Home | History | Annotate | Line # | Download | only in ic
ath.c revision 1.8
      1 /*-
      2  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
      3  * All rights reserved.
      4  *
      5  * Redistribution and use in source and binary forms, with or without
      6  * modification, are permitted provided that the following conditions
      7  * are met:
      8  * 1. Redistributions of source code must retain the above copyright
      9  *    notice, this list of conditions and the following disclaimer,
     10  *    without modification.
     11  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
     12  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
     13  *    redistribution must be conditioned upon including a substantially
     14  *    similar Disclaimer requirement for further binary redistribution.
     15  * 3. Neither the names of the above-listed copyright holders nor the names
     16  *    of any contributors may be used to endorse or promote products derived
     17  *    from this software without specific prior written permission.
     18  *
     19  * Alternatively, this software may be distributed under the terms of the
     20  * GNU General Public License ("GPL") version 2 as published by the Free
     21  * Software Foundation.
     22  *
     23  * NO WARRANTY
     24  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
     25  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
     26  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
     27  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
     28  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
     29  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
     30  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
     31  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
     32  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
     33  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
     34  * THE POSSIBILITY OF SUCH DAMAGES.
     35  */
     36 
     37 #include <sys/cdefs.h>
     38 #ifdef __FreeBSD__
     39 __FBSDID("$FreeBSD: src/sys/dev/ath/if_ath.c,v 1.14 2003/09/05 22:22:49 sam Exp $");
     40 #endif
     41 #ifdef __NetBSD__
     42 __KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.8 2003/10/15 22:41:22 enami Exp $");
     43 #endif
     44 
     45 /*
     46  * Driver for the Atheros Wireless LAN controller.
     47  *
     48  * This software is derived from work of Atsushi Onoe; his contribution
     49  * is greatly appreciated.
     50  */
     51 
     52 #include "opt_inet.h"
     53 
     54 #ifdef __NetBSD__
     55 #include "bpfilter.h"
     56 #endif /* __NetBSD__ */
     57 
     58 #include <sys/param.h>
     59 #include <sys/systm.h>
     60 #include <sys/types.h>
     61 #include <sys/sysctl.h>
     62 #include <sys/mbuf.h>
     63 #include <sys/malloc.h>
     64 #include <sys/lock.h>
     65 #ifdef __FreeBSD__
     66 #include <sys/mutex.h>
     67 #endif
     68 #include <sys/kernel.h>
     69 #include <sys/socket.h>
     70 #include <sys/sockio.h>
     71 #include <sys/errno.h>
     72 #include <sys/callout.h>
     73 #ifdef __FreeBSD__
     74 #include <sys/bus.h>
     75 #else
     76 #include <machine/bus.h>
     77 #endif
     78 #include <sys/endian.h>
     79 
     80 #include <machine/bus.h>
     81 
     82 #include <net/if.h>
     83 #include <net/if_dl.h>
     84 #include <net/if_media.h>
     85 #include <net/if_arp.h>
     86 #ifdef __FreeBSD__
     87 #include <net/ethernet.h>
     88 #else
     89 #include <net/if_ether.h>
     90 #endif
     91 #include <net/if_llc.h>
     92 
     93 #include <net80211/ieee80211_var.h>
     94 #include <net80211/ieee80211_compat.h>
     95 
     96 #if NBPFILTER > 0
     97 #include <net/bpf.h>
     98 #endif
     99 
    100 #ifdef INET
    101 #include <netinet/in.h>
    102 #endif
    103 
    104 #include <dev/ic/athcompat.h>
    105 
    106 #define	AR_DEBUG
    107 #ifdef __FreeBSD__
    108 #include <dev/ath/if_athvar.h>
    109 #include <contrib/dev/ath/ah_desc.h>
    110 #else
    111 #include <dev/ic/athvar.h>
    112 #include <../contrib/sys/dev/ic/athhal_desc.h>
    113 #endif
    114 
    115 /* unalligned little endian access */
    116 #define LE_READ_2(p)							\
    117 	((u_int16_t)							\
    118 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
    119 #define LE_READ_4(p)							\
    120 	((u_int32_t)							\
    121 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
    122 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
    123 
    124 #ifdef __FreeBSD__
    125 static void	ath_init(void *);
    126 #else
    127 static int	ath_init(struct ifnet *);
    128 #endif
    129 static int	ath_init1(struct ath_softc *);
    130 static int	ath_intr1(struct ath_softc *);
    131 static void	ath_stop(struct ifnet *);
    132 static void	ath_start(struct ifnet *);
    133 static void	ath_reset(struct ath_softc *);
    134 static int	ath_media_change(struct ifnet *);
    135 static void	ath_watchdog(struct ifnet *);
    136 static int	ath_ioctl(struct ifnet *, u_long, caddr_t);
    137 static void	ath_fatal_proc(void *, int);
    138 static void	ath_rxorn_proc(void *, int);
    139 static void	ath_bmiss_proc(void *, int);
    140 static void	ath_initkeytable(struct ath_softc *);
    141 static void	ath_mode_init(struct ath_softc *);
    142 static int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
    143 static void	ath_beacon_proc(void *, int);
    144 static void	ath_beacon_free(struct ath_softc *);
    145 static void	ath_beacon_config(struct ath_softc *);
    146 static int	ath_desc_alloc(struct ath_softc *);
    147 static void	ath_desc_free(struct ath_softc *);
    148 static struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
    149 static void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
    150 static void	ath_node_copy(struct ieee80211com *,
    151 			struct ieee80211_node *, const struct ieee80211_node *);
    152 static int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
    153 static void	ath_rx_proc(void *, int);
    154 static int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
    155 			     struct ath_buf *, struct mbuf *);
    156 static void	ath_tx_proc(void *, int);
    157 static int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
    158 static void	ath_draintxq(struct ath_softc *);
    159 static void	ath_stoprecv(struct ath_softc *);
    160 static int	ath_startrecv(struct ath_softc *);
    161 static void	ath_next_scan(void *);
    162 static void	ath_calibrate(void *);
    163 static int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
    164 static void	ath_newassoc(struct ieee80211com *,
    165 			struct ieee80211_node *, int);
    166 static int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor);
    167 
    168 static int	ath_rate_setup(struct ath_softc *sc, u_int mode);
    169 static void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
    170 static void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
    171 static void	ath_rate_ctl(void *, struct ieee80211_node *);
    172 
    173 #ifdef __NetBSD__
    174 int	ath_enable(struct ath_softc *);
    175 void	ath_disable(struct ath_softc *);
    176 void	ath_power(int, void *);
    177 #endif
    178 
    179 #ifdef __FreeBSD__
    180 SYSCTL_DECL(_hw_ath);
    181 /* XXX validate sysctl values */
    182 SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
    183 	    0, "channel dwell time (ms) for AP/station scanning");
    184 SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
    185 	    0, "chip calibration interval (secs)");
    186 SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
    187 	    0, "enable/disable outdoor operation");
    188 SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
    189 	    0, "country code");
    190 SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
    191 	    0, "regulatory domain");
    192 #endif /* __FreeBSD__ */
    193 
    194 static	int ath_dwelltime = 200;		/* 5 channels/second */
    195 static	int ath_calinterval = 30;		/* calibrate every 30 secs */
    196 static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
    197 static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
    198 static	int ath_regdomain = 0;			/* regulatory domain */
    199 
    200 #ifdef AR_DEBUG
    201 int	ath_debug = 0;
    202 #ifdef __FreeBSD__
    203 SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
    204 	    0, "control debugging printfs");
    205 #endif /* __FreeBSD__ */
    206 #define	IFF_DUMPPKTS(_ifp) \
    207 	(ath_debug || \
    208 	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
    209 static	void ath_printrxbuf(struct ath_buf *bf, int);
    210 static	void ath_printtxbuf(struct ath_buf *bf, int);
    211 #define	DPRINTF(X)	if (ath_debug) printf X
    212 #define	DPRINTF2(X)	if (ath_debug > 1) printf X
    213 #else
    214 #define	IFF_DUMPPKTS(_ifp) \
    215 	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
    216 #define	DPRINTF(X)
    217 #define	DPRINTF2(X)
    218 #endif
    219 
    220 #ifdef __NetBSD__
    221 int
    222 ath_activate(struct device *self, enum devact act)
    223 {
    224 	struct ath_softc *sc = (struct ath_softc *)self;
    225 	int rv = 0, s;
    226 
    227 	s = splnet();
    228 	switch (act) {
    229 	case DVACT_ACTIVATE:
    230 		rv = EOPNOTSUPP;
    231 		break;
    232 	case DVACT_DEACTIVATE:
    233 		if_deactivate(&sc->sc_ic.ic_if);
    234 		break;
    235 	}
    236 	splx(s);
    237 	return rv;
    238 }
    239 
    240 int
    241 ath_enable(struct ath_softc *sc)
    242 {
    243 	if (ATH_IS_ENABLED(sc) == 0) {
    244 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
    245 			printf("%s: device enable failed\n",
    246 				sc->sc_dev.dv_xname);
    247 			return (EIO);
    248 		}
    249 		sc->sc_flags |= ATH_ENABLED;
    250 	}
    251 	return (0);
    252 }
    253 
    254 void
    255 ath_disable(struct ath_softc *sc)
    256 {
    257 	if (!ATH_IS_ENABLED(sc))
    258 		return;
    259 	if (sc->sc_disable != NULL)
    260 		(*sc->sc_disable)(sc);
    261 	sc->sc_flags &= ~ATH_ENABLED;
    262 }
    263 #endif	/* #ifdef __NetBSD__ */
    264 
    265 int
    266 ath_attach(u_int16_t devid, struct ath_softc *sc)
    267 {
    268 	struct ieee80211com *ic = &sc->sc_ic;
    269 	struct ifnet *ifp = &ic->ic_if;
    270 	struct ath_hal *ah;
    271 	HAL_STATUS status;
    272 	int error = 0;
    273 
    274 	DPRINTF(("ath_attach: devid 0x%x\n", devid));
    275 
    276 #ifdef __FreeBSD__
    277 	/* set these up early for if_printf use */
    278 	ifp->if_unit = device_get_unit(sc->sc_dev);
    279 	ifp->if_name = "ath";
    280 #else
    281 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
    282 #endif
    283 
    284 	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
    285 	if (ah == NULL) {
    286 		if_printf(ifp, "unable to attach hardware; HAL status %u\n",
    287 			status);
    288 		error = ENXIO;
    289 		goto bad;
    290 	}
    291 	sc->sc_ah = ah;
    292 	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
    293 
    294 	/*
    295 	 * Collect the channel list using the default country
    296 	 * code and including outdoor channels.  The 802.11 layer
    297 	 * is resposible for filtering this list based on settings
    298 	 * like the phy mode.
    299 	 */
    300 	error = ath_getchannels(sc, ath_countrycode, ath_outdoor);
    301 	if (error != 0)
    302 		goto bad;
    303 	/*
    304 	 * Copy these back; they are set as a side effect
    305 	 * of constructing the channel list.
    306 	 */
    307 	ath_regdomain = ath_hal_getregdomain(ah);
    308 	ath_countrycode = ath_hal_getcountrycode(ah);
    309 
    310 	/*
    311 	 * Setup rate tables for all potential media types.
    312 	 */
    313 	ath_rate_setup(sc, IEEE80211_MODE_11A);
    314 	ath_rate_setup(sc, IEEE80211_MODE_11B);
    315 	ath_rate_setup(sc, IEEE80211_MODE_11G);
    316 	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
    317 
    318 	error = ath_desc_alloc(sc);
    319 	if (error != 0) {
    320 		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
    321 		goto bad;
    322 	}
    323 	ATH_CALLOUT_INIT(&sc->sc_scan_ch);
    324 	ATH_CALLOUT_INIT(&sc->sc_cal_ch);
    325 
    326 #ifdef __FreeBSD__
    327 	mtx_init(&sc->sc_txbuflock,
    328 		device_get_nameunit(sc->sc_dev), "xmit buf q", MTX_DEF);
    329 	mtx_init(&sc->sc_txqlock,
    330 		device_get_nameunit(sc->sc_dev), "xmit q", MTX_DEF);
    331 #endif
    332 
    333 	ATH_TASK_INIT(&sc->sc_txtask, ath_tx_proc, sc);
    334 	ATH_TASK_INIT(&sc->sc_rxtask, ath_rx_proc, sc);
    335 	ATH_TASK_INIT(&sc->sc_swbatask, ath_beacon_proc, sc);
    336 	ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc);
    337 	ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc);
    338 	ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc);
    339 
    340 	/*
    341 	 * For now just pre-allocate one data queue and one
    342 	 * beacon queue.  Note that the HAL handles resetting
    343 	 * them at the needed time.  Eventually we'll want to
    344 	 * allocate more tx queues for splitting management
    345 	 * frames and for QOS support.
    346 	 */
    347 	sc->sc_txhalq = ath_hal_setuptxqueue(ah,
    348 		HAL_TX_QUEUE_DATA,
    349 		AH_TRUE			/* enable interrupts */
    350 	);
    351 	if (sc->sc_txhalq == (u_int) -1) {
    352 		if_printf(ifp, "unable to setup a data xmit queue!\n");
    353 		goto bad;
    354 	}
    355 	sc->sc_bhalq = ath_hal_setuptxqueue(ah,
    356 		HAL_TX_QUEUE_BEACON,
    357 		AH_TRUE			/* enable interrupts */
    358 	);
    359 	if (sc->sc_bhalq == (u_int) -1) {
    360 		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
    361 		goto bad;
    362 	}
    363 
    364 	ifp->if_softc = sc;
    365 	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST;
    366 	ifp->if_start = ath_start;
    367 	ifp->if_watchdog = ath_watchdog;
    368 	ifp->if_ioctl = ath_ioctl;
    369 	ifp->if_init = ath_init;
    370 #ifdef __FreeBSD__
    371 	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
    372 #else
    373 #if 0
    374 	ifp->if_stop = ath_stop;		/* XXX */
    375 #endif
    376 	IFQ_SET_READY(&ifp->if_snd);
    377 #endif
    378 
    379 	ic->ic_softc = sc;
    380 	ic->ic_newassoc = ath_newassoc;
    381 	/* XXX not right but it's not used anywhere important */
    382 	ic->ic_phytype = IEEE80211_T_OFDM;
    383 	ic->ic_opmode = IEEE80211_M_STA;
    384 	ic->ic_caps = IEEE80211_C_WEP | IEEE80211_C_IBSS | IEEE80211_C_HOSTAP
    385 		| IEEE80211_C_MONITOR;
    386 	/* NB: 11g support is identified when we fetch the channel set */
    387 	if (sc->sc_have11g)
    388 		ic->ic_caps |= IEEE80211_C_SHPREAMBLE;
    389 
    390 	/* get mac address from hardware */
    391 	ath_hal_getmac(ah, ic->ic_myaddr);
    392 
    393 #ifdef __NetBSD__
    394 	if_attach(ifp);
    395 #endif
    396 	/* call MI attach routine. */
    397 	ieee80211_ifattach(ifp);
    398 	/* override default methods */
    399 	ic->ic_node_alloc = ath_node_alloc;
    400 	ic->ic_node_free = ath_node_free;
    401 	ic->ic_node_copy = ath_node_copy;
    402 	sc->sc_newstate = ic->ic_newstate;
    403 	ic->ic_newstate = ath_newstate;
    404 	/* complete initialization */
    405 	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
    406 
    407 #if NBPFILTER > 0
    408 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
    409 		sizeof(struct ieee80211_frame) + sizeof(sc->sc_tx_th),
    410 		&sc->sc_drvbpf);
    411 #endif
    412 	/*
    413 	 * Initialize constant fields.
    414 	 *
    415 	 * NB: the channel is setup each time we transition to the
    416 	 *     RUN state to avoid filling it in for each frame.
    417 	 */
    418 	sc->sc_tx_th.wt_ihdr.it_len = sizeof(sc->sc_tx_th);
    419 	sc->sc_tx_th.wt_ihdr.it_present = ATH_TX_RADIOTAP_PRESENT;
    420 
    421 	sc->sc_rx_th.wr_ihdr.it_len = sizeof(sc->sc_rx_th);
    422 	sc->sc_rx_th.wr_ihdr.it_present = ATH_RX_RADIOTAP_PRESENT;
    423 
    424 	if_printf(ifp, "802.11 address: %s\n", ether_sprintf(ic->ic_myaddr));
    425 
    426 #ifdef __NetBSD__
    427 	sc->sc_flags |= ATH_ATTACHED;
    428 	/*
    429 	 * Make sure the interface is shutdown during reboot.
    430 	 */
    431 #if 0
    432 	sc->sc_sdhook = shutdownhook_establish(ath_shutdown, sc);
    433 	if (sc->sc_sdhook == NULL)
    434 		printf("%s: WARNING: unable to establish shutdown hook\n",
    435 			sc->sc_dev.dv_xname);
    436 #endif
    437 	sc->sc_powerhook = powerhook_establish(ath_power, sc);
    438 	if (sc->sc_powerhook == NULL)
    439 		printf("%s: WARNING: unable to establish power hook\n",
    440 			sc->sc_dev.dv_xname);
    441 #endif
    442 	return 0;
    443 bad:
    444 	if (ah)
    445 		ath_hal_detach(ah);
    446 	sc->sc_invalid = 1;
    447 	return error;
    448 }
    449 
    450 int
    451 ath_detach(struct ath_softc *sc)
    452 {
    453 	struct ifnet *ifp = &sc->sc_ic.ic_if;
    454 	ath_softc_critsect_decl(s);
    455 
    456 	DPRINTF(("ath_detach: if_flags %x\n", ifp->if_flags));
    457 	if ((sc->sc_flags & ATH_ATTACHED) == 0)
    458 		return (0);
    459 
    460 	ath_softc_critsect_begin(sc, s);
    461 	ath_stop(ifp);
    462 #if NBPFILTER > 0
    463 	bpfdetach(ifp);
    464 #endif
    465 	ath_desc_free(sc);
    466 	ath_hal_detach(sc->sc_ah);
    467 	ieee80211_ifdetach(ifp);
    468 #ifdef __NetBSD__
    469 	if_detach(ifp);
    470 #endif
    471 	ath_softc_critsect_end(sc, s);
    472 	return 0;
    473 }
    474 
    475 void
    476 ath_power(int why, void *arg)
    477 {
    478 	struct ath_softc *sc = arg;
    479 	int s;
    480 
    481 	DPRINTF(("ath_power(%d)\n", why));
    482 
    483 	s = splnet();
    484 	switch (why) {
    485 	case PWR_SUSPEND:
    486 	case PWR_STANDBY:
    487 		ath_suspend(sc, why);
    488 		break;
    489 	case PWR_RESUME:
    490 		ath_resume(sc, why);
    491 		break;
    492 	case PWR_SOFTSUSPEND:
    493 	case PWR_SOFTSTANDBY:
    494 	case PWR_SOFTRESUME:
    495 		break;
    496 	}
    497 	splx(s);
    498 }
    499 
    500 void
    501 ath_suspend(struct ath_softc *sc, int why)
    502 {
    503 	struct ifnet *ifp = &sc->sc_ic.ic_if;
    504 
    505 	DPRINTF(("ath_suspend: if_flags %x\n", ifp->if_flags));
    506 
    507 	ath_stop(ifp);
    508 	if (sc->sc_power != NULL)
    509 		(*sc->sc_power)(sc, why);
    510 }
    511 
    512 void
    513 ath_resume(struct ath_softc *sc, int why)
    514 {
    515 	struct ifnet *ifp = &sc->sc_ic.ic_if;
    516 
    517 	DPRINTF(("ath_resume: if_flags %x\n", ifp->if_flags));
    518 
    519 	if (ifp->if_flags & IFF_UP) {
    520 		ath_init(ifp);
    521 #if 0
    522 		(void)ath_intr(sc);
    523 #endif
    524 		if (sc->sc_power != NULL)
    525 			(*sc->sc_power)(sc, why);
    526 		if (ifp->if_flags & IFF_RUNNING)
    527 			ath_start(ifp);
    528 	}
    529 }
    530 
    531 void
    532 ath_shutdown(struct ath_softc *sc)
    533 {
    534 #if 1
    535 	return;
    536 #else
    537 	struct ifnet *ifp = &sc->sc_ic.ic_if;
    538 
    539 	DPRINTF(("ath_shutdown: if_flags %x\n", ifp->if_flags));
    540 
    541 	ath_stop(ifp);
    542 #endif
    543 }
    544 
    545 #ifdef __NetBSD__
    546 int
    547 ath_intr(void *arg)
    548 {
    549 	return ath_intr1((struct ath_softc *)arg);
    550 }
    551 #else
    552 void
    553 ath_intr(void *arg)
    554 {
    555 	(void)ath_intr1((struct ath_softc *)arg);
    556 }
    557 #endif
    558 
    559 static int
    560 ath_intr1(struct ath_softc *sc)
    561 {
    562 	struct ieee80211com *ic = &sc->sc_ic;
    563 	struct ifnet *ifp = &ic->ic_if;
    564 	struct ath_hal *ah = sc->sc_ah;
    565 	HAL_INT status;
    566 
    567 	if (sc->sc_invalid) {
    568 		/*
    569 		 * The hardware is not ready/present, don't touch anything.
    570 		 * Note this can happen early on if the IRQ is shared.
    571 		 */
    572 		DPRINTF(("ath_intr: invalid; ignored\n"));
    573 		return 0;
    574 	}
    575 	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
    576 		DPRINTF(("ath_intr: if_flags 0x%x\n", ifp->if_flags));
    577 		ath_hal_getisr(ah, &status);	/* clear ISR */
    578 		ath_hal_intrset(ah, 0);		/* disable further intr's */
    579 		return 1; /* XXX */
    580 	}
    581 	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
    582 	DPRINTF2(("ath_intr: status 0x%x\n", status));
    583 #ifdef AR_DEBUG
    584 	if (ath_debug &&
    585 	    (status & (HAL_INT_FATAL|HAL_INT_RXORN|HAL_INT_BMISS))) {
    586 		if_printf(ifp, "ath_intr: status 0x%x\n", status);
    587 		ath_hal_dumpstate(ah);
    588 	}
    589 #endif /* AR_DEBUG */
    590 	if (status & HAL_INT_FATAL) {
    591 		sc->sc_stats.ast_hardware++;
    592 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
    593 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_fataltask);
    594 	} else if (status & HAL_INT_RXORN) {
    595 		sc->sc_stats.ast_rxorn++;
    596 		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
    597 		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxorntask);
    598 	} else {
    599 		if (status & HAL_INT_RXEOL) {
    600 			/*
    601 			 * NB: the hardware should re-read the link when
    602 			 *     RXE bit is written, but it doesn't work at
    603 			 *     least on older hardware revs.
    604 			 */
    605 			sc->sc_stats.ast_rxeol++;
    606 			sc->sc_rxlink = NULL;
    607 		}
    608 		if (status & HAL_INT_TXURN) {
    609 			sc->sc_stats.ast_txurn++;
    610 			/* bump tx trigger level */
    611 			ath_hal_updatetxtriglevel(ah, AH_TRUE);
    612 		}
    613 		if (status & HAL_INT_RX)
    614 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask);
    615 		if (status & HAL_INT_TX)
    616 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask);
    617 		if (status & HAL_INT_SWBA)
    618 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_swbatask);
    619 		if (status & HAL_INT_BMISS) {
    620 			sc->sc_stats.ast_bmiss++;
    621 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask);
    622 		}
    623 	}
    624 	return 1;
    625 }
    626 
    627 static void
    628 ath_fatal_proc(void *arg, int pending)
    629 {
    630 	struct ath_softc *sc = arg;
    631 
    632 	device_printf(sc->sc_dev, "hardware error; resetting\n");
    633 	ath_reset(sc);
    634 }
    635 
    636 static void
    637 ath_rxorn_proc(void *arg, int pending)
    638 {
    639 	struct ath_softc *sc = arg;
    640 
    641 	device_printf(sc->sc_dev, "rx FIFO overrun; resetting\n");
    642 	ath_reset(sc);
    643 }
    644 
    645 static void
    646 ath_bmiss_proc(void *arg, int pending)
    647 {
    648 	struct ath_softc *sc = arg;
    649 	struct ieee80211com *ic = &sc->sc_ic;
    650 
    651 	DPRINTF(("ath_bmiss_proc: pending %u\n", pending));
    652 	KASSERT(ic->ic_opmode == IEEE80211_M_STA,
    653 		("unexpect operating mode %u", ic->ic_opmode));
    654 	if (ic->ic_state == IEEE80211_S_RUN)
    655 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    656 }
    657 
    658 static u_int
    659 ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
    660 {
    661 	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
    662 
    663 	switch (mode) {
    664 	case IEEE80211_MODE_AUTO:
    665 		return 0;
    666 	case IEEE80211_MODE_11A:
    667 		return CHANNEL_A;
    668 	case IEEE80211_MODE_11B:
    669 		return CHANNEL_B;
    670 	case IEEE80211_MODE_11G:
    671 		return CHANNEL_PUREG;
    672 	case IEEE80211_MODE_TURBO:
    673 		return CHANNEL_T;
    674 	default:
    675 		panic("%s: unsupported mode %d\n", __func__, mode);
    676 		return 0;
    677 	}
    678 }
    679 
    680 #ifdef __NetBSD__
    681 static int
    682 ath_init(struct ifnet *ifp)
    683 {
    684 	return ath_init1((struct ath_softc *)ifp->if_softc);
    685 }
    686 #else
    687 static void
    688 ath_init(void *arg)
    689 {
    690 	(void)ath_init1((struct ath_softc *)arg);
    691 }
    692 #endif
    693 
    694 static int
    695 ath_init1(struct ath_softc *sc)
    696 {
    697 	struct ieee80211com *ic = &sc->sc_ic;
    698 	struct ifnet *ifp = &ic->ic_if;
    699 	struct ieee80211_node *ni;
    700 	enum ieee80211_phymode mode;
    701 	struct ath_hal *ah = sc->sc_ah;
    702 	HAL_STATUS status;
    703 	HAL_CHANNEL hchan;
    704 	int error = 0;
    705 	ath_softc_critsect_decl(s);
    706 
    707 	DPRINTF(("ath_init: if_flags 0x%x\n", ifp->if_flags));
    708 
    709 #ifdef __NetBSD__
    710 	if ((error = ath_enable(sc)) != 0)
    711 		return error;
    712 #endif
    713 
    714 	ath_softc_critsect_begin(sc, s);
    715 	/*
    716 	 * Stop anything previously setup.  This is safe
    717 	 * whether this is the first time through or not.
    718 	 */
    719 	ath_stop(ifp);
    720 
    721 	/*
    722 	 * The basic interface to setting the hardware in a good
    723 	 * state is ``reset''.  On return the hardware is known to
    724 	 * be powered up and with interrupts disabled.  This must
    725 	 * be followed by initialization of the appropriate bits
    726 	 * and then setup of the interrupt mask.
    727 	 */
    728 	hchan.channel = ic->ic_ibss_chan->ic_freq;
    729 	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
    730 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
    731 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
    732 			status);
    733 		error = -1;
    734 		goto done;
    735 	}
    736 
    737 	/*
    738 	 * Setup the hardware after reset: the key cache
    739 	 * is filled as needed and the receive engine is
    740 	 * set going.  Frame transmit is handled entirely
    741 	 * in the frame output path; there's nothing to do
    742 	 * here except setup the interrupt mask.
    743 	 */
    744 	if (ic->ic_flags & IEEE80211_F_WEPON)
    745 		ath_initkeytable(sc);
    746 	if ((error = ath_startrecv(sc)) != 0) {
    747 		if_printf(ifp, "unable to start recv logic\n");
    748 		goto done;
    749 	}
    750 
    751 	/*
    752 	 * Enable interrupts.
    753 	 */
    754 	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
    755 		  | HAL_INT_RXEOL | HAL_INT_RXORN
    756 		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
    757 	ath_hal_intrset(ah, sc->sc_imask);
    758 
    759 	ifp->if_flags |= IFF_RUNNING;
    760 	ic->ic_state = IEEE80211_S_INIT;
    761 
    762 	/*
    763 	 * The hardware should be ready to go now so it's safe
    764 	 * to kick the 802.11 state machine as it's likely to
    765 	 * immediately call back to us to send mgmt frames.
    766 	 */
    767 	ni = ic->ic_bss;
    768 	ni->ni_chan = ic->ic_ibss_chan;
    769 	mode = ieee80211_chan2mode(ic, ni->ni_chan);
    770 	if (mode != sc->sc_curmode)
    771 		ath_setcurmode(sc, mode);
    772 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
    773 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
    774 	else
    775 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
    776 done:
    777 	ath_softc_critsect_end(sc, s);
    778 	return error;
    779 }
    780 
    781 static void
    782 ath_stop(struct ifnet *ifp)
    783 {
    784 	struct ieee80211com *ic = (struct ieee80211com *) ifp;
    785 	struct ath_softc *sc = ifp->if_softc;
    786 	struct ath_hal *ah = sc->sc_ah;
    787 	ath_softc_critsect_decl(s);
    788 
    789 	DPRINTF(("ath_stop: invalid %u if_flags 0x%x\n",
    790 		sc->sc_invalid, ifp->if_flags));
    791 
    792 	ath_softc_critsect_begin(sc, s);
    793 	if (ifp->if_flags & IFF_RUNNING) {
    794 		/*
    795 		 * Shutdown the hardware and driver:
    796 		 *    disable interrupts
    797 		 *    turn off timers
    798 		 *    clear transmit machinery
    799 		 *    clear receive machinery
    800 		 *    drain and release tx queues
    801 		 *    reclaim beacon resources
    802 		 *    reset 802.11 state machine
    803 		 *    power down hardware
    804 		 *
    805 		 * Note that some of this work is not possible if the
    806 		 * hardware is gone (invalid).
    807 		 */
    808 		ifp->if_flags &= ~IFF_RUNNING;
    809 		ifp->if_timer = 0;
    810 		if (!sc->sc_invalid)
    811 			ath_hal_intrset(ah, 0);
    812 		ath_draintxq(sc);
    813 		if (!sc->sc_invalid)
    814 			ath_stoprecv(sc);
    815 		else
    816 			sc->sc_rxlink = NULL;
    817 #ifdef __FreeBSD__
    818 		IF_DRAIN(&ifp->if_snd);
    819 #else
    820 		IF_PURGE(&ifp->if_snd);
    821 #endif
    822 		ath_beacon_free(sc);
    823 		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
    824 		if (!sc->sc_invalid) {
    825 			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
    826 		}
    827 #ifdef __NetBSD__
    828 		ath_disable(sc);
    829 #endif
    830 	}
    831 	ath_softc_critsect_end(sc, s);
    832 }
    833 
    834 /*
    835  * Reset the hardware w/o losing operational state.  This is
    836  * basically a more efficient way of doing ath_stop, ath_init,
    837  * followed by state transitions to the current 802.11
    838  * operational state.  Used to recover from errors rx overrun
    839  * and to reset the hardware when rf gain settings must be reset.
    840  */
    841 static void
    842 ath_reset(struct ath_softc *sc)
    843 {
    844 	struct ieee80211com *ic = &sc->sc_ic;
    845 	struct ifnet *ifp = &ic->ic_if;
    846 	struct ath_hal *ah = sc->sc_ah;
    847 	struct ieee80211_channel *c;
    848 	HAL_STATUS status;
    849 	HAL_CHANNEL hchan;
    850 
    851 	/*
    852 	 * Convert to a HAL channel description with the flags
    853 	 * constrained to reflect the current operating mode.
    854 	 */
    855 	c = ic->ic_ibss_chan;
    856 	hchan.channel = c->ic_freq;
    857 	hchan.channelFlags = ath_chan2flags(ic, c);
    858 
    859 	ath_hal_intrset(ah, 0);		/* disable interrupts */
    860 	ath_draintxq(sc);		/* stop xmit side */
    861 	ath_stoprecv(sc);		/* stop recv side */
    862 	/* NB: indicate channel change so we do a full reset */
    863 	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
    864 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
    865 			__func__, status);
    866 	ath_hal_intrset(ah, sc->sc_imask);
    867 	if (ath_startrecv(sc) != 0)	/* restart recv */
    868 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
    869 	ath_start(ifp);			/* restart xmit */
    870 	if (ic->ic_state == IEEE80211_S_RUN)
    871 		ath_beacon_config(sc);	/* restart beacons */
    872 }
    873 
    874 static void
    875 ath_start(struct ifnet *ifp)
    876 {
    877 	struct ath_softc *sc = ifp->if_softc;
    878 	struct ath_hal *ah = sc->sc_ah;
    879 	struct ieee80211com *ic = &sc->sc_ic;
    880 	struct ieee80211_node *ni;
    881 	struct ath_buf *bf;
    882 	struct mbuf *m;
    883 	struct ieee80211_frame *wh;
    884 	ath_txbuf_critsect_decl(s);
    885 
    886 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
    887 		return;
    888 	for (;;) {
    889 		/*
    890 		 * Grab a TX buffer and associated resources.
    891 		 */
    892 		ath_txbuf_critsect_begin(sc, s);
    893 		bf = TAILQ_FIRST(&sc->sc_txbuf);
    894 		if (bf != NULL)
    895 			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
    896 		ath_txbuf_critsect_end(sc, s);
    897 		if (bf == NULL) {
    898 			DPRINTF(("ath_start: out of xmit buffers\n"));
    899 			sc->sc_stats.ast_tx_qstop++;
    900 			ifp->if_flags |= IFF_OACTIVE;
    901 			break;
    902 		}
    903 		/*
    904 		 * Poll the management queue for frames; they
    905 		 * have priority over normal data frames.
    906 		 */
    907 		IF_DEQUEUE(&ic->ic_mgtq, m);
    908 		if (m == NULL) {
    909 			/*
    910 			 * No data frames go out unless we're associated.
    911 			 */
    912 			if (ic->ic_state != IEEE80211_S_RUN) {
    913 				DPRINTF(("ath_start: ignore data packet, "
    914 					"state %u\n", ic->ic_state));
    915 				sc->sc_stats.ast_tx_discard++;
    916 				ath_txbuf_critsect_begin(sc, s);
    917 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
    918 				ath_txbuf_critsect_end(sc, s);
    919 				break;
    920 			}
    921 			IF_DEQUEUE(&ifp->if_snd, m);
    922 			if (m == NULL) {
    923 				ath_txbuf_critsect_begin(sc, s);
    924 				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
    925 				ath_txbuf_critsect_end(sc, s);
    926 				break;
    927 			}
    928 			ifp->if_opackets++;
    929 
    930 #ifdef __NetBSD__
    931 #if NBPFILTER > 0
    932 			if (ifp->if_bpf)
    933 				bpf_mtap(ifp->if_bpf, m);
    934 #endif
    935 #endif
    936 #ifdef __FreeBSD__
    937 			BPF_MTAP(ifp, m);
    938 #endif
    939 			/*
    940 			 * Encapsulate the packet in prep for transmission.
    941 			 */
    942 			m = ieee80211_encap(ifp, m, &ni);
    943 			if (m == NULL) {
    944 				DPRINTF(("ath_start: encapsulation failure\n"));
    945 				sc->sc_stats.ast_tx_encap++;
    946 				goto bad;
    947 			}
    948 			wh = mtod(m, struct ieee80211_frame *);
    949 			if (ic->ic_flags & IEEE80211_F_WEPON)
    950 				wh->i_fc[1] |= IEEE80211_FC1_WEP;
    951 		} else {
    952 			/*
    953 			 * Hack!  The referenced node pointer is in the
    954 			 * rcvif field of the packet header.  This is
    955 			 * placed there by ieee80211_mgmt_output because
    956 			 * we need to hold the reference with the frame
    957 			 * and there's no other way (other than packet
    958 			 * tags which we consider too expensive to use)
    959 			 * to pass it along.
    960 			 */
    961 			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
    962 			m->m_pkthdr.rcvif = NULL;
    963 
    964 			wh = mtod(m, struct ieee80211_frame *);
    965 			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
    966 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
    967 				/* fill time stamp */
    968 				u_int64_t tsf;
    969 				u_int32_t *tstamp;
    970 
    971 				tsf = ath_hal_gettsf64(ah);
    972 				/* XXX: adjust 100us delay to xmit */
    973 				tsf += 100;
    974 				tstamp = (u_int32_t *)&wh[1];
    975 				tstamp[0] = htole32(tsf & 0xffffffff);
    976 				tstamp[1] = htole32(tsf >> 32);
    977 			}
    978 			sc->sc_stats.ast_tx_mgmt++;
    979 		}
    980 #if NBPFILTER > 0
    981 		if (ic->ic_rawbpf)
    982 			bpf_mtap(ic->ic_rawbpf, m);
    983 #endif
    984 
    985 #if NBPFILTER > 0
    986 		if (sc->sc_drvbpf) {
    987 #ifdef __FreeBSD__
    988 			struct mbuf *mb;
    989 
    990 			MGETHDR(mb, M_DONTWAIT, m->m_type);
    991 			if (mb != NULL) {
    992 				sc->sc_tx_th.wt_rate =
    993 					ni->ni_rates.rs_rates[ni->ni_txrate];
    994 
    995 				mb->m_next = m;
    996 				mb->m_data = (caddr_t)&sc->sc_tx_th;
    997 				mb->m_len = sizeof(sc->sc_tx_th);
    998 				mb->m_pkthdr.len += mb->m_len;
    999 				bpf_mtap(sc->sc_drvbpf, mb);
   1000 				m_free(mb);
   1001 			}
   1002 #else
   1003 			struct mbuf mb;
   1004 
   1005 			M_COPY_PKTHDR(&mb, m);
   1006 			sc->sc_tx_th.wt_rate =
   1007 				ni->ni_rates.rs_rates[ni->ni_txrate];
   1008 
   1009 			mb.m_next = m;
   1010 			mb.m_data = (caddr_t)&sc->sc_tx_th;
   1011 			mb.m_len = sizeof(sc->sc_tx_th);
   1012 			mb.m_pkthdr.len += mb.m_len;
   1013 			bpf_mtap(sc->sc_drvbpf, &mb);
   1014 #endif
   1015 		}
   1016 #endif
   1017 
   1018 		/*
   1019 		 * TODO:
   1020 		 * The duration field of 802.11 header should be filled.
   1021 		 * XXX This may be done in the ieee80211 layer, but the upper
   1022 		 *     doesn't know the detail of parameters such as IFS
   1023 		 *     for now..
   1024 		 */
   1025 		if (ath_tx_start(sc, ni, bf, m)) {
   1026 	bad:
   1027 			ath_txbuf_critsect_begin(sc, s);
   1028 			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1029 			ath_txbuf_critsect_end(sc, s);
   1030 			ifp->if_oerrors++;
   1031 			if (ni && ni != ic->ic_bss)
   1032 				ieee80211_free_node(ic, ni);
   1033 			continue;
   1034 		}
   1035 
   1036 		sc->sc_tx_timer = 5;
   1037 		ifp->if_timer = 1;
   1038 	}
   1039 }
   1040 
   1041 static int
   1042 ath_media_change(struct ifnet *ifp)
   1043 {
   1044 	int error;
   1045 
   1046 	error = ieee80211_media_change(ifp);
   1047 	if (error == ENETRESET) {
   1048 		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
   1049 		    (IFF_RUNNING|IFF_UP))
   1050 			ath_init(ifp);		/* XXX lose error */
   1051 		error = 0;
   1052 	}
   1053 	return error;
   1054 }
   1055 
   1056 static void
   1057 ath_watchdog(struct ifnet *ifp)
   1058 {
   1059 	struct ath_softc *sc = ifp->if_softc;
   1060 	struct ieee80211com *ic = &sc->sc_ic;
   1061 
   1062 	ifp->if_timer = 0;
   1063 	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
   1064 		return;
   1065 	if (sc->sc_tx_timer) {
   1066 		if (--sc->sc_tx_timer == 0) {
   1067 			if_printf(ifp, "device timeout\n");
   1068 #ifdef AR_DEBUG
   1069 			if (ath_debug)
   1070 				ath_hal_dumpstate(sc->sc_ah);
   1071 #endif /* AR_DEBUG */
   1072 			ath_init(ifp);		/* XXX ath_reset??? */
   1073 			ifp->if_oerrors++;
   1074 			sc->sc_stats.ast_watchdog++;
   1075 			return;
   1076 		}
   1077 		ifp->if_timer = 1;
   1078 	}
   1079 	if (ic->ic_fixed_rate == -1) {
   1080 		/*
   1081 		 * Run the rate control algorithm if we're not
   1082 		 * locked at a fixed rate.
   1083 		 */
   1084 		if (ic->ic_opmode == IEEE80211_M_STA)
   1085 			ath_rate_ctl(sc, ic->ic_bss);
   1086 		else
   1087 			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
   1088 	}
   1089 	ieee80211_watchdog(ifp);
   1090 }
   1091 
   1092 static int
   1093 ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
   1094 {
   1095 	struct ath_softc *sc = ifp->if_softc;
   1096 	struct ifreq *ifr = (struct ifreq *)data;
   1097 	int error = 0;
   1098 	ath_softc_critsect_decl(s);
   1099 
   1100 	ath_softc_critsect_begin(sc, s);
   1101 	switch (cmd) {
   1102 	case SIOCSIFFLAGS:
   1103 		if (ifp->if_flags & IFF_UP) {
   1104 			if (ifp->if_flags & IFF_RUNNING) {
   1105 				/*
   1106 				 * To avoid rescanning another access point,
   1107 				 * do not call ath_init() here.  Instead,
   1108 				 * only reflect promisc mode settings.
   1109 				 */
   1110 				ath_mode_init(sc);
   1111 			} else
   1112 				ath_init(ifp);		/* XXX lose error */
   1113 		} else
   1114 			ath_stop(ifp);
   1115 		break;
   1116 	case SIOCADDMULTI:
   1117 	case SIOCDELMULTI:
   1118 #ifdef __FreeBSD__
   1119 		/*
   1120 		 * The upper layer has already installed/removed
   1121 		 * the multicast address(es), just recalculate the
   1122 		 * multicast filter for the card.
   1123 		 */
   1124 		if (ifp->if_flags & IFF_RUNNING)
   1125 			ath_mode_init(sc);
   1126 #endif
   1127 #ifdef __NetBSD__
   1128 		error = (cmd == SIOCADDMULTI) ?
   1129 		    ether_addmulti(ifr, &sc->sc_ic.ic_ec) :
   1130 		    ether_delmulti(ifr, &sc->sc_ic.ic_ec);
   1131 		if (error == ENETRESET) {
   1132 			if (ifp->if_flags & IFF_RUNNING)
   1133 				ath_mode_init(sc);
   1134 			error = 0;
   1135 		}
   1136 #endif
   1137 		break;
   1138 	case SIOCGATHSTATS:
   1139 		copyout(&sc->sc_stats, ifr->ifr_data, sizeof (sc->sc_stats));
   1140 		break;
   1141 	default:
   1142 		error = ieee80211_ioctl(ifp, cmd, data);
   1143 		if (error == ENETRESET) {
   1144 			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
   1145 			    (IFF_RUNNING|IFF_UP))
   1146 				ath_init(ifp);		/* XXX lose error */
   1147 			error = 0;
   1148 		}
   1149 		break;
   1150 	}
   1151 	ath_softc_critsect_end(sc, s);
   1152 	return error;
   1153 }
   1154 
   1155 /*
   1156  * Fill the hardware key cache with key entries.
   1157  */
   1158 static void
   1159 ath_initkeytable(struct ath_softc *sc)
   1160 {
   1161 	struct ieee80211com *ic = &sc->sc_ic;
   1162 	struct ath_hal *ah = sc->sc_ah;
   1163 	int i;
   1164 
   1165 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
   1166 		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
   1167 		if (k->wk_len == 0)
   1168 			ath_hal_keyreset(ah, i);
   1169 		else
   1170 			/* XXX return value */
   1171 			/* NB: this uses HAL_KEYVAL == ieee80211_wepkey */
   1172 			ath_hal_keyset(ah, i, (const HAL_KEYVAL *) k);
   1173 	}
   1174 }
   1175 
   1176 static void
   1177 ath_mcastfilter_accum(caddr_t dl, u_int32_t (*mfilt)[2])
   1178 {
   1179 	u_int32_t val;
   1180 	u_int8_t pos;
   1181 
   1182 	val = LE_READ_4(dl + 0);
   1183 	pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
   1184 	val = LE_READ_4(dl + 3);
   1185 	pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
   1186 	pos &= 0x3f;
   1187 	(*mfilt)[pos / 32] |= (1 << (pos % 32));
   1188 }
   1189 
   1190 #ifdef __FreeBSD__
   1191 static void
   1192 ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
   1193 {
   1194 	struct ieee80211com *ic = &sc->sc_ic;
   1195 	struct ifnet *ifp = &ic->ic_if;
   1196 	struct ifmultiaddr *ifma;
   1197 
   1198 	TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
   1199 		caddr_t dl;
   1200 
   1201 		/* calculate XOR of eight 6bit values */
   1202 		dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
   1203 		ath_mcastfilter_accum(dl, &mfilt);
   1204 	}
   1205 }
   1206 #else
   1207 static void
   1208 ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
   1209 {
   1210 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   1211 	struct ether_multi *enm;
   1212 	struct ether_multistep estep;
   1213 
   1214 	ETHER_FIRST_MULTI(estep, &sc->sc_ic.ic_ec, enm);
   1215 	while (enm != NULL) {
   1216 		/* XXX Punt on ranges. */
   1217 		if (!IEEE80211_ADDR_EQ(enm->enm_addrlo, enm->enm_addrhi)) {
   1218 			(*mfilt)[0] = (*mfilt)[1] = ~((u_int32_t)0);
   1219 			ifp->if_flags |= IFF_ALLMULTI;
   1220 			return;
   1221 		}
   1222 		ath_mcastfilter_accum(enm->enm_addrlo, mfilt);
   1223 		ETHER_NEXT_MULTI(estep, enm);
   1224 	}
   1225 	ifp->if_flags &= ~IFF_ALLMULTI;
   1226 }
   1227 #endif
   1228 
   1229 static void
   1230 ath_mode_init(struct ath_softc *sc)
   1231 {
   1232 	struct ieee80211com *ic = &sc->sc_ic;
   1233 	struct ath_hal *ah = sc->sc_ah;
   1234 	struct ifnet *ifp = &ic->ic_if;
   1235 	u_int32_t rfilt, mfilt[2];
   1236 
   1237 	/* configure operational mode */
   1238 	ath_hal_setopmode(ah, ic->ic_opmode);
   1239 
   1240 	/* receive filter */
   1241 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
   1242 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
   1243 	if (ic->ic_opmode != IEEE80211_M_STA)
   1244 		rfilt |= HAL_RX_FILTER_PROBEREQ;
   1245 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
   1246 	    (ifp->if_flags & IFF_PROMISC))
   1247 		rfilt |= HAL_RX_FILTER_PROM;
   1248 	if (ic->ic_state == IEEE80211_S_SCAN)
   1249 		rfilt |= HAL_RX_FILTER_BEACON;
   1250 	ath_hal_setrxfilter(ah, rfilt);
   1251 
   1252 	/* calculate and install multicast filter */
   1253 #ifdef __FreeBSD__
   1254 	if ((ifp->if_flags & IFF_ALLMULTI) == 0) {
   1255 		mfilt[0] = mfilt[1] = 0;
   1256 		ath_mcastfilter_compute(sc, &mfilt);
   1257 	} else {
   1258 		mfilt[0] = mfilt[1] = ~0;
   1259 	}
   1260 #endif
   1261 #ifdef __NetBSD__
   1262 	mfilt[0] = mfilt[1] = 0;
   1263 	ath_mcastfilter_compute(sc, &mfilt);
   1264 #endif
   1265 	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
   1266 	DPRINTF(("ath_mode_init: RX filter 0x%x, MC filter %08x:%08x\n",
   1267 		rfilt, mfilt[0], mfilt[1]));
   1268 }
   1269 
   1270 #ifdef __FreeBSD__
   1271 static void
   1272 ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
   1273 {
   1274 	struct ath_buf *bf = arg;
   1275 
   1276 	KASSERT(nseg <= ATH_MAX_SCATTER,
   1277 		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
   1278 	bf->bf_mapsize = mapsize;
   1279 	bf->bf_nseg = nseg;
   1280 	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
   1281 }
   1282 #endif /* __FreeBSD__ */
   1283 
   1284 static struct mbuf *
   1285 ath_getmbuf(int flags, int type, u_int pktlen)
   1286 {
   1287 	struct mbuf *m;
   1288 
   1289 	KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
   1290 #ifdef __FreeBSD__
   1291 	if (pktlen <= MHLEN)
   1292 		MGETHDR(m, flags, type);
   1293 	else
   1294 		m = m_getcl(flags, type, M_PKTHDR);
   1295 #else
   1296 	MGETHDR(m, flags, type);
   1297 	if (m != NULL && pktlen > MHLEN)
   1298 		MCLGET(m, flags);
   1299 #endif
   1300 	return m;
   1301 }
   1302 
   1303 static int
   1304 ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
   1305 {
   1306 	struct ieee80211com *ic = &sc->sc_ic;
   1307 	struct ifnet *ifp = &ic->ic_if;
   1308 	struct ath_hal *ah = sc->sc_ah;
   1309 	struct ieee80211_frame *wh;
   1310 	struct ath_buf *bf;
   1311 	struct ath_desc *ds;
   1312 	struct mbuf *m;
   1313 	int error, pktlen;
   1314 	u_int8_t *frm, rate;
   1315 	u_int16_t capinfo;
   1316 	struct ieee80211_rateset *rs;
   1317 	const HAL_RATE_TABLE *rt;
   1318 
   1319 	bf = sc->sc_bcbuf;
   1320 	if (bf->bf_m != NULL) {
   1321 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   1322 		m_freem(bf->bf_m);
   1323 		bf->bf_m = NULL;
   1324 		bf->bf_node = NULL;
   1325 	}
   1326 	/*
   1327 	 * NB: the beacon data buffer must be 32-bit aligned;
   1328 	 * we assume the mbuf routines will return us something
   1329 	 * with this alignment (perhaps should assert).
   1330 	 */
   1331 	rs = &ni->ni_rates;
   1332 	pktlen = sizeof (struct ieee80211_frame)
   1333 	       + 8 + 2 + 2 + 2+ni->ni_esslen + 2+rs->rs_nrates + 6;
   1334 	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
   1335 		pktlen += 2;
   1336 	m = ath_getmbuf(M_DONTWAIT, MT_DATA, pktlen);
   1337 	if (m == NULL) {
   1338 		DPRINTF(("ath_beacon_alloc: cannot get mbuf/cluster; size %u\n",
   1339 			pktlen));
   1340 		sc->sc_stats.ast_be_nombuf++;
   1341 		return ENOMEM;
   1342 	}
   1343 
   1344 	wh = mtod(m, struct ieee80211_frame *);
   1345 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
   1346 	    IEEE80211_FC0_SUBTYPE_BEACON;
   1347 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
   1348 	*(u_int16_t *)wh->i_dur = 0;
   1349 	memcpy(wh->i_addr1, ifp->if_broadcastaddr, IEEE80211_ADDR_LEN);
   1350 	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
   1351 	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
   1352 	*(u_int16_t *)wh->i_seq = 0;
   1353 
   1354 	/*
   1355 	 * beacon frame format
   1356 	 *	[8] time stamp
   1357 	 *	[2] beacon interval
   1358 	 *	[2] cabability information
   1359 	 *	[tlv] ssid
   1360 	 *	[tlv] supported rates
   1361 	 *	[tlv] parameter set (IBSS)
   1362 	 *	[tlv] extended supported rates
   1363 	 */
   1364 	frm = (u_int8_t *)&wh[1];
   1365 	memset(frm, 0, 8);	/* timestamp is set by hardware */
   1366 	frm += 8;
   1367 	*(u_int16_t *)frm = htole16(ni->ni_intval);
   1368 	frm += 2;
   1369 	if (ic->ic_opmode == IEEE80211_M_IBSS)
   1370 		capinfo = IEEE80211_CAPINFO_IBSS;
   1371 	else
   1372 		capinfo = IEEE80211_CAPINFO_ESS;
   1373 	if (ic->ic_flags & IEEE80211_F_WEPON)
   1374 		capinfo |= IEEE80211_CAPINFO_PRIVACY;
   1375 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
   1376 		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
   1377 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
   1378 		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
   1379 	*(u_int16_t *)frm = htole16(capinfo);
   1380 	frm += 2;
   1381 	*frm++ = IEEE80211_ELEMID_SSID;
   1382 	*frm++ = ni->ni_esslen;
   1383 	memcpy(frm, ni->ni_essid, ni->ni_esslen);
   1384 	frm += ni->ni_esslen;
   1385 	frm = ieee80211_add_rates(frm, rs);
   1386 	if (ic->ic_opmode == IEEE80211_M_IBSS) {
   1387 		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
   1388 		*frm++ = 2;
   1389 		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
   1390 	} else {
   1391 		/* TODO: TIM */
   1392 		*frm++ = IEEE80211_ELEMID_TIM;
   1393 		*frm++ = 4;	/* length */
   1394 		*frm++ = 0;	/* DTIM count */
   1395 		*frm++ = 1;	/* DTIM period */
   1396 		*frm++ = 0;	/* bitmap control */
   1397 		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
   1398 	}
   1399 	frm = ieee80211_add_xrates(frm, rs);
   1400 	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
   1401 	KASSERT(m->m_pkthdr.len <= pktlen,
   1402 		("beacon bigger than expected, len %u calculated %u",
   1403 		m->m_pkthdr.len, pktlen));
   1404 
   1405 	DPRINTF2(("ath_beacon_alloc: m %p len %u\n", m, m->m_len));
   1406 	error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m, BUS_DMA_NOWAIT);
   1407 	if (error != 0) {
   1408 		m_freem(m);
   1409 		return error;
   1410 	}
   1411 	KASSERT(bf->bf_nseg == 1,
   1412 		("ath_beacon_alloc: multi-segment packet; nseg %u",
   1413 		bf->bf_nseg));
   1414 	bf->bf_m = m;
   1415 
   1416 	/* setup descriptors */
   1417 	ds = bf->bf_desc;
   1418 
   1419 	ds->ds_link = 0;
   1420 	ds->ds_data = bf->bf_segs[0].ds_addr;
   1421 
   1422 	DPRINTF2(("%s: segaddr %p seglen %u\n", __func__,
   1423 	    (caddr_t)bf->bf_segs[0].ds_addr, (u_int)bf->bf_segs[0].ds_len));
   1424 
   1425 	/*
   1426 	 * Calculate rate code.
   1427 	 * XXX everything at min xmit rate
   1428 	 */
   1429 	rt = sc->sc_currates;
   1430 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
   1431 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
   1432 		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
   1433 	else
   1434 		rate = rt->info[0].rateCode;
   1435 	if (!ath_hal_setuptxdesc(ah, ds
   1436 		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
   1437 		, sizeof(struct ieee80211_frame)	/* header length */
   1438 		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
   1439 		, 0x20				/* txpower XXX */
   1440 		, rate, 1			/* series 0 rate/tries */
   1441 		, HAL_TXKEYIX_INVALID		/* no encryption */
   1442 		, 0				/* antenna mode */
   1443 		, HAL_TXDESC_NOACK		/* no ack for beacons */
   1444 		, 0				/* rts/cts rate */
   1445 		, 0				/* rts/cts duration */
   1446 	)) {
   1447 		printf("%s: ath_hal_setuptxdesc failed\n", __func__);
   1448 		return -1;
   1449 	}
   1450 	/* NB: beacon's BufLen must be a multiple of 4 bytes */
   1451 	/* XXX verify mbuf data area covers this roundup */
   1452 	if (!ath_hal_filltxdesc(ah, ds
   1453 		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
   1454 		, AH_TRUE				/* first segment */
   1455 		, AH_TRUE				/* last segment */
   1456 	)) {
   1457 		printf("%s: ath_hal_filltxdesc failed\n", __func__);
   1458 		return -1;
   1459 	}
   1460 
   1461 	/* XXX it is not appropriate to bus_dmamap_sync? -dcy */
   1462 
   1463 	return 0;
   1464 }
   1465 
   1466 static void
   1467 ath_beacon_proc(void *arg, int pending)
   1468 {
   1469 	struct ath_softc *sc = arg;
   1470 	struct ieee80211com *ic = &sc->sc_ic;
   1471 	struct ath_buf *bf = sc->sc_bcbuf;
   1472 	struct ath_hal *ah = sc->sc_ah;
   1473 
   1474 	DPRINTF2(("%s: pending %u\n", __func__, pending));
   1475 	if (ic->ic_opmode == IEEE80211_M_STA ||
   1476 	    bf == NULL || bf->bf_m == NULL) {
   1477 		DPRINTF(("%s: ic_flags=%x bf=%p bf_m=%p\n",
   1478 			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
   1479 		return;
   1480 	}
   1481 	/* TODO: update beacon to reflect PS poll state */
   1482 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
   1483 		DPRINTF(("%s: beacon queue %u did not stop?",
   1484 			__func__, sc->sc_bhalq));
   1485 		return;			/* busy, XXX is this right? */
   1486 	}
   1487 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREWRITE);
   1488 
   1489 	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
   1490 	ath_hal_txstart(ah, sc->sc_bhalq);
   1491 	DPRINTF2(("%s: BCDP%u = %p (%p)\n", __func__,
   1492 		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
   1493 }
   1494 
   1495 static void
   1496 ath_beacon_free(struct ath_softc *sc)
   1497 {
   1498 	struct ath_buf *bf = sc->sc_bcbuf;
   1499 
   1500 	if (bf->bf_m != NULL) {
   1501 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   1502 		m_freem(bf->bf_m);
   1503 		bf->bf_m = NULL;
   1504 		bf->bf_node = NULL;
   1505 	}
   1506 }
   1507 
   1508 /*
   1509  * Configure the beacon and sleep timers.
   1510  *
   1511  * When operating as an AP this resets the TSF and sets
   1512  * up the hardware to notify us when we need to issue beacons.
   1513  *
   1514  * When operating in station mode this sets up the beacon
   1515  * timers according to the timestamp of the last received
   1516  * beacon and the current TSF, configures PCF and DTIM
   1517  * handling, programs the sleep registers so the hardware
   1518  * will wakeup in time to receive beacons, and configures
   1519  * the beacon miss handling so we'll receive a BMISS
   1520  * interrupt when we stop seeing beacons from the AP
   1521  * we've associated with.
   1522  */
   1523 static void
   1524 ath_beacon_config(struct ath_softc *sc)
   1525 {
   1526 	struct ath_hal *ah = sc->sc_ah;
   1527 	struct ieee80211com *ic = &sc->sc_ic;
   1528 	struct ieee80211_node *ni = ic->ic_bss;
   1529 	u_int32_t nexttbtt;
   1530 
   1531 	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
   1532 	    (LE_READ_4(ni->ni_tstamp) >> 10);
   1533 	DPRINTF(("%s: nexttbtt=%u\n", __func__, nexttbtt));
   1534 	nexttbtt += ni->ni_intval;
   1535 	if (ic->ic_opmode == IEEE80211_M_STA) {
   1536 		HAL_BEACON_STATE bs;
   1537 		u_int32_t bmisstime;
   1538 
   1539 		/* NB: no PCF support right now */
   1540 		memset(&bs, 0, sizeof(bs));
   1541 		bs.bs_intval = ni->ni_intval;
   1542 		bs.bs_nexttbtt = nexttbtt;
   1543 		bs.bs_dtimperiod = bs.bs_intval;
   1544 		bs.bs_nextdtim = nexttbtt;
   1545 		/*
   1546 		 * Calculate the number of consecutive beacons to miss
   1547 		 * before taking a BMISS interrupt.  The configuration
   1548 		 * is specified in ms, so we need to convert that to
   1549 		 * TU's and then calculate based on the beacon interval.
   1550 		 * Note that we clamp the result to at most 10 beacons.
   1551 		 */
   1552 		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
   1553 		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
   1554 		if (bs.bs_bmissthreshold > 10)
   1555 			bs.bs_bmissthreshold = 10;
   1556 		else if (bs.bs_bmissthreshold <= 0)
   1557 			bs.bs_bmissthreshold = 1;
   1558 
   1559 		/*
   1560 		 * Calculate sleep duration.  The configuration is
   1561 		 * given in ms.  We insure a multiple of the beacon
   1562 		 * period is used.  Also, if the sleep duration is
   1563 		 * greater than the DTIM period then it makes senses
   1564 		 * to make it a multiple of that.
   1565 		 *
   1566 		 * XXX fixed at 100ms
   1567 		 */
   1568 		bs.bs_sleepduration =
   1569 			roundup((100 * 1000) / 1024, bs.bs_intval);
   1570 		if (bs.bs_sleepduration > bs.bs_dtimperiod)
   1571 			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
   1572 
   1573 		DPRINTF(("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
   1574 			, __func__
   1575 			, bs.bs_intval
   1576 			, bs.bs_nexttbtt
   1577 			, bs.bs_dtimperiod
   1578 			, bs.bs_nextdtim
   1579 			, bs.bs_bmissthreshold
   1580 			, bs.bs_sleepduration
   1581 		));
   1582 		ath_hal_intrset(ah, 0);
   1583 		/*
   1584 		 * Reset our tsf so the hardware will update the
   1585 		 * tsf register to reflect timestamps found in
   1586 		 * received beacons.
   1587 		 */
   1588 		ath_hal_resettsf(ah);
   1589 		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
   1590 		sc->sc_imask |= HAL_INT_BMISS;
   1591 		ath_hal_intrset(ah, sc->sc_imask);
   1592 	} else {
   1593 		DPRINTF(("%s: intval %u nexttbtt %u\n",
   1594 			__func__, ni->ni_intval, nexttbtt));
   1595 		ath_hal_intrset(ah, 0);
   1596 		ath_hal_beaconinit(ah, ic->ic_opmode,
   1597 			nexttbtt, ni->ni_intval);
   1598 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
   1599 			sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
   1600 		ath_hal_intrset(ah, sc->sc_imask);
   1601 	}
   1602 }
   1603 
   1604 #ifdef __FreeBSD__
   1605 static void
   1606 ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
   1607 {
   1608 	bus_addr_t *paddr = (bus_addr_t*) arg;
   1609 	*paddr = segs->ds_addr;
   1610 }
   1611 #endif
   1612 
   1613 #ifdef __FreeBSD__
   1614 static int
   1615 ath_desc_alloc(struct ath_softc *sc)
   1616 {
   1617 	int i, bsize, error;
   1618 	struct ath_desc *ds;
   1619 	struct ath_buf *bf;
   1620 
   1621 	/* allocate descriptors */
   1622 	sc->sc_desc_len = sizeof(struct ath_desc) *
   1623 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
   1624 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
   1625 	if (error != 0)
   1626 		return error;
   1627 
   1628 	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
   1629 				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
   1630 
   1631 	if (error != 0)
   1632 		goto fail0;
   1633 
   1634 	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
   1635 				sc->sc_desc, sc->sc_desc_len,
   1636 				ath_load_cb, &sc->sc_desc_paddr,
   1637 				BUS_DMA_NOWAIT);
   1638 	if (error != 0)
   1639 		goto fail1;
   1640 
   1641 	ds = sc->sc_desc;
   1642 	DPRINTF(("ath_desc_alloc: DMA map: %p (%d) -> %p (%lu)\n",
   1643 	    ds, sc->sc_desc_len,
   1644 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
   1645 
   1646 	/* allocate buffers */
   1647 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
   1648 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
   1649 	if (bf == NULL) {
   1650 		printf("%s: unable to allocate Tx/Rx buffers\n",
   1651 		    sc->sc_dev.dv_xname);
   1652 		error = -1;
   1653 		goto fail2;
   1654 	}
   1655 	sc->sc_bufptr = bf;
   1656 
   1657 	TAILQ_INIT(&sc->sc_rxbuf);
   1658 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
   1659 		bf->bf_desc = ds;
   1660 		bf->bf_daddr = sc->sc_desc_paddr +
   1661 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1662 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
   1663 					  &bf->bf_dmamap);
   1664 		if (error != 0)
   1665 			break;
   1666 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
   1667 	}
   1668 
   1669 	TAILQ_INIT(&sc->sc_txbuf);
   1670 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
   1671 		bf->bf_desc = ds;
   1672 		bf->bf_daddr = sc->sc_desc_paddr +
   1673 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1674 		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
   1675 					  &bf->bf_dmamap);
   1676 		if (error != 0)
   1677 			break;
   1678 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1679 	}
   1680 	TAILQ_INIT(&sc->sc_txq);
   1681 
   1682 	/* beacon buffer */
   1683 	bf->bf_desc = ds;
   1684 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1685 	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
   1686 	if (error != 0)
   1687 		return error;
   1688 	sc->sc_bcbuf = bf;
   1689 	return 0;
   1690 
   1691 fail2:
   1692 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
   1693 fail1:
   1694 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
   1695 fail0:
   1696 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
   1697 	sc->sc_ddmamap = NULL;
   1698 	return error;
   1699 }
   1700 #else
   1701 static int
   1702 ath_desc_alloc(struct ath_softc *sc)
   1703 {
   1704 	int i, bsize, error = -1;
   1705 	struct ath_desc *ds;
   1706 	struct ath_buf *bf;
   1707 
   1708 	/* allocate descriptors */
   1709 	sc->sc_desc_len = sizeof(struct ath_desc) *
   1710 				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
   1711 	if ((error = bus_dmamem_alloc(sc->sc_dmat, sc->sc_desc_len, PAGE_SIZE,
   1712 	    0, &sc->sc_dseg, 1, &sc->sc_dnseg, 0)) != 0) {
   1713 		printf("%s: unable to allocate control data, error = %d\n",
   1714 		    sc->sc_dev.dv_xname, error);
   1715 		goto fail0;
   1716 	}
   1717 
   1718 	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg,
   1719 	    sc->sc_desc_len, (caddr_t *)&sc->sc_desc, BUS_DMA_COHERENT)) != 0) {
   1720 		printf("%s: unable to map control data, error = %d\n",
   1721 		    sc->sc_dev.dv_xname, error);
   1722 		goto fail1;
   1723 	}
   1724 
   1725 	if ((error = bus_dmamap_create(sc->sc_dmat, sc->sc_desc_len, 1,
   1726 	    sc->sc_desc_len, 0, 0, &sc->sc_ddmamap)) != 0) {
   1727 		printf("%s: unable to create control data DMA map, "
   1728 		    "error = %d\n", sc->sc_dev.dv_xname, error);
   1729 		goto fail2;
   1730 	}
   1731 
   1732 	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap, sc->sc_desc,
   1733 	    sc->sc_desc_len, NULL, 0)) != 0) {
   1734 		printf("%s: unable to load control data DMA map, error = %d\n",
   1735 		    sc->sc_dev.dv_xname, error);
   1736 		goto fail3;
   1737 	}
   1738 
   1739 	ds = sc->sc_desc;
   1740 	sc->sc_desc_paddr = sc->sc_ddmamap->dm_segs[0].ds_addr;
   1741 
   1742 	DPRINTF(("ath_desc_alloc: DMA map: %p (%lu) -> %p (%lu)\n",
   1743 	    ds, (u_long)sc->sc_desc_len,
   1744 	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
   1745 
   1746 	/* allocate buffers */
   1747 	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
   1748 	bf = malloc(bsize, M_DEVBUF, M_NOWAIT | M_ZERO);
   1749 	if (bf == NULL) {
   1750 		printf("%s: unable to allocate Tx/Rx buffers\n",
   1751 		    sc->sc_dev.dv_xname);
   1752 		error = ENOMEM;
   1753 		goto fail3;
   1754 	}
   1755 	sc->sc_bufptr = bf;
   1756 
   1757 	TAILQ_INIT(&sc->sc_rxbuf);
   1758 	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
   1759 		bf->bf_desc = ds;
   1760 		bf->bf_daddr = sc->sc_desc_paddr +
   1761 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1762 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
   1763 		    MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
   1764 			printf("%s: unable to create Rx dmamap, error = %d\n",
   1765 			    sc->sc_dev.dv_xname, error);
   1766 			goto fail4;
   1767 		}
   1768 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
   1769 	}
   1770 
   1771 	TAILQ_INIT(&sc->sc_txbuf);
   1772 	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
   1773 		bf->bf_desc = ds;
   1774 		bf->bf_daddr = sc->sc_desc_paddr +
   1775 		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1776 		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
   1777 		    ATH_TXDESC, MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
   1778 			printf("%s: unable to create Tx dmamap, error = %d\n",
   1779 			    sc->sc_dev.dv_xname, error);
   1780 			goto fail5;
   1781 		}
   1782 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   1783 	}
   1784 	TAILQ_INIT(&sc->sc_txq);
   1785 
   1786 	/* beacon buffer */
   1787 	bf->bf_desc = ds;
   1788 	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
   1789 	if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
   1790 	    &bf->bf_dmamap)) != 0) {
   1791 		printf("%s: unable to create beacon dmamap, error = %d\n",
   1792 		    sc->sc_dev.dv_xname, error);
   1793 		goto fail5;
   1794 	}
   1795 	sc->sc_bcbuf = bf;
   1796 	return 0;
   1797 
   1798 fail5:
   1799 	for (i = ATH_RXBUF; i < ATH_RXBUF + ATH_TXBUF; i++) {
   1800 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
   1801 			continue;
   1802 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
   1803 	}
   1804 fail4:
   1805 	for (i = 0; i < ATH_RXBUF; i++) {
   1806 		if (sc->sc_bufptr[i].bf_dmamap == NULL)
   1807 			continue;
   1808 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
   1809 	}
   1810 fail3:
   1811 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
   1812 fail2:
   1813 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
   1814 	sc->sc_ddmamap = NULL;
   1815 fail1:
   1816 	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_desc, sc->sc_desc_len);
   1817 fail0:
   1818 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
   1819 	return error;
   1820 }
   1821 #endif
   1822 
   1823 static void
   1824 ath_desc_free(struct ath_softc *sc)
   1825 {
   1826 	struct ath_buf *bf;
   1827 
   1828 #ifdef __FreeBSD__
   1829 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
   1830 	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
   1831 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
   1832 #else
   1833 	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
   1834 	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
   1835 	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
   1836 #endif
   1837 
   1838 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
   1839 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   1840 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
   1841 		m_freem(bf->bf_m);
   1842 	}
   1843 	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
   1844 		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
   1845 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
   1846 		if (bf->bf_m) {
   1847 			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   1848 			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
   1849 			m_freem(bf->bf_m);
   1850 			bf->bf_m = NULL;
   1851 		}
   1852 	}
   1853 	if (sc->sc_bcbuf != NULL) {
   1854 		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
   1855 		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
   1856 		sc->sc_bcbuf = NULL;
   1857 	}
   1858 
   1859 	TAILQ_INIT(&sc->sc_rxbuf);
   1860 	TAILQ_INIT(&sc->sc_txbuf);
   1861 	TAILQ_INIT(&sc->sc_txq);
   1862 	free(sc->sc_bufptr, M_DEVBUF);
   1863 	sc->sc_bufptr = NULL;
   1864 }
   1865 
   1866 static struct ieee80211_node *
   1867 ath_node_alloc(struct ieee80211com *ic)
   1868 {
   1869 	struct ath_node *an =
   1870 		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT | M_ZERO);
   1871 	return an ? &an->an_node : NULL;
   1872 }
   1873 
   1874 static void
   1875 ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
   1876 {
   1877 	struct ath_softc *sc = ic->ic_if.if_softc;
   1878 	struct ath_buf *bf;
   1879 
   1880 	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
   1881 		if (bf->bf_node == ni)
   1882 			bf->bf_node = NULL;
   1883 	}
   1884 	free(ni, M_DEVBUF);
   1885 }
   1886 
   1887 static void
   1888 ath_node_copy(struct ieee80211com *ic,
   1889 	struct ieee80211_node *dst, const struct ieee80211_node *src)
   1890 {
   1891 	*(struct ath_node *)dst = *(const struct ath_node *)src;
   1892 }
   1893 
   1894 static int
   1895 ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
   1896 {
   1897 	struct ath_hal *ah = sc->sc_ah;
   1898 	int error;
   1899 	struct mbuf *m;
   1900 	struct ath_desc *ds;
   1901 
   1902 	m = bf->bf_m;
   1903 	if (m == NULL) {
   1904 		/*
   1905 		 * NB: by assigning a page to the rx dma buffer we
   1906 		 * implicitly satisfy the Atheros requirement that
   1907 		 * this buffer be cache-line-aligned and sized to be
   1908 		 * multiple of the cache line size.  Not doing this
   1909 		 * causes weird stuff to happen (for the 5210 at least).
   1910 		 */
   1911 		m = ath_getmbuf(M_DONTWAIT, MT_DATA, MCLBYTES);
   1912 		if (m == NULL) {
   1913 			DPRINTF(("ath_rxbuf_init: no mbuf/cluster\n"));
   1914 			sc->sc_stats.ast_rx_nombuf++;
   1915 			return ENOMEM;
   1916 		}
   1917 		bf->bf_m = m;
   1918 		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
   1919 
   1920 		error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m,
   1921 		                                 BUS_DMA_NOWAIT);
   1922 		if (error != 0) {
   1923 			DPRINTF(("ath_rxbuf_init: ath_buf_dmamap_load_mbuf failed;"
   1924 				" error %d\n", error));
   1925 			sc->sc_stats.ast_rx_busdma++;
   1926 			return error;
   1927 		}
   1928 		KASSERT(bf->bf_nseg == 1,
   1929 			("ath_rxbuf_init: multi-segment packet; nseg %u",
   1930 			bf->bf_nseg));
   1931 	}
   1932 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREREAD);
   1933 
   1934 	/* setup descriptors */
   1935 	ds = bf->bf_desc;
   1936 	ds->ds_link = 0;
   1937 	ds->ds_data = bf->bf_segs[0].ds_addr;
   1938 	ath_hal_setuprxdesc(ah, ds
   1939 		, m->m_len		/* buffer size */
   1940 		, 0
   1941 	);
   1942 
   1943 	if (sc->sc_rxlink != NULL)
   1944 		*sc->sc_rxlink = bf->bf_daddr;
   1945 	sc->sc_rxlink = &ds->ds_link;
   1946 	return 0;
   1947 }
   1948 
   1949 static void
   1950 ath_rx_proc(void *arg, int npending)
   1951 {
   1952 	struct ath_softc *sc = arg;
   1953 	struct ath_buf *bf;
   1954 	struct ieee80211com *ic = &sc->sc_ic;
   1955 	struct ifnet *ifp = &ic->ic_if;
   1956 	struct ath_hal *ah = sc->sc_ah;
   1957 	struct ath_desc *ds;
   1958 	struct mbuf *m;
   1959 	struct ieee80211_frame *wh, whbuf;
   1960 	struct ieee80211_node *ni;
   1961 	int len;
   1962 	u_int phyerr;
   1963 	HAL_STATUS status;
   1964 
   1965 	DPRINTF2(("ath_rx_proc: pending %u\n", npending));
   1966 	do {
   1967 		bf = TAILQ_FIRST(&sc->sc_rxbuf);
   1968 		if (bf == NULL) {		/* NB: shouldn't happen */
   1969 			if_printf(ifp, "ath_rx_proc: no buffer!\n");
   1970 			break;
   1971 		}
   1972 		m = bf->bf_m;
   1973 		if (m == NULL) {		/* NB: shouldn't happen */
   1974 			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
   1975 			continue;
   1976 		}
   1977 		ds = bf->bf_desc;
   1978 		status = ath_hal_rxprocdesc(ah, ds);
   1979 #ifdef AR_DEBUG
   1980 		if (ath_debug > 1)
   1981 			ath_printrxbuf(bf, status == HAL_OK);
   1982 #endif
   1983 		if (status == HAL_EINPROGRESS)
   1984 			break;
   1985 		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
   1986 		if (ds->ds_rxstat.rs_status != 0) {
   1987 			ifp->if_ierrors++;
   1988 			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
   1989 				sc->sc_stats.ast_rx_crcerr++;
   1990 			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
   1991 				sc->sc_stats.ast_rx_fifoerr++;
   1992 			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
   1993 				sc->sc_stats.ast_rx_badcrypt++;
   1994 			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
   1995 				sc->sc_stats.ast_rx_phyerr++;
   1996 				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
   1997 				sc->sc_stats.ast_rx_phy[phyerr]++;
   1998 			}
   1999 			goto rx_next;
   2000 		}
   2001 
   2002 		len = ds->ds_rxstat.rs_datalen;
   2003 		if (len < sizeof(struct ieee80211_frame)) {
   2004 			DPRINTF(("ath_rx_proc: short packet %d\n", len));
   2005 			sc->sc_stats.ast_rx_tooshort++;
   2006 			goto rx_next;
   2007 		}
   2008 
   2009 		ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_POSTREAD);
   2010 
   2011 		wh = mtod(m, struct ieee80211_frame *);
   2012 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
   2013 		    IEEE80211_FC0_TYPE_CTL &&
   2014 		    ic->ic_opmode != IEEE80211_M_MONITOR) {
   2015 			/*
   2016 			 * Discard control frame when not in monitor mode.
   2017 			 */
   2018 			DPRINTF(("ath_rx_proc: control frame\n"));
   2019 			sc->sc_stats.ast_rx_ctl++;
   2020 			goto rx_next;
   2021 		}
   2022 
   2023 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   2024 		bf->bf_m = NULL;
   2025 		m->m_pkthdr.rcvif = ifp;
   2026 		m->m_pkthdr.len = m->m_len = len;
   2027 
   2028 #if NBPFILTER > 0
   2029 		if (sc->sc_drvbpf) {
   2030 #ifdef __FreeBSD__
   2031 			struct mbuf *mb;
   2032 
   2033 			/* XXX pre-allocate space when setting up recv's */
   2034 			MGETHDR(mb, M_DONTWAIT, m->m_type);
   2035 			if (mb != NULL) {
   2036 				sc->sc_rx_th.wr_rate =
   2037 					sc->sc_hwmap[ds->ds_rxstat.rs_rate];
   2038 				sc->sc_rx_th.wr_antsignal =
   2039 					ds->ds_rxstat.rs_rssi;
   2040 				sc->sc_rx_th.wr_antenna =
   2041 					ds->ds_rxstat.rs_antenna;
   2042 				/* XXX TSF */
   2043 
   2044 				(void) m_dup_pkthdr(mb, m, M_DONTWAIT);
   2045 				mb->m_next = m;
   2046 				mb->m_data = (caddr_t)&sc->sc_rx_th;
   2047 				mb->m_len = sizeof(sc->sc_rx_th);
   2048 				mb->m_pkthdr.len += mb->m_len;
   2049 				bpf_mtap(sc->sc_drvbpf, mb);
   2050 				m_free(mb);
   2051 			}
   2052 #else
   2053 			/* XXX pre-allocate space when setting up recv's */
   2054 			struct mbuf mb;
   2055 
   2056 			sc->sc_rx_th.wr_rate =
   2057 				sc->sc_hwmap[ds->ds_rxstat.rs_rate];
   2058 			sc->sc_rx_th.wr_antsignal =
   2059 				ds->ds_rxstat.rs_rssi;
   2060 			sc->sc_rx_th.wr_antenna =
   2061 				ds->ds_rxstat.rs_antenna;
   2062 			/* XXX TSF */
   2063 
   2064 			M_COPY_PKTHDR(&mb, m);
   2065 			mb.m_next = m;
   2066 			mb.m_data = (caddr_t)&sc->sc_rx_th;
   2067 			mb.m_len = sizeof(sc->sc_rx_th);
   2068 			mb.m_pkthdr.len += mb.m_len;
   2069 			bpf_mtap(sc->sc_drvbpf, &mb);
   2070 #endif
   2071 		}
   2072 #endif
   2073 
   2074 		m_adj(m, -IEEE80211_CRC_LEN);
   2075 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
   2076 			/*
   2077 			 * WEP is decrypted by hardware. Clear WEP bit
   2078 			 * and trim WEP header for ieee80211_input().
   2079 			 */
   2080 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
   2081 			memcpy(&whbuf, wh, sizeof(whbuf));
   2082 			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
   2083 			memcpy(mtod(m, caddr_t), &whbuf, sizeof(whbuf));
   2084 			/*
   2085 			 * Also trim WEP ICV from the tail.
   2086 			 */
   2087 			m_adj(m, -IEEE80211_WEP_CRCLEN);
   2088 			/*
   2089 			 * The header has probably moved.
   2090 			 */
   2091 			wh = mtod(m, struct ieee80211_frame *);
   2092 		}
   2093 
   2094 		/*
   2095 		 * Locate the node for sender, track state, and
   2096 		 * then pass this node (referenced) up to the 802.11
   2097 		 * layer for its use.  We are required to pass
   2098 		 * something so we fall back to ic_bss when this frame
   2099 		 * is from an unknown sender.
   2100 		 */
   2101 		if (ic->ic_opmode != IEEE80211_M_STA) {
   2102 			ni = ieee80211_find_node(ic, wh->i_addr2);
   2103 			if (ni == NULL)
   2104 				ni = ieee80211_ref_node(ic->ic_bss);
   2105 		} else
   2106 			ni = ieee80211_ref_node(ic->ic_bss);
   2107 		ATH_NODE(ni)->an_rx_antenna = ds->ds_rxstat.rs_antenna;
   2108 		/*
   2109 		 * Send frame up for processing.
   2110 		 */
   2111 		ieee80211_input(ifp, m, ni,
   2112 			ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
   2113 		/*
   2114 		 * The frame may have caused the node to be marked for
   2115 		 * reclamation (e.g. in response to a DEAUTH message)
   2116 		 * so use free_node here instead of unref_node.
   2117 		 */
   2118 		if (ni == ic->ic_bss)
   2119 			ieee80211_unref_node(&ni);
   2120 		else
   2121 			ieee80211_free_node(ic, ni);
   2122   rx_next:
   2123 		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
   2124 	} while (ath_rxbuf_init(sc, bf) == 0);
   2125 
   2126 	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
   2127 	ath_hal_rxena(ah);			/* in case of RXEOL */
   2128 }
   2129 
   2130 /*
   2131  * XXX Size of an ACK control frame in bytes.
   2132  */
   2133 #define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
   2134 
   2135 static int
   2136 ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
   2137     struct mbuf *m0)
   2138 {
   2139 	struct ieee80211com *ic = &sc->sc_ic;
   2140 	struct ath_hal *ah = sc->sc_ah;
   2141 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   2142 	int i, error, iswep, hdrlen, pktlen;
   2143 	u_int8_t rix, cix, txrate, ctsrate;
   2144 	struct ath_desc *ds;
   2145 	struct mbuf *m;
   2146 	struct ieee80211_frame *wh;
   2147 	u_int32_t iv;
   2148 	u_int8_t *ivp;
   2149 	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
   2150 	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
   2151 	u_int subtype, flags, ctsduration, antenna;
   2152 	HAL_PKT_TYPE atype;
   2153 	const HAL_RATE_TABLE *rt;
   2154 	HAL_BOOL shortPreamble;
   2155 	struct ath_node *an;
   2156 	ath_txq_critsect_decl(s);
   2157 
   2158 	wh = mtod(m0, struct ieee80211_frame *);
   2159 	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
   2160 	hdrlen = sizeof(struct ieee80211_frame);
   2161 	pktlen = m0->m_pkthdr.len;
   2162 
   2163 	if (iswep) {
   2164 		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
   2165 		m_adj(m0, hdrlen);
   2166 		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
   2167 		if (m0 == NULL) {
   2168 			sc->sc_stats.ast_tx_nombuf++;
   2169 			return ENOMEM;
   2170 		}
   2171 		ivp = hdrbuf + hdrlen;
   2172 		/*
   2173 		 * XXX
   2174 		 * IV must not duplicate during the lifetime of the key.
   2175 		 * But no mechanism to renew keys is defined in IEEE 802.11
   2176 		 * WEP.  And IV may be duplicated between other stations
   2177 		 * because of the session key itself is shared.
   2178 		 * So we use pseudo random IV for now, though it is not the
   2179 		 * right way.
   2180 		 */
   2181 		iv = arc4random();
   2182 		for (i = 0; i < IEEE80211_WEP_IVLEN; i++) {
   2183 			ivp[i] = iv;
   2184 			iv >>= 8;
   2185 		}
   2186 		ivp[i] = sc->sc_ic.ic_wep_txkey << 6;	/* Key ID and pad */
   2187 		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
   2188 		/*
   2189 		 * The ICV length must be included into hdrlen and pktlen.
   2190 		 */
   2191 		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
   2192 		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
   2193 	}
   2194 	pktlen += IEEE80211_CRC_LEN;
   2195 
   2196 	/*
   2197 	 * Load the DMA map so any coalescing is done.  This
   2198 	 * also calculates the number of descriptors we need.
   2199 	 */
   2200 	error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m0, BUS_DMA_NOWAIT);
   2201 	if (error != 0) {
   2202 		sc->sc_stats.ast_tx_busdma++;
   2203 		m_freem(m0);
   2204 		return error;
   2205 	}
   2206 	/*
   2207 	 * Discard null packets and check for packets that
   2208 	 * require too many TX descriptors.  We try to convert
   2209 	 * the latter to a cluster.
   2210 	 */
   2211 	if (bf->bf_nseg > ATH_TXDESC) {		/* too many desc's, linearize */
   2212 		sc->sc_stats.ast_tx_linear++;
   2213 		MGETHDR(m, M_DONTWAIT, MT_DATA);
   2214 		if (m == NULL) {
   2215 			sc->sc_stats.ast_tx_nombuf++;
   2216 			m_freem(m0);
   2217 			return ENOMEM;
   2218 		}
   2219 #ifdef __FreeBSD__
   2220 		M_MOVE_PKTHDR(m, m0);
   2221 #else
   2222 		M_COPY_PKTHDR(m, m0);
   2223 #endif
   2224 		MCLGET(m, M_DONTWAIT);
   2225 		if ((m->m_flags & M_EXT) == 0) {
   2226 			sc->sc_stats.ast_tx_nomcl++;
   2227 			m_freem(m0);
   2228 			m_free(m);
   2229 			return ENOMEM;
   2230 		}
   2231 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
   2232 		m_freem(m0);
   2233 		m->m_len = m->m_pkthdr.len;
   2234 		m0 = m;
   2235 		error = ath_buf_dmamap_load_mbuf(sc->sc_dmat, bf, m0,
   2236 					         BUS_DMA_NOWAIT);
   2237 		if (error != 0) {
   2238 			sc->sc_stats.ast_tx_busdma++;
   2239 			m_freem(m0);
   2240 			return error;
   2241 		}
   2242 		KASSERT(bf->bf_nseg == 1,
   2243 			("ath_tx_start: packet not one segment; nseg %u",
   2244 			bf->bf_nseg));
   2245 	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
   2246 		sc->sc_stats.ast_tx_nodata++;
   2247 		m_freem(m0);
   2248 		return EIO;
   2249 	}
   2250 	DPRINTF2(("ath_tx_start: m %p len %u\n", m0, pktlen));
   2251 	ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_PREWRITE);
   2252 	bf->bf_m = m0;
   2253 	bf->bf_node = ni;			/* NB: held reference */
   2254 
   2255 	/* setup descriptors */
   2256 	ds = bf->bf_desc;
   2257 	rt = sc->sc_currates;
   2258 	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
   2259 
   2260 	/*
   2261 	 * Calculate Atheros packet type from IEEE80211 packet header
   2262 	 * and setup for rate calculations.
   2263 	 */
   2264 	atype = HAL_PKT_TYPE_NORMAL;			/* default */
   2265 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
   2266 	case IEEE80211_FC0_TYPE_MGT:
   2267 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
   2268 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
   2269 			atype = HAL_PKT_TYPE_BEACON;
   2270 		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
   2271 			atype = HAL_PKT_TYPE_PROBE_RESP;
   2272 		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
   2273 			atype = HAL_PKT_TYPE_ATIM;
   2274 		rix = 0;			/* XXX lowest rate */
   2275 		break;
   2276 	case IEEE80211_FC0_TYPE_CTL:
   2277 		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
   2278 		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
   2279 			atype = HAL_PKT_TYPE_PSPOLL;
   2280 		rix = 0;			/* XXX lowest rate */
   2281 		break;
   2282 	default:
   2283 		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
   2284 				IEEE80211_RATE_VAL];
   2285 		if (rix == 0xff) {
   2286 			if_printf(ifp, "bogus xmit rate 0x%x\n",
   2287 				ni->ni_rates.rs_rates[ni->ni_txrate]);
   2288 			sc->sc_stats.ast_tx_badrate++;
   2289 			m_freem(m0);
   2290 			return EIO;
   2291 		}
   2292 		break;
   2293 	}
   2294 	/*
   2295 	 * NB: the 802.11 layer marks whether or not we should
   2296 	 * use short preamble based on the current mode and
   2297 	 * negotiated parameters.
   2298 	 */
   2299 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE) {
   2300 		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
   2301 		shortPreamble = AH_TRUE;
   2302 		sc->sc_stats.ast_tx_shortpre++;
   2303 	} else {
   2304 		txrate = rt->info[rix].rateCode;
   2305 		shortPreamble = AH_FALSE;
   2306 	}
   2307 
   2308 	/*
   2309 	 * Calculate miscellaneous flags.
   2310 	 */
   2311 	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
   2312 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
   2313 		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
   2314 		sc->sc_stats.ast_tx_noack++;
   2315 	} else if (pktlen > ic->ic_rtsthreshold) {
   2316 		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
   2317 		sc->sc_stats.ast_tx_rts++;
   2318 	}
   2319 
   2320 	/*
   2321 	 * Calculate RTS/CTS rate and duration if needed.
   2322 	 */
   2323 	ctsduration = 0;
   2324 	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
   2325 		/*
   2326 		 * CTS transmit rate is derived from the transmit rate
   2327 		 * by looking in the h/w rate table.  We must also factor
   2328 		 * in whether or not a short preamble is to be used.
   2329 		 */
   2330 		cix = rt->info[rix].controlRate;
   2331 		ctsrate = rt->info[cix].rateCode;
   2332 		if (shortPreamble)
   2333 			ctsrate |= rt->info[cix].shortPreamble;
   2334 		/*
   2335 		 * Compute the transmit duration based on the size
   2336 		 * of an ACK frame.  We call into the HAL to do the
   2337 		 * computation since it depends on the characteristics
   2338 		 * of the actual PHY being used.
   2339 		 */
   2340 		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
   2341 			ctsduration += ath_hal_computetxtime(ah,
   2342 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
   2343 		}
   2344 		/* SIFS + data */
   2345 		ctsduration += ath_hal_computetxtime(ah,
   2346 			rt, pktlen, rix, shortPreamble);
   2347 		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
   2348 			ctsduration += ath_hal_computetxtime(ah,
   2349 				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
   2350 		}
   2351 	} else
   2352 		ctsrate = 0;
   2353 
   2354 	/*
   2355 	 * For now use the antenna on which the last good
   2356 	 * frame was received on.  We assume this field is
   2357 	 * initialized to 0 which gives us ``auto'' or the
   2358 	 * ``default'' antenna.
   2359 	 */
   2360 	an = (struct ath_node *) ni;
   2361 	if (an->an_tx_antenna)
   2362 		antenna = an->an_tx_antenna;
   2363 	else
   2364 		antenna = an->an_rx_antenna;
   2365 
   2366 	/*
   2367 	 * Formulate first tx descriptor with tx controls.
   2368 	 */
   2369 	/* XXX check return value? */
   2370 	ath_hal_setuptxdesc(ah, ds
   2371 		, pktlen		/* packet length */
   2372 		, hdrlen		/* header length */
   2373 		, atype			/* Atheros packet type */
   2374 		, 60			/* txpower XXX */
   2375 		, txrate, 1+10		/* series 0 rate/tries */
   2376 		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
   2377 		, antenna		/* antenna mode */
   2378 		, flags			/* flags */
   2379 		, ctsrate		/* rts/cts rate */
   2380 		, ctsduration		/* rts/cts duration */
   2381 	);
   2382 #ifdef notyet
   2383 	ath_hal_setupxtxdesc(ah, ds
   2384 		, AH_FALSE		/* short preamble */
   2385 		, 0, 0			/* series 1 rate/tries */
   2386 		, 0, 0			/* series 2 rate/tries */
   2387 		, 0, 0			/* series 3 rate/tries */
   2388 	);
   2389 #endif
   2390 	/*
   2391 	 * Fillin the remainder of the descriptor info.
   2392 	 */
   2393 	for (i = 0; i < bf->bf_nseg; i++, ds++) {
   2394 		ds->ds_data = bf->bf_segs[i].ds_addr;
   2395 		if (i == bf->bf_nseg - 1)
   2396 			ds->ds_link = 0;
   2397 		else
   2398 			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
   2399 		ath_hal_filltxdesc(ah, ds
   2400 			, bf->bf_segs[i].ds_len	/* segment length */
   2401 			, i == 0		/* first segment */
   2402 			, i == bf->bf_nseg - 1	/* last segment */
   2403 		);
   2404 		DPRINTF2(("ath_tx_start: %d: %08x %08x %08x %08x %08x %08x\n",
   2405 		    i, ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
   2406 		    ds->ds_hw[0], ds->ds_hw[1]));
   2407 	}
   2408 
   2409 	/*
   2410 	 * Insert the frame on the outbound list and
   2411 	 * pass it on to the hardware.
   2412 	 */
   2413 	ath_txq_critsect_begin(sc, s);
   2414 	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
   2415 	if (sc->sc_txlink == NULL) {
   2416 		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
   2417 		DPRINTF2(("ath_tx_start: TXDP0 = %p (%p)\n",
   2418 		    (caddr_t)bf->bf_daddr, bf->bf_desc));
   2419 	} else {
   2420 		*sc->sc_txlink = bf->bf_daddr;
   2421 		DPRINTF2(("ath_tx_start: link(%p)=%p (%p)\n",
   2422 		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
   2423 	}
   2424 	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
   2425 	ath_txq_critsect_end(sc, s);
   2426 
   2427 	ath_hal_txstart(ah, sc->sc_txhalq);
   2428 	return 0;
   2429 }
   2430 
   2431 static void
   2432 ath_tx_proc(void *arg, int npending)
   2433 {
   2434 	struct ath_softc *sc = arg;
   2435 	struct ath_hal *ah = sc->sc_ah;
   2436 	struct ath_buf *bf;
   2437 	struct ieee80211com *ic = &sc->sc_ic;
   2438 	struct ifnet *ifp = &ic->ic_if;
   2439 	struct ath_desc *ds;
   2440 	struct ieee80211_node *ni;
   2441 	struct ath_node *an;
   2442 	int sr, lr;
   2443 	HAL_STATUS status;
   2444 	ath_txq_critsect_decl(s);
   2445 	ath_txbuf_critsect_decl(s2);
   2446 
   2447 	DPRINTF2(("ath_tx_proc: pending %u tx queue %p, link %p\n",
   2448 		npending, (caddr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
   2449 		sc->sc_txlink));
   2450 	for (;;) {
   2451 		ath_txq_critsect_begin(sc, s);
   2452 		bf = TAILQ_FIRST(&sc->sc_txq);
   2453 		if (bf == NULL) {
   2454 			sc->sc_txlink = NULL;
   2455 			ath_txq_critsect_end(sc, s);
   2456 			break;
   2457 		}
   2458 		/* only the last descriptor is needed */
   2459 		ds = &bf->bf_desc[bf->bf_nseg - 1];
   2460 		status = ath_hal_txprocdesc(ah, ds);
   2461 #ifdef AR_DEBUG
   2462 		if (ath_debug > 1)
   2463 			ath_printtxbuf(bf, status == HAL_OK);
   2464 #endif
   2465 		if (status == HAL_EINPROGRESS) {
   2466 			ath_txq_critsect_end(sc, s);
   2467 			break;
   2468 		}
   2469 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
   2470 		ath_txq_critsect_end(sc, s);
   2471 
   2472 		ni = bf->bf_node;
   2473 		if (ni != NULL) {
   2474 			an = (struct ath_node *) ni;
   2475 			if (ds->ds_txstat.ts_status == 0) {
   2476 				an->an_tx_ok++;
   2477 				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
   2478 			} else {
   2479 				an->an_tx_err++;
   2480 				ifp->if_oerrors++;
   2481 				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
   2482 					sc->sc_stats.ast_tx_xretries++;
   2483 				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
   2484 					sc->sc_stats.ast_tx_fifoerr++;
   2485 				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
   2486 					sc->sc_stats.ast_tx_filtered++;
   2487 				an->an_tx_antenna = 0;	/* invalidate */
   2488 			}
   2489 			sr = ds->ds_txstat.ts_shortretry;
   2490 			lr = ds->ds_txstat.ts_longretry;
   2491 			sc->sc_stats.ast_tx_shortretry += sr;
   2492 			sc->sc_stats.ast_tx_longretry += lr;
   2493 			if (sr + lr)
   2494 				an->an_tx_retr++;
   2495 			/*
   2496 			 * Reclaim reference to node.
   2497 			 *
   2498 			 * NB: the node may be reclaimed here if, for example
   2499 			 *     this is a DEAUTH message that was sent and the
   2500 			 *     node was timed out due to inactivity.
   2501 			 */
   2502 			if (ni != ic->ic_bss)
   2503 				ieee80211_free_node(ic, ni);
   2504 		}
   2505 		ath_buf_dmamap_sync(sc->sc_dmat, bf, BUS_DMASYNC_POSTWRITE);
   2506 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   2507 		m_freem(bf->bf_m);
   2508 		bf->bf_m = NULL;
   2509 		bf->bf_node = NULL;
   2510 
   2511 		ath_txbuf_critsect_begin(sc, s2);
   2512 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   2513 		ath_txbuf_critsect_end(sc, s2);
   2514 	}
   2515 	ifp->if_flags &= ~IFF_OACTIVE;
   2516 	sc->sc_tx_timer = 0;
   2517 
   2518 	ath_start(ifp);
   2519 }
   2520 
   2521 /*
   2522  * Drain the transmit queue and reclaim resources.
   2523  */
   2524 static void
   2525 ath_draintxq(struct ath_softc *sc)
   2526 {
   2527 	struct ath_hal *ah = sc->sc_ah;
   2528 	struct ifnet *ifp = &sc->sc_ic.ic_if;
   2529 	struct ath_buf *bf;
   2530 	ath_txq_critsect_decl(s);
   2531 	ath_txbuf_critsect_decl(s2);
   2532 
   2533 	/* XXX return value */
   2534 	if (!sc->sc_invalid) {
   2535 		/* don't touch the hardware if marked invalid */
   2536 		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
   2537 		DPRINTF(("ath_draintxq: tx queue %p, link %p\n",
   2538 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
   2539 		    sc->sc_txlink));
   2540 		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
   2541 		DPRINTF(("ath_draintxq: beacon queue %p\n",
   2542 		    (caddr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
   2543 	}
   2544 	for (;;) {
   2545 		ath_txq_critsect_begin(sc, s);
   2546 		bf = TAILQ_FIRST(&sc->sc_txq);
   2547 		if (bf == NULL) {
   2548 			sc->sc_txlink = NULL;
   2549 			ath_txq_critsect_end(sc, s);
   2550 			break;
   2551 		}
   2552 		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
   2553 		ath_txq_critsect_end(sc, s);
   2554 #ifdef AR_DEBUG
   2555 		if (ath_debug)
   2556 			ath_printtxbuf(bf,
   2557 				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
   2558 #endif /* AR_DEBUG */
   2559 		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
   2560 		m_freem(bf->bf_m);
   2561 		bf->bf_m = NULL;
   2562 		bf->bf_node = NULL;
   2563 		ath_txbuf_critsect_begin(sc, s2);
   2564 		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
   2565 		ath_txbuf_critsect_end(sc, s2);
   2566 	}
   2567 	ifp->if_flags &= ~IFF_OACTIVE;
   2568 	sc->sc_tx_timer = 0;
   2569 }
   2570 
   2571 /*
   2572  * Disable the receive h/w in preparation for a reset.
   2573  */
   2574 static void
   2575 ath_stoprecv(struct ath_softc *sc)
   2576 {
   2577 	struct ath_hal *ah = sc->sc_ah;
   2578 
   2579 	ath_hal_stoppcurecv(ah);	/* disable PCU */
   2580 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
   2581 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
   2582 	DELAY(3000);			/* long enough for 1 frame */
   2583 #ifdef AR_DEBUG
   2584 	if (ath_debug) {
   2585 		struct ath_buf *bf;
   2586 
   2587 		DPRINTF(("ath_stoprecv: rx queue %p, link %p\n",
   2588 		    (caddr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink));
   2589 		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
   2590 			if (ath_hal_rxprocdesc(ah, bf->bf_desc) == HAL_OK)
   2591 				ath_printrxbuf(bf, 1);
   2592 		}
   2593 	}
   2594 #endif
   2595 	sc->sc_rxlink = NULL;		/* just in case */
   2596 }
   2597 
   2598 /*
   2599  * Enable the receive h/w following a reset.
   2600  */
   2601 static int
   2602 ath_startrecv(struct ath_softc *sc)
   2603 {
   2604 	struct ath_hal *ah = sc->sc_ah;
   2605 	struct ath_buf *bf;
   2606 
   2607 	sc->sc_rxlink = NULL;
   2608 	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
   2609 		int error = ath_rxbuf_init(sc, bf);
   2610 		if (error != 0) {
   2611 			DPRINTF(("ath_startrecv: ath_rxbuf_init failed %d\n",
   2612 				error));
   2613 			return error;
   2614 		}
   2615 	}
   2616 
   2617 	bf = TAILQ_FIRST(&sc->sc_rxbuf);
   2618 	ath_hal_putrxbuf(ah, bf->bf_daddr);
   2619 	ath_hal_rxena(ah);		/* enable recv descriptors */
   2620 	ath_mode_init(sc);		/* set filters, etc. */
   2621 	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
   2622 	return 0;
   2623 }
   2624 
   2625 /*
   2626  * Set/change channels.  If the channel is really being changed,
   2627  * it's done by resetting the chip.  To accomplish this we must
   2628  * first cleanup any pending DMA, then restart stuff after a la
   2629  * ath_init.
   2630  */
   2631 static int
   2632 ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
   2633 {
   2634 	struct ath_hal *ah = sc->sc_ah;
   2635 	struct ieee80211com *ic = &sc->sc_ic;
   2636 
   2637 	DPRINTF(("ath_chan_set: %u (%u MHz) -> %u (%u MHz)\n",
   2638 	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
   2639 		ic->ic_ibss_chan->ic_freq,
   2640 	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
   2641 	if (chan != ic->ic_ibss_chan) {
   2642 		HAL_STATUS status;
   2643 		HAL_CHANNEL hchan;
   2644 		enum ieee80211_phymode mode;
   2645 
   2646 		/*
   2647 		 * To switch channels clear any pending DMA operations;
   2648 		 * wait long enough for the RX fifo to drain, reset the
   2649 		 * hardware at the new frequency, and then re-enable
   2650 		 * the relevant bits of the h/w.
   2651 		 */
   2652 		ath_hal_intrset(ah, 0);		/* disable interrupts */
   2653 		ath_draintxq(sc);		/* clear pending tx frames */
   2654 		ath_stoprecv(sc);		/* turn off frame recv */
   2655 		/*
   2656 		 * Convert to a HAL channel description with
   2657 		 * the flags constrained to reflect the current
   2658 		 * operating mode.
   2659 		 */
   2660 		hchan.channel = chan->ic_freq;
   2661 		hchan.channelFlags = ath_chan2flags(ic, chan);
   2662 		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
   2663 			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
   2664 				"channel %u (%u Mhz)\n",
   2665 				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
   2666 			return EIO;
   2667 		}
   2668 		/*
   2669 		 * Re-enable rx framework.
   2670 		 */
   2671 		if (ath_startrecv(sc) != 0) {
   2672 			if_printf(&ic->ic_if,
   2673 				"ath_chan_set: unable to restart recv logic\n");
   2674 			return EIO;
   2675 		}
   2676 
   2677 		/*
   2678 		 * Update BPF state.
   2679 		 */
   2680 		sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
   2681 			htole16(chan->ic_freq);
   2682 		sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
   2683 			htole16(chan->ic_flags);
   2684 
   2685 		/*
   2686 		 * Change channels and update the h/w rate map
   2687 		 * if we're switching; e.g. 11a to 11b/g.
   2688 		 */
   2689 		ic->ic_ibss_chan = chan;
   2690 		mode = ieee80211_chan2mode(ic, chan);
   2691 		if (mode != sc->sc_curmode)
   2692 			ath_setcurmode(sc, mode);
   2693 
   2694 		/*
   2695 		 * Re-enable interrupts.
   2696 		 */
   2697 		ath_hal_intrset(ah, sc->sc_imask);
   2698 	}
   2699 	return 0;
   2700 }
   2701 
   2702 static void
   2703 ath_next_scan(void *arg)
   2704 {
   2705 	struct ath_softc *sc = arg;
   2706 	struct ieee80211com *ic = &sc->sc_ic;
   2707 	struct ifnet *ifp = &ic->ic_if;
   2708 	int s;
   2709 
   2710 	/* don't call ath_start w/o network interrupts blocked */
   2711 	s = splnet();
   2712 
   2713 	if (ic->ic_state == IEEE80211_S_SCAN)
   2714 		ieee80211_next_scan(ifp);
   2715 	splx(s);
   2716 }
   2717 
   2718 /*
   2719  * Periodically recalibrate the PHY to account
   2720  * for temperature/environment changes.
   2721  */
   2722 static void
   2723 ath_calibrate(void *arg)
   2724 {
   2725 	struct ath_softc *sc = arg;
   2726 	struct ath_hal *ah = sc->sc_ah;
   2727 	struct ieee80211com *ic = &sc->sc_ic;
   2728 	struct ieee80211_channel *c;
   2729 	HAL_CHANNEL hchan;
   2730 
   2731 	sc->sc_stats.ast_per_cal++;
   2732 
   2733 	/*
   2734 	 * Convert to a HAL channel description with the flags
   2735 	 * constrained to reflect the current operating mode.
   2736 	 */
   2737 	c = ic->ic_ibss_chan;
   2738 	hchan.channel = c->ic_freq;
   2739 	hchan.channelFlags = ath_chan2flags(ic, c);
   2740 
   2741 	DPRINTF(("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
   2742 
   2743 	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
   2744 		/*
   2745 		 * Rfgain is out of bounds, reset the chip
   2746 		 * to load new gain values.
   2747 		 */
   2748 		sc->sc_stats.ast_per_rfgain++;
   2749 		ath_reset(sc);
   2750 	}
   2751 	if (!ath_hal_calibrate(ah, &hchan)) {
   2752 		DPRINTF(("%s: calibration of channel %u failed\n",
   2753 			__func__, c->ic_freq));
   2754 		sc->sc_stats.ast_per_calfail++;
   2755 	}
   2756 	callout_reset(&sc->sc_cal_ch, hz * ath_calinterval, ath_calibrate, sc);
   2757 }
   2758 
   2759 static HAL_LED_STATE
   2760 ath_state_to_led(enum ieee80211_state state)
   2761 {
   2762 	switch (state) {
   2763 	case IEEE80211_S_INIT:
   2764 		return HAL_LED_INIT;
   2765 	case IEEE80211_S_SCAN:
   2766 		return HAL_LED_SCAN;
   2767 	case IEEE80211_S_AUTH:
   2768 		return HAL_LED_AUTH;
   2769 	case IEEE80211_S_ASSOC:
   2770 		return HAL_LED_ASSOC;
   2771 	case IEEE80211_S_RUN:
   2772 		return HAL_LED_RUN;
   2773 	default:
   2774 		panic("%s: unknown 802.11 state %d\n", __func__, state);
   2775 		return HAL_LED_INIT;
   2776 	}
   2777 }
   2778 
   2779 static int
   2780 ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
   2781 {
   2782 	struct ifnet *ifp = &ic->ic_if;
   2783 	struct ath_softc *sc = ifp->if_softc;
   2784 	struct ath_hal *ah = sc->sc_ah;
   2785 	struct ieee80211_node *ni;
   2786 	int i, error;
   2787 	u_int8_t *bssid;
   2788 	u_int32_t rfilt;
   2789 
   2790 	DPRINTF(("%s: %s -> %s\n", __func__,
   2791 		ieee80211_state_name[ic->ic_state],
   2792 		ieee80211_state_name[nstate]));
   2793 
   2794 	ath_hal_setledstate(ah, ath_state_to_led(nstate));	/* set LED */
   2795 
   2796 	if (nstate == IEEE80211_S_INIT) {
   2797 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
   2798 		ath_hal_intrset(ah, sc->sc_imask);
   2799 		callout_stop(&sc->sc_scan_ch);
   2800 		callout_stop(&sc->sc_cal_ch);
   2801 		return (*sc->sc_newstate)(ic, nstate, arg);
   2802 	}
   2803 	ni = ic->ic_bss;
   2804 	error = ath_chan_set(sc, ni->ni_chan);
   2805 	if (error != 0)
   2806 		goto bad;
   2807 	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
   2808 	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
   2809 	if (ic->ic_opmode != IEEE80211_M_STA)
   2810 		rfilt |= HAL_RX_FILTER_PROBEREQ;
   2811 	if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
   2812 	    (ifp->if_flags & IFF_PROMISC))
   2813 		rfilt |= HAL_RX_FILTER_PROM;
   2814 	if (nstate == IEEE80211_S_SCAN) {
   2815 		callout_reset(&sc->sc_scan_ch, (hz * ath_dwelltime) / 1000,
   2816 			ath_next_scan, sc);
   2817 		bssid = ifp->if_broadcastaddr;
   2818 		rfilt |= HAL_RX_FILTER_BEACON;
   2819 	} else {
   2820 		callout_stop(&sc->sc_scan_ch);
   2821 		bssid = ni->ni_bssid;
   2822 	}
   2823 	ath_hal_setrxfilter(ah, rfilt);
   2824 	DPRINTF(("%s: RX filter 0x%x bssid %s\n",
   2825 		 __func__, rfilt, ether_sprintf(bssid)));
   2826 
   2827 	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
   2828 		ath_hal_setassocid(ah, bssid, ni->ni_associd);
   2829 	else
   2830 		ath_hal_setassocid(ah, bssid, 0);
   2831 	if (ic->ic_flags & IEEE80211_F_WEPON) {
   2832 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
   2833 			if (ath_hal_keyisvalid(ah, i))
   2834 				ath_hal_keysetmac(ah, i, bssid);
   2835 	}
   2836 
   2837 	if (nstate == IEEE80211_S_RUN) {
   2838 		DPRINTF(("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
   2839 			"capinfo=0x%04x chan=%d\n"
   2840 			 , __func__
   2841 			 , ic->ic_flags
   2842 			 , ni->ni_intval
   2843 			 , ether_sprintf(ni->ni_bssid)
   2844 			 , ni->ni_capinfo
   2845 			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
   2846 
   2847 		/*
   2848 		 * Allocate and setup the beacon frame for AP or adhoc mode.
   2849 		 */
   2850 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
   2851 		    ic->ic_opmode == IEEE80211_M_IBSS) {
   2852 			error = ath_beacon_alloc(sc, ni);
   2853 			if (error != 0)
   2854 				goto bad;
   2855 		}
   2856 
   2857 		/*
   2858 		 * Configure the beacon and sleep timers.
   2859 		 */
   2860 		ath_beacon_config(sc);
   2861 
   2862 		/* start periodic recalibration timer */
   2863 		callout_reset(&sc->sc_cal_ch, hz * ath_calinterval,
   2864 			ath_calibrate, sc);
   2865 	} else {
   2866 		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
   2867 		ath_hal_intrset(ah, sc->sc_imask);
   2868 		callout_stop(&sc->sc_cal_ch);		/* no calibration */
   2869 	}
   2870 	/*
   2871 	 * Reset the rate control state.
   2872 	 */
   2873 	ath_rate_ctl_reset(sc, nstate);
   2874 	/*
   2875 	 * Invoke the parent method to complete the work.
   2876 	 */
   2877 	return (*sc->sc_newstate)(ic, nstate, arg);
   2878 bad:
   2879 	callout_stop(&sc->sc_scan_ch);
   2880 	callout_stop(&sc->sc_cal_ch);
   2881 	/* NB: do not invoke the parent */
   2882 	return error;
   2883 }
   2884 
   2885 /*
   2886  * Setup driver-specific state for a newly associated node.
   2887  * Note that we're called also on a re-associate, the isnew
   2888  * param tells us if this is the first time or not.
   2889  */
   2890 static void
   2891 ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
   2892 {
   2893 	if (isnew) {
   2894 		struct ath_node *an = (struct ath_node *) ni;
   2895 
   2896 		an->an_tx_ok = an->an_tx_err =
   2897 			an->an_tx_retr = an->an_tx_upper = 0;
   2898 		/* start with highest negotiated rate */
   2899 		/*
   2900 		 * XXX should do otherwise but only when
   2901 		 * the rate control algorithm is better.
   2902 		 */
   2903 		KASSERT(ni->ni_rates.rs_nrates > 0,
   2904 			("new association w/ no rates!"));
   2905 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
   2906 	}
   2907 }
   2908 
   2909 static int
   2910 ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor)
   2911 {
   2912 	struct ieee80211com *ic = &sc->sc_ic;
   2913 	struct ifnet *ifp = &ic->ic_if;
   2914 	struct ath_hal *ah = sc->sc_ah;
   2915 	HAL_CHANNEL *chans;
   2916 	int i, ix, nchan;
   2917 
   2918 	sc->sc_have11g = 0;
   2919 	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
   2920 			M_TEMP, M_NOWAIT);
   2921 	if (chans == NULL) {
   2922 		if_printf(ifp, "unable to allocate channel table\n");
   2923 		return ENOMEM;
   2924 	}
   2925 	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
   2926 	    cc, HAL_MODE_ALL, outdoor)) {
   2927 		if_printf(ifp, "unable to collect channel list from hal\n");
   2928 		free(chans, M_TEMP);
   2929 		return EINVAL;
   2930 	}
   2931 
   2932 	/*
   2933 	 * Convert HAL channels to ieee80211 ones and insert
   2934 	 * them in the table according to their channel number.
   2935 	 */
   2936 	for (i = 0; i < nchan; i++) {
   2937 		HAL_CHANNEL *c = &chans[i];
   2938 		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
   2939 		if (ix > IEEE80211_CHAN_MAX) {
   2940 			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
   2941 				ix, c->channel, c->channelFlags);
   2942 			continue;
   2943 		}
   2944 		/* NB: flags are known to be compatible */
   2945 		if (ic->ic_channels[ix].ic_freq == 0) {
   2946 			ic->ic_channels[ix].ic_freq = c->channel;
   2947 			ic->ic_channels[ix].ic_flags = c->channelFlags;
   2948 		} else {
   2949 			/* channels overlap; e.g. 11g and 11b */
   2950 			ic->ic_channels[ix].ic_flags |= c->channelFlags;
   2951 		}
   2952 		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
   2953 			sc->sc_have11g = 1;
   2954 	}
   2955 	free(chans, M_TEMP);
   2956 	return 0;
   2957 }
   2958 
   2959 static int
   2960 ath_rate_setup(struct ath_softc *sc, u_int mode)
   2961 {
   2962 	struct ath_hal *ah = sc->sc_ah;
   2963 	struct ieee80211com *ic = &sc->sc_ic;
   2964 	const HAL_RATE_TABLE *rt;
   2965 	struct ieee80211_rateset *rs;
   2966 	int i, maxrates;
   2967 
   2968 	switch (mode) {
   2969 	case IEEE80211_MODE_11A:
   2970 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
   2971 		break;
   2972 	case IEEE80211_MODE_11B:
   2973 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
   2974 		break;
   2975 	case IEEE80211_MODE_11G:
   2976 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
   2977 		break;
   2978 	case IEEE80211_MODE_TURBO:
   2979 		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
   2980 		break;
   2981 	default:
   2982 		DPRINTF(("%s: invalid mode %u\n", __func__, mode));
   2983 		return 0;
   2984 	}
   2985 	rt = sc->sc_rates[mode];
   2986 	if (rt == NULL)
   2987 		return 0;
   2988 	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
   2989 		DPRINTF(("%s: rate table too small (%u > %u)\n",
   2990 			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
   2991 		maxrates = IEEE80211_RATE_MAXSIZE;
   2992 	} else
   2993 		maxrates = rt->rateCount;
   2994 	rs = &ic->ic_sup_rates[mode];
   2995 	for (i = 0; i < maxrates; i++)
   2996 		rs->rs_rates[i] = rt->info[i].dot11Rate;
   2997 	rs->rs_nrates = maxrates;
   2998 	return 1;
   2999 }
   3000 
   3001 static void
   3002 ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
   3003 {
   3004 	const HAL_RATE_TABLE *rt;
   3005 	int i;
   3006 
   3007 	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
   3008 	rt = sc->sc_rates[mode];
   3009 	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
   3010 	for (i = 0; i < rt->rateCount; i++)
   3011 		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
   3012 	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
   3013 	for (i = 0; i < 32; i++)
   3014 		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
   3015 	sc->sc_currates = rt;
   3016 	sc->sc_curmode = mode;
   3017 }
   3018 
   3019 /*
   3020  * Reset the rate control state for each 802.11 state transition.
   3021  */
   3022 static void
   3023 ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
   3024 {
   3025 	struct ieee80211com *ic = &sc->sc_ic;
   3026 	struct ieee80211_node *ni;
   3027 	struct ath_node *an;
   3028 
   3029 	an = (struct ath_node *) ic->ic_bss;
   3030 	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
   3031 	if (ic->ic_opmode == IEEE80211_M_STA) {
   3032 		ni = ic->ic_bss;
   3033 		if (state == IEEE80211_S_RUN) {
   3034 			/* start with highest negotiated rate */
   3035 			KASSERT(ni->ni_rates.rs_nrates > 0,
   3036 				("transition to RUN state w/ no rates!"));
   3037 			ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
   3038 		} else {
   3039 			/* use lowest rate */
   3040 			ni->ni_txrate = 0;
   3041 		}
   3042 	} else {
   3043 		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
   3044 			ni->ni_txrate = 0;		/* use lowest rate */
   3045 			an = (struct ath_node *) ni;
   3046 			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
   3047 			    an->an_tx_upper = 0;
   3048 		}
   3049 	}
   3050 }
   3051 
   3052 /*
   3053  * Examine and potentially adjust the transmit rate.
   3054  */
   3055 static void
   3056 ath_rate_ctl(void *arg, struct ieee80211_node *ni)
   3057 {
   3058 	struct ath_softc *sc = arg;
   3059 	struct ath_node *an = (struct ath_node *) ni;
   3060 	struct ieee80211_rateset *rs = &ni->ni_rates;
   3061 	int mod = 0, orate, enough;
   3062 
   3063 	/*
   3064 	 * Rate control
   3065 	 * XXX: very primitive version.
   3066 	 */
   3067 	sc->sc_stats.ast_rate_calls++;
   3068 
   3069 	enough = (an->an_tx_ok + an->an_tx_err >= 10);
   3070 
   3071 	/* no packet reached -> down */
   3072 	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
   3073 		mod = -1;
   3074 
   3075 	/* all packets needs retry in average -> down */
   3076 	if (enough && an->an_tx_ok < an->an_tx_retr)
   3077 		mod = -1;
   3078 
   3079 	/* no error and less than 10% of packets needs retry -> up */
   3080 	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
   3081 		mod = 1;
   3082 
   3083 	orate = ni->ni_txrate;
   3084 	switch (mod) {
   3085 	case 0:
   3086 		if (enough && an->an_tx_upper > 0)
   3087 			an->an_tx_upper--;
   3088 		break;
   3089 	case -1:
   3090 		if (ni->ni_txrate > 0) {
   3091 			ni->ni_txrate--;
   3092 			sc->sc_stats.ast_rate_drop++;
   3093 		}
   3094 		an->an_tx_upper = 0;
   3095 		break;
   3096 	case 1:
   3097 		if (++an->an_tx_upper < 2)
   3098 			break;
   3099 		an->an_tx_upper = 0;
   3100 		if (ni->ni_txrate + 1 < rs->rs_nrates) {
   3101 			ni->ni_txrate++;
   3102 			sc->sc_stats.ast_rate_raise++;
   3103 		}
   3104 		break;
   3105 	}
   3106 
   3107 	if (ni->ni_txrate != orate) {
   3108 		DPRINTF(("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
   3109 		    __func__,
   3110 		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
   3111 		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
   3112 		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr));
   3113 	}
   3114 	if (ni->ni_txrate != orate || enough)
   3115 		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
   3116 }
   3117 
   3118 #ifdef AR_DEBUG
   3119 #ifdef __FreeBSD__
   3120 static int
   3121 sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
   3122 {
   3123 	char dmode[64];
   3124 	int error;
   3125 
   3126 	strncpy(dmode, "", sizeof(dmode) - 1);
   3127 	dmode[sizeof(dmode) - 1] = '\0';
   3128 	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
   3129 
   3130 	if (error == 0 && req->newptr != NULL) {
   3131 		struct ifnet *ifp;
   3132 		struct ath_softc *sc;
   3133 
   3134 		ifp = ifunit("ath0");		/* XXX */
   3135 		if (!ifp)
   3136 			return EINVAL;
   3137 		sc = ifp->if_softc;
   3138 		if (strcmp(dmode, "hal") == 0)
   3139 			ath_hal_dumpstate(sc->sc_ah);
   3140 		else if (strcmp(dmode, "eeprom") == 0)
   3141 			ath_hal_dumpeeprom(sc->sc_ah);
   3142 		else if (strcmp(dmode, "rfgain") == 0)
   3143 			ath_hal_dumprfgain(sc->sc_ah);
   3144 		else if (strcmp(dmode, "ani") == 0)
   3145 			ath_hal_dumpani(sc->sc_ah);
   3146 		else
   3147 			return EINVAL;
   3148 	}
   3149 	return error;
   3150 }
   3151 SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
   3152 	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
   3153 #endif /* __FreeBSD__ */
   3154 
   3155 static void
   3156 ath_printrxbuf(struct ath_buf *bf, int done)
   3157 {
   3158 	struct ath_desc *ds;
   3159 	int i;
   3160 
   3161 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
   3162 		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
   3163 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
   3164 		    ds->ds_link, ds->ds_data,
   3165 		    ds->ds_ctl0, ds->ds_ctl1,
   3166 		    ds->ds_hw[0], ds->ds_hw[1],
   3167 		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
   3168 	}
   3169 }
   3170 
   3171 static void
   3172 ath_printtxbuf(struct ath_buf *bf, int done)
   3173 {
   3174 	struct ath_desc *ds;
   3175 	int i;
   3176 
   3177 	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
   3178 		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
   3179 		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
   3180 		    ds->ds_link, ds->ds_data,
   3181 		    ds->ds_ctl0, ds->ds_ctl1,
   3182 		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
   3183 		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
   3184 	}
   3185 }
   3186 #endif /* AR_DEBUG */
   3187