xref: /freebsd/sys/dev/ath/if_ath.c (revision e0c27215058b5786c78fcfb3963eebe61a989511)
1 /*-
2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer,
10  *    without modification.
11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
13  *    redistribution must be conditioned upon including a substantially
14  *    similar Disclaimer requirement for further binary redistribution.
15  * 3. Neither the names of the above-listed copyright holders nor the names
16  *    of any contributors may be used to endorse or promote products derived
17  *    from this software without specific prior written permission.
18  *
19  * Alternatively, this software may be distributed under the terms of the
20  * GNU General Public License ("GPL") version 2 as published by the Free
21  * Software Foundation.
22  *
23  * NO WARRANTY
24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
34  * THE POSSIBILITY OF SUCH DAMAGES.
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 /*
41  * Driver for the Atheros Wireless LAN controller.
42  *
43  * This software is derived from work of Atsushi Onoe; his contribution
44  * is greatly appreciated.
45  */
46 
47 #include "opt_inet.h"
48 
49 #include <sys/param.h>
50 #include <sys/systm.h>
51 #include <sys/sysctl.h>
52 #include <sys/mbuf.h>
53 #include <sys/malloc.h>
54 #include <sys/lock.h>
55 #include <sys/mutex.h>
56 #include <sys/kernel.h>
57 #include <sys/socket.h>
58 #include <sys/sockio.h>
59 #include <sys/errno.h>
60 #include <sys/callout.h>
61 #include <sys/bus.h>
62 #include <sys/endian.h>
63 
64 #include <machine/bus.h>
65 
66 #include <net/if.h>
67 #include <net/if_dl.h>
68 #include <net/if_media.h>
69 #include <net/if_arp.h>
70 #include <net/ethernet.h>
71 #include <net/if_llc.h>
72 
73 #include <net80211/ieee80211.h>
74 #include <net80211/ieee80211_crypto.h>
75 #include <net80211/ieee80211_node.h>
76 #include <net80211/ieee80211_proto.h>
77 #include <net80211/ieee80211_var.h>
78 
79 #include <net/bpf.h>
80 
81 #ifdef INET
82 #include <netinet/in.h>
83 #include <netinet/if_ether.h>
84 #endif
85 
86 #define	AR_DEBUG
87 #include <dev/ath/if_athvar.h>
88 #include <contrib/dev/ath/ah_desc.h>
89 
90 /* unalligned little endian access */
91 #define LE_READ_2(p)							\
92 	((u_int16_t)							\
93 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
94 #define LE_READ_4(p)							\
95 	((u_int32_t)							\
96 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
97 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
98 
99 static void	ath_init(void *);
100 static void	ath_stop(struct ifnet *);
101 static void	ath_start(struct ifnet *);
102 static void	ath_reset(struct ath_softc *);
103 static int	ath_media_change(struct ifnet *);
104 static void	ath_watchdog(struct ifnet *);
105 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
106 static void	ath_fatal_proc(void *, int);
107 static void	ath_rxorn_proc(void *, int);
108 static void	ath_bmiss_proc(void *, int);
109 static void	ath_initkeytable(struct ath_softc *);
110 static void	ath_mode_init(struct ath_softc *);
111 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
112 static void	ath_beacon_proc(void *, int);
113 static void	ath_beacon_free(struct ath_softc *);
114 static void	ath_beacon_config(struct ath_softc *);
115 static int	ath_desc_alloc(struct ath_softc *);
116 static void	ath_desc_free(struct ath_softc *);
117 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
118 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
119 static void	ath_node_copy(struct ieee80211com *,
120 			struct ieee80211_node *, const struct ieee80211_node *);
121 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
122 static void	ath_rx_proc(void *, int);
123 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
124 			     struct ath_buf *, struct mbuf *);
125 static void	ath_tx_proc(void *, int);
126 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
127 static void	ath_draintxq(struct ath_softc *);
128 static void	ath_stoprecv(struct ath_softc *);
129 static int	ath_startrecv(struct ath_softc *);
130 static void	ath_next_scan(void *);
131 static void	ath_calibrate(void *);
132 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
133 static void	ath_newassoc(struct ieee80211com *,
134 			struct ieee80211_node *, int);
135 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
136 
137 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
138 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
139 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
140 static void	ath_rate_ctl(void *, struct ieee80211_node *);
141 
142 SYSCTL_DECL(_hw_ath);
143 
144 /* XXX validate sysctl values */
145 static	int ath_dwelltime = 200;		/* 5 channels/second */
146 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
147 	    0, "channel dwell time (ms) for AP/station scanning");
148 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
149 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
150 	    0, "chip calibration interval (secs)");
151 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
152 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
153 	    0, "enable/disable outdoor operation");
154 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
155 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
156 	    0, "country code");
157 static	int ath_regdomain = 0;			/* regulatory domain */
158 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
159 	    0, "regulatory domain");
160 
161 static	int ath_bmisshack = 1;
162 SYSCTL_INT(_hw_ath, OID_AUTO, bmisshack, CTLFLAG_RW, &ath_bmisshack,
163 	    0, "enable/disable hack to discard bmiss interrupts");
164 
165 #ifdef AR_DEBUG
166 int	ath_debug = 0;
167 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
168 	    0, "control debugging printfs");
169 #define	IFF_DUMPPKTS(_ifp) \
170 	(ath_debug || \
171 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
172 static	void ath_printrxbuf(struct ath_buf *bf, int);
173 static	void ath_printtxbuf(struct ath_buf *bf, int);
174 #define	DPRINTF(X)	if (ath_debug) printf X
175 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
176 #else
177 #define	IFF_DUMPPKTS(_ifp) \
178 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
179 #define	DPRINTF(X)
180 #define	DPRINTF2(X)
181 #endif
182 
183 int
184 ath_attach(u_int16_t devid, struct ath_softc *sc)
185 {
186 	struct ieee80211com *ic = &sc->sc_ic;
187 	struct ifnet *ifp = &ic->ic_if;
188 	struct ath_hal *ah;
189 	HAL_STATUS status;
190 	int error = 0;
191 
192 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
193 
194 	/* set these up early for if_printf use */
195 	ifp->if_unit = device_get_unit(sc->sc_dev);
196 	ifp->if_name = "ath";
197 
198 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
199 	if (ah == NULL) {
200 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
201 			status);
202 		error = ENXIO;
203 		goto bad;
204 	}
205 	sc->sc_ah = ah;
206 
207 	/*
208 	 * Collect the channel list using the default country
209 	 * code and including outdoor channels.  The 802.11 layer
210 	 * is resposible for filtering this list based on settings
211 	 * like the phy mode.
212 	 */
213 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
214 	if (error != 0)
215 		goto bad;
216 	/*
217 	 * Copy these back; they are set as a side effect
218 	 * of constructing the channel list.
219 	 */
220 	ath_regdomain = ath_hal_getregdomain(ah);
221 	ath_countrycode = ath_hal_getcountrycode(ah);
222 
223 	/*
224 	 * Setup rate tables for all potential media types.
225 	 */
226 	ath_rate_setup(sc, IEEE80211_MODE_11A);
227 	ath_rate_setup(sc, IEEE80211_MODE_11B);
228 	ath_rate_setup(sc, IEEE80211_MODE_11G);
229 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
230 
231 	error = ath_desc_alloc(sc);
232 	if (error != 0) {
233 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
234 		goto bad;
235 	}
236 	callout_init(&sc->sc_scan_ch, 0);
237 	callout_init(&sc->sc_cal_ch, 0);
238 
239 	mtx_init(&sc->sc_txbuflock,
240 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
241 	mtx_init(&sc->sc_txqlock,
242 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
243 
244 	TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
245 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
246 	TASK_INIT(&sc->sc_swbatask, 0, ath_beacon_proc, sc);
247 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
248 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
249 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
250 
251 	/*
252 	 * For now just pre-allocate one data queue and one
253 	 * beacon queue.  Note that the HAL handles resetting
254 	 * them at the needed time.  Eventually we'll want to
255 	 * allocate more tx queues for splitting management
256 	 * frames and for QOS support.
257 	 */
258 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
259 		HAL_TX_QUEUE_DATA,
260 		AH_TRUE			/* enable interrupts */
261 	);
262 	if (sc->sc_txhalq == (u_int) -1) {
263 		if_printf(ifp, "unable to setup a data xmit queue!\n");
264 		goto bad;
265 	}
266 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
267 		HAL_TX_QUEUE_BEACON,
268 		AH_TRUE			/* enable interrupts */
269 	);
270 	if (sc->sc_bhalq == (u_int) -1) {
271 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
272 		goto bad;
273 	}
274 
275 	ifp->if_softc = sc;
276 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
277 	ifp->if_start = ath_start;
278 	ifp->if_watchdog = ath_watchdog;
279 	ifp->if_ioctl = ath_ioctl;
280 	ifp->if_init = ath_init;
281 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
282 
283 	ic->ic_softc = sc;
284 	ic->ic_newassoc = ath_newassoc;
285 	/* XXX not right but it's not used anywhere important */
286 	ic->ic_phytype = IEEE80211_T_OFDM;
287 	ic->ic_opmode = IEEE80211_M_STA;
288 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP;
289 	/* NB: 11g support is identified when we fetch the channel set */
290 	if (sc->sc_have11g)
291 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
292 
293 	/* get mac address from hardware */
294 	ath_hal_getmac(ah, ic->ic_myaddr);
295 
296 	/* call MI attach routine. */
297 	ieee80211_ifattach(ifp);
298 	/* override default methods */
299 	ic->ic_node_alloc = ath_node_alloc;
300 	ic->ic_node_free = ath_node_free;
301 	ic->ic_node_copy = ath_node_copy;
302 	sc->sc_newstate = ic->ic_newstate;
303 	ic->ic_newstate = ath_newstate;
304 	/* complete initialization */
305 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
306 
307 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
308 
309 	return 0;
310 bad:
311 	if (ah)
312 		ath_hal_detach(ah);
313 	sc->sc_invalid = 1;
314 	return error;
315 }
316 
317 int
318 ath_detach(struct ath_softc *sc)
319 {
320 	struct ifnet *ifp = &sc->sc_ic.ic_if;
321 
322 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
323 
324 	mtx_lock(&sc->sc_mtx);
325 	ath_stop(ifp);
326 	ath_desc_free(sc);
327 	ath_hal_detach(sc->sc_ah);
328 	ieee80211_ifdetach(ifp);
329 	mtx_unlock(&sc->sc_mtx);
330 	return 0;
331 }
332 
333 void
334 ath_suspend(struct ath_softc *sc)
335 {
336 	struct ifnet *ifp = &sc->sc_ic.ic_if;
337 
338 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
339 
340 	ath_stop(ifp);
341 }
342 
343 void
344 ath_resume(struct ath_softc *sc)
345 {
346 	struct ifnet *ifp = &sc->sc_ic.ic_if;
347 
348 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
349 
350 	ath_init(ifp);
351 	if (ifp->if_flags & IFF_UP)
352 		ath_start(ifp);
353 }
354 
355 void
356 ath_shutdown(struct ath_softc *sc)
357 {
358 	struct ifnet *ifp = &sc->sc_ic.ic_if;
359 
360 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
361 
362 	ath_stop(ifp);
363 }
364 
365 void
366 ath_intr(void *arg)
367 {
368 	struct ath_softc *sc = arg;
369 	struct ieee80211com *ic = &sc->sc_ic;
370 	struct ifnet *ifp = &ic->ic_if;
371 	struct ath_hal *ah = sc->sc_ah;
372 	HAL_INT status;
373 
374 	if (sc->sc_invalid) {
375 		/*
376 		 * The hardware is gone, don't touch anything.
377 		 * XXX can this happen?
378 		 */
379 		DPRINTF(("ath_intr: invalid; ignored\n"));
380 		return;
381 	}
382 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
383 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
384 		ath_hal_getisr(ah, &status);	/* clear ISR */
385 		ath_hal_intrset(ah, 0);		/* disable further intr's */
386 		return;
387 	}
388 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
389 	DPRINTF2(("ath_intr: status 0x%x\n", status));
390 if (ath_bmisshack) status &= ~HAL_INT_BMISS; /*XXX*/
391 #ifdef AR_DEBUG
392 	if (ath_debug &&
393 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
394 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
395 		ath_hal_dumpstate(ah);
396 	}
397 #endif /* AR_DEBUG */
398 	if (status & HAL_INT_FATAL) {
399 		sc->sc_stats.ast_hardware++;
400 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
401 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
402 	} else if (status & HAL_INT_RXORN) {
403 		sc->sc_stats.ast_rxorn++;
404 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
405 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
406 	} else {
407 		if (status & HAL_INT_RXEOL) {
408 			/*
409 			 * NB: the hardware should re-read the link when
410 			 *     RXE bit is written, but it doesn't work at
411 			 *     least on older hardware revs.
412 			 */
413 			sc->sc_stats.ast_rxeol++;
414 			sc->sc_rxlink = NULL;
415 		}
416 		if (status & HAL_INT_TXURN) {
417 			sc->sc_stats.ast_txurn++;
418 			/* bump tx trigger level */
419 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
420 		}
421 		if (status & HAL_INT_RX)
422 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
423 		if (status & HAL_INT_TX)
424 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
425 		if (status & HAL_INT_SWBA)
426 			taskqueue_enqueue(taskqueue_swi, &sc->sc_swbatask);
427 		if (status & HAL_INT_BMISS) {
428 			sc->sc_stats.ast_bmiss++;
429 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
430 		}
431 	}
432 }
433 
434 static void
435 ath_fatal_proc(void *arg, int pending)
436 {
437 	struct ath_softc *sc = arg;
438 
439 	device_printf(sc->sc_dev, "hardware error; resetting\n");
440 	ath_reset(sc);
441 }
442 
443 static void
444 ath_rxorn_proc(void *arg, int pending)
445 {
446 	struct ath_softc *sc = arg;
447 
448 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
449 	ath_reset(sc);
450 }
451 
452 static void
453 ath_bmiss_proc(void *arg, int pending)
454 {
455 	struct ath_softc *sc = arg;
456 	struct ieee80211com *ic = &sc->sc_ic;
457 
458 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
459 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
460 		("unexpect operating mode %u", ic->ic_opmode));
461 	if (ic->ic_state == IEEE80211_S_RUN)
462 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
463 }
464 
465 static u_int
466 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
467 {
468 	static const u_int modeflags[] = {
469 		0,			/* IEEE80211_MODE_AUTO */
470 		CHANNEL_A,		/* IEEE80211_MODE_11A */
471 		CHANNEL_B,		/* IEEE80211_MODE_11B */
472 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
473 		CHANNEL_T		/* IEEE80211_MODE_TURBO */
474 	};
475 	return modeflags[ieee80211_chan2mode(ic, chan)];
476 }
477 
478 static void
479 ath_init(void *arg)
480 {
481 	struct ath_softc *sc = (struct ath_softc *) arg;
482 	struct ieee80211com *ic = &sc->sc_ic;
483 	struct ifnet *ifp = &ic->ic_if;
484 	struct ieee80211_node *ni;
485 	enum ieee80211_phymode mode;
486 	struct ath_hal *ah = sc->sc_ah;
487 	HAL_STATUS status;
488 	HAL_CHANNEL hchan;
489 
490 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
491 
492 	mtx_lock(&sc->sc_mtx);
493 	/*
494 	 * Stop anything previously setup.  This is safe
495 	 * whether this is the first time through or not.
496 	 */
497 	ath_stop(ifp);
498 
499 	/*
500 	 * The basic interface to setting the hardware in a good
501 	 * state is ``reset''.  On return the hardware is known to
502 	 * be powered up and with interrupts disabled.  This must
503 	 * be followed by initialization of the appropriate bits
504 	 * and then setup of the interrupt mask.
505 	 */
506 	hchan.channel = ic->ic_ibss_chan->ic_freq;
507 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
508 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
509 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
510 			status);
511 		goto done;
512 	}
513 
514 	/*
515 	 * Setup the hardware after reset: the key cache
516 	 * is filled as needed and the receive engine is
517 	 * set going.  Frame transmit is handled entirely
518 	 * in the frame output path; there's nothing to do
519 	 * here except setup the interrupt mask.
520 	 */
521 	if (ic->ic_flags & IEEE80211_F_WEPON)
522 		ath_initkeytable(sc);
523 	if (ath_startrecv(sc) != 0) {
524 		if_printf(ifp, "unable to start recv logic\n");
525 		goto done;
526 	}
527 
528 	/*
529 	 * Enable interrupts.
530 	 */
531 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
532 		  | HAL_INT_RXEOL | HAL_INT_RXORN
533 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
534 	ath_hal_intrset(ah, sc->sc_imask);
535 
536 	ifp->if_flags |= IFF_RUNNING;
537 	ic->ic_state = IEEE80211_S_INIT;
538 
539 	/*
540 	 * The hardware should be ready to go now so it's safe
541 	 * to kick the 802.11 state machine as it's likely to
542 	 * immediately call back to us to send mgmt frames.
543 	 */
544 	ni = ic->ic_bss;
545 	ni->ni_chan = ic->ic_ibss_chan;
546 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
547 	if (mode != sc->sc_curmode)
548 		ath_setcurmode(sc, mode);
549 	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
550 done:
551 	mtx_unlock(&sc->sc_mtx);
552 }
553 
554 static void
555 ath_stop(struct ifnet *ifp)
556 {
557 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
558 	struct ath_softc *sc = ifp->if_softc;
559 	struct ath_hal *ah = sc->sc_ah;
560 
561 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
562 		sc->sc_invalid, ifp->if_flags));
563 
564 	mtx_lock(&sc->sc_mtx);
565 	if (ifp->if_flags & IFF_RUNNING) {
566 		/*
567 		 * Shutdown the hardware and driver:
568 		 *    disable interrupts
569 		 *    turn off timers
570 		 *    clear transmit machinery
571 		 *    clear receive machinery
572 		 *    drain and release tx queues
573 		 *    reclaim beacon resources
574 		 *    reset 802.11 state machine
575 		 *    power down hardware
576 		 *
577 		 * Note that some of this work is not possible if the
578 		 * hardware is gone (invalid).
579 		 */
580 		ifp->if_flags &= ~IFF_RUNNING;
581 		ifp->if_timer = 0;
582 		if (!sc->sc_invalid)
583 			ath_hal_intrset(ah, 0);
584 		ath_draintxq(sc);
585 		if (!sc->sc_invalid)
586 			ath_stoprecv(sc);
587 		else
588 			sc->sc_rxlink = NULL;
589 		IF_DRAIN(&ifp->if_snd);
590 		ath_beacon_free(sc);
591 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
592 		if (!sc->sc_invalid)
593 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
594 	}
595 	mtx_unlock(&sc->sc_mtx);
596 }
597 
598 /*
599  * Reset the hardware w/o losing operational state.  This is
600  * basically a more efficient way of doing ath_stop, ath_init,
601  * followed by state transitions to the current 802.11
602  * operational state.  Used to recover from errors rx overrun
603  * and to reset the hardware when rf gain settings must be reset.
604  */
605 static void
606 ath_reset(struct ath_softc *sc)
607 {
608 	struct ieee80211com *ic = &sc->sc_ic;
609 	struct ifnet *ifp = &ic->ic_if;
610 	struct ath_hal *ah = sc->sc_ah;
611 	struct ieee80211_channel *c;
612 	HAL_STATUS status;
613 	HAL_CHANNEL hchan;
614 
615 	/*
616 	 * Convert to a HAL channel description with the flags
617 	 * constrained to reflect the current operating mode.
618 	 */
619 	c = ic->ic_ibss_chan;
620 	hchan.channel = c->ic_freq;
621 	hchan.channelFlags = ath_chan2flags(ic, c);
622 
623 	ath_hal_intrset(ah, 0);		/* disable interrupts */
624 	ath_draintxq(sc);		/* stop xmit side */
625 	ath_stoprecv(sc);		/* stop recv side */
626 	/* NB: indicate channel change so we do a full reset */
627 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
628 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
629 			__func__, status);
630 	ath_hal_intrset(ah, sc->sc_imask);
631 	if (ath_startrecv(sc) != 0)	/* restart recv */
632 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
633 	ath_start(ifp);			/* restart xmit */
634 	if (ic->ic_state == IEEE80211_S_RUN)
635 		ath_beacon_config(sc);	/* restart beacons */
636 }
637 
638 static void
639 ath_start(struct ifnet *ifp)
640 {
641 	struct ath_softc *sc = ifp->if_softc;
642 	struct ath_hal *ah = sc->sc_ah;
643 	struct ieee80211com *ic = &sc->sc_ic;
644 	struct ieee80211_node *ni;
645 	struct ath_buf *bf;
646 	struct mbuf *m;
647 	struct ieee80211_frame *wh;
648 
649 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
650 		return;
651 	for (;;) {
652 		/*
653 		 * Grab a TX buffer and associated resources.
654 		 */
655 		mtx_lock(&sc->sc_txbuflock);
656 		bf = TAILQ_FIRST(&sc->sc_txbuf);
657 		if (bf != NULL)
658 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
659 		mtx_unlock(&sc->sc_txbuflock);
660 		if (bf == NULL) {
661 			DPRINTF(("ath_start: out of xmit buffers\n"));
662 			sc->sc_stats.ast_tx_qstop++;
663 			ifp->if_flags |= IFF_OACTIVE;
664 			break;
665 		}
666 		/*
667 		 * Poll the management queue for frames; they
668 		 * have priority over normal data frames.
669 		 */
670 		IF_DEQUEUE(&ic->ic_mgtq, m);
671 		if (m == NULL) {
672 			/*
673 			 * No data frames go out unless we're associated.
674 			 */
675 			if (ic->ic_state != IEEE80211_S_RUN) {
676 				DPRINTF(("ath_start: ignore data packet, "
677 					"state %u\n", ic->ic_state));
678 				sc->sc_stats.ast_tx_discard++;
679 				mtx_lock(&sc->sc_txbuflock);
680 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
681 				mtx_unlock(&sc->sc_txbuflock);
682 				break;
683 			}
684 			IF_DEQUEUE(&ifp->if_snd, m);
685 			if (m == NULL) {
686 				mtx_lock(&sc->sc_txbuflock);
687 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
688 				mtx_unlock(&sc->sc_txbuflock);
689 				break;
690 			}
691 			ifp->if_opackets++;
692 			BPF_MTAP(ifp, m);
693 			/*
694 			 * Encapsulate the packet in prep for transmission.
695 			 */
696 			m = ieee80211_encap(ifp, m);
697 			if (m == NULL) {
698 				DPRINTF(("ath_start: encapsulation failure\n"));
699 				sc->sc_stats.ast_tx_encap++;
700 				goto bad;
701 			}
702 			wh = mtod(m, struct ieee80211_frame *);
703 			if (ic->ic_flags & IEEE80211_F_WEPON)
704 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
705 		} else {
706 			wh = mtod(m, struct ieee80211_frame *);
707 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
708 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
709 				/* fill time stamp */
710 				u_int64_t tsf;
711 				u_int32_t *tstamp;
712 
713 				tsf = ath_hal_gettsf64(ah);
714 				/* XXX: adjust 100us delay to xmit */
715 				tsf += 100;
716 				tstamp = (u_int32_t *)&wh[1];
717 				tstamp[0] = htole32(tsf & 0xffffffff);
718 				tstamp[1] = htole32(tsf >> 32);
719 			}
720 			sc->sc_stats.ast_tx_mgmt++;
721 		}
722 		if (ic->ic_rawbpf)
723 			bpf_mtap(ic->ic_rawbpf, m);
724 
725 		if (ic->ic_opmode != IEEE80211_M_STA) {
726 			ni = ieee80211_find_node(ic, wh->i_addr1);
727 			if (ni == NULL) {
728 				/*
729 				 * When not in station mode the destination
730 				 * address should always be in the node table
731 				 * unless this is a multicast/broadcast frame.
732 				 */
733 				if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
734 				    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
735 				    IEEE80211_FC0_TYPE_DATA) {
736 					m_freem(m);
737 					sc->sc_stats.ast_tx_nonode++;
738 					goto bad;
739 				}
740 				ni = ic->ic_bss;
741 			}
742 		} else
743 			ni = ic->ic_bss;
744 
745 		/*
746 		 * TODO:
747 		 * The duration field of 802.11 header should be filled.
748 		 * XXX This may be done in the ieee80211 layer, but the upper
749 		 *     doesn't know the detail of parameters such as IFS
750 		 *     for now..
751 		 */
752 
753 		if (IFF_DUMPPKTS(ifp))
754 			ieee80211_dump_pkt(mtod(m, u_int8_t *), m->m_len,
755 			    ni->ni_rates.rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL,
756 			    -1);
757 
758 		if (ath_tx_start(sc, ni, bf, m)) {
759 	bad:
760 			mtx_lock(&sc->sc_txbuflock);
761 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
762 			mtx_unlock(&sc->sc_txbuflock);
763 			ifp->if_oerrors++;
764 			continue;
765 		}
766 
767 		sc->sc_tx_timer = 5;
768 		ifp->if_timer = 1;
769 	}
770 }
771 
772 static int
773 ath_media_change(struct ifnet *ifp)
774 {
775 	int error;
776 
777 	error = ieee80211_media_change(ifp);
778 	if (error == ENETRESET) {
779 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
780 		    (IFF_RUNNING|IFF_UP))
781 			ath_init(ifp);		/* XXX lose error */
782 		error = 0;
783 	}
784 	return error;
785 }
786 
787 static void
788 ath_watchdog(struct ifnet *ifp)
789 {
790 	struct ath_softc *sc = ifp->if_softc;
791 	struct ieee80211com *ic = &sc->sc_ic;
792 
793 	ifp->if_timer = 0;
794 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
795 		return;
796 	if (sc->sc_tx_timer) {
797 		if (--sc->sc_tx_timer == 0) {
798 			if_printf(ifp, "device timeout\n");
799 #ifdef AR_DEBUG
800 			if (ath_debug)
801 				ath_hal_dumpstate(sc->sc_ah);
802 #endif /* AR_DEBUG */
803 			ath_init(ifp);		/* XXX ath_reset??? */
804 			ifp->if_oerrors++;
805 			sc->sc_stats.ast_watchdog++;
806 			return;
807 		}
808 		ifp->if_timer = 1;
809 	}
810 	if (ic->ic_fixed_rate == -1) {
811 		/*
812 		 * Run the rate control algorithm if we're not
813 		 * locked at a fixed rate.
814 		 */
815 		if (ic->ic_opmode == IEEE80211_M_STA)
816 			ath_rate_ctl(sc, ic->ic_bss);
817 		else
818 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
819 	}
820 	ieee80211_watchdog(ifp);
821 }
822 
823 static int
824 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
825 {
826 	struct ath_softc *sc = ifp->if_softc;
827 	struct ifreq *ifr = (struct ifreq *)data;
828 	int error = 0;
829 
830 	mtx_lock(&sc->sc_mtx);
831 	switch (cmd) {
832 	case SIOCSIFFLAGS:
833 		if (ifp->if_flags & IFF_UP) {
834 			if (ifp->if_flags & IFF_RUNNING) {
835 				/*
836 				 * To avoid rescanning another access point,
837 				 * do not call ath_init() here.  Instead,
838 				 * only reflect promisc mode settings.
839 				 */
840 				ath_mode_init(sc);
841 			} else
842 				ath_init(ifp);		/* XXX lose error */
843 		} else
844 			ath_stop(ifp);
845 		break;
846 	case SIOCADDMULTI:
847 	case SIOCDELMULTI:
848 		/*
849 		 * The upper layer has already installed/removed
850 		 * the multicast address(es), just recalculate the
851 		 * multicast filter for the card.
852 		 */
853 		if (ifp->if_flags & IFF_RUNNING)
854 			ath_mode_init(sc);
855 		break;
856 	case SIOCGATHSTATS:
857 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
858 		break;
859 	default:
860 		error = ieee80211_ioctl(ifp, cmd, data);
861 		if (error == ENETRESET) {
862 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
863 			    (IFF_RUNNING|IFF_UP))
864 				ath_init(ifp);		/* XXX lose error */
865 			error = 0;
866 		}
867 		break;
868 	}
869 	mtx_unlock(&sc->sc_mtx);
870 	return error;
871 }
872 
873 /*
874  * Fill the hardware key cache with key entries.
875  */
876 static void
877 ath_initkeytable(struct ath_softc *sc)
878 {
879 	struct ieee80211com *ic = &sc->sc_ic;
880 	struct ath_hal *ah = sc->sc_ah;
881 	int i;
882 
883 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
884 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
885 		if (k->wk_len == 0)
886 			ath_hal_keyreset(ah, i);
887 		else
888 			/* XXX return value */
889 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
890 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
891 	}
892 }
893 
894 static void
895 ath_mode_init(struct ath_softc *sc)
896 {
897 	struct ieee80211com *ic = &sc->sc_ic;
898 	struct ath_hal *ah = sc->sc_ah;
899 	struct ifnet *ifp = &ic->ic_if;
900 	u_int32_t rfilt, mfilt[2], val;
901 	u_int8_t pos;
902 	struct ifmultiaddr *ifma;
903 
904 	/* configure operational mode */
905 	ath_hal_setopmode(ah, ic->ic_opmode);
906 
907 	/* receive filter */
908 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
909 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
910 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
911 	    (ifp->if_flags & IFF_PROMISC))
912 		rfilt |= HAL_RX_FILTER_PROM;
913 	if (ic->ic_state == IEEE80211_S_SCAN)
914 		rfilt |= HAL_RX_FILTER_BEACON;
915 	ath_hal_setrxfilter(ah, rfilt);
916 
917 	/* calculate and install multicast filter */
918 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
919 		mfilt[0] = mfilt[1] = 0;
920 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
921 			caddr_t dl;
922 
923 			/* calculate XOR of eight 6bit values */
924 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
925 			val = LE_READ_4(dl + 0);
926 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
927 			val = LE_READ_4(dl + 3);
928 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
929 			pos &= 0x3f;
930 			mfilt[pos / 32] |= (1 << (pos % 32));
931 		}
932 	} else {
933 		mfilt[0] = mfilt[1] = ~0;
934 	}
935 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
936 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
937 		rfilt, mfilt[0], mfilt[1]));
938 }
939 
940 static void
941 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
942 {
943 	struct ath_buf *bf = arg;
944 
945 	KASSERT(nseg <= ATH_MAX_SCATTER,
946 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
947 	bf->bf_mapsize = mapsize;
948 	bf->bf_nseg = nseg;
949 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
950 }
951 
952 static int
953 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
954 {
955 	struct ieee80211com *ic = &sc->sc_ic;
956 	struct ifnet *ifp = &ic->ic_if;
957 	struct ath_hal *ah = sc->sc_ah;
958 	struct ieee80211_frame *wh;
959 	struct ath_buf *bf;
960 	struct ath_desc *ds;
961 	struct mbuf *m;
962 	int error, pktlen;
963 	u_int8_t *frm, rate;
964 	u_int16_t capinfo;
965 	struct ieee80211_rateset *rs;
966 	const HAL_RATE_TABLE *rt;
967 
968 	bf = sc->sc_bcbuf;
969 	if (bf->bf_m != NULL) {
970 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
971 		m_freem(bf->bf_m);
972 		bf->bf_m = NULL;
973 		bf->bf_node = NULL;
974 	}
975 	/*
976 	 * NB: the beacon data buffer must be 32-bit aligned;
977 	 * we assume the mbuf routines will return us something
978 	 * with this alignment (perhaps should assert).
979 	 */
980 	rs = &ni->ni_rates;
981 	pktlen = 8 + 2 + 2+ 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
982 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
983 		pktlen += 2;
984 	if (pktlen <= MHLEN)
985 		MGETHDR(m, M_DONTWAIT, MT_DATA);
986 	else
987 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
988 	if (m == NULL) {
989 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
990 			pktlen));
991 		sc->sc_stats.ast_be_nombuf++;
992 		return ENOMEM;
993 	}
994 
995 	wh = mtod(m, struct ieee80211_frame *);
996 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
997 	    IEEE80211_FC0_SUBTYPE_BEACON;
998 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
999 	*(u_int16_t *)wh->i_dur = 0;
1000 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
1001 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1002 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
1003 	*(u_int16_t *)wh->i_seq = 0;
1004 
1005 	/*
1006 	 * beacon frame format
1007 	 *	[8] time stamp
1008 	 *	[2] beacon interval
1009 	 *	[2] cabability information
1010 	 *	[tlv] ssid
1011 	 *	[tlv] supported rates
1012 	 *	[tlv] parameter set (IBSS)
1013 	 *	[tlv] extended supported rates
1014 	 */
1015 	frm = (u_int8_t *)&wh[1];
1016 	memset(frm, 0, 8);	/* timestamp is set by hardware */
1017 	frm += 8;
1018 	*(u_int16_t *)frm = htole16(ni->ni_intval);
1019 	frm += 2;
1020 	if (ic->ic_opmode == IEEE80211_M_IBSS)
1021 		capinfo = IEEE80211_CAPINFO_IBSS;
1022 	else
1023 		capinfo = IEEE80211_CAPINFO_ESS;
1024 	if (ic->ic_flags & IEEE80211_F_WEPON)
1025 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
1026 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1027 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
1028 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1029 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
1030 	*(u_int16_t *)frm = htole16(capinfo);
1031 	frm += 2;
1032 	*frm++ = IEEE80211_ELEMID_SSID;
1033 	*frm++ = ni->ni_esslen;
1034 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
1035 	frm += ni->ni_esslen;
1036 	frm = ieee80211_add_rates(frm, rs);
1037 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
1038 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
1039 		*frm++ = 2;
1040 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
1041 	} else {
1042 		/* TODO: TIM */
1043 		*frm++ = IEEE80211_ELEMID_TIM;
1044 		*frm++ = 4;	/* length */
1045 		*frm++ = 0;	/* DTIM count */
1046 		*frm++ = 1;	/* DTIM period */
1047 		*frm++ = 0;	/* bitmap control */
1048 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
1049 	}
1050 	frm = ieee80211_add_xrates(frm, rs);
1051 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
1052 
1053 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
1054 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1055 				     ath_mbuf_load_cb, bf,
1056 				     BUS_DMA_NOWAIT);
1057 	if (error != 0) {
1058 		m_freem(m);
1059 		return error;
1060 	}
1061 	KASSERT(bf->bf_nseg == 1,
1062 		("ath_beacon_alloc: multi-segment packet; nseg %u",
1063 		bf->bf_nseg));
1064 	bf->bf_m = m;
1065 
1066 	/* setup descriptors */
1067 	ds = bf->bf_desc;
1068 
1069 	ds->ds_link = 0;
1070 	ds->ds_data = bf->bf_segs[0].ds_addr;
1071 	/* XXX verify mbuf data area covers this roundup */
1072 	/*
1073 	 * Calculate rate code.
1074 	 * XXX everything at min xmit rate
1075 	 */
1076 	rt = sc->sc_currates;
1077 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1078 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) == 0)
1079 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
1080 	else
1081 		rate = rt->info[0].rateCode;
1082 	ath_hal_setuptxdesc(ah, ds
1083 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
1084 		, sizeof(struct ieee80211_frame)	/* header length */
1085 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
1086 		, 0x20				/* txpower XXX */
1087 		, rate, 1			/* series 0 rate/tries */
1088 		, HAL_TXKEYIX_INVALID		/* no encryption */
1089 		, 0				/* antenna mode */
1090 		, HAL_TXDESC_NOACK		/* no ack for beacons */
1091 		, 0				/* rts/cts rate */
1092 		, 0				/* rts/cts duration */
1093 	);
1094 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
1095 	ath_hal_filltxdesc(ah, ds
1096 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
1097 		, AH_TRUE				/* first segment */
1098 		, AH_TRUE				/* last segment */
1099 	);
1100 
1101 	return 0;
1102 }
1103 
1104 static void
1105 ath_beacon_proc(void *arg, int pending)
1106 {
1107 	struct ath_softc *sc = arg;
1108 	struct ieee80211com *ic = &sc->sc_ic;
1109 	struct ath_buf *bf = sc->sc_bcbuf;
1110 	struct ath_hal *ah = sc->sc_ah;
1111 
1112 	DPRINTF2(("%s: pending %u\n", __func__, pending));
1113 	if (ic->ic_opmode == IEEE80211_M_STA || bf == NULL || bf->bf_m == NULL) {
1114 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
1115 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
1116 		return;
1117 	}
1118 	/* update beacon to reflect PS poll state */
1119 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
1120 		DPRINTF(("%s: beacon queue %u did not stop?",
1121 			__func__, sc->sc_bhalq));
1122 		return;			/* busy, XXX is this right? */
1123 	}
1124 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1125 
1126 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
1127 	ath_hal_txstart(ah, sc->sc_bhalq);
1128 	DPRINTF2(("%s: TXDP%u = %p (%p)\n", __func__,
1129 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1130 }
1131 
1132 static void
1133 ath_beacon_free(struct ath_softc *sc)
1134 {
1135 	struct ath_buf *bf = sc->sc_bcbuf;
1136 
1137 	if (bf->bf_m != NULL) {
1138 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1139 		m_freem(bf->bf_m);
1140 		bf->bf_m = NULL;
1141 		bf->bf_node = NULL;
1142 	}
1143 }
1144 
1145 /*
1146  * Configure the beacon and sleep timers.
1147  *
1148  * When operating as an AP this resets the TSF and sets
1149  * up the hardware to notify us when we need to issue beacons.
1150  *
1151  * When operating in station mode this sets up the beacon
1152  * timers according to the timestamp of the last received
1153  * beacon and the current TSF, configures PCF and DTIM
1154  * handling, programs the sleep registers so the hardware
1155  * will wakeup in time to receive beacons, and configures
1156  * the beacon miss handling so we'll receive a BMISS
1157  * interrupt when we stop seeing beacons from the AP
1158  * we've associated with.
1159  */
1160 static void
1161 ath_beacon_config(struct ath_softc *sc)
1162 {
1163 	struct ath_hal *ah = sc->sc_ah;
1164 	struct ieee80211com *ic = &sc->sc_ic;
1165 	struct ieee80211_node *ni = ic->ic_bss;
1166 	u_int32_t nexttbtt;
1167 
1168 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
1169 	    (LE_READ_4(ni->ni_tstamp) >> 10);
1170 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
1171 	nexttbtt += ni->ni_intval;
1172 	if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
1173 		HAL_BEACON_STATE bs;
1174 		u_int32_t bmisstime;
1175 
1176 		/* NB: no PCF support right now */
1177 		memset(&bs, 0, sizeof(bs));
1178 		bs.bs_intval = ni->ni_intval;
1179 		bs.bs_nexttbtt = nexttbtt;
1180 		bs.bs_dtimperiod = bs.bs_intval;
1181 		bs.bs_nextdtim = nexttbtt;
1182 		/*
1183 		 * Calculate the number of consecutive beacons to miss
1184 		 * before taking a BMISS interrupt.  The configuration
1185 		 * is specified in ms, so we need to convert that to
1186 		 * TU's and then calculate based on the beacon interval.
1187 		 * Note that we clamp the result to at most 10 beacons.
1188 		 */
1189 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
1190 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
1191 		if (bs.bs_bmissthreshold > 10)
1192 			bs.bs_bmissthreshold = 10;
1193 		else if (bs.bs_bmissthreshold <= 0)
1194 			bs.bs_bmissthreshold = 1;
1195 
1196 		/*
1197 		 * Calculate sleep duration.  The configuration is
1198 		 * given in ms.  We insure a multiple of the beacon
1199 		 * period is used.  Also, if the sleep duration is
1200 		 * greater than the DTIM period then it makes senses
1201 		 * to make it a multiple of that.
1202 		 *
1203 		 * XXX fixed at 100ms
1204 		 */
1205 		bs.bs_sleepduration =
1206 			roundup((100 * 1000) / 1024, bs.bs_intval);
1207 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
1208 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
1209 
1210 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
1211 			, __func__
1212 			, bs.bs_intval
1213 			, bs.bs_nexttbtt
1214 			, bs.bs_dtimperiod
1215 			, bs.bs_nextdtim
1216 			, bs.bs_bmissthreshold
1217 			, bs.bs_sleepduration
1218 		));
1219 		ath_hal_intrset(ah, 0);
1220 		/*
1221 		 * Reset our tsf so the hardware will update the
1222 		 * tsf register to reflect timestamps found in
1223 		 * received beacons.
1224 		 */
1225 		ath_hal_resettsf(ah);
1226 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
1227 		sc->sc_imask |= HAL_INT_BMISS;
1228 		ath_hal_intrset(ah, sc->sc_imask);
1229 	} else {
1230 		DPRINTF(("%s: intval %u nexttbtt %u\n",
1231 			__func__, ni->ni_intval, nexttbtt));
1232 		ath_hal_intrset(ah, 0);
1233 		ath_hal_beaconinit(ah, ic->ic_opmode,
1234 			nexttbtt, ni->ni_intval);
1235 		sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
1236 		ath_hal_intrset(ah, sc->sc_imask);
1237 	}
1238 }
1239 
1240 static void
1241 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
1242 {
1243 	bus_addr_t *paddr = (bus_addr_t*) arg;
1244 	*paddr = segs->ds_addr;
1245 }
1246 
1247 static int
1248 ath_desc_alloc(struct ath_softc *sc)
1249 {
1250 	int i, bsize, error;
1251 	struct ath_desc *ds;
1252 	struct ath_buf *bf;
1253 
1254 	/* allocate descriptors */
1255 	sc->sc_desc_len = sizeof(struct ath_desc) *
1256 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
1257 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1258 	if (error != 0)
1259 		return error;
1260 
1261 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
1262 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
1263 	if (error != 0)
1264 		goto fail0;
1265 
1266 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
1267 				sc->sc_desc, sc->sc_desc_len,
1268 				ath_load_cb, &sc->sc_desc_paddr,
1269 				BUS_DMA_NOWAIT);
1270 	if (error != 0)
1271 		goto fail1;
1272 
1273 	ds = sc->sc_desc;
1274 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
1275 	    ds, sc->sc_desc_len,
1276 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
1277 
1278 	/* allocate buffers */
1279 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
1280 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
1281 	if (bf == NULL)
1282 		goto fail2;
1283 	sc->sc_bufptr = bf;
1284 
1285 	TAILQ_INIT(&sc->sc_rxbuf);
1286 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
1287 		bf->bf_desc = ds;
1288 		bf->bf_daddr = sc->sc_desc_paddr +
1289 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1290 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1291 					  &bf->bf_dmamap);
1292 		if (error != 0)
1293 			break;
1294 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1295 	}
1296 
1297 	TAILQ_INIT(&sc->sc_txbuf);
1298 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
1299 		bf->bf_desc = ds;
1300 		bf->bf_daddr = sc->sc_desc_paddr +
1301 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
1302 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
1303 					  &bf->bf_dmamap);
1304 		if (error != 0)
1305 			break;
1306 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1307 	}
1308 	TAILQ_INIT(&sc->sc_txq);
1309 
1310 	/* beacon buffer */
1311 	bf->bf_desc = ds;
1312 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
1313 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
1314 	if (error != 0)
1315 		return error;
1316 	sc->sc_bcbuf = bf;
1317 	return 0;
1318 
1319 fail2:
1320 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1321 fail1:
1322 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1323 fail0:
1324 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1325 	sc->sc_ddmamap = NULL;
1326 	return error;
1327 }
1328 
1329 static void
1330 ath_desc_free(struct ath_softc *sc)
1331 {
1332 	struct ath_buf *bf;
1333 
1334 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
1335 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
1336 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
1337 
1338 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1339 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1340 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1341 		m_freem(bf->bf_m);
1342 	}
1343 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
1344 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1345 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
1346 		if (bf->bf_m) {
1347 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1348 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
1349 			m_freem(bf->bf_m);
1350 			bf->bf_m = NULL;
1351 		}
1352 	}
1353 	if (sc->sc_bcbuf != NULL) {
1354 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1355 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
1356 		sc->sc_bcbuf = NULL;
1357 	}
1358 
1359 	TAILQ_INIT(&sc->sc_rxbuf);
1360 	TAILQ_INIT(&sc->sc_txbuf);
1361 	TAILQ_INIT(&sc->sc_txq);
1362 	free(sc->sc_bufptr, M_DEVBUF);
1363 	sc->sc_bufptr = NULL;
1364 }
1365 
1366 static struct ieee80211_node *
1367 ath_node_alloc(struct ieee80211com *ic)
1368 {
1369 	struct ath_node *an =
1370 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1371 	return an ? &an->st_node : NULL;
1372 }
1373 
1374 static void
1375 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1376 {
1377         struct ath_softc *sc = ic->ic_if.if_softc;
1378 	struct ath_buf *bf;
1379 
1380 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
1381 		if (bf->bf_node == ni)
1382 			bf->bf_node = NULL;
1383 	}
1384 	free(ni, M_DEVBUF);
1385 }
1386 
1387 static void
1388 ath_node_copy(struct ieee80211com *ic,
1389 	struct ieee80211_node *dst, const struct ieee80211_node *src)
1390 {
1391 	*(struct ath_node *)dst = *(const struct ath_node *)src;
1392 }
1393 
1394 static int
1395 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1396 {
1397 	struct ath_hal *ah = sc->sc_ah;
1398 	int error;
1399 	struct mbuf *m;
1400 	struct ath_desc *ds;
1401 
1402 	m = bf->bf_m;
1403 	if (m == NULL) {
1404 		/*
1405 		 * NB: by assigning a page to the rx dma buffer we
1406 		 * implicitly satisfy the Atheros requirement that
1407 		 * this buffer be cache-line-aligned and sized to be
1408 		 * multiple of the cache line size.  Not doing this
1409 		 * causes weird stuff to happen (for the 5210 at least).
1410 		 */
1411 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1412 		if (m == NULL) {
1413 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
1414 			sc->sc_stats.ast_rx_nombuf++;
1415 			return ENOMEM;
1416 		}
1417 		bf->bf_m = m;
1418 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
1419 
1420 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
1421 					     ath_mbuf_load_cb, bf,
1422 					     BUS_DMA_NOWAIT);
1423 		if (error != 0) {
1424 			DPRINTF(("ath_rxbuf_init: bus_dmamap_load_mbuf failed;"
1425 				" error %d\n", error));
1426 			sc->sc_stats.ast_rx_busdma++;
1427 			return error;
1428 		}
1429 		KASSERT(bf->bf_nseg == 1,
1430 			("ath_rxbuf_init: multi-segment packet; nseg %u",
1431 			bf->bf_nseg));
1432 	}
1433 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
1434 
1435 	/* setup descriptors */
1436 	ds = bf->bf_desc;
1437 	ds->ds_link = 0;
1438 	ds->ds_data = bf->bf_segs[0].ds_addr;
1439 	ath_hal_setuprxdesc(ah, ds
1440 		, m->m_len		/* buffer size */
1441 		, 0
1442 	);
1443 
1444 	if (sc->sc_rxlink != NULL)
1445 		*sc->sc_rxlink = bf->bf_daddr;
1446 	sc->sc_rxlink = &ds->ds_link;
1447 	return 0;
1448 }
1449 
1450 static void
1451 ath_rx_proc(void *arg, int npending)
1452 {
1453 	struct ath_softc *sc = arg;
1454 	struct ath_buf *bf;
1455 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1456 	struct ath_hal *ah = sc->sc_ah;
1457 	struct ath_desc *ds;
1458 	struct mbuf *m;
1459 	struct ieee80211_frame *wh, whbuf;
1460 	int len;
1461 	u_int phyerr;
1462 	HAL_STATUS status;
1463 
1464 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
1465 	do {
1466 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
1467 		if (bf == NULL) {		/* NB: shouldn't happen */
1468 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
1469 			break;
1470 		}
1471 		m = bf->bf_m;
1472 		if (m == NULL) {		/* NB: shouldn't happen */
1473 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
1474 			continue;
1475 		}
1476 		ds = bf->bf_desc;
1477 		status = ath_hal_rxprocdesc(ah, ds);
1478 #ifdef AR_DEBUG
1479 		if (ath_debug > 1)
1480 			ath_printrxbuf(bf, status == HAL_OK);
1481 #endif
1482 		if (status == HAL_EINPROGRESS)
1483 			break;
1484 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
1485 		if (ds->ds_rxstat.rs_status != 0) {
1486 			ifp->if_ierrors++;
1487 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
1488 				sc->sc_stats.ast_rx_crcerr++;
1489 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
1490 				sc->sc_stats.ast_rx_fifoerr++;
1491 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
1492 				sc->sc_stats.ast_rx_badcrypt++;
1493 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
1494 				sc->sc_stats.ast_rx_phyerr++;
1495 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
1496 				sc->sc_stats.ast_rx_phy[phyerr]++;
1497 			}
1498 			goto rx_next;
1499 		}
1500 
1501 		len = ds->ds_rxstat.rs_datalen;
1502 		if (len < sizeof(struct ieee80211_frame)) {
1503 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
1504 			goto rx_next;
1505 		}
1506 
1507 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1508 		    BUS_DMASYNC_POSTREAD);
1509 
1510 		wh = mtod(m, struct ieee80211_frame *);
1511 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1512 		    IEEE80211_FC0_TYPE_CTL) {
1513 			/*
1514 			 * Ignore control frame received in promisc mode.
1515 			 */
1516 			DPRINTF(("ath_rx_proc: control frame\n"));
1517 			goto rx_next;
1518 		}
1519 
1520 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1521 		bf->bf_m = NULL;
1522 		m->m_pkthdr.rcvif = ifp;
1523 		m->m_pkthdr.len = m->m_len = len;
1524 		if (IFF_DUMPPKTS(ifp)) {
1525 			struct ieee80211com *ic = &sc->sc_ic;
1526 			const HAL_RATE_TABLE *rt = sc->sc_rates[ic->ic_curmode];
1527 			ieee80211_dump_pkt(mtod(m, u_int8_t *), len,
1528 				rt ? rt->info[rt->rateCodeToIndex[ds->ds_rxstat.rs_rate]].dot11Rate & IEEE80211_RATE_VAL : 0,
1529 				ds->ds_rxstat.rs_rssi);
1530 		}
1531 		m_adj(m, -IEEE80211_CRC_LEN);
1532 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1533 			/*
1534 			 * WEP is decrypted by hardware. Clear WEP bit
1535 			 * and trim WEP header for ieee80211_input().
1536 			 */
1537 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1538 			memcpy(&whbuf, wh, sizeof(whbuf));
1539 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1540 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
1541 			/*
1542 			 * Also trim WEP ICV from the tail.
1543 			 */
1544 			m_adj(m, -IEEE80211_WEP_CRCLEN);
1545 		}
1546 		ieee80211_input(ifp, m,
1547 			ds->ds_rxstat.rs_rssi,
1548 			ds->ds_rxstat.rs_tstamp,
1549 			ds->ds_rxstat.rs_antenna);
1550   rx_next:
1551 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
1552 	} while (ath_rxbuf_init(sc, bf) == 0);
1553 
1554 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
1555 	ath_hal_rxena(ah);			/* in case of RXEOL */
1556 }
1557 
1558 /*
1559  * XXX Size of an ACK control frame in bytes.
1560  */
1561 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
1562 
1563 static int
1564 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
1565     struct mbuf *m0)
1566 {
1567 	struct ieee80211com *ic = &sc->sc_ic;
1568 	struct ath_hal *ah = sc->sc_ah;
1569 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1570 	int i, error, iswep, hdrlen, pktlen;
1571 	u_int8_t rix, cix, txrate, ctsrate;
1572 	struct ath_desc *ds;
1573 	struct mbuf *m;
1574 	struct ieee80211_frame *wh;
1575 	u_int32_t iv;
1576 	u_int8_t *ivp;
1577 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
1578 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
1579 	u_int subtype, flags, ctsduration, antenna;
1580 	HAL_PKT_TYPE atype;
1581 	const HAL_RATE_TABLE *rt;
1582 	HAL_BOOL shortPreamble;
1583 	struct ath_node *an;
1584 
1585 	wh = mtod(m0, struct ieee80211_frame *);
1586 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
1587 	hdrlen = sizeof(struct ieee80211_frame);
1588 	pktlen = m0->m_pkthdr.len;
1589 
1590 	if (iswep) {
1591 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
1592 		m_adj(m0, hdrlen);
1593 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
1594 		if (m0 == NULL) {
1595 			sc->sc_stats.ast_tx_nombuf++;
1596 			return ENOMEM;
1597 		}
1598 		ivp = hdrbuf + hdrlen;
1599 		/*
1600 		 * XXX
1601 		 * IV must not duplicate during the lifetime of the key.
1602 		 * But no mechanism to renew keys is defined in IEEE 802.11
1603 		 * WEP.  And IV may be duplicated between other stations
1604 		 * because of the session key itself is shared.
1605 		 * So we use pseudo random IV for now, though it is not the
1606 		 * right way.
1607 		 */
1608 		iv = arc4random();
1609 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
1610 			ivp[i] = iv;
1611 			iv >>= 8;
1612 		}
1613 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
1614 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
1615 		/*
1616 		 * The ICV length must be included into hdrlen and pktlen.
1617 		 */
1618 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
1619 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
1620 	}
1621 	pktlen += IEEE80211_CRC_LEN;
1622 
1623 	/*
1624 	 * Load the DMA map so any coalescing is done.  This
1625 	 * also calculates the number of descriptors we need.
1626 	 */
1627 	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1628 				     ath_mbuf_load_cb, bf,
1629 				     BUS_DMA_NOWAIT);
1630 	if (error != 0) {
1631 		sc->sc_stats.ast_tx_busdma++;
1632 		m_freem(m0);
1633 		return error;
1634 	}
1635 	/*
1636 	 * Discard null packets and check for packets that
1637 	 * require too many TX descriptors.  We try to convert
1638 	 * the latter to a cluster.
1639 	 */
1640 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
1641 		sc->sc_stats.ast_tx_linear++;
1642 		MGETHDR(m, M_DONTWAIT, MT_DATA);
1643 		if (m == NULL) {
1644 			sc->sc_stats.ast_tx_nombuf++;
1645 			m_freem(m0);
1646 			return ENOMEM;
1647 		}
1648 		M_MOVE_PKTHDR(m, m0);
1649 		MCLGET(m, M_DONTWAIT);
1650 		if ((m->m_flags & M_EXT) == 0) {
1651 			sc->sc_stats.ast_tx_nomcl++;
1652 			m_freem(m0);
1653 			m_free(m);
1654 			return ENOMEM;
1655 		}
1656 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
1657 		m_freem(m0);
1658 		m->m_len = m->m_pkthdr.len;
1659 		m0 = m;
1660 		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
1661 					     ath_mbuf_load_cb, bf,
1662 					     BUS_DMA_NOWAIT);
1663 		if (error != 0) {
1664 			sc->sc_stats.ast_tx_busdma++;
1665 			m_freem(m0);
1666 			return error;
1667 		}
1668 		KASSERT(bf->bf_nseg == 1,
1669 			("ath_tx_start: packet not one segment; nseg %u",
1670 			bf->bf_nseg));
1671 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
1672 		sc->sc_stats.ast_tx_nodata++;
1673 		m_freem(m0);
1674 		return EIO;
1675 	}
1676 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
1677 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
1678 	bf->bf_m = m0;
1679 	bf->bf_node = ni;
1680 
1681 	/* setup descriptors */
1682 	ds = bf->bf_desc;
1683 	rt = sc->sc_currates;
1684 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
1685 
1686 	/*
1687 	 * Calculate Atheros packet type from IEEE80211 packet header
1688 	 * and setup for rate calculations.
1689 	 */
1690 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
1691 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1692 	case IEEE80211_FC0_TYPE_MGT:
1693 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1694 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
1695 			atype = HAL_PKT_TYPE_BEACON;
1696 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1697 			atype = HAL_PKT_TYPE_PROBE_RESP;
1698 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
1699 			atype = HAL_PKT_TYPE_ATIM;
1700 		rix = 0;			/* XXX lowest rate */
1701 		break;
1702 	case IEEE80211_FC0_TYPE_CTL:
1703 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1704 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
1705 			atype = HAL_PKT_TYPE_PSPOLL;
1706 		rix = 0;			/* XXX lowest rate */
1707 		break;
1708 	default:
1709 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
1710 				IEEE80211_RATE_VAL];
1711 		if (rix == 0xff) {
1712 			if_printf(ifp, "bogus xmit rate 0x%x\n",
1713 				ni->ni_rates.rs_rates[ni->ni_txrate]);
1714 			sc->sc_stats.ast_tx_badrate++;
1715 			m_freem(m0);
1716 			return EIO;
1717 		}
1718 		break;
1719 	}
1720 	/*
1721 	 * NB: the 802.11 layer marks whether or not we should
1722 	 * use short preamble based on the current mode and
1723 	 * negotiated parameters.
1724 	 */
1725 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
1726 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
1727 		shortPreamble = AH_TRUE;
1728 		sc->sc_stats.ast_tx_shortpre++;
1729 	} else {
1730 		txrate = rt->info[rix].rateCode;
1731 		shortPreamble = AH_FALSE;
1732 	}
1733 
1734 	/*
1735 	 * Calculate miscellaneous flags.
1736 	 */
1737 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
1738 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1739 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
1740 		sc->sc_stats.ast_tx_noack++;
1741 	} else if (pktlen > ic->ic_rtsthreshold) {
1742 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
1743 		sc->sc_stats.ast_tx_rts++;
1744 	}
1745 
1746 	/*
1747 	 * Calculate RTS/CTS rate and duration if needed.
1748 	 */
1749 	ctsduration = 0;
1750 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
1751 		/*
1752 		 * CTS transmit rate is derived from the transmit rate
1753 		 * by looking in the h/w rate table.  We must also factor
1754 		 * in whether or not a short preamble is to be used.
1755 		 */
1756 		cix = rt->info[rix].controlRate;
1757 		ctsrate = rt->info[cix].rateCode;
1758 		if (shortPreamble)
1759 			ctsrate |= rt->info[cix].shortPreamble;
1760 		/*
1761 		 * Compute the transmit duration based on the size
1762 		 * of an ACK frame.  We call into the HAL to do the
1763 		 * computation since it depends on the characteristics
1764 		 * of the actual PHY being used.
1765 		 */
1766 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
1767 			ctsduration += ath_hal_computetxtime(ah,
1768 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1769 		}
1770 		/* SIFS + data */
1771 		ctsduration += ath_hal_computetxtime(ah,
1772 			rt, pktlen, rix, shortPreamble);
1773 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
1774 			ctsduration += ath_hal_computetxtime(ah,
1775 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
1776 		}
1777 	} else
1778 		ctsrate = 0;
1779 
1780 	/*
1781 	 * For now use the antenna on which the last good
1782 	 * frame was received on.  We assume this field is
1783 	 * initialized to 0 which gives us ``auto'' or the
1784 	 * ``default'' antenna.
1785 	 */
1786 	an = (struct ath_node *) ni;
1787 	if (an->an_tx_antenna)
1788 		antenna = an->an_tx_antenna;
1789 	else
1790 		antenna = ni->ni_rantenna;
1791 
1792 	/*
1793 	 * Formulate first tx descriptor with tx controls.
1794 	 */
1795 	/* XXX check return value? */
1796 	ath_hal_setuptxdesc(ah, ds
1797 		, pktlen		/* packet length */
1798 		, hdrlen		/* header length */
1799 		, atype			/* Atheros packet type */
1800 		, 60			/* txpower XXX */
1801 		, txrate, 1+10		/* series 0 rate/tries */
1802 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
1803 		, antenna		/* antenna mode */
1804 		, flags			/* flags */
1805 		, ctsrate		/* rts/cts rate */
1806 		, ctsduration		/* rts/cts duration */
1807 	);
1808 #ifdef notyet
1809 	ath_hal_setupxtxdesc(ah, ds
1810 		, AH_FALSE		/* short preamble */
1811 		, 0, 0			/* series 1 rate/tries */
1812 		, 0, 0			/* series 2 rate/tries */
1813 		, 0, 0			/* series 3 rate/tries */
1814 	);
1815 #endif
1816 	/*
1817 	 * Fillin the remainder of the descriptor info.
1818 	 */
1819 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
1820 		ds->ds_data = bf->bf_segs[i].ds_addr;
1821 		if (i == bf->bf_nseg - 1)
1822 			ds->ds_link = 0;
1823 		else
1824 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
1825 		ath_hal_filltxdesc(ah, ds
1826 			, bf->bf_segs[i].ds_len	/* segment length */
1827 			, i == 0		/* first segment */
1828 			, i == bf->bf_nseg - 1	/* last segment */
1829 		);
1830 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
1831 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
1832 		    ds->ds_hw[0], ds->ds_hw[1]));
1833 	}
1834 
1835 	/*
1836 	 * Insert the frame on the outbound list and
1837 	 * pass it on to the hardware.
1838 	 */
1839 	mtx_lock(&sc->sc_txqlock);
1840 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
1841 	if (sc->sc_txlink == NULL) {
1842 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
1843 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
1844 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
1845 	} else {
1846 		*sc->sc_txlink = bf->bf_daddr;
1847 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
1848 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
1849 	}
1850 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
1851 	mtx_unlock(&sc->sc_txqlock);
1852 
1853 	ath_hal_txstart(ah, sc->sc_txhalq);
1854 	return 0;
1855 }
1856 
1857 static void
1858 ath_tx_proc(void *arg, int npending)
1859 {
1860 	struct ath_softc *sc = arg;
1861 	struct ath_hal *ah = sc->sc_ah;
1862 	struct ath_buf *bf;
1863 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1864 	struct ath_desc *ds;
1865 	struct ieee80211_node *ni;
1866 	struct ath_node *an;
1867 	int sr, lr;
1868 	HAL_STATUS status;
1869 
1870 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
1871 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
1872 		sc->sc_txlink));
1873 	for (;;) {
1874 		mtx_lock(&sc->sc_txqlock);
1875 		bf = TAILQ_FIRST(&sc->sc_txq);
1876 		if (bf == NULL) {
1877 			sc->sc_txlink = NULL;
1878 			mtx_unlock(&sc->sc_txqlock);
1879 			break;
1880 		}
1881 		/* only the last descriptor is needed */
1882 		ds = &bf->bf_desc[bf->bf_nseg - 1];
1883 		status = ath_hal_txprocdesc(ah, ds);
1884 #ifdef AR_DEBUG
1885 		if (ath_debug > 1)
1886 			ath_printtxbuf(bf, status == HAL_OK);
1887 #endif
1888 		if (status == HAL_EINPROGRESS) {
1889 			mtx_unlock(&sc->sc_txqlock);
1890 			break;
1891 		}
1892 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1893 		mtx_unlock(&sc->sc_txqlock);
1894 
1895 		ni = bf->bf_node;
1896 		if (ni != NULL) {
1897 			an = (struct ath_node *) ni;
1898 			if (ds->ds_txstat.ts_status == 0) {
1899 				an->an_tx_ok++;
1900 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
1901 			} else {
1902 				an->an_tx_err++;
1903 				ifp->if_oerrors++;
1904 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
1905 					sc->sc_stats.ast_tx_xretries++;
1906 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
1907 					sc->sc_stats.ast_tx_fifoerr++;
1908 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
1909 					sc->sc_stats.ast_tx_filtered++;
1910 				an->an_tx_antenna = 0;	/* invalidate */
1911 			}
1912 			sr = ds->ds_txstat.ts_shortretry;
1913 			lr = ds->ds_txstat.ts_longretry;
1914 			sc->sc_stats.ast_tx_shortretry += sr;
1915 			sc->sc_stats.ast_tx_longretry += lr;
1916 			if (sr + lr)
1917 				an->an_tx_retr++;
1918 		}
1919 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
1920 		    BUS_DMASYNC_POSTWRITE);
1921 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1922 		m_freem(bf->bf_m);
1923 		bf->bf_m = NULL;
1924 		bf->bf_node = NULL;
1925 
1926 		mtx_lock(&sc->sc_txbuflock);
1927 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1928 		mtx_unlock(&sc->sc_txbuflock);
1929 	}
1930 	ifp->if_flags &= ~IFF_OACTIVE;
1931 	sc->sc_tx_timer = 0;
1932 
1933 	ath_start(ifp);
1934 }
1935 
1936 /*
1937  * Drain the transmit queue and reclaim resources.
1938  */
1939 static void
1940 ath_draintxq(struct ath_softc *sc)
1941 {
1942 	struct ath_hal *ah = sc->sc_ah;
1943 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1944 	struct ath_buf *bf;
1945 
1946 	/* XXX return value */
1947 	if (!sc->sc_invalid) {
1948 		/* don't touch the hardware if marked invalid */
1949 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
1950 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
1951 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
1952 		    sc->sc_txlink));
1953 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
1954 		DPRINTF(("ath_draintxq: beacon queue %p\n",
1955 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
1956 	}
1957 	for (;;) {
1958 		mtx_lock(&sc->sc_txqlock);
1959 		bf = TAILQ_FIRST(&sc->sc_txq);
1960 		if (bf == NULL) {
1961 			sc->sc_txlink = NULL;
1962 			mtx_unlock(&sc->sc_txqlock);
1963 			break;
1964 		}
1965 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
1966 		mtx_unlock(&sc->sc_txqlock);
1967 #ifdef AR_DEBUG
1968 		if (ath_debug)
1969 			ath_printtxbuf(bf,
1970 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
1971 #endif /* AR_DEBUG */
1972 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
1973 		m_freem(bf->bf_m);
1974 		bf->bf_m = NULL;
1975 		bf->bf_node = NULL;
1976 		mtx_lock(&sc->sc_txbuflock);
1977 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
1978 		mtx_unlock(&sc->sc_txbuflock);
1979 	}
1980 	ifp->if_flags &= ~IFF_OACTIVE;
1981 	sc->sc_tx_timer = 0;
1982 }
1983 
1984 /*
1985  * Disable the receive h/w in preparation for a reset.
1986  */
1987 static void
1988 ath_stoprecv(struct ath_softc *sc)
1989 {
1990 	struct ath_hal *ah = sc->sc_ah;
1991 
1992 	ath_hal_stoppcurecv(ah);	/* disable PCU */
1993 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
1994 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
1995 	DELAY(3000);			/* long enough for 1 frame */
1996 #ifdef AR_DEBUG
1997 	if (ath_debug) {
1998 		struct ath_buf *bf;
1999 
2000 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
2001 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
2002 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2003 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
2004 				ath_printrxbuf(bf, 1);
2005 		}
2006 	}
2007 #endif
2008 	sc->sc_rxlink = NULL;		/* just in case */
2009 }
2010 
2011 /*
2012  * Enable the receive h/w following a reset.
2013  */
2014 static int
2015 ath_startrecv(struct ath_softc *sc)
2016 {
2017 	struct ath_hal *ah = sc->sc_ah;
2018 	struct ath_buf *bf;
2019 
2020 	sc->sc_rxlink = NULL;
2021 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
2022 		int error = ath_rxbuf_init(sc, bf);
2023 		if (error != 0) {
2024 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
2025 				error));
2026 			return error;
2027 		}
2028 	}
2029 
2030 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
2031 	ath_hal_putrxbuf(ah, bf->bf_daddr);
2032 	ath_hal_rxena(ah);		/* enable recv descriptors */
2033 	ath_mode_init(sc);		/* set filters, etc. */
2034 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
2035 	return 0;
2036 }
2037 
2038 /*
2039  * Set/change channels.  If the channel is really being changed,
2040  * it's done by resetting the chip.  To accomplish this we must
2041  * first cleanup any pending DMA, then restart stuff after a la
2042  * ath_init.
2043  */
2044 static int
2045 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2046 {
2047 	struct ath_hal *ah = sc->sc_ah;
2048 	struct ieee80211com *ic = &sc->sc_ic;
2049 
2050 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
2051 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
2052 		ic->ic_ibss_chan->ic_freq,
2053 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
2054 	if (chan != ic->ic_ibss_chan) {
2055 		HAL_STATUS status;
2056 		HAL_CHANNEL hchan;
2057 		enum ieee80211_phymode mode;
2058 
2059 		/*
2060 		 * To switch channels clear any pending DMA operations;
2061 		 * wait long enough for the RX fifo to drain, reset the
2062 		 * hardware at the new frequency, and then re-enable
2063 		 * the relevant bits of the h/w.
2064 		 */
2065 		ath_hal_intrset(ah, 0);		/* disable interrupts */
2066 		ath_draintxq(sc);		/* clear pending tx frames */
2067 		ath_stoprecv(sc);		/* turn off frame recv */
2068 		/*
2069 		 * Convert to a HAL channel description with
2070 		 * the flags constrained to reflect the current
2071 		 * operating mode.
2072 		 */
2073 		hchan.channel = chan->ic_freq;
2074 		hchan.channelFlags = ath_chan2flags(ic, chan);
2075 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
2076 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
2077 				"channel %u (%u Mhz)\n",
2078 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
2079 			return EIO;
2080 		}
2081 		/*
2082 		 * Re-enable rx framework.
2083 		 */
2084 		if (ath_startrecv(sc) != 0) {
2085 			if_printf(&ic->ic_if,
2086 				"ath_chan_set: unable to restart recv logic\n");
2087 			return EIO;
2088 		}
2089 
2090 		/*
2091 		 * Re-enable interrupts.
2092 		 */
2093 		ath_hal_intrset(ah, sc->sc_imask);
2094 
2095 		/*
2096 		 * Change channels and update the h/w rate map
2097 		 * if we're switching; e.g. 11a to 11b/g.
2098 		 */
2099 		ic->ic_ibss_chan = chan;
2100 		mode = ieee80211_chan2mode(ic, chan);
2101 		if (mode != sc->sc_curmode)
2102 			ath_setcurmode(sc, mode);
2103 	}
2104 	return 0;
2105 }
2106 
2107 static void
2108 ath_next_scan(void *arg)
2109 {
2110 	struct ath_softc *sc = arg;
2111 	struct ieee80211com *ic = &sc->sc_ic;
2112 	struct ifnet *ifp = &ic->ic_if;
2113 
2114 	if (ic->ic_state == IEEE80211_S_SCAN)
2115 		ieee80211_next_scan(ifp);
2116 }
2117 
2118 /*
2119  * Periodically recalibrate the PHY to account
2120  * for temperature/environment changes.
2121  */
2122 static void
2123 ath_calibrate(void *arg)
2124 {
2125 	struct ath_softc *sc = arg;
2126 	struct ath_hal *ah = sc->sc_ah;
2127 	struct ieee80211com *ic = &sc->sc_ic;
2128 	struct ieee80211_channel *c;
2129 	HAL_CHANNEL hchan;
2130 
2131 	sc->sc_stats.ast_per_cal++;
2132 
2133 	/*
2134 	 * Convert to a HAL channel description with the flags
2135 	 * constrained to reflect the current operating mode.
2136 	 */
2137 	c = ic->ic_ibss_chan;
2138 	hchan.channel = c->ic_freq;
2139 	hchan.channelFlags = ath_chan2flags(ic, c);
2140 
2141 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
2142 
2143 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
2144 		/*
2145 		 * Rfgain is out of bounds, reset the chip
2146 		 * to load new gain values.
2147 		 */
2148 		sc->sc_stats.ast_per_rfgain++;
2149 		ath_reset(sc);
2150 	}
2151 	if (!ath_hal_calibrate(ah, &hchan)) {
2152 		DPRINTF(("%s: calibration of channel %u failed\n",
2153 			__func__, c->ic_freq));
2154 		sc->sc_stats.ast_per_calfail++;
2155 	}
2156 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
2157 }
2158 
2159 static int
2160 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2161 {
2162 	struct ifnet *ifp = &ic->ic_if;
2163 	struct ath_softc *sc = ifp->if_softc;
2164 	struct ath_hal *ah = sc->sc_ah;
2165 	struct ieee80211_node *ni;
2166 	int i, error;
2167 	u_int8_t *bssid;
2168 	u_int32_t rfilt;
2169 	static const HAL_LED_STATE leds[] = {
2170 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
2171 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
2172 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
2173 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
2174 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
2175 	};
2176 
2177 	DPRINTF(("%s: %s -> %s\n", __func__,
2178 		ieee80211_state_name[ic->ic_state],
2179 		ieee80211_state_name[nstate]));
2180 
2181 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
2182 
2183 	if (nstate == IEEE80211_S_INIT) {
2184 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2185 		ath_hal_intrset(ah, sc->sc_imask);
2186 		callout_stop(&sc->sc_scan_ch);
2187 		callout_stop(&sc->sc_cal_ch);
2188 		return (*sc->sc_newstate)(ic, nstate, arg);
2189 	}
2190 	ni = ic->ic_bss;
2191 	error = ath_chan_set(sc, ni->ni_chan);
2192 	if (error != 0)
2193 		goto bad;
2194 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
2195 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
2196 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2197 	    (ifp->if_flags & IFF_PROMISC))
2198 		rfilt |= HAL_RX_FILTER_PROM;
2199 	if (nstate == IEEE80211_S_SCAN) {
2200 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
2201 			ath_next_scan, sc);
2202 		bssid = ifp->if_broadcastaddr;
2203 		rfilt |= HAL_RX_FILTER_BEACON;
2204 	} else {
2205 		callout_stop(&sc->sc_scan_ch);
2206 		bssid = ni->ni_bssid;
2207 	}
2208 	ath_hal_setrxfilter(ah, rfilt);
2209 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
2210 		 __func__, rfilt, ether_sprintf(bssid)));
2211 
2212 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
2213 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
2214 	else
2215 		ath_hal_setassocid(ah, bssid, 0);
2216 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2217 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2218 			if (ath_hal_keyisvalid(ah, i))
2219 				ath_hal_keysetmac(ah, i, bssid);
2220 	}
2221 
2222 	if (nstate == IEEE80211_S_RUN) {
2223 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
2224 			"capinfo=0x%04x chan=%d\n"
2225 			 , __func__
2226 			 , ic->ic_flags
2227 			 , ni->ni_intval
2228 			 , ether_sprintf(ni->ni_bssid)
2229 			 , ni->ni_capinfo
2230 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
2231 
2232 		/*
2233 		 * Allocate and setup the beacon frame for AP or adhoc mode.
2234 		 */
2235 		if (ic->ic_opmode != IEEE80211_M_STA) {
2236 			error = ath_beacon_alloc(sc, ni);
2237 			if (error != 0)
2238 				goto bad;
2239 		}
2240 
2241 		/*
2242 		 * Configure the beacon and sleep timers.
2243 		 */
2244 		ath_beacon_config(sc);
2245 
2246 		/* start periodic recalibration timer */
2247 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
2248 			ath_calibrate, sc);
2249 	} else {
2250 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
2251 		ath_hal_intrset(ah, sc->sc_imask);
2252 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
2253 	}
2254 	/*
2255 	 * Reset the rate control state.
2256 	 */
2257 	ath_rate_ctl_reset(sc, nstate);
2258 	/*
2259 	 * Invoke the parent method to complete the work.
2260 	 */
2261 	return (*sc->sc_newstate)(ic, nstate, arg);
2262 bad:
2263 	callout_stop(&sc->sc_scan_ch);
2264 	callout_stop(&sc->sc_cal_ch);
2265 	/* NB: do not invoke the parent */
2266 	return error;
2267 }
2268 
2269 /*
2270  * Setup driver-specific state for a newly associated node.
2271  * Note that we're called also on a re-associate, the isnew
2272  * param tells us if this is the first time or not.
2273  */
2274 static void
2275 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2276 {
2277 	if (isnew) {
2278 		struct ath_node *an = (struct ath_node *) ni;
2279 
2280 		an->an_tx_ok = an->an_tx_err =
2281 			an->an_tx_retr = an->an_tx_upper = 0;
2282 		/* start with highest negotiated rate */
2283 		/*
2284 		 * XXX should do otherwise but only when
2285 		 * the rate control algorithm is better.
2286 		 */
2287 		KASSERT(ni->ni_rates.rs_nrates > 0,
2288 			("new association w/ no rates!"));
2289 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2290 	}
2291 }
2292 
2293 static int
2294 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
2295 {
2296 	struct ieee80211com *ic = &sc->sc_ic;
2297 	struct ifnet *ifp = &ic->ic_if;
2298 	struct ath_hal *ah = sc->sc_ah;
2299 	HAL_CHANNEL *chans;
2300 	int i, ix, nchan;
2301 
2302 	sc->sc_have11g = 0;
2303 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
2304 			M_TEMP, M_NOWAIT);
2305 	if (chans == NULL) {
2306 		if_printf(ifp, "unable to allocate channel table\n");
2307 		return ENOMEM;
2308 	}
2309 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
2310 	    cc, HAL_MODE_ALL, outdoor)) {
2311 		if_printf(ifp, "unable to collect channel list from hal\n");
2312 		free(chans, M_TEMP);
2313 		return EINVAL;
2314 	}
2315 
2316 	/*
2317 	 * Convert HAL channels to ieee80211 ones and insert
2318 	 * them in the table according to their channel number.
2319 	 */
2320 	for (i = 0; i < nchan; i++) {
2321 		HAL_CHANNEL *c = &chans[i];
2322 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
2323 		if (ix > IEEE80211_CHAN_MAX) {
2324 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
2325 				ix, c->channel, c->channelFlags);
2326 			continue;
2327 		}
2328 		/* NB: flags are known to be compatible */
2329 		if (ic->ic_channels[ix].ic_freq == 0) {
2330 			ic->ic_channels[ix].ic_freq = c->channel;
2331 			ic->ic_channels[ix].ic_flags = c->channelFlags;
2332 		} else {
2333 			/* channels overlap; e.g. 11g and 11b */
2334 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
2335 		}
2336 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
2337 			sc->sc_have11g = 1;
2338 	}
2339 	free(chans, M_TEMP);
2340 	return 0;
2341 }
2342 
2343 static int
2344 ath_rate_setup(struct ath_softc *sc, u_int mode)
2345 {
2346 	struct ath_hal *ah = sc->sc_ah;
2347 	struct ieee80211com *ic = &sc->sc_ic;
2348 	const HAL_RATE_TABLE *rt;
2349 	struct ieee80211_rateset *rs;
2350 	int i, maxrates;
2351 
2352 	switch (mode) {
2353 	case IEEE80211_MODE_11A:
2354 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
2355 		break;
2356 	case IEEE80211_MODE_11B:
2357 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
2358 		break;
2359 	case IEEE80211_MODE_11G:
2360 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
2361 		break;
2362 	case IEEE80211_MODE_TURBO:
2363 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
2364 		break;
2365 	default:
2366 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
2367 		return 0;
2368 	}
2369 	rt = sc->sc_rates[mode];
2370 	if (rt == NULL)
2371 		return 0;
2372 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
2373 		DPRINTF(("%s: rate table too small (%u > %u)\n",
2374 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
2375 		maxrates = IEEE80211_RATE_MAXSIZE;
2376 	} else
2377 		maxrates = rt->rateCount;
2378 	rs = &ic->ic_sup_rates[mode];
2379 	for (i = 0; i < maxrates; i++)
2380 		rs->rs_rates[i] = rt->info[i].dot11Rate;
2381 	rs->rs_nrates = maxrates;
2382 	return 1;
2383 }
2384 
2385 static void
2386 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
2387 {
2388 	const HAL_RATE_TABLE *rt;
2389 	int i;
2390 
2391 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
2392 	rt = sc->sc_rates[mode];
2393 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
2394 	for (i = 0; i < rt->rateCount; i++)
2395 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
2396 	sc->sc_currates = rt;
2397 	sc->sc_curmode = mode;
2398 }
2399 
2400 /*
2401  * Reset the rate control state for each 802.11 state transition.
2402  */
2403 static void
2404 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
2405 {
2406 	struct ieee80211com *ic = &sc->sc_ic;
2407 	struct ieee80211_node *ni;
2408 	struct ath_node *an;
2409 
2410 	an = (struct ath_node *) ic->ic_bss;
2411 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
2412 	if (ic->ic_opmode == IEEE80211_M_STA) {
2413 		ni = ic->ic_bss;
2414 		if (state == IEEE80211_S_RUN) {
2415 			/* start with highest negotiated rate */
2416 			KASSERT(ni->ni_rates.rs_nrates > 0,
2417 				("transition to RUN state w/ no rates!"));
2418 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
2419 		} else {
2420 			/* use lowest rate */
2421 			ni->ni_txrate = 0;
2422 		}
2423 	} else {
2424 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
2425 			ni->ni_txrate = 0;		/* use lowest rate */
2426 			an = (struct ath_node *) ni;
2427 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
2428 			    an->an_tx_upper = 0;
2429 		}
2430 	}
2431 }
2432 
2433 /*
2434  * Examine and potentially adjust the transmit rate.
2435  */
2436 static void
2437 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
2438 {
2439 	struct ath_softc *sc = arg;
2440 	struct ath_node *an = (struct ath_node *) ni;
2441 	struct ieee80211_rateset *rs = &ni->ni_rates;
2442 	int mod = 0, orate, enough;
2443 
2444 	/*
2445 	 * Rate control
2446 	 * XXX: very primitive version.
2447 	 */
2448 	sc->sc_stats.ast_rate_calls++;
2449 
2450 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
2451 
2452 	/* no packet reached -> down */
2453 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
2454 		mod = -1;
2455 
2456 	/* all packets needs retry in average -> down */
2457 	if (enough && an->an_tx_ok < an->an_tx_retr)
2458 		mod = -1;
2459 
2460 	/* no error and less than 10% of packets needs retry -> up */
2461 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
2462 		mod = 1;
2463 
2464 	orate = ni->ni_txrate;
2465 	switch (mod) {
2466 	case 0:
2467 		if (enough && an->an_tx_upper > 0)
2468 			an->an_tx_upper--;
2469 		break;
2470 	case -1:
2471 		if (ni->ni_txrate > 0) {
2472 			ni->ni_txrate--;
2473 			sc->sc_stats.ast_rate_drop++;
2474 		}
2475 		an->an_tx_upper = 0;
2476 		break;
2477 	case 1:
2478 		if (++an->an_tx_upper < 2)
2479 			break;
2480 		an->an_tx_upper = 0;
2481 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
2482 			ni->ni_txrate++;
2483 			sc->sc_stats.ast_rate_raise++;
2484 		}
2485 		break;
2486 	}
2487 
2488 	if (ni->ni_txrate != orate) {
2489 		printf("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
2490 		    __func__,
2491 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
2492 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
2493 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr);
2494 	}
2495 	if (ni->ni_txrate != orate || enough)
2496 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
2497 }
2498 
2499 #ifdef AR_DEBUG
2500 static int
2501 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
2502 {
2503 	char dmode[64];
2504 	int error;
2505 
2506 	strncpy(dmode, "", sizeof(dmode) - 1);
2507 	dmode[sizeof(dmode) - 1] = '\0';
2508 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
2509 
2510 	if (error == 0 && req->newptr != NULL) {
2511 		struct ifnet *ifp;
2512 		struct ath_softc *sc;
2513 
2514 		ifp = ifunit("ath0");		/* XXX */
2515 		if (!ifp)
2516 			return EINVAL;
2517 		sc = ifp->if_softc;
2518 		if (strcmp(dmode, "hal") == 0)
2519 			ath_hal_dumpstate(sc->sc_ah);
2520 		else if (strcmp(dmode, "eeprom") == 0)
2521 			ath_hal_dumpeeprom(sc->sc_ah);
2522 		else if (strcmp(dmode, "rfgain") == 0)
2523 			ath_hal_dumprfgain(sc->sc_ah);
2524 		else if (strcmp(dmode, "ani") == 0)
2525 			ath_hal_dumpani(sc->sc_ah);
2526 		else
2527 			return EINVAL;
2528 	}
2529 	return error;
2530 }
2531 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
2532 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
2533 
2534 static void
2535 ath_printrxbuf(struct ath_buf *bf, int done)
2536 {
2537 	struct ath_desc *ds;
2538 	int i;
2539 
2540 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2541 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
2542 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2543 		    ds->ds_link, ds->ds_data,
2544 		    ds->ds_ctl0, ds->ds_ctl1,
2545 		    ds->ds_hw[0], ds->ds_hw[1],
2546 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
2547 	}
2548 }
2549 
2550 static void
2551 ath_printtxbuf(struct ath_buf *bf, int done)
2552 {
2553 	struct ath_desc *ds;
2554 	int i;
2555 
2556 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
2557 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
2558 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
2559 		    ds->ds_link, ds->ds_data,
2560 		    ds->ds_ctl0, ds->ds_ctl1,
2561 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
2562 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
2563 	}
2564 }
2565 #endif /* AR_DEBUG */
2566