Home | History | Annotate | Line # | Download | only in ic
ath.c revision 1.1.1.5
      1 /*-
      2  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  * 1. Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer,
     10  *    without modification.
     11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
     12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
     13  *    redistribution must be conditioned upon including a substantially
     14  *    similar Disclaimer requirement for further binary redistribution.
     15  * 3. Neither the names of the above-listed copyright holders nor the names
     16  *    of any contributors may be used to endorse or promote products derived
     17  *    from this software without specific prior written permission.
     18  *
     19  * Alternatively, this software may be distributed under the terms of the
     20  * GNU General Public License ("GPL") version 2 as published by the Free
     21  * Software Foundation.
     22  *
     23  * NO WARRANTY
     24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
     27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
     28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
     29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
     32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
     34  * THE POSSIBILITY OF SUCH DAMAGES.
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 __FBSDID("$FreeBSD: src/sys/dev/ath/if_ath.c,v 1.94 2005/07/07 00:04:50 sam Exp $");
     39 
     40 /*
     41  * Driver for the Atheros Wireless LAN controller.
     42  *
     43  * This software is derived from work of Atsushi Onoe; his contribution
     44  * is greatly appreciated.
     45  */
     46 
     47 #include "opt_inet.h"
     48 
     49 #include <sys/param.h>
     50 #include <sys/systm.h>
     51 #include <sys/sysctl.h>
     52 #include <sys/mbuf.h>
     53 #include <sys/malloc.h>
     54 #include <sys/lock.h>
     55 #include <sys/mutex.h>
     56 #include <sys/kernel.h>
     57 #include <sys/socket.h>
     58 #include <sys/sockio.h>
     59 #include <sys/errno.h>
     60 #include <sys/callout.h>
     61 #include <sys/bus.h>
     62 #include <sys/endian.h>
     63 
     64 #include <machine/bus.h>
     65 
     66 #include <net/if.h>
     67 #include <net/if_dl.h>
     68 #include <net/if_media.h>
     69 #include <net/if_types.h>
     70 #include <net/if_arp.h>
     71 #include <net/ethernet.h>
     72 #include <net/if_llc.h>
     73 
     74 #include <net80211/ieee80211_var.h>
     75 
     76 #include <net/bpf.h>
     77 
     78 #ifdef INET
     79 #include <netinet/in.h>
     80 #include <netinet/if_ether.h>
     81 #endif
     82 
     83 #define	AR_DEBUG
     84 #include <dev/ath/if_athvar.h>
     85 #include <contrib/dev/ath/ah_desc.h>
     86 #include <contrib/dev/ath/ah_devid.h>		/* XXX for softled */
     87 
     88 /* unaligned little endian access */
     89 #define LE_READ_2(p)							\
     90 	((u_int16_t)							\
     91 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
     92 #define LE_READ_4(p)							\
     93 	((u_int32_t)							\
     94 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
     95 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
     96 
     97 enum {
     98 	ATH_LED_TX,
     99 	ATH_LED_RX,
    100 	ATH_LED_POLL,
    101 };
    102 
    103 static void	ath_init(void *);
    104 static void	ath_stop_locked(struct ifnet *);
    105 static void	ath_stop(struct ifnet *);
    106 static void	ath_start(struct ifnet *);
    107 static int	ath_reset(struct ifnet *);
    108 static int	ath_media_change(struct ifnet *);
    109 static void	ath_watchdog(struct ifnet *);
    110 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
    111 static void	ath_fatal_proc(void *, int);
    112 static void	ath_rxorn_proc(void *, int);
    113 static void	ath_bmiss_proc(void *, int);
    114 static int	ath_key_alloc(struct ieee80211com *,
    115 			const struct ieee80211_key *);
    116 static int	ath_key_delete(struct ieee80211com *,
    117 			const struct ieee80211_key *);
    118 static int	ath_key_set(struct ieee80211com *, const struct ieee80211_key *,
    119 			const u_int8_t mac[IEEE80211_ADDR_LEN]);
    120 static void	ath_key_update_begin(struct ieee80211com *);
    121 static void	ath_key_update_end(struct ieee80211com *);
    122 static void	ath_mode_init(struct ath_softc *);
    123 static void	ath_setslottime(struct ath_softc *);
    124 static void	ath_updateslot(struct ifnet *);
    125 static int	ath_beaconq_setup(struct ath_hal *);
    126 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
    127 static void	ath_beacon_setup(struct ath_softc *, struct ath_buf *);
    128 static void	ath_beacon_proc(void *, int);
    129 static void	ath_bstuck_proc(void *, int);
    130 static void	ath_beacon_free(struct ath_softc *);
    131 static void	ath_beacon_config(struct ath_softc *);
    132 static void	ath_descdma_cleanup(struct ath_softc *sc,
    133 			struct ath_descdma *, ath_bufhead *);
    134 static int	ath_desc_alloc(struct ath_softc *);
    135 static void	ath_desc_free(struct ath_softc *);
    136 static struct ieee80211_node *ath_node_alloc(struct ieee80211_node_table *);
    137 static void	ath_node_free(struct ieee80211_node *);
    138 static u_int8_t	ath_node_getrssi(const struct ieee80211_node *);
    139 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
    140 static void	ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
    141 			struct ieee80211_node *ni,
    142 			int subtype, int rssi, u_int32_t rstamp);
    143 static void	ath_setdefantenna(struct ath_softc *, u_int);
    144 static void	ath_rx_proc(void *, int);
    145 static struct ath_txq *ath_txq_setup(struct ath_softc*, int qtype, int subtype);
    146 static int	ath_tx_setup(struct ath_softc *, int, int);
    147 static int	ath_wme_update(struct ieee80211com *);
    148 static void	ath_tx_cleanupq(struct ath_softc *, struct ath_txq *);
    149 static void	ath_tx_cleanup(struct ath_softc *);
    150 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
    151 			     struct ath_buf *, struct mbuf *);
    152 static void	ath_tx_proc_q0(void *, int);
    153 static void	ath_tx_proc_q0123(void *, int);
    154 static void	ath_tx_proc(void *, int);
    155 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
    156 static void	ath_draintxq(struct ath_softc *);
    157 static void	ath_stoprecv(struct ath_softc *);
    158 static int	ath_startrecv(struct ath_softc *);
    159 static void	ath_chan_change(struct ath_softc *, struct ieee80211_channel *);
    160 static void	ath_next_scan(void *);
    161 static void	ath_calibrate(void *);
    162 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
    163 static void	ath_setup_stationkey(struct ieee80211_node *);
    164 static void	ath_newassoc(struct ieee80211com *,
    165 			struct ieee80211_node *, int);
    166 static int	ath_getchannels(struct ath_softc *, u_int cc,
    167 			HAL_BOOL outdoor, HAL_BOOL xchanmode);
    168 static void	ath_led_event(struct ath_softc *, int);
    169 static void	ath_update_txpow(struct ath_softc *);
    170 
    171 static int	ath_rate_setup(struct ath_softc *, u_int mode);
    172 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
    173 
    174 static void	ath_sysctlattach(struct ath_softc *);
    175 static void	ath_bpfattach(struct ath_softc *);
    176 static void	ath_announce(struct ath_softc *);
    177 
    178 SYSCTL_DECL(_hw_ath);
    179 
    180 /* XXX validate sysctl values */
    181 static	int ath_dwelltime = 200;		/* 5 channels/second */
    182 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
    183 	    0, "channel dwell time (ms) for AP/station scanning");
    184 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
    185 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
    186 	    0, "chip calibration interval (secs)");
    187 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
    188 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
    189 	    0, "outdoor operation");
    190 TUNABLE_INT("hw.ath.outdoor", &ath_outdoor);
    191 static	int ath_xchanmode = AH_TRUE;		/* extended channel use */
    192 SYSCTL_INT(_hw_ath, OID_AUTO, xchanmode, CTLFLAG_RD, &ath_xchanmode,
    193 	    0, "extended channel mode");
    194 TUNABLE_INT("hw.ath.xchanmode", &ath_xchanmode);
    195 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
    196 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
    197 	    0, "country code");
    198 TUNABLE_INT("hw.ath.countrycode", &ath_countrycode);
    199 static	int ath_regdomain = 0;			/* regulatory domain */
    200 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
    201 	    0, "regulatory domain");
    202 
    203 #ifdef AR_DEBUG
    204 static	int ath_debug = 0;
    205 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
    206 	    0, "control debugging printfs");
    207 TUNABLE_INT("hw.ath.debug", &ath_debug);
    208 enum {
    209 	ATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
    210 	ATH_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
    211 	ATH_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
    212 	ATH_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
    213 	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
    214 	ATH_DEBUG_RESET		= 0x00000020,	/* reset processing */
    215 	ATH_DEBUG_MODE		= 0x00000040,	/* mode init/setup */
    216 	ATH_DEBUG_BEACON 	= 0x00000080,	/* beacon handling */
    217 	ATH_DEBUG_WATCHDOG 	= 0x00000100,	/* watchdog timeout */
    218 	ATH_DEBUG_INTR		= 0x00001000,	/* ISR */
    219 	ATH_DEBUG_TX_PROC	= 0x00002000,	/* tx ISR proc */
    220 	ATH_DEBUG_RX_PROC	= 0x00004000,	/* rx ISR proc */
    221 	ATH_DEBUG_BEACON_PROC	= 0x00008000,	/* beacon ISR proc */
    222 	ATH_DEBUG_CALIBRATE	= 0x00010000,	/* periodic calibration */
    223 	ATH_DEBUG_KEYCACHE	= 0x00020000,	/* key cache management */
    224 	ATH_DEBUG_STATE		= 0x00040000,	/* 802.11 state transitions */
    225 	ATH_DEBUG_NODE		= 0x00080000,	/* node management */
    226 	ATH_DEBUG_LED		= 0x00100000,	/* led management */
    227 	ATH_DEBUG_FATAL		= 0x80000000,	/* fatal errors */
    228 	ATH_DEBUG_ANY		= 0xffffffff
    229 };
    230 #define	IFF_DUMPPKTS(sc, m) \
    231 	((sc->sc_debug & (m)) || \
    232 	    (sc->sc_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
    233 #define	DPRINTF(sc, m, fmt, ...) do {				\
    234 	if (sc->sc_debug & (m))					\
    235 		printf(fmt, __VA_ARGS__);			\
    236 } while (0)
    237 #define	KEYPRINTF(sc, ix, hk, mac) do {				\
    238 	if (sc->sc_debug & ATH_DEBUG_KEYCACHE)			\
    239 		ath_keyprint(__func__, ix, hk, mac);		\
    240 } while (0)
    241 static	void ath_printrxbuf(struct ath_buf *bf, int);
    242 static	void ath_printtxbuf(struct ath_buf *bf, int);
    243 #else
    244 #define	IFF_DUMPPKTS(sc, m) \
    245 	((sc->sc_ifp->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
    246 #define	DPRINTF(m, fmt, ...)
    247 #define	KEYPRINTF(sc, k, ix, mac)
    248 #endif
    249 
    250 MALLOC_DEFINE(M_ATHDEV, "athdev", "ath driver dma buffers");
    251 
    252 int
    253 ath_attach(u_int16_t devid, struct ath_softc *sc)
    254 {
    255 	struct ifnet *ifp;
    256 	struct ieee80211com *ic = &sc->sc_ic;
    257 	struct ath_hal *ah = NULL;
    258 	HAL_STATUS status;
    259 	int error = 0, i;
    260 
    261 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: devid 0x%x\n", __func__, devid);
    262 
    263 	ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
    264 	if (ifp == NULL) {
    265 		device_printf(sc->sc_dev, "can not if_alloc()\n");
    266 		error = ENOSPC;
    267 		goto bad;
    268 	}
    269 
    270 	/* set these up early for if_printf use */
    271 	if_initname(ifp, device_get_name(sc->sc_dev),
    272 		device_get_unit(sc->sc_dev));
    273 
    274 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
    275 	if (ah == NULL) {
    276 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
    277 			status);
    278 		error = ENXIO;
    279 		goto bad;
    280 	}
    281 	if (ah->ah_abi != HAL_ABI_VERSION) {
    282 		if_printf(ifp, "HAL ABI mismatch detected "
    283 			"(HAL:0x%x != driver:0x%x)\n",
    284 			ah->ah_abi, HAL_ABI_VERSION);
    285 		error = ENXIO;
    286 		goto bad;
    287 	}
    288 	sc->sc_ah = ah;
    289 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
    290 
    291 	/*
    292 	 * Check if the MAC has multi-rate retry support.
    293 	 * We do this by trying to setup a fake extended
    294 	 * descriptor.  MAC's that don't have support will
    295 	 * return false w/o doing anything.  MAC's that do
    296 	 * support it will return true w/o doing anything.
    297 	 */
    298 	sc->sc_mrretry = ath_hal_setupxtxdesc(ah, NULL, 0,0, 0,0, 0,0);
    299 
    300 	/*
    301 	 * Check if the device has hardware counters for PHY
    302 	 * errors.  If so we need to enable the MIB interrupt
    303 	 * so we can act on stat triggers.
    304 	 */
    305 	if (ath_hal_hwphycounters(ah))
    306 		sc->sc_needmib = 1;
    307 
    308 	/*
    309 	 * Get the hardware key cache size.
    310 	 */
    311 	sc->sc_keymax = ath_hal_keycachesize(ah);
    312 	if (sc->sc_keymax > ATH_KEYMAX) {
    313 		if_printf(ifp, "Warning, using only %u of %u key cache slots\n",
    314 			ATH_KEYMAX, sc->sc_keymax);
    315 		sc->sc_keymax = ATH_KEYMAX;
    316 	}
    317 	/*
    318 	 * Reset the key cache since some parts do not
    319 	 * reset the contents on initial power up.
    320 	 */
    321 	for (i = 0; i < sc->sc_keymax; i++)
    322 		ath_hal_keyreset(ah, i);
    323 	/*
    324 	 * Mark key cache slots associated with global keys
    325 	 * as in use.  If we knew TKIP was not to be used we
    326 	 * could leave the +32, +64, and +32+64 slots free.
    327 	 * XXX only for splitmic.
    328 	 */
    329 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
    330 		setbit(sc->sc_keymap, i);
    331 		setbit(sc->sc_keymap, i+32);
    332 		setbit(sc->sc_keymap, i+64);
    333 		setbit(sc->sc_keymap, i+32+64);
    334 	}
    335 
    336 	/*
    337 	 * Collect the channel list using the default country
    338 	 * code and including outdoor channels.  The 802.11 layer
    339 	 * is resposible for filtering this list based on settings
    340 	 * like the phy mode.
    341 	 */
    342 	error = ath_getchannels(sc, ath_countrycode,
    343 			ath_outdoor, ath_xchanmode);
    344 	if (error != 0)
    345 		goto bad;
    346 	/*
    347 	 * Setup dynamic sysctl's now that country code and
    348 	 * regdomain are available from the hal.
    349 	 */
    350 	ath_sysctlattach(sc);
    351 
    352 	/*
    353 	 * Setup rate tables for all potential media types.
    354 	 */
    355 	ath_rate_setup(sc, IEEE80211_MODE_11A);
    356 	ath_rate_setup(sc, IEEE80211_MODE_11B);
    357 	ath_rate_setup(sc, IEEE80211_MODE_11G);
    358 	ath_rate_setup(sc, IEEE80211_MODE_TURBO_A);
    359 	ath_rate_setup(sc, IEEE80211_MODE_TURBO_G);
    360 	/* NB: setup here so ath_rate_update is happy */
    361 	ath_setcurmode(sc, IEEE80211_MODE_11A);
    362 
    363 	/*
    364 	 * Allocate tx+rx descriptors and populate the lists.
    365 	 */
    366 	error = ath_desc_alloc(sc);
    367 	if (error != 0) {
    368 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
    369 		goto bad;
    370 	}
    371 	callout_init(&sc->sc_scan_ch, debug_mpsafenet ? CALLOUT_MPSAFE : 0);
    372 	callout_init(&sc->sc_cal_ch, CALLOUT_MPSAFE);
    373 
    374 	ATH_TXBUF_LOCK_INIT(sc);
    375 
    376 	TASK_INIT(&sc->sc_rxtask, 0, ath_rx_proc, sc);
    377 	TASK_INIT(&sc->sc_rxorntask, 0, ath_rxorn_proc, sc);
    378 	TASK_INIT(&sc->sc_fataltask, 0, ath_fatal_proc, sc);
    379 	TASK_INIT(&sc->sc_bmisstask, 0, ath_bmiss_proc, sc);
    380 	TASK_INIT(&sc->sc_bstucktask, 0, ath_bstuck_proc, sc);
    381 
    382 	/*
    383 	 * Allocate hardware transmit queues: one queue for
    384 	 * beacon frames and one data queue for each QoS
    385 	 * priority.  Note that the hal handles reseting
    386 	 * these queues at the needed time.
    387 	 *
    388 	 * XXX PS-Poll
    389 	 */
    390 	sc->sc_bhalq = ath_beaconq_setup(ah);
    391 	if (sc->sc_bhalq == (u_int) -1) {
    392 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
    393 		error = EIO;
    394 		goto bad2;
    395 	}
    396 	sc->sc_cabq = ath_txq_setup(sc, HAL_TX_QUEUE_CAB, 0);
    397 	if (sc->sc_cabq == NULL) {
    398 		if_printf(ifp, "unable to setup CAB xmit queue!\n");
    399 		error = EIO;
    400 		goto bad2;
    401 	}
    402 	/* NB: insure BK queue is the lowest priority h/w queue */
    403 	if (!ath_tx_setup(sc, WME_AC_BK, HAL_WME_AC_BK)) {
    404 		if_printf(ifp, "unable to setup xmit queue for %s traffic!\n",
    405 			ieee80211_wme_acnames[WME_AC_BK]);
    406 		error = EIO;
    407 		goto bad2;
    408 	}
    409 	if (!ath_tx_setup(sc, WME_AC_BE, HAL_WME_AC_BE) ||
    410 	    !ath_tx_setup(sc, WME_AC_VI, HAL_WME_AC_VI) ||
    411 	    !ath_tx_setup(sc, WME_AC_VO, HAL_WME_AC_VO)) {
    412 		/*
    413 		 * Not enough hardware tx queues to properly do WME;
    414 		 * just punt and assign them all to the same h/w queue.
    415 		 * We could do a better job of this if, for example,
    416 		 * we allocate queues when we switch from station to
    417 		 * AP mode.
    418 		 */
    419 		if (sc->sc_ac2q[WME_AC_VI] != NULL)
    420 			ath_tx_cleanupq(sc, sc->sc_ac2q[WME_AC_VI]);
    421 		if (sc->sc_ac2q[WME_AC_BE] != NULL)
    422 			ath_tx_cleanupq(sc, sc->sc_ac2q[WME_AC_BE]);
    423 		sc->sc_ac2q[WME_AC_BE] = sc->sc_ac2q[WME_AC_BK];
    424 		sc->sc_ac2q[WME_AC_VI] = sc->sc_ac2q[WME_AC_BK];
    425 		sc->sc_ac2q[WME_AC_VO] = sc->sc_ac2q[WME_AC_BK];
    426 	}
    427 
    428 	/*
    429 	 * Special case certain configurations.  Note the
    430 	 * CAB queue is handled by these specially so don't
    431 	 * include them when checking the txq setup mask.
    432 	 */
    433 	switch (sc->sc_txqsetup &~ (1<<sc->sc_cabq->axq_qnum)) {
    434 	case 0x01:
    435 		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc_q0, sc);
    436 		break;
    437 	case 0x0f:
    438 		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc_q0123, sc);
    439 		break;
    440 	default:
    441 		TASK_INIT(&sc->sc_txtask, 0, ath_tx_proc, sc);
    442 		break;
    443 	}
    444 
    445 	/*
    446 	 * Setup rate control.  Some rate control modules
    447 	 * call back to change the anntena state so expose
    448 	 * the necessary entry points.
    449 	 * XXX maybe belongs in struct ath_ratectrl?
    450 	 */
    451 	sc->sc_setdefantenna = ath_setdefantenna;
    452 	sc->sc_rc = ath_rate_attach(sc);
    453 	if (sc->sc_rc == NULL) {
    454 		error = EIO;
    455 		goto bad2;
    456 	}
    457 
    458 	sc->sc_blinking = 0;
    459 	sc->sc_ledstate = 1;
    460 	sc->sc_ledon = 0;			/* low true */
    461 	sc->sc_ledidle = (2700*hz)/1000;	/* 2.7sec */
    462 	callout_init(&sc->sc_ledtimer, CALLOUT_MPSAFE);
    463 	/*
    464 	 * Auto-enable soft led processing for IBM cards and for
    465 	 * 5211 minipci cards.  Users can also manually enable/disable
    466 	 * support with a sysctl.
    467 	 */
    468 	sc->sc_softled = (devid == AR5212_DEVID_IBM || devid == AR5211_DEVID);
    469 	if (sc->sc_softled) {
    470 		ath_hal_gpioCfgOutput(ah, sc->sc_ledpin);
    471 		ath_hal_gpioset(ah, sc->sc_ledpin, !sc->sc_ledon);
    472 	}
    473 
    474 	ifp->if_softc = sc;
    475 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
    476 	ifp->if_start = ath_start;
    477 	ifp->if_watchdog = ath_watchdog;
    478 	ifp->if_ioctl = ath_ioctl;
    479 	ifp->if_init = ath_init;
    480 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
    481 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
    482 	IFQ_SET_READY(&ifp->if_snd);
    483 
    484 	ic->ic_ifp = ifp;
    485 	ic->ic_reset = ath_reset;
    486 	ic->ic_newassoc = ath_newassoc;
    487 	ic->ic_updateslot = ath_updateslot;
    488 	ic->ic_wme.wme_update = ath_wme_update;
    489 	/* XXX not right but it's not used anywhere important */
    490 	ic->ic_phytype = IEEE80211_T_OFDM;
    491 	ic->ic_opmode = IEEE80211_M_STA;
    492 	ic->ic_caps =
    493 		  IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
    494 		| IEEE80211_C_HOSTAP		/* hostap mode */
    495 		| IEEE80211_C_MONITOR		/* monitor mode */
    496 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
    497 		| IEEE80211_C_SHSLOT		/* short slot time supported */
    498 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
    499 		;
    500 	/*
    501 	 * Query the hal to figure out h/w crypto support.
    502 	 */
    503 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_WEP))
    504 		ic->ic_caps |= IEEE80211_C_WEP;
    505 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_OCB))
    506 		ic->ic_caps |= IEEE80211_C_AES;
    507 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_CCM))
    508 		ic->ic_caps |= IEEE80211_C_AES_CCM;
    509 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_CKIP))
    510 		ic->ic_caps |= IEEE80211_C_CKIP;
    511 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_TKIP)) {
    512 		ic->ic_caps |= IEEE80211_C_TKIP;
    513 		/*
    514 		 * Check if h/w does the MIC and/or whether the
    515 		 * separate key cache entries are required to
    516 		 * handle both tx+rx MIC keys.
    517 		 */
    518 		if (ath_hal_ciphersupported(ah, HAL_CIPHER_MIC))
    519 			ic->ic_caps |= IEEE80211_C_TKIPMIC;
    520 		if (ath_hal_tkipsplit(ah))
    521 			sc->sc_splitmic = 1;
    522 	}
    523 	sc->sc_hasclrkey = ath_hal_ciphersupported(ah, HAL_CIPHER_CLR);
    524 	sc->sc_mcastkey = ath_hal_getmcastkeysearch(ah);
    525 	/*
    526 	 * TPC support can be done either with a global cap or
    527 	 * per-packet support.  The latter is not available on
    528 	 * all parts.  We're a bit pedantic here as all parts
    529 	 * support a global cap.
    530 	 */
    531 	sc->sc_hastpc = ath_hal_hastpc(ah);
    532 	if (sc->sc_hastpc || ath_hal_hastxpowlimit(ah))
    533 		ic->ic_caps |= IEEE80211_C_TXPMGT;
    534 
    535 	/*
    536 	 * Mark WME capability only if we have sufficient
    537 	 * hardware queues to do proper priority scheduling.
    538 	 */
    539 	if (sc->sc_ac2q[WME_AC_BE] != sc->sc_ac2q[WME_AC_BK])
    540 		ic->ic_caps |= IEEE80211_C_WME;
    541 	/*
    542 	 * Check for misc other capabilities.
    543 	 */
    544 	if (ath_hal_hasbursting(ah))
    545 		ic->ic_caps |= IEEE80211_C_BURST;
    546 
    547 	/*
    548 	 * Indicate we need the 802.11 header padded to a
    549 	 * 32-bit boundary for 4-address and QoS frames.
    550 	 */
    551 	ic->ic_flags |= IEEE80211_F_DATAPAD;
    552 
    553 	/*
    554 	 * Query the hal about antenna support.
    555 	 */
    556 	if (ath_hal_hasdiversity(ah)) {
    557 		sc->sc_hasdiversity = 1;
    558 		sc->sc_diversity = ath_hal_getdiversity(ah);
    559 	}
    560 	sc->sc_defant = ath_hal_getdefantenna(ah);
    561 
    562 	/*
    563 	 * Not all chips have the VEOL support we want to
    564 	 * use with IBSS beacons; check here for it.
    565 	 */
    566 	sc->sc_hasveol = ath_hal_hasveol(ah);
    567 
    568 	/* get mac address from hardware */
    569 	ath_hal_getmac(ah, ic->ic_myaddr);
    570 
    571 	/* call MI attach routine. */
    572 	ieee80211_ifattach(ic);
    573 	/* override default methods */
    574 	ic->ic_node_alloc = ath_node_alloc;
    575 	sc->sc_node_free = ic->ic_node_free;
    576 	ic->ic_node_free = ath_node_free;
    577 	ic->ic_node_getrssi = ath_node_getrssi;
    578 	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
    579 	ic->ic_recv_mgmt = ath_recv_mgmt;
    580 	sc->sc_newstate = ic->ic_newstate;
    581 	ic->ic_newstate = ath_newstate;
    582 	ic->ic_crypto.cs_key_alloc = ath_key_alloc;
    583 	ic->ic_crypto.cs_key_delete = ath_key_delete;
    584 	ic->ic_crypto.cs_key_set = ath_key_set;
    585 	ic->ic_crypto.cs_key_update_begin = ath_key_update_begin;
    586 	ic->ic_crypto.cs_key_update_end = ath_key_update_end;
    587 	/* complete initialization */
    588 	ieee80211_media_init(ic, ath_media_change, ieee80211_media_status);
    589 
    590 	ath_bpfattach(sc);
    591 
    592 	if (bootverbose)
    593 		ieee80211_announce(ic);
    594 	ath_announce(sc);
    595 	return 0;
    596 bad2:
    597 	ath_tx_cleanup(sc);
    598 	ath_desc_free(sc);
    599 bad:
    600 	if (ah)
    601 		ath_hal_detach(ah);
    602 	if (ifp != NULL)
    603 		if_free(ifp);
    604 	sc->sc_invalid = 1;
    605 	return error;
    606 }
    607 
    608 int
    609 ath_detach(struct ath_softc *sc)
    610 {
    611 	struct ifnet *ifp = sc->sc_ifp;
    612 
    613 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
    614 		__func__, ifp->if_flags);
    615 
    616 	ath_stop(ifp);
    617 	bpfdetach(ifp);
    618 	/*
    619 	 * NB: the order of these is important:
    620 	 * o call the 802.11 layer before detaching the hal to
    621 	 *   insure callbacks into the driver to delete global
    622 	 *   key cache entries can be handled
    623 	 * o reclaim the tx queue data structures after calling
    624 	 *   the 802.11 layer as we'll get called back to reclaim
    625 	 *   node state and potentially want to use them
    626 	 * o to cleanup the tx queues the hal is called, so detach
    627 	 *   it last
    628 	 * Other than that, it's straightforward...
    629 	 */
    630 	ieee80211_ifdetach(&sc->sc_ic);
    631 	ath_rate_detach(sc->sc_rc);
    632 	ath_desc_free(sc);
    633 	ath_tx_cleanup(sc);
    634 	ath_hal_detach(sc->sc_ah);
    635 
    636 	return 0;
    637 }
    638 
    639 void
    640 ath_suspend(struct ath_softc *sc)
    641 {
    642 	struct ifnet *ifp = sc->sc_ifp;
    643 
    644 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
    645 		__func__, ifp->if_flags);
    646 
    647 	ath_stop(ifp);
    648 }
    649 
    650 void
    651 ath_resume(struct ath_softc *sc)
    652 {
    653 	struct ifnet *ifp = sc->sc_ifp;
    654 
    655 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
    656 		__func__, ifp->if_flags);
    657 
    658 	if (ifp->if_flags & IFF_UP) {
    659 		ath_init(sc);
    660 		if (ifp->if_flags & IFF_RUNNING)
    661 			ath_start(ifp);
    662 	}
    663 	if (sc->sc_softled) {
    664 		ath_hal_gpioCfgOutput(sc->sc_ah, sc->sc_ledpin);
    665 		ath_hal_gpioset(sc->sc_ah, sc->sc_ledpin, !sc->sc_ledon);
    666 	}
    667 }
    668 
    669 void
    670 ath_shutdown(struct ath_softc *sc)
    671 {
    672 	struct ifnet *ifp = sc->sc_ifp;
    673 
    674 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags %x\n",
    675 		__func__, ifp->if_flags);
    676 
    677 	ath_stop(ifp);
    678 }
    679 
    680 /*
    681  * Interrupt handler.  Most of the actual processing is deferred.
    682  */
    683 void
    684 ath_intr(void *arg)
    685 {
    686 	struct ath_softc *sc = arg;
    687 	struct ifnet *ifp = sc->sc_ifp;
    688 	struct ath_hal *ah = sc->sc_ah;
    689 	HAL_INT status;
    690 
    691 	if (sc->sc_invalid) {
    692 		/*
    693 		 * The hardware is not ready/present, don't touch anything.
    694 		 * Note this can happen early on if the IRQ is shared.
    695 		 */
    696 		DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid; ignored\n", __func__);
    697 		return;
    698 	}
    699 	if (!ath_hal_intrpend(ah))		/* shared irq, not for us */
    700 		return;
    701 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
    702 		DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
    703 			__func__, ifp->if_flags);
    704 		ath_hal_getisr(ah, &status);	/* clear ISR */
    705 		ath_hal_intrset(ah, 0);		/* disable further intr's */
    706 		return;
    707 	}
    708 	/*
    709 	 * Figure out the reason(s) for the interrupt.  Note
    710 	 * that the hal returns a pseudo-ISR that may include
    711 	 * bits we haven't explicitly enabled so we mask the
    712 	 * value to insure we only process bits we requested.
    713 	 */
    714 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
    715 	DPRINTF(sc, ATH_DEBUG_INTR, "%s: status 0x%x\n", __func__, status);
    716 	status &= sc->sc_imask;			/* discard unasked for bits */
    717 	if (status & HAL_INT_FATAL) {
    718 		/*
    719 		 * Fatal errors are unrecoverable.  Typically
    720 		 * these are caused by DMA errors.  Unfortunately
    721 		 * the exact reason is not (presently) returned
    722 		 * by the hal.
    723 		 */
    724 		sc->sc_stats.ast_hardware++;
    725 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
    726 		taskqueue_enqueue(taskqueue_swi, &sc->sc_fataltask);
    727 	} else if (status & HAL_INT_RXORN) {
    728 		sc->sc_stats.ast_rxorn++;
    729 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
    730 		taskqueue_enqueue(taskqueue_swi, &sc->sc_rxorntask);
    731 	} else {
    732 		if (status & HAL_INT_SWBA) {
    733 			/*
    734 			 * Software beacon alert--time to send a beacon.
    735 			 * Handle beacon transmission directly; deferring
    736 			 * this is too slow to meet timing constraints
    737 			 * under load.
    738 			 */
    739 			ath_beacon_proc(sc, 0);
    740 		}
    741 		if (status & HAL_INT_RXEOL) {
    742 			/*
    743 			 * NB: the hardware should re-read the link when
    744 			 *     RXE bit is written, but it doesn't work at
    745 			 *     least on older hardware revs.
    746 			 */
    747 			sc->sc_stats.ast_rxeol++;
    748 			sc->sc_rxlink = NULL;
    749 		}
    750 		if (status & HAL_INT_TXURN) {
    751 			sc->sc_stats.ast_txurn++;
    752 			/* bump tx trigger level */
    753 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
    754 		}
    755 		if (status & HAL_INT_RX)
    756 			taskqueue_enqueue(taskqueue_swi, &sc->sc_rxtask);
    757 		if (status & HAL_INT_TX)
    758 			taskqueue_enqueue(taskqueue_swi, &sc->sc_txtask);
    759 		if (status & HAL_INT_BMISS) {
    760 			sc->sc_stats.ast_bmiss++;
    761 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bmisstask);
    762 		}
    763 		if (status & HAL_INT_MIB) {
    764 			sc->sc_stats.ast_mib++;
    765 			/*
    766 			 * Disable interrupts until we service the MIB
    767 			 * interrupt; otherwise it will continue to fire.
    768 			 */
    769 			ath_hal_intrset(ah, 0);
    770 			/*
    771 			 * Let the hal handle the event.  We assume it will
    772 			 * clear whatever condition caused the interrupt.
    773 			 */
    774 			ath_hal_mibevent(ah,
    775 				&ATH_NODE(sc->sc_ic.ic_bss)->an_halstats);
    776 			ath_hal_intrset(ah, sc->sc_imask);
    777 		}
    778 	}
    779 }
    780 
    781 static void
    782 ath_fatal_proc(void *arg, int pending)
    783 {
    784 	struct ath_softc *sc = arg;
    785 	struct ifnet *ifp = sc->sc_ifp;
    786 
    787 	if_printf(ifp, "hardware error; resetting\n");
    788 	ath_reset(ifp);
    789 }
    790 
    791 static void
    792 ath_rxorn_proc(void *arg, int pending)
    793 {
    794 	struct ath_softc *sc = arg;
    795 	struct ifnet *ifp = sc->sc_ifp;
    796 
    797 	if_printf(ifp, "rx FIFO overrun; resetting\n");
    798 	ath_reset(ifp);
    799 }
    800 
    801 static void
    802 ath_bmiss_proc(void *arg, int pending)
    803 {
    804 	struct ath_softc *sc = arg;
    805 	struct ieee80211com *ic = &sc->sc_ic;
    806 
    807 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: pending %u\n", __func__, pending);
    808 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
    809 		("unexpect operating mode %u", ic->ic_opmode));
    810 	if (ic->ic_state == IEEE80211_S_RUN) {
    811 		/*
    812 		 * Rather than go directly to scan state, try to
    813 		 * reassociate first.  If that fails then the state
    814 		 * machine will drop us into scanning after timing
    815 		 * out waiting for a probe response.
    816 		 */
    817 		NET_LOCK_GIANT();
    818 		ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
    819 		NET_UNLOCK_GIANT();
    820 	}
    821 }
    822 
    823 static u_int
    824 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
    825 {
    826 #define	N(a)	(sizeof(a) / sizeof(a[0]))
    827 	static const u_int modeflags[] = {
    828 		0,			/* IEEE80211_MODE_AUTO */
    829 		CHANNEL_A,		/* IEEE80211_MODE_11A */
    830 		CHANNEL_B,		/* IEEE80211_MODE_11B */
    831 		CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
    832 		0,			/* IEEE80211_MODE_FH */
    833 		CHANNEL_T,		/* IEEE80211_MODE_TURBO_A */
    834 		CHANNEL_108G		/* IEEE80211_MODE_TURBO_G */
    835 	};
    836 	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
    837 
    838 	KASSERT(mode < N(modeflags), ("unexpected phy mode %u", mode));
    839 	KASSERT(modeflags[mode] != 0, ("mode %u undefined", mode));
    840 	return modeflags[mode];
    841 #undef N
    842 }
    843 
    844 static void
    845 ath_init(void *arg)
    846 {
    847 	struct ath_softc *sc = (struct ath_softc *) arg;
    848 	struct ieee80211com *ic = &sc->sc_ic;
    849 	struct ifnet *ifp = sc->sc_ifp;
    850 	struct ieee80211_node *ni;
    851 	struct ath_hal *ah = sc->sc_ah;
    852 	HAL_STATUS status;
    853 
    854 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
    855 		__func__, ifp->if_flags);
    856 
    857 	ATH_LOCK(sc);
    858 	/*
    859 	 * Stop anything previously setup.  This is safe
    860 	 * whether this is the first time through or not.
    861 	 */
    862 	ath_stop_locked(ifp);
    863 
    864 	/*
    865 	 * The basic interface to setting the hardware in a good
    866 	 * state is ``reset''.  On return the hardware is known to
    867 	 * be powered up and with interrupts disabled.  This must
    868 	 * be followed by initialization of the appropriate bits
    869 	 * and then setup of the interrupt mask.
    870 	 */
    871 	sc->sc_curchan.channel = ic->ic_ibss_chan->ic_freq;
    872 	sc->sc_curchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
    873 	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_FALSE, &status)) {
    874 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
    875 			status);
    876 		goto done;
    877 	}
    878 
    879 	/*
    880 	 * This is needed only to setup initial state
    881 	 * but it's best done after a reset.
    882 	 */
    883 	ath_update_txpow(sc);
    884 
    885 	/*
    886 	 * Setup the hardware after reset: the key cache
    887 	 * is filled as needed and the receive engine is
    888 	 * set going.  Frame transmit is handled entirely
    889 	 * in the frame output path; there's nothing to do
    890 	 * here except setup the interrupt mask.
    891 	 */
    892 	if (ath_startrecv(sc) != 0) {
    893 		if_printf(ifp, "unable to start recv logic\n");
    894 		goto done;
    895 	}
    896 
    897 	/*
    898 	 * Enable interrupts.
    899 	 */
    900 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
    901 		  | HAL_INT_RXEOL | HAL_INT_RXORN
    902 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
    903 	/*
    904 	 * Enable MIB interrupts when there are hardware phy counters.
    905 	 * Note we only do this (at the moment) for station mode.
    906 	 */
    907 	if (sc->sc_needmib && ic->ic_opmode == IEEE80211_M_STA)
    908 		sc->sc_imask |= HAL_INT_MIB;
    909 	ath_hal_intrset(ah, sc->sc_imask);
    910 
    911 	ifp->if_flags |= IFF_RUNNING;
    912 	ic->ic_state = IEEE80211_S_INIT;
    913 
    914 	/*
    915 	 * The hardware should be ready to go now so it's safe
    916 	 * to kick the 802.11 state machine as it's likely to
    917 	 * immediately call back to us to send mgmt frames.
    918 	 */
    919 	ni = ic->ic_bss;
    920 	ni->ni_chan = ic->ic_ibss_chan;
    921 	ath_chan_change(sc, ni->ni_chan);
    922 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
    923 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
    924 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    925 	} else
    926 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
    927 done:
    928 	ATH_UNLOCK(sc);
    929 }
    930 
    931 static void
    932 ath_stop_locked(struct ifnet *ifp)
    933 {
    934 	struct ath_softc *sc = ifp->if_softc;
    935 	struct ieee80211com *ic = &sc->sc_ic;
    936 	struct ath_hal *ah = sc->sc_ah;
    937 
    938 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid %u if_flags 0x%x\n",
    939 		__func__, sc->sc_invalid, ifp->if_flags);
    940 
    941 	ATH_LOCK_ASSERT(sc);
    942 	if (ifp->if_flags & IFF_RUNNING) {
    943 		/*
    944 		 * Shutdown the hardware and driver:
    945 		 *    reset 802.11 state machine
    946 		 *    turn off timers
    947 		 *    disable interrupts
    948 		 *    turn off the radio
    949 		 *    clear transmit machinery
    950 		 *    clear receive machinery
    951 		 *    drain and release tx queues
    952 		 *    reclaim beacon resources
    953 		 *    power down hardware
    954 		 *
    955 		 * Note that some of this work is not possible if the
    956 		 * hardware is gone (invalid).
    957 		 */
    958 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
    959 		ifp->if_flags &= ~IFF_RUNNING;
    960 		ifp->if_timer = 0;
    961 		if (!sc->sc_invalid) {
    962 			if (sc->sc_softled) {
    963 				callout_stop(&sc->sc_ledtimer);
    964 				ath_hal_gpioset(ah, sc->sc_ledpin,
    965 					!sc->sc_ledon);
    966 				sc->sc_blinking = 0;
    967 			}
    968 			ath_hal_intrset(ah, 0);
    969 		}
    970 		ath_draintxq(sc);
    971 		if (!sc->sc_invalid) {
    972 			ath_stoprecv(sc);
    973 			ath_hal_phydisable(ah);
    974 		} else
    975 			sc->sc_rxlink = NULL;
    976 		IFQ_DRV_PURGE(&ifp->if_snd);
    977 		ath_beacon_free(sc);
    978 	}
    979 }
    980 
    981 static void
    982 ath_stop(struct ifnet *ifp)
    983 {
    984 	struct ath_softc *sc = ifp->if_softc;
    985 
    986 	ATH_LOCK(sc);
    987 	ath_stop_locked(ifp);
    988 	if (!sc->sc_invalid) {
    989 		/*
    990 		 * Set the chip in full sleep mode.  Note that we are
    991 		 * careful to do this only when bringing the interface
    992 		 * completely to a stop.  When the chip is in this state
    993 		 * it must be carefully woken up or references to
    994 		 * registers in the PCI clock domain may freeze the bus
    995 		 * (and system).  This varies by chip and is mostly an
    996 		 * issue with newer parts that go to sleep more quickly.
    997 		 */
    998 		ath_hal_setpower(sc->sc_ah, HAL_PM_FULL_SLEEP, 0);
    999 	}
   1000 	ATH_UNLOCK(sc);
   1001 }
   1002 
   1003 /*
   1004  * Reset the hardware w/o losing operational state.  This is
   1005  * basically a more efficient way of doing ath_stop, ath_init,
   1006  * followed by state transitions to the current 802.11
   1007  * operational state.  Used to recover from various errors and
   1008  * to reset or reload hardware state.
   1009  */
   1010 static int
   1011 ath_reset(struct ifnet *ifp)
   1012 {
   1013 	struct ath_softc *sc = ifp->if_softc;
   1014 	struct ieee80211com *ic = &sc->sc_ic;
   1015 	struct ath_hal *ah = sc->sc_ah;
   1016 	struct ieee80211_channel *c;
   1017 	HAL_STATUS status;
   1018 
   1019 	/*
   1020 	 * Convert to a HAL channel description with the flags
   1021 	 * constrained to reflect the current operating mode.
   1022 	 */
   1023 	c = ic->ic_ibss_chan;
   1024 	sc->sc_curchan.channel = c->ic_freq;
   1025 	sc->sc_curchan.channelFlags = ath_chan2flags(ic, c);
   1026 
   1027 	ath_hal_intrset(ah, 0);		/* disable interrupts */
   1028 	ath_draintxq(sc);		/* stop xmit side */
   1029 	ath_stoprecv(sc);		/* stop recv side */
   1030 	/* NB: indicate channel change so we do a full reset */
   1031 	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_TRUE, &status))
   1032 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
   1033 			__func__, status);
   1034 	ath_update_txpow(sc);		/* update tx power state */
   1035 	if (ath_startrecv(sc) != 0)	/* restart recv */
   1036 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
   1037 	/*
   1038 	 * We may be doing a reset in response to an ioctl
   1039 	 * that changes the channel so update any state that
   1040 	 * might change as a result.
   1041 	 */
   1042 	ath_chan_change(sc, c);
   1043 	if (ic->ic_state == IEEE80211_S_RUN)
   1044 		ath_beacon_config(sc);	/* restart beacons */
   1045 	ath_hal_intrset(ah, sc->sc_imask);
   1046 
   1047 	ath_start(ifp);			/* restart xmit */
   1048 	return 0;
   1049 }
   1050 
   1051 static void
   1052 ath_start(struct ifnet *ifp)
   1053 {
   1054 	struct ath_softc *sc = ifp->if_softc;
   1055 	struct ath_hal *ah = sc->sc_ah;
   1056 	struct ieee80211com *ic = &sc->sc_ic;
   1057 	struct ieee80211_node *ni;
   1058 	struct ath_buf *bf;
   1059 	struct mbuf *m;
   1060 	struct ieee80211_frame *wh;
   1061 	struct ether_header *eh;
   1062 
   1063 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
   1064 		return;
   1065 	for (;;) {
   1066 		/*
   1067 		 * Grab a TX buffer and associated resources.
   1068 		 */
   1069 		ATH_TXBUF_LOCK(sc);
   1070 		bf = STAILQ_FIRST(&sc->sc_txbuf);
   1071 		if (bf != NULL)
   1072 			STAILQ_REMOVE_HEAD(&sc->sc_txbuf, bf_list);
   1073 		ATH_TXBUF_UNLOCK(sc);
   1074 		if (bf == NULL) {
   1075 			DPRINTF(sc, ATH_DEBUG_ANY, "%s: out of xmit buffers\n",
   1076 				__func__);
   1077 			sc->sc_stats.ast_tx_qstop++;
   1078 			ifp->if_flags |= IFF_OACTIVE;
   1079 			break;
   1080 		}
   1081 		/*
   1082 		 * Poll the management queue for frames; they
   1083 		 * have priority over normal data frames.
   1084 		 */
   1085 		IF_DEQUEUE(&ic->ic_mgtq, m);
   1086 		if (m == NULL) {
   1087 			/*
   1088 			 * No data frames go out unless we're associated.
   1089 			 */
   1090 			if (ic->ic_state != IEEE80211_S_RUN) {
   1091 				DPRINTF(sc, ATH_DEBUG_ANY,
   1092 					"%s: ignore data packet, state %u\n",
   1093 					__func__, ic->ic_state);
   1094 				sc->sc_stats.ast_tx_discard++;
   1095 				ATH_TXBUF_LOCK(sc);
   1096 				STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1097 				ATH_TXBUF_UNLOCK(sc);
   1098 				break;
   1099 			}
   1100 			IFQ_DRV_DEQUEUE(&ifp->if_snd, m);	/* XXX: LOCK */
   1101 			if (m == NULL) {
   1102 				ATH_TXBUF_LOCK(sc);
   1103 				STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1104 				ATH_TXBUF_UNLOCK(sc);
   1105 				break;
   1106 			}
   1107 			/*
   1108 			 * Find the node for the destination so we can do
   1109 			 * things like power save and fast frames aggregation.
   1110 			 */
   1111 			if (m->m_len < sizeof(struct ether_header) &&
   1112 			   (m = m_pullup(m, sizeof(struct ether_header))) == NULL) {
   1113 				ic->ic_stats.is_tx_nobuf++;	/* XXX */
   1114 				ni = NULL;
   1115 				goto bad;
   1116 			}
   1117 			eh = mtod(m, struct ether_header *);
   1118 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
   1119 			if (ni == NULL) {
   1120 				/* NB: ieee80211_find_txnode does stat+msg */
   1121 				m_freem(m);
   1122 				goto bad;
   1123 			}
   1124 			if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) &&
   1125 			    (m->m_flags & M_PWR_SAV) == 0) {
   1126 				/*
   1127 				 * Station in power save mode; pass the frame
   1128 				 * to the 802.11 layer and continue.  We'll get
   1129 				 * the frame back when the time is right.
   1130 				 */
   1131 				ieee80211_pwrsave(ic, ni, m);
   1132 				goto reclaim;
   1133 			}
   1134 			/* calculate priority so we can find the tx queue */
   1135 			if (ieee80211_classify(ic, m, ni)) {
   1136 				DPRINTF(sc, ATH_DEBUG_XMIT,
   1137 					"%s: discard, classification failure\n",
   1138 					__func__);
   1139 				m_freem(m);
   1140 				goto bad;
   1141 			}
   1142 			ifp->if_opackets++;
   1143 			BPF_MTAP(ifp, m);
   1144 			/*
   1145 			 * Encapsulate the packet in prep for transmission.
   1146 			 */
   1147 			m = ieee80211_encap(ic, m, ni);
   1148 			if (m == NULL) {
   1149 				DPRINTF(sc, ATH_DEBUG_ANY,
   1150 					"%s: encapsulation failure\n",
   1151 					__func__);
   1152 				sc->sc_stats.ast_tx_encap++;
   1153 				goto bad;
   1154 			}
   1155 		} else {
   1156 			/*
   1157 			 * Hack!  The referenced node pointer is in the
   1158 			 * rcvif field of the packet header.  This is
   1159 			 * placed there by ieee80211_mgmt_output because
   1160 			 * we need to hold the reference with the frame
   1161 			 * and there's no other way (other than packet
   1162 			 * tags which we consider too expensive to use)
   1163 			 * to pass it along.
   1164 			 */
   1165 			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
   1166 			m->m_pkthdr.rcvif = NULL;
   1167 
   1168 			wh = mtod(m, struct ieee80211_frame *);
   1169 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
   1170 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
   1171 				/* fill time stamp */
   1172 				u_int64_t tsf;
   1173 				u_int32_t *tstamp;
   1174 
   1175 				tsf = ath_hal_gettsf64(ah);
   1176 				/* XXX: adjust 100us delay to xmit */
   1177 				tsf += 100;
   1178 				tstamp = (u_int32_t *)&wh[1];
   1179 				tstamp[0] = htole32(tsf & 0xffffffff);
   1180 				tstamp[1] = htole32(tsf >> 32);
   1181 			}
   1182 			sc->sc_stats.ast_tx_mgmt++;
   1183 		}
   1184 
   1185 		if (ath_tx_start(sc, ni, bf, m)) {
   1186 	bad:
   1187 			ifp->if_oerrors++;
   1188 	reclaim:
   1189 			ATH_TXBUF_LOCK(sc);
   1190 			STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1191 			ATH_TXBUF_UNLOCK(sc);
   1192 			if (ni != NULL)
   1193 				ieee80211_free_node(ni);
   1194 			continue;
   1195 		}
   1196 
   1197 		sc->sc_tx_timer = 5;
   1198 		ifp->if_timer = 1;
   1199 	}
   1200 }
   1201 
   1202 static int
   1203 ath_media_change(struct ifnet *ifp)
   1204 {
   1205 #define	IS_UP(ifp) \
   1206 	((ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
   1207 	int error;
   1208 
   1209 	error = ieee80211_media_change(ifp);
   1210 	if (error == ENETRESET) {
   1211 		if (IS_UP(ifp))
   1212 			ath_init(ifp->if_softc);	/* XXX lose error */
   1213 		error = 0;
   1214 	}
   1215 	return error;
   1216 #undef IS_UP
   1217 }
   1218 
   1219 #ifdef AR_DEBUG
   1220 static void
   1221 ath_keyprint(const char *tag, u_int ix,
   1222 	const HAL_KEYVAL *hk, const u_int8_t mac[IEEE80211_ADDR_LEN])
   1223 {
   1224 	static const char *ciphers[] = {
   1225 		"WEP",
   1226 		"AES-OCB",
   1227 		"AES-CCM",
   1228 		"CKIP",
   1229 		"TKIP",
   1230 		"CLR",
   1231 	};
   1232 	int i, n;
   1233 
   1234 	printf("%s: [%02u] %-7s ", tag, ix, ciphers[hk->kv_type]);
   1235 	for (i = 0, n = hk->kv_len; i < n; i++)
   1236 		printf("%02x", hk->kv_val[i]);
   1237 	printf(" mac %s", ether_sprintf(mac));
   1238 	if (hk->kv_type == HAL_CIPHER_TKIP) {
   1239 		printf(" mic ");
   1240 		for (i = 0; i < sizeof(hk->kv_mic); i++)
   1241 			printf("%02x", hk->kv_mic[i]);
   1242 	}
   1243 	printf("\n");
   1244 }
   1245 #endif
   1246 
   1247 /*
   1248  * Set a TKIP key into the hardware.  This handles the
   1249  * potential distribution of key state to multiple key
   1250  * cache slots for TKIP.
   1251  */
   1252 static int
   1253 ath_keyset_tkip(struct ath_softc *sc, const struct ieee80211_key *k,
   1254 	HAL_KEYVAL *hk, const u_int8_t mac[IEEE80211_ADDR_LEN])
   1255 {
   1256 #define	IEEE80211_KEY_XR	(IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV)
   1257 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
   1258 	struct ath_hal *ah = sc->sc_ah;
   1259 
   1260 	KASSERT(k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP,
   1261 		("got a non-TKIP key, cipher %u", k->wk_cipher->ic_cipher));
   1262 	KASSERT(sc->sc_splitmic, ("key cache !split"));
   1263 	if ((k->wk_flags & IEEE80211_KEY_XR) == IEEE80211_KEY_XR) {
   1264 		/*
   1265 		 * TX key goes at first index, RX key at +32.
   1266 		 * The hal handles the MIC keys at index+64.
   1267 		 */
   1268 		memcpy(hk->kv_mic, k->wk_txmic, sizeof(hk->kv_mic));
   1269 		KEYPRINTF(sc, k->wk_keyix, hk, zerobssid);
   1270 		if (!ath_hal_keyset(ah, k->wk_keyix, hk, zerobssid))
   1271 			return 0;
   1272 
   1273 		memcpy(hk->kv_mic, k->wk_rxmic, sizeof(hk->kv_mic));
   1274 		KEYPRINTF(sc, k->wk_keyix+32, hk, mac);
   1275 		/* XXX delete tx key on failure? */
   1276 		return ath_hal_keyset(ah, k->wk_keyix+32, hk, mac);
   1277 	} else if (k->wk_flags & IEEE80211_KEY_XR) {
   1278 		/*
   1279 		 * TX/RX key goes at first index.
   1280 		 * The hal handles the MIC keys are index+64.
   1281 		 */
   1282 		memcpy(hk->kv_mic, k->wk_flags & IEEE80211_KEY_XMIT ?
   1283 			k->wk_txmic : k->wk_rxmic, sizeof(hk->kv_mic));
   1284 		KEYPRINTF(sc, k->wk_keyix, hk, mac);
   1285 		return ath_hal_keyset(ah, k->wk_keyix, hk, mac);
   1286 	}
   1287 	return 0;
   1288 #undef IEEE80211_KEY_XR
   1289 }
   1290 
   1291 /*
   1292  * Set a net80211 key into the hardware.  This handles the
   1293  * potential distribution of key state to multiple key
   1294  * cache slots for TKIP with hardware MIC support.
   1295  */
   1296 static int
   1297 ath_keyset(struct ath_softc *sc, const struct ieee80211_key *k,
   1298 	const u_int8_t mac0[IEEE80211_ADDR_LEN],
   1299 	struct ieee80211_node *bss)
   1300 {
   1301 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   1302 	static const u_int8_t ciphermap[] = {
   1303 		HAL_CIPHER_WEP,		/* IEEE80211_CIPHER_WEP */
   1304 		HAL_CIPHER_TKIP,	/* IEEE80211_CIPHER_TKIP */
   1305 		HAL_CIPHER_AES_OCB,	/* IEEE80211_CIPHER_AES_OCB */
   1306 		HAL_CIPHER_AES_CCM,	/* IEEE80211_CIPHER_AES_CCM */
   1307 		(u_int8_t) -1,		/* 4 is not allocated */
   1308 		HAL_CIPHER_CKIP,	/* IEEE80211_CIPHER_CKIP */
   1309 		HAL_CIPHER_CLR,		/* IEEE80211_CIPHER_NONE */
   1310 	};
   1311 	struct ath_hal *ah = sc->sc_ah;
   1312 	const struct ieee80211_cipher *cip = k->wk_cipher;
   1313 	u_int8_t gmac[IEEE80211_ADDR_LEN];
   1314 	const u_int8_t *mac;
   1315 	HAL_KEYVAL hk;
   1316 
   1317 	memset(&hk, 0, sizeof(hk));
   1318 	/*
   1319 	 * Software crypto uses a "clear key" so non-crypto
   1320 	 * state kept in the key cache are maintained and
   1321 	 * so that rx frames have an entry to match.
   1322 	 */
   1323 	if ((k->wk_flags & IEEE80211_KEY_SWCRYPT) == 0) {
   1324 		KASSERT(cip->ic_cipher < N(ciphermap),
   1325 			("invalid cipher type %u", cip->ic_cipher));
   1326 		hk.kv_type = ciphermap[cip->ic_cipher];
   1327 		hk.kv_len = k->wk_keylen;
   1328 		memcpy(hk.kv_val, k->wk_key, k->wk_keylen);
   1329 	} else
   1330 		hk.kv_type = HAL_CIPHER_CLR;
   1331 
   1332 	if ((k->wk_flags & IEEE80211_KEY_GROUP) && sc->sc_mcastkey) {
   1333 		/*
   1334 		 * Group keys on hardware that supports multicast frame
   1335 		 * key search use a mac that is the sender's address with
   1336 		 * the high bit set instead of the app-specified address.
   1337 		 */
   1338 		IEEE80211_ADDR_COPY(gmac, bss->ni_macaddr);
   1339 		gmac[0] |= 0x80;
   1340 		mac = gmac;
   1341 	} else
   1342 		mac = mac0;
   1343 
   1344 	if (hk.kv_type == HAL_CIPHER_TKIP &&
   1345 	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 &&
   1346 	    sc->sc_splitmic) {
   1347 		return ath_keyset_tkip(sc, k, &hk, mac);
   1348 	} else {
   1349 		KEYPRINTF(sc, k->wk_keyix, &hk, mac);
   1350 		return ath_hal_keyset(ah, k->wk_keyix, &hk, mac);
   1351 	}
   1352 #undef N
   1353 }
   1354 
   1355 /*
   1356  * Allocate tx/rx key slots for TKIP.  We allocate two slots for
   1357  * each key, one for decrypt/encrypt and the other for the MIC.
   1358  */
   1359 static u_int16_t
   1360 key_alloc_2pair(struct ath_softc *sc)
   1361 {
   1362 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   1363 	u_int i, keyix;
   1364 
   1365 	KASSERT(sc->sc_splitmic, ("key cache !split"));
   1366 	/* XXX could optimize */
   1367 	for (i = 0; i < N(sc->sc_keymap)/4; i++) {
   1368 		u_int8_t b = sc->sc_keymap[i];
   1369 		if (b != 0xff) {
   1370 			/*
   1371 			 * One or more slots in this byte are free.
   1372 			 */
   1373 			keyix = i*NBBY;
   1374 			while (b & 1) {
   1375 		again:
   1376 				keyix++;
   1377 				b >>= 1;
   1378 			}
   1379 			/* XXX IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV */
   1380 			if (isset(sc->sc_keymap, keyix+32) ||
   1381 			    isset(sc->sc_keymap, keyix+64) ||
   1382 			    isset(sc->sc_keymap, keyix+32+64)) {
   1383 				/* full pair unavailable */
   1384 				/* XXX statistic */
   1385 				if (keyix == (i+1)*NBBY) {
   1386 					/* no slots were appropriate, advance */
   1387 					continue;
   1388 				}
   1389 				goto again;
   1390 			}
   1391 			setbit(sc->sc_keymap, keyix);
   1392 			setbit(sc->sc_keymap, keyix+64);
   1393 			setbit(sc->sc_keymap, keyix+32);
   1394 			setbit(sc->sc_keymap, keyix+32+64);
   1395 			DPRINTF(sc, ATH_DEBUG_KEYCACHE,
   1396 				"%s: key pair %u,%u %u,%u\n",
   1397 				__func__, keyix, keyix+64,
   1398 				keyix+32, keyix+32+64);
   1399 			return keyix;
   1400 		}
   1401 	}
   1402 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of pair space\n", __func__);
   1403 	return IEEE80211_KEYIX_NONE;
   1404 #undef N
   1405 }
   1406 
   1407 /*
   1408  * Allocate a single key cache slot.
   1409  */
   1410 static u_int16_t
   1411 key_alloc_single(struct ath_softc *sc)
   1412 {
   1413 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   1414 	u_int i, keyix;
   1415 
   1416 	/* XXX try i,i+32,i+64,i+32+64 to minimize key pair conflicts */
   1417 	for (i = 0; i < N(sc->sc_keymap); i++) {
   1418 		u_int8_t b = sc->sc_keymap[i];
   1419 		if (b != 0xff) {
   1420 			/*
   1421 			 * One or more slots are free.
   1422 			 */
   1423 			keyix = i*NBBY;
   1424 			while (b & 1)
   1425 				keyix++, b >>= 1;
   1426 			setbit(sc->sc_keymap, keyix);
   1427 			DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: key %u\n",
   1428 				__func__, keyix);
   1429 			return keyix;
   1430 		}
   1431 	}
   1432 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of space\n", __func__);
   1433 	return IEEE80211_KEYIX_NONE;
   1434 #undef N
   1435 }
   1436 
   1437 /*
   1438  * Allocate one or more key cache slots for a uniacst key.  The
   1439  * key itself is needed only to identify the cipher.  For hardware
   1440  * TKIP with split cipher+MIC keys we allocate two key cache slot
   1441  * pairs so that we can setup separate TX and RX MIC keys.  Note
   1442  * that the MIC key for a TKIP key at slot i is assumed by the
   1443  * hardware to be at slot i+64.  This limits TKIP keys to the first
   1444  * 64 entries.
   1445  */
   1446 static int
   1447 ath_key_alloc(struct ieee80211com *ic, const struct ieee80211_key *k)
   1448 {
   1449 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   1450 
   1451 	/*
   1452 	 * Group key allocation must be handled specially for
   1453 	 * parts that do not support multicast key cache search
   1454 	 * functionality.  For those parts the key id must match
   1455 	 * the h/w key index so lookups find the right key.  On
   1456 	 * parts w/ the key search facility we install the sender's
   1457 	 * mac address (with the high bit set) and let the hardware
   1458 	 * find the key w/o using the key id.  This is preferred as
   1459 	 * it permits us to support multiple users for adhoc and/or
   1460 	 * multi-station operation.
   1461 	 */
   1462 	if ((k->wk_flags & IEEE80211_KEY_GROUP) && !sc->sc_mcastkey) {
   1463 		u_int keyix;
   1464 
   1465 		if (!(&ic->ic_nw_keys[0] <= k &&
   1466 		      k < &ic->ic_nw_keys[IEEE80211_WEP_NKID])) {
   1467 			/* should not happen */
   1468 			DPRINTF(sc, ATH_DEBUG_KEYCACHE,
   1469 				"%s: bogus group key\n", __func__);
   1470 			return IEEE80211_KEYIX_NONE;
   1471 		}
   1472 		keyix = k - ic->ic_nw_keys;
   1473 		/*
   1474 		 * XXX we pre-allocate the global keys so
   1475 		 * have no way to check if they've already been allocated.
   1476 		 */
   1477 		return keyix;
   1478 	}
   1479 
   1480 	/*
   1481 	 * We allocate two pair for TKIP when using the h/w to do
   1482 	 * the MIC.  For everything else, including software crypto,
   1483 	 * we allocate a single entry.  Note that s/w crypto requires
   1484 	 * a pass-through slot on the 5211 and 5212.  The 5210 does
   1485 	 * not support pass-through cache entries and we map all
   1486 	 * those requests to slot 0.
   1487 	 */
   1488 	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
   1489 		return key_alloc_single(sc);
   1490 	} else if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP &&
   1491 	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic) {
   1492 		return key_alloc_2pair(sc);
   1493 	} else {
   1494 		return key_alloc_single(sc);
   1495 	}
   1496 }
   1497 
   1498 /*
   1499  * Delete an entry in the key cache allocated by ath_key_alloc.
   1500  */
   1501 static int
   1502 ath_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
   1503 {
   1504 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   1505 	struct ath_hal *ah = sc->sc_ah;
   1506 	const struct ieee80211_cipher *cip = k->wk_cipher;
   1507 	struct ieee80211_node *ni;
   1508 	u_int keyix = k->wk_keyix;
   1509 
   1510 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: delete key %u\n", __func__, keyix);
   1511 
   1512 	ath_hal_keyreset(ah, keyix);
   1513 	/*
   1514 	 * Check the key->node map and flush any ref.
   1515 	 */
   1516 	ni = sc->sc_keyixmap[keyix];
   1517 	if (ni != NULL) {
   1518 		ieee80211_free_node(ni);
   1519 		sc->sc_keyixmap[keyix] = NULL;
   1520 	}
   1521 	/*
   1522 	 * Handle split tx/rx keying required for TKIP with h/w MIC.
   1523 	 */
   1524 	if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
   1525 	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic) {
   1526 		ath_hal_keyreset(ah, keyix+32);		/* RX key */
   1527 		ni = sc->sc_keyixmap[keyix+32];
   1528 		if (ni != NULL) {			/* as above... */
   1529 			ieee80211_free_node(ni);
   1530 			sc->sc_keyixmap[keyix+32] = NULL;
   1531 		}
   1532 	}
   1533 	if (keyix >= IEEE80211_WEP_NKID) {
   1534 		/*
   1535 		 * Don't touch keymap entries for global keys so
   1536 		 * they are never considered for dynamic allocation.
   1537 		 */
   1538 		clrbit(sc->sc_keymap, keyix);
   1539 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
   1540 		    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 &&
   1541 		    sc->sc_splitmic) {
   1542 			clrbit(sc->sc_keymap, keyix+64);	/* TX key MIC */
   1543 			clrbit(sc->sc_keymap, keyix+32);	/* RX key */
   1544 			clrbit(sc->sc_keymap, keyix+32+64);	/* RX key MIC */
   1545 		}
   1546 	}
   1547 	return 1;
   1548 }
   1549 
   1550 /*
   1551  * Set the key cache contents for the specified key.  Key cache
   1552  * slot(s) must already have been allocated by ath_key_alloc.
   1553  */
   1554 static int
   1555 ath_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
   1556 	const u_int8_t mac[IEEE80211_ADDR_LEN])
   1557 {
   1558 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   1559 
   1560 	return ath_keyset(sc, k, mac, ic->ic_bss);
   1561 }
   1562 
   1563 /*
   1564  * Block/unblock tx+rx processing while a key change is done.
   1565  * We assume the caller serializes key management operations
   1566  * so we only need to worry about synchronization with other
   1567  * uses that originate in the driver.
   1568  */
   1569 static void
   1570 ath_key_update_begin(struct ieee80211com *ic)
   1571 {
   1572 	struct ifnet *ifp = ic->ic_ifp;
   1573 	struct ath_softc *sc = ifp->if_softc;
   1574 
   1575 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
   1576 #if 0
   1577 	tasklet_disable(&sc->sc_rxtq);
   1578 #endif
   1579 	IF_LOCK(&ifp->if_snd);		/* NB: doesn't block mgmt frames */
   1580 }
   1581 
   1582 static void
   1583 ath_key_update_end(struct ieee80211com *ic)
   1584 {
   1585 	struct ifnet *ifp = ic->ic_ifp;
   1586 	struct ath_softc *sc = ifp->if_softc;
   1587 
   1588 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s:\n", __func__);
   1589 	IF_UNLOCK(&ifp->if_snd);
   1590 #if 0
   1591 	tasklet_enable(&sc->sc_rxtq);
   1592 #endif
   1593 }
   1594 
   1595 /*
   1596  * Calculate the receive filter according to the
   1597  * operating mode and state:
   1598  *
   1599  * o always accept unicast, broadcast, and multicast traffic
   1600  * o maintain current state of phy error reception (the hal
   1601  *   may enable phy error frames for noise immunity work)
   1602  * o probe request frames are accepted only when operating in
   1603  *   hostap, adhoc, or monitor modes
   1604  * o enable promiscuous mode according to the interface state
   1605  * o accept beacons:
   1606  *   - when operating in adhoc mode so the 802.11 layer creates
   1607  *     node table entries for peers,
   1608  *   - when operating in station mode for collecting rssi data when
   1609  *     the station is otherwise quiet, or
   1610  *   - when scanning
   1611  */
   1612 static u_int32_t
   1613 ath_calcrxfilter(struct ath_softc *sc, enum ieee80211_state state)
   1614 {
   1615 	struct ieee80211com *ic = &sc->sc_ic;
   1616 	struct ath_hal *ah = sc->sc_ah;
   1617 	struct ifnet *ifp = sc->sc_ifp;
   1618 	u_int32_t rfilt;
   1619 
   1620 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
   1621 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
   1622 	if (ic->ic_opmode != IEEE80211_M_STA)
   1623 		rfilt |= HAL_RX_FILTER_PROBEREQ;
   1624 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
   1625 	    (ifp->if_flags & IFF_PROMISC))
   1626 		rfilt |= HAL_RX_FILTER_PROM;
   1627 	if (ic->ic_opmode == IEEE80211_M_STA ||
   1628 	    ic->ic_opmode == IEEE80211_M_IBSS ||
   1629 	    state == IEEE80211_S_SCAN)
   1630 		rfilt |= HAL_RX_FILTER_BEACON;
   1631 	return rfilt;
   1632 }
   1633 
   1634 static void
   1635 ath_mode_init(struct ath_softc *sc)
   1636 {
   1637 	struct ieee80211com *ic = &sc->sc_ic;
   1638 	struct ath_hal *ah = sc->sc_ah;
   1639 	struct ifnet *ifp = sc->sc_ifp;
   1640 	u_int32_t rfilt, mfilt[2], val;
   1641 	u_int8_t pos;
   1642 	struct ifmultiaddr *ifma;
   1643 
   1644 	/* configure rx filter */
   1645 	rfilt = ath_calcrxfilter(sc, ic->ic_state);
   1646 	ath_hal_setrxfilter(ah, rfilt);
   1647 
   1648 	/* configure operational mode */
   1649 	ath_hal_setopmode(ah);
   1650 
   1651 	/*
   1652 	 * Handle any link-level address change.  Note that we only
   1653 	 * need to force ic_myaddr; any other addresses are handled
   1654 	 * as a byproduct of the ifnet code marking the interface
   1655 	 * down then up.
   1656 	 *
   1657 	 * XXX should get from lladdr instead of arpcom but that's more work
   1658 	 */
   1659 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IFP2ENADDR(ifp));
   1660 	ath_hal_setmac(ah, ic->ic_myaddr);
   1661 
   1662 	/* calculate and install multicast filter */
   1663 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
   1664 		mfilt[0] = mfilt[1] = 0;
   1665 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
   1666 			caddr_t dl;
   1667 
   1668 			/* calculate XOR of eight 6bit values */
   1669 			dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
   1670 			val = LE_READ_4(dl + 0);
   1671 			pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
   1672 			val = LE_READ_4(dl + 3);
   1673 			pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
   1674 			pos &= 0x3f;
   1675 			mfilt[pos / 32] |= (1 << (pos % 32));
   1676 		}
   1677 	} else {
   1678 		mfilt[0] = mfilt[1] = ~0;
   1679 	}
   1680 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
   1681 	DPRINTF(sc, ATH_DEBUG_MODE, "%s: RX filter 0x%x, MC filter %08x:%08x\n",
   1682 		__func__, rfilt, mfilt[0], mfilt[1]);
   1683 }
   1684 
   1685 /*
   1686  * Set the slot time based on the current setting.
   1687  */
   1688 static void
   1689 ath_setslottime(struct ath_softc *sc)
   1690 {
   1691 	struct ieee80211com *ic = &sc->sc_ic;
   1692 	struct ath_hal *ah = sc->sc_ah;
   1693 
   1694 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
   1695 		ath_hal_setslottime(ah, HAL_SLOT_TIME_9);
   1696 	else
   1697 		ath_hal_setslottime(ah, HAL_SLOT_TIME_20);
   1698 	sc->sc_updateslot = OK;
   1699 }
   1700 
   1701 /*
   1702  * Callback from the 802.11 layer to update the
   1703  * slot time based on the current setting.
   1704  */
   1705 static void
   1706 ath_updateslot(struct ifnet *ifp)
   1707 {
   1708 	struct ath_softc *sc = ifp->if_softc;
   1709 	struct ieee80211com *ic = &sc->sc_ic;
   1710 
   1711 	/*
   1712 	 * When not coordinating the BSS, change the hardware
   1713 	 * immediately.  For other operation we defer the change
   1714 	 * until beacon updates have propagated to the stations.
   1715 	 */
   1716 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
   1717 		sc->sc_updateslot = UPDATE;
   1718 	else
   1719 		ath_setslottime(sc);
   1720 }
   1721 
   1722 /*
   1723  * Setup a h/w transmit queue for beacons.
   1724  */
   1725 static int
   1726 ath_beaconq_setup(struct ath_hal *ah)
   1727 {
   1728 	HAL_TXQ_INFO qi;
   1729 
   1730 	memset(&qi, 0, sizeof(qi));
   1731 	qi.tqi_aifs = HAL_TXQ_USEDEFAULT;
   1732 	qi.tqi_cwmin = HAL_TXQ_USEDEFAULT;
   1733 	qi.tqi_cwmax = HAL_TXQ_USEDEFAULT;
   1734 	/* NB: for dynamic turbo, don't enable any other interrupts */
   1735 	qi.tqi_qflags = TXQ_FLAG_TXDESCINT_ENABLE;
   1736 	return ath_hal_setuptxqueue(ah, HAL_TX_QUEUE_BEACON, &qi);
   1737 }
   1738 
   1739 /*
   1740  * Setup the transmit queue parameters for the beacon queue.
   1741  */
   1742 static int
   1743 ath_beaconq_config(struct ath_softc *sc)
   1744 {
   1745 #define	ATH_EXPONENT_TO_VALUE(v)	((1<<(v))-1)
   1746 	struct ieee80211com *ic = &sc->sc_ic;
   1747 	struct ath_hal *ah = sc->sc_ah;
   1748 	HAL_TXQ_INFO qi;
   1749 
   1750 	ath_hal_gettxqueueprops(ah, sc->sc_bhalq, &qi);
   1751 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
   1752 		/*
   1753 		 * Always burst out beacon and CAB traffic.
   1754 		 */
   1755 		qi.tqi_aifs = ATH_BEACON_AIFS_DEFAULT;
   1756 		qi.tqi_cwmin = ATH_BEACON_CWMIN_DEFAULT;
   1757 		qi.tqi_cwmax = ATH_BEACON_CWMAX_DEFAULT;
   1758 	} else {
   1759 		struct wmeParams *wmep =
   1760 			&ic->ic_wme.wme_chanParams.cap_wmeParams[WME_AC_BE];
   1761 		/*
   1762 		 * Adhoc mode; important thing is to use 2x cwmin.
   1763 		 */
   1764 		qi.tqi_aifs = wmep->wmep_aifsn;
   1765 		qi.tqi_cwmin = 2*ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmin);
   1766 		qi.tqi_cwmax = ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmax);
   1767 	}
   1768 
   1769 	if (!ath_hal_settxqueueprops(ah, sc->sc_bhalq, &qi)) {
   1770 		device_printf(sc->sc_dev, "unable to update parameters for "
   1771 			"beacon hardware queue!\n");
   1772 		return 0;
   1773 	} else {
   1774 		ath_hal_resettxqueue(ah, sc->sc_bhalq); /* push to h/w */
   1775 		return 1;
   1776 	}
   1777 #undef ATH_EXPONENT_TO_VALUE
   1778 }
   1779 
   1780 /*
   1781  * Allocate and setup an initial beacon frame.
   1782  */
   1783 static int
   1784 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
   1785 {
   1786 	struct ieee80211com *ic = ni->ni_ic;
   1787 	struct ath_buf *bf;
   1788 	struct mbuf *m;
   1789 	int error;
   1790 
   1791 	bf = STAILQ_FIRST(&sc->sc_bbuf);
   1792 	if (bf == NULL) {
   1793 		DPRINTF(sc, ATH_DEBUG_BEACON, "%s: no dma buffers\n", __func__);
   1794 		sc->sc_stats.ast_be_nombuf++;	/* XXX */
   1795 		return ENOMEM;			/* XXX */
   1796 	}
   1797 	/*
   1798 	 * NB: the beacon data buffer must be 32-bit aligned;
   1799 	 * we assume the mbuf routines will return us something
   1800 	 * with this alignment (perhaps should assert).
   1801 	 */
   1802 	m = ieee80211_beacon_alloc(ic, ni, &sc->sc_boff);
   1803 	if (m == NULL) {
   1804 		DPRINTF(sc, ATH_DEBUG_BEACON, "%s: cannot get mbuf\n",
   1805 			__func__);
   1806 		sc->sc_stats.ast_be_nombuf++;
   1807 		return ENOMEM;
   1808 	}
   1809 	error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m,
   1810 				     bf->bf_segs, &bf->bf_nseg,
   1811 				     BUS_DMA_NOWAIT);
   1812 	if (error == 0) {
   1813 		bf->bf_m = m;
   1814 		bf->bf_node = ieee80211_ref_node(ni);
   1815 	} else {
   1816 		m_freem(m);
   1817 	}
   1818 	return error;
   1819 }
   1820 
   1821 /*
   1822  * Setup the beacon frame for transmit.
   1823  */
   1824 static void
   1825 ath_beacon_setup(struct ath_softc *sc, struct ath_buf *bf)
   1826 {
   1827 #define	USE_SHPREAMBLE(_ic) \
   1828 	(((_ic)->ic_flags & (IEEE80211_F_SHPREAMBLE | IEEE80211_F_USEBARKER))\
   1829 		== IEEE80211_F_SHPREAMBLE)
   1830 	struct ieee80211_node *ni = bf->bf_node;
   1831 	struct ieee80211com *ic = ni->ni_ic;
   1832 	struct mbuf *m = bf->bf_m;
   1833 	struct ath_hal *ah = sc->sc_ah;
   1834 	struct ath_node *an = ATH_NODE(ni);
   1835 	struct ath_desc *ds;
   1836 	int flags, antenna;
   1837 	u_int8_t rate;
   1838 
   1839 	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: m %p len %u\n",
   1840 		__func__, m, m->m_len);
   1841 
   1842 	/* setup descriptors */
   1843 	ds = bf->bf_desc;
   1844 
   1845 	flags = HAL_TXDESC_NOACK;
   1846 	if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol) {
   1847 		ds->ds_link = bf->bf_daddr;	/* self-linked */
   1848 		flags |= HAL_TXDESC_VEOL;
   1849 		/*
   1850 		 * Let hardware handle antenna switching.
   1851 		 */
   1852 		antenna = 0;
   1853 	} else {
   1854 		ds->ds_link = 0;
   1855 		/*
   1856 		 * Switch antenna every 4 beacons.
   1857 		 * XXX assumes two antenna
   1858 		 */
   1859 		antenna = (sc->sc_stats.ast_be_xmit & 4 ? 2 : 1);
   1860 	}
   1861 
   1862 	KASSERT(bf->bf_nseg == 1,
   1863 		("multi-segment beacon frame; nseg %u", bf->bf_nseg));
   1864 	ds->ds_data = bf->bf_segs[0].ds_addr;
   1865 	/*
   1866 	 * Calculate rate code.
   1867 	 * XXX everything at min xmit rate
   1868 	 */
   1869 	if (USE_SHPREAMBLE(ic))
   1870 		rate = an->an_tx_mgtratesp;
   1871 	else
   1872 		rate = an->an_tx_mgtrate;
   1873 	ath_hal_setuptxdesc(ah, ds
   1874 		, m->m_len + IEEE80211_CRC_LEN	/* frame length */
   1875 		, sizeof(struct ieee80211_frame)/* header length */
   1876 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
   1877 		, ni->ni_txpower		/* txpower XXX */
   1878 		, rate, 1			/* series 0 rate/tries */
   1879 		, HAL_TXKEYIX_INVALID		/* no encryption */
   1880 		, antenna			/* antenna mode */
   1881 		, flags				/* no ack, veol for beacons */
   1882 		, 0				/* rts/cts rate */
   1883 		, 0				/* rts/cts duration */
   1884 	);
   1885 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
   1886 	ath_hal_filltxdesc(ah, ds
   1887 		, roundup(m->m_len, 4)		/* buffer length */
   1888 		, AH_TRUE			/* first segment */
   1889 		, AH_TRUE			/* last segment */
   1890 		, ds				/* first descriptor */
   1891 	);
   1892 #undef USE_SHPREAMBLE
   1893 }
   1894 
   1895 /*
   1896  * Transmit a beacon frame at SWBA.  Dynamic updates to the
   1897  * frame contents are done as needed and the slot time is
   1898  * also adjusted based on current state.
   1899  */
   1900 static void
   1901 ath_beacon_proc(void *arg, int pending)
   1902 {
   1903 	struct ath_softc *sc = arg;
   1904 	struct ath_buf *bf = STAILQ_FIRST(&sc->sc_bbuf);
   1905 	struct ieee80211_node *ni = bf->bf_node;
   1906 	struct ieee80211com *ic = ni->ni_ic;
   1907 	struct ath_hal *ah = sc->sc_ah;
   1908 	struct mbuf *m;
   1909 	int ncabq, error, otherant;
   1910 
   1911 	DPRINTF(sc, ATH_DEBUG_BEACON_PROC, "%s: pending %u\n",
   1912 		__func__, pending);
   1913 
   1914 	if (ic->ic_opmode == IEEE80211_M_STA ||
   1915 	    ic->ic_opmode == IEEE80211_M_MONITOR ||
   1916 	    bf == NULL || bf->bf_m == NULL) {
   1917 		DPRINTF(sc, ATH_DEBUG_ANY, "%s: ic_flags=%x bf=%p bf_m=%p\n",
   1918 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL);
   1919 		return;
   1920 	}
   1921 	/*
   1922 	 * Check if the previous beacon has gone out.  If
   1923 	 * not don't don't try to post another, skip this
   1924 	 * period and wait for the next.  Missed beacons
   1925 	 * indicate a problem and should not occur.  If we
   1926 	 * miss too many consecutive beacons reset the device.
   1927 	 */
   1928 	if (ath_hal_numtxpending(ah, sc->sc_bhalq) != 0) {
   1929 		sc->sc_bmisscount++;
   1930 		DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
   1931 			"%s: missed %u consecutive beacons\n",
   1932 			__func__, sc->sc_bmisscount);
   1933 		if (sc->sc_bmisscount > 3)		/* NB: 3 is a guess */
   1934 			taskqueue_enqueue(taskqueue_swi, &sc->sc_bstucktask);
   1935 		return;
   1936 	}
   1937 	if (sc->sc_bmisscount != 0) {
   1938 		DPRINTF(sc, ATH_DEBUG_BEACON,
   1939 			"%s: resume beacon xmit after %u misses\n",
   1940 			__func__, sc->sc_bmisscount);
   1941 		sc->sc_bmisscount = 0;
   1942 	}
   1943 
   1944 	/*
   1945 	 * Update dynamic beacon contents.  If this returns
   1946 	 * non-zero then we need to remap the memory because
   1947 	 * the beacon frame changed size (probably because
   1948 	 * of the TIM bitmap).
   1949 	 */
   1950 	m = bf->bf_m;
   1951 	ncabq = ath_hal_numtxpending(ah, sc->sc_cabq->axq_qnum);
   1952 	if (ieee80211_beacon_update(ic, bf->bf_node, &sc->sc_boff, m, ncabq)) {
   1953 		/* XXX too conservative? */
   1954 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   1955 		error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m,
   1956 					     bf->bf_segs, &bf->bf_nseg,
   1957 					     BUS_DMA_NOWAIT);
   1958 		if (error != 0) {
   1959 			if_printf(ic->ic_ifp,
   1960 			    "%s: bus_dmamap_load_mbuf_sg failed, error %u\n",
   1961 			    __func__, error);
   1962 			return;
   1963 		}
   1964 	}
   1965 
   1966 	/*
   1967 	 * Handle slot time change when a non-ERP station joins/leaves
   1968 	 * an 11g network.  The 802.11 layer notifies us via callback,
   1969 	 * we mark updateslot, then wait one beacon before effecting
   1970 	 * the change.  This gives associated stations at least one
   1971 	 * beacon interval to note the state change.
   1972 	 */
   1973 	/* XXX locking */
   1974 	if (sc->sc_updateslot == UPDATE)
   1975 		sc->sc_updateslot = COMMIT;	/* commit next beacon */
   1976 	else if (sc->sc_updateslot == COMMIT)
   1977 		ath_setslottime(sc);		/* commit change to h/w */
   1978 
   1979 	/*
   1980 	 * Check recent per-antenna transmit statistics and flip
   1981 	 * the default antenna if noticeably more frames went out
   1982 	 * on the non-default antenna.
   1983 	 * XXX assumes 2 anntenae
   1984 	 */
   1985 	otherant = sc->sc_defant & 1 ? 2 : 1;
   1986 	if (sc->sc_ant_tx[otherant] > sc->sc_ant_tx[sc->sc_defant] + 2)
   1987 		ath_setdefantenna(sc, otherant);
   1988 	sc->sc_ant_tx[1] = sc->sc_ant_tx[2] = 0;
   1989 
   1990 	/*
   1991 	 * Construct tx descriptor.
   1992 	 */
   1993 	ath_beacon_setup(sc, bf);
   1994 
   1995 	/*
   1996 	 * Stop any current dma and put the new frame on the queue.
   1997 	 * This should never fail since we check above that no frames
   1998 	 * are still pending on the queue.
   1999 	 */
   2000 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
   2001 		DPRINTF(sc, ATH_DEBUG_ANY,
   2002 			"%s: beacon queue %u did not stop?\n",
   2003 			__func__, sc->sc_bhalq);
   2004 	}
   2005 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
   2006 
   2007 	/*
   2008 	 * Enable the CAB queue before the beacon queue to
   2009 	 * insure cab frames are triggered by this beacon.
   2010 	 */
   2011 	if (sc->sc_boff.bo_tim[4] & 1)		/* NB: only at DTIM */
   2012 		ath_hal_txstart(ah, sc->sc_cabq->axq_qnum);
   2013 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
   2014 	ath_hal_txstart(ah, sc->sc_bhalq);
   2015 	DPRINTF(sc, ATH_DEBUG_BEACON_PROC,
   2016 		"%s: TXDP[%u] = %p (%p)\n", __func__,
   2017 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc);
   2018 
   2019 	sc->sc_stats.ast_be_xmit++;
   2020 }
   2021 
   2022 /*
   2023  * Reset the hardware after detecting beacons have stopped.
   2024  */
   2025 static void
   2026 ath_bstuck_proc(void *arg, int pending)
   2027 {
   2028 	struct ath_softc *sc = arg;
   2029 	struct ifnet *ifp = sc->sc_ifp;
   2030 
   2031 	if_printf(ifp, "stuck beacon; resetting (bmiss count %u)\n",
   2032 		sc->sc_bmisscount);
   2033 	ath_reset(ifp);
   2034 }
   2035 
   2036 /*
   2037  * Reclaim beacon resources.
   2038  */
   2039 static void
   2040 ath_beacon_free(struct ath_softc *sc)
   2041 {
   2042 	struct ath_buf *bf;
   2043 
   2044 	STAILQ_FOREACH(bf, &sc->sc_bbuf, bf_list) {
   2045 		if (bf->bf_m != NULL) {
   2046 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   2047 			m_freem(bf->bf_m);
   2048 			bf->bf_m = NULL;
   2049 		}
   2050 		if (bf->bf_node != NULL) {
   2051 			ieee80211_free_node(bf->bf_node);
   2052 			bf->bf_node = NULL;
   2053 		}
   2054 	}
   2055 }
   2056 
   2057 /*
   2058  * Configure the beacon and sleep timers.
   2059  *
   2060  * When operating as an AP this resets the TSF and sets
   2061  * up the hardware to notify us when we need to issue beacons.
   2062  *
   2063  * When operating in station mode this sets up the beacon
   2064  * timers according to the timestamp of the last received
   2065  * beacon and the current TSF, configures PCF and DTIM
   2066  * handling, programs the sleep registers so the hardware
   2067  * will wakeup in time to receive beacons, and configures
   2068  * the beacon miss handling so we'll receive a BMISS
   2069  * interrupt when we stop seeing beacons from the AP
   2070  * we've associated with.
   2071  */
   2072 static void
   2073 ath_beacon_config(struct ath_softc *sc)
   2074 {
   2075 #define	TSF_TO_TU(_h,_l)	(((_h) << 22) | ((_l) >> 10))
   2076 	struct ath_hal *ah = sc->sc_ah;
   2077 	struct ieee80211com *ic = &sc->sc_ic;
   2078 	struct ieee80211_node *ni = ic->ic_bss;
   2079 	u_int32_t nexttbtt, intval;
   2080 
   2081 	/* extract tstamp from last beacon and convert to TU */
   2082 	nexttbtt = TSF_TO_TU(LE_READ_4(ni->ni_tstamp.data + 4),
   2083 			     LE_READ_4(ni->ni_tstamp.data));
   2084 	/* NB: the beacon interval is kept internally in TU's */
   2085 	intval = ni->ni_intval & HAL_BEACON_PERIOD;
   2086 	if (nexttbtt == 0)		/* e.g. for ap mode */
   2087 		nexttbtt = intval;
   2088 	else if (intval)		/* NB: can be 0 for monitor mode */
   2089 		nexttbtt = roundup(nexttbtt, intval);
   2090 	DPRINTF(sc, ATH_DEBUG_BEACON, "%s: nexttbtt %u intval %u (%u)\n",
   2091 		__func__, nexttbtt, intval, ni->ni_intval);
   2092 	if (ic->ic_opmode == IEEE80211_M_STA) {
   2093 		HAL_BEACON_STATE bs;
   2094 		u_int64_t tsf;
   2095 		u_int32_t tsftu;
   2096 		int dtimperiod, dtimcount;
   2097 		int cfpperiod, cfpcount;
   2098 
   2099 		/*
   2100 		 * Setup dtim and cfp parameters according to
   2101 		 * last beacon we received (which may be none).
   2102 		 */
   2103 		dtimperiod = ni->ni_dtim_period;
   2104 		if (dtimperiod <= 0)		/* NB: 0 if not known */
   2105 			dtimperiod = 1;
   2106 		dtimcount = ni->ni_dtim_count;
   2107 		if (dtimcount >= dtimperiod)	/* NB: sanity check */
   2108 			dtimcount = 0;		/* XXX? */
   2109 		cfpperiod = 1;			/* NB: no PCF support yet */
   2110 		cfpcount = 0;
   2111 #define	FUDGE	2
   2112 		/*
   2113 		 * Pull nexttbtt forward to reflect the current
   2114 		 * TSF and calculate dtim+cfp state for the result.
   2115 		 */
   2116 		tsf = ath_hal_gettsf64(ah);
   2117 		tsftu = TSF_TO_TU((u_int32_t)(tsf>>32), (u_int32_t)tsf) + FUDGE;
   2118 		do {
   2119 			nexttbtt += intval;
   2120 			if (--dtimcount < 0) {
   2121 				dtimcount = dtimperiod - 1;
   2122 				if (--cfpcount < 0)
   2123 					cfpcount = cfpperiod - 1;
   2124 			}
   2125 		} while (nexttbtt < tsftu);
   2126 #undef FUDGE
   2127 		memset(&bs, 0, sizeof(bs));
   2128 		bs.bs_intval = intval;
   2129 		bs.bs_nexttbtt = nexttbtt;
   2130 		bs.bs_dtimperiod = dtimperiod*intval;
   2131 		bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount*intval;
   2132 		bs.bs_cfpperiod = cfpperiod*bs.bs_dtimperiod;
   2133 		bs.bs_cfpnext = bs.bs_nextdtim + cfpcount*bs.bs_dtimperiod;
   2134 		bs.bs_cfpmaxduration = 0;
   2135 #if 0
   2136 		/*
   2137 		 * The 802.11 layer records the offset to the DTIM
   2138 		 * bitmap while receiving beacons; use it here to
   2139 		 * enable h/w detection of our AID being marked in
   2140 		 * the bitmap vector (to indicate frames for us are
   2141 		 * pending at the AP).
   2142 		 * XXX do DTIM handling in s/w to WAR old h/w bugs
   2143 		 * XXX enable based on h/w rev for newer chips
   2144 		 */
   2145 		bs.bs_timoffset = ni->ni_timoff;
   2146 #endif
   2147 		/*
   2148 		 * Calculate the number of consecutive beacons to miss
   2149 		 * before taking a BMISS interrupt.  The configuration
   2150 		 * is specified in ms, so we need to convert that to
   2151 		 * TU's and then calculate based on the beacon interval.
   2152 		 * Note that we clamp the result to at most 10 beacons.
   2153 		 */
   2154 		bs.bs_bmissthreshold = howmany(ic->ic_bmisstimeout, intval);
   2155 		if (bs.bs_bmissthreshold > 10)
   2156 			bs.bs_bmissthreshold = 10;
   2157 		else if (bs.bs_bmissthreshold <= 0)
   2158 			bs.bs_bmissthreshold = 1;
   2159 
   2160 		/*
   2161 		 * Calculate sleep duration.  The configuration is
   2162 		 * given in ms.  We insure a multiple of the beacon
   2163 		 * period is used.  Also, if the sleep duration is
   2164 		 * greater than the DTIM period then it makes senses
   2165 		 * to make it a multiple of that.
   2166 		 *
   2167 		 * XXX fixed at 100ms
   2168 		 */
   2169 		bs.bs_sleepduration =
   2170 			roundup(IEEE80211_MS_TO_TU(100), bs.bs_intval);
   2171 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
   2172 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
   2173 
   2174 		DPRINTF(sc, ATH_DEBUG_BEACON,
   2175 			"%s: tsf %ju tsf:tu %u intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u cfp:period %u maxdur %u next %u timoffset %u\n"
   2176 			, __func__
   2177 			, tsf, tsftu
   2178 			, bs.bs_intval
   2179 			, bs.bs_nexttbtt
   2180 			, bs.bs_dtimperiod
   2181 			, bs.bs_nextdtim
   2182 			, bs.bs_bmissthreshold
   2183 			, bs.bs_sleepduration
   2184 			, bs.bs_cfpperiod
   2185 			, bs.bs_cfpmaxduration
   2186 			, bs.bs_cfpnext
   2187 			, bs.bs_timoffset
   2188 		);
   2189 		ath_hal_intrset(ah, 0);
   2190 		ath_hal_beacontimers(ah, &bs);
   2191 		sc->sc_imask |= HAL_INT_BMISS;
   2192 		ath_hal_intrset(ah, sc->sc_imask);
   2193 	} else {
   2194 		ath_hal_intrset(ah, 0);
   2195 		if (nexttbtt == intval)
   2196 			intval |= HAL_BEACON_RESET_TSF;
   2197 		if (ic->ic_opmode == IEEE80211_M_IBSS) {
   2198 			/*
   2199 			 * In IBSS mode enable the beacon timers but only
   2200 			 * enable SWBA interrupts if we need to manually
   2201 			 * prepare beacon frames.  Otherwise we use a
   2202 			 * self-linked tx descriptor and let the hardware
   2203 			 * deal with things.
   2204 			 */
   2205 			intval |= HAL_BEACON_ENA;
   2206 			if (!sc->sc_hasveol)
   2207 				sc->sc_imask |= HAL_INT_SWBA;
   2208 			ath_beaconq_config(sc);
   2209 		} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
   2210 			/*
   2211 			 * In AP mode we enable the beacon timers and
   2212 			 * SWBA interrupts to prepare beacon frames.
   2213 			 */
   2214 			intval |= HAL_BEACON_ENA;
   2215 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
   2216 			ath_beaconq_config(sc);
   2217 		}
   2218 		ath_hal_beaconinit(ah, nexttbtt, intval);
   2219 		sc->sc_bmisscount = 0;
   2220 		ath_hal_intrset(ah, sc->sc_imask);
   2221 		/*
   2222 		 * When using a self-linked beacon descriptor in
   2223 		 * ibss mode load it once here.
   2224 		 */
   2225 		if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_hasveol)
   2226 			ath_beacon_proc(sc, 0);
   2227 	}
   2228 #undef TSF_TO_TU
   2229 }
   2230 
   2231 static void
   2232 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
   2233 {
   2234 	bus_addr_t *paddr = (bus_addr_t*) arg;
   2235 	KASSERT(error == 0, ("error %u on bus_dma callback", error));
   2236 	*paddr = segs->ds_addr;
   2237 }
   2238 
   2239 static int
   2240 ath_descdma_setup(struct ath_softc *sc,
   2241 	struct ath_descdma *dd, ath_bufhead *head,
   2242 	const char *name, int nbuf, int ndesc)
   2243 {
   2244 #define	DS2PHYS(_dd, _ds) \
   2245 	((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
   2246 	struct ifnet *ifp = sc->sc_ifp;
   2247 	struct ath_desc *ds;
   2248 	struct ath_buf *bf;
   2249 	int i, bsize, error;
   2250 
   2251 	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %s DMA: %u buffers %u desc/buf\n",
   2252 	    __func__, name, nbuf, ndesc);
   2253 
   2254 	dd->dd_name = name;
   2255 	dd->dd_desc_len = sizeof(struct ath_desc) * nbuf * ndesc;
   2256 
   2257 	/*
   2258 	 * Setup DMA descriptor area.
   2259 	 */
   2260 	error = bus_dma_tag_create(NULL,	/* parent */
   2261 		       PAGE_SIZE, 0,		/* alignment, bounds */
   2262 		       BUS_SPACE_MAXADDR_32BIT,	/* lowaddr */
   2263 		       BUS_SPACE_MAXADDR,	/* highaddr */
   2264 		       NULL, NULL,		/* filter, filterarg */
   2265 		       dd->dd_desc_len,		/* maxsize */
   2266 		       1,			/* nsegments */
   2267 		       BUS_SPACE_MAXADDR,	/* maxsegsize */
   2268 		       BUS_DMA_ALLOCNOW,	/* flags */
   2269 		       NULL,			/* lockfunc */
   2270 		       NULL,			/* lockarg */
   2271 		       &dd->dd_dmat);
   2272 	if (error != 0) {
   2273 		if_printf(ifp, "cannot allocate %s DMA tag\n", dd->dd_name);
   2274 		return error;
   2275 	}
   2276 
   2277 	/* allocate descriptors */
   2278 	error = bus_dmamap_create(dd->dd_dmat, BUS_DMA_NOWAIT, &dd->dd_dmamap);
   2279 	if (error != 0) {
   2280 		if_printf(ifp, "unable to create dmamap for %s descriptors, "
   2281 			"error %u\n", dd->dd_name, error);
   2282 		goto fail0;
   2283 	}
   2284 
   2285 	error = bus_dmamem_alloc(dd->dd_dmat, (void**) &dd->dd_desc,
   2286 				 BUS_DMA_NOWAIT, &dd->dd_dmamap);
   2287 	if (error != 0) {
   2288 		if_printf(ifp, "unable to alloc memory for %u %s descriptors, "
   2289 			"error %u\n", nbuf * ndesc, dd->dd_name, error);
   2290 		goto fail1;
   2291 	}
   2292 
   2293 	error = bus_dmamap_load(dd->dd_dmat, dd->dd_dmamap,
   2294 				dd->dd_desc, dd->dd_desc_len,
   2295 				ath_load_cb, &dd->dd_desc_paddr,
   2296 				BUS_DMA_NOWAIT);
   2297 	if (error != 0) {
   2298 		if_printf(ifp, "unable to map %s descriptors, error %u\n",
   2299 			dd->dd_name, error);
   2300 		goto fail2;
   2301 	}
   2302 
   2303 	ds = dd->dd_desc;
   2304 	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %s DMA map: %p (%lu) -> %p (%lu)\n",
   2305 	    __func__, dd->dd_name, ds, (u_long) dd->dd_desc_len,
   2306 	    (caddr_t) dd->dd_desc_paddr, /*XXX*/ (u_long) dd->dd_desc_len);
   2307 
   2308 	/* allocate rx buffers */
   2309 	bsize = sizeof(struct ath_buf) * nbuf;
   2310 	bf = malloc(bsize, M_ATHDEV, M_NOWAIT | M_ZERO);
   2311 	if (bf == NULL) {
   2312 		if_printf(ifp, "malloc of %s buffers failed, size %u\n",
   2313 			dd->dd_name, bsize);
   2314 		goto fail3;
   2315 	}
   2316 	dd->dd_bufptr = bf;
   2317 
   2318 	STAILQ_INIT(head);
   2319 	for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
   2320 		bf->bf_desc = ds;
   2321 		bf->bf_daddr = DS2PHYS(dd, ds);
   2322 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
   2323 				&bf->bf_dmamap);
   2324 		if (error != 0) {
   2325 			if_printf(ifp, "unable to create dmamap for %s "
   2326 				"buffer %u, error %u\n", dd->dd_name, i, error);
   2327 			ath_descdma_cleanup(sc, dd, head);
   2328 			return error;
   2329 		}
   2330 		STAILQ_INSERT_TAIL(head, bf, bf_list);
   2331 	}
   2332 	return 0;
   2333 fail3:
   2334 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
   2335 fail2:
   2336 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
   2337 fail1:
   2338 	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
   2339 fail0:
   2340 	bus_dma_tag_destroy(dd->dd_dmat);
   2341 	memset(dd, 0, sizeof(*dd));
   2342 	return error;
   2343 #undef DS2PHYS
   2344 }
   2345 
   2346 static void
   2347 ath_descdma_cleanup(struct ath_softc *sc,
   2348 	struct ath_descdma *dd, ath_bufhead *head)
   2349 {
   2350 	struct ath_buf *bf;
   2351 	struct ieee80211_node *ni;
   2352 
   2353 	bus_dmamap_unload(dd->dd_dmat, dd->dd_dmamap);
   2354 	bus_dmamem_free(dd->dd_dmat, dd->dd_desc, dd->dd_dmamap);
   2355 	bus_dmamap_destroy(dd->dd_dmat, dd->dd_dmamap);
   2356 	bus_dma_tag_destroy(dd->dd_dmat);
   2357 
   2358 	STAILQ_FOREACH(bf, head, bf_list) {
   2359 		if (bf->bf_m) {
   2360 			m_freem(bf->bf_m);
   2361 			bf->bf_m = NULL;
   2362 		}
   2363 		if (bf->bf_dmamap != NULL) {
   2364 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
   2365 			bf->bf_dmamap = NULL;
   2366 		}
   2367 		ni = bf->bf_node;
   2368 		bf->bf_node = NULL;
   2369 		if (ni != NULL) {
   2370 			/*
   2371 			 * Reclaim node reference.
   2372 			 */
   2373 			ieee80211_free_node(ni);
   2374 		}
   2375 	}
   2376 
   2377 	STAILQ_INIT(head);
   2378 	free(dd->dd_bufptr, M_ATHDEV);
   2379 	memset(dd, 0, sizeof(*dd));
   2380 }
   2381 
   2382 static int
   2383 ath_desc_alloc(struct ath_softc *sc)
   2384 {
   2385 	int error;
   2386 
   2387 	error = ath_descdma_setup(sc, &sc->sc_rxdma, &sc->sc_rxbuf,
   2388 			"rx", ATH_RXBUF, 1);
   2389 	if (error != 0)
   2390 		return error;
   2391 
   2392 	error = ath_descdma_setup(sc, &sc->sc_txdma, &sc->sc_txbuf,
   2393 			"tx", ATH_TXBUF, ATH_TXDESC);
   2394 	if (error != 0) {
   2395 		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
   2396 		return error;
   2397 	}
   2398 
   2399 	error = ath_descdma_setup(sc, &sc->sc_bdma, &sc->sc_bbuf,
   2400 			"beacon", 1, 1);
   2401 	if (error != 0) {
   2402 		ath_descdma_cleanup(sc, &sc->sc_txdma, &sc->sc_txbuf);
   2403 		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
   2404 		return error;
   2405 	}
   2406 	return 0;
   2407 }
   2408 
   2409 static void
   2410 ath_desc_free(struct ath_softc *sc)
   2411 {
   2412 
   2413 	if (sc->sc_bdma.dd_desc_len != 0)
   2414 		ath_descdma_cleanup(sc, &sc->sc_bdma, &sc->sc_bbuf);
   2415 	if (sc->sc_txdma.dd_desc_len != 0)
   2416 		ath_descdma_cleanup(sc, &sc->sc_txdma, &sc->sc_txbuf);
   2417 	if (sc->sc_rxdma.dd_desc_len != 0)
   2418 		ath_descdma_cleanup(sc, &sc->sc_rxdma, &sc->sc_rxbuf);
   2419 }
   2420 
   2421 static struct ieee80211_node *
   2422 ath_node_alloc(struct ieee80211_node_table *nt)
   2423 {
   2424 	struct ieee80211com *ic = nt->nt_ic;
   2425 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   2426 	const size_t space = sizeof(struct ath_node) + sc->sc_rc->arc_space;
   2427 	struct ath_node *an;
   2428 
   2429 	an = malloc(space, M_80211_NODE, M_NOWAIT|M_ZERO);
   2430 	if (an == NULL) {
   2431 		/* XXX stat+msg */
   2432 		return NULL;
   2433 	}
   2434 	an->an_avgrssi = ATH_RSSI_DUMMY_MARKER;
   2435 	an->an_halstats.ns_avgbrssi = ATH_RSSI_DUMMY_MARKER;
   2436 	an->an_halstats.ns_avgrssi = ATH_RSSI_DUMMY_MARKER;
   2437 	an->an_halstats.ns_avgtxrssi = ATH_RSSI_DUMMY_MARKER;
   2438 	ath_rate_node_init(sc, an);
   2439 
   2440 	DPRINTF(sc, ATH_DEBUG_NODE, "%s: an %p\n", __func__, an);
   2441 	return &an->an_node;
   2442 }
   2443 
   2444 static void
   2445 ath_node_free(struct ieee80211_node *ni)
   2446 {
   2447 	struct ieee80211com *ic = ni->ni_ic;
   2448         struct ath_softc *sc = ic->ic_ifp->if_softc;
   2449 
   2450 	DPRINTF(sc, ATH_DEBUG_NODE, "%s: ni %p\n", __func__, ni);
   2451 
   2452 	ath_rate_node_cleanup(sc, ATH_NODE(ni));
   2453 	sc->sc_node_free(ni);
   2454 }
   2455 
   2456 static u_int8_t
   2457 ath_node_getrssi(const struct ieee80211_node *ni)
   2458 {
   2459 #define	HAL_EP_RND(x, mul) \
   2460 	((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
   2461 	u_int32_t avgrssi = ATH_NODE_CONST(ni)->an_avgrssi;
   2462 	int32_t rssi;
   2463 
   2464 	/*
   2465 	 * When only one frame is received there will be no state in
   2466 	 * avgrssi so fallback on the value recorded by the 802.11 layer.
   2467 	 */
   2468 	if (avgrssi != ATH_RSSI_DUMMY_MARKER)
   2469 		rssi = HAL_EP_RND(avgrssi, HAL_RSSI_EP_MULTIPLIER);
   2470 	else
   2471 		rssi = ni->ni_rssi;
   2472 	/* NB: theoretically we shouldn't need this, but be paranoid */
   2473 	return rssi < 0 ? 0 : rssi > 127 ? 127 : rssi;
   2474 #undef HAL_EP_RND
   2475 }
   2476 
   2477 static int
   2478 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
   2479 {
   2480 	struct ath_hal *ah = sc->sc_ah;
   2481 	int error;
   2482 	struct mbuf *m;
   2483 	struct ath_desc *ds;
   2484 
   2485 	m = bf->bf_m;
   2486 	if (m == NULL) {
   2487 		/*
   2488 		 * NB: by assigning a page to the rx dma buffer we
   2489 		 * implicitly satisfy the Atheros requirement that
   2490 		 * this buffer be cache-line-aligned and sized to be
   2491 		 * multiple of the cache line size.  Not doing this
   2492 		 * causes weird stuff to happen (for the 5210 at least).
   2493 		 */
   2494 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
   2495 		if (m == NULL) {
   2496 			DPRINTF(sc, ATH_DEBUG_ANY,
   2497 				"%s: no mbuf/cluster\n", __func__);
   2498 			sc->sc_stats.ast_rx_nombuf++;
   2499 			return ENOMEM;
   2500 		}
   2501 		bf->bf_m = m;
   2502 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
   2503 
   2504 		error = bus_dmamap_load_mbuf_sg(sc->sc_dmat,
   2505 					     bf->bf_dmamap, m,
   2506 					     bf->bf_segs, &bf->bf_nseg,
   2507 					     BUS_DMA_NOWAIT);
   2508 		if (error != 0) {
   2509 			DPRINTF(sc, ATH_DEBUG_ANY,
   2510 			    "%s: bus_dmamap_load_mbuf_sg failed; error %d\n",
   2511 			    __func__, error);
   2512 			sc->sc_stats.ast_rx_busdma++;
   2513 			return error;
   2514 		}
   2515 		KASSERT(bf->bf_nseg == 1,
   2516 			("multi-segment packet; nseg %u", bf->bf_nseg));
   2517 	}
   2518 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREREAD);
   2519 
   2520 	/*
   2521 	 * Setup descriptors.  For receive we always terminate
   2522 	 * the descriptor list with a self-linked entry so we'll
   2523 	 * not get overrun under high load (as can happen with a
   2524 	 * 5212 when ANI processing enables PHY error frames).
   2525 	 *
   2526 	 * To insure the last descriptor is self-linked we create
   2527 	 * each descriptor as self-linked and add it to the end.  As
   2528 	 * each additional descriptor is added the previous self-linked
   2529 	 * entry is ``fixed'' naturally.  This should be safe even
   2530 	 * if DMA is happening.  When processing RX interrupts we
   2531 	 * never remove/process the last, self-linked, entry on the
   2532 	 * descriptor list.  This insures the hardware always has
   2533 	 * someplace to write a new frame.
   2534 	 */
   2535 	ds = bf->bf_desc;
   2536 	ds->ds_link = bf->bf_daddr;	/* link to self */
   2537 	ds->ds_data = bf->bf_segs[0].ds_addr;
   2538 	ath_hal_setuprxdesc(ah, ds
   2539 		, m->m_len		/* buffer size */
   2540 		, 0
   2541 	);
   2542 
   2543 	if (sc->sc_rxlink != NULL)
   2544 		*sc->sc_rxlink = bf->bf_daddr;
   2545 	sc->sc_rxlink = &ds->ds_link;
   2546 	return 0;
   2547 }
   2548 
   2549 /*
   2550  * Extend 15-bit time stamp from rx descriptor to
   2551  * a full 64-bit TSF using the current h/w TSF.
   2552  */
   2553 static __inline u_int64_t
   2554 ath_extend_tsf(struct ath_hal *ah, u_int32_t rstamp)
   2555 {
   2556 	u_int64_t tsf;
   2557 
   2558 	tsf = ath_hal_gettsf64(ah);
   2559 	if ((tsf & 0x7fff) < rstamp)
   2560 		tsf -= 0x8000;
   2561 	return ((tsf &~ 0x7fff) | rstamp);
   2562 }
   2563 
   2564 /*
   2565  * Intercept management frames to collect beacon rssi data
   2566  * and to do ibss merges.
   2567  */
   2568 static void
   2569 ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
   2570 	struct ieee80211_node *ni,
   2571 	int subtype, int rssi, u_int32_t rstamp)
   2572 {
   2573 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   2574 
   2575 	/*
   2576 	 * Call up first so subsequent work can use information
   2577 	 * potentially stored in the node (e.g. for ibss merge).
   2578 	 */
   2579 	sc->sc_recv_mgmt(ic, m, ni, subtype, rssi, rstamp);
   2580 	switch (subtype) {
   2581 	case IEEE80211_FC0_SUBTYPE_BEACON:
   2582 		/* update rssi statistics for use by the hal */
   2583 		ATH_RSSI_LPF(ATH_NODE(ni)->an_halstats.ns_avgbrssi, rssi);
   2584 		/* fall thru... */
   2585 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
   2586 		if (ic->ic_opmode == IEEE80211_M_IBSS &&
   2587 		    ic->ic_state == IEEE80211_S_RUN) {
   2588 			u_int64_t tsf = ath_extend_tsf(sc->sc_ah, rstamp);
   2589 			/*
   2590 			 * Handle ibss merge as needed; check the tsf on the
   2591 			 * frame before attempting the merge.  The 802.11 spec
   2592 			 * says the station should change it's bssid to match
   2593 			 * the oldest station with the same ssid, where oldest
   2594 			 * is determined by the tsf.  Note that hardware
   2595 			 * reconfiguration happens through callback to
   2596 			 * ath_newstate as the state machine will go from
   2597 			 * RUN -> RUN when this happens.
   2598 			 */
   2599 			if (le64toh(ni->ni_tstamp.tsf) >= tsf) {
   2600 				DPRINTF(sc, ATH_DEBUG_STATE,
   2601 				    "ibss merge, rstamp %u tsf %ju "
   2602 				    "tstamp %ju\n", rstamp, (uintmax_t)tsf,
   2603 				    (uintmax_t)ni->ni_tstamp.tsf);
   2604 				(void) ieee80211_ibss_merge(ic, ni);
   2605 			}
   2606 		}
   2607 		break;
   2608 	}
   2609 }
   2610 
   2611 /*
   2612  * Set the default antenna.
   2613  */
   2614 static void
   2615 ath_setdefantenna(struct ath_softc *sc, u_int antenna)
   2616 {
   2617 	struct ath_hal *ah = sc->sc_ah;
   2618 
   2619 	/* XXX block beacon interrupts */
   2620 	ath_hal_setdefantenna(ah, antenna);
   2621 	if (sc->sc_defant != antenna)
   2622 		sc->sc_stats.ast_ant_defswitch++;
   2623 	sc->sc_defant = antenna;
   2624 	sc->sc_rxotherant = 0;
   2625 }
   2626 
   2627 static void
   2628 ath_rx_proc(void *arg, int npending)
   2629 {
   2630 #define	PA2DESC(_sc, _pa) \
   2631 	((struct ath_desc *)((caddr_t)(_sc)->sc_rxdma.dd_desc + \
   2632 		((_pa) - (_sc)->sc_rxdma.dd_desc_paddr)))
   2633 	struct ath_softc *sc = arg;
   2634 	struct ath_buf *bf;
   2635 	struct ieee80211com *ic = &sc->sc_ic;
   2636 	struct ifnet *ifp = sc->sc_ifp;
   2637 	struct ath_hal *ah = sc->sc_ah;
   2638 	struct ath_desc *ds;
   2639 	struct mbuf *m;
   2640 	struct ieee80211_node *ni;
   2641 	struct ath_node *an;
   2642 	int len, type;
   2643 	u_int phyerr;
   2644 	HAL_STATUS status;
   2645 
   2646 	NET_LOCK_GIANT();		/* XXX */
   2647 
   2648 	DPRINTF(sc, ATH_DEBUG_RX_PROC, "%s: pending %u\n", __func__, npending);
   2649 	do {
   2650 		bf = STAILQ_FIRST(&sc->sc_rxbuf);
   2651 		if (bf == NULL) {		/* NB: shouldn't happen */
   2652 			if_printf(ifp, "%s: no buffer!\n", __func__);
   2653 			break;
   2654 		}
   2655 		ds = bf->bf_desc;
   2656 		if (ds->ds_link == bf->bf_daddr) {
   2657 			/* NB: never process the self-linked entry at the end */
   2658 			break;
   2659 		}
   2660 		m = bf->bf_m;
   2661 		if (m == NULL) {		/* NB: shouldn't happen */
   2662 			if_printf(ifp, "%s: no mbuf!\n", __func__);
   2663 			continue;
   2664 		}
   2665 		/* XXX sync descriptor memory */
   2666 		/*
   2667 		 * Must provide the virtual address of the current
   2668 		 * descriptor, the physical address, and the virtual
   2669 		 * address of the next descriptor in the h/w chain.
   2670 		 * This allows the HAL to look ahead to see if the
   2671 		 * hardware is done with a descriptor by checking the
   2672 		 * done bit in the following descriptor and the address
   2673 		 * of the current descriptor the DMA engine is working
   2674 		 * on.  All this is necessary because of our use of
   2675 		 * a self-linked list to avoid rx overruns.
   2676 		 */
   2677 		status = ath_hal_rxprocdesc(ah, ds,
   2678 				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
   2679 #ifdef AR_DEBUG
   2680 		if (sc->sc_debug & ATH_DEBUG_RECV_DESC)
   2681 			ath_printrxbuf(bf, status == HAL_OK);
   2682 #endif
   2683 		if (status == HAL_EINPROGRESS)
   2684 			break;
   2685 		STAILQ_REMOVE_HEAD(&sc->sc_rxbuf, bf_list);
   2686 		if (ds->ds_rxstat.rs_more) {
   2687 			/*
   2688 			 * Frame spans multiple descriptors; this
   2689 			 * cannot happen yet as we don't support
   2690 			 * jumbograms.  If not in monitor mode,
   2691 			 * discard the frame.
   2692 			 */
   2693 			if (ic->ic_opmode != IEEE80211_M_MONITOR) {
   2694 				sc->sc_stats.ast_rx_toobig++;
   2695 				goto rx_next;
   2696 			}
   2697 			/* fall thru for monitor mode handling... */
   2698 		} else if (ds->ds_rxstat.rs_status != 0) {
   2699 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
   2700 				sc->sc_stats.ast_rx_crcerr++;
   2701 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
   2702 				sc->sc_stats.ast_rx_fifoerr++;
   2703 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
   2704 				sc->sc_stats.ast_rx_phyerr++;
   2705 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
   2706 				sc->sc_stats.ast_rx_phy[phyerr]++;
   2707 				goto rx_next;
   2708 			}
   2709 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT) {
   2710 				/*
   2711 				 * Decrypt error.  If the error occurred
   2712 				 * because there was no hardware key, then
   2713 				 * let the frame through so the upper layers
   2714 				 * can process it.  This is necessary for 5210
   2715 				 * parts which have no way to setup a ``clear''
   2716 				 * key cache entry.
   2717 				 *
   2718 				 * XXX do key cache faulting
   2719 				 */
   2720 				if (ds->ds_rxstat.rs_keyix == HAL_RXKEYIX_INVALID)
   2721 					goto rx_accept;
   2722 				sc->sc_stats.ast_rx_badcrypt++;
   2723 			}
   2724 			if (ds->ds_rxstat.rs_status & HAL_RXERR_MIC) {
   2725 				sc->sc_stats.ast_rx_badmic++;
   2726 				/*
   2727 				 * Do minimal work required to hand off
   2728 				 * the 802.11 header for notifcation.
   2729 				 */
   2730 				/* XXX frag's and qos frames */
   2731 				len = ds->ds_rxstat.rs_datalen;
   2732 				if (len >= sizeof (struct ieee80211_frame)) {
   2733 					bus_dmamap_sync(sc->sc_dmat,
   2734 					    bf->bf_dmamap,
   2735 					    BUS_DMASYNC_POSTREAD);
   2736 					ieee80211_notify_michael_failure(ic,
   2737 					    mtod(m, struct ieee80211_frame *),
   2738 					    sc->sc_splitmic ?
   2739 					        ds->ds_rxstat.rs_keyix-32 :
   2740 					        ds->ds_rxstat.rs_keyix
   2741 					);
   2742 				}
   2743 			}
   2744 			ifp->if_ierrors++;
   2745 			/*
   2746 			 * Reject error frames, we normally don't want
   2747 			 * to see them in monitor mode (in monitor mode
   2748 			 * allow through packets that have crypto problems).
   2749 			 */
   2750 			if ((ds->ds_rxstat.rs_status &~
   2751 				(HAL_RXERR_DECRYPT|HAL_RXERR_MIC)) ||
   2752 			    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
   2753 				goto rx_next;
   2754 		}
   2755 rx_accept:
   2756 		/*
   2757 		 * Sync and unmap the frame.  At this point we're
   2758 		 * committed to passing the mbuf somewhere so clear
   2759 		 * bf_m; this means a new sk_buff must be allocated
   2760 		 * when the rx descriptor is setup again to receive
   2761 		 * another frame.
   2762 		 */
   2763 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
   2764 		    BUS_DMASYNC_POSTREAD);
   2765 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   2766 		bf->bf_m = NULL;
   2767 
   2768 		m->m_pkthdr.rcvif = ifp;
   2769 		len = ds->ds_rxstat.rs_datalen;
   2770 		m->m_pkthdr.len = m->m_len = len;
   2771 
   2772 		sc->sc_stats.ast_ant_rx[ds->ds_rxstat.rs_antenna]++;
   2773 
   2774 		if (sc->sc_drvbpf) {
   2775 			u_int8_t rix;
   2776 
   2777 			/*
   2778 			 * Discard anything shorter than an ack or cts.
   2779 			 */
   2780 			if (len < IEEE80211_ACK_LEN) {
   2781 				DPRINTF(sc, ATH_DEBUG_RECV,
   2782 					"%s: runt packet %d\n",
   2783 					__func__, len);
   2784 				sc->sc_stats.ast_rx_tooshort++;
   2785 				m_freem(m);
   2786 				goto rx_next;
   2787 			}
   2788 			rix = ds->ds_rxstat.rs_rate;
   2789 			sc->sc_rx_th.wr_flags = sc->sc_hwmap[rix].rxflags;
   2790 			sc->sc_rx_th.wr_rate = sc->sc_hwmap[rix].ieeerate;
   2791 			sc->sc_rx_th.wr_antsignal = ds->ds_rxstat.rs_rssi;
   2792 			sc->sc_rx_th.wr_antenna = ds->ds_rxstat.rs_antenna;
   2793 			/* XXX TSF */
   2794 
   2795 			bpf_mtap2(sc->sc_drvbpf,
   2796 				&sc->sc_rx_th, sc->sc_rx_th_len, m);
   2797 		}
   2798 
   2799 		/*
   2800 		 * From this point on we assume the frame is at least
   2801 		 * as large as ieee80211_frame_min; verify that.
   2802 		 */
   2803 		if (len < IEEE80211_MIN_LEN) {
   2804 			DPRINTF(sc, ATH_DEBUG_RECV, "%s: short packet %d\n",
   2805 				__func__, len);
   2806 			sc->sc_stats.ast_rx_tooshort++;
   2807 			m_freem(m);
   2808 			goto rx_next;
   2809 		}
   2810 
   2811 		if (IFF_DUMPPKTS(sc, ATH_DEBUG_RECV)) {
   2812 			ieee80211_dump_pkt(mtod(m, caddr_t), len,
   2813 				   sc->sc_hwmap[ds->ds_rxstat.rs_rate].ieeerate,
   2814 				   ds->ds_rxstat.rs_rssi);
   2815 		}
   2816 
   2817 		m_adj(m, -IEEE80211_CRC_LEN);
   2818 
   2819 		/*
   2820 		 * Locate the node for sender, track state, and then
   2821 		 * pass the (referenced) node up to the 802.11 layer
   2822 		 * for its use.  If the sender is unknown spam the
   2823 		 * frame; it'll be dropped where it's not wanted.
   2824 		 */
   2825 		if (ds->ds_rxstat.rs_keyix != HAL_RXKEYIX_INVALID &&
   2826 		    (ni = sc->sc_keyixmap[ds->ds_rxstat.rs_keyix]) != NULL) {
   2827 			/*
   2828 			 * Fast path: node is present in the key map;
   2829 			 * grab a reference for processing the frame.
   2830 			 */
   2831 			an = ATH_NODE(ieee80211_ref_node(ni));
   2832 			ATH_RSSI_LPF(an->an_avgrssi, ds->ds_rxstat.rs_rssi);
   2833 			type = ieee80211_input(ic, m, ni,
   2834 				ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
   2835 		} else {
   2836 			/*
   2837 			 * Locate the node for sender, track state, and then
   2838 			 * pass the (referenced) node up to the 802.11 layer
   2839 			 * for its use.
   2840 			 */
   2841 			ni = ieee80211_find_rxnode(ic,
   2842 				mtod(m, const struct ieee80211_frame_min *));
   2843 			/*
   2844 			 * Track rx rssi and do any rx antenna management.
   2845 			 */
   2846 			an = ATH_NODE(ni);
   2847 			ATH_RSSI_LPF(an->an_avgrssi, ds->ds_rxstat.rs_rssi);
   2848 			/*
   2849 			 * Send frame up for processing.
   2850 			 */
   2851 			type = ieee80211_input(ic, m, ni,
   2852 				ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
   2853 			if (ni != ic->ic_bss) {
   2854 				u_int16_t keyix;
   2855 				/*
   2856 				 * If the station has a key cache slot assigned
   2857 				 * update the key->node mapping table.
   2858 				 */
   2859 				keyix = ni->ni_ucastkey.wk_keyix;
   2860 				if (keyix != IEEE80211_KEYIX_NONE &&
   2861 				    sc->sc_keyixmap[keyix] == NULL)
   2862 					sc->sc_keyixmap[keyix] =
   2863 						ieee80211_ref_node(ni);
   2864 			}
   2865 		}
   2866 		ieee80211_free_node(ni);
   2867 		if (sc->sc_diversity) {
   2868 			/*
   2869 			 * When using fast diversity, change the default rx
   2870 			 * antenna if diversity chooses the other antenna 3
   2871 			 * times in a row.
   2872 			 */
   2873 			if (sc->sc_defant != ds->ds_rxstat.rs_antenna) {
   2874 				if (++sc->sc_rxotherant >= 3)
   2875 					ath_setdefantenna(sc,
   2876 						ds->ds_rxstat.rs_antenna);
   2877 			} else
   2878 				sc->sc_rxotherant = 0;
   2879 		}
   2880 		if (sc->sc_softled) {
   2881 			/*
   2882 			 * Blink for any data frame.  Otherwise do a
   2883 			 * heartbeat-style blink when idle.  The latter
   2884 			 * is mainly for station mode where we depend on
   2885 			 * periodic beacon frames to trigger the poll event.
   2886 			 */
   2887 			if (type == IEEE80211_FC0_TYPE_DATA) {
   2888 				sc->sc_rxrate = ds->ds_rxstat.rs_rate;
   2889 				ath_led_event(sc, ATH_LED_RX);
   2890 			} else if (ticks - sc->sc_ledevent >= sc->sc_ledidle)
   2891 				ath_led_event(sc, ATH_LED_POLL);
   2892 		}
   2893 rx_next:
   2894 		STAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
   2895 	} while (ath_rxbuf_init(sc, bf) == 0);
   2896 
   2897 	/* rx signal state monitoring */
   2898 	ath_hal_rxmonitor(ah, &ATH_NODE(ic->ic_bss)->an_halstats);
   2899 
   2900 	NET_UNLOCK_GIANT();		/* XXX */
   2901 #undef PA2DESC
   2902 }
   2903 
   2904 /*
   2905  * Setup a h/w transmit queue.
   2906  */
   2907 static struct ath_txq *
   2908 ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
   2909 {
   2910 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   2911 	struct ath_hal *ah = sc->sc_ah;
   2912 	HAL_TXQ_INFO qi;
   2913 	int qnum;
   2914 
   2915 	memset(&qi, 0, sizeof(qi));
   2916 	qi.tqi_subtype = subtype;
   2917 	qi.tqi_aifs = HAL_TXQ_USEDEFAULT;
   2918 	qi.tqi_cwmin = HAL_TXQ_USEDEFAULT;
   2919 	qi.tqi_cwmax = HAL_TXQ_USEDEFAULT;
   2920 	/*
   2921 	 * Enable interrupts only for EOL and DESC conditions.
   2922 	 * We mark tx descriptors to receive a DESC interrupt
   2923 	 * when a tx queue gets deep; otherwise waiting for the
   2924 	 * EOL to reap descriptors.  Note that this is done to
   2925 	 * reduce interrupt load and this only defers reaping
   2926 	 * descriptors, never transmitting frames.  Aside from
   2927 	 * reducing interrupts this also permits more concurrency.
   2928 	 * The only potential downside is if the tx queue backs
   2929 	 * up in which case the top half of the kernel may backup
   2930 	 * due to a lack of tx descriptors.
   2931 	 */
   2932 	qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE | TXQ_FLAG_TXDESCINT_ENABLE;
   2933 	qnum = ath_hal_setuptxqueue(ah, qtype, &qi);
   2934 	if (qnum == -1) {
   2935 		/*
   2936 		 * NB: don't print a message, this happens
   2937 		 * normally on parts with too few tx queues
   2938 		 */
   2939 		return NULL;
   2940 	}
   2941 	if (qnum >= N(sc->sc_txq)) {
   2942 		device_printf(sc->sc_dev,
   2943 			"hal qnum %u out of range, max %zu!\n",
   2944 			qnum, N(sc->sc_txq));
   2945 		ath_hal_releasetxqueue(ah, qnum);
   2946 		return NULL;
   2947 	}
   2948 	if (!ATH_TXQ_SETUP(sc, qnum)) {
   2949 		struct ath_txq *txq = &sc->sc_txq[qnum];
   2950 
   2951 		txq->axq_qnum = qnum;
   2952 		txq->axq_depth = 0;
   2953 		txq->axq_intrcnt = 0;
   2954 		txq->axq_link = NULL;
   2955 		STAILQ_INIT(&txq->axq_q);
   2956 		ATH_TXQ_LOCK_INIT(sc, txq);
   2957 		sc->sc_txqsetup |= 1<<qnum;
   2958 	}
   2959 	return &sc->sc_txq[qnum];
   2960 #undef N
   2961 }
   2962 
   2963 /*
   2964  * Setup a hardware data transmit queue for the specified
   2965  * access control.  The hal may not support all requested
   2966  * queues in which case it will return a reference to a
   2967  * previously setup queue.  We record the mapping from ac's
   2968  * to h/w queues for use by ath_tx_start and also track
   2969  * the set of h/w queues being used to optimize work in the
   2970  * transmit interrupt handler and related routines.
   2971  */
   2972 static int
   2973 ath_tx_setup(struct ath_softc *sc, int ac, int haltype)
   2974 {
   2975 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   2976 	struct ath_txq *txq;
   2977 
   2978 	if (ac >= N(sc->sc_ac2q)) {
   2979 		device_printf(sc->sc_dev, "AC %u out of range, max %zu!\n",
   2980 			ac, N(sc->sc_ac2q));
   2981 		return 0;
   2982 	}
   2983 	txq = ath_txq_setup(sc, HAL_TX_QUEUE_DATA, haltype);
   2984 	if (txq != NULL) {
   2985 		sc->sc_ac2q[ac] = txq;
   2986 		return 1;
   2987 	} else
   2988 		return 0;
   2989 #undef N
   2990 }
   2991 
   2992 /*
   2993  * Update WME parameters for a transmit queue.
   2994  */
   2995 static int
   2996 ath_txq_update(struct ath_softc *sc, int ac)
   2997 {
   2998 #define	ATH_EXPONENT_TO_VALUE(v)	((1<<v)-1)
   2999 #define	ATH_TXOP_TO_US(v)		(v<<5)
   3000 	struct ieee80211com *ic = &sc->sc_ic;
   3001 	struct ath_txq *txq = sc->sc_ac2q[ac];
   3002 	struct wmeParams *wmep = &ic->ic_wme.wme_chanParams.cap_wmeParams[ac];
   3003 	struct ath_hal *ah = sc->sc_ah;
   3004 	HAL_TXQ_INFO qi;
   3005 
   3006 	ath_hal_gettxqueueprops(ah, txq->axq_qnum, &qi);
   3007 	qi.tqi_aifs = wmep->wmep_aifsn;
   3008 	qi.tqi_cwmin = ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmin);
   3009 	qi.tqi_cwmax = ATH_EXPONENT_TO_VALUE(wmep->wmep_logcwmax);
   3010 	qi.tqi_burstTime = ATH_TXOP_TO_US(wmep->wmep_txopLimit);
   3011 
   3012 	if (!ath_hal_settxqueueprops(ah, txq->axq_qnum, &qi)) {
   3013 		device_printf(sc->sc_dev, "unable to update hardware queue "
   3014 			"parameters for %s traffic!\n",
   3015 			ieee80211_wme_acnames[ac]);
   3016 		return 0;
   3017 	} else {
   3018 		ath_hal_resettxqueue(ah, txq->axq_qnum); /* push to h/w */
   3019 		return 1;
   3020 	}
   3021 #undef ATH_TXOP_TO_US
   3022 #undef ATH_EXPONENT_TO_VALUE
   3023 }
   3024 
   3025 /*
   3026  * Callback from the 802.11 layer to update WME parameters.
   3027  */
   3028 static int
   3029 ath_wme_update(struct ieee80211com *ic)
   3030 {
   3031 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   3032 
   3033 	return !ath_txq_update(sc, WME_AC_BE) ||
   3034 	    !ath_txq_update(sc, WME_AC_BK) ||
   3035 	    !ath_txq_update(sc, WME_AC_VI) ||
   3036 	    !ath_txq_update(sc, WME_AC_VO) ? EIO : 0;
   3037 }
   3038 
   3039 /*
   3040  * Reclaim resources for a setup queue.
   3041  */
   3042 static void
   3043 ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq)
   3044 {
   3045 
   3046 	ath_hal_releasetxqueue(sc->sc_ah, txq->axq_qnum);
   3047 	ATH_TXQ_LOCK_DESTROY(txq);
   3048 	sc->sc_txqsetup &= ~(1<<txq->axq_qnum);
   3049 }
   3050 
   3051 /*
   3052  * Reclaim all tx queue resources.
   3053  */
   3054 static void
   3055 ath_tx_cleanup(struct ath_softc *sc)
   3056 {
   3057 	int i;
   3058 
   3059 	ATH_TXBUF_LOCK_DESTROY(sc);
   3060 	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
   3061 		if (ATH_TXQ_SETUP(sc, i))
   3062 			ath_tx_cleanupq(sc, &sc->sc_txq[i]);
   3063 }
   3064 
   3065 /*
   3066  * Defragment an mbuf chain, returning at most maxfrags separate
   3067  * mbufs+clusters.  If this is not possible NULL is returned and
   3068  * the original mbuf chain is left in it's present (potentially
   3069  * modified) state.  We use two techniques: collapsing consecutive
   3070  * mbufs and replacing consecutive mbufs by a cluster.
   3071  */
   3072 static struct mbuf *
   3073 ath_defrag(struct mbuf *m0, int how, int maxfrags)
   3074 {
   3075 	struct mbuf *m, *n, *n2, **prev;
   3076 	u_int curfrags;
   3077 
   3078 	/*
   3079 	 * Calculate the current number of frags.
   3080 	 */
   3081 	curfrags = 0;
   3082 	for (m = m0; m != NULL; m = m->m_next)
   3083 		curfrags++;
   3084 	/*
   3085 	 * First, try to collapse mbufs.  Note that we always collapse
   3086 	 * towards the front so we don't need to deal with moving the
   3087 	 * pkthdr.  This may be suboptimal if the first mbuf has much
   3088 	 * less data than the following.
   3089 	 */
   3090 	m = m0;
   3091 again:
   3092 	for (;;) {
   3093 		n = m->m_next;
   3094 		if (n == NULL)
   3095 			break;
   3096 		if ((m->m_flags & M_RDONLY) == 0 &&
   3097 		    n->m_len < M_TRAILINGSPACE(m)) {
   3098 			bcopy(mtod(n, void *), mtod(m, char *) + m->m_len,
   3099 				n->m_len);
   3100 			m->m_len += n->m_len;
   3101 			m->m_next = n->m_next;
   3102 			m_free(n);
   3103 			if (--curfrags <= maxfrags)
   3104 				return m0;
   3105 		} else
   3106 			m = n;
   3107 	}
   3108 	KASSERT(maxfrags > 1,
   3109 		("maxfrags %u, but normal collapse failed", maxfrags));
   3110 	/*
   3111 	 * Collapse consecutive mbufs to a cluster.
   3112 	 */
   3113 	prev = &m0->m_next;		/* NB: not the first mbuf */
   3114 	while ((n = *prev) != NULL) {
   3115 		if ((n2 = n->m_next) != NULL &&
   3116 		    n->m_len + n2->m_len < MCLBYTES) {
   3117 			m = m_getcl(how, MT_DATA, 0);
   3118 			if (m == NULL)
   3119 				goto bad;
   3120 			bcopy(mtod(n, void *), mtod(m, void *), n->m_len);
   3121 			bcopy(mtod(n2, void *), mtod(m, char *) + n->m_len,
   3122 				n2->m_len);
   3123 			m->m_len = n->m_len + n2->m_len;
   3124 			m->m_next = n2->m_next;
   3125 			*prev = m;
   3126 			m_free(n);
   3127 			m_free(n2);
   3128 			if (--curfrags <= maxfrags)	/* +1 cl -2 mbufs */
   3129 				return m0;
   3130 			/*
   3131 			 * Still not there, try the normal collapse
   3132 			 * again before we allocate another cluster.
   3133 			 */
   3134 			goto again;
   3135 		}
   3136 		prev = &n->m_next;
   3137 	}
   3138 	/*
   3139 	 * No place where we can collapse to a cluster; punt.
   3140 	 * This can occur if, for example, you request 2 frags
   3141 	 * but the packet requires that both be clusters (we
   3142 	 * never reallocate the first mbuf to avoid moving the
   3143 	 * packet header).
   3144 	 */
   3145 bad:
   3146 	return NULL;
   3147 }
   3148 
   3149 static int
   3150 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
   3151     struct mbuf *m0)
   3152 {
   3153 #define	CTS_DURATION \
   3154 	ath_hal_computetxtime(ah, rt, IEEE80211_ACK_LEN, cix, AH_TRUE)
   3155 #define	updateCTSForBursting(_ah, _ds, _txq) \
   3156 	ath_hal_updateCTSForBursting(_ah, _ds, \
   3157 	    _txq->axq_linkbuf != NULL ? _txq->axq_linkbuf->bf_desc : NULL, \
   3158 	    _txq->axq_lastdsWithCTS, _txq->axq_gatingds, \
   3159 	    txopLimit, CTS_DURATION)
   3160 	struct ieee80211com *ic = &sc->sc_ic;
   3161 	struct ath_hal *ah = sc->sc_ah;
   3162 	struct ifnet *ifp = sc->sc_ifp;
   3163 	const struct chanAccParams *cap = &ic->ic_wme.wme_chanParams;
   3164 	int i, error, iswep, ismcast, keyix, hdrlen, pktlen, try0;
   3165 	u_int8_t rix, txrate, ctsrate;
   3166 	u_int8_t cix = 0xff;		/* NB: silence compiler */
   3167 	struct ath_desc *ds, *ds0;
   3168 	struct ath_txq *txq;
   3169 	struct ieee80211_frame *wh;
   3170 	u_int subtype, flags, ctsduration;
   3171 	HAL_PKT_TYPE atype;
   3172 	const HAL_RATE_TABLE *rt;
   3173 	HAL_BOOL shortPreamble;
   3174 	struct ath_node *an;
   3175 	struct mbuf *m;
   3176 	u_int pri;
   3177 
   3178 	wh = mtod(m0, struct ieee80211_frame *);
   3179 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
   3180 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
   3181 	hdrlen = ieee80211_anyhdrsize(wh);
   3182 	/*
   3183 	 * Packet length must not include any
   3184 	 * pad bytes; deduct them here.
   3185 	 */
   3186 	pktlen = m0->m_pkthdr.len - (hdrlen & 3);
   3187 
   3188 	if (iswep) {
   3189 		const struct ieee80211_cipher *cip;
   3190 		struct ieee80211_key *k;
   3191 
   3192 		/*
   3193 		 * Construct the 802.11 header+trailer for an encrypted
   3194 		 * frame. The only reason this can fail is because of an
   3195 		 * unknown or unsupported cipher/key type.
   3196 		 */
   3197 		k = ieee80211_crypto_encap(ic, ni, m0);
   3198 		if (k == NULL) {
   3199 			/*
   3200 			 * This can happen when the key is yanked after the
   3201 			 * frame was queued.  Just discard the frame; the
   3202 			 * 802.11 layer counts failures and provides
   3203 			 * debugging/diagnostics.
   3204 			 */
   3205 			m_freem(m0);
   3206 			return EIO;
   3207 		}
   3208 		/*
   3209 		 * Adjust the packet + header lengths for the crypto
   3210 		 * additions and calculate the h/w key index.  When
   3211 		 * a s/w mic is done the frame will have had any mic
   3212 		 * added to it prior to entry so skb->len above will
   3213 		 * account for it. Otherwise we need to add it to the
   3214 		 * packet length.
   3215 		 */
   3216 		cip = k->wk_cipher;
   3217 		hdrlen += cip->ic_header;
   3218 		pktlen += cip->ic_header + cip->ic_trailer;
   3219 		if ((k->wk_flags & IEEE80211_KEY_SWMIC) == 0)
   3220 			pktlen += cip->ic_miclen;
   3221 		keyix = k->wk_keyix;
   3222 
   3223 		/* packet header may have moved, reset our local pointer */
   3224 		wh = mtod(m0, struct ieee80211_frame *);
   3225 	} else if (ni->ni_ucastkey.wk_cipher == &ieee80211_cipher_none) {
   3226 		/*
   3227 		 * Use station key cache slot, if assigned.
   3228 		 */
   3229 		keyix = ni->ni_ucastkey.wk_keyix;
   3230 		if (keyix == IEEE80211_KEYIX_NONE)
   3231 			keyix = HAL_TXKEYIX_INVALID;
   3232 	} else
   3233 		keyix = HAL_TXKEYIX_INVALID;
   3234 
   3235 	pktlen += IEEE80211_CRC_LEN;
   3236 
   3237 	/*
   3238 	 * Load the DMA map so any coalescing is done.  This
   3239 	 * also calculates the number of descriptors we need.
   3240 	 */
   3241 	error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m0,
   3242 				     bf->bf_segs, &bf->bf_nseg,
   3243 				     BUS_DMA_NOWAIT);
   3244 	if (error == EFBIG) {
   3245 		/* XXX packet requires too many descriptors */
   3246 		bf->bf_nseg = ATH_TXDESC+1;
   3247 	} else if (error != 0) {
   3248 		sc->sc_stats.ast_tx_busdma++;
   3249 		m_freem(m0);
   3250 		return error;
   3251 	}
   3252 	/*
   3253 	 * Discard null packets and check for packets that
   3254 	 * require too many TX descriptors.  We try to convert
   3255 	 * the latter to a cluster.
   3256 	 */
   3257 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
   3258 		sc->sc_stats.ast_tx_linear++;
   3259 		m = ath_defrag(m0, M_DONTWAIT, ATH_TXDESC);
   3260 		if (m == NULL) {
   3261 			m_freem(m0);
   3262 			sc->sc_stats.ast_tx_nombuf++;
   3263 			return ENOMEM;
   3264 		}
   3265 		m0 = m;
   3266 		error = bus_dmamap_load_mbuf_sg(sc->sc_dmat, bf->bf_dmamap, m0,
   3267 					     bf->bf_segs, &bf->bf_nseg,
   3268 					     BUS_DMA_NOWAIT);
   3269 		if (error != 0) {
   3270 			sc->sc_stats.ast_tx_busdma++;
   3271 			m_freem(m0);
   3272 			return error;
   3273 		}
   3274 		KASSERT(bf->bf_nseg <= ATH_TXDESC,
   3275 		    ("too many segments after defrag; nseg %u", bf->bf_nseg));
   3276 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
   3277 		sc->sc_stats.ast_tx_nodata++;
   3278 		m_freem(m0);
   3279 		return EIO;
   3280 	}
   3281 	DPRINTF(sc, ATH_DEBUG_XMIT, "%s: m %p len %u\n", __func__, m0, pktlen);
   3282 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
   3283 	bf->bf_m = m0;
   3284 	bf->bf_node = ni;			/* NB: held reference */
   3285 
   3286 	/* setup descriptors */
   3287 	ds = bf->bf_desc;
   3288 	rt = sc->sc_currates;
   3289 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
   3290 
   3291 	/*
   3292 	 * NB: the 802.11 layer marks whether or not we should
   3293 	 * use short preamble based on the current mode and
   3294 	 * negotiated parameters.
   3295 	 */
   3296 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
   3297 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
   3298 		shortPreamble = AH_TRUE;
   3299 		sc->sc_stats.ast_tx_shortpre++;
   3300 	} else {
   3301 		shortPreamble = AH_FALSE;
   3302 	}
   3303 
   3304 	an = ATH_NODE(ni);
   3305 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for crypto errs */
   3306 	/*
   3307 	 * Calculate Atheros packet type from IEEE80211 packet header,
   3308 	 * setup for rate calculations, and select h/w transmit queue.
   3309 	 */
   3310 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
   3311 	case IEEE80211_FC0_TYPE_MGT:
   3312 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
   3313 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
   3314 			atype = HAL_PKT_TYPE_BEACON;
   3315 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
   3316 			atype = HAL_PKT_TYPE_PROBE_RESP;
   3317 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
   3318 			atype = HAL_PKT_TYPE_ATIM;
   3319 		else
   3320 			atype = HAL_PKT_TYPE_NORMAL;	/* XXX */
   3321 		rix = 0;			/* XXX lowest rate */
   3322 		try0 = ATH_TXMAXTRY;
   3323 		if (shortPreamble)
   3324 			txrate = an->an_tx_mgtratesp;
   3325 		else
   3326 			txrate = an->an_tx_mgtrate;
   3327 		/* NB: force all management frames to highest queue */
   3328 		if (ni->ni_flags & IEEE80211_NODE_QOS) {
   3329 			/* NB: force all management frames to highest queue */
   3330 			pri = WME_AC_VO;
   3331 		} else
   3332 			pri = WME_AC_BE;
   3333 		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
   3334 		break;
   3335 	case IEEE80211_FC0_TYPE_CTL:
   3336 		atype = HAL_PKT_TYPE_PSPOLL;	/* stop setting of duration */
   3337 		rix = 0;			/* XXX lowest rate */
   3338 		try0 = ATH_TXMAXTRY;
   3339 		if (shortPreamble)
   3340 			txrate = an->an_tx_mgtratesp;
   3341 		else
   3342 			txrate = an->an_tx_mgtrate;
   3343 		/* NB: force all ctl frames to highest queue */
   3344 		if (ni->ni_flags & IEEE80211_NODE_QOS) {
   3345 			/* NB: force all ctl frames to highest queue */
   3346 			pri = WME_AC_VO;
   3347 		} else
   3348 			pri = WME_AC_BE;
   3349 		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
   3350 		break;
   3351 	case IEEE80211_FC0_TYPE_DATA:
   3352 		atype = HAL_PKT_TYPE_NORMAL;		/* default */
   3353 		/*
   3354 		 * Data frames; consult the rate control module.
   3355 		 */
   3356 		ath_rate_findrate(sc, an, shortPreamble, pktlen,
   3357 			&rix, &try0, &txrate);
   3358 		sc->sc_txrate = txrate;			/* for LED blinking */
   3359 		/*
   3360 		 * Default all non-QoS traffic to the background queue.
   3361 		 */
   3362 		if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
   3363 			pri = M_WME_GETAC(m0);
   3364 			if (cap->cap_wmeParams[pri].wmep_noackPolicy) {
   3365 				flags |= HAL_TXDESC_NOACK;
   3366 				sc->sc_stats.ast_tx_noack++;
   3367 			}
   3368 		} else
   3369 			pri = WME_AC_BE;
   3370 		break;
   3371 	default:
   3372 		if_printf(ifp, "bogus frame type 0x%x (%s)\n",
   3373 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
   3374 		/* XXX statistic */
   3375 		m_freem(m0);
   3376 		return EIO;
   3377 	}
   3378 	txq = sc->sc_ac2q[pri];
   3379 
   3380 	/*
   3381 	 * When servicing one or more stations in power-save mode
   3382 	 * multicast frames must be buffered until after the beacon.
   3383 	 * We use the CAB queue for that.
   3384 	 */
   3385 	if (ismcast && ic->ic_ps_sta) {
   3386 		txq = sc->sc_cabq;
   3387 		/* XXX? more bit in 802.11 frame header */
   3388 	}
   3389 
   3390 	/*
   3391 	 * Calculate miscellaneous flags.
   3392 	 */
   3393 	if (ismcast) {
   3394 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
   3395 		sc->sc_stats.ast_tx_noack++;
   3396 	} else if (pktlen > ic->ic_rtsthreshold) {
   3397 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
   3398 		cix = rt->info[rix].controlRate;
   3399 		sc->sc_stats.ast_tx_rts++;
   3400 	}
   3401 
   3402 	/*
   3403 	 * If 802.11g protection is enabled, determine whether
   3404 	 * to use RTS/CTS or just CTS.  Note that this is only
   3405 	 * done for OFDM unicast frames.
   3406 	 */
   3407 	if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
   3408 	    rt->info[rix].phy == IEEE80211_T_OFDM &&
   3409 	    (flags & HAL_TXDESC_NOACK) == 0) {
   3410 		/* XXX fragments must use CCK rates w/ protection */
   3411 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
   3412 			flags |= HAL_TXDESC_RTSENA;
   3413 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
   3414 			flags |= HAL_TXDESC_CTSENA;
   3415 		cix = rt->info[sc->sc_protrix].controlRate;
   3416 		sc->sc_stats.ast_tx_protect++;
   3417 	}
   3418 
   3419 	/*
   3420 	 * Calculate duration.  This logically belongs in the 802.11
   3421 	 * layer but it lacks sufficient information to calculate it.
   3422 	 */
   3423 	if ((flags & HAL_TXDESC_NOACK) == 0 &&
   3424 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
   3425 		u_int16_t dur;
   3426 		/*
   3427 		 * XXX not right with fragmentation.
   3428 		 */
   3429 		if (shortPreamble)
   3430 			dur = rt->info[rix].spAckDuration;
   3431 		else
   3432 			dur = rt->info[rix].lpAckDuration;
   3433 		*(u_int16_t *)wh->i_dur = htole16(dur);
   3434 	}
   3435 
   3436 	/*
   3437 	 * Calculate RTS/CTS rate and duration if needed.
   3438 	 */
   3439 	ctsduration = 0;
   3440 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
   3441 		/*
   3442 		 * CTS transmit rate is derived from the transmit rate
   3443 		 * by looking in the h/w rate table.  We must also factor
   3444 		 * in whether or not a short preamble is to be used.
   3445 		 */
   3446 		/* NB: cix is set above where RTS/CTS is enabled */
   3447 		KASSERT(cix != 0xff, ("cix not setup"));
   3448 		ctsrate = rt->info[cix].rateCode;
   3449 		/*
   3450 		 * Compute the transmit duration based on the frame
   3451 		 * size and the size of an ACK frame.  We call into the
   3452 		 * HAL to do the computation since it depends on the
   3453 		 * characteristics of the actual PHY being used.
   3454 		 *
   3455 		 * NB: CTS is assumed the same size as an ACK so we can
   3456 		 *     use the precalculated ACK durations.
   3457 		 */
   3458 		if (shortPreamble) {
   3459 			ctsrate |= rt->info[cix].shortPreamble;
   3460 			if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
   3461 				ctsduration += rt->info[cix].spAckDuration;
   3462 			ctsduration += ath_hal_computetxtime(ah,
   3463 				rt, pktlen, rix, AH_TRUE);
   3464 			if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
   3465 				ctsduration += rt->info[cix].spAckDuration;
   3466 		} else {
   3467 			if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
   3468 				ctsduration += rt->info[cix].lpAckDuration;
   3469 			ctsduration += ath_hal_computetxtime(ah,
   3470 				rt, pktlen, rix, AH_FALSE);
   3471 			if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
   3472 				ctsduration += rt->info[cix].lpAckDuration;
   3473 		}
   3474 		/*
   3475 		 * Must disable multi-rate retry when using RTS/CTS.
   3476 		 */
   3477 		try0 = ATH_TXMAXTRY;
   3478 	} else
   3479 		ctsrate = 0;
   3480 
   3481 	if (IFF_DUMPPKTS(sc, ATH_DEBUG_XMIT))
   3482 		ieee80211_dump_pkt(mtod(m0, caddr_t), m0->m_len,
   3483 			sc->sc_hwmap[txrate].ieeerate, -1);
   3484 
   3485 	if (ic->ic_rawbpf)
   3486 		bpf_mtap(ic->ic_rawbpf, m0);
   3487 	if (sc->sc_drvbpf) {
   3488 		sc->sc_tx_th.wt_flags = sc->sc_hwmap[txrate].txflags;
   3489 		if (iswep)
   3490 			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
   3491 		sc->sc_tx_th.wt_rate = sc->sc_hwmap[txrate].ieeerate;
   3492 		sc->sc_tx_th.wt_txpower = ni->ni_txpower;
   3493 		sc->sc_tx_th.wt_antenna = sc->sc_txantenna;
   3494 
   3495 		bpf_mtap2(sc->sc_drvbpf,
   3496 			&sc->sc_tx_th, sc->sc_tx_th_len, m0);
   3497 	}
   3498 
   3499 	/*
   3500 	 * Determine if a tx interrupt should be generated for
   3501 	 * this descriptor.  We take a tx interrupt to reap
   3502 	 * descriptors when the h/w hits an EOL condition or
   3503 	 * when the descriptor is specifically marked to generate
   3504 	 * an interrupt.  We periodically mark descriptors in this
   3505 	 * way to insure timely replenishing of the supply needed
   3506 	 * for sending frames.  Defering interrupts reduces system
   3507 	 * load and potentially allows more concurrent work to be
   3508 	 * done but if done to aggressively can cause senders to
   3509 	 * backup.
   3510 	 *
   3511 	 * NB: use >= to deal with sc_txintrperiod changing
   3512 	 *     dynamically through sysctl.
   3513 	 */
   3514 	if (flags & HAL_TXDESC_INTREQ) {
   3515 		txq->axq_intrcnt = 0;
   3516 	} else if (++txq->axq_intrcnt >= sc->sc_txintrperiod) {
   3517 		flags |= HAL_TXDESC_INTREQ;
   3518 		txq->axq_intrcnt = 0;
   3519 	}
   3520 
   3521 	/*
   3522 	 * Formulate first tx descriptor with tx controls.
   3523 	 */
   3524 	/* XXX check return value? */
   3525 	ath_hal_setuptxdesc(ah, ds
   3526 		, pktlen		/* packet length */
   3527 		, hdrlen		/* header length */
   3528 		, atype			/* Atheros packet type */
   3529 		, ni->ni_txpower	/* txpower */
   3530 		, txrate, try0		/* series 0 rate/tries */
   3531 		, keyix			/* key cache index */
   3532 		, sc->sc_txantenna	/* antenna mode */
   3533 		, flags			/* flags */
   3534 		, ctsrate		/* rts/cts rate */
   3535 		, ctsduration		/* rts/cts duration */
   3536 	);
   3537 	bf->bf_flags = flags;
   3538 	/*
   3539 	 * Setup the multi-rate retry state only when we're
   3540 	 * going to use it.  This assumes ath_hal_setuptxdesc
   3541 	 * initializes the descriptors (so we don't have to)
   3542 	 * when the hardware supports multi-rate retry and
   3543 	 * we don't use it.
   3544 	 */
   3545 	if (try0 != ATH_TXMAXTRY)
   3546 		ath_rate_setupxtxdesc(sc, an, ds, shortPreamble, rix);
   3547 
   3548 	/*
   3549 	 * Fillin the remainder of the descriptor info.
   3550 	 */
   3551 	ds0 = ds;
   3552 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
   3553 		ds->ds_data = bf->bf_segs[i].ds_addr;
   3554 		if (i == bf->bf_nseg - 1)
   3555 			ds->ds_link = 0;
   3556 		else
   3557 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
   3558 		ath_hal_filltxdesc(ah, ds
   3559 			, bf->bf_segs[i].ds_len	/* segment length */
   3560 			, i == 0		/* first segment */
   3561 			, i == bf->bf_nseg - 1	/* last segment */
   3562 			, ds0			/* first descriptor */
   3563 		);
   3564 		DPRINTF(sc, ATH_DEBUG_XMIT,
   3565 			"%s: %d: %08x %08x %08x %08x %08x %08x\n",
   3566 			__func__, i, ds->ds_link, ds->ds_data,
   3567 			ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]);
   3568 	}
   3569 	/*
   3570 	 * Insert the frame on the outbound list and
   3571 	 * pass it on to the hardware.
   3572 	 */
   3573 	ATH_TXQ_LOCK(txq);
   3574 	if (flags & (HAL_TXDESC_RTSENA | HAL_TXDESC_CTSENA)) {
   3575 		u_int32_t txopLimit = IEEE80211_TXOP_TO_US(
   3576 			cap->cap_wmeParams[pri].wmep_txopLimit);
   3577 		/*
   3578 		 * When bursting, potentially extend the CTS duration
   3579 		 * of a previously queued frame to cover this frame
   3580 		 * and not exceed the txopLimit.  If that can be done
   3581 		 * then disable RTS/CTS on this frame since it's now
   3582 		 * covered (burst extension).  Otherwise we must terminate
   3583 		 * the burst before this frame goes out so as not to
   3584 		 * violate the WME parameters.  All this is complicated
   3585 		 * as we need to update the state of packets on the
   3586 		 * (live) hardware queue.  The logic is buried in the hal
   3587 		 * because it's highly chip-specific.
   3588 		 */
   3589 		if (txopLimit != 0) {
   3590 			sc->sc_stats.ast_tx_ctsburst++;
   3591 			if (updateCTSForBursting(ah, ds0, txq) == 0) {
   3592 				/*
   3593 				 * This frame was not covered by RTS/CTS from
   3594 				 * the previous frame in the burst; update the
   3595 				 * descriptor pointers so this frame is now
   3596 				 * treated as the last frame for extending a
   3597 				 * burst.
   3598 				 */
   3599 				txq->axq_lastdsWithCTS = ds0;
   3600 				/* set gating Desc to final desc */
   3601 				txq->axq_gatingds =
   3602 					(struct ath_desc *)txq->axq_link;
   3603 			} else
   3604 				sc->sc_stats.ast_tx_ctsext++;
   3605 		}
   3606 	}
   3607 	ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
   3608 	if (txq->axq_link == NULL) {
   3609 		ath_hal_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
   3610 		DPRINTF(sc, ATH_DEBUG_XMIT,
   3611 			"%s: TXDP[%u] = %p (%p) depth %d\n", __func__,
   3612 			txq->axq_qnum, (caddr_t)bf->bf_daddr, bf->bf_desc,
   3613 			txq->axq_depth);
   3614 	} else {
   3615 		*txq->axq_link = bf->bf_daddr;
   3616 		DPRINTF(sc, ATH_DEBUG_XMIT,
   3617 			"%s: link[%u](%p)=%p (%p) depth %d\n", __func__,
   3618 			txq->axq_qnum, txq->axq_link,
   3619 			(caddr_t)bf->bf_daddr, bf->bf_desc, txq->axq_depth);
   3620 	}
   3621 	txq->axq_link = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
   3622 	/*
   3623 	 * The CAB queue is started from the SWBA handler since
   3624 	 * frames only go out on DTIM and to avoid possible races.
   3625 	 */
   3626 	if (txq != sc->sc_cabq)
   3627 		ath_hal_txstart(ah, txq->axq_qnum);
   3628 	ATH_TXQ_UNLOCK(txq);
   3629 
   3630 	return 0;
   3631 #undef updateCTSForBursting
   3632 #undef CTS_DURATION
   3633 }
   3634 
   3635 /*
   3636  * Process completed xmit descriptors from the specified queue.
   3637  */
   3638 static void
   3639 ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
   3640 {
   3641 	struct ath_hal *ah = sc->sc_ah;
   3642 	struct ieee80211com *ic = &sc->sc_ic;
   3643 	struct ath_buf *bf;
   3644 	struct ath_desc *ds, *ds0;
   3645 	struct ieee80211_node *ni;
   3646 	struct ath_node *an;
   3647 	int sr, lr, pri;
   3648 	HAL_STATUS status;
   3649 
   3650 	DPRINTF(sc, ATH_DEBUG_TX_PROC, "%s: tx queue %u head %p link %p\n",
   3651 		__func__, txq->axq_qnum,
   3652 		(caddr_t)(uintptr_t) ath_hal_gettxbuf(sc->sc_ah, txq->axq_qnum),
   3653 		txq->axq_link);
   3654 	for (;;) {
   3655 		ATH_TXQ_LOCK(txq);
   3656 		txq->axq_intrcnt = 0;	/* reset periodic desc intr count */
   3657 		bf = STAILQ_FIRST(&txq->axq_q);
   3658 		if (bf == NULL) {
   3659 			txq->axq_link = NULL;
   3660 			ATH_TXQ_UNLOCK(txq);
   3661 			break;
   3662 		}
   3663 		ds0 = &bf->bf_desc[0];
   3664 		ds = &bf->bf_desc[bf->bf_nseg - 1];
   3665 		status = ath_hal_txprocdesc(ah, ds);
   3666 #ifdef AR_DEBUG
   3667 		if (sc->sc_debug & ATH_DEBUG_XMIT_DESC)
   3668 			ath_printtxbuf(bf, status == HAL_OK);
   3669 #endif
   3670 		if (status == HAL_EINPROGRESS) {
   3671 			ATH_TXQ_UNLOCK(txq);
   3672 			break;
   3673 		}
   3674 		if (ds0 == txq->axq_lastdsWithCTS)
   3675 			txq->axq_lastdsWithCTS = NULL;
   3676 		if (ds == txq->axq_gatingds)
   3677 			txq->axq_gatingds = NULL;
   3678 		ATH_TXQ_REMOVE_HEAD(txq, bf_list);
   3679 		ATH_TXQ_UNLOCK(txq);
   3680 
   3681 		ni = bf->bf_node;
   3682 		if (ni != NULL) {
   3683 			an = ATH_NODE(ni);
   3684 			if (ds->ds_txstat.ts_status == 0) {
   3685 				u_int8_t txant = ds->ds_txstat.ts_antenna;
   3686 				sc->sc_stats.ast_ant_tx[txant]++;
   3687 				sc->sc_ant_tx[txant]++;
   3688 				if (ds->ds_txstat.ts_rate & HAL_TXSTAT_ALTRATE)
   3689 					sc->sc_stats.ast_tx_altrate++;
   3690 				sc->sc_stats.ast_tx_rssi =
   3691 					ds->ds_txstat.ts_rssi;
   3692 				ATH_RSSI_LPF(an->an_halstats.ns_avgtxrssi,
   3693 					ds->ds_txstat.ts_rssi);
   3694 				pri = M_WME_GETAC(bf->bf_m);
   3695 				if (pri >= WME_AC_VO)
   3696 					ic->ic_wme.wme_hipri_traffic++;
   3697 				ni->ni_inact = ni->ni_inact_reload;
   3698 			} else {
   3699 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
   3700 					sc->sc_stats.ast_tx_xretries++;
   3701 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
   3702 					sc->sc_stats.ast_tx_fifoerr++;
   3703 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
   3704 					sc->sc_stats.ast_tx_filtered++;
   3705 			}
   3706 			sr = ds->ds_txstat.ts_shortretry;
   3707 			lr = ds->ds_txstat.ts_longretry;
   3708 			sc->sc_stats.ast_tx_shortretry += sr;
   3709 			sc->sc_stats.ast_tx_longretry += lr;
   3710 			/*
   3711 			 * Hand the descriptor to the rate control algorithm.
   3712 			 */
   3713 			if ((ds->ds_txstat.ts_status & HAL_TXERR_FILT) == 0 &&
   3714 			    (bf->bf_flags & HAL_TXDESC_NOACK) == 0)
   3715 				ath_rate_tx_complete(sc, an, ds, ds0);
   3716 			/*
   3717 			 * Reclaim reference to node.
   3718 			 *
   3719 			 * NB: the node may be reclaimed here if, for example
   3720 			 *     this is a DEAUTH message that was sent and the
   3721 			 *     node was timed out due to inactivity.
   3722 			 */
   3723 			ieee80211_free_node(ni);
   3724 		}
   3725 		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
   3726 		    BUS_DMASYNC_POSTWRITE);
   3727 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   3728 		m_freem(bf->bf_m);
   3729 		bf->bf_m = NULL;
   3730 		bf->bf_node = NULL;
   3731 
   3732 		ATH_TXBUF_LOCK(sc);
   3733 		STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   3734 		ATH_TXBUF_UNLOCK(sc);
   3735 	}
   3736 }
   3737 
   3738 /*
   3739  * Deferred processing of transmit interrupt; special-cased
   3740  * for a single hardware transmit queue (e.g. 5210 and 5211).
   3741  */
   3742 static void
   3743 ath_tx_proc_q0(void *arg, int npending)
   3744 {
   3745 	struct ath_softc *sc = arg;
   3746 	struct ifnet *ifp = sc->sc_ifp;
   3747 
   3748 	ath_tx_processq(sc, &sc->sc_txq[0]);
   3749 	ath_tx_processq(sc, sc->sc_cabq);
   3750 	ifp->if_flags &= ~IFF_OACTIVE;
   3751 	sc->sc_tx_timer = 0;
   3752 
   3753 	if (sc->sc_softled)
   3754 		ath_led_event(sc, ATH_LED_TX);
   3755 
   3756 	ath_start(ifp);
   3757 }
   3758 
   3759 /*
   3760  * Deferred processing of transmit interrupt; special-cased
   3761  * for four hardware queues, 0-3 (e.g. 5212 w/ WME support).
   3762  */
   3763 static void
   3764 ath_tx_proc_q0123(void *arg, int npending)
   3765 {
   3766 	struct ath_softc *sc = arg;
   3767 	struct ifnet *ifp = sc->sc_ifp;
   3768 
   3769 	/*
   3770 	 * Process each active queue.
   3771 	 */
   3772 	ath_tx_processq(sc, &sc->sc_txq[0]);
   3773 	ath_tx_processq(sc, &sc->sc_txq[1]);
   3774 	ath_tx_processq(sc, &sc->sc_txq[2]);
   3775 	ath_tx_processq(sc, &sc->sc_txq[3]);
   3776 	ath_tx_processq(sc, sc->sc_cabq);
   3777 
   3778 	ifp->if_flags &= ~IFF_OACTIVE;
   3779 	sc->sc_tx_timer = 0;
   3780 
   3781 	if (sc->sc_softled)
   3782 		ath_led_event(sc, ATH_LED_TX);
   3783 
   3784 	ath_start(ifp);
   3785 }
   3786 
   3787 /*
   3788  * Deferred processing of transmit interrupt.
   3789  */
   3790 static void
   3791 ath_tx_proc(void *arg, int npending)
   3792 {
   3793 	struct ath_softc *sc = arg;
   3794 	struct ifnet *ifp = sc->sc_ifp;
   3795 	int i;
   3796 
   3797 	/*
   3798 	 * Process each active queue.
   3799 	 */
   3800 	/* XXX faster to read ISR_S0_S and ISR_S1_S to determine q's? */
   3801 	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
   3802 		if (ATH_TXQ_SETUP(sc, i))
   3803 			ath_tx_processq(sc, &sc->sc_txq[i]);
   3804 
   3805 	ifp->if_flags &= ~IFF_OACTIVE;
   3806 	sc->sc_tx_timer = 0;
   3807 
   3808 	if (sc->sc_softled)
   3809 		ath_led_event(sc, ATH_LED_TX);
   3810 
   3811 	ath_start(ifp);
   3812 }
   3813 
   3814 static void
   3815 ath_tx_draintxq(struct ath_softc *sc, struct ath_txq *txq)
   3816 {
   3817 	struct ath_hal *ah = sc->sc_ah;
   3818 	struct ieee80211_node *ni;
   3819 	struct ath_buf *bf;
   3820 
   3821 	/*
   3822 	 * NB: this assumes output has been stopped and
   3823 	 *     we do not need to block ath_tx_tasklet
   3824 	 */
   3825 	for (;;) {
   3826 		ATH_TXQ_LOCK(txq);
   3827 		bf = STAILQ_FIRST(&txq->axq_q);
   3828 		if (bf == NULL) {
   3829 			txq->axq_link = NULL;
   3830 			ATH_TXQ_UNLOCK(txq);
   3831 			break;
   3832 		}
   3833 		ATH_TXQ_REMOVE_HEAD(txq, bf_list);
   3834 		ATH_TXQ_UNLOCK(txq);
   3835 #ifdef AR_DEBUG
   3836 		if (sc->sc_debug & ATH_DEBUG_RESET)
   3837 			ath_printtxbuf(bf,
   3838 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
   3839 #endif /* AR_DEBUG */
   3840 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   3841 		m_freem(bf->bf_m);
   3842 		bf->bf_m = NULL;
   3843 		ni = bf->bf_node;
   3844 		bf->bf_node = NULL;
   3845 		if (ni != NULL) {
   3846 			/*
   3847 			 * Reclaim node reference.
   3848 			 */
   3849 			ieee80211_free_node(ni);
   3850 		}
   3851 		ATH_TXBUF_LOCK(sc);
   3852 		STAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   3853 		ATH_TXBUF_UNLOCK(sc);
   3854 	}
   3855 }
   3856 
   3857 static void
   3858 ath_tx_stopdma(struct ath_softc *sc, struct ath_txq *txq)
   3859 {
   3860 	struct ath_hal *ah = sc->sc_ah;
   3861 
   3862 	(void) ath_hal_stoptxdma(ah, txq->axq_qnum);
   3863 	DPRINTF(sc, ATH_DEBUG_RESET, "%s: tx queue [%u] %p, link %p\n",
   3864 	    __func__, txq->axq_qnum,
   3865 	    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, txq->axq_qnum),
   3866 	    txq->axq_link);
   3867 }
   3868 
   3869 /*
   3870  * Drain the transmit queues and reclaim resources.
   3871  */
   3872 static void
   3873 ath_draintxq(struct ath_softc *sc)
   3874 {
   3875 	struct ath_hal *ah = sc->sc_ah;
   3876 	struct ifnet *ifp = sc->sc_ifp;
   3877 	int i;
   3878 
   3879 	/* XXX return value */
   3880 	if (!sc->sc_invalid) {
   3881 		/* don't touch the hardware if marked invalid */
   3882 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
   3883 		DPRINTF(sc, ATH_DEBUG_RESET,
   3884 		    "%s: beacon queue %p\n", __func__,
   3885 		    (caddr_t)(uintptr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq));
   3886 		for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
   3887 			if (ATH_TXQ_SETUP(sc, i))
   3888 				ath_tx_stopdma(sc, &sc->sc_txq[i]);
   3889 	}
   3890 	for (i = 0; i < HAL_NUM_TX_QUEUES; i++)
   3891 		if (ATH_TXQ_SETUP(sc, i))
   3892 			ath_tx_draintxq(sc, &sc->sc_txq[i]);
   3893 	ifp->if_flags &= ~IFF_OACTIVE;
   3894 	sc->sc_tx_timer = 0;
   3895 }
   3896 
   3897 /*
   3898  * Disable the receive h/w in preparation for a reset.
   3899  */
   3900 static void
   3901 ath_stoprecv(struct ath_softc *sc)
   3902 {
   3903 #define	PA2DESC(_sc, _pa) \
   3904 	((struct ath_desc *)((caddr_t)(_sc)->sc_rxdma.dd_desc + \
   3905 		((_pa) - (_sc)->sc_rxdma.dd_desc_paddr)))
   3906 	struct ath_hal *ah = sc->sc_ah;
   3907 
   3908 	ath_hal_stoppcurecv(ah);	/* disable PCU */
   3909 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
   3910 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
   3911 	DELAY(3000);			/* 3ms is long enough for 1 frame */
   3912 #ifdef AR_DEBUG
   3913 	if (sc->sc_debug & (ATH_DEBUG_RESET | ATH_DEBUG_FATAL)) {
   3914 		struct ath_buf *bf;
   3915 
   3916 		printf("%s: rx queue %p, link %p\n", __func__,
   3917 			(caddr_t)(uintptr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink);
   3918 		STAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
   3919 			struct ath_desc *ds = bf->bf_desc;
   3920 			HAL_STATUS status = ath_hal_rxprocdesc(ah, ds,
   3921 				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
   3922 			if (status == HAL_OK || (sc->sc_debug & ATH_DEBUG_FATAL))
   3923 				ath_printrxbuf(bf, status == HAL_OK);
   3924 		}
   3925 	}
   3926 #endif
   3927 	sc->sc_rxlink = NULL;		/* just in case */
   3928 #undef PA2DESC
   3929 }
   3930 
   3931 /*
   3932  * Enable the receive h/w following a reset.
   3933  */
   3934 static int
   3935 ath_startrecv(struct ath_softc *sc)
   3936 {
   3937 	struct ath_hal *ah = sc->sc_ah;
   3938 	struct ath_buf *bf;
   3939 
   3940 	sc->sc_rxlink = NULL;
   3941 	STAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
   3942 		int error = ath_rxbuf_init(sc, bf);
   3943 		if (error != 0) {
   3944 			DPRINTF(sc, ATH_DEBUG_RECV,
   3945 				"%s: ath_rxbuf_init failed %d\n",
   3946 				__func__, error);
   3947 			return error;
   3948 		}
   3949 	}
   3950 
   3951 	bf = STAILQ_FIRST(&sc->sc_rxbuf);
   3952 	ath_hal_putrxbuf(ah, bf->bf_daddr);
   3953 	ath_hal_rxena(ah);		/* enable recv descriptors */
   3954 	ath_mode_init(sc);		/* set filters, etc. */
   3955 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
   3956 	return 0;
   3957 }
   3958 
   3959 /*
   3960  * Update internal state after a channel change.
   3961  */
   3962 static void
   3963 ath_chan_change(struct ath_softc *sc, struct ieee80211_channel *chan)
   3964 {
   3965 	struct ieee80211com *ic = &sc->sc_ic;
   3966 	enum ieee80211_phymode mode;
   3967 	u_int16_t flags;
   3968 
   3969 	/*
   3970 	 * Change channels and update the h/w rate map
   3971 	 * if we're switching; e.g. 11a to 11b/g.
   3972 	 */
   3973 	mode = ieee80211_chan2mode(ic, chan);
   3974 	if (mode != sc->sc_curmode)
   3975 		ath_setcurmode(sc, mode);
   3976 	/*
   3977 	 * Update BPF state.  NB: ethereal et. al. don't handle
   3978 	 * merged flags well so pick a unique mode for their use.
   3979 	 */
   3980 	if (IEEE80211_IS_CHAN_A(chan))
   3981 		flags = IEEE80211_CHAN_A;
   3982 	/* XXX 11g schizophrenia */
   3983 	else if (IEEE80211_IS_CHAN_G(chan) ||
   3984 	    IEEE80211_IS_CHAN_PUREG(chan))
   3985 		flags = IEEE80211_CHAN_G;
   3986 	else
   3987 		flags = IEEE80211_CHAN_B;
   3988 	if (IEEE80211_IS_CHAN_T(chan))
   3989 		flags |= IEEE80211_CHAN_TURBO;
   3990 	sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
   3991 		htole16(chan->ic_freq);
   3992 	sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
   3993 		htole16(flags);
   3994 }
   3995 
   3996 /*
   3997  * Set/change channels.  If the channel is really being changed,
   3998  * it's done by reseting the chip.  To accomplish this we must
   3999  * first cleanup any pending DMA, then restart stuff after a la
   4000  * ath_init.
   4001  */
   4002 static int
   4003 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
   4004 {
   4005 	struct ath_hal *ah = sc->sc_ah;
   4006 	struct ieee80211com *ic = &sc->sc_ic;
   4007 	HAL_CHANNEL hchan;
   4008 
   4009 	/*
   4010 	 * Convert to a HAL channel description with
   4011 	 * the flags constrained to reflect the current
   4012 	 * operating mode.
   4013 	 */
   4014 	hchan.channel = chan->ic_freq;
   4015 	hchan.channelFlags = ath_chan2flags(ic, chan);
   4016 
   4017 	DPRINTF(sc, ATH_DEBUG_RESET, "%s: %u (%u MHz) -> %u (%u MHz)\n",
   4018 	    __func__,
   4019 	    ath_hal_mhz2ieee(sc->sc_curchan.channel,
   4020 		sc->sc_curchan.channelFlags),
   4021 	    	sc->sc_curchan.channel,
   4022 	    ath_hal_mhz2ieee(hchan.channel, hchan.channelFlags), hchan.channel);
   4023 	if (hchan.channel != sc->sc_curchan.channel ||
   4024 	    hchan.channelFlags != sc->sc_curchan.channelFlags) {
   4025 		HAL_STATUS status;
   4026 
   4027 		/*
   4028 		 * To switch channels clear any pending DMA operations;
   4029 		 * wait long enough for the RX fifo to drain, reset the
   4030 		 * hardware at the new frequency, and then re-enable
   4031 		 * the relevant bits of the h/w.
   4032 		 */
   4033 		ath_hal_intrset(ah, 0);		/* disable interrupts */
   4034 		ath_draintxq(sc);		/* clear pending tx frames */
   4035 		ath_stoprecv(sc);		/* turn off frame recv */
   4036 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
   4037 			if_printf(ic->ic_ifp, "ath_chan_set: unable to reset "
   4038 				"channel %u (%u Mhz)\n",
   4039 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
   4040 			return EIO;
   4041 		}
   4042 		sc->sc_curchan = hchan;
   4043 		ath_update_txpow(sc);		/* update tx power state */
   4044 
   4045 		/*
   4046 		 * Re-enable rx framework.
   4047 		 */
   4048 		if (ath_startrecv(sc) != 0) {
   4049 			if_printf(ic->ic_ifp,
   4050 				"ath_chan_set: unable to restart recv logic\n");
   4051 			return EIO;
   4052 		}
   4053 
   4054 		/*
   4055 		 * Change channels and update the h/w rate map
   4056 		 * if we're switching; e.g. 11a to 11b/g.
   4057 		 */
   4058 		ic->ic_ibss_chan = chan;
   4059 		ath_chan_change(sc, chan);
   4060 
   4061 		/*
   4062 		 * Re-enable interrupts.
   4063 		 */
   4064 		ath_hal_intrset(ah, sc->sc_imask);
   4065 	}
   4066 	return 0;
   4067 }
   4068 
   4069 static void
   4070 ath_next_scan(void *arg)
   4071 {
   4072 	struct ath_softc *sc = arg;
   4073 	struct ieee80211com *ic = &sc->sc_ic;
   4074 
   4075 	if (ic->ic_state == IEEE80211_S_SCAN)
   4076 		ieee80211_next_scan(ic);
   4077 }
   4078 
   4079 /*
   4080  * Periodically recalibrate the PHY to account
   4081  * for temperature/environment changes.
   4082  */
   4083 static void
   4084 ath_calibrate(void *arg)
   4085 {
   4086 	struct ath_softc *sc = arg;
   4087 	struct ath_hal *ah = sc->sc_ah;
   4088 
   4089 	sc->sc_stats.ast_per_cal++;
   4090 
   4091 	DPRINTF(sc, ATH_DEBUG_CALIBRATE, "%s: channel %u/%x\n",
   4092 		__func__, sc->sc_curchan.channel, sc->sc_curchan.channelFlags);
   4093 
   4094 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
   4095 		/*
   4096 		 * Rfgain is out of bounds, reset the chip
   4097 		 * to load new gain values.
   4098 		 */
   4099 		sc->sc_stats.ast_per_rfgain++;
   4100 		ath_reset(sc->sc_ifp);
   4101 	}
   4102 	if (!ath_hal_calibrate(ah, &sc->sc_curchan)) {
   4103 		DPRINTF(sc, ATH_DEBUG_ANY,
   4104 			"%s: calibration of channel %u failed\n",
   4105 			__func__, sc->sc_curchan.channel);
   4106 		sc->sc_stats.ast_per_calfail++;
   4107 	}
   4108 	callout_reset(&sc->sc_cal_ch, ath_calinterval * hz, ath_calibrate, sc);
   4109 }
   4110 
   4111 static int
   4112 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
   4113 {
   4114 	struct ifnet *ifp = ic->ic_ifp;
   4115 	struct ath_softc *sc = ifp->if_softc;
   4116 	struct ath_hal *ah = sc->sc_ah;
   4117 	struct ieee80211_node *ni;
   4118 	int i, error;
   4119 	const u_int8_t *bssid;
   4120 	u_int32_t rfilt;
   4121 	static const HAL_LED_STATE leds[] = {
   4122 	    HAL_LED_INIT,	/* IEEE80211_S_INIT */
   4123 	    HAL_LED_SCAN,	/* IEEE80211_S_SCAN */
   4124 	    HAL_LED_AUTH,	/* IEEE80211_S_AUTH */
   4125 	    HAL_LED_ASSOC, 	/* IEEE80211_S_ASSOC */
   4126 	    HAL_LED_RUN, 	/* IEEE80211_S_RUN */
   4127 	};
   4128 
   4129 	DPRINTF(sc, ATH_DEBUG_STATE, "%s: %s -> %s\n", __func__,
   4130 		ieee80211_state_name[ic->ic_state],
   4131 		ieee80211_state_name[nstate]);
   4132 
   4133 	callout_stop(&sc->sc_scan_ch);
   4134 	callout_stop(&sc->sc_cal_ch);
   4135 	ath_hal_setledstate(ah, leds[nstate]);	/* set LED */
   4136 
   4137 	if (nstate == IEEE80211_S_INIT) {
   4138 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
   4139 		/*
   4140 		 * NB: disable interrupts so we don't rx frames.
   4141 		 */
   4142 		ath_hal_intrset(ah, sc->sc_imask &~ HAL_INT_GLOBAL);
   4143 		/*
   4144 		 * Notify the rate control algorithm.
   4145 		 */
   4146 		ath_rate_newstate(sc, nstate);
   4147 		goto done;
   4148 	}
   4149 	ni = ic->ic_bss;
   4150 	error = ath_chan_set(sc, ni->ni_chan);
   4151 	if (error != 0)
   4152 		goto bad;
   4153 	rfilt = ath_calcrxfilter(sc, nstate);
   4154 	if (nstate == IEEE80211_S_SCAN)
   4155 		bssid = ifp->if_broadcastaddr;
   4156 	else
   4157 		bssid = ni->ni_bssid;
   4158 	ath_hal_setrxfilter(ah, rfilt);
   4159 	DPRINTF(sc, ATH_DEBUG_STATE, "%s: RX filter 0x%x bssid %s\n",
   4160 		 __func__, rfilt, ether_sprintf(bssid));
   4161 
   4162 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
   4163 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
   4164 	else
   4165 		ath_hal_setassocid(ah, bssid, 0);
   4166 	if (ic->ic_flags & IEEE80211_F_PRIVACY) {
   4167 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
   4168 			if (ath_hal_keyisvalid(ah, i))
   4169 				ath_hal_keysetmac(ah, i, bssid);
   4170 	}
   4171 
   4172 	/*
   4173 	 * Notify the rate control algorithm so rates
   4174 	 * are setup should ath_beacon_alloc be called.
   4175 	 */
   4176 	ath_rate_newstate(sc, nstate);
   4177 
   4178 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
   4179 		/* nothing to do */;
   4180 	} else if (nstate == IEEE80211_S_RUN) {
   4181 		DPRINTF(sc, ATH_DEBUG_STATE,
   4182 			"%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
   4183 			"capinfo=0x%04x chan=%d\n"
   4184 			 , __func__
   4185 			 , ic->ic_flags
   4186 			 , ni->ni_intval
   4187 			 , ether_sprintf(ni->ni_bssid)
   4188 			 , ni->ni_capinfo
   4189 			 , ieee80211_chan2ieee(ic, ni->ni_chan));
   4190 
   4191 		switch (ic->ic_opmode) {
   4192 		case IEEE80211_M_HOSTAP:
   4193 		case IEEE80211_M_IBSS:
   4194 			/*
   4195 			 * Allocate and setup the beacon frame.
   4196 			 *
   4197 			 * Stop any previous beacon DMA.  This may be
   4198 			 * necessary, for example, when an ibss merge
   4199 			 * causes reconfiguration; there will be a state
   4200 			 * transition from RUN->RUN that means we may
   4201 			 * be called with beacon transmission active.
   4202 			 */
   4203 			ath_hal_stoptxdma(ah, sc->sc_bhalq);
   4204 			ath_beacon_free(sc);
   4205 			error = ath_beacon_alloc(sc, ni);
   4206 			if (error != 0)
   4207 				goto bad;
   4208 			break;
   4209 		case IEEE80211_M_STA:
   4210 			/*
   4211 			 * Allocate a key cache slot to the station.
   4212 			 */
   4213 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0 &&
   4214 			    sc->sc_hasclrkey &&
   4215 			    ni->ni_ucastkey.wk_keyix == IEEE80211_KEYIX_NONE)
   4216 				ath_setup_stationkey(ni);
   4217 			break;
   4218 		default:
   4219 			break;
   4220 		}
   4221 
   4222 		/*
   4223 		 * Configure the beacon and sleep timers.
   4224 		 */
   4225 		ath_beacon_config(sc);
   4226 	} else {
   4227 		ath_hal_intrset(ah,
   4228 			sc->sc_imask &~ (HAL_INT_SWBA | HAL_INT_BMISS));
   4229 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
   4230 	}
   4231 done:
   4232 	/*
   4233 	 * Invoke the parent method to complete the work.
   4234 	 */
   4235 	error = sc->sc_newstate(ic, nstate, arg);
   4236 	/*
   4237 	 * Finally, start any timers.
   4238 	 */
   4239 	if (nstate == IEEE80211_S_RUN) {
   4240 		/* start periodic recalibration timer */
   4241 		callout_reset(&sc->sc_cal_ch, ath_calinterval * hz,
   4242 			ath_calibrate, sc);
   4243 	} else if (nstate == IEEE80211_S_SCAN) {
   4244 		/* start ap/neighbor scan timer */
   4245 		callout_reset(&sc->sc_scan_ch, (ath_dwelltime * hz) / 1000,
   4246 			ath_next_scan, sc);
   4247 	}
   4248 bad:
   4249 	return error;
   4250 }
   4251 
   4252 /*
   4253  * Allocate a key cache slot to the station so we can
   4254  * setup a mapping from key index to node. The key cache
   4255  * slot is needed for managing antenna state and for
   4256  * compression when stations do not use crypto.  We do
   4257  * it uniliaterally here; if crypto is employed this slot
   4258  * will be reassigned.
   4259  */
   4260 static void
   4261 ath_setup_stationkey(struct ieee80211_node *ni)
   4262 {
   4263 	struct ieee80211com *ic = ni->ni_ic;
   4264 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   4265 	u_int16_t keyix;
   4266 
   4267 	keyix = ath_key_alloc(ic, &ni->ni_ucastkey);
   4268 	if (keyix == IEEE80211_KEYIX_NONE) {
   4269 		/*
   4270 		 * Key cache is full; we'll fall back to doing
   4271 		 * the more expensive lookup in software.  Note
   4272 		 * this also means no h/w compression.
   4273 		 */
   4274 		/* XXX msg+statistic */
   4275 	} else {
   4276 		ni->ni_ucastkey.wk_keyix = keyix;
   4277 		/* NB: this will create a pass-thru key entry */
   4278 		ath_keyset(sc, &ni->ni_ucastkey, ni->ni_macaddr, ic->ic_bss);
   4279 	}
   4280 }
   4281 
   4282 /*
   4283  * Setup driver-specific state for a newly associated node.
   4284  * Note that we're called also on a re-associate, the isnew
   4285  * param tells us if this is the first time or not.
   4286  */
   4287 static void
   4288 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
   4289 {
   4290 	struct ath_softc *sc = ic->ic_ifp->if_softc;
   4291 
   4292 	ath_rate_newassoc(sc, ATH_NODE(ni), isnew);
   4293 	if (isnew &&
   4294 	    (ic->ic_flags & IEEE80211_F_PRIVACY) == 0 && sc->sc_hasclrkey) {
   4295 		KASSERT(ni->ni_ucastkey.wk_keyix == IEEE80211_KEYIX_NONE,
   4296 		    ("new assoc with a unicast key already setup (keyix %u)",
   4297 		    ni->ni_ucastkey.wk_keyix));
   4298 		ath_setup_stationkey(ni);
   4299 	}
   4300 }
   4301 
   4302 static int
   4303 ath_getchannels(struct ath_softc *sc, u_int cc,
   4304 	HAL_BOOL outdoor, HAL_BOOL xchanmode)
   4305 {
   4306 	struct ieee80211com *ic = &sc->sc_ic;
   4307 	struct ifnet *ifp = sc->sc_ifp;
   4308 	struct ath_hal *ah = sc->sc_ah;
   4309 	HAL_CHANNEL *chans;
   4310 	int i, ix, nchan;
   4311 
   4312 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
   4313 			M_TEMP, M_NOWAIT);
   4314 	if (chans == NULL) {
   4315 		if_printf(ifp, "unable to allocate channel table\n");
   4316 		return ENOMEM;
   4317 	}
   4318 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
   4319 	    cc, HAL_MODE_ALL, outdoor, xchanmode)) {
   4320 		u_int32_t rd;
   4321 
   4322 		ath_hal_getregdomain(ah, &rd);
   4323 		if_printf(ifp, "unable to collect channel list from hal; "
   4324 			"regdomain likely %u country code %u\n", rd, cc);
   4325 		free(chans, M_TEMP);
   4326 		return EINVAL;
   4327 	}
   4328 
   4329 	/*
   4330 	 * Convert HAL channels to ieee80211 ones and insert
   4331 	 * them in the table according to their channel number.
   4332 	 */
   4333 	for (i = 0; i < nchan; i++) {
   4334 		HAL_CHANNEL *c = &chans[i];
   4335 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
   4336 		if (ix > IEEE80211_CHAN_MAX) {
   4337 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
   4338 				ix, c->channel, c->channelFlags);
   4339 			continue;
   4340 		}
   4341 		/* NB: flags are known to be compatible */
   4342 		if (ic->ic_channels[ix].ic_freq == 0) {
   4343 			ic->ic_channels[ix].ic_freq = c->channel;
   4344 			ic->ic_channels[ix].ic_flags = c->channelFlags;
   4345 		} else {
   4346 			/* channels overlap; e.g. 11g and 11b */
   4347 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
   4348 		}
   4349 	}
   4350 	free(chans, M_TEMP);
   4351 	return 0;
   4352 }
   4353 
   4354 static void
   4355 ath_led_done(void *arg)
   4356 {
   4357 	struct ath_softc *sc = arg;
   4358 
   4359 	sc->sc_blinking = 0;
   4360 }
   4361 
   4362 /*
   4363  * Turn the LED off: flip the pin and then set a timer so no
   4364  * update will happen for the specified duration.
   4365  */
   4366 static void
   4367 ath_led_off(void *arg)
   4368 {
   4369 	struct ath_softc *sc = arg;
   4370 
   4371 	ath_hal_gpioset(sc->sc_ah, sc->sc_ledpin, !sc->sc_ledon);
   4372 	callout_reset(&sc->sc_ledtimer, sc->sc_ledoff, ath_led_done, sc);
   4373 }
   4374 
   4375 /*
   4376  * Blink the LED according to the specified on/off times.
   4377  */
   4378 static void
   4379 ath_led_blink(struct ath_softc *sc, int on, int off)
   4380 {
   4381 	DPRINTF(sc, ATH_DEBUG_LED, "%s: on %u off %u\n", __func__, on, off);
   4382 	ath_hal_gpioset(sc->sc_ah, sc->sc_ledpin, sc->sc_ledon);
   4383 	sc->sc_blinking = 1;
   4384 	sc->sc_ledoff = off;
   4385 	callout_reset(&sc->sc_ledtimer, on, ath_led_off, sc);
   4386 }
   4387 
   4388 static void
   4389 ath_led_event(struct ath_softc *sc, int event)
   4390 {
   4391 
   4392 	sc->sc_ledevent = ticks;	/* time of last event */
   4393 	if (sc->sc_blinking)		/* don't interrupt active blink */
   4394 		return;
   4395 	switch (event) {
   4396 	case ATH_LED_POLL:
   4397 		ath_led_blink(sc, sc->sc_hwmap[0].ledon,
   4398 			sc->sc_hwmap[0].ledoff);
   4399 		break;
   4400 	case ATH_LED_TX:
   4401 		ath_led_blink(sc, sc->sc_hwmap[sc->sc_txrate].ledon,
   4402 			sc->sc_hwmap[sc->sc_txrate].ledoff);
   4403 		break;
   4404 	case ATH_LED_RX:
   4405 		ath_led_blink(sc, sc->sc_hwmap[sc->sc_rxrate].ledon,
   4406 			sc->sc_hwmap[sc->sc_rxrate].ledoff);
   4407 		break;
   4408 	}
   4409 }
   4410 
   4411 static void
   4412 ath_update_txpow(struct ath_softc *sc)
   4413 {
   4414 	struct ieee80211com *ic = &sc->sc_ic;
   4415 	struct ath_hal *ah = sc->sc_ah;
   4416 	u_int32_t txpow;
   4417 
   4418 	if (sc->sc_curtxpow != ic->ic_txpowlimit) {
   4419 		ath_hal_settxpowlimit(ah, ic->ic_txpowlimit);
   4420 		/* read back in case value is clamped */
   4421 		ath_hal_gettxpowlimit(ah, &txpow);
   4422 		ic->ic_txpowlimit = sc->sc_curtxpow = txpow;
   4423 	}
   4424 	/*
   4425 	 * Fetch max tx power level for status requests.
   4426 	 */
   4427 	ath_hal_getmaxtxpow(sc->sc_ah, &txpow);
   4428 	ic->ic_bss->ni_txpower = txpow;
   4429 }
   4430 
   4431 static int
   4432 ath_rate_setup(struct ath_softc *sc, u_int mode)
   4433 {
   4434 	struct ath_hal *ah = sc->sc_ah;
   4435 	struct ieee80211com *ic = &sc->sc_ic;
   4436 	const HAL_RATE_TABLE *rt;
   4437 	struct ieee80211_rateset *rs;
   4438 	int i, maxrates;
   4439 
   4440 	switch (mode) {
   4441 	case IEEE80211_MODE_11A:
   4442 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
   4443 		break;
   4444 	case IEEE80211_MODE_11B:
   4445 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
   4446 		break;
   4447 	case IEEE80211_MODE_11G:
   4448 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
   4449 		break;
   4450 	case IEEE80211_MODE_TURBO_A:
   4451 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
   4452 		break;
   4453 	case IEEE80211_MODE_TURBO_G:
   4454 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_108G);
   4455 		break;
   4456 	default:
   4457 		DPRINTF(sc, ATH_DEBUG_ANY, "%s: invalid mode %u\n",
   4458 			__func__, mode);
   4459 		return 0;
   4460 	}
   4461 	rt = sc->sc_rates[mode];
   4462 	if (rt == NULL)
   4463 		return 0;
   4464 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
   4465 		DPRINTF(sc, ATH_DEBUG_ANY,
   4466 			"%s: rate table too small (%u > %u)\n",
   4467 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE);
   4468 		maxrates = IEEE80211_RATE_MAXSIZE;
   4469 	} else
   4470 		maxrates = rt->rateCount;
   4471 	rs = &ic->ic_sup_rates[mode];
   4472 	for (i = 0; i < maxrates; i++)
   4473 		rs->rs_rates[i] = rt->info[i].dot11Rate;
   4474 	rs->rs_nrates = maxrates;
   4475 	return 1;
   4476 }
   4477 
   4478 static void
   4479 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
   4480 {
   4481 #define	N(a)	(sizeof(a)/sizeof(a[0]))
   4482 	/* NB: on/off times from the Atheros NDIS driver, w/ permission */
   4483 	static const struct {
   4484 		u_int		rate;		/* tx/rx 802.11 rate */
   4485 		u_int16_t	timeOn;		/* LED on time (ms) */
   4486 		u_int16_t	timeOff;	/* LED off time (ms) */
   4487 	} blinkrates[] = {
   4488 		{ 108,  40,  10 },
   4489 		{  96,  44,  11 },
   4490 		{  72,  50,  13 },
   4491 		{  48,  57,  14 },
   4492 		{  36,  67,  16 },
   4493 		{  24,  80,  20 },
   4494 		{  22, 100,  25 },
   4495 		{  18, 133,  34 },
   4496 		{  12, 160,  40 },
   4497 		{  10, 200,  50 },
   4498 		{   6, 240,  58 },
   4499 		{   4, 267,  66 },
   4500 		{   2, 400, 100 },
   4501 		{   0, 500, 130 },
   4502 	};
   4503 	const HAL_RATE_TABLE *rt;
   4504 	int i, j;
   4505 
   4506 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
   4507 	rt = sc->sc_rates[mode];
   4508 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
   4509 	for (i = 0; i < rt->rateCount; i++)
   4510 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
   4511 	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
   4512 	for (i = 0; i < 32; i++) {
   4513 		u_int8_t ix = rt->rateCodeToIndex[i];
   4514 		if (ix == 0xff) {
   4515 			sc->sc_hwmap[i].ledon = (500 * hz) / 1000;
   4516 			sc->sc_hwmap[i].ledoff = (130 * hz) / 1000;
   4517 			continue;
   4518 		}
   4519 		sc->sc_hwmap[i].ieeerate =
   4520 			rt->info[ix].dot11Rate & IEEE80211_RATE_VAL;
   4521 		sc->sc_hwmap[i].txflags = IEEE80211_RADIOTAP_F_DATAPAD;
   4522 		if (rt->info[ix].shortPreamble ||
   4523 		    rt->info[ix].phy == IEEE80211_T_OFDM)
   4524 			sc->sc_hwmap[i].txflags |= IEEE80211_RADIOTAP_F_SHORTPRE;
   4525 		/* NB: receive frames include FCS */
   4526 		sc->sc_hwmap[i].rxflags = sc->sc_hwmap[i].txflags |
   4527 			IEEE80211_RADIOTAP_F_FCS;
   4528 		/* setup blink rate table to avoid per-packet lookup */
   4529 		for (j = 0; j < N(blinkrates)-1; j++)
   4530 			if (blinkrates[j].rate == sc->sc_hwmap[i].ieeerate)
   4531 				break;
   4532 		/* NB: this uses the last entry if the rate isn't found */
   4533 		/* XXX beware of overlow */
   4534 		sc->sc_hwmap[i].ledon = (blinkrates[j].timeOn * hz) / 1000;
   4535 		sc->sc_hwmap[i].ledoff = (blinkrates[j].timeOff * hz) / 1000;
   4536 	}
   4537 	sc->sc_currates = rt;
   4538 	sc->sc_curmode = mode;
   4539 	/*
   4540 	 * All protection frames are transmited at 2Mb/s for
   4541 	 * 11g, otherwise at 1Mb/s.
   4542 	 * XXX select protection rate index from rate table.
   4543 	 */
   4544 	sc->sc_protrix = (mode == IEEE80211_MODE_11G ? 1 : 0);
   4545 	/* NB: caller is responsible for reseting rate control state */
   4546 #undef N
   4547 }
   4548 
   4549 #ifdef AR_DEBUG
   4550 static void
   4551 ath_printrxbuf(struct ath_buf *bf, int done)
   4552 {
   4553 	struct ath_desc *ds;
   4554 	int i;
   4555 
   4556 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
   4557 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
   4558 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
   4559 		    ds->ds_link, ds->ds_data,
   4560 		    ds->ds_ctl0, ds->ds_ctl1,
   4561 		    ds->ds_hw[0], ds->ds_hw[1],
   4562 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
   4563 	}
   4564 }
   4565 
   4566 static void
   4567 ath_printtxbuf(struct ath_buf *bf, int done)
   4568 {
   4569 	struct ath_desc *ds;
   4570 	int i;
   4571 
   4572 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
   4573 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
   4574 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
   4575 		    ds->ds_link, ds->ds_data,
   4576 		    ds->ds_ctl0, ds->ds_ctl1,
   4577 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
   4578 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
   4579 	}
   4580 }
   4581 #endif /* AR_DEBUG */
   4582 
   4583 static void
   4584 ath_watchdog(struct ifnet *ifp)
   4585 {
   4586 	struct ath_softc *sc = ifp->if_softc;
   4587 	struct ieee80211com *ic = &sc->sc_ic;
   4588 
   4589 	ifp->if_timer = 0;
   4590 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
   4591 		return;
   4592 	if (sc->sc_tx_timer) {
   4593 		if (--sc->sc_tx_timer == 0) {
   4594 			if_printf(ifp, "device timeout\n");
   4595 			ath_reset(ifp);
   4596 			ifp->if_oerrors++;
   4597 			sc->sc_stats.ast_watchdog++;
   4598 		} else
   4599 			ifp->if_timer = 1;
   4600 	}
   4601 	ieee80211_watchdog(ic);
   4602 }
   4603 
   4604 /*
   4605  * Diagnostic interface to the HAL.  This is used by various
   4606  * tools to do things like retrieve register contents for
   4607  * debugging.  The mechanism is intentionally opaque so that
   4608  * it can change frequently w/o concern for compatiblity.
   4609  */
   4610 static int
   4611 ath_ioctl_diag(struct ath_softc *sc, struct ath_diag *ad)
   4612 {
   4613 	struct ath_hal *ah = sc->sc_ah;
   4614 	u_int id = ad->ad_id & ATH_DIAG_ID;
   4615 	void *indata = NULL;
   4616 	void *outdata = NULL;
   4617 	u_int32_t insize = ad->ad_in_size;
   4618 	u_int32_t outsize = ad->ad_out_size;
   4619 	int error = 0;
   4620 
   4621 	if (ad->ad_id & ATH_DIAG_IN) {
   4622 		/*
   4623 		 * Copy in data.
   4624 		 */
   4625 		indata = malloc(insize, M_TEMP, M_NOWAIT);
   4626 		if (indata == NULL) {
   4627 			error = ENOMEM;
   4628 			goto bad;
   4629 		}
   4630 		error = copyin(ad->ad_in_data, indata, insize);
   4631 		if (error)
   4632 			goto bad;
   4633 	}
   4634 	if (ad->ad_id & ATH_DIAG_DYN) {
   4635 		/*
   4636 		 * Allocate a buffer for the results (otherwise the HAL
   4637 		 * returns a pointer to a buffer where we can read the
   4638 		 * results).  Note that we depend on the HAL leaving this
   4639 		 * pointer for us to use below in reclaiming the buffer;
   4640 		 * may want to be more defensive.
   4641 		 */
   4642 		outdata = malloc(outsize, M_TEMP, M_NOWAIT);
   4643 		if (outdata == NULL) {
   4644 			error = ENOMEM;
   4645 			goto bad;
   4646 		}
   4647 	}
   4648 	if (ath_hal_getdiagstate(ah, id, indata, insize, &outdata, &outsize)) {
   4649 		if (outsize < ad->ad_out_size)
   4650 			ad->ad_out_size = outsize;
   4651 		if (outdata != NULL)
   4652 			error = copyout(outdata, ad->ad_out_data,
   4653 					ad->ad_out_size);
   4654 	} else {
   4655 		error = EINVAL;
   4656 	}
   4657 bad:
   4658 	if ((ad->ad_id & ATH_DIAG_IN) && indata != NULL)
   4659 		free(indata, M_TEMP);
   4660 	if ((ad->ad_id & ATH_DIAG_DYN) && outdata != NULL)
   4661 		free(outdata, M_TEMP);
   4662 	return error;
   4663 }
   4664 
   4665 static int
   4666 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   4667 {
   4668 #define	IS_RUNNING(ifp) \
   4669 	((ifp->if_flags & (IFF_RUNNING|IFF_UP)) == (IFF_RUNNING|IFF_UP))
   4670 	struct ath_softc *sc = ifp->if_softc;
   4671 	struct ieee80211com *ic = &sc->sc_ic;
   4672 	struct ifreq *ifr = (struct ifreq *)data;
   4673 	int error = 0;
   4674 
   4675 	ATH_LOCK(sc);
   4676 	switch (cmd) {
   4677 	case SIOCSIFFLAGS:
   4678 		if (IS_RUNNING(ifp)) {
   4679 			/*
   4680 			 * To avoid rescanning another access point,
   4681 			 * do not call ath_init() here.  Instead,
   4682 			 * only reflect promisc mode settings.
   4683 			 */
   4684 			ath_mode_init(sc);
   4685 		} else if (ifp->if_flags & IFF_UP) {
   4686 			/*
   4687 			 * Beware of being called during attach/detach
   4688 			 * to reset promiscuous mode.  In that case we
   4689 			 * will still be marked UP but not RUNNING.
   4690 			 * However trying to re-init the interface
   4691 			 * is the wrong thing to do as we've already
   4692 			 * torn down much of our state.  There's
   4693 			 * probably a better way to deal with this.
   4694 			 */
   4695 			if (!sc->sc_invalid && ic->ic_bss != NULL)
   4696 				ath_init(sc);	/* XXX lose error */
   4697 		} else
   4698 			ath_stop_locked(ifp);
   4699 		break;
   4700 	case SIOCADDMULTI:
   4701 	case SIOCDELMULTI:
   4702 		/*
   4703 		 * The upper layer has already installed/removed
   4704 		 * the multicast address(es), just recalculate the
   4705 		 * multicast filter for the card.
   4706 		 */
   4707 		if (ifp->if_flags & IFF_RUNNING)
   4708 			ath_mode_init(sc);
   4709 		break;
   4710 	case SIOCGATHSTATS:
   4711 		/* NB: embed these numbers to get a consistent view */
   4712 		sc->sc_stats.ast_tx_packets = ifp->if_opackets;
   4713 		sc->sc_stats.ast_rx_packets = ifp->if_ipackets;
   4714 		sc->sc_stats.ast_rx_rssi = ieee80211_getrssi(ic);
   4715 		ATH_UNLOCK(sc);
   4716 		/*
   4717 		 * NB: Drop the softc lock in case of a page fault;
   4718 		 * we'll accept any potential inconsisentcy in the
   4719 		 * statistics.  The alternative is to copy the data
   4720 		 * to a local structure.
   4721 		 */
   4722 		return copyout(&sc->sc_stats,
   4723 				ifr->ifr_data, sizeof (sc->sc_stats));
   4724 	case SIOCGATHDIAG:
   4725 		error = ath_ioctl_diag(sc, (struct ath_diag *) ifr);
   4726 		break;
   4727 	default:
   4728 		error = ieee80211_ioctl(ic, cmd, data);
   4729 		if (error == ENETRESET) {
   4730 			if (IS_RUNNING(ifp) &&
   4731 			    ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
   4732 				ath_init(sc);	/* XXX lose error */
   4733 			error = 0;
   4734 		}
   4735 		if (error == ERESTART)
   4736 			error = IS_RUNNING(ifp) ? ath_reset(ifp) : 0;
   4737 		break;
   4738 	}
   4739 	ATH_UNLOCK(sc);
   4740 	return error;
   4741 #undef IS_RUNNING
   4742 }
   4743 
   4744 static int
   4745 ath_sysctl_slottime(SYSCTL_HANDLER_ARGS)
   4746 {
   4747 	struct ath_softc *sc = arg1;
   4748 	u_int slottime = ath_hal_getslottime(sc->sc_ah);
   4749 	int error;
   4750 
   4751 	error = sysctl_handle_int(oidp, &slottime, 0, req);
   4752 	if (error || !req->newptr)
   4753 		return error;
   4754 	return !ath_hal_setslottime(sc->sc_ah, slottime) ? EINVAL : 0;
   4755 }
   4756 
   4757 static int
   4758 ath_sysctl_acktimeout(SYSCTL_HANDLER_ARGS)
   4759 {
   4760 	struct ath_softc *sc = arg1;
   4761 	u_int acktimeout = ath_hal_getacktimeout(sc->sc_ah);
   4762 	int error;
   4763 
   4764 	error = sysctl_handle_int(oidp, &acktimeout, 0, req);
   4765 	if (error || !req->newptr)
   4766 		return error;
   4767 	return !ath_hal_setacktimeout(sc->sc_ah, acktimeout) ? EINVAL : 0;
   4768 }
   4769 
   4770 static int
   4771 ath_sysctl_ctstimeout(SYSCTL_HANDLER_ARGS)
   4772 {
   4773 	struct ath_softc *sc = arg1;
   4774 	u_int ctstimeout = ath_hal_getctstimeout(sc->sc_ah);
   4775 	int error;
   4776 
   4777 	error = sysctl_handle_int(oidp, &ctstimeout, 0, req);
   4778 	if (error || !req->newptr)
   4779 		return error;
   4780 	return !ath_hal_setctstimeout(sc->sc_ah, ctstimeout) ? EINVAL : 0;
   4781 }
   4782 
   4783 static int
   4784 ath_sysctl_softled(SYSCTL_HANDLER_ARGS)
   4785 {
   4786 	struct ath_softc *sc = arg1;
   4787 	int softled = sc->sc_softled;
   4788 	int error;
   4789 
   4790 	error = sysctl_handle_int(oidp, &softled, 0, req);
   4791 	if (error || !req->newptr)
   4792 		return error;
   4793 	softled = (softled != 0);
   4794 	if (softled != sc->sc_softled) {
   4795 		if (softled) {
   4796 			/* NB: handle any sc_ledpin change */
   4797 			ath_hal_gpioCfgOutput(sc->sc_ah, sc->sc_ledpin);
   4798 			ath_hal_gpioset(sc->sc_ah, sc->sc_ledpin,
   4799 				!sc->sc_ledon);
   4800 		}
   4801 		sc->sc_softled = softled;
   4802 	}
   4803 	return 0;
   4804 }
   4805 
   4806 static int
   4807 ath_sysctl_rxantenna(SYSCTL_HANDLER_ARGS)
   4808 {
   4809 	struct ath_softc *sc = arg1;
   4810 	u_int defantenna = ath_hal_getdefantenna(sc->sc_ah);
   4811 	int error;
   4812 
   4813 	error = sysctl_handle_int(oidp, &defantenna, 0, req);
   4814 	if (!error && req->newptr)
   4815 		ath_hal_setdefantenna(sc->sc_ah, defantenna);
   4816 	return error;
   4817 }
   4818 
   4819 static int
   4820 ath_sysctl_diversity(SYSCTL_HANDLER_ARGS)
   4821 {
   4822 	struct ath_softc *sc = arg1;
   4823 	u_int diversity = sc->sc_diversity;
   4824 	int error;
   4825 
   4826 	error = sysctl_handle_int(oidp, &diversity, 0, req);
   4827 	if (error || !req->newptr)
   4828 		return error;
   4829 	sc->sc_diversity = diversity;
   4830 	return !ath_hal_setdiversity(sc->sc_ah, diversity) ? EINVAL : 0;
   4831 }
   4832 
   4833 static int
   4834 ath_sysctl_diag(SYSCTL_HANDLER_ARGS)
   4835 {
   4836 	struct ath_softc *sc = arg1;
   4837 	u_int32_t diag;
   4838 	int error;
   4839 
   4840 	if (!ath_hal_getdiag(sc->sc_ah, &diag))
   4841 		return EINVAL;
   4842 	error = sysctl_handle_int(oidp, &diag, 0, req);
   4843 	if (error || !req->newptr)
   4844 		return error;
   4845 	return !ath_hal_setdiag(sc->sc_ah, diag) ? EINVAL : 0;
   4846 }
   4847 
   4848 static int
   4849 ath_sysctl_tpscale(SYSCTL_HANDLER_ARGS)
   4850 {
   4851 	struct ath_softc *sc = arg1;
   4852 	struct ifnet *ifp = sc->sc_ifp;
   4853 	u_int32_t scale;
   4854 	int error;
   4855 
   4856 	ath_hal_gettpscale(sc->sc_ah, &scale);
   4857 	error = sysctl_handle_int(oidp, &scale, 0, req);
   4858 	if (error || !req->newptr)
   4859 		return error;
   4860 	return !ath_hal_settpscale(sc->sc_ah, scale) ? EINVAL : ath_reset(ifp);
   4861 }
   4862 
   4863 static int
   4864 ath_sysctl_tpc(SYSCTL_HANDLER_ARGS)
   4865 {
   4866 	struct ath_softc *sc = arg1;
   4867 	u_int tpc = ath_hal_gettpc(sc->sc_ah);
   4868 	int error;
   4869 
   4870 	error = sysctl_handle_int(oidp, &tpc, 0, req);
   4871 	if (error || !req->newptr)
   4872 		return error;
   4873 	return !ath_hal_settpc(sc->sc_ah, tpc) ? EINVAL : 0;
   4874 }
   4875 
   4876 static void
   4877 ath_sysctlattach(struct ath_softc *sc)
   4878 {
   4879 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
   4880 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
   4881 
   4882 	ath_hal_getcountrycode(sc->sc_ah, &sc->sc_countrycode);
   4883 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4884 		"countrycode", CTLFLAG_RD, &sc->sc_countrycode, 0,
   4885 		"EEPROM country code");
   4886 	ath_hal_getregdomain(sc->sc_ah, &sc->sc_regdomain);
   4887 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4888 		"regdomain", CTLFLAG_RD, &sc->sc_regdomain, 0,
   4889 		"EEPROM regdomain code");
   4890 	sc->sc_debug = ath_debug;
   4891 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4892 		"debug", CTLFLAG_RW, &sc->sc_debug, 0,
   4893 		"control debugging printfs");
   4894 
   4895 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4896 		"slottime", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4897 		ath_sysctl_slottime, "I", "802.11 slot time (us)");
   4898 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4899 		"acktimeout", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4900 		ath_sysctl_acktimeout, "I", "802.11 ACK timeout (us)");
   4901 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4902 		"ctstimeout", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4903 		ath_sysctl_ctstimeout, "I", "802.11 CTS timeout (us)");
   4904 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4905 		"softled", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4906 		ath_sysctl_softled, "I", "enable/disable software LED support");
   4907 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4908 		"ledpin", CTLFLAG_RW, &sc->sc_ledpin, 0,
   4909 		"GPIO pin connected to LED");
   4910 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4911 		"ledon", CTLFLAG_RW, &sc->sc_ledon, 0,
   4912 		"setting to turn LED on");
   4913 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4914 		"ledidle", CTLFLAG_RW, &sc->sc_ledidle, 0,
   4915 		"idle time for inactivity LED (ticks)");
   4916 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4917 		"txantenna", CTLFLAG_RW, &sc->sc_txantenna, 0,
   4918 		"tx antenna (0=auto)");
   4919 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4920 		"rxantenna", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4921 		ath_sysctl_rxantenna, "I", "default/rx antenna");
   4922 	if (sc->sc_hasdiversity)
   4923 		SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4924 			"diversity", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4925 			ath_sysctl_diversity, "I", "antenna diversity");
   4926 	sc->sc_txintrperiod = ATH_TXINTR_PERIOD;
   4927 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4928 		"txintrperiod", CTLFLAG_RW, &sc->sc_txintrperiod, 0,
   4929 		"tx descriptor batching");
   4930 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4931 		"diag", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4932 		ath_sysctl_diag, "I", "h/w diagnostic control");
   4933 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4934 		"tpscale", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4935 		ath_sysctl_tpscale, "I", "tx power scaling");
   4936 	if (sc->sc_hastpc)
   4937 		SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
   4938 			"tpc", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
   4939 			ath_sysctl_tpc, "I", "enable/disable per-packet TPC");
   4940 }
   4941 
   4942 static void
   4943 ath_bpfattach(struct ath_softc *sc)
   4944 {
   4945 	struct ifnet *ifp = sc->sc_ifp;
   4946 
   4947 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
   4948 		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
   4949 		&sc->sc_drvbpf);
   4950 	/*
   4951 	 * Initialize constant fields.
   4952 	 * XXX make header lengths a multiple of 32-bits so subsequent
   4953 	 *     headers are properly aligned; this is a kludge to keep
   4954 	 *     certain applications happy.
   4955 	 *
   4956 	 * NB: the channel is setup each time we transition to the
   4957 	 *     RUN state to avoid filling it in for each frame.
   4958 	 */
   4959 	sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
   4960 	sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
   4961 	sc->sc_tx_th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
   4962 
   4963 	sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
   4964 	sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
   4965 	sc->sc_rx_th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
   4966 }
   4967 
   4968 /*
   4969  * Announce various information on device/driver attach.
   4970  */
   4971 static void
   4972 ath_announce(struct ath_softc *sc)
   4973 {
   4974 #define	HAL_MODE_DUALBAND	(HAL_MODE_11A|HAL_MODE_11B)
   4975 	struct ifnet *ifp = sc->sc_ifp;
   4976 	struct ath_hal *ah = sc->sc_ah;
   4977 	u_int modes, cc;
   4978 
   4979 	if_printf(ifp, "mac %d.%d phy %d.%d",
   4980 		ah->ah_macVersion, ah->ah_macRev,
   4981 		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
   4982 	/*
   4983 	 * Print radio revision(s).  We check the wireless modes
   4984 	 * to avoid falsely printing revs for inoperable parts.
   4985 	 * Dual-band radio revs are returned in the 5Ghz rev number.
   4986 	 */
   4987 	ath_hal_getcountrycode(ah, &cc);
   4988 	modes = ath_hal_getwirelessmodes(ah, cc);
   4989 	if ((modes & HAL_MODE_DUALBAND) == HAL_MODE_DUALBAND) {
   4990 		if (ah->ah_analog5GhzRev && ah->ah_analog2GhzRev)
   4991 			printf(" 5ghz radio %d.%d 2ghz radio %d.%d",
   4992 				ah->ah_analog5GhzRev >> 4,
   4993 				ah->ah_analog5GhzRev & 0xf,
   4994 				ah->ah_analog2GhzRev >> 4,
   4995 				ah->ah_analog2GhzRev & 0xf);
   4996 		else
   4997 			printf(" radio %d.%d", ah->ah_analog5GhzRev >> 4,
   4998 				ah->ah_analog5GhzRev & 0xf);
   4999 	} else
   5000 		printf(" radio %d.%d", ah->ah_analog5GhzRev >> 4,
   5001 			ah->ah_analog5GhzRev & 0xf);
   5002 	printf("\n");
   5003 	if (bootverbose) {
   5004 		int i;
   5005 		for (i = 0; i <= WME_AC_VO; i++) {
   5006 			struct ath_txq *txq = sc->sc_ac2q[i];
   5007 			if_printf(ifp, "Use hw queue %u for %s traffic\n",
   5008 				txq->axq_qnum, ieee80211_wme_acnames[i]);
   5009 		}
   5010 		if_printf(ifp, "Use hw queue %u for CAB traffic\n",
   5011 			sc->sc_cabq->axq_qnum);
   5012 		if_printf(ifp, "Use hw queue %u for beacons\n", sc->sc_bhalq);
   5013 	}
   5014 #undef HAL_MODE_DUALBAND
   5015 }
   5016