
2488 		break;
2489 	}
2490 
2491 	if (ni->ni_txrate != orate) {
2492 		printf("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2493 		    __func__,
2494 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2495 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2496 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr);
2497 	}
2498 	if (ni->ni_txrate != orate || enough)
2499 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2500 }
2501 
2502 #ifdef AR_DEBUG
2503 static int
2504 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2505 {
2506 	char dmode[64];
2507 	int error;
2508 
2509 	strncpy(dmode, "", sizeof(dmode) - 1);
2510 	dmode[sizeof(dmode) - 1] = '\0';
2511 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2512 
2513 	if (error == 0 && req->newptr != NULL) {
2514 		struct ifnet *ifp;
2515 		struct ath_softc *sc;
2516 
2517 		ifp = ifunit("ath0");		/* XXX */
2518 		if (!ifp)
2519 			return EINVAL;
2520 		sc = ifp->if_softc;
2521 		if (strcmp(dmode, "hal") == 0)
2522 			ath_hal_dumpstate(sc->sc_ah);
2523 		else if (strcmp(dmode, "eeprom") == 0)
2524 			ath_hal_dumpeeprom(sc->sc_ah);
2525 		else if (strcmp(dmode, "rfgain") == 0)
2526 			ath_hal_dumprfgain(sc->sc_ah);
2527 		else if (strcmp(dmode, "ani") == 0)
2528 			ath_hal_dumpani(sc->sc_ah);
2529 		else
2530 			return EINVAL;
2531 	}
2532 	return error;
2533 }
2534 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2535 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2536 
2537 static void
2538 ath_printrxbuf(struct ath_buf *bf, int done)
2539 {
2540 	struct ath_desc *ds;
2541 	int i;
2542 
2543 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2544 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2545 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2546 		    ds->ds_link, ds->ds_data,
2547 		    ds->ds_ctl0, ds->ds_ctl1,
2548 		    ds->ds_hw[0], ds->ds_hw[1],
2549 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2550 	}
2551 }
2552 
2553 static void
2554 ath_printtxbuf(struct ath_buf *bf, int done)
2555 {
2556 	struct ath_desc *ds;
2557 	int i;
2558 
2559 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2560 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2561 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2562 		    ds->ds_link, ds->ds_data,
2563 		    ds->ds_ctl0, ds->ds_ctl1,
2564 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2565 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2566 	}
2567 }
2568 #endif /* AR_DEBUG */
2569