xref: /freebsd/sys/dev/ath/if_ath.c (revision b52f49a9a0f22207ad5130ad8faba08de3ed23d8)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  */
43 
44 #include "opt_inet.h"
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/sysctl.h>
49 #include <sys/mbuf.h>
50 #include <sys/malloc.h>
51 #include <sys/lock.h>
52 #include <sys/mutex.h>
53 #include <sys/kernel.h>
54 #include <sys/socket.h>
55 #include <sys/sockio.h>
56 #include <sys/errno.h>
57 #include <sys/callout.h>
58 #include <sys/bus.h>
59 #include <sys/endian.h>
60 
61 #include <machine/bus.h>
62 
63 #include <net/if.h>
64 #include <net/if_dl.h>
65 #include <net/if_media.h>
66 #include <net/if_arp.h>
67 #include <net/ethernet.h>
68 #include <net/if_llc.h>
69 
70 #include <net80211/ieee80211.h>
71 #include <net80211/ieee80211_crypto.h>
72 #include <net80211/ieee80211_node.h>
73 #include <net80211/ieee80211_proto.h>
74 #include <net80211/ieee80211_var.h>
75 
76 #include <net/bpf.h>
77 
78 #ifdef INET
79 #include <netinet/in.h>
80 #include <netinet/if_ether.h>
81 #endif
82 
83 #define	AR_DEBUG
84 #include <dev/ath/if_athvar.h>
85 #include <contrib/dev/ath/ah_desc.h>
86 
87 /* unalligned little endian access */
88 #define LE_READ_2(p)							\
89 	((u_int16_t)							\
90 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
91 #define LE_READ_4(p)							\
92 	((u_int32_t)							\
93 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
94 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
95 
96 static void	ath_init(void *);
97 static void	ath_stop(struct ifnet *);
98 static void	ath_start(struct ifnet *);
99 static void	ath_reset(struct ath_softc *);
100 static int	ath_media_change(struct ifnet *);
101 static void	ath_watchdog(struct ifnet *);
102 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
103 static void	ath_fatal_proc(void *, int);
104 static void	ath_rxorn_proc(void *, int);
105 static void	ath_bmiss_proc(void *, int);
106 static void	ath_initkeytable(struct ath_softc *);
107 static void	ath_mode_init(struct ath_softc *);
108 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
109 static void	ath_beacon_proc(void *, int);
110 static void	ath_beacon_free(struct ath_softc *);
111 static void	ath_beacon_config(struct ath_softc *);
112 static int	ath_desc_alloc(struct ath_softc *);
113 static void	ath_desc_free(struct ath_softc *);
114 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
115 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
116 static void	ath_node_copy(struct ieee80211com *,
117 			struct ieee80211_node *, const struct ieee80211_node *);
118 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
119 static void	ath_rx_proc(void *, int);
120 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
121 			     struct ath_buf *, struct mbuf *);
122 static void	ath_tx_proc(void *, int);
123 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
124 static void	ath_draintxq(struct ath_softc *);
125 static void	ath_stoprecv(struct ath_softc *);
126 static int	ath_startrecv(struct ath_softc *);
127 static void	ath_next_scan(void *);
128 static void	ath_calibrate(void *);
129 static int	ath_newstate(void *, enum ieee80211_state);
130 static void	ath_newassoc(struct ieee80211com *,
131 			struct ieee80211_node *, int);
132 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
133 
134 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
135 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
136 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
137 static void	ath_rate_ctl(void *, struct ieee80211_node *);
138 
139 SYSCTL_DECL(_hw_ath);
140 
141 /* XXX validate sysctl values */
142 static	int ath_dwelltime = 200;		/* 5 channels/second */
143 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
144 	    0, "channel dwell time (ms) for AP/station scanning");
145 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
146 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
147 	    0, "chip calibration interval (secs)");
148 
149 static	int ath_bmisshack = 1;
150 SYSCTL_INT(_hw_ath, OID_AUTO, bmisshack, CTLFLAG_RW, &ath_bmisshack,
151 	    0, "enable/disable hack to discard bmiss interrupts");
152 
153 #ifdef AR_DEBUG
154 int	ath_debug = 0;
155 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
156 	    0, "control debugging printfs");
157 #define	IFF_DUMPPKTS(_ifp) \
158 	(ath_debug || \
159 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
160 static	void ath_printrxbuf(struct ath_buf *bf, int);
161 static	void ath_printtxbuf(struct ath_buf *bf, int);
162 #define	DPRINTF(X)	if (ath_debug) printf X
163 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
164 #else
165 #define	IFF_DUMPPKTS(_ifp) \
166 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
167 #define	DPRINTF(X)
168 #define	DPRINTF2(X)
169 #endif
170 
171 int
172 ath_attach(u_int16_t devid, struct ath_softc *sc)
173 {
174 	struct ieee80211com *ic = &sc->sc_ic;
175 	struct ifnet *ifp = &ic->ic_if;
176 	struct ath_hal *ah;
177 	HAL_STATUS status;
178 	int error = 0;
179 
180 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
181 
182 	/* set these up early for if_printf use */
183 	ifp->if_unit = device_get_unit(sc->sc_dev);
184 	ifp->if_name = "ath";
185 
186 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
187 	if (ah == NULL) {
188 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
189 			status);
190 		error = ENXIO;
191 		goto bad;
192 	}
193 	sc->sc_ah = ah;
194 
195 	/*
196 	 * Collect the channel list using the default country
197 	 * code and including outdoor channels.  The 802.11 layer
198 	 * is resposible for filtering this list to a set of
199 	 * channels that it considers ok to use.
200 	 */
201 	error = ath_getchannels(sc, CTRY_DEFAULT, AH_TRUE);
202 	if (error != 0)
203 		goto bad;
204 
205 	/*
206 	 * Setup rate tables for all potential media types.
207 	 */
208 	ath_rate_setup(sc, IEEE80211_MODE_11A);
209 	ath_rate_setup(sc, IEEE80211_MODE_11B);
210 	ath_rate_setup(sc, IEEE80211_MODE_11G);
211 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
212 
213 	error = ath_desc_alloc(sc);
214 	if (error != 0) {
215 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
216 		goto bad;
217 	}
218 	callout_init(&sc->sc_scan_ch, 0);
219 	callout_init(&sc->sc_cal_ch, 0);
220 
221 	mtx_init(&sc->sc_txbuflock,
222 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
223 	mtx_init(&sc->sc_txqlock,
224 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
225 
226 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
227 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
228 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
229 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
230 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
231 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
232 
233 	/*
234 	 * For now just pre-allocate one data queue and one
235 	 * beacon queue.  Note that the HAL handles resetting
236 	 * them at the needed time.  Eventually we'll want to
237 	 * allocate more tx queues for splitting management
238 	 * frames and for QOS support.
239 	 */
240 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
241 		HAL_TX_QUEUE_DATA,
242 		AH_TRUE			/* enable interrupts */
243 	);
244 	if (sc->sc_txhalq == (u_int) -1) {
245 		if_printf(ifp, "unable to setup a data xmit queue!\n");
246 		goto bad;
247 	}
248 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
249 		HAL_TX_QUEUE_BEACON,
250 		AH_TRUE			/* enable interrupts */
251 	);
252 	if (sc->sc_bhalq == (u_int) -1) {
253 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
254 		goto bad;
255 	}
256 
257 	ifp->if_softc = sc;
258 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
259 	ifp->if_start = ath_start;
260 	ifp->if_watchdog = ath_watchdog;
261 	ifp->if_ioctl = ath_ioctl;
262 	ifp->if_init = ath_init;
263 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
264 
265 	ic->ic_softc = sc;
266 	ic->ic_newstate = ath_newstate;
267 	ic->ic_newassoc = ath_newassoc;
268 	/* XXX not right but it's not used anywhere important */
269 	ic->ic_phytype = IEEE80211_T_OFDM;
270 	ic->ic_opmode = IEEE80211_M_STA;
271 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP;
272 	/* NB: 11g support is identified when we fetch the channel set */
273 	if (sc->sc_have11g)
274 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
275 
276 	/* get mac address from hardware */
277 	ath_hal_getmac(ah, ic->ic_myaddr);
278 
279 	/* call MI attach routine. */
280 	ieee80211_ifattach(ifp);
281 	/* override default methods */
282 	ic->ic_node_alloc = ath_node_alloc;
283 	ic->ic_node_free = ath_node_free;
284 	ic->ic_node_copy = ath_node_copy;
285 
286 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
287 
288 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
289 
290 	return 0;
291 bad:
292 	if (ah)
293 		ath_hal_detach(ah);
294 	sc->sc_invalid = 1;
295 	return error;
296 }
297 
298 int
299 ath_detach(struct ath_softc *sc)
300 {
301 	struct ifnet *ifp = &sc->sc_ic.ic_if;
302 
303 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
304 
305 	mtx_lock(&sc->sc_mtx);
306 	ath_stop(ifp);
307 	ath_desc_free(sc);
308 	ath_hal_detach(sc->sc_ah);
309 	ieee80211_ifdetach(ifp);
310 	mtx_unlock(&sc->sc_mtx);
311 	return 0;
312 }
313 
314 void
315 ath_suspend(struct ath_softc *sc)
316 {
317 	struct ifnet *ifp = &sc->sc_ic.ic_if;
318 
319 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
320 
321 	ath_stop(ifp);
322 }
323 
324 void
325 ath_resume(struct ath_softc *sc)
326 {
327 	struct ifnet *ifp = &sc->sc_ic.ic_if;
328 
329 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
330 
331 	ath_init(ifp);
332 	if (ifp->if_flags & IFF_UP)
333 		ath_start(ifp);
334 }
335 
336 void
337 ath_shutdown(struct ath_softc *sc)
338 {
339 	struct ifnet *ifp = &sc->sc_ic.ic_if;
340 
341 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
342 
343 	ath_stop(ifp);
344 }
345 
346 void
347 ath_intr(void *arg)
348 {
349 	struct ath_softc *sc = arg;
350 	struct ieee80211com *ic = &sc->sc_ic;
351 	struct ifnet *ifp = &ic->ic_if;
352 	struct ath_hal *ah = sc->sc_ah;
353 	HAL_INT status;
354 
355 	if (sc->sc_invalid) {
356 		/*
357 		 * The hardware is gone, don't touch anything.
358 		 * XXX can this happen?
359 		 */
360 		DPRINTF(("ath_intr: invalid; ignored\n"));
361 		return;
362 	}
363 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
364 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
365 		ath_hal_getisr(ah, &status);	/* clear ISR */
366 		ath_hal_intrset(ah, 0);		/* disable further intr's */
367 		return;
368 	}
369 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
370 	DPRINTF2(("ath_intr: status 0x%x\n", status));
371 if (ath_bmisshack) status &= ~HAL_INT_BMISS; /*XXX*/
372 #ifdef AR_DEBUG
373 	if (ath_debug &&
374 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
375 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
376 		ath_hal_dumpstate(ah);
377 	}
378 #endif /* AR_DEBUG */
379 	if (status & HAL_INT_FATAL) {
380 		sc->sc_stats.ast_hardware++;
381 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
382 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
383 	} else if (status & HAL_INT_RXORN) {
384 		sc->sc_stats.ast_rxorn++;
385 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
386 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
387 	} else {
388 		if (status & HAL_INT_RXEOL) {
389 			/*
390 			 * NB: the hardware should re-read the link when
391 			 *     RXE bit is written, but it doesn't work at
392 			 *     least on older hardware revs.
393 			 */
394 			sc->sc_stats.ast_rxeol++;
395 			sc->sc_rxlink = NULL;
396 		}
397 		if (status & HAL_INT_TXURN) {
398 			sc->sc_stats.ast_txurn++;
399 			/* bump tx trigger level */
400 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
401 		}
402 		if (status & HAL_INT_RX)
403 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
404 		if (status & HAL_INT_TX)
405 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
406 		if (status & HAL_INT_SWBA)
407 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
408 		if (status & HAL_INT_BMISS) {
409 			sc->sc_stats.ast_bmiss++;
410 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
411 		}
412 	}
413 }
414 
415 static void
416 ath_fatal_proc(void *arg, int pending)
417 {
418 	struct ath_softc *sc = arg;
419 
420 	device_printf(sc->sc_dev, "hardware error; resetting\n");
421 	ath_reset(sc);
422 }
423 
424 static void
425 ath_rxorn_proc(void *arg, int pending)
426 {
427 	struct ath_softc *sc = arg;
428 
429 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
430 	ath_reset(sc);
431 }
432 
433 static void
434 ath_bmiss_proc(void *arg, int pending)
435 {
436 	struct ath_softc *sc = arg;
437 	struct ieee80211com *ic = &sc->sc_ic;
438 	struct ifnet *ifp = &ic->ic_if;
439 
440 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
441 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
442 		("unexpect operating mode %u", ic->ic_opmode));
443 	if (ic->ic_state == IEEE80211_S_RUN)
444 		ieee80211_new_state(ifp, IEEE80211_S_SCAN, -1);
445 }
446 
447 static u_int
448 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
449 {
450 	static const u_int modeflags[] = {
451 		0,			/* IEEE80211_MODE_AUTO */
452 		CHANNEL_A,		/* IEEE80211_MODE_11A */
453 		CHANNEL_B,		/* IEEE80211_MODE_11B */
454 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
455 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
456 	};
457 	return modeflags[ieee80211_chan2mode(ic, chan)];
458 }
459 
460 static void
461 ath_init(void *arg)
462 {
463 	struct ath_softc *sc = (struct ath_softc *) arg;
464 	struct ieee80211com *ic = &sc->sc_ic;
465 	struct ifnet *ifp = &ic->ic_if;
466 	struct ieee80211_node *ni;
467 	enum ieee80211_phymode mode;
468 	struct ath_hal *ah = sc->sc_ah;
469 	HAL_STATUS status;
470 	HAL_CHANNEL hchan;
471 
472 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
473 
474 	mtx_lock(&sc->sc_mtx);
475 	/*
476 	 * Stop anything previously setup.  This is safe
477 	 * whether this is the first time through or not.
478 	 */
479 	ath_stop(ifp);
480 
481 	/*
482 	 * The basic interface to setting the hardware in a good
483 	 * state is ``reset''.  On return the hardware is known to
484 	 * be powered up and with interrupts disabled.  This must
485 	 * be followed by initialization of the appropriate bits
486 	 * and then setup of the interrupt mask.
487 	 */
488 	hchan.channel = ic->ic_ibss_chan->ic_freq;
489 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
490 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
491 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
492 			status);
493 		goto done;
494 	}
495 
496 	/*
497 	 * Setup the hardware after reset: the key cache
498 	 * is filled as needed and the receive engine is
499 	 * set going.  Frame transmit is handled entirely
500 	 * in the frame output path; there's nothing to do
501 	 * here except setup the interrupt mask.
502 	 */
503 	if (ic->ic_flags & IEEE80211_F_WEPON)
504 		ath_initkeytable(sc);
505 	if (ath_startrecv(sc) != 0) {
506 		if_printf(ifp, "unable to start recv logic\n");
507 		goto done;
508 	}
509 
510 	/*
511 	 * Enable interrupts.
512 	 */
513 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
514 		  | HAL_INT_RXEOL | HAL_INT_RXORN
515 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
516 	ath_hal_intrset(ah, sc->sc_imask);
517 
518 	ifp->if_flags |= IFF_RUNNING;
519 	ic->ic_state = IEEE80211_S_INIT;
520 
521 	/*
522 	 * The hardware should be ready to go now so it's safe
523 	 * to kick the 802.11 state machine as it's likely to
524 	 * immediately call back to us to send mgmt frames.
525 	 */
526 	ni = ic->ic_bss;
527 	ni->ni_chan = ic->ic_ibss_chan;
528 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
529 	if (mode != sc->sc_curmode)
530 		ath_setcurmode(sc, mode);
531 	ieee80211_new_state(ifp, IEEE80211_S_SCAN, -1);
532 done:
533 	mtx_unlock(&sc->sc_mtx);
534 }
535 
536 static void
537 ath_stop(struct ifnet *ifp)
538 {
539 	struct ath_softc *sc = ifp->if_softc;
540 	struct ath_hal *ah = sc->sc_ah;
541 
542 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
543 		sc->sc_invalid, ifp->if_flags));
544 
545 	mtx_lock(&sc->sc_mtx);
546 	if (ifp->if_flags & IFF_RUNNING) {
547 		/*
548 		 * Shutdown the hardware and driver:
549 		 *    disable interrupts
550 		 *    turn off timers
551 		 *    clear transmit machinery
552 		 *    clear receive machinery
553 		 *    drain and release tx queues
554 		 *    reclaim beacon resources
555 		 *    reset 802.11 state machine
556 		 *    power down hardware
557 		 *
558 		 * Note that some of this work is not possible if the
559 		 * hardware is gone (invalid).
560 		 */
561 		ifp->if_flags &= ~IFF_RUNNING;
562 		ifp->if_timer = 0;
563 		if (!sc->sc_invalid)
564 			ath_hal_intrset(ah, 0);
565 		ath_draintxq(sc);
566 		if (!sc->sc_invalid)
567 			ath_stoprecv(sc);
568 		else
569 			sc->sc_rxlink = NULL;
570 		IF_DRAIN(&ifp->if_snd);
571 		ath_beacon_free(sc);
572 		ieee80211_new_state(ifp, IEEE80211_S_INIT, -1);
573 		if (!sc->sc_invalid)
574 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
575 	}
576 	mtx_unlock(&sc->sc_mtx);
577 }
578 
579 /*
580  * Reset the hardware w/o losing operational state.  This is
581  * basically a more efficient way of doing ath_stop, ath_init,
582  * followed by state transitions to the current 802.11
583  * operational state.  Used to recover from errors rx overrun
584  * and to reset the hardware when rf gain settings must be reset.
585  */
586 static void
587 ath_reset(struct ath_softc *sc)
588 {
589 	struct ieee80211com *ic = &sc->sc_ic;
590 	struct ifnet *ifp = &ic->ic_if;
591 	struct ath_hal *ah = sc->sc_ah;
592 	struct ieee80211_channel *c;
593 	HAL_STATUS status;
594 	HAL_CHANNEL hchan;
595 
596 	/*
597 	 * Convert to a HAL channel description with the flags
598 	 * constrained to reflect the current operating mode.
599 	 */
600 	c = ic->ic_ibss_chan;
601 	hchan.channel = c->ic_freq;
602 	hchan.channelFlags = ath_chan2flags(ic, c);
603 
604 	ath_hal_intrset(ah, 0);		/* disable interrupts */
605 	ath_draintxq(sc);		/* stop xmit side */
606 	ath_stoprecv(sc);		/* stop recv side */
607 	/* NB: indicate channel change so we do a full reset */
608 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
609 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
610 			__func__, status);
611 	ath_hal_intrset(ah, sc->sc_imask);
612 	if (ath_startrecv(sc) != 0)	/* restart recv */
613 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
614 	ath_start(ifp);			/* restart xmit */
615 	if (ic->ic_state == IEEE80211_S_RUN)
616 		ath_beacon_config(sc);	/* restart beacons */
617 }
618 
619 static void
620 ath_start(struct ifnet *ifp)
621 {
622 	struct ath_softc *sc = ifp->if_softc;
623 	struct ath_hal *ah = sc->sc_ah;
624 	struct ieee80211com *ic = &sc->sc_ic;
625 	struct ieee80211_node *ni;
626 	struct ath_buf *bf;
627 	struct mbuf *m;
628 	struct ieee80211_frame *wh;
629 
630 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
631 		return;
632 	for (;;) {
633 		/*
634 		 * Grab a TX buffer and associated resources.
635 		 */
636 		mtx_lock(&sc->sc_txbuflock);
637 		bf = TAILQ_FIRST(&sc->sc_txbuf);
638 		if (bf != NULL)
639 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
640 		mtx_unlock(&sc->sc_txbuflock);
641 		if (bf == NULL) {
642 			DPRINTF(("ath_start: out of xmit buffers\n"));
643 			sc->sc_stats.ast_tx_qstop++;
644 			ifp->if_flags |= IFF_OACTIVE;
645 			break;
646 		}
647 		/*
648 		 * Poll the management queue for frames; they
649 		 * have priority over normal data frames.
650 		 */
651 		IF_DEQUEUE(&ic->ic_mgtq, m);
652 		if (m == NULL) {
653 			/*
654 			 * No data frames go out unless we're associated.
655 			 */
656 			if (ic->ic_state != IEEE80211_S_RUN) {
657 				DPRINTF(("ath_start: ignore data packet, "
658 					"state %u\n", ic->ic_state));
659 				sc->sc_stats.ast_tx_discard++;
660 				mtx_lock(&sc->sc_txbuflock);
661 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
662 				mtx_unlock(&sc->sc_txbuflock);
663 				break;
664 			}
665 			IF_DEQUEUE(&ifp->if_snd, m);
666 			if (m == NULL) {
667 				mtx_lock(&sc->sc_txbuflock);
668 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
669 				mtx_unlock(&sc->sc_txbuflock);
670 				break;
671 			}
672 			ifp->if_opackets++;
673 			BPF_MTAP(ifp, m);
674 			/*
675 			 * Encapsulate the packet in prep for transmission.
676 			 */
677 			m = ieee80211_encap(ifp, m);
678 			if (m == NULL) {
679 				DPRINTF(("ath_start: encapsulation failure\n"));
680 				sc->sc_stats.ast_tx_encap++;
681 				goto bad;
682 			}
683 			wh = mtod(m, struct ieee80211_frame *);
684 			if (ic->ic_flags & IEEE80211_F_WEPON)
685 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
686 		} else {
687 			wh = mtod(m, struct ieee80211_frame *);
688 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
689 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
690 				/* fill time stamp */
691 				u_int64_t tsf;
692 				u_int32_t *tstamp;
693 
694 				tsf = ath_hal_gettsf64(ah);
695 				/* XXX: adjust 100us delay to xmit */
696 				tsf += 100;
697 				tstamp = (u_int32_t *)&wh[1];
698 				tstamp[0] = htole32(tsf & 0xffffffff);
699 				tstamp[1] = htole32(tsf >> 32);
700 			}
701 			sc->sc_stats.ast_tx_mgmt++;
702 		}
703 		if (ic->ic_rawbpf)
704 			bpf_mtap(ic->ic_rawbpf, m);
705 
706 		if (ic->ic_opmode != IEEE80211_M_STA) {
707 			ni = ieee80211_find_node(ic, wh->i_addr1);
708 			if (ni == NULL) {
709 				/*
710 				 * When not in station mode the destination
711 				 * address should always be in the node table
712 				 * unless this is a multicast/broadcast frame.
713 				 */
714 				if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
715 				    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
716 				    IEEE80211_FC0_TYPE_DATA) {
717 					m_freem(m);
718 					sc->sc_stats.ast_tx_nonode++;
719 					goto bad;
720 				}
721 				ni = ic->ic_bss;
722 			}
723 		} else
724 			ni = ic->ic_bss;
725 
726 		/*
727 		 * TODO:
728 		 * The duration field of 802.11 header should be filled.
729 		 * XXX This may be done in the ieee80211 layer, but the upper
730 		 *     doesn't know the detail of parameters such as IFS
731 		 *     for now..
732 		 */
733 
734 		if (IFF_DUMPPKTS(ifp))
735 			ieee80211_dump_pkt(mtod(m, u_int8_t *), m->m_len,
736 			    ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL,
737 			    -1);
738 
739 		if (ath_tx_start(sc, ni, bf, m)) {
740 	bad:
741 			mtx_lock(&sc->sc_txbuflock);
742 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
743 			mtx_unlock(&sc->sc_txbuflock);
744 			ifp->if_oerrors++;
745 			continue;
746 		}
747 
748 		sc->sc_tx_timer = 5;
749 		ifp->if_timer = 1;
750 	}
751 }
752 
753 static int
754 ath_media_change(struct ifnet *ifp)
755 {
756 	int error;
757 
758 	error = ieee80211_media_change(ifp);
759 	if (error == ENETRESET) {
760 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
761 		    (IFF_RUNNING|IFF_UP))
762 			ath_init(ifp);		/* XXX lose error */
763 		error = 0;
764 	}
765 	return error;
766 }
767 
768 static void
769 ath_watchdog(struct ifnet *ifp)
770 {
771 	struct ath_softc *sc = ifp->if_softc;
772 	struct ieee80211com *ic = &sc->sc_ic;
773 
774 	ifp->if_timer = 0;
775 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
776 		return;
777 	if (sc->sc_tx_timer) {
778 		if (--sc->sc_tx_timer == 0) {
779 			if_printf(ifp, "device timeout\n");
780 #ifdef AR_DEBUG
781 			if (ath_debug)
782 				ath_hal_dumpstate(sc->sc_ah);
783 #endif /* AR_DEBUG */
784 			ath_init(ifp);		/* XXX ath_reset??? */
785 			ifp->if_oerrors++;
786 			sc->sc_stats.ast_watchdog++;
787 			return;
788 		}
789 		ifp->if_timer = 1;
790 	}
791 	if (ic->ic_fixed_rate == -1) {
792 		/*
793 		 * Run the rate control algorithm if we're not
794 		 * locked at a fixed rate.
795 		 */
796 		if (ic->ic_opmode == IEEE80211_M_STA)
797 			ath_rate_ctl(sc, ic->ic_bss);
798 		else
799 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
800 	}
801 	ieee80211_watchdog(ifp);
802 }
803 
804 static int
805 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
806 {
807 	struct ath_softc *sc = ifp->if_softc;
808 	struct ifreq *ifr = (struct ifreq *)data;
809 	int error = 0;
810 
811 	mtx_lock(&sc->sc_mtx);
812 	switch (cmd) {
813 	case SIOCSIFFLAGS:
814 		if (ifp->if_flags & IFF_UP) {
815 			if (ifp->if_flags & IFF_RUNNING) {
816 				/*
817 				 * To avoid rescanning another access point,
818 				 * do not call ath_init() here.  Instead,
819 				 * only reflect promisc mode settings.
820 				 */
821 				ath_mode_init(sc);
822 			} else
823 				ath_init(ifp);		/* XXX lose error */
824 		} else
825 			ath_stop(ifp);
826 		break;
827 	case SIOCADDMULTI:
828 	case SIOCDELMULTI:
829 		/*
830 		 * The upper layer has already installed/removed
831 		 * the multicast address(es), just recalculate the
832 		 * multicast filter for the card.
833 		 */
834 		if (ifp->if_flags & IFF_RUNNING)
835 			ath_mode_init(sc);
836 		break;
837 	case SIOCGATHSTATS:
838 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
839 		break;
840 	default:
841 		error = ieee80211_ioctl(ifp, cmd, data);
842 		if (error == ENETRESET) {
843 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
844 			    (IFF_RUNNING|IFF_UP))
845 				ath_init(ifp);		/* XXX lose error */
846 			error = 0;
847 		}
848 		break;
849 	}
850 	mtx_unlock(&sc->sc_mtx);
851 	return error;
852 }
853 
854 /*
855  * Fill the hardware key cache with key entries.
856  */
857 static void
858 ath_initkeytable(struct ath_softc *sc)
859 {
860 	struct ieee80211com *ic = &sc->sc_ic;
861 	struct ath_hal *ah = sc->sc_ah;
862 	int i;
863 
864 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
865 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
866 		if (k->wk_len == 0)
867 			ath_hal_keyreset(ah, i);
868 		else
869 			/* XXX return value */
870 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
871 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
872 	}
873 }
874 
875 static void
876 ath_mode_init(struct ath_softc *sc)
877 {
878 	struct ieee80211com *ic = &sc->sc_ic;
879 	struct ath_hal *ah = sc->sc_ah;
880 	struct ifnet *ifp = &ic->ic_if;
881 	u_int32_t rfilt, mfilt[2], val;
882 	u_int8_t pos;
883 	struct ifmultiaddr *ifma;
884 
885 	/* configure operational mode */
886 	ath_hal_setopmode(ah, ic->ic_opmode);
887 
888 	/* receive filter */
889 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
890 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
891 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
892 	    (ifp->if_flags & IFF_PROMISC))
893 		rfilt |= HAL_RX_FILTER_PROM;
894 	if (ic->ic_state == IEEE80211_S_SCAN)
895 		rfilt |= HAL_RX_FILTER_BEACON;
896 	ath_hal_setrxfilter(ah, rfilt);
897 
898 	/* calculate and install multicast filter */
899 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
900 		mfilt[0] = mfilt[1] = 0;
901 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
902 			caddr_t dl;
903 
904 			/* calculate XOR of eight 6bit values */
905 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
906 			val = LE_READ_4(dl + 0);
907 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
908 			val = LE_READ_4(dl + 3);
909 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
910 			pos &= 0x3f;
911 			mfilt[pos / 32] |= (1 << (pos % 32));
912 		}
913 	} else {
914 		mfilt[0] = mfilt[1] = ~0;
915 	}
916 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
917 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
918 		rfilt, mfilt[0], mfilt[1]));
919 }
920 
921 static void
922 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
923 {
924 	struct ath_buf *bf = arg;
925 
926 	KASSERT(nseg <= ATH_MAX_SCATTER,
927 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
928 	bf->bf_mapsize = mapsize;
929 	bf->bf_nseg = nseg;
930 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
931 }
932 
933 static int
934 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
935 {
936 	struct ieee80211com *ic = &sc->sc_ic;
937 	struct ifnet *ifp = &ic->ic_if;
938 	struct ath_hal *ah = sc->sc_ah;
939 	struct ieee80211_frame *wh;
940 	struct ath_buf *bf;
941 	struct ath_desc *ds;
942 	struct mbuf *m;
943 	int error, pktlen;
944 	u_int8_t *frm, rate;
945 	u_int16_t capinfo;
946 	struct ieee80211_rateset *rs;
947 	const HAL_RATE_TABLE *rt;
948 
949 	bf = sc->sc_bcbuf;
950 	if (bf->bf_m != NULL) {
951 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
952 		m_freem(bf->bf_m);
953 		bf->bf_m = NULL;
954 		bf->bf_node = NULL;
955 	}
956 	/*
957 	 * NB: the beacon data buffer must be 32-bit aligned;
958 	 * we assume the mbuf routines will return us something
959 	 * with this alignment (perhaps should assert).
960 	 */
961 	rs = &ni->ni_rates;
962 	pktlen = 8 + 2 + 2+ 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
963 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
964 		pktlen += 2;
965 	if (pktlen <= MHLEN)
966 		MGETHDR(m, M_DONTWAIT, MT_DATA);
967 	else
968 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
969 	if (m == NULL) {
970 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
971 			pktlen));
972 		sc->sc_stats.ast_be_nombuf++;
973 		return ENOMEM;
974 	}
975 
976 	wh = mtod(m, struct ieee80211_frame *);
977 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
978 	    IEEE80211_FC0_SUBTYPE_BEACON;
979 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
980 	*(u_int16_t *)wh->i_dur = 0;
981 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
982 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
983 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
984 	*(u_int16_t *)wh->i_seq = 0;
985 
986 	/*
987 	 * beacon frame format
988 	 *	[8] time stamp
989 	 *	[2] beacon interval
990 	 *	[2] cabability information
991 	 *	[tlv] ssid
992 	 *	[tlv] supported rates
993 	 *	[tlv] parameter set (IBSS)
994 	 *	[tlv] extended supported rates
995 	 */
996 	frm = (u_int8_t *)&wh[1];
997 	memset(frm, 0, 8);	/* timestamp is set by hardware */
998 	frm += 8;
999 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1000 	frm += 2;
1001 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1002 		capinfo = IEEE80211_CAPINFO_IBSS;
1003 	else
1004 		capinfo = IEEE80211_CAPINFO_ESS;
1005 	if (ic->ic_flags & IEEE80211_F_WEPON)
1006 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1007 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1008 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1009 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1010 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1011 	*(u_int16_t *)frm = htole16(capinfo);
1012 	frm += 2;
1013 	*frm++ = IEEE80211_ELEMID_SSID;
1014 	*frm++ = ni->ni_esslen;
1015 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1016 	frm += ni->ni_esslen;
1017 	frm = ieee80211_add_rates(frm, rs);
1018 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1019 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1020 		*frm++ = 2;
1021 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1022 	} else {
1023 		/* TODO: TIM */
1024 		*frm++ = IEEE80211_ELEMID_TIM;
1025 		*frm++ = 4;	/* length */
1026 		*frm++ = 0;	/* DTIM count */
1027 		*frm++ = 1;	/* DTIM period */
1028 		*frm++ = 0;	/* bitmap control */
1029 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1030 	}
1031 	frm = ieee80211_add_xrates(frm, rs);
1032 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1033 
1034 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1035 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1036 				     ath_mbuf_load_cb, bf,
1037 				     BUS_DMA_NOWAIT);
1038 	if (error != 0) {
1039 		m_freem(m);
1040 		return error;
1041 	}
1042 	KASSERT(bf->bf_nseg == 1,
1043 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1044 		bf->bf_nseg));
1045 	bf->bf_m = m;
1046 
1047 	/* setup descriptors */
1048 	ds = bf->bf_desc;
1049 
1050 	ds->ds_link = 0;
1051 	ds->ds_data = bf->bf_segs[0].ds_addr;
1052 	/* XXX verify mbuf data area covers this roundup */
1053 	/*
1054 	 * Calculate rate code.
1055 	 * XXX everything at min xmit rate
1056 	 */
1057 	rt = sc->sc_currates;
1058 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1059 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) == 0)
1060 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1061 	else
1062 		rate = rt->info[0].rateCode;
1063 	ath_hal_setuptxdesc(ah, ds
1064 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1065 		, sizeof(struct ieee80211_frame)	/* header length */
1066 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1067 		, 0x20				/* txpower XXX */
1068 		, rate, 1			/* series 0 rate/tries */
1069 		, HAL_TXKEYIX_INVALID		/* no encryption */
1070 		, 0				/* antenna mode */
1071 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1072 		, 0				/* rts/cts rate */
1073 		, 0				/* rts/cts duration */
1074 	);
1075 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1076 	ath_hal_filltxdesc(ah, ds
1077 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1078 		, AH_TRUE				/* first segment */
1079 		, AH_TRUE				/* last segment */
1080 	);
1081 
1082 	return 0;
1083 }
1084 
1085 static void
1086 ath_beacon_proc(void *arg, int pending)
1087 {
1088 	struct ath_softc *sc = arg;
1089 	struct ieee80211com *ic = &sc->sc_ic;
1090 	struct ath_buf *bf = sc->sc_bcbuf;
1091 	struct ath_hal *ah = sc->sc_ah;
1092 
1093 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1094 	if (ic->ic_opmode == IEEE80211_M_STA || bf == NULL || bf->bf_m == NULL) {
1095 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1096 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1097 		return;
1098 	}
1099 	/* update beacon to reflect PS poll state */
1100 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1101 		DPRINTF(("%s: beacon queue %u did not stop?",
1102 			__func__, sc->sc_bhalq));
1103 		return;			/* busy, XXX is this right? */
1104 	}
1105 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1106 
1107 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1108 	ath_hal_txstart(ah, sc->sc_bhalq);
1109 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1110 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1111 }
1112 
1113 static void
1114 ath_beacon_free(struct ath_softc *sc)
1115 {
1116 	struct ath_buf *bf = sc->sc_bcbuf;
1117 
1118 	if (bf->bf_m != NULL) {
1119 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1120 		m_freem(bf->bf_m);
1121 		bf->bf_m = NULL;
1122 		bf->bf_node = NULL;
1123 	}
1124 }
1125 
1126 /*
1127  * Configure the beacon and sleep timers.
1128  *
1129  * When operating as an AP this resets the TSF and sets
1130  * up the hardware to notify us when we need to issue beacons.
1131  *
1132  * When operating in station mode this sets up the beacon
1133  * timers according to the timestamp of the last received
1134  * beacon and the current TSF, configures PCF and DTIM
1135  * handling, programs the sleep registers so the hardware
1136  * will wakeup in time to receive beacons, and configures
1137  * the beacon miss handling so we'll receive a BMISS
1138  * interrupt when we stop seeing beacons from the AP
1139  * we've associated with.
1140  */
1141 static void
1142 ath_beacon_config(struct ath_softc *sc)
1143 {
1144 	struct ath_hal *ah = sc->sc_ah;
1145 	struct ieee80211com *ic = &sc->sc_ic;
1146 	struct ieee80211_node *ni = ic->ic_bss;
1147 	u_int32_t nexttbtt;
1148 
1149 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1150 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1151 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1152 	nexttbtt += ni->ni_intval;
1153 	if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
1154 		HAL_BEACON_STATE bs;
1155 		u_int32_t bmisstime;
1156 
1157 		/* NB: no PCF support right now */
1158 		memset(&bs, 0, sizeof(bs));
1159 		bs.bs_intval = ni->ni_intval;
1160 		bs.bs_nexttbtt = nexttbtt;
1161 		bs.bs_dtimperiod = bs.bs_intval;
1162 		bs.bs_nextdtim = nexttbtt;
1163 		/*
1164 		 * Calculate the number of consecutive beacons to miss
1165 		 * before taking a BMISS interrupt.  The configuration
1166 		 * is specified in ms, so we need to convert that to
1167 		 * TU's and then calculate based on the beacon interval.
1168 		 * Note that we clamp the result to at most 10 beacons.
1169 		 */
1170 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1171 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1172 		if (bs.bs_bmissthreshold > 10)
1173 			bs.bs_bmissthreshold = 10;
1174 		else if (bs.bs_bmissthreshold <= 0)
1175 			bs.bs_bmissthreshold = 1;
1176 
1177 		/*
1178 		 * Calculate sleep duration.  The configuration is
1179 		 * given in ms.  We insure a multiple of the beacon
1180 		 * period is used.  Also, if the sleep duration is
1181 		 * greater than the DTIM period then it makes senses
1182 		 * to make it a multiple of that.
1183 		 *
1184 		 * XXX fixed at 100ms
1185 		 */
1186 		bs.bs_sleepduration =
1187 			roundup((100 * 1000) / 1024, bs.bs_intval);
1188 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1189 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1190 
1191 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1192 			, __func__
1193 			, bs.bs_intval
1194 			, bs.bs_nexttbtt
1195 			, bs.bs_dtimperiod
1196 			, bs.bs_nextdtim
1197 			, bs.bs_bmissthreshold
1198 			, bs.bs_sleepduration
1199 		));
1200 		ath_hal_intrset(ah, 0);
1201 		/*
1202 		 * Reset our tsf so the hardware will update the
1203 		 * tsf register to reflect timestamps found in
1204 		 * received beacons.
1205 		 */
1206 		ath_hal_resettsf(ah);
1207 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1208 		sc->sc_imask |= HAL_INT_BMISS;
1209 		ath_hal_intrset(ah, sc->sc_imask);
1210 	} else {
1211 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1212 			__func__, ni->ni_intval, nexttbtt));
1213 		ath_hal_intrset(ah, 0);
1214 		ath_hal_beaconinit(ah, ic->ic_opmode,
1215 			nexttbtt, ni->ni_intval);
1216 		sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1217 		ath_hal_intrset(ah, sc->sc_imask);
1218 	}
1219 }
1220 
1221 static void
1222 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1223 {
1224 	bus_addr_t *paddr = (bus_addr_t*) arg;
1225 	*paddr = segs->ds_addr;
1226 }
1227 
1228 static int
1229 ath_desc_alloc(struct ath_softc *sc)
1230 {
1231 	int i, bsize, error;
1232 	struct ath_desc *ds;
1233 	struct ath_buf *bf;
1234 
1235 	/* allocate descriptors */
1236 	sc->sc_desc_len = sizeof(struct ath_desc) *
1237 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1238 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1239 	if (error != 0)
1240 		return error;
1241 
1242 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1243 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1244 	if (error != 0)
1245 		goto fail0;
1246 
1247 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1248 				sc->sc_desc, sc->sc_desc_len,
1249 				ath_load_cb, &sc->sc_desc_paddr,
1250 				BUS_DMA_NOWAIT);
1251 	if (error != 0)
1252 		goto fail1;
1253 
1254 	ds = sc->sc_desc;
1255 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1256 	    ds, sc->sc_desc_len,
1257 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1258 
1259 	/* allocate buffers */
1260 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1261 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1262 	if (bf == NULL)
1263 		goto fail2;
1264 	sc->sc_bufptr = bf;
1265 
1266 	TAILQ_INIT(&sc->sc_rxbuf);
1267 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1268 		bf->bf_desc = ds;
1269 		bf->bf_daddr = sc->sc_desc_paddr +
1270 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1271 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1272 					  &bf->bf_dmamap);
1273 		if (error != 0)
1274 			break;
1275 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1276 	}
1277 
1278 	TAILQ_INIT(&sc->sc_txbuf);
1279 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1280 		bf->bf_desc = ds;
1281 		bf->bf_daddr = sc->sc_desc_paddr +
1282 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1283 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1284 					  &bf->bf_dmamap);
1285 		if (error != 0)
1286 			break;
1287 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1288 	}
1289 	TAILQ_INIT(&sc->sc_txq);
1290 
1291 	/* beacon buffer */
1292 	bf->bf_desc = ds;
1293 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1294 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1295 	if (error != 0)
1296 		return error;
1297 	sc->sc_bcbuf = bf;
1298 	return 0;
1299 
1300 fail2:
1301 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1302 fail1:
1303 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1304 fail0:
1305 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1306 	sc->sc_ddmamap = NULL;
1307 	return error;
1308 }
1309 
1310 static void
1311 ath_desc_free(struct ath_softc *sc)
1312 {
1313 	struct ath_buf *bf;
1314 
1315 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1316 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1317 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1318 
1319 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1320 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1321 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1322 		m_freem(bf->bf_m);
1323 	}
1324 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1325 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1326 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1327 		if (bf->bf_m) {
1328 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1329 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1330 			m_freem(bf->bf_m);
1331 			bf->bf_m = NULL;
1332 		}
1333 	}
1334 	if (sc->sc_bcbuf != NULL) {
1335 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1336 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1337 		sc->sc_bcbuf = NULL;
1338 	}
1339 
1340 	TAILQ_INIT(&sc->sc_rxbuf);
1341 	TAILQ_INIT(&sc->sc_txbuf);
1342 	TAILQ_INIT(&sc->sc_txq);
1343 	free(sc->sc_bufptr, M_DEVBUF);
1344 	sc->sc_bufptr = NULL;
1345 }
1346 
1347 static struct ieee80211_node *
1348 ath_node_alloc(struct ieee80211com *ic)
1349 {
1350 	struct ath_node *an =
1351 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1352 	return an ? &an->st_node : NULL;
1353 }
1354 
1355 static void
1356 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1357 {
1358         struct ath_softc *sc = ic->ic_if.if_softc;
1359 	struct ath_buf *bf;
1360 
1361 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1362 		if (bf->bf_node == ni)
1363 			bf->bf_node = NULL;
1364 	}
1365 	free(ni, M_DEVBUF);
1366 }
1367 
1368 static void
1369 ath_node_copy(struct ieee80211com *ic,
1370 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1371 {
1372 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1373 }
1374 
1375 static int
1376 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1377 {
1378 	struct ath_hal *ah = sc->sc_ah;
1379 	int error;
1380 	struct mbuf *m;
1381 	struct ath_desc *ds;
1382 
1383 	m = bf->bf_m;
1384 	if (m == NULL) {
1385 		/*
1386 		 * NB: by assigning a page to the rx dma buffer we
1387 		 * implicitly satisfy the Atheros requirement that
1388 		 * this buffer be cache-line-aligned and sized to be
1389 		 * multiple of the cache line size.  Not doing this
1390 		 * causes weird stuff to happen (for the 5210 at least).
1391 		 */
1392 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1393 		if (m == NULL) {
1394 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1395 			sc->sc_stats.ast_rx_nombuf++;
1396 			return ENOMEM;
1397 		}
1398 		bf->bf_m = m;
1399 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1400 
1401 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1402 					     ath_mbuf_load_cb, bf,
1403 					     BUS_DMA_NOWAIT);
1404 		if (error != 0) {
1405 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1406 				" error %d\n", error));
1407 			sc->sc_stats.ast_rx_busdma++;
1408 			return error;
1409 		}
1410 		KASSERT(bf->bf_nseg == 1,
1411 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1412 			bf->bf_nseg));
1413 	}
1414 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1415 
1416 	/* setup descriptors */
1417 	ds = bf->bf_desc;
1418 	ds->ds_link = 0;
1419 	ds->ds_data = bf->bf_segs[0].ds_addr;
1420 	ath_hal_setuprxdesc(ah, ds
1421 		, m->m_len		/* buffer size */
1422 		, 0
1423 	);
1424 
1425 	if (sc->sc_rxlink != NULL)
1426 		*sc->sc_rxlink = bf->bf_daddr;
1427 	sc->sc_rxlink = &ds->ds_link;
1428 	return 0;
1429 }
1430 
1431 static void
1432 ath_rx_proc(void *arg, int npending)
1433 {
1434 	struct ath_softc *sc = arg;
1435 	struct ath_buf *bf;
1436 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1437 	struct ath_hal *ah = sc->sc_ah;
1438 	struct ath_desc *ds;
1439 	struct mbuf *m;
1440 	struct ieee80211_frame *wh, whbuf;
1441 	int len;
1442 	u_int phyerr;
1443 	HAL_STATUS status;
1444 
1445 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1446 	do {
1447 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1448 		if (bf == NULL) {		/* NB: shouldn't happen */
1449 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1450 			break;
1451 		}
1452 		m = bf->bf_m;
1453 		if (m == NULL) {		/* NB: shouldn't happen */
1454 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1455 			continue;
1456 		}
1457 		ds = bf->bf_desc;
1458 		status = ath_hal_rxprocdesc(ah, ds);
1459 #ifdef AR_DEBUG
1460 		if (ath_debug > 1)
1461 			ath_printrxbuf(bf, status == HAL_OK);
1462 #endif
1463 		if (status == HAL_EINPROGRESS)
1464 			break;
1465 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1466 		if (ds->ds_rxstat.rs_status != 0) {
1467 			ifp->if_ierrors++;
1468 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1469 				sc->sc_stats.ast_rx_crcerr++;
1470 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1471 				sc->sc_stats.ast_rx_fifoerr++;
1472 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1473 				sc->sc_stats.ast_rx_badcrypt++;
1474 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1475 				sc->sc_stats.ast_rx_phyerr++;
1476 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1477 				sc->sc_stats.ast_rx_phy[phyerr]++;
1478 			}
1479 			goto rx_next;
1480 		}
1481 
1482 		len = ds->ds_rxstat.rs_datalen;
1483 		if (len < sizeof(struct ieee80211_frame)) {
1484 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1485 			goto rx_next;
1486 		}
1487 
1488 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1489 		    BUS_DMASYNC_POSTREAD);
1490 
1491 		wh = mtod(m, struct ieee80211_frame *);
1492 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1493 		    IEEE80211_FC0_TYPE_CTL) {
1494 			/*
1495 			 * Ignore control frame received in promisc mode.
1496 			 */
1497 			DPRINTF(("ath_rx_proc: control frame\n"));
1498 			goto rx_next;
1499 		}
1500 
1501 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1502 		bf->bf_m = NULL;
1503 		m->m_pkthdr.rcvif = ifp;
1504 		m->m_pkthdr.len = m->m_len = len;
1505 		if (IFF_DUMPPKTS(ifp)) {
1506 			struct ieee80211com *ic = &sc->sc_ic;
1507 			const HAL_RATE_TABLE *rt = sc->sc_rates[ic->ic_curmode];
1508 			ieee80211_dump_pkt(mtod(m, u_int8_t *), len,
1509 				rt ? rt->info[rt->rateCodeToIndex[ds->ds_rxstat.rs_rate]].dot11Rate & IEEE80211_RATE_VAL : 0,
1510 				ds->ds_rxstat.rs_rssi);
1511 		}
1512 		m_adj(m, -IEEE80211_CRC_LEN);
1513 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1514 			/*
1515 			 * WEP is decrypted by hardware. Clear WEP bit
1516 			 * and trim WEP header for ieee80211_input().
1517 			 */
1518 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1519 			memcpy(&whbuf, wh, sizeof(whbuf));
1520 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1521 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
1522 			/*
1523 			 * Also trim WEP ICV from the tail.
1524 			 */
1525 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1526 		}
1527 		ieee80211_input(ifp, m,
1528 			ds->ds_rxstat.rs_rssi,
1529 			ds->ds_rxstat.rs_tstamp,
1530 			ds->ds_rxstat.rs_antenna);
1531   rx_next:
1532 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1533 	} while (ath_rxbuf_init(sc, bf) == 0);
1534 
1535 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1536 	ath_hal_rxena(ah);			/* in case of RXEOL */
1537 }
1538 
1539 /*
1540  * XXX Size of an ACK control frame in bytes.
1541  */
1542 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1543 
1544 static int
1545 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1546     struct mbuf *m0)
1547 {
1548 	struct ieee80211com *ic = &sc->sc_ic;
1549 	struct ath_hal *ah = sc->sc_ah;
1550 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1551 	int i, error, iswep, hdrlen, pktlen;
1552 	u_int8_t rix, cix, txrate, ctsrate;
1553 	struct ath_desc *ds;
1554 	struct mbuf *m;
1555 	struct ieee80211_frame *wh;
1556 	u_int32_t iv;
1557 	u_int8_t *ivp;
1558 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1559 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1560 	u_int subtype, flags, ctsduration, antenna;
1561 	HAL_PKT_TYPE atype;
1562 	const HAL_RATE_TABLE *rt;
1563 	HAL_BOOL shortPreamble;
1564 	struct ath_node *an;
1565 
1566 	wh = mtod(m0, struct ieee80211_frame *);
1567 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1568 	hdrlen = sizeof(struct ieee80211_frame);
1569 	pktlen = m0->m_pkthdr.len;
1570 
1571 	if (iswep) {
1572 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1573 		m_adj(m0, hdrlen);
1574 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1575 		if (m0 == NULL) {
1576 			sc->sc_stats.ast_tx_nombuf++;
1577 			return ENOMEM;
1578 		}
1579 		ivp = hdrbuf + hdrlen;
1580 		/*
1581 		 * XXX
1582 		 * IV must not duplicate during the lifetime of the key.
1583 		 * But no mechanism to renew keys is defined in IEEE 802.11
1584 		 * WEP.  And IV may be duplicated between other stations
1585 		 * because of the session key itself is shared.
1586 		 * So we use pseudo random IV for now, though it is not the
1587 		 * right way.
1588 		 */
1589 		iv = arc4random();
1590 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1591 			ivp[i] = iv;
1592 			iv >>= 8;
1593 		}
1594 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1595 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1596 		/*
1597 		 * The ICV length must be included into hdrlen and pktlen.
1598 		 */
1599 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1600 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1601 	}
1602 	pktlen += IEEE80211_CRC_LEN;
1603 
1604 	/*
1605 	 * Load the DMA map so any coalescing is done.  This
1606 	 * also calculates the number of descriptors we need.
1607 	 */
1608 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1609 				     ath_mbuf_load_cb, bf,
1610 				     BUS_DMA_NOWAIT);
1611 	if (error != 0) {
1612 		sc->sc_stats.ast_tx_busdma++;
1613 		m_freem(m0);
1614 		return error;
1615 	}
1616 	/*
1617 	 * Discard null packets and check for packets that
1618 	 * require too many TX descriptors.  We try to convert
1619 	 * the latter to a cluster.
1620 	 */
1621 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1622 		sc->sc_stats.ast_tx_linear++;
1623 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1624 		if (m == NULL) {
1625 			sc->sc_stats.ast_tx_nombuf++;
1626 			m_freem(m0);
1627 			return ENOMEM;
1628 		}
1629 		M_MOVE_PKTHDR(m, m0);
1630 		MCLGET(m, M_DONTWAIT);
1631 		if ((m->m_flags & M_EXT) == 0) {
1632 			sc->sc_stats.ast_tx_nomcl++;
1633 			m_freem(m0);
1634 			m_free(m);
1635 			return ENOMEM;
1636 		}
1637 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1638 		m_freem(m0);
1639 		m->m_len = m->m_pkthdr.len;
1640 		m0 = m;
1641 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1642 					     ath_mbuf_load_cb, bf,
1643 					     BUS_DMA_NOWAIT);
1644 		if (error != 0) {
1645 			sc->sc_stats.ast_tx_busdma++;
1646 			m_freem(m0);
1647 			return error;
1648 		}
1649 		KASSERT(bf->bf_nseg == 1,
1650 			("ath_tx_start: packet not one segment; nseg %u",
1651 			bf->bf_nseg));
1652 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1653 		sc->sc_stats.ast_tx_nodata++;
1654 		m_freem(m0);
1655 		return EIO;
1656 	}
1657 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1658 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1659 	bf->bf_m = m0;
1660 	bf->bf_node = ni;
1661 
1662 	/* setup descriptors */
1663 	ds = bf->bf_desc;
1664 	rt = sc->sc_currates;
1665 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1666 
1667 	/*
1668 	 * Calculate Atheros packet type from IEEE80211 packet header
1669 	 * and setup for rate calculations.
1670 	 */
1671 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1672 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1673 	case IEEE80211_FC0_TYPE_MGT:
1674 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1675 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1676 			atype = HAL_PKT_TYPE_BEACON;
1677 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1678 			atype = HAL_PKT_TYPE_PROBE_RESP;
1679 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1680 			atype = HAL_PKT_TYPE_ATIM;
1681 		rix = 0;			/* XXX lowest rate */
1682 		break;
1683 	case IEEE80211_FC0_TYPE_CTL:
1684 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1685 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1686 			atype = HAL_PKT_TYPE_PSPOLL;
1687 		rix = 0;			/* XXX lowest rate */
1688 		break;
1689 	default:
1690 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1691 				IEEE80211_RATE_VAL];
1692 		if (rix == 0xff) {
1693 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1694 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1695 			sc->sc_stats.ast_tx_badrate++;
1696 			m_freem(m0);
1697 			return EIO;
1698 		}
1699 		break;
1700 	}
1701 	/*
1702 	 * NB: the 802.11 layer marks whether or not we should
1703 	 * use short preamble based on the current mode and
1704 	 * negotiated parameters.
1705 	 */
1706 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1707 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1708 		shortPreamble = AH_TRUE;
1709 		sc->sc_stats.ast_tx_shortpre++;
1710 	} else {
1711 		txrate = rt->info[rix].rateCode;
1712 		shortPreamble = AH_FALSE;
1713 	}
1714 
1715 	/*
1716 	 * Calculate miscellaneous flags.
1717 	 */
1718 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1719 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1720 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1721 		sc->sc_stats.ast_tx_noack++;
1722 	} else if (pktlen > ic->ic_rtsthreshold) {
1723 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
1724 		sc->sc_stats.ast_tx_rts++;
1725 	}
1726 
1727 	/*
1728 	 * Calculate RTS/CTS rate and duration if needed.
1729 	 */
1730 	ctsduration = 0;
1731 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
1732 		/*
1733 		 * CTS transmit rate is derived from the transmit rate
1734 		 * by looking in the h/w rate table.  We must also factor
1735 		 * in whether or not a short preamble is to be used.
1736 		 */
1737 		cix = rt->info[rix].controlRate;
1738 		ctsrate = rt->info[cix].rateCode;
1739 		if (shortPreamble)
1740 			ctsrate |= rt->info[cix].shortPreamble;
1741 		/*
1742 		 * Compute the transmit duration based on the size
1743 		 * of an ACK frame.  We call into the HAL to do the
1744 		 * computation since it depends on the characteristics
1745 		 * of the actual PHY being used.
1746 		 */
1747 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
1748 			ctsduration += ath_hal_computetxtime(ah,
1749 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1750 		}
1751 		/* SIFS + data */
1752 		ctsduration += ath_hal_computetxtime(ah,
1753 			rt, pktlen, rix, shortPreamble);
1754 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
1755 			ctsduration += ath_hal_computetxtime(ah,
1756 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1757 		}
1758 	} else
1759 		ctsrate = 0;
1760 
1761 	/*
1762 	 * For now use the antenna on which the last good
1763 	 * frame was received on.  We assume this field is
1764 	 * initialized to 0 which gives us ``auto'' or the
1765 	 * ``default'' antenna.
1766 	 */
1767 	an = (struct ath_node *) ni;
1768 	if (an->an_tx_antenna)
1769 		antenna = an->an_tx_antenna;
1770 	else
1771 		antenna = ni->ni_rantenna;
1772 
1773 	/*
1774 	 * Formulate first tx descriptor with tx controls.
1775 	 */
1776 	/* XXX check return value? */
1777 	ath_hal_setuptxdesc(ah, ds
1778 		, pktlen		/* packet length */
1779 		, hdrlen		/* header length */
1780 		, atype			/* Atheros packet type */
1781 		, 60			/* txpower XXX */
1782 		, txrate, 1+10		/* series 0 rate/tries */
1783 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
1784 		, antenna		/* antenna mode */
1785 		, flags			/* flags */
1786 		, ctsrate		/* rts/cts rate */
1787 		, ctsduration		/* rts/cts duration */
1788 	);
1789 #ifdef notyet
1790 	ath_hal_setupxtxdesc(ah, ds
1791 		, AH_FALSE		/* short preamble */
1792 		, 0, 0			/* series 1 rate/tries */
1793 		, 0, 0			/* series 2 rate/tries */
1794 		, 0, 0			/* series 3 rate/tries */
1795 	);
1796 #endif
1797 	/*
1798 	 * Fillin the remainder of the descriptor info.
1799 	 */
1800 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
1801 		ds->ds_data = bf->bf_segs[i].ds_addr;
1802 		if (i == bf->bf_nseg - 1)
1803 			ds->ds_link = 0;
1804 		else
1805 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
1806 		ath_hal_filltxdesc(ah, ds
1807 			, bf->bf_segs[i].ds_len	/* segment length */
1808 			, i == 0		/* first segment */
1809 			, i == bf->bf_nseg - 1	/* last segment */
1810 		);
1811 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
1812 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
1813 		    ds->ds_hw[0], ds->ds_hw[1]));
1814 	}
1815 
1816 	/*
1817 	 * Insert the frame on the outbound list and
1818 	 * pass it on to the hardware.
1819 	 */
1820 	mtx_lock(&sc->sc_txqlock);
1821 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
1822 	if (sc->sc_txlink == NULL) {
1823 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
1824 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
1825 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
1826 	} else {
1827 		*sc->sc_txlink = bf->bf_daddr;
1828 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
1829 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
1830 	}
1831 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
1832 	mtx_unlock(&sc->sc_txqlock);
1833 
1834 	ath_hal_txstart(ah, sc->sc_txhalq);
1835 	return 0;
1836 }
1837 
1838 static void
1839 ath_tx_proc(void *arg, int npending)
1840 {
1841 	struct ath_softc *sc = arg;
1842 	struct ath_hal *ah = sc->sc_ah;
1843 	struct ath_buf *bf;
1844 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1845 	struct ath_desc *ds;
1846 	struct ieee80211_node *ni;
1847 	struct ath_node *an;
1848 	int sr, lr;
1849 	HAL_STATUS status;
1850 
1851 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
1852 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
1853 		sc->sc_txlink));
1854 	for (;;) {
1855 		mtx_lock(&sc->sc_txqlock);
1856 		bf = TAILQ_FIRST(&sc->sc_txq);
1857 		if (bf == NULL) {
1858 			sc->sc_txlink = NULL;
1859 			mtx_unlock(&sc->sc_txqlock);
1860 			break;
1861 		}
1862 		/* only the last descriptor is needed */
1863 		ds = &bf->bf_desc[bf->bf_nseg - 1];
1864 		status = ath_hal_txprocdesc(ah, ds);
1865 #ifdef AR_DEBUG
1866 		if (ath_debug > 1)
1867 			ath_printtxbuf(bf, status == HAL_OK);
1868 #endif
1869 		if (status == HAL_EINPROGRESS) {
1870 			mtx_unlock(&sc->sc_txqlock);
1871 			break;
1872 		}
1873 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1874 		mtx_unlock(&sc->sc_txqlock);
1875 
1876 		ni = bf->bf_node;
1877 		if (ni != NULL) {
1878 			an = (struct ath_node *) ni;
1879 			if (ds->ds_txstat.ts_status == 0) {
1880 				an->an_tx_ok++;
1881 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
1882 			} else {
1883 				an->an_tx_err++;
1884 				ifp->if_oerrors++;
1885 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
1886 					sc->sc_stats.ast_tx_xretries++;
1887 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
1888 					sc->sc_stats.ast_tx_fifoerr++;
1889 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
1890 					sc->sc_stats.ast_tx_filtered++;
1891 				an->an_tx_antenna = 0;	/* invalidate */
1892 			}
1893 			sr = ds->ds_txstat.ts_shortretry;
1894 			lr = ds->ds_txstat.ts_longretry;
1895 			sc->sc_stats.ast_tx_shortretry += sr;
1896 			sc->sc_stats.ast_tx_longretry += lr;
1897 			if (sr + lr)
1898 				an->an_tx_retr++;
1899 		}
1900 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1901 		    BUS_DMASYNC_POSTWRITE);
1902 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1903 		m_freem(bf->bf_m);
1904 		bf->bf_m = NULL;
1905 		bf->bf_node = NULL;
1906 
1907 		mtx_lock(&sc->sc_txbuflock);
1908 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1909 		mtx_unlock(&sc->sc_txbuflock);
1910 	}
1911 	ifp->if_flags &= ~IFF_OACTIVE;
1912 	sc->sc_tx_timer = 0;
1913 
1914 	ath_start(ifp);
1915 }
1916 
1917 /*
1918  * Drain the transmit queue and reclaim resources.
1919  */
1920 static void
1921 ath_draintxq(struct ath_softc *sc)
1922 {
1923 	struct ath_hal *ah = sc->sc_ah;
1924 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1925 	struct ath_buf *bf;
1926 
1927 	/* XXX return value */
1928 	if (!sc->sc_invalid) {
1929 		/* don't touch the hardware if marked invalid */
1930 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
1931 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
1932 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
1933 		    sc->sc_txlink));
1934 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
1935 		DPRINTF(("ath_draintxq: beacon queue %p\n",
1936 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
1937 	}
1938 	for (;;) {
1939 		mtx_lock(&sc->sc_txqlock);
1940 		bf = TAILQ_FIRST(&sc->sc_txq);
1941 		if (bf == NULL) {
1942 			sc->sc_txlink = NULL;
1943 			mtx_unlock(&sc->sc_txqlock);
1944 			break;
1945 		}
1946 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1947 		mtx_unlock(&sc->sc_txqlock);
1948 #ifdef AR_DEBUG
1949 		if (ath_debug)
1950 			ath_printtxbuf(bf,
1951 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
1952 #endif /* AR_DEBUG */
1953 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1954 		m_freem(bf->bf_m);
1955 		bf->bf_m = NULL;
1956 		bf->bf_node = NULL;
1957 		mtx_lock(&sc->sc_txbuflock);
1958 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1959 		mtx_unlock(&sc->sc_txbuflock);
1960 	}
1961 	ifp->if_flags &= ~IFF_OACTIVE;
1962 	sc->sc_tx_timer = 0;
1963 }
1964 
1965 /*
1966  * Disable the receive h/w in preparation for a reset.
1967  */
1968 static void
1969 ath_stoprecv(struct ath_softc *sc)
1970 {
1971 	struct ath_hal *ah = sc->sc_ah;
1972 
1973 	ath_hal_stoppcurecv(ah);	/* disable PCU */
1974 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
1975 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
1976 	DELAY(3000);			/* long enough for 1 frame */
1977 #ifdef AR_DEBUG
1978 	if (ath_debug) {
1979 		struct ath_buf *bf;
1980 
1981 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
1982 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
1983 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1984 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
1985 				ath_printrxbuf(bf, 1);
1986 		}
1987 	}
1988 #endif
1989 	sc->sc_rxlink = NULL;		/* just in case */
1990 }
1991 
1992 /*
1993  * Enable the receive h/w following a reset.
1994  */
1995 static int
1996 ath_startrecv(struct ath_softc *sc)
1997 {
1998 	struct ath_hal *ah = sc->sc_ah;
1999 	struct ath_buf *bf;
2000 
2001 	sc->sc_rxlink = NULL;
2002 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2003 		int error = ath_rxbuf_init(sc, bf);
2004 		if (error != 0) {
2005 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2006 				error));
2007 			return error;
2008 		}
2009 	}
2010 
2011 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2012 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2013 	ath_hal_rxena(ah);		/* enable recv descriptors */
2014 	ath_mode_init(sc);		/* set filters, etc. */
2015 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2016 	return 0;
2017 }
2018 
2019 /*
2020  * Set/change channels.  If the channel is really being changed,
2021  * it's done by resetting the chip.  To accomplish this we must
2022  * first cleanup any pending DMA, then restart stuff after a la
2023  * ath_init.
2024  */
2025 static int
2026 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2027 {
2028 	struct ath_hal *ah = sc->sc_ah;
2029 	struct ieee80211com *ic = &sc->sc_ic;
2030 
2031 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2032 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2033 		ic->ic_ibss_chan->ic_freq,
2034 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2035 	if (chan != ic->ic_ibss_chan) {
2036 		HAL_STATUS status;
2037 		HAL_CHANNEL hchan;
2038 		enum ieee80211_phymode mode;
2039 
2040 		/*
2041 		 * To switch channels clear any pending DMA operations;
2042 		 * wait long enough for the RX fifo to drain, reset the
2043 		 * hardware at the new frequency, and then re-enable
2044 		 * the relevant bits of the h/w.
2045 		 */
2046 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2047 		ath_draintxq(sc);		/* clear pending tx frames */
2048 		ath_stoprecv(sc);		/* turn off frame recv */
2049 		/*
2050 		 * Convert to a HAL channel description with
2051 		 * the flags constrained to reflect the current
2052 		 * operating mode.
2053 		 */
2054 		hchan.channel = chan->ic_freq;
2055 		hchan.channelFlags = ath_chan2flags(ic, chan);
2056 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2057 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2058 				"channel %u (%u Mhz)\n",
2059 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2060 			return EIO;
2061 		}
2062 		/*
2063 		 * Re-enable rx framework.
2064 		 */
2065 		if (ath_startrecv(sc) != 0) {
2066 			if_printf(&ic->ic_if,
2067 				"ath_chan_set: unable to restart recv logic\n");
2068 			return EIO;
2069 		}
2070 
2071 		/*
2072 		 * Re-enable interrupts.
2073 		 */
2074 		ath_hal_intrset(ah, sc->sc_imask);
2075 
2076 		/*
2077 		 * Change channels and update the h/w rate map
2078 		 * if we're switching; e.g. 11a to 11b/g.
2079 		 */
2080 		ic->ic_ibss_chan = chan;
2081 		mode = ieee80211_chan2mode(ic, chan);
2082 		if (mode != sc->sc_curmode)
2083 			ath_setcurmode(sc, mode);
2084 	}
2085 	return 0;
2086 }
2087 
2088 static void
2089 ath_next_scan(void *arg)
2090 {
2091 	struct ath_softc *sc = arg;
2092 	struct ieee80211com *ic = &sc->sc_ic;
2093 	struct ifnet *ifp = &ic->ic_if;
2094 
2095 	if (ic->ic_state == IEEE80211_S_SCAN)
2096 		ieee80211_next_scan(ifp);
2097 }
2098 
2099 /*
2100  * Periodically recalibrate the PHY to account
2101  * for temperature/environment changes.
2102  */
2103 static void
2104 ath_calibrate(void *arg)
2105 {
2106 	struct ath_softc *sc = arg;
2107 	struct ath_hal *ah = sc->sc_ah;
2108 	struct ieee80211com *ic = &sc->sc_ic;
2109 	struct ieee80211_channel *c;
2110 	HAL_CHANNEL hchan;
2111 
2112 	sc->sc_stats.ast_per_cal++;
2113 
2114 	/*
2115 	 * Convert to a HAL channel description with the flags
2116 	 * constrained to reflect the current operating mode.
2117 	 */
2118 	c = ic->ic_ibss_chan;
2119 	hchan.channel = c->ic_freq;
2120 	hchan.channelFlags = ath_chan2flags(ic, c);
2121 
2122 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2123 
2124 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2125 		/*
2126 		 * Rfgain is out of bounds, reset the chip
2127 		 * to load new gain values.
2128 		 */
2129 		sc->sc_stats.ast_per_rfgain++;
2130 		ath_reset(sc);
2131 	}
2132 	if (!ath_hal_calibrate(ah, &hchan)) {
2133 		DPRINTF(("%s: calibration of channel %u failed\n",
2134 			__func__, c->ic_freq));
2135 		sc->sc_stats.ast_per_calfail++;
2136 	}
2137 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2138 }
2139 
2140 static int
2141 ath_newstate(void *arg, enum ieee80211_state nstate)
2142 {
2143 	struct ath_softc *sc = arg;
2144 	struct ath_hal *ah = sc->sc_ah;
2145 	struct ieee80211com *ic = &sc->sc_ic;
2146 	struct ifnet *ifp = &ic->ic_if;
2147 	struct ieee80211_node *ni;
2148 	int i, error;
2149 	u_int8_t *bssid;
2150 	u_int32_t rfilt;
2151 	enum ieee80211_state ostate;
2152 #ifdef AR_DEBUG
2153 	static const char *stname[] =
2154 	    { "INIT", "SCAN", "AUTH", "ASSOC", "RUN" };
2155 #endif /* AR_DEBUG */
2156 	static const HAL_LED_STATE leds[] = {
2157 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2158 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2159 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2160 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2161 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2162 	};
2163 
2164 	ostate = ic->ic_state;
2165 
2166 	DPRINTF(("%s: %s -> %s\n", __func__, stname[ostate], stname[nstate]));
2167 
2168 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2169 
2170 	if (nstate == IEEE80211_S_INIT) {
2171 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2172 		ath_hal_intrset(ah, sc->sc_imask);
2173 		error = 0;			/* cheat + use error return */
2174 		goto bad;
2175 	}
2176 	ni = ic->ic_bss;
2177 	error = ath_chan_set(sc, ni->ni_chan);
2178 	if (error != 0)
2179 		goto bad;
2180 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
2181 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
2182 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2183 	    (ifp->if_flags & IFF_PROMISC))
2184 		rfilt |= HAL_RX_FILTER_PROM;
2185 	if (nstate == IEEE80211_S_SCAN) {
2186 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2187 			ath_next_scan, sc);
2188 		bssid = ifp->if_broadcastaddr;
2189 		rfilt |= HAL_RX_FILTER_BEACON;
2190 	} else {
2191 		callout_stop(&sc->sc_scan_ch);
2192 		bssid = ni->ni_bssid;
2193 	}
2194 	ath_hal_setrxfilter(ah, rfilt);
2195 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2196 		 __func__, rfilt, ether_sprintf(bssid)));
2197 
2198 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2199 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2200 	else
2201 		ath_hal_setassocid(ah, bssid, 0);
2202 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2203 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2204 			if (ath_hal_keyisvalid(ah, i))
2205 				ath_hal_keysetmac(ah, i, bssid);
2206 	}
2207 
2208 	if (nstate == IEEE80211_S_RUN) {
2209 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2210 			"capinfo=0x%04x chan=%d\n"
2211 			 , __func__
2212 			 , ic->ic_flags
2213 			 , ni->ni_intval
2214 			 , ether_sprintf(ni->ni_bssid)
2215 			 , ni->ni_capinfo
2216 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2217 
2218 		/*
2219 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2220 		 */
2221 		if (ic->ic_opmode != IEEE80211_M_STA) {
2222 			error = ath_beacon_alloc(sc, ni);
2223 			if (error != 0)
2224 				goto bad;
2225 		}
2226 
2227 		/*
2228 		 * Configure the beacon and sleep timers.
2229 		 */
2230 		ath_beacon_config(sc);
2231 
2232 		/* start periodic recalibration timer */
2233 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2234 			ath_calibrate, sc);
2235 	} else {
2236 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2237 		ath_hal_intrset(ah, sc->sc_imask);
2238 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2239 	}
2240 	/*
2241 	 * Reset the rate control state.
2242 	 */
2243 	ath_rate_ctl_reset(sc, nstate);
2244 	return 0;
2245 bad:
2246 	callout_stop(&sc->sc_scan_ch);
2247 	callout_stop(&sc->sc_cal_ch);
2248 	return error;
2249 }
2250 
2251 /*
2252  * Setup driver-specific state for a newly associated node.
2253  * Note that we're called also on a re-associate, the isnew
2254  * param tells us if this is the first time or not.
2255  */
2256 static void
2257 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2258 {
2259 	if (isnew) {
2260 		struct ath_node *an = (struct ath_node *) ni;
2261 
2262 		an->an_tx_ok = an->an_tx_err =
2263 			an->an_tx_retr = an->an_tx_upper = 0;
2264 		/* start with highest negotiated rate */
2265 		/*
2266 		 * XXX should do otherwise but only when
2267 		 * the rate control algorithm is better.
2268 		 */
2269 		KASSERT(ni->ni_rates.rs_nrates > 0,
2270 			("new association w/ no rates!"));
2271 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2272 	}
2273 }
2274 
2275 static int
2276 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2277 {
2278 	struct ieee80211com *ic = &sc->sc_ic;
2279 	struct ifnet *ifp = &ic->ic_if;
2280 	struct ath_hal *ah = sc->sc_ah;
2281 	HAL_CHANNEL *chans;
2282 	int i, ix, nchan;
2283 
2284 	sc->sc_have11g = 0;
2285 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2286 			M_TEMP, M_NOWAIT);
2287 	if (chans == NULL) {
2288 		if_printf(ifp, "unable to allocate channel table\n");
2289 		return ENOMEM;
2290 	}
2291 	/* XXX where does the country code, et. al. come from? */
2292 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2293 	    CTRY_DEFAULT, HAL_MODE_ALL, AH_TRUE)) {
2294 		if_printf(ifp, "unable to collect channel list from hal\n");
2295 		free(chans, M_TEMP);
2296 		return EINVAL;
2297 	}
2298 
2299 	/*
2300 	 * Convert HAL channels to ieee80211 ones and insert
2301 	 * them in the table according to their channel number.
2302 	 */
2303 	for (i = 0; i < nchan; i++) {
2304 		HAL_CHANNEL *c = &chans[i];
2305 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2306 		if (ix > IEEE80211_CHAN_MAX) {
2307 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2308 				ix, c->channel, c->channelFlags);
2309 			continue;
2310 		}
2311 		/* NB: flags are known to be compatible */
2312 		if (ic->ic_channels[ix].ic_freq == 0) {
2313 			ic->ic_channels[ix].ic_freq = c->channel;
2314 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2315 		} else {
2316 			/* channels overlap; e.g. 11g and 11b */
2317 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2318 		}
2319 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
2320 			sc->sc_have11g = 1;
2321 	}
2322 	free(chans, M_TEMP);
2323 	return 0;
2324 }
2325 
2326 static int
2327 ath_rate_setup(struct ath_softc *sc, u_int mode)
2328 {
2329 	struct ath_hal *ah = sc->sc_ah;
2330 	struct ieee80211com *ic = &sc->sc_ic;
2331 	const HAL_RATE_TABLE *rt;
2332 	struct ieee80211_rateset *rs;
2333 	int i, maxrates;
2334 
2335 	switch (mode) {
2336 	case IEEE80211_MODE_11A:
2337 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2338 		break;
2339 	case IEEE80211_MODE_11B:
2340 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2341 		break;
2342 	case IEEE80211_MODE_11G:
2343 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2344 		break;
2345 	case IEEE80211_MODE_TURBO:
2346 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2347 		break;
2348 	default:
2349 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2350 		return 0;
2351 	}
2352 	rt = sc->sc_rates[mode];
2353 	if (rt == NULL)
2354 		return 0;
2355 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2356 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2357 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2358 		maxrates = IEEE80211_RATE_MAXSIZE;
2359 	} else
2360 		maxrates = rt->rateCount;
2361 	rs = &ic->ic_sup_rates[mode];
2362 	for (i = 0; i < maxrates; i++)
2363 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2364 	rs->rs_nrates = maxrates;
2365 	return 1;
2366 }
2367 
2368 static void
2369 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2370 {
2371 	const HAL_RATE_TABLE *rt;
2372 	int i;
2373 
2374 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2375 	rt = sc->sc_rates[mode];
2376 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2377 	for (i = 0; i < rt->rateCount; i++)
2378 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2379 	sc->sc_currates = rt;
2380 	sc->sc_curmode = mode;
2381 }
2382 
2383 /*
2384  * Reset the rate control state for each 802.11 state transition.
2385  */
2386 static void
2387 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2388 {
2389 	struct ieee80211com *ic = &sc->sc_ic;
2390 	struct ieee80211_node *ni;
2391 	struct ath_node *an;
2392 
2393 	an = (struct ath_node *) ic->ic_bss;
2394 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2395 	if (ic->ic_opmode == IEEE80211_M_STA) {
2396 		ni = ic->ic_bss;
2397 		if (state == IEEE80211_S_RUN) {
2398 			/* start with highest negotiated rate */
2399 			KASSERT(ni->ni_rates.rs_nrates > 0,
2400 				("transition to RUN state w/ no rates!"));
2401 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2402 		} else {
2403 			/* use lowest rate */
2404 			ni->ni_txrate = 0;
2405 		}
2406 	} else {
2407 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2408 			ni->ni_txrate = 0;		/* use lowest rate */
2409 			an = (struct ath_node *) ni;
2410 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2411 			    an->an_tx_upper = 0;
2412 		}
2413 	}
2414 }
2415 
2416 /*
2417  * Examine and potentially adjust the transmit rate.
2418  */
2419 static void
2420 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2421 {
2422 	struct ath_softc *sc = arg;
2423 	struct ath_node *an = (struct ath_node *) ni;
2424 	struct ieee80211_rateset *rs = &ni->ni_rates;
2425 	int mod = 0, orate, enough;
2426 
2427 	/*
2428 	 * Rate control
2429 	 * XXX: very primitive version.
2430 	 */
2431 	sc->sc_stats.ast_rate_calls++;
2432 
2433 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2434 
2435 	/* no packet reached -> down */
2436 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2437 		mod = -1;
2438 
2439 	/* all packets needs retry in average -> down */
2440 	if (enough && an->an_tx_ok < an->an_tx_retr)
2441 		mod = -1;
2442 
2443 	/* no error and less than 10% of packets needs retry -> up */
2444 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2445 		mod = 1;
2446 
2447 	orate = ni->ni_txrate;
2448 	switch (mod) {
2449 	case 0:
2450 		if (enough && an->an_tx_upper > 0)
2451 			an->an_tx_upper--;
2452 		break;
2453 	case -1:
2454 		if (ni->ni_txrate > 0) {
2455 			ni->ni_txrate--;
2456 			sc->sc_stats.ast_rate_drop++;
2457 		}
2458 		an->an_tx_upper = 0;
2459 		break;
2460 	case 1:
2461 		if (++an->an_tx_upper < 2)
2462 			break;
2463 		an->an_tx_upper = 0;
2464 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2465 			ni->ni_txrate++;
2466 			sc->sc_stats.ast_rate_raise++;
2467 		}
2468 		break;
2469 	}
2470 
2471 	if (ni->ni_txrate != orate) {
2472 		printf("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2473 		    __func__,
2474 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2475 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2476 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr);
2477 	}
2478 	if (ni->ni_txrate != orate || enough)
2479 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2480 }
2481 
2482 #ifdef AR_DEBUG
2483 static int
2484 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2485 {
2486 	char dmode[64];
2487 	int error;
2488 
2489 	strncpy(dmode, "", sizeof(dmode) - 1);
2490 	dmode[sizeof(dmode) - 1] = '\0';
2491 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2492 
2493 	if (error == 0 && req->newptr != NULL) {
2494 		struct ifnet *ifp;
2495 		struct ath_softc *sc;
2496 
2497 		ifp = ifunit("ath0");		/* XXX */
2498 		if (!ifp)
2499 			return EINVAL;
2500 		sc = ifp->if_softc;
2501 		if (strcmp(dmode, "hal") == 0)
2502 			ath_hal_dumpstate(sc->sc_ah);
2503 		else if (strcmp(dmode, "eeprom") == 0)
2504 			ath_hal_dumpeeprom(sc->sc_ah);
2505 		else if (strcmp(dmode, "rfgain") == 0)
2506 			ath_hal_dumprfgain(sc->sc_ah);
2507 		else if (strcmp(dmode, "ani") == 0)
2508 			ath_hal_dumpani(sc->sc_ah);
2509 		else
2510 			return EINVAL;
2511 	}
2512 	return error;
2513 }
2514 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2515 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2516 
2517 static void
2518 ath_printrxbuf(struct ath_buf *bf, int done)
2519 {
2520 	struct ath_desc *ds;
2521 	int i;
2522 
2523 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2524 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2525 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2526 		    ds->ds_link, ds->ds_data,
2527 		    ds->ds_ctl0, ds->ds_ctl1,
2528 		    ds->ds_hw[0], ds->ds_hw[1],
2529 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2530 	}
2531 }
2532 
2533 static void
2534 ath_printtxbuf(struct ath_buf *bf, int done)
2535 {
2536 	struct ath_desc *ds;
2537 	int i;
2538 
2539 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2540 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2541 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2542 		    ds->ds_link, ds->ds_data,
2543 		    ds->ds_ctl0, ds->ds_ctl1,
2544 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2545 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2546 	}
2547 }
2548 #endif /* AR_DEBUG */
2549