/usr/src/sys/dev/ic/ath.c

Bug Summary

File:	dev/ic/ath.c
Warning:	line 1427, column 4 Division by zero
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ath.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -D CONFIG_DRM_AMD_DC_DCN3_0 -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /usr/obj/sys/arch/amd64/compile/GENERIC.MP/scan-build/2022-01-12-131800-47421-1 -x c /usr/src/sys/dev/ic/ath.c
1/*      $OpenBSD: ath.c,v 1.122 2020/10/11 07:05:28 mpi Exp $  */
2/*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/

4/*-
* Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer,
*    without modification.
* 2. Redistributions in binary form must reproduce at minimum a disclaimer
*    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
*    redistribution must be conditioned upon including a substantially
*    similar Disclaimer requirement for further binary redistribution.
* 3. Neither the names of the above-listed copyright holders nor the names
*    of any contributors may be used to endorse or promote products derived
*    from this software without specific prior written permission.
*
* NO WARRANTY
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
* LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
* THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
* IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
* THE POSSIBILITY OF SUCH DAMAGES.
*/

36/*
* Driver for the Atheros Wireless LAN controller.
*
* This software is derived from work of Atsushi Onoe; his contribution
* is greatly appreciated. It has been modified for OpenBSD to use an
* open source HAL instead of the original binary-only HAL. 
*/

44#include "bpfilter.h"

46#include <sys/param.h>
47#include <sys/systm.h>
48#include <sys/mbuf.h>
49#include <sys/malloc.h>
50#include <sys/lock.h>
51#include <sys/kernel.h>
52#include <sys/socket.h>
53#include <sys/sockio.h>
54#include <sys/device.h>
55#include <sys/errno.h>
56#include <sys/timeout.h>
57#include <sys/gpio.h>
58#include <sys/endian.h>

60#include <machine/bus.h>

62#include <net/if.h>
63#include <net/if_dl.h>
64#include <net/if_media.h>
65#if NBPFILTER1 > 0
66#include <net/bpf.h>
67#endif
68#include <netinet/in.h>
69#include <netinet/if_ether.h>

71#include <net80211/ieee80211_var.h>
72#include <net80211/ieee80211_rssadapt.h>

74#include <dev/pci/pcidevs.h>
75#include <dev/gpio/gpiovar.h>

77#include <dev/ic/athvar.h>

79int	ath_init(struct ifnet *);
80int	ath_init1(struct ath_softc *);
81int	ath_intr1(struct ath_softc *);
82void	ath_stop(struct ifnet *);
83void	ath_start(struct ifnet *);
84void	ath_reset(struct ath_softc *, int);
85int	ath_media_change(struct ifnet *);
86void	ath_watchdog(struct ifnet *);
87int	ath_ioctl(struct ifnet *, u_long, caddr_t);
88void	ath_fatal_proc(void *, int);
89void	ath_rxorn_proc(void *, int);
90void	ath_bmiss_proc(void *, int);
91int	ath_initkeytable(struct ath_softc *);
92void    ath_mcastfilter_accum(caddr_t, u_int32_t (*)[2]);
93void    ath_mcastfilter_compute(struct ath_softc *, u_int32_t (*)[2]);
94u_int32_t ath_calcrxfilter(struct ath_softc *);
95void	ath_mode_init(struct ath_softc *);
96#ifndef IEEE80211_STA_ONLY
97int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
98void	ath_beacon_proc(void *, int);
99void	ath_beacon_free(struct ath_softc *);
100#endif
101void	ath_beacon_config(struct ath_softc *);
102int	ath_desc_alloc(struct ath_softc *);
103void	ath_desc_free(struct ath_softc *);
104struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
105struct mbuf *ath_getmbuf(int, int, u_int);
106void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
107void	ath_node_copy(struct ieee80211com *,
   struct ieee80211_node *, const struct ieee80211_node *);
109u_int8_t ath_node_getrssi(struct ieee80211com *,
   const struct ieee80211_node *);
111int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
112void	ath_rx_proc(void *, int);
113int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
   struct ath_buf *, struct mbuf *);
115void	ath_tx_proc(void *, int);
116int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
117void	ath_draintxq(struct ath_softc *);
118void	ath_stoprecv(struct ath_softc *);
119int	ath_startrecv(struct ath_softc *);
120void	ath_next_scan(void *);
121int	ath_set_slot_time(struct ath_softc *);
122void	ath_calibrate(void *);
123void	ath_ledstate(struct ath_softc *, enum ieee80211_state);
124int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
125void	ath_newassoc(struct ieee80211com *,
   struct ieee80211_node *, int);
127int	ath_getchannels(struct ath_softc *, HAL_BOOL outdoor,
   HAL_BOOL xchanmode);
129int	ath_rate_setup(struct ath_softc *sc, u_int mode);
130void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
131void	ath_rssadapt_updatenode(void *, struct ieee80211_node *);
132void	ath_rssadapt_updatestats(void *);
133#ifndef IEEE80211_STA_ONLY
134void	ath_recv_mgmt(struct ieee80211com *, struct mbuf *,
   struct ieee80211_node *, struct ieee80211_rxinfo *, int);
136#endif
137void	ath_disable(struct ath_softc *);

139int	ath_gpio_attach(struct ath_softc *, u_int16_t);
140int	ath_gpio_pin_read(void *, int);
141void	ath_gpio_pin_write(void *, int, int);
142void	ath_gpio_pin_ctl(void *, int, int);

144#ifdef AR_DEBUG
145void	ath_printrxbuf(struct ath_buf *, int);
146void	ath_printtxbuf(struct ath_buf *, int);
147int ath_debug = 0;
148#endif

150int ath_dwelltime = 200;		/* 5 channels/second */
151int ath_calinterval = 30;		/* calibrate every 30 secs */
152int ath_outdoor = AH_TRUE;		/* outdoor operation */
153int ath_xchanmode = AH_TRUE;		/* enable extended channels */
154int ath_softcrypto = 1;			/* 1=enable software crypto */

156struct cfdriver ath_cd = {
NULL((void *)0), "ath", DV_IFNET
158};

160int
161ath_activate(struct device *self, int act)
162{
struct ath_softc *sc = (struct ath_softc *)self;
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;

switch (act) {
case DVACT_SUSPEND3:
if (ifp->if_flags & IFF_RUNNING0x40) {
	ath_stop(ifp);
	if (sc->sc_power != NULL((void *)0))
		(*sc->sc_power)(sc, act);
}
break;
case DVACT_RESUME4:
if (ifp->if_flags & IFF_UP0x1) {
	ath_init(ifp);
	if (ifp->if_flags & IFF_RUNNING0x40)
		ath_start(ifp);
}
break;
}
return 0;
183}

185int
186ath_enable(struct ath_softc *sc)
187{
if (ATH_IS_ENABLED(sc)((sc)->sc_flags & 0x0002) == 0) {
if (sc->sc_enable != NULL((void *)0) && (*sc->sc_enable)(sc) != 0) {
	printf("%s: device enable failed\n",
		sc->sc_dev.dv_xname);
	return (EIO5);
}
sc->sc_flags |= ATH_ENABLED0x0002;
}
return (0);
197}

199void
200ath_disable(struct ath_softc *sc)
201{
if (!ATH_IS_ENABLED(sc)((sc)->sc_flags & 0x0002))
return;
if (sc->sc_disable != NULL((void *)0))
(*sc->sc_disable)(sc);
sc->sc_flags &= ~ATH_ENABLED0x0002;
207}

209int
210ath_attach(u_int16_t devid, struct ath_softc *sc)
211{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_hal *ah;
HAL_STATUS status;
HAL_TXQ_INFO qinfo;
int error = 0, i;

DPRINTF(ATH_DEBUG_ANY, ("%s: devid 0x%x\n", __func__, devid));

bcopy(sc->sc_dev.dv_xname, ifp->if_xname, IFNAMSIZ16);
sc->sc_flags &= ~ATH_ATTACHED0x0001;	/* make sure that it's not attached */

ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh,
   sc->sc_pcie, &status);
if (ah == NULL((void *)0)) {
printf("%s: unable to attach hardware; HAL status %d\n",
	ifp->if_xname, status);
error = ENXIO6;
goto bad;
}
if (ah->ah_abi != HAL_ABI_VERSION0x04090901) {
printf("%s: HAL ABI mismatch detected (0x%x != 0x%x)\n",
	ifp->if_xname, ah->ah_abi, HAL_ABI_VERSION0x04090901);
error = ENXIO6;
goto bad;
}

if (ah->ah_single_chip == AH_TRUE) {
printf("%s: AR%s %u.%u phy %u.%u rf %u.%u", ifp->if_xname,
    ar5k_printver(AR5K_VERSION_DEV, devid),
    ah->ah_mac_version, ah->ah_mac_revision,
    ah->ah_phy_revision >> 4, ah->ah_phy_revision & 0xf,
    ah->ah_radio_5ghz_revision >> 4,
    ah->ah_radio_5ghz_revision & 0xf);
} else {
printf("%s: AR%s %u.%u phy %u.%u", ifp->if_xname,
    ar5k_printver(AR5K_VERSION_VER, ah->ah_mac_srev),
    ah->ah_mac_version, ah->ah_mac_revision,
    ah->ah_phy_revision >> 4, ah->ah_phy_revision & 0xf);
printf(" rf%s %u.%u",
    ar5k_printver(AR5K_VERSION_RAD, ah->ah_radio_5ghz_revision),
    ah->ah_radio_5ghz_revision >> 4,
    ah->ah_radio_5ghz_revision & 0xf);
if (ah->ah_radio_2ghz_revision != 0) {
	printf(" rf%s %u.%u",
	    ar5k_printver(AR5K_VERSION_RAD,
	    ah->ah_radio_2ghz_revision),
	    ah->ah_radio_2ghz_revision >> 4,
	    ah->ah_radio_2ghz_revision & 0xf);
}
}
if (ah->ah_ee_versionah_capabilities.cap_eeprom.ee_version == AR5K_EEPROM_VERSION_4_70x3007)
printf(" eeprom 4.7");
else
printf(" eeprom %1x.%1x", ah->ah_ee_versionah_capabilities.cap_eeprom.ee_version >> 12,
    ah->ah_ee_versionah_capabilities.cap_eeprom.ee_version & 0xff);

269#if 0
if (ah->ah_radio_5ghz_revision >= AR5K_SREV_RAD_UNSUPP0xff ||
   ah->ah_radio_2ghz_revision >= AR5K_SREV_RAD_UNSUPP0xff) {
printf(": RF radio not supported\n");
error = EOPNOTSUPP45;
goto bad;
}
276#endif

sc->sc_ah = ah;
sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */

/*
* Get regulation domain either stored in the EEPROM or defined
* as the default value. Some devices are known to have broken
* regulation domain values in their EEPROM.
*/
ath_hal_get_regdomain(ah, &ah->ah_regdomain)(*(&ah->ah_capabilities.cap_regdomain.reg_current) = (
ah)->ah_get_regdomain(ah));

/*
* Construct channel list based on the current regulation domain.
*/
error = ath_getchannels(sc, ath_outdoor, ath_xchanmode);
if (error != 0)
goto bad;

/*
* Setup rate tables for all potential media types.
*/
ath_rate_setup(sc, IEEE80211_MODE_11A);
ath_rate_setup(sc, IEEE80211_MODE_11B);
ath_rate_setup(sc, IEEE80211_MODE_11G);

error = ath_desc_alloc(sc);
if (error != 0) {
printf(": failed to allocate descriptors: %d\n", error);
goto bad;
}
timeout_set(&sc->sc_scan_to, ath_next_scan, sc);
timeout_set(&sc->sc_cal_to, ath_calibrate, sc);
timeout_set(&sc->sc_rssadapt_to, ath_rssadapt_updatestats, sc);

311#ifdef __FreeBSD__
ATH_TXBUF_LOCK_INIT(sc)mtx_init;
ATH_TXQ_LOCK_INIT(sc)mtx_init;
314#endif

ATH_TASK_INIT(&sc->sc_txtask, ath_tx_proc, sc)do { (&sc->sc_txtask)->t_func = (ath_tx_proc); (&
sc->sc_txtask)->t_context = (sc); } while (0);
ATH_TASK_INIT(&sc->sc_rxtask, ath_rx_proc, sc)do { (&sc->sc_rxtask)->t_func = (ath_rx_proc); (&
sc->sc_rxtask)->t_context = (sc); } while (0);
ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc)do { (&sc->sc_rxorntask)->t_func = (ath_rxorn_proc)
; (&sc->sc_rxorntask)->t_context = (sc); } while (0
);
ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc)do { (&sc->sc_fataltask)->t_func = (ath_fatal_proc)
; (&sc->sc_fataltask)->t_context = (sc); } while (0
);
ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc)do { (&sc->sc_bmisstask)->t_func = (ath_bmiss_proc)
; (&sc->sc_bmisstask)->t_context = (sc); } while (0
);
321#ifndef IEEE80211_STA_ONLY
ATH_TASK_INIT(&sc->sc_swbatask, ath_beacon_proc, sc)do { (&sc->sc_swbatask)->t_func = (ath_beacon_proc)
; (&sc->sc_swbatask)->t_context = (sc); } while (0);
323#endif

/*
* For now just pre-allocate one data queue and one
* beacon queue.  Note that the HAL handles resetting
* them at the needed time.  Eventually we'll want to
* allocate more tx queues for splitting management
* frames and for QOS support.
*/
sc->sc_bhalq = ath_hal_setup_tx_queue(ah, HAL_TX_QUEUE_BEACON, NULL)((*(ah)->ah_setup_tx_queue)((ah), (HAL_TX_QUEUE_BEACON), (
((void *)0))));
if (sc->sc_bhalq == (u_int) -1) {
printf(": unable to setup a beacon xmit queue!\n");
goto bad2;
}

for (i = 0; i <= HAL_TX_QUEUE_ID_DATA_MAX; i++) {
bzero(&qinfo, sizeof(qinfo))__builtin_bzero((&qinfo), (sizeof(qinfo)));
qinfo.tqi_type = HAL_TX_QUEUE_DATA;
qinfo.tqi_subtype = i; /* should be mapped to WME types */
sc->sc_txhalq[i] = ath_hal_setup_tx_queue(ah,((*(ah)->ah_setup_tx_queue)((ah), (HAL_TX_QUEUE_DATA), (&
qinfo)))
    HAL_TX_QUEUE_DATA, &qinfo)((*(ah)->ah_setup_tx_queue)((ah), (HAL_TX_QUEUE_DATA), (&
qinfo)));
if (sc->sc_txhalq[i] == (u_int) -1) {
	printf(": unable to setup a data xmit queue %u!\n", i);
	goto bad2;
}
}

ifp->if_softc = sc;
ifp->if_flags = IFF_SIMPLEX0x800 | IFF_BROADCAST0x2 | IFF_MULTICAST0x8000;
ifp->if_start = ath_start;
ifp->if_watchdog = ath_watchdog;
ifp->if_ioctl = ath_ioctl;
355#ifndef __OpenBSD__1
ifp->if_stop = ath_stop;		/* XXX */
357#endif
ifq_set_maxlen(&ifp->if_snd, ATH_TXBUF * ATH_TXDESC)((&ifp->if_snd)->ifq_maxlen = (60 * 8));

ic->ic_softcic_ac.ac_if.if_softc = sc;
ic->ic_newassoc = ath_newassoc;
/* XXX not right but it's not used anywhere important */
ic->ic_phytype = IEEE80211_T_OFDM;
ic->ic_opmode = IEEE80211_M_STA;
ic->ic_caps = IEEE80211_C_WEP0x00000001	/* wep supported */
   | IEEE80211_C_PMGT0x00000004		/* power management */
367#ifndef IEEE80211_STA_ONLY
   | IEEE80211_C_IBSS0x00000002		/* ibss, nee adhoc, mode */
   | IEEE80211_C_HOSTAP0x00000008	/* hostap mode */
370#endif
   | IEEE80211_C_MONITOR0x00000200	/* monitor mode */
   | IEEE80211_C_SHSLOT0x00000080	/* short slot time supported */
   | IEEE80211_C_SHPREAMBLE0x00000100;	/* short preamble supported */
if (ath_softcrypto)
ic->ic_caps |= IEEE80211_C_RSN0x00001000;	/* wpa/rsn supported */

/*
* Not all chips have the VEOL support we want to use with
* IBSS beacon; check here for it.
*/
sc->sc_veol = ath_hal_has_veol(ah)((*(ah)->ah_has_veol)((ah)));

/* get mac address from hardware */
ath_hal_get_lladdr(ah, ic->ic_myaddr)((*(ah)->ah_get_lladdr)((ah), (ic->ic_myaddr)));

if_attach(ifp);

/* call MI attach routine. */
ieee80211_ifattach(ifp);

/* override default methods */
ic->ic_node_alloc = ath_node_alloc;
sc->sc_node_free = ic->ic_node_free;
ic->ic_node_free = ath_node_free;
sc->sc_node_copy = ic->ic_node_copy;
ic->ic_node_copy = ath_node_copy;
ic->ic_node_getrssi = ath_node_getrssi;
sc->sc_newstate = ic->ic_newstate;
ic->ic_newstate = ath_newstate;
400#ifndef IEEE80211_STA_ONLY
sc->sc_recv_mgmt = ic->ic_recv_mgmt;
ic->ic_recv_mgmt = ath_recv_mgmt;
403#endif
ic->ic_max_rssi = AR5K_MAX_RSSI64;
bcopy(etherbroadcastaddr, sc->sc_broadcast_addr, IEEE80211_ADDR_LEN6);

/* complete initialization */
ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);

410#if NBPFILTER1 > 0
bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO127,
   sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN64);

sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
bzero(&sc->sc_rxtapu, sc->sc_rxtap_len)__builtin_bzero((&sc->sc_rxtapu), (sc->sc_rxtap_len
));
sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_len = htole16(sc->sc_rxtap_len)((__uint16_t)(sc->sc_rxtap_len));
sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT)((__uint32_t)(( (1 << IEEE80211_RADIOTAP_FLAGS) | (1 <<
 IEEE80211_RADIOTAP_RATE) | (1 << IEEE80211_RADIOTAP_CHANNEL
) | (1 << IEEE80211_RADIOTAP_ANTENNA) | (1 << IEEE80211_RADIOTAP_RSSI
) | 0)));

sc->sc_txtap_len = sizeof(sc->sc_txtapu);
bzero(&sc->sc_txtapu, sc->sc_txtap_len)__builtin_bzero((&sc->sc_txtapu), (sc->sc_txtap_len
));
sc->sc_txtapsc_txtapu.th.wt_ihdr.it_len = htole16(sc->sc_txtap_len)((__uint16_t)(sc->sc_txtap_len));
sc->sc_txtapsc_txtapu.th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT)((__uint32_t)(( (1 << IEEE80211_RADIOTAP_FLAGS) | (1 <<
 IEEE80211_RADIOTAP_RATE) | (1 << IEEE80211_RADIOTAP_CHANNEL
) | (1 << IEEE80211_RADIOTAP_DBM_TX_POWER) | (1 <<
 IEEE80211_RADIOTAP_ANTENNA) | 0)));
423#endif

sc->sc_flags |= ATH_ATTACHED0x0001;

/*
* Print regulation domain and the mac address. The regulation domain
* will be marked with a * if the EEPROM value has been overwritten.
*/
printf(", %s%s, address %s\n",
   ieee80211_regdomain2name(ah->ah_regdomainah_capabilities.cap_regdomain.reg_current),
   ah->ah_regdomainah_capabilities.cap_regdomain.reg_current != ah->ah_regdomain_hwah_capabilities.cap_regdomain.reg_hw ? "*" : "",
   ether_sprintf(ic->ic_myaddr));

if (ath_gpio_attach(sc, devid) == 0)
sc->sc_flags |= ATH_GPIO0x0004;

return 0;
440bad2:
ath_desc_free(sc);
442bad:
if (ah)
ath_hal_detach(ah)((*(ah)->ah_detach)(ah));
sc->sc_invalid = 1;
return error;
447}

449int
450ath_detach(struct ath_softc *sc, int flags)
451{
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
int s;

if ((sc->sc_flags & ATH_ATTACHED0x0001) == 0)
return (0);

config_detach_children(&sc->sc_dev, flags);

DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));

timeout_del(&sc->sc_scan_to);
timeout_del(&sc->sc_cal_to);
timeout_del(&sc->sc_rssadapt_to);

s = splnet()splraise(0x7);
ath_stop(ifp);
ath_desc_free(sc);
ath_hal_detach(sc->sc_ah)((*(sc->sc_ah)->ah_detach)(sc->sc_ah));

ieee80211_ifdetach(ifp);
if_detach(ifp);

splx(s)spllower(s);
475#ifdef __FreeBSD__
ATH_TXBUF_LOCK_DESTROY(sc)mtx_destroy(&(sc)->sc_txbuflock);
ATH_TXQ_LOCK_DESTROY(sc)mtx_destroy(&(sc)->sc_txqlock);
478#endif

return 0;
481}

483int
484ath_intr(void *arg)
485{
return ath_intr1((struct ath_softc *)arg);
487}

489int
490ath_intr1(struct ath_softc *sc)
491{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_hal *ah = sc->sc_ah;
HAL_INT status;

if (sc->sc_invalid) {
/*
 * The hardware is not ready/present, don't touch anything.
 * Note this can happen early on if the IRQ is shared.
 */
DPRINTF(ATH_DEBUG_ANY, ("%s: invalid; ignored\n", __func__));
return 0;
}
if (!ath_hal_is_intr_pending(ah)((*(ah)->ah_is_intr_pending)((ah))))		/* shared irq, not for us */
return 0;
if ((ifp->if_flags & (IFF_RUNNING0x40|IFF_UP0x1)) != (IFF_RUNNING0x40|IFF_UP0x1)) {
DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
    __func__, ifp->if_flags));
ath_hal_get_isr(ah, &status)((*(ah)->ah_get_isr)((ah), (&status)));	/* clear ISR */
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));		/* disable further intr's */
return 1; /* XXX */
}
ath_hal_get_isr(ah, &status)((*(ah)->ah_get_isr)((ah), (&status)));		/* NB: clears ISR too */
DPRINTF(ATH_DEBUG_INTR, ("%s: status 0x%x\n", __func__, status));
status &= sc->sc_imask;			/* discard unasked for bits */
if (status & HAL_INT_FATAL0x40000000) {
sc->sc_stats.ast_hardware++;
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));		/* disable intr's until reset */
ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_fataltask)((*(&sc->sc_fataltask)->t_func)((&sc->sc_fataltask
)->t_context, 1));
} else if (status & HAL_INT_RXORN0x00000020) {
sc->sc_stats.ast_rxorn++;
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));		/* disable intr's until reset */
ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxorntask)((*(&sc->sc_rxorntask)->t_func)((&sc->sc_rxorntask
)->t_context, 1));
} else if (status & HAL_INT_MIB0x00001000) {
DPRINTF(ATH_DEBUG_INTR,
    ("%s: resetting MIB counters\n", __func__));
sc->sc_stats.ast_mib++;
ath_hal_update_mib_counters(ah, &sc->sc_mib_stats)((*(ah)->ah_update_mib_counters)((ah), (&sc->sc_mib_stats
)));
} else {
if (status & HAL_INT_RXEOL0x00000010) {
	/*
	 * NB: the hardware should re-read the link when
	 *     RXE bit is written, but it doesn't work at
	 *     least on older hardware revs.
	 */
	sc->sc_stats.ast_rxeol++;
	sc->sc_rxlink = NULL((void *)0);
}
if (status & HAL_INT_TXURN0x00000800) {
	sc->sc_stats.ast_txurn++;
	/* bump tx trigger level */
	ath_hal_update_tx_triglevel(ah, AH_TRUE)((*(ah)->ah_update_tx_triglevel)((ah), (AH_TRUE)));
}
if (status & HAL_INT_RX0x00000001)
	ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask)((*(&sc->sc_rxtask)->t_func)((&sc->sc_rxtask
)->t_context, 1));
if (status & HAL_INT_TX0x00000040)
	ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask)((*(&sc->sc_txtask)->t_func)((&sc->sc_txtask
)->t_context, 1));
if (status & HAL_INT_SWBA0x00010000)
	ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_swbatask)((*(&sc->sc_swbatask)->t_func)((&sc->sc_swbatask
)->t_context, 1));
if (status & HAL_INT_BMISS0x00040000) {
	sc->sc_stats.ast_bmiss++;
	ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask)((*(&sc->sc_bmisstask)->t_func)((&sc->sc_bmisstask
)->t_context, 1));
}
}
return 1;
557}

559void
560ath_fatal_proc(void *arg, int pending)
561{
struct ath_softc *sc = arg;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;

if (ifp->if_flags & IFF_DEBUG0x4)
printf("%s: hardware error; resetting\n", ifp->if_xname);
ath_reset(sc, 1);
569}

571void
572ath_rxorn_proc(void *arg, int pending)
573{
struct ath_softc *sc = arg;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;

if (ifp->if_flags & IFF_DEBUG0x4)
printf("%s: rx FIFO overrun; resetting\n", ifp->if_xname);
ath_reset(sc, 1);
581}

583void
584ath_bmiss_proc(void *arg, int pending)
585{
struct ath_softc *sc = arg;
struct ieee80211com *ic = &sc->sc_ic;

DPRINTF(ATH_DEBUG_ANY, ("%s: pending %u\n", __func__, pending));
if (ic->ic_opmode != IEEE80211_M_STA)
return;
if (ic->ic_state == IEEE80211_S_RUN) {
/*
 * Rather than go directly to scan state, try to
 * reassociate first.  If that fails then the state
 * machine will drop us into scanning after timing
 * out waiting for a probe response.
 */
ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_ASSOC), (-1)));
}
601}

603int
604ath_init(struct ifnet *ifp)
605{
return ath_init1((struct ath_softc *)ifp->if_softc);
607}

609int
610ath_init1(struct ath_softc *sc)
611{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ieee80211_node *ni;
enum ieee80211_phymode mode;
struct ath_hal *ah = sc->sc_ah;
HAL_STATUS status;
HAL_CHANNEL hchan;
int error = 0, s;

DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
   __func__, ifp->if_flags));

if ((error = ath_enable(sc)) != 0)
return error;

s = splnet()splraise(0x7);
/*
* Stop anything previously setup.  This is safe
* whether this is the first time through or not.
*/
ath_stop(ifp);

/*
* Reset the link layer address to the latest value.
*/
IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl))__builtin_memcpy((ic->ic_myaddr), (((caddr_t)((ifp->if_sadl
)->sdl_data + (ifp->if_sadl)->sdl_nlen))), (6));
ath_hal_set_lladdr(ah, ic->ic_myaddr)((*(ah)->ah_set_lladdr)((ah), (ic->ic_myaddr)));

/*
* The basic interface to setting the hardware in a good
* state is ``reset''.  On return the hardware is known to
* be powered up and with interrupts disabled.  This must
* be followed by initialization of the appropriate bits
* and then setup of the interrupt mask.
*/
hchan.channel = ic->ic_ibss_chan->ic_freq;
hchan.channelFlags = ic->ic_ibss_chan->ic_flags;
if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)((*(ah)->ah_reset)((ah), (ic->ic_opmode), (&hchan),
 (AH_TRUE), (&status)))) {
printf("%s: unable to reset hardware; hal status %u\n",
	ifp->if_xname, status);
error = EIO5;
goto done;
}
ath_set_slot_time(sc);

if ((error = ath_initkeytable(sc)) != 0) {
printf("%s: unable to reset the key cache\n",
    ifp->if_xname);
goto done;
}

if ((error = ath_startrecv(sc)) != 0) {
printf("%s: unable to start recv logic\n", ifp->if_xname);
goto done;
}

/*
* Enable interrupts.
*/
sc->sc_imask = HAL_INT_RX0x00000001 | HAL_INT_TX0x00000040
   | HAL_INT_RXEOL0x00000010 | HAL_INT_RXORN0x00000020
   | HAL_INT_FATAL0x40000000 | HAL_INT_GLOBAL0x80000000;
674#ifndef IEEE80211_STA_ONLY
if (ic->ic_opmode == IEEE80211_M_HOSTAP)
sc->sc_imask |= HAL_INT_MIB0x00001000;
677#endif
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));

ifp->if_flags |= IFF_RUNNING0x40;
ic->ic_state = IEEE80211_S_INIT;

/*
* The hardware should be ready to go now so it's safe
* to kick the 802.11 state machine as it's likely to
* immediately call back to us to send mgmt frames.
*/
ni = ic->ic_bss;
ni->ni_chan = ic->ic_ibss_chan;
mode = ieee80211_chan2mode(ic, ni->ni_chan);
if (mode != sc->sc_curmode)
ath_setcurmode(sc, mode);
if (ic->ic_opmode != IEEE80211_M_MONITOR) {
ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
} else {
ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
}
698done:
splx(s)spllower(s);
return error;
701}

703void
704ath_stop(struct ifnet *ifp)
705{
struct ieee80211com *ic = (struct ieee80211com *) ifp;
struct ath_softc *sc = ifp->if_softc;
struct ath_hal *ah = sc->sc_ah;
int s;

DPRINTF(ATH_DEBUG_ANY, ("%s: invalid %u if_flags 0x%x\n",
   __func__, sc->sc_invalid, ifp->if_flags));

s = splnet()splraise(0x7);
if (ifp->if_flags & IFF_RUNNING0x40) {
/*
 * Shutdown the hardware and driver:
 *    disable interrupts
 *    turn off timers
 *    clear transmit machinery
 *    clear receive machinery
 *    drain and release tx queues
 *    reclaim beacon resources
 *    reset 802.11 state machine
 *    power down hardware
 *
 * Note that some of this work is not possible if the
 * hardware is gone (invalid).
 */
ifp->if_flags &= ~IFF_RUNNING0x40;
ifp->if_timer = 0;
if (!sc->sc_invalid)
	ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));
ath_draintxq(sc);
if (!sc->sc_invalid) {
	ath_stoprecv(sc);
} else {
	sc->sc_rxlink = NULL((void *)0);
}
ifq_purge(&ifp->if_snd);
741#ifndef IEEE80211_STA_ONLY
ath_beacon_free(sc);
743#endif
ieee80211_new_state(ic, IEEE80211_S_INIT, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_INIT), (-1)));
if (!sc->sc_invalid) {
	ath_hal_set_power(ah, HAL_PM_FULL_SLEEP, 0)((*(ah)->ah_set_power)((ah), (HAL_PM_FULL_SLEEP), AH_TRUE,
 (0)));
}
ath_disable(sc);
}
splx(s)spllower(s);
751}

753/*
* Reset the hardware w/o losing operational state.  This is
* basically a more efficient way of doing ath_stop, ath_init,
* followed by state transitions to the current 802.11
* operational state.  Used to recover from errors rx overrun
* and to reset the hardware when rf gain settings must be reset.
*/
760void
761ath_reset(struct ath_softc *sc, int full)
762{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_hal *ah = sc->sc_ah;
struct ieee80211_channel *c;
HAL_STATUS status;
HAL_CHANNEL hchan;

/*
* Convert to a HAL channel description.
*/
c = ic->ic_ibss_chan;
hchan.channel = c->ic_freq;
hchan.channelFlags = c->ic_flags;

ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));		/* disable interrupts */
ath_draintxq(sc);		/* stop xmit side */
ath_stoprecv(sc);		/* stop recv side */
/* NB: indicate channel change so we do a full reset */
if (!ath_hal_reset(ah, ic->ic_opmode, &hchan,((*(ah)->ah_reset)((ah), (ic->ic_opmode), (&hchan),
 (full ? AH_TRUE : AH_FALSE), (&status)))
   full ? AH_TRUE : AH_FALSE, &status)((*(ah)->ah_reset)((ah), (ic->ic_opmode), (&hchan),
 (full ? AH_TRUE : AH_FALSE), (&status)))) {
printf("%s: %s: unable to reset hardware; hal status %u\n",
	ifp->if_xname, __func__, status);
}
ath_set_slot_time(sc);
/* In case channel changed, save as a node channel */
ic->ic_bss->ni_chan = ic->ic_ibss_chan;
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
if (ath_startrecv(sc) != 0)	/* restart recv */
printf("%s: %s: unable to start recv logic\n", ifp->if_xname,
    __func__);
ath_start(ifp);			/* restart xmit */
if (ic->ic_state == IEEE80211_S_RUN)
ath_beacon_config(sc);	/* restart beacons */
796}

798void
799ath_start(struct ifnet *ifp)
800{
struct ath_softc *sc = ifp->if_softc;
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
struct ieee80211_node *ni;
struct ath_buf *bf;
struct mbuf *m;
struct ieee80211_frame *wh;
int s;

if (!(ifp->if_flags & IFF_RUNNING0x40) || ifq_is_oactive(&ifp->if_snd) ||
   sc->sc_invalid)
return;
for (;;) {
/*
 * Grab a TX buffer and associated resources.
 */
s = splnet()splraise(0x7);
bf = TAILQ_FIRST(&sc->sc_txbuf)((&sc->sc_txbuf)->tqh_first);
if (bf != NULL((void *)0))
	TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list)do { if (((bf)->bf_list.tqe_next) != ((void *)0)) (bf)->
bf_list.tqe_next->bf_list.tqe_prev = (bf)->bf_list.tqe_prev
; else (&sc->sc_txbuf)->tqh_last = (bf)->bf_list
.tqe_prev; *(bf)->bf_list.tqe_prev = (bf)->bf_list.tqe_next
; ((bf)->bf_list.tqe_prev) = ((void *)-1); ((bf)->bf_list
.tqe_next) = ((void *)-1); } while (0);
splx(s)spllower(s);
if (bf == NULL((void *)0)) {
	DPRINTF(ATH_DEBUG_ANY, ("%s: out of xmit buffers\n",
	    __func__));
	sc->sc_stats.ast_tx_qstop++;
	ifq_set_oactive(&ifp->if_snd);
	break;
}
/*
 * Poll the management queue for frames; they
 * have priority over normal data frames.
 */
m = mq_dequeue(&ic->ic_mgtq);
if (m == NULL((void *)0)) {
	/*
	 * No data frames go out unless we're associated.
	 */
	if (ic->ic_state != IEEE80211_S_RUN) {
		DPRINTF(ATH_DEBUG_ANY,
		    ("%s: ignore data packet, state %u\n",
		    __func__, ic->ic_state));
		sc->sc_stats.ast_tx_discard++;
		s = splnet()splraise(0x7);
		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
		splx(s)spllower(s);
		break;
	}
	m = ifq_dequeue(&ifp->if_snd);
	if (m == NULL((void *)0)) {
		s = splnet()splraise(0x7);
		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
		splx(s)spllower(s);
		break;
	}

856#if NBPFILTER1 > 0
	if (ifp->if_bpf)
		bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT(1 << 1));
859#endif

	/*
	 * Encapsulate the packet in prep for transmission.
	 */
	m = ieee80211_encap(ifp, m, &ni);
	if (m == NULL((void *)0)) {
		DPRINTF(ATH_DEBUG_ANY,
		    ("%s: encapsulation failure\n",
		    __func__));
		sc->sc_stats.ast_tx_encap++;
		goto bad;
	}
	wh = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));
} else {
	ni = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_cookie;

	wh = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));
	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK0xf0) ==
	    IEEE80211_FC0_SUBTYPE_PROBE_RESP0x50) {
		/* fill time stamp */
		u_int64_t tsf;
		u_int32_t *tstamp;

		tsf = ath_hal_get_tsf64(ah)((*(ah)->ah_get_tsf64)((ah)));
		/* XXX: adjust 100us delay to xmit */
		tsf += 100;
		tstamp = (u_int32_t *)&wh[1];
		tstamp[0] = htole32(tsf & 0xffffffff)((__uint32_t)(tsf & 0xffffffff));
		tstamp[1] = htole32(tsf >> 32)((__uint32_t)(tsf >> 32));
	}
	sc->sc_stats.ast_tx_mgmt++;
}

if (ath_tx_start(sc, ni, bf, m)) {
bad:
	s = splnet()splraise(0x7);
	TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
	splx(s)spllower(s);
	ifp->if_oerrorsif_data.ifi_oerrors++;
	if (ni != NULL((void *)0))
		ieee80211_release_node(ic, ni);
	continue;
}

sc->sc_tx_timer = 5;
ifp->if_timer = 1;
}
907}

909int
910ath_media_change(struct ifnet *ifp)
911{
int error;

error = ieee80211_media_change(ifp);
if (error == ENETRESET52) {
if ((ifp->if_flags & (IFF_RUNNING0x40|IFF_UP0x1)) ==
    (IFF_RUNNING0x40|IFF_UP0x1))
	ath_init(ifp);		/* XXX lose error */
error = 0;
}
return error;
922}

924void
925ath_watchdog(struct ifnet *ifp)
926{
struct ath_softc *sc = ifp->if_softc;

ifp->if_timer = 0;
if ((ifp->if_flags & IFF_RUNNING0x40) == 0 || sc->sc_invalid)
return;
if (sc->sc_tx_timer) {
if (--sc->sc_tx_timer == 0) {
	printf("%s: device timeout\n", ifp->if_xname);
	ath_reset(sc, 1);
	ifp->if_oerrorsif_data.ifi_oerrors++;
	sc->sc_stats.ast_watchdog++;
	return;
}
ifp->if_timer = 1;
}

ieee80211_watchdog(ifp);
944}

946int
947ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
948{
struct ath_softc *sc = ifp->if_softc;
struct ieee80211com *ic = &sc->sc_ic;
struct ifreq *ifr = (struct ifreq *)data;
int error = 0, s;

s = splnet()splraise(0x7);
switch (cmd) {
case SIOCSIFADDR((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((12))):
ifp->if_flags |= IFF_UP0x1;
/* FALLTHROUGH */
case SIOCSIFFLAGS((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((16))):
if (ifp->if_flags & IFF_UP0x1) {
	if (ifp->if_flags & IFF_RUNNING0x40) {
		/*
		 * To avoid rescanning another access point,
		 * do not call ath_init() here.  Instead,
		 * only reflect promisc mode settings.
		 */
		ath_mode_init(sc);
	} else {
		/*
		 * Beware of being called during detach to
		 * reset promiscuous mode.  In that case we
		 * will still be marked UP but not RUNNING.
		 * However trying to re-init the interface
		 * is the wrong thing to do as we've already
		 * torn down much of our state.  There's
		 * probably a better way to deal with this.
		 */
		if (!sc->sc_invalid)
			ath_init(ifp);	/* XXX lose error */
	}
} else
	ath_stop(ifp);
break;
case SIOCADDMULTI((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((49))):
case SIOCDELMULTI((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((50))):
986#ifdef __FreeBSD__
/*
 * The upper layer has already installed/removed
 * the multicast address(es), just recalculate the
 * multicast filter for the card.
 */
if (ifp->if_flags & IFF_RUNNING0x40)
	ath_mode_init(sc);
994#endif
error = (cmd == SIOCADDMULTI((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((49)))) ?
    ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
    ether_delmulti(ifr, &sc->sc_ic.ic_ac);
if (error == ENETRESET52) {
	if (ifp->if_flags & IFF_RUNNING0x40)
		ath_mode_init(sc);
	error = 0;
}
break;
case SIOCGATHSTATS(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ifreq) & 0x1fff) << 16) | ((('i')) <<
 8) | ((137))):
error = copyout(&sc->sc_stats,
    ifr->ifr_dataifr_ifru.ifru_data, sizeof (sc->sc_stats));
break;
default:
error = ieee80211_ioctl(ifp, cmd, data);
if (error == ENETRESET52) {
	if ((ifp->if_flags & (IFF_RUNNING0x40|IFF_UP0x1)) ==
	    (IFF_RUNNING0x40|IFF_UP0x1)) {
		if (ic->ic_opmode != IEEE80211_M_MONITOR)
			ath_init(ifp);	/* XXX lose error */
		else
			ath_reset(sc, 1);
	}
	error = 0;
}
break;
}
splx(s)spllower(s);
return error;
1024}

1026/*
* Fill the hardware key cache with key entries.
*/
1029int
1030ath_initkeytable(struct ath_softc *sc)
1031{
struct ieee80211com *ic = &sc->sc_ic;
struct ath_hal *ah = sc->sc_ah;
int i;

if (ath_softcrypto) {
/*
 * Disable the hardware crypto engine and reset the key cache
 * to allow software crypto operation for WEP/RSN/WPA2
 */
if (ic->ic_flags & (IEEE80211_F_WEPON0x00000100|IEEE80211_F_RSNON0x00200000))
	(void)ath_hal_softcrypto(ah, AH_TRUE)((*(ah)->ah_softcrypto)((ah), (AH_TRUE)));
else
	(void)ath_hal_softcrypto(ah, AH_FALSE)((*(ah)->ah_softcrypto)((ah), (AH_FALSE)));
return (0);
}

/* WEP is disabled, we only support WEP in hardware yet */
if ((ic->ic_flags & IEEE80211_F_WEPON0x00000100) == 0)
return (0);

/*
* Setup the hardware after reset: the key cache is filled as
* needed and the receive engine is set going.  Frame transmit
* is handled entirely in the frame output path; there's nothing
* to do here except setup the interrupt mask.
*/

/* XXX maybe should reset all keys when !WEPON */
for (i = 0; i < IEEE80211_WEP_NKID4; i++) {
struct ieee80211_key *k = &ic->ic_nw_keys[i];
if (k->k_len == 0)
	ath_hal_reset_key(ah, i)((*(ah)->ah_reset_key)((ah), (i)));
else {
	HAL_KEYVAL hk;

	bzero(&hk, sizeof(hk))__builtin_bzero((&hk), (sizeof(hk)));
	/*
	 * Pad the key to a supported key length. It
	 * is always a good idea to use full-length
	 * keys without padded zeros but this seems
	 * to be the default behaviour used by many
	 * implementations.
	 */
	if (k->k_cipher == IEEE80211_CIPHER_WEP40)
		hk.wk_len = AR5K_KEYVAL_LENGTH_405;
	else if (k->k_cipher == IEEE80211_CIPHER_WEP104)
		hk.wk_len = AR5K_KEYVAL_LENGTH_10413;
	else
		return (EINVAL22);
	bcopy(k->k_key, hk.wk_key, hk.wk_len);

	if (ath_hal_set_key(ah, i, &hk)((*(ah)->ah_set_key)((ah), (i), (&hk), ((void *)0), AH_FALSE
)) != AH_TRUE)
		return (EINVAL22);
}
}

return (0);
1089}

1091void
1092ath_mcastfilter_accum(caddr_t dl, u_int32_t (*mfilt)[2])
1093{
u_int32_t val;
u_int8_t pos;

val = LE_READ_4(dl + 0)((u_int32_t) ((((u_int8_t *)(dl + 0))[0] ) | (((u_int8_t *)(dl
 + 0))[1] << 8) | (((u_int8_t *)(dl + 0))[2] << 16
) | (((u_int8_t *)(dl + 0))[3] << 24)));
pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
val = LE_READ_4(dl + 3)((u_int32_t) ((((u_int8_t *)(dl + 3))[0] ) | (((u_int8_t *)(dl
 + 3))[1] << 8) | (((u_int8_t *)(dl + 3))[2] << 16
) | (((u_int8_t *)(dl + 3))[3] << 24)));
pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
pos &= 0x3f;
(*mfilt)[pos / 32] |= (1 << (pos % 32));
1103}

1105void
1106ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
1107{
struct arpcom *ac = &sc->sc_ic.ic_ac;
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
struct ether_multi *enm;
struct ether_multistep estep;

if (ac->ac_multirangecnt > 0) {
/* XXX Punt on ranges. */
(*mfilt)[0] = (*mfilt)[1] = ~((u_int32_t)0);
ifp->if_flags |= IFF_ALLMULTI0x200;
return;
}

ETHER_FIRST_MULTI(estep, ac, enm)do { (estep).e_enm = ((&(ac)->ac_multiaddrs)->lh_first
); do { if ((((enm)) = ((estep)).e_enm) != ((void *)0)) ((estep
)).e_enm = ((((enm)))->enm_list.le_next); } while ( 0); } while
 ( 0);
while (enm != NULL((void *)0)) {
ath_mcastfilter_accum(enm->enm_addrlo, mfilt);
ETHER_NEXT_MULTI(estep, enm)do { if (((enm) = (estep).e_enm) != ((void *)0)) (estep).e_enm
 = (((enm))->enm_list.le_next); } while ( 0);
}
ifp->if_flags &= ~IFF_ALLMULTI0x200;
1126}

1128/*
* Calculate the receive filter according to the
* operating mode and state:
*
* o always accept unicast, broadcast, and multicast traffic
* o maintain current state of phy error reception
* o probe request frames are accepted only when operating in
*   hostap, adhoc, or monitor modes
* o enable promiscuous mode according to the interface state
* o accept beacons:
*   - when operating in adhoc mode so the 802.11 layer creates
*     node table entries for peers,
*   - when operating in station mode for collecting rssi data when
*     the station is otherwise quiet, or
*   - when scanning
*/
1144u_int32_t
1145ath_calcrxfilter(struct ath_softc *sc)
1146{
struct ieee80211com *ic = &sc->sc_ic;
struct ath_hal *ah = sc->sc_ah;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
u_int32_t rfilt;

rfilt = (ath_hal_get_rx_filter(ah)((*(ah)->ah_get_rx_filter)((ah))) & HAL_RX_FILTER_PHYERR0x00000100)
   | HAL_RX_FILTER_UCAST0x00000001 | HAL_RX_FILTER_BCAST0x00000004 | HAL_RX_FILTER_MCAST0x00000002;
if (ic->ic_opmode != IEEE80211_M_STA)
rfilt |= HAL_RX_FILTER_PROBEREQ0x00000080;
1156#ifndef IEEE80211_STA_ONLY
if (ic->ic_opmode != IEEE80211_M_AHDEMO)
1158#endif
rfilt |= HAL_RX_FILTER_BEACON0x00000010;
if (ifp->if_flags & IFF_PROMISC0x100)
rfilt |= HAL_RX_FILTER_PROM0x00000020;
return rfilt;
1163}

1165void
1166ath_mode_init(struct ath_softc *sc)
1167{
struct ath_hal *ah = sc->sc_ah;
u_int32_t rfilt, mfilt[2];

/* configure rx filter */
rfilt = ath_calcrxfilter(sc);
ath_hal_set_rx_filter(ah, rfilt)((*(ah)->ah_set_rx_filter)((ah), (rfilt)));

/* configure operational mode */
ath_hal_set_opmode(ah)((*(ah)->ah_set_opmode)((ah)));

/* calculate and install multicast filter */
mfilt[0] = mfilt[1] = 0;
ath_mcastfilter_compute(sc, &mfilt);
ath_hal_set_mcast_filter(ah, mfilt[0], mfilt[1])((*(ah)->ah_set_mcast_filter)((ah), (mfilt[0]), (mfilt[1])
));
DPRINTF(ATH_DEBUG_MODE, ("%s: RX filter 0x%x, MC filter %08x:%08x\n",
   __func__, rfilt, mfilt[0], mfilt[1]));
1184}

1186struct mbuf *
1187ath_getmbuf(int flags, int type, u_int pktlen)
1188{
struct mbuf *m;

KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen))if (!(pktlen <= (1 << 11))) panic ("802.11 packet too large: %u"
, pktlen);
1192#ifdef __FreeBSD__
if (pktlen <= MHLEN((256 - sizeof(struct m_hdr)) - sizeof(struct pkthdr))) {
MGETHDR(m, flags, type)m = m_gethdr((flags), (type));
} else {
m = m_getcl(flags, type, M_PKTHDR0x0002);
}
1198#else
MGETHDR(m, flags, type)m = m_gethdr((flags), (type));
if (m != NULL((void *)0) && pktlen > MHLEN((256 - sizeof(struct m_hdr)) - sizeof(struct pkthdr))) {
MCLGET(m, flags)(void) m_clget((m), (flags), (1 << 11));
if ((m->m_flagsm_hdr.mh_flags & M_EXT0x0001) == 0) {
	m_free(m);
	m = NULL((void *)0);
}
}
1207#endif
return m;
1209}

1211#ifndef IEEE80211_STA_ONLY
1212int
1213ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
1214{
struct ieee80211com *ic = &sc->sc_ic;
struct ath_hal *ah = sc->sc_ah;
struct ath_buf *bf;
struct ath_desc *ds;
struct mbuf *m;
int error;
u_int8_t rate;
const HAL_RATE_TABLE *rt;
u_int flags = 0;

bf = sc->sc_bcbuf;
if (bf->bf_m != NULL((void *)0)) {
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
m_freem(bf->bf_m);
bf->bf_m = NULL((void *)0);
bf->bf_node = NULL((void *)0);
}
/*
* NB: the beacon data buffer must be 32-bit aligned;
* we assume the mbuf routines will return us something
* with this alignment (perhaps should assert).
*/
m = ieee80211_beacon_alloc(ic, ni);
if (m == NULL((void *)0)) {
DPRINTF(ATH_DEBUG_BEACON, ("%s: cannot get mbuf/cluster\n",
    __func__));
sc->sc_stats.ast_be_nombuf++;
return ENOMEM12;
}

DPRINTF(ATH_DEBUG_BEACON, ("%s: m %p len %u\n", __func__, m, m->m_len));
error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m), (0x0001))
   BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m), (0x0001));
if (error != 0) {
m_freem(m);
return error;
}
KASSERT(bf->bf_nseg == 1,if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("%s: multi-segment packet; nseg %u"
, __func__, bf->bf_dmamap->dm_nsegs)
("%s: multi-segment packet; nseg %u", __func__, bf->bf_nseg))if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("%s: multi-segment packet; nseg %u"
, __func__, bf->bf_dmamap->dm_nsegs);
bf->bf_m = m;

/* setup descriptors */
ds = bf->bf_desc;
bzero(ds, sizeof(struct ath_desc))__builtin_bzero((ds), (sizeof(struct ath_desc)));

if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_veol) {
ds->ds_link = bf->bf_daddr;	/* link to self */
flags |= HAL_TXDESC_VEOL0x0020;
} else {
ds->ds_link = 0;
}
ds->ds_data = bf->bf_segsbf_dmamap->dm_segs[0].ds_addr;

DPRINTF(ATH_DEBUG_ANY, ("%s: segaddr %p seglen %u\n", __func__,
   (caddr_t)bf->bf_segs[0].ds_addr, (u_int)bf->bf_segs[0].ds_len));

/*
* Calculate rate code.
* XXX everything at min xmit rate
*/
rt = sc->sc_currates;
KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode))if (!(rt != ((void *)0))) panic ("no rate table, mode %u", sc
->sc_curmode);
if (ic->ic_flags & IEEE80211_F_SHPREAMBLE0x00040000) {
rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
} else {
rate = rt->info[0].rateCode;
}

flags = HAL_TXDESC_NOACK0x0002;
if (ic->ic_opmode == IEEE80211_M_IBSS)
flags |= HAL_TXDESC_VEOL0x0020;

if (!ath_hal_setup_tx_desc(ah, ds((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, sizeof(struct ieee80211_frame)	/* header length */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, HAL_PKT_TYPE_BEACON		/* Atheros packet type */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, 60				/* txpower XXX */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, rate, 1			/* series 0 rate/tries */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, HAL_TXKEYIX_INVALID		/* no encryption */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, 0				/* antenna mode */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, flags				/* no ack for beacons */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, 0				/* rts/cts rate */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
, 0				/* rts/cts duration */((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))
)((*(ah)->ah_setup_tx_desc)((ah), (ds), (m->M_dat.MH.MH_pkthdr
.len + 4), (sizeof(struct ieee80211_frame)), (HAL_PKT_TYPE_BEACON
), (60), (rate), (1), (((u_int32_t) - 1)), (0), (flags), (0),
 (0)))) {
printf("%s: ath_hal_setup_tx_desc failed\n", __func__);
return -1;
}
/* NB: beacon's BufLen must be a multiple of 4 bytes */
/* XXX verify mbuf data area covers this roundup */
if (!ath_hal_fill_tx_desc(ah, ds((*(ah)->ah_fill_tx_desc)((ah), (ds), (((((bf->bf_dmamap
->dm_segs[0].ds_len)+((4)-1))/(4))*(4))), (AH_TRUE), (AH_TRUE
)))
, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */((*(ah)->ah_fill_tx_desc)((ah), (ds), (((((bf->bf_dmamap
->dm_segs[0].ds_len)+((4)-1))/(4))*(4))), (AH_TRUE), (AH_TRUE
)))
, AH_TRUE				/* first segment */((*(ah)->ah_fill_tx_desc)((ah), (ds), (((((bf->bf_dmamap
->dm_segs[0].ds_len)+((4)-1))/(4))*(4))), (AH_TRUE), (AH_TRUE
)))
, AH_TRUE				/* last segment */((*(ah)->ah_fill_tx_desc)((ah), (ds), (((((bf->bf_dmamap
->dm_segs[0].ds_len)+((4)-1))/(4))*(4))), (AH_TRUE), (AH_TRUE
)))
)((*(ah)->ah_fill_tx_desc)((ah), (ds), (((((bf->bf_dmamap
->dm_segs[0].ds_len)+((4)-1))/(4))*(4))), (AH_TRUE), (AH_TRUE
)))) {
printf("%s: ath_hal_fill_tx_desc failed\n", __func__);
return -1;
}

/* XXX it is not appropriate to bus_dmamap_sync? -dcy */

return 0;
1316}

1318void
1319ath_beacon_proc(void *arg, int pending)
1320{
struct ath_softc *sc = arg;
struct ieee80211com *ic = &sc->sc_ic;
struct ath_buf *bf = sc->sc_bcbuf;
struct ath_hal *ah = sc->sc_ah;

DPRINTF(ATH_DEBUG_BEACON_PROC, ("%s: pending %u\n", __func__, pending));
if (ic->ic_opmode == IEEE80211_M_STA ||
   bf == NULL((void *)0) || bf->bf_m == NULL((void *)0)) {
DPRINTF(ATH_DEBUG_ANY, ("%s: ic_flags=%x bf=%p bf_m=%p\n",
    __func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
return;
}
/* TODO: update beacon to reflect PS poll state */
if (!ath_hal_stop_tx_dma(ah, sc->sc_bhalq)((*(ah)->ah_stop_tx_dma)((ah), (sc->sc_bhalq)))) {
DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
    __func__, sc->sc_bhalq));
}
bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x04))
   bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x04));

ath_hal_put_tx_buf(ah, sc->sc_bhalq, bf->bf_daddr)((*(ah)->ah_put_tx_buf)((ah), (sc->sc_bhalq), (bf->bf_daddr
)));
ath_hal_tx_start(ah, sc->sc_bhalq)((*(ah)->ah_tx_start)((ah), (sc->sc_bhalq)));
DPRINTF(ATH_DEBUG_BEACON_PROC,
   ("%s: TXDP%u = %p (%p)\n", __func__,
   sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
1346}

1348void
1349ath_beacon_free(struct ath_softc *sc)
1350{
struct ath_buf *bf = sc->sc_bcbuf;

if (bf->bf_m != NULL((void *)0)) {
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
m_freem(bf->bf_m);
bf->bf_m = NULL((void *)0);
bf->bf_node = NULL((void *)0);
}
1359}
1360#endif	/* IEEE80211_STA_ONLY */

1362/*
* Configure the beacon and sleep timers.
*
* When operating as an AP this resets the TSF and sets
* up the hardware to notify us when we need to issue beacons.
*
* When operating in station mode this sets up the beacon
* timers according to the timestamp of the last received
* beacon and the current TSF, configures PCF and DTIM
* handling, programs the sleep registers so the hardware
* will wakeup in time to receive beacons, and configures
* the beacon miss handling so we'll receive a BMISS
* interrupt when we stop seeing beacons from the AP
* we've associated with.
*/
1377void
1378ath_beacon_config(struct ath_softc *sc)
1379{
1380#define MS_TO_TU(x)(((x) * 1000) / 1024)	(((x) * 1000) / 1024)
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
struct ieee80211_node *ni = ic->ic_bss;
u_int32_t nexttbtt, intval;

nexttbtt = (LE_READ_4(ni->ni_tstamp + 4)((u_int32_t) ((((u_int8_t *)(ni->ni_tstamp + 4))[0] ) | ((
(u_int8_t *)(ni->ni_tstamp + 4))[1] << 8) | (((u_int8_t
 *)(ni->ni_tstamp + 4))[2] << 16) | (((u_int8_t *)(ni
->ni_tstamp + 4))[3] << 24))) << 22) |
   (LE_READ_4(ni->ni_tstamp)((u_int32_t) ((((u_int8_t *)(ni->ni_tstamp))[0] ) | (((u_int8_t
 *)(ni->ni_tstamp))[1] << 8) | (((u_int8_t *)(ni->
ni_tstamp))[2] << 16) | (((u_int8_t *)(ni->ni_tstamp
))[3] << 24))) >> 10);
intval = MAX(1, ni->ni_intval)(((1)>(ni->ni_intval))?(1):(ni->ni_intval)) & HAL_BEACON_PERIOD0x0000ffff;
12
←
Assuming 1 is <= field 'ni_intval'→
13
←
'?' condition is false→
14
←
Value assigned to 'intval'→
if (nexttbtt == 0) {	/* e.g. for ap mode */
15
←
Assuming 'nexttbtt' is not equal to 0→
16
←
Taking false branch→
nexttbtt = intval;
} else if (intval) {
17
←
Assuming 'intval' is 0→
18
←
Taking false branch→
nexttbtt = roundup(nexttbtt, intval)((((nexttbtt)+((intval)-1))/(intval))*(intval));
}
DPRINTF(ATH_DEBUG_BEACON, ("%s: intval %u nexttbtt %u\n",
   __func__, ni->ni_intval, nexttbtt));
if (ic->ic_opmode18.1
Field 'ic_opmode' is equal to IEEE80211_M_STA
 == IEEE80211_M_STA) {
19
←
Taking true branch→
HAL_BEACON_STATE bs;

/* NB: no PCF support right now */
bzero(&bs, sizeof(bs))__builtin_bzero((&bs), (sizeof(bs)));
bs.bs_intvalbs_interval = intval;
20
←
The value 0 is assigned to 'bs.bs_interval'→
bs.bs_nexttbttbs_next_beacon = nexttbtt;
bs.bs_dtimperiodbs_dtim_period = bs.bs_intvalbs_interval;
bs.bs_nextdtimbs_next_dtim = nexttbtt;
/*
 * Calculate the number of consecutive beacons to miss
 * before taking a BMISS interrupt. 
 * Note that we clamp the result to at most 7 beacons.
 */
bs.bs_bmissthresholdbs_bmiss_threshold = ic->ic_bmissthres;
if (bs.bs_bmissthresholdbs_bmiss_threshold > 7) {
21
←
Assuming field 'bs_bmiss_threshold' is <= 7→
22
←
Taking false branch→
	bs.bs_bmissthresholdbs_bmiss_threshold = 7;
} else if (bs.bs_bmissthresholdbs_bmiss_threshold <= 0) {
23
←
Assuming field 'bs_bmiss_threshold' is > 0→
24
←
Taking false branch→
	bs.bs_bmissthresholdbs_bmiss_threshold = 1;
}

/*
 * Calculate sleep duration.  The configuration is
 * given in ms.  We insure a multiple of the beacon
 * period is used.  Also, if the sleep duration is
 * greater than the DTIM period then it makes senses
 * to make it a multiple of that.
 *
 * XXX fixed at 100ms
 */
bs.bs_sleepdurationbs_sleep_duration =
	roundup(MS_TO_TU(100), bs.bs_intval)(((((((100) * 1000) / 1024))+((bs.bs_interval)-1))/(bs.bs_interval
))*(bs.bs_interval));
25
←
Division by zero
if (bs.bs_sleepdurationbs_sleep_duration > bs.bs_dtimperiodbs_dtim_period) {
	bs.bs_sleepdurationbs_sleep_duration =
	    roundup(bs.bs_sleepduration, bs.bs_dtimperiod)((((bs.bs_sleep_duration)+((bs.bs_dtim_period)-1))/(bs.bs_dtim_period
))*(bs.bs_dtim_period));
}

DPRINTF(ATH_DEBUG_BEACON,
    ("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u"
    " sleep %u\n"
    , __func__
    , bs.bs_intval
    , bs.bs_nexttbtt
    , bs.bs_dtimperiod
    , bs.bs_nextdtim
    , bs.bs_bmissthreshold
    , bs.bs_sleepduration
));
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));
ath_hal_set_beacon_timers(ah, &bs, 0/*XXX*/, 0, 0)((*(ah)->ah_set_beacon_timers)((ah), (&bs), (0), (0), (
0)));
sc->sc_imask |= HAL_INT_BMISS0x00040000;
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
}
1449#ifndef IEEE80211_STA_ONLY
else {
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));
if (nexttbtt == intval)
	intval |= HAL_BEACON_RESET_TSF0x01000000;
if (ic->ic_opmode == IEEE80211_M_IBSS) {
	/*
	 * In IBSS mode enable the beacon timers but only
	 * enable SWBA interrupts if we need to manually
	 * prepare beacon frames. Otherwise we use a
	 * self-linked tx descriptor and let the hardware
	 * deal with things.
	 */
	intval |= HAL_BEACON_ENA0x00800000;
	if (!sc->sc_veol)
		sc->sc_imask |= HAL_INT_SWBA0x00010000;
} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
	/*
	 * In AP mode we enable the beacon timers and
	 * SWBA interrupts to prepare beacon frames.
	 */
	intval |= HAL_BEACON_ENA0x00800000;
	sc->sc_imask |= HAL_INT_SWBA0x00010000;	/* beacon prepare */
}
ath_hal_init_beacon(ah, nexttbtt, intval)((*(ah)->ah_init_beacon)((ah), (nexttbtt), (intval)));
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
/*
 * When using a self-linked beacon descriptor in IBBS
 * mode load it once here.
 */
if (ic->ic_opmode == IEEE80211_M_IBSS && sc->sc_veol)
	ath_beacon_proc(sc, 0);
}
1482#endif
1483}

1485int
1486ath_desc_alloc(struct ath_softc *sc)
1487{
int i, bsize, error = -1;
struct ath_desc *ds;
struct ath_buf *bf;

/* allocate descriptors */
sc->sc_desc_len = sizeof(struct ath_desc) *
		(ATH_TXBUF60 * ATH_TXDESC8 + ATH_RXBUF40 + 1);
if ((error = bus_dmamem_alloc(sc->sc_dmat, sc->sc_desc_len, PAGE_SIZE,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (sc->
sc_desc_len), ((1 << 12)), (0), (&sc->sc_dseg), (
1), (&sc->sc_dnseg), (0))
   0, &sc->sc_dseg, 1, &sc->sc_dnseg, 0)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (sc->
sc_desc_len), ((1 << 12)), (0), (&sc->sc_dseg), (
1), (&sc->sc_dnseg), (0))) != 0) {
printf("%s: unable to allocate control data, error = %d\n",
    sc->sc_dev.dv_xname, error);
goto fail0;
}

if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_dseg), (sc->sc_dnseg), (sc->sc_desc_len), ((caddr_t
 *)&sc->sc_desc), (0x0004))
   sc->sc_desc_len, (caddr_t *)&sc->sc_desc, BUS_DMA_COHERENT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_dseg), (sc->sc_dnseg), (sc->sc_desc_len), ((caddr_t
 *)&sc->sc_desc), (0x0004))) != 0) {
printf("%s: unable to map control data, error = %d\n",
    sc->sc_dev.dv_xname, error);
goto fail1;
}

if ((error = bus_dmamap_create(sc->sc_dmat, sc->sc_desc_len, 1,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (sc->
sc_desc_len), (1), (sc->sc_desc_len), (0), (0), (&sc->
sc_ddmamap))
   sc->sc_desc_len, 0, 0, &sc->sc_ddmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (sc->
sc_desc_len), (1), (sc->sc_desc_len), (0), (0), (&sc->
sc_ddmamap))) != 0) {
printf("%s: unable to create control data DMA map, "
    "error = %d\n", sc->sc_dev.dv_xname, error);
goto fail2;
}

if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap, sc->sc_desc,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_ddmamap), (sc->sc_desc), (sc->sc_desc_len), (((void *
)0)), (0))
   sc->sc_desc_len, NULL, 0)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_ddmamap), (sc->sc_desc), (sc->sc_desc_len), (((void *
)0)), (0))) != 0) {
printf("%s: unable to load control data DMA map, error = %d\n",
    sc->sc_dev.dv_xname, error);
goto fail3;
}

ds = sc->sc_desc;
sc->sc_desc_paddr = sc->sc_ddmamap->dm_segs[0].ds_addr;

DPRINTF(ATH_DEBUG_XMIT_DESC|ATH_DEBUG_RECV_DESC,
   ("ath_desc_alloc: DMA map: %p (%lu) -> %p (%lu)\n",
   ds, (u_long)sc->sc_desc_len,
   (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));

/* allocate buffers */
bsize = sizeof(struct ath_buf) * (ATH_TXBUF60 + ATH_RXBUF40 + 1);
bf = malloc(bsize, M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (bf == NULL((void *)0)) {
printf("%s: unable to allocate Tx/Rx buffers\n",
    sc->sc_dev.dv_xname);
error = ENOMEM12;
goto fail3;
}
sc->sc_bufptr = bf;

TAILQ_INIT(&sc->sc_rxbuf)do { (&sc->sc_rxbuf)->tqh_first = ((void *)0); (&
sc->sc_rxbuf)->tqh_last = &(&sc->sc_rxbuf)->
tqh_first; } while (0);
for (i = 0; i < ATH_RXBUF40; i++, bf++, ds++) {
bf->bf_desc = ds;
bf->bf_daddr = sc->sc_desc_paddr +
    ((caddr_t)ds - (caddr_t)sc->sc_desc);
if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (1), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))
    MCLBYTES, 0, 0, &bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (1), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))) != 0) {
	printf("%s: unable to create Rx dmamap, error = %d\n",
	    sc->sc_dev.dv_xname, error);
	goto fail4;
}
TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_rxbuf)->tqh_last; *(&sc->
sc_rxbuf)->tqh_last = (bf); (&sc->sc_rxbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
}

TAILQ_INIT(&sc->sc_txbuf)do { (&sc->sc_txbuf)->tqh_first = ((void *)0); (&
sc->sc_txbuf)->tqh_last = &(&sc->sc_txbuf)->
tqh_first; } while (0);
for (i = 0; i < ATH_TXBUF60; i++, bf++, ds += ATH_TXDESC8) {
bf->bf_desc = ds;
bf->bf_daddr = sc->sc_desc_paddr +
    ((caddr_t)ds - (caddr_t)sc->sc_desc);
if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (8), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))
    ATH_TXDESC, MCLBYTES, 0, 0, &bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (8), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))) != 0) {
	printf("%s: unable to create Tx dmamap, error = %d\n",
	    sc->sc_dev.dv_xname, error);
	goto fail5;
}
TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
}
TAILQ_INIT(&sc->sc_txq)do { (&sc->sc_txq)->tqh_first = ((void *)0); (&
sc->sc_txq)->tqh_last = &(&sc->sc_txq)->tqh_first
; } while (0);

/* beacon buffer */
bf->bf_desc = ds;
bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (1), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))
   &bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 <<
 11)), (1), ((1 << 11)), (0), (0), (&bf->bf_dmamap
))) != 0) {
printf("%s: unable to create beacon dmamap, error = %d\n",
    sc->sc_dev.dv_xname, error);
goto fail5;
}
sc->sc_bcbuf = bf;
return 0;

1583fail5:
for (i = ATH_RXBUF40; i < ATH_RXBUF40 + ATH_TXBUF60; i++) {
if (sc->sc_bufptr[i].bf_dmamap == NULL((void *)0))
	continue;
bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_bufptr[i].bf_dmamap));
}
1589fail4:
for (i = 0; i < ATH_RXBUF40; i++) {
if (sc->sc_bufptr[i].bf_dmamap == NULL((void *)0))
	continue;
bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_bufptr[i].bf_dmamap));
}
1595fail3:
bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc->
sc_ddmamap));
1597fail2:
bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_ddmamap));
sc->sc_ddmamap = NULL((void *)0);
1600fail1:
bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_desc, sc->sc_desc_len)(*(sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), ((caddr_t
)sc->sc_desc), (sc->sc_desc_len));
1602fail0:
bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
sc->sc_dseg), (sc->sc_dnseg));
return error;
1605}

1607void
1608ath_desc_free(struct ath_softc *sc)
1609{
struct ath_buf *bf;

bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc->
sc_ddmamap));
bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_ddmamap));
bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
sc->sc_dseg), (sc->sc_dnseg));

TAILQ_FOREACH(bf, &sc->sc_txq, bf_list)for((bf) = ((&sc->sc_txq)->tqh_first); (bf) != ((void
 *)0); (bf) = ((bf)->bf_list.tqe_next)) {
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (bf
->bf_dmamap));
m_freem(bf->bf_m);
}
TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)for((bf) = ((&sc->sc_txbuf)->tqh_first); (bf) != ((
void *)0); (bf) = ((bf)->bf_list.tqe_next))
bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (bf
->bf_dmamap));
TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list)for((bf) = ((&sc->sc_rxbuf)->tqh_first); (bf) != ((
void *)0); (bf) = ((bf)->bf_list.tqe_next)) {
if (bf->bf_m) {
	bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
	bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (bf
->bf_dmamap));
	m_freem(bf->bf_m);
	bf->bf_m = NULL((void *)0);
}
}
if (sc->sc_bcbuf != NULL((void *)0)) {
bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc->
sc_bcbuf->bf_dmamap));
bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc
->sc_bcbuf->bf_dmamap));
sc->sc_bcbuf = NULL((void *)0);
}

TAILQ_INIT(&sc->sc_rxbuf)do { (&sc->sc_rxbuf)->tqh_first = ((void *)0); (&
sc->sc_rxbuf)->tqh_last = &(&sc->sc_rxbuf)->
tqh_first; } while (0);
TAILQ_INIT(&sc->sc_txbuf)do { (&sc->sc_txbuf)->tqh_first = ((void *)0); (&
sc->sc_txbuf)->tqh_last = &(&sc->sc_txbuf)->
tqh_first; } while (0);
TAILQ_INIT(&sc->sc_txq)do { (&sc->sc_txq)->tqh_first = ((void *)0); (&
sc->sc_txq)->tqh_last = &(&sc->sc_txq)->tqh_first
; } while (0);
free(sc->sc_bufptr, M_DEVBUF2, 0);
sc->sc_bufptr = NULL((void *)0);
1642}

1644struct ieee80211_node *
1645ath_node_alloc(struct ieee80211com *ic)
1646{
struct ath_node *an;

an = malloc(sizeof(*an), M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (an) {
int i;
for (i = 0; i < ATH_RHIST_SIZE16; i++)
	an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME(~0);
an->an_rx_hist_next = ATH_RHIST_SIZE16-1;
return &an->an_node;
} else
return NULL((void *)0);
1658}

1660void
1661ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1662{
struct ath_softc *sc = ic->ic_ific_ac.ac_if.if_softc;
struct ath_buf *bf;

TAILQ_FOREACH(bf, &sc->sc_txq, bf_list)for((bf) = ((&sc->sc_txq)->tqh_first); (bf) != ((void
 *)0); (bf) = ((bf)->bf_list.tqe_next)) {
if (bf->bf_node == ni)
	bf->bf_node = NULL((void *)0);
}
(*sc->sc_node_free)(ic, ni);
1671}

1673void
1674ath_node_copy(struct ieee80211com *ic,
struct ieee80211_node *dst, const struct ieee80211_node *src)
1676{
struct ath_softc *sc = ic->ic_ific_ac.ac_if.if_softc;

bcopy(&src[1], &dst[1],
sizeof(struct ath_node) - sizeof(struct ieee80211_node));
(*sc->sc_node_copy)(ic, dst, src);
1682}

1684u_int8_t
1685ath_node_getrssi(struct ieee80211com *ic, const struct ieee80211_node *ni)
1686{
const struct ath_node *an = ATH_NODE(ni)((struct ath_node *)(ni));
int i, now, nsamples, rssi;

/*
* Calculate the average over the last second of sampled data.
*/
now = ATH_TICKS()(ticks);
nsamples = 0;
rssi = 0;
i = an->an_rx_hist_next;
do {
const struct ath_recv_hist *rh = &an->an_rx_hist[i];
if (rh->arh_ticks == ATH_RHIST_NOTIME(~0))
	goto done;
if (now - rh->arh_ticks > hz)
	goto done;
rssi += rh->arh_rssi;
nsamples++;
if (i == 0) {
	i = ATH_RHIST_SIZE16-1;
} else {
	i--;
}
} while (i != an->an_rx_hist_next);
1711done:
/*
* Return either the average or the last known
* value if there is no recent data.
*/
return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
1717}

1719int
1720ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
1721{
struct ath_hal *ah = sc->sc_ah;
int error;
struct mbuf *m;
struct ath_desc *ds;

m = bf->bf_m;
if (m == NULL((void *)0)) {
/*
 * NB: by assigning a page to the rx dma buffer we
 * implicitly satisfy the Atheros requirement that
 * this buffer be cache-line-aligned and sized to be
 * multiple of the cache line size.  Not doing this
 * causes weird stuff to happen (for the 5210 at least).
 */
m = ath_getmbuf(M_DONTWAIT0x0002, MT_DATA1, MCLBYTES(1 << 11));
if (m == NULL((void *)0)) {
	DPRINTF(ATH_DEBUG_ANY,
	    ("%s: no mbuf/cluster\n", __func__));
	sc->sc_stats.ast_rx_nombuf++;
	return ENOMEM12;
}
bf->bf_m = m;
m->m_pkthdrM_dat.MH.MH_pkthdr.len = m->m_lenm_hdr.mh_len = m->m_extM_dat.MH.MH_dat.MH_ext.ext_size;

error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m), (0x0001))
    BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m), (0x0001));
if (error != 0) {
	DPRINTF(ATH_DEBUG_ANY,
	    ("%s: ath_bus_dmamap_load_mbuf failed;"
	    " error %d\n", __func__, error));
	sc->sc_stats.ast_rx_busdma++;
	return error;
}
KASSERT(bf->bf_nseg == 1,if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_rxbuf_init: multi-segment packet; nseg %u"
, bf->bf_dmamap->dm_nsegs)
	("ath_rxbuf_init: multi-segment packet; nseg %u",if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_rxbuf_init: multi-segment packet; nseg %u"
, bf->bf_dmamap->dm_nsegs)
	bf->bf_nseg))if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_rxbuf_init: multi-segment packet; nseg %u"
, bf->bf_dmamap->dm_nsegs);
}
bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x01))
   bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x01));

/*
* Setup descriptors.  For receive we always terminate
* the descriptor list with a self-linked entry so we'll
* not get overrun under high load (as can happen with a
* 5212 when ANI processing enables PHY errors).
*
* To insure the last descriptor is self-linked we create
* each descriptor as self-linked and add it to the end.  As
* each additional descriptor is added the previous self-linked
* entry is ``fixed'' naturally.  This should be safe even
* if DMA is happening.  When processing RX interrupts we
* never remove/process the last, self-linked, entry on the
* descriptor list.  This insures the hardware always has
* someplace to write a new frame.
*/
ds = bf->bf_desc;
bzero(ds, sizeof(struct ath_desc))__builtin_bzero((ds), (sizeof(struct ath_desc)));
1779#ifndef IEEE80211_STA_ONLY
if (sc->sc_ic.ic_opmode != IEEE80211_M_HOSTAP)
ds->ds_link = bf->bf_daddr;	/* link to self */
1782#endif
ds->ds_data = bf->bf_segsbf_dmamap->dm_segs[0].ds_addr;
ath_hal_setup_rx_desc(ah, ds((*(ah)->ah_setup_rx_desc)((ah), (ds), (m->m_hdr.mh_len
), (0)))
, m->m_len		/* buffer size */((*(ah)->ah_setup_rx_desc)((ah), (ds), (m->m_hdr.mh_len
), (0)))
, 0((*(ah)->ah_setup_rx_desc)((ah), (ds), (m->m_hdr.mh_len
), (0)))
)((*(ah)->ah_setup_rx_desc)((ah), (ds), (m->m_hdr.mh_len
), (0)));

if (sc->sc_rxlink != NULL((void *)0))
*sc->sc_rxlink = bf->bf_daddr;
sc->sc_rxlink = &ds->ds_link;
return 0;
1793}

1795void
1796ath_rx_proc(void *arg, int npending)
1797{
struct mbuf_list ml = MBUF_LIST_INITIALIZER(){ ((void *)0), ((void *)0), 0 };
1799#define	PA2DESC(_sc, _pa) \
((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
((_pa) - (_sc)->sc_desc_paddr)))
struct ath_softc *sc = arg;
struct ath_buf *bf;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_hal *ah = sc->sc_ah;
struct ath_desc *ds;
struct mbuf *m;
struct ieee80211_frame *wh;
struct ieee80211_frame whbuf;
struct ieee80211_rxinfo rxi;
struct ieee80211_node *ni;
struct ath_node *an;
struct ath_recv_hist *rh;
int len;
u_int phyerr;
HAL_STATUS status;

DPRINTF(ATH_DEBUG_RX_PROC, ("%s: pending %u\n", __func__, npending));
do {
bf = TAILQ_FIRST(&sc->sc_rxbuf)((&sc->sc_rxbuf)->tqh_first);
if (bf == NULL((void *)0)) {		/* NB: shouldn't happen */
	printf("%s: ath_rx_proc: no buffer!\n", ifp->if_xname);
	break;
}
ds = bf->bf_desc;
if (ds->ds_link == bf->bf_daddr) {
	/* NB: never process the self-linked entry at the end */
	break;
}
m = bf->bf_m;
if (m == NULL((void *)0)) {		/* NB: shouldn't happen */
	printf("%s: ath_rx_proc: no mbuf!\n", ifp->if_xname);
	continue;
}
/* XXX sync descriptor memory */
/*
 * Must provide the virtual address of the current
 * descriptor, the physical address, and the virtual
 * address of the next descriptor in the h/w chain.
 * This allows the HAL to look ahead to see if the
 * hardware is done with a descriptor by checking the
 * done bit in the following descriptor and the address
 * of the current descriptor the DMA engine is working
 * on.  All this is necessary because of our use of
 * a self-linked list to avoid rx overruns.
 */
status = ath_hal_proc_rx_desc(ah, ds,((*(ah)->ah_proc_rx_desc)((ah), (ds), (bf->bf_daddr), (
PA2DESC(sc, ds->ds_link))))
    bf->bf_daddr, PA2DESC(sc, ds->ds_link))((*(ah)->ah_proc_rx_desc)((ah), (ds), (bf->bf_daddr), (
PA2DESC(sc, ds->ds_link))));
1850#ifdef AR_DEBUG
if (ath_debug & ATH_DEBUG_RECV_DESC)
    ath_printrxbuf(bf, status == HAL_OK0);
1853#endif
if (status == HAL_EINPROGRESS36)
	break;
TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list)do { if (((bf)->bf_list.tqe_next) != ((void *)0)) (bf)->
bf_list.tqe_next->bf_list.tqe_prev = (bf)->bf_list.tqe_prev
; else (&sc->sc_rxbuf)->tqh_last = (bf)->bf_list
.tqe_prev; *(bf)->bf_list.tqe_prev = (bf)->bf_list.tqe_next
; ((bf)->bf_list.tqe_prev) = ((void *)-1); ((bf)->bf_list
.tqe_next) = ((void *)-1); } while (0);

if (ds->ds_rxstatds_us.rx.rs_more) {
	/*
	 * Frame spans multiple descriptors; this
	 * cannot happen yet as we don't support
	 * jumbograms.  If not in monitor mode,
	 * discard the frame.
	 */

	/* 
	 * Enable this if you want to see error
	 * frames in Monitor mode.
	 */
1870#ifdef ERROR_FRAMES
	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
		/* XXX statistic */
		goto rx_next;
	}
1875#endif
	/* fall thru for monitor mode handling... */

} else if (ds->ds_rxstatds_us.rx.rs_status != 0) {
	if (ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_CRC0x01)
		sc->sc_stats.ast_rx_crcerr++;
	if (ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_FIFO0x04)
		sc->sc_stats.ast_rx_fifoerr++;
	if (ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_DECRYPT0x08)
		sc->sc_stats.ast_rx_badcrypt++;
	if (ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_PHY0x02) {
		sc->sc_stats.ast_rx_phyerr++;
		phyerr = ds->ds_rxstatds_us.rx.rs_phyerr & 0x1f;
		sc->sc_stats.ast_rx_phy[phyerr]++;
	}

	/*
	 * reject error frames, we normally don't want
	 * to see them in monitor mode.
	 */
	if ((ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_DECRYPT0x08 ) ||
	    (ds->ds_rxstatds_us.rx.rs_status & HAL_RXERR_PHY0x02))
	    goto rx_next;

	/*
	 * In monitor mode, allow through packets that
	 * cannot be decrypted
	 */
	if ((ds->ds_rxstatds_us.rx.rs_status & ~HAL_RXERR_DECRYPT0x08) ||
	    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
		goto rx_next;
}

len = ds->ds_rxstatds_us.rx.rs_datalen;
if (len < IEEE80211_MIN_LEN(sizeof(struct ieee80211_frame_min) + 4)) {
	DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
	    __func__, len));
	sc->sc_stats.ast_rx_tooshort++;
	goto rx_next;
}

bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x02))
    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x02));

bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
bf->bf_m = NULL((void *)0);
m->m_pkthdrM_dat.MH.MH_pkthdr.len = m->m_lenm_hdr.mh_len = len;

1923#if NBPFILTER1 > 0
if (sc->sc_drvbpf) {
	sc->sc_rxtapsc_rxtapu.th.wr_flags = IEEE80211_RADIOTAP_F_FCS0x10;
	sc->sc_rxtapsc_rxtapu.th.wr_rate =
	    sc->sc_hwmap[ds->ds_rxstatds_us.rx.rs_rate] &
	    IEEE80211_RATE_VAL0x7f;
	sc->sc_rxtapsc_rxtapu.th.wr_antenna = ds->ds_rxstatds_us.rx.rs_antenna;
	sc->sc_rxtapsc_rxtapu.th.wr_rssi = ds->ds_rxstatds_us.rx.rs_rssi;
	sc->sc_rxtapsc_rxtapu.th.wr_max_rssi = ic->ic_max_rssi;

	bpf_mtap_hdr(sc->sc_drvbpf, &sc->sc_rxtapsc_rxtapu.th,
	    sc->sc_rxtap_len, m, BPF_DIRECTION_IN(1 << 0));
}
1936#endif
m_adj(m, -IEEE80211_CRC_LEN4);
wh = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));
rxi.rxi_flags = 0;
if (!ath_softcrypto && (wh->i_fc[1] & IEEE80211_FC1_WEP0x40)) {
	/*
	 * WEP is decrypted by hardware. Clear WEP bit
	 * and trim WEP header for ieee80211_inputm().
	 */
	wh->i_fc[1] &= ~IEEE80211_FC1_WEP0x40;
	bcopy(wh, &whbuf, sizeof(whbuf));
	m_adj(m, IEEE80211_WEP_IVLEN3 + IEEE80211_WEP_KIDLEN1);
	wh = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));
	bcopy(&whbuf, wh, sizeof(whbuf));
	/*
	 * Also trim WEP ICV from the tail.
	 */
	m_adj(m, -IEEE80211_WEP_CRCLEN4);
	/*
	 * The header has probably moved.
	 */
	wh = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));

	rxi.rxi_flags |= IEEE80211_RXI_HWDEC0x00000001;
}

/*
 * Locate the node for sender, track state, and
 * then pass this node (referenced) up to the 802.11
 * layer for its use.
 */
ni = ieee80211_find_rxnode(ic, wh);

/*
 * Record driver-specific state.
 */
an = ATH_NODE(ni)((struct ath_node *)(ni));
if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE16)
	an->an_rx_hist_next = 0;
rh = &an->an_rx_hist[an->an_rx_hist_next];
rh->arh_ticks = ATH_TICKS()(ticks);
rh->arh_rssi = ds->ds_rxstatds_us.rx.rs_rssi;
rh->arh_antenna = ds->ds_rxstatds_us.rx.rs_antenna;

/*
 * Send frame up for processing.
 */
rxi.rxi_rssi = ds->ds_rxstatds_us.rx.rs_rssi;
rxi.rxi_tstamp = ds->ds_rxstatds_us.rx.rs_tstamp;
ieee80211_inputm(ifp, m, ni, &rxi, &ml);

/* Handle the rate adaption */
ieee80211_rssadapt_input(ic, ni, &an->an_rssadapt,
    ds->ds_rxstatds_us.rx.rs_rssi);

/*
 * The frame may have caused the node to be marked for
 * reclamation (e.g. in response to a DEAUTH message)
 * so use release_node here instead of unref_node.
 */
ieee80211_release_node(ic, ni);

rx_next:
TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_rxbuf)->tqh_last; *(&sc->
sc_rxbuf)->tqh_last = (bf); (&sc->sc_rxbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
} while (ath_rxbuf_init(sc, bf) == 0);

if_input(ifp, &ml);

ath_hal_set_rx_signal(ah)((*(ah)->ah_set_rx_signal)((ah)));		/* rx signal state monitoring */
ath_hal_start_rx(ah)((*(ah)->ah_start_rx)((ah)));			/* in case of RXEOL */
2006#undef PA2DESC
2007}

2009/*
* XXX Size of an ACK control frame in bytes.
*/
2012#define	IEEE80211_ACK_SIZE(2+2+6 +4)	(2+2+IEEE80211_ADDR_LEN6+4)

2014int
2015ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni,
  struct ath_buf *bf, struct mbuf *m0)
2017{
struct ieee80211com *ic = &sc->sc_ic;
struct ath_hal *ah = sc->sc_ah;
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
int i, error, iswep, hdrlen, pktlen, len, s, tries;
u_int8_t rix, cix, txrate, ctsrate;
struct ath_desc *ds;
struct ieee80211_frame *wh;
struct ieee80211_key *k;
u_int32_t iv;
u_int8_t *ivp;
u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
   IEEE80211_WEP_IVLEN3 + IEEE80211_WEP_KIDLEN1];
u_int subtype, flags, ctsduration, antenna;
HAL_PKT_TYPE atype;
const HAL_RATE_TABLE *rt;
HAL_BOOL shortPreamble;
struct ath_node *an;
u_int8_t hwqueue = HAL_TX_QUEUE_ID_DATA_MIN;

wh = mtod(m0, struct ieee80211_frame *)((struct ieee80211_frame *)((m0)->m_hdr.mh_data));
iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED0x40;
hdrlen = sizeof(struct ieee80211_frame);
pktlen = m0->m_pkthdrM_dat.MH.MH_pkthdr.len;

if (ath_softcrypto && iswep) {
k = ieee80211_get_txkey(ic, wh, ni);	
if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL((void *)0))
	return ENOMEM12;
wh = mtod(m0, struct ieee80211_frame *)((struct ieee80211_frame *)((m0)->m_hdr.mh_data));

/* reset len in case we got a new mbuf */
pktlen = m0->m_pkthdrM_dat.MH.MH_pkthdr.len;
} else if (!ath_softcrypto && iswep) {
bcopy(mtod(m0, caddr_t)((caddr_t)((m0)->m_hdr.mh_data)), hdrbuf, hdrlen);
m_adj(m0, hdrlen);
M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT)(m0) = m_prepend((m0), (sizeof(hdrbuf)), (0x0002));
if (m0 == NULL((void *)0)) {
	sc->sc_stats.ast_tx_nombuf++;
	return ENOMEM12;
}
ivp = hdrbuf + hdrlen;
wh = mtod(m0, struct ieee80211_frame *)((struct ieee80211_frame *)((m0)->m_hdr.mh_data));
/*
 * XXX
 * IV must not duplicate during the lifetime of the key.
 * But no mechanism to renew keys is defined in IEEE 802.11
 * for WEP.  And the IV may be duplicated at other stations
 * because the session key itself is shared.  So we use a
 * pseudo random IV for now, though it is not the right way.
 *
 * NB: Rather than use a strictly random IV we select a
 * random one to start and then increment the value for
 * each frame.  This is an explicit tradeoff between
 * overhead and security.  Given the basic insecurity of
 * WEP this seems worthwhile.
 */

/*
 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
 * (B, 255, N) with 3 <= B < 16 and 0 <= N <= 255
 */
iv = ic->ic_iv;
if ((iv & 0xff00) == 0xff00) {
	int B = (iv & 0xff0000) >> 16;
	if (3 <= B && B < 16)
		iv = (B+1) << 16;
}
ic->ic_iv = iv + 1;

/*
 * NB: Preserve byte order of IV for packet
 *     sniffers; it doesn't matter otherwise.
 */
2091#if BYTE_ORDER1234 == BIG_ENDIAN4321
ivp[0] = iv >> 0;
ivp[1] = iv >> 8;
ivp[2] = iv >> 16;
2095#else
ivp[2] = iv >> 0;
ivp[1] = iv >> 8;
ivp[0] = iv >> 16;
2099#endif
ivp[3] = ic->ic_wep_txkeyic_def_txkey << 6; /* Key ID and pad */
bcopy(hdrbuf, mtod(m0, caddr_t)((caddr_t)((m0)->m_hdr.mh_data)), sizeof(hdrbuf));
/*
 * The length of hdrlen and pktlen must be increased for WEP
 */
len = IEEE80211_WEP_IVLEN3 +
    IEEE80211_WEP_KIDLEN1 +
    IEEE80211_WEP_CRCLEN4;
hdrlen += len;
pktlen += len;
}
pktlen += IEEE80211_CRC_LEN4;

/*
* Load the DMA map so any coalescing is done.  This
* also calculates the number of descriptors we need.
*/
error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m0), (0x0001))
   BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m0), (0x0001));
/*
* Discard null packets and check for packets that
* require too many TX descriptors.  We try to convert
* the latter to a cluster.
*/
if (error == EFBIG27) {		/* too many desc's, linearize */
sc->sc_stats.ast_tx_linear++;
if (m_defrag(m0, M_DONTWAIT0x0002)) {
	sc->sc_stats.ast_tx_nomcl++;
	m_freem(m0);
	return ENOMEM12;
}
error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m0), (0x0001))
    BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), (
bf->bf_dmamap), (m0), (0x0001));
if (error != 0) {
	sc->sc_stats.ast_tx_busdma++;
	m_freem(m0);
	return error;
}
KASSERT(bf->bf_nseg == 1,if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_tx_start: packet not one segment; nseg %u"
, bf->bf_dmamap->dm_nsegs)
	("ath_tx_start: packet not one segment; nseg %u",if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_tx_start: packet not one segment; nseg %u"
, bf->bf_dmamap->dm_nsegs)
	bf->bf_nseg))if (!(bf->bf_dmamap->dm_nsegs == 1)) panic ("ath_tx_start: packet not one segment; nseg %u"
, bf->bf_dmamap->dm_nsegs);
} else if (error != 0) {
sc->sc_stats.ast_tx_busdma++;
m_freem(m0);
return error;
} else if (bf->bf_nsegbf_dmamap->dm_nsegs == 0) {		/* null packet, discard */
sc->sc_stats.ast_tx_nodata++;
m_freem(m0);
return EIO5;
}
DPRINTF(ATH_DEBUG_XMIT, ("%s: m %p len %u\n", __func__, m0, pktlen));
bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x04))
   bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x04));
bf->bf_m = m0;
bf->bf_node = ni;			/* NB: held reference */
an = ATH_NODE(ni)((struct ath_node *)(ni));

/* setup descriptors */
ds = bf->bf_desc;
rt = sc->sc_currates;
KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode))if (!(rt != ((void *)0))) panic ("no rate table, mode %u", sc
->sc_curmode);

/*
* Calculate Atheros packet type from IEEE80211 packet header
* and setup for rate calculations.
*/
bf->bf_id.id_node = NULL((void *)0);
atype = HAL_PKT_TYPE_NORMAL;			/* default */
switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK0x0c) {
case IEEE80211_FC0_TYPE_MGT0x00:
subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK0xf0;
if (subtype == IEEE80211_FC0_SUBTYPE_BEACON0x80) {
	atype = HAL_PKT_TYPE_BEACON;
} else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP0x50) {
	atype = HAL_PKT_TYPE_PROBE_RESP;
} else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM0x90) {
	atype = HAL_PKT_TYPE_ATIM;
}
rix = 0;			/* XXX lowest rate */
break;
case IEEE80211_FC0_TYPE_CTL0x04:
subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK0xf0;
if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL0xa0)
	atype = HAL_PKT_TYPE_PSPOLL;
rix = 0;			/* XXX lowest rate */
break;
default:
/* remember link conditions for rate adaptation algorithm */
if (ic->ic_fixed_rate == -1) {
	bf->bf_id.id_len = m0->m_pkthdrM_dat.MH.MH_pkthdr.len;
	bf->bf_id.id_rateidx = ni->ni_txrate;
	bf->bf_id.id_node = ni;
	bf->bf_id.id_rssi = ath_node_getrssi(ic, ni);
}
ni->ni_txrate = ieee80211_rssadapt_choose(&an->an_rssadapt,
    &ni->ni_rates, wh, m0->m_pkthdrM_dat.MH.MH_pkthdr.len, ic->ic_fixed_rate,
    ifp->if_xname, 0);
rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
    IEEE80211_RATE_VAL0x7f];
if (rix == 0xff) {
	printf("%s: bogus xmit rate 0x%x (idx 0x%x)\n",
	    ifp->if_xname, ni->ni_rates.rs_rates[ni->ni_txrate],
	    ni->ni_txrate);
	sc->sc_stats.ast_tx_badrate++;
	m_freem(m0);
	return EIO5;
}
break;
}

/*
* NB: the 802.11 layer marks whether or not we should
* use short preamble based on the current mode and
* negotiated parameters.
*/
if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE0x00040000) &&
   (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE0x0020)) {
txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
shortPreamble = AH_TRUE;
sc->sc_stats.ast_tx_shortpre++;
} else {
txrate = rt->info[rix].rateCode;
shortPreamble = AH_FALSE;
}

/*
* Calculate miscellaneous flags.
*/
flags = HAL_TXDESC_CLRDMASK0x0001;		/* XXX needed for wep errors */
if (IEEE80211_IS_MULTICAST(wh->i_addr1)(*(wh->i_addr1) & 0x01)) {
flags |= HAL_TXDESC_NOACK0x0002;	/* no ack on broad/multicast */
sc->sc_stats.ast_tx_noack++;
} else if (pktlen > ic->ic_rtsthreshold) {
flags |= HAL_TXDESC_RTSENA0x0004;	/* RTS based on frame length */
sc->sc_stats.ast_tx_rts++;
}

/*
* Calculate duration.  This logically belongs in the 802.11
* layer but it lacks sufficient information to calculate it.
*/
if ((flags & HAL_TXDESC_NOACK0x0002) == 0 &&
   (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK0x0c) != IEEE80211_FC0_TYPE_CTL0x04) {
u_int16_t dur;
/*
 * XXX not right with fragmentation.
 */
dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE(2+2+6 +4),
		rix, shortPreamble);
*((u_int16_t*) wh->i_dur) = htole16(dur)((__uint16_t)(dur));
}

/*
* Calculate RTS/CTS rate and duration if needed.
*/
ctsduration = 0;
if (flags & (HAL_TXDESC_RTSENA0x0004|HAL_TXDESC_CTSENA0x0008)) {
/*
 * CTS transmit rate is derived from the transmit rate
 * by looking in the h/w rate table.  We must also factor
 * in whether or not a short preamble is to be used.
 */
cix = rt->info[rix].controlRate;
ctsrate = rt->info[cix].rateCode;
if (shortPreamble)
	ctsrate |= rt->info[cix].shortPreamble;
/*
 * Compute the transmit duration based on the size
 * of an ACK frame.  We call into the HAL to do the
 * computation since it depends on the characteristics
 * of the actual PHY being used.
 */
if (flags & HAL_TXDESC_RTSENA0x0004) {	/* SIFS + CTS */
	ctsduration += ath_hal_computetxtime(ah,
		rt, IEEE80211_ACK_SIZE(2+2+6 +4), cix, shortPreamble);
}
/* SIFS + data */
ctsduration += ath_hal_computetxtime(ah,
	rt, pktlen, rix, shortPreamble);
if ((flags & HAL_TXDESC_NOACK0x0002) == 0) {	/* SIFS + ACK */
	ctsduration += ath_hal_computetxtime(ah,
		rt, IEEE80211_ACK_SIZE(2+2+6 +4), cix, shortPreamble);
}
} else
ctsrate = 0;

/*
* For now use the antenna on which the last good
* frame was received on.  We assume this field is
* initialized to 0 which gives us ``auto'' or the
* ``default'' antenna.
*/
if (an->an_tx_antenna) {
antenna = an->an_tx_antenna;
} else {
antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
}

2298#if NBPFILTER1 > 0
if (ic->ic_rawbpf)
bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT(1 << 1));

if (sc->sc_drvbpf) {
sc->sc_txtapsc_txtapu.th.wt_flags = 0;
if (shortPreamble)
	sc->sc_txtapsc_txtapu.th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE0x02;
if (!ath_softcrypto && iswep)
	sc->sc_txtapsc_txtapu.th.wt_flags |= IEEE80211_RADIOTAP_F_WEP0x04;
sc->sc_txtapsc_txtapu.th.wt_rate = ni->ni_rates.rs_rates[ni->ni_txrate] &
    IEEE80211_RATE_VAL0x7f;
sc->sc_txtapsc_txtapu.th.wt_txpower = 30;
sc->sc_txtapsc_txtapu.th.wt_antenna = antenna;

bpf_mtap_hdr(sc->sc_drvbpf, &sc->sc_txtapsc_txtapu.th, sc->sc_txtap_len,
    m0, BPF_DIRECTION_OUT(1 << 1));
}
2316#endif

/*
* Formulate first tx descriptor with tx controls.
*/
tries = IEEE80211_IS_MULTICAST(wh->i_addr1)(*(wh->i_addr1) & 0x01) ? 1 : 15;
/* XXX check return value? */
ath_hal_setup_tx_desc(ah, ds((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, pktlen		/* packet length */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, hdrlen		/* header length */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, atype			/* Atheros packet type */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, 60			/* txpower XXX */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, txrate, tries		/* series 0 rate/tries */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, antenna		/* antenna mode */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, flags			/* flags */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, ctsrate		/* rts/cts rate */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
, ctsduration		/* rts/cts duration */((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)))
)((*(ah)->ah_setup_tx_desc)((ah), (ds), (pktlen), (hdrlen),
 (atype), (60), (txrate), (tries), (iswep ? sc->sc_ic.ic_def_txkey
 : ((u_int32_t) - 1)), (antenna), (flags), (ctsrate), (ctsduration
)));
2335#ifdef notyet
ath_hal_setup_xtx_desc(ah, ds
, AH_FALSE		/* short preamble */
, 0, 0			/* series 1 rate/tries */
, 0, 0			/* series 2 rate/tries */
, 0, 0			/* series 3 rate/tries */
);
2342#endif
/*
* Fillin the remainder of the descriptor info.
*/
for (i = 0; i < bf->bf_nsegbf_dmamap->dm_nsegs; i++, ds++) {
ds->ds_data = bf->bf_segsbf_dmamap->dm_segs[i].ds_addr;
if (i == bf->bf_nsegbf_dmamap->dm_nsegs - 1) {
	ds->ds_link = 0;
} else {
	ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
}
ath_hal_fill_tx_desc(ah, ds((*(ah)->ah_fill_tx_desc)((ah), (ds), (bf->bf_dmamap->
dm_segs[i].ds_len), (i == 0), (i == bf->bf_dmamap->dm_nsegs
 - 1)))
	, bf->bf_segs[i].ds_len	/* segment length */((*(ah)->ah_fill_tx_desc)((ah), (ds), (bf->bf_dmamap->
dm_segs[i].ds_len), (i == 0), (i == bf->bf_dmamap->dm_nsegs
 - 1)))
	, i == 0		/* first segment */((*(ah)->ah_fill_tx_desc)((ah), (ds), (bf->bf_dmamap->
dm_segs[i].ds_len), (i == 0), (i == bf->bf_dmamap->dm_nsegs
 - 1)))
	, i == bf->bf_nseg - 1	/* last segment */((*(ah)->ah_fill_tx_desc)((ah), (ds), (bf->bf_dmamap->
dm_segs[i].ds_len), (i == 0), (i == bf->bf_dmamap->dm_nsegs
 - 1)))
)((*(ah)->ah_fill_tx_desc)((ah), (ds), (bf->bf_dmamap->
dm_segs[i].ds_len), (i == 0), (i == bf->bf_dmamap->dm_nsegs
 - 1)));
DPRINTF(ATH_DEBUG_XMIT,
    ("%s: %d: %08x %08x %08x %08x %08x %08x\n",
    __func__, i, ds->ds_link, ds->ds_data,
    ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]));
}

/*
* Insert the frame on the outbound list and
* pass it on to the hardware.
*/
s = splnet()splraise(0x7);
TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txq)->tqh_last; *(&sc->
sc_txq)->tqh_last = (bf); (&sc->sc_txq)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
if (sc->sc_txlink == NULL((void *)0)) {
ath_hal_put_tx_buf(ah, sc->sc_txhalq[hwqueue], bf->bf_daddr)((*(ah)->ah_put_tx_buf)((ah), (sc->sc_txhalq[hwqueue]),
 (bf->bf_daddr)));
DPRINTF(ATH_DEBUG_XMIT, ("%s: TXDP0 = %p (%p)\n", __func__,
    (caddr_t)bf->bf_daddr, bf->bf_desc));
} else {
*sc->sc_txlink = bf->bf_daddr;
DPRINTF(ATH_DEBUG_XMIT, ("%s: link(%p)=%p (%p)\n", __func__,
    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
}
sc->sc_txlink = &bf->bf_desc[bf->bf_nsegbf_dmamap->dm_nsegs - 1].ds_link;
splx(s)spllower(s);

ath_hal_tx_start(ah, sc->sc_txhalq[hwqueue])((*(ah)->ah_tx_start)((ah), (sc->sc_txhalq[hwqueue])));
return 0;
2384}

2386void
2387ath_tx_proc(void *arg, int npending)
2388{
struct ath_softc *sc = arg;
struct ath_hal *ah = sc->sc_ah;
struct ath_buf *bf;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_desc *ds;
struct ieee80211_node *ni;
struct ath_node *an;
int sr, lr, s;
HAL_STATUS status;

for (;;) {
s = splnet()splraise(0x7);
bf = TAILQ_FIRST(&sc->sc_txq)((&sc->sc_txq)->tqh_first);
if (bf == NULL((void *)0)) {
	sc->sc_txlink = NULL((void *)0);
	splx(s)spllower(s);
	break;
}
/* only the last descriptor is needed */
ds = &bf->bf_desc[bf->bf_nsegbf_dmamap->dm_nsegs - 1];
status = ath_hal_proc_tx_desc(ah, ds)((*(ah)->ah_proc_tx_desc)((ah), (ds)));
2411#ifdef AR_DEBUG
if (ath_debug & ATH_DEBUG_XMIT_DESC)
	ath_printtxbuf(bf, status == HAL_OK0);
2414#endif
if (status == HAL_EINPROGRESS36) {
	splx(s)spllower(s);
	break;
}
TAILQ_REMOVE(&sc->sc_txq, bf, bf_list)do { if (((bf)->bf_list.tqe_next) != ((void *)0)) (bf)->
bf_list.tqe_next->bf_list.tqe_prev = (bf)->bf_list.tqe_prev
; else (&sc->sc_txq)->tqh_last = (bf)->bf_list.tqe_prev
; *(bf)->bf_list.tqe_prev = (bf)->bf_list.tqe_next; ((bf
)->bf_list.tqe_prev) = ((void *)-1); ((bf)->bf_list.tqe_next
) = ((void *)-1); } while (0);
splx(s)spllower(s);

ni = bf->bf_node;
if (ni != NULL((void *)0)) {
	an = (struct ath_node *) ni;
	if (ds->ds_txstatds_us.tx.ts_status == 0) {
		if (bf->bf_id.id_node != NULL((void *)0))
			ieee80211_rssadapt_raise_rate(ic,
			    &an->an_rssadapt, &bf->bf_id);
		an->an_tx_antenna = ds->ds_txstatds_us.tx.ts_antenna;
	} else {
		if (bf->bf_id.id_node != NULL((void *)0))
			ieee80211_rssadapt_lower_rate(ic, ni,
			    &an->an_rssadapt, &bf->bf_id);
		if (ds->ds_txstatds_us.tx.ts_status & HAL_TXERR_XRETRY0x01)
			sc->sc_stats.ast_tx_xretries++;
		if (ds->ds_txstatds_us.tx.ts_status & HAL_TXERR_FIFO0x04)
			sc->sc_stats.ast_tx_fifoerr++;
		if (ds->ds_txstatds_us.tx.ts_status & HAL_TXERR_FILT0x02)
			sc->sc_stats.ast_tx_filtered++;
		an->an_tx_antenna = 0;	/* invalidate */
	}
	sr = ds->ds_txstatds_us.tx.ts_shortretry;
	lr = ds->ds_txstatds_us.tx.ts_longretry;
	sc->sc_stats.ast_tx_shortretry += sr;
	sc->sc_stats.ast_tx_longretry += lr;
	/*
	 * Reclaim reference to node.
	 *
	 * NB: the node may be reclaimed here if, for example
	 *     this is a DEAUTH message that was sent and the
	 *     node was timed out due to inactivity.
	 */
	ieee80211_release_node(ic, ni);
}
bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x08))
    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (bf->
bf_dmamap), (0), (bf->bf_dmamap->dm_mapsize), (0x08));
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
m_freem(bf->bf_m);
bf->bf_m = NULL((void *)0);
bf->bf_node = NULL((void *)0);

s = splnet()splraise(0x7);
TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
splx(s)spllower(s);
}
ifq_clr_oactive(&ifp->if_snd);
sc->sc_tx_timer = 0;

ath_start(ifp);
2470}

2472/*
* Drain the transmit queue and reclaim resources.
*/
2475void
2476ath_draintxq(struct ath_softc *sc)
2477{
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ieee80211_node *ni;
struct ath_buf *bf;
int s, i;

/* XXX return value */
if (!sc->sc_invalid) {
for (i = 0; i <= HAL_TX_QUEUE_ID_DATA_MAX; i++) {
	/* don't touch the hardware if marked invalid */
	(void) ath_hal_stop_tx_dma(ah, sc->sc_txhalq[i])((*(ah)->ah_stop_tx_dma)((ah), (sc->sc_txhalq[i])));
	DPRINTF(ATH_DEBUG_RESET,
	    ("%s: tx queue %d (%p), link %p\n", __func__, i,
	    (caddr_t)(u_intptr_t)ath_hal_get_tx_buf(ah,
	    sc->sc_txhalq[i]), sc->sc_txlink));
}
(void) ath_hal_stop_tx_dma(ah, sc->sc_bhalq)((*(ah)->ah_stop_tx_dma)((ah), (sc->sc_bhalq)));
DPRINTF(ATH_DEBUG_RESET,
    ("%s: beacon queue (%p)\n", __func__,
    (caddr_t)(u_intptr_t)ath_hal_get_tx_buf(ah, sc->sc_bhalq)));
}
for (;;) {
s = splnet()splraise(0x7);
bf = TAILQ_FIRST(&sc->sc_txq)((&sc->sc_txq)->tqh_first);
if (bf == NULL((void *)0)) {
	sc->sc_txlink = NULL((void *)0);
	splx(s)spllower(s);
	break;
}
TAILQ_REMOVE(&sc->sc_txq, bf, bf_list)do { if (((bf)->bf_list.tqe_next) != ((void *)0)) (bf)->
bf_list.tqe_next->bf_list.tqe_prev = (bf)->bf_list.tqe_prev
; else (&sc->sc_txq)->tqh_last = (bf)->bf_list.tqe_prev
; *(bf)->bf_list.tqe_prev = (bf)->bf_list.tqe_next; ((bf
)->bf_list.tqe_prev) = ((void *)-1); ((bf)->bf_list.tqe_next
) = ((void *)-1); } while (0);
splx(s)spllower(s);
2510#ifdef AR_DEBUG
if (ath_debug & ATH_DEBUG_RESET) {
	ath_printtxbuf(bf,
	    ath_hal_proc_tx_desc(ah, bf->bf_desc)((*(ah)->ah_proc_tx_desc)((ah), (bf->bf_desc))) == HAL_OK0);
}
2515#endif /* AR_DEBUG */
bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (bf->
bf_dmamap));
m_freem(bf->bf_m);
bf->bf_m = NULL((void *)0);
ni = bf->bf_node;
bf->bf_node = NULL((void *)0);
s = splnet()splraise(0x7);
if (ni != NULL((void *)0)) {
	/*
	 * Reclaim node reference.
	 */
	ieee80211_release_node(ic, ni);
}
TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list)do { (bf)->bf_list.tqe_next = ((void *)0); (bf)->bf_list
.tqe_prev = (&sc->sc_txbuf)->tqh_last; *(&sc->
sc_txbuf)->tqh_last = (bf); (&sc->sc_txbuf)->tqh_last
 = &(bf)->bf_list.tqe_next; } while (0);
splx(s)spllower(s);
}
ifq_clr_oactive(&ifp->if_snd);
sc->sc_tx_timer = 0;
2533}

2535/*
* Disable the receive h/w in preparation for a reset.
*/
2538void
2539ath_stoprecv(struct ath_softc *sc)
2540{
2541#define	PA2DESC(_sc, _pa) \
((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
((_pa) - (_sc)->sc_desc_paddr)))
struct ath_hal *ah = sc->sc_ah;

ath_hal_stop_pcu_recv(ah)((*(ah)->ah_stop_pcu_recv)((ah)));	/* disable PCU */
ath_hal_set_rx_filter(ah, 0)((*(ah)->ah_set_rx_filter)((ah), (0)));	/* clear recv filter */
ath_hal_stop_rx_dma(ah)((*(ah)->ah_stop_rx_dma)((ah)));	/* disable DMA engine */
2549#ifdef AR_DEBUG
if (ath_debug & ATH_DEBUG_RESET) {
struct ath_buf *bf;

printf("%s: rx queue %p, link %p\n", __func__,
    (caddr_t)(u_intptr_t)ath_hal_get_rx_buf(ah)((*(ah)->ah_get_rx_buf)((ah))), sc->sc_rxlink);
TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list)for((bf) = ((&sc->sc_rxbuf)->tqh_first); (bf) != ((
void *)0); (bf) = ((bf)->bf_list.tqe_next)) {
	struct ath_desc *ds = bf->bf_desc;
	if (ath_hal_proc_rx_desc(ah, ds, bf->bf_daddr,((*(ah)->ah_proc_rx_desc)((ah), (ds), (bf->bf_daddr), (
PA2DESC(sc, ds->ds_link))))
	    PA2DESC(sc, ds->ds_link))((*(ah)->ah_proc_rx_desc)((ah), (ds), (bf->bf_daddr), (
PA2DESC(sc, ds->ds_link)))) == HAL_OK0)
		ath_printrxbuf(bf, 1);
}
}
2562#endif
sc->sc_rxlink = NULL((void *)0);		/* just in case */
2564#undef PA2DESC
2565}

2567/*
* Enable the receive h/w following a reset.
*/
2570int
2571ath_startrecv(struct ath_softc *sc)
2572{
struct ath_hal *ah = sc->sc_ah;
struct ath_buf *bf;

sc->sc_rxlink = NULL((void *)0);
TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list)for((bf) = ((&sc->sc_rxbuf)->tqh_first); (bf) != ((
void *)0); (bf) = ((bf)->bf_list.tqe_next)) {
int error = ath_rxbuf_init(sc, bf);
if (error != 0) {
	DPRINTF(ATH_DEBUG_RECV,
	    ("%s: ath_rxbuf_init failed %d\n",
	    __func__, error));
	return error;
}
}

bf = TAILQ_FIRST(&sc->sc_rxbuf)((&sc->sc_rxbuf)->tqh_first);
ath_hal_put_rx_buf(ah, bf->bf_daddr)((*(ah)->ah_put_rx_buf)((ah), (bf->bf_daddr)));
ath_hal_start_rx(ah)((*(ah)->ah_start_rx)((ah)));		/* enable recv descriptors */
ath_mode_init(sc);		/* set filters, etc. */
ath_hal_start_rx_pcu(ah)((*(ah)->ah_start_rx_pcu)((ah)));	/* re-enable PCU/DMA engine */
return 0;
2593}

2595/*
* Set/change channels.  If the channel is really being changed,
* it's done by resetting the chip.  To accomplish this we must
* first cleanup any pending DMA, then restart stuff after a la
* ath_init.
*/
2601int
2602ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
2603{
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;

DPRINTF(ATH_DEBUG_ANY, ("%s: %u (%u MHz) -> %u (%u MHz)\n", __func__,
   ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
   ic->ic_ibss_chan->ic_freq,
   ieee80211_chan2ieee(ic, chan), chan->ic_freq));
if (chan != ic->ic_ibss_chan) {
HAL_STATUS status;
HAL_CHANNEL hchan;
enum ieee80211_phymode mode;

/*
 * To switch channels clear any pending DMA operations;
 * wait long enough for the RX fifo to drain, reset the
 * hardware at the new frequency, and then re-enable
 * the relevant bits of the h/w.
 */
ath_hal_set_intr(ah, 0)((*(ah)->ah_set_intr)((ah), (0)));		/* disable interrupts */
ath_draintxq(sc);		/* clear pending tx frames */
ath_stoprecv(sc);		/* turn off frame recv */
/*
 * Convert to a HAL channel description.
 */
hchan.channel = chan->ic_freq;
hchan.channelFlags = chan->ic_flags;
if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE,((*(ah)->ah_reset)((ah), (ic->ic_opmode), (&hchan),
 (AH_TRUE), (&status)))
    &status)((*(ah)->ah_reset)((ah), (ic->ic_opmode), (&hchan),
 (AH_TRUE), (&status)))) {
	printf("%s: ath_chan_set: unable to reset "
		"channel %u (%u MHz)\n", ifp->if_xname,
		ieee80211_chan2ieee(ic, chan), chan->ic_freq);
	return EIO5;
}
ath_set_slot_time(sc);
/*
 * Re-enable rx framework.
 */
if (ath_startrecv(sc) != 0) {
	printf("%s: ath_chan_set: unable to restart recv "
	    "logic\n", ifp->if_xname);
	return EIO5;
}

2648#if NBPFILTER1 > 0
/*
 * Update BPF state.
 */
sc->sc_txtapsc_txtapu.th.wt_chan_freq = sc->sc_rxtapsc_rxtapu.th.wr_chan_freq =
    htole16(chan->ic_freq)((__uint16_t)(chan->ic_freq));
sc->sc_txtapsc_txtapu.th.wt_chan_flags = sc->sc_rxtapsc_rxtapu.th.wr_chan_flags =
    htole16(chan->ic_flags)((__uint16_t)(chan->ic_flags));
2656#endif

/*
 * Change channels and update the h/w rate map
 * if we're switching; e.g. 11a to 11b/g.
 */
ic->ic_ibss_chan = chan;
mode = ieee80211_chan2mode(ic, chan);
if (mode != sc->sc_curmode)
	ath_setcurmode(sc, mode);

/*
 * Re-enable interrupts.
 */
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
}
return 0;
2673}

2675void
2676ath_next_scan(void *arg)
2677{
struct ath_softc *sc = arg;
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
int s;

/* don't call ath_start w/o network interrupts blocked */
s = splnet()splraise(0x7);

if (ic->ic_state == IEEE80211_S_SCAN)
ieee80211_next_scan(ifp);
splx(s)spllower(s);
2689}

2691int
2692ath_set_slot_time(struct ath_softc *sc)
2693{
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;

if (ic->ic_flags & IEEE80211_F_SHSLOT0x00020000)
return (ath_hal_set_slot_time(ah, HAL_SLOT_TIME_9)((*(ah)->ah_set_slot_time)(ah, 396)));

return (0);
2701}

2703/*
* Periodically recalibrate the PHY to account
* for temperature/environment changes.
*/
2707void
2708ath_calibrate(void *arg)
2709{
struct ath_softc *sc = arg;
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
struct ieee80211_channel *c;
HAL_CHANNEL hchan;
int s;

sc->sc_stats.ast_per_cal++;

/*
* Convert to a HAL channel description.
*/
c = ic->ic_ibss_chan;
hchan.channel = c->ic_freq;
hchan.channelFlags = c->ic_flags;

s = splnet()splraise(0x7);
DPRINTF(ATH_DEBUG_CALIBRATE,
   ("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));

if (ath_hal_get_rf_gain(ah)((*(ah)->ah_get_rf_gain)((ah))) == HAL_RFGAIN_NEED_CHANGE) {
/*
 * Rfgain is out of bounds, reset the chip
 * to load new gain values.
 */
sc->sc_stats.ast_per_rfgain++;
ath_reset(sc, 1);
}
if (!ath_hal_calibrate(ah, &hchan)((*(ah)->ah_calibrate)((ah), (&hchan)))) {
DPRINTF(ATH_DEBUG_ANY,
    ("%s: calibration of channel %u failed\n",
    __func__, c->ic_freq));
sc->sc_stats.ast_per_calfail++;
}
timeout_add_sec(&sc->sc_cal_to, ath_calinterval);
splx(s)spllower(s);
2746}

2748void
2749ath_ledstate(struct ath_softc *sc, enum ieee80211_state state)
2750{
HAL_LED_STATE led = HAL_LED_INITIEEE80211_S_INIT;
u_int32_t softled = AR5K_SOFTLED_OFF1;

switch (state) {
case IEEE80211_S_INIT:
break;
case IEEE80211_S_SCAN:
led = HAL_LED_SCANIEEE80211_S_SCAN;
break;
case IEEE80211_S_AUTH:
led = HAL_LED_AUTHIEEE80211_S_AUTH;
break;
case IEEE80211_S_ASSOC:
led = HAL_LED_ASSOCIEEE80211_S_ASSOC;
softled = AR5K_SOFTLED_ON0;
break;
case IEEE80211_S_RUN:
led = HAL_LED_RUNIEEE80211_S_RUN;
softled = AR5K_SOFTLED_ON0;
break;
}

ath_hal_set_ledstate(sc->sc_ah, led)((*(sc->sc_ah)->ah_set_ledstate)((sc->sc_ah), (led))
);
if (sc->sc_softled) {
ath_hal_set_gpio_output(sc->sc_ah, AR5K_SOFTLED_PIN)((*(sc->sc_ah)->ah_set_gpio_output)((sc->sc_ah), (0)
));
ath_hal_set_gpio(sc->sc_ah, AR5K_SOFTLED_PIN, softled)((*(sc->sc_ah)->ah_set_gpio)((sc->sc_ah), (0), (softled
)));
}
2778}

2780int
2781ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2782{
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_softc *sc = ifp->if_softc;
struct ath_hal *ah = sc->sc_ah;
struct ieee80211_node *ni;
const u_int8_t *bssid;
int error, i;

u_int32_t rfilt;

DPRINTF(ATH_DEBUG_ANY, ("%s: %s -> %s\n", __func__,
   ieee80211_state_name[ic->ic_state],
   ieee80211_state_name[nstate]));

timeout_del(&sc->sc_scan_to);
timeout_del(&sc->sc_cal_to);
ath_ledstate(sc, nstate);

if (nstate0.1
'nstate' is not equal to IEEE80211_S_INIT
 == IEEE80211_S_INIT) {
1
Taking false branch→
timeout_del(&sc->sc_rssadapt_to);
sc->sc_imask &= ~(HAL_INT_SWBA0x00010000 | HAL_INT_BMISS0x00040000);
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
return (*sc->sc_newstate)(ic, nstate, arg);
}
ni = ic->ic_bss;
error = ath_chan_set(sc, ni->ni_chan);
if (error1.1
'error' is equal to 0
 != 0)
2
←
Taking false branch→
goto bad;
rfilt = ath_calcrxfilter(sc);
if (nstate2.1
'nstate' is not equal to IEEE80211_S_SCAN
 == IEEE80211_S_SCAN ||
4
←
Taking false branch→
   ic->ic_opmode == IEEE80211_M_MONITOR) {
3
←
Assuming field 'ic_opmode' is not equal to IEEE80211_M_MONITOR→
bssid = sc->sc_broadcast_addr;
} else {
bssid = ni->ni_bssid;
}
ath_hal_set_rx_filter(ah, rfilt)((*(ah)->ah_set_rx_filter)((ah), (rfilt)));
DPRINTF(ATH_DEBUG_ANY, ("%s: RX filter 0x%x bssid %s\n",
   __func__, rfilt, ether_sprintf((u_char*)bssid)));

if (nstate4.1
'nstate' is equal to IEEE80211_S_RUN
 == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA) {
5
←
Assuming field 'ic_opmode' is equal to IEEE80211_M_STA→
6
←
Taking true branch→
ath_hal_set_associd(ah, bssid, ni->ni_associd)((*(ah)->ah_set_associd)((ah), (bssid), (ni->ni_associd
), 0));
} else {
ath_hal_set_associd(ah, bssid, 0)((*(ah)->ah_set_associd)((ah), (bssid), (0), 0));
}

if (!ath_softcrypto && (ic->ic_flags & IEEE80211_F_WEPON0x00000100)) {
7
←
Assuming 'ath_softcrypto' is not equal to 0→
for (i = 0; i < IEEE80211_WEP_NKID4; i++) {
	if (ath_hal_is_key_valid(ah, i)(((*(ah)->ah_is_key_valid)((ah), (i)))))
		ath_hal_set_key_lladdr(ah, i, bssid)((*(ah)->ah_set_key_lladdr)((ah), (i), (bssid)));
}
}

if (ic->ic_opmode7.1
Field 'ic_opmode' is not equal to IEEE80211_M_MONITOR
 == IEEE80211_M_MONITOR) {
8
←
Taking false branch→
/* nothing to do */
} else if (nstate8.1
'nstate' is equal to IEEE80211_S_RUN
 == IEEE80211_S_RUN) {
9
←
Taking true branch→
DPRINTF(ATH_DEBUG_ANY, ("%s(RUN): "
    "ic_flags=0x%08x iv=%d bssid=%s "
    "capinfo=0x%04x chan=%d\n",
    __func__,
    ic->ic_flags,
    ni->ni_intval,
    ether_sprintf(ni->ni_bssid),
    ni->ni_capinfo,
    ieee80211_chan2ieee(ic, ni->ni_chan)));

/*
 * Allocate and setup the beacon frame for AP or adhoc mode.
 */
2850#ifndef IEEE80211_STA_ONLY
if (ic->ic_opmode9.1
Field 'ic_opmode' is not equal to IEEE80211_M_HOSTAP
 == IEEE80211_M_HOSTAP ||
10
←
Taking false branch→
    ic->ic_opmode9.2
Field 'ic_opmode' is not equal to IEEE80211_M_IBSS
 == IEEE80211_M_IBSS) {
	error = ath_beacon_alloc(sc, ni);
	if (error != 0)
		goto bad;
}
2857#endif
/*
 * Configure the beacon and sleep timers.
 */
ath_beacon_config(sc);
11
←
Calling 'ath_beacon_config'→
} else {
sc->sc_imask &= ~(HAL_INT_SWBA0x00010000 | HAL_INT_BMISS0x00040000);
ath_hal_set_intr(ah, sc->sc_imask)((*(ah)->ah_set_intr)((ah), (sc->sc_imask)));
}

/*
* Invoke the parent method to complete the work.
*/
error = (*sc->sc_newstate)(ic, nstate, arg);

if (nstate == IEEE80211_S_RUN) {
/* start periodic recalibration timer */
timeout_add_sec(&sc->sc_cal_to, ath_calinterval);

if (ic->ic_opmode != IEEE80211_M_MONITOR)
	timeout_add_msec(&sc->sc_rssadapt_to, 100);
} else if (nstate == IEEE80211_S_SCAN) {
/* start ap/neighbor scan timer */
timeout_add_msec(&sc->sc_scan_to, ath_dwelltime);
}
2882bad:
return error;
2884}

2886#ifndef IEEE80211_STA_ONLY
2887void
2888ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
  struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, int subtype)
2890{
struct ath_softc *sc = (struct ath_softc*)ic->ic_softcic_ac.ac_if.if_softc;
struct ath_hal *ah = sc->sc_ah;

(*sc->sc_recv_mgmt)(ic, m, ni, rxi, subtype);

switch (subtype) {
case IEEE80211_FC0_SUBTYPE_PROBE_RESP0x50:
case IEEE80211_FC0_SUBTYPE_BEACON0x80:
if (ic->ic_opmode != IEEE80211_M_IBSS ||
    ic->ic_state != IEEE80211_S_RUN)
	break;
if (ieee80211_ibss_merge(ic, ni, ath_hal_get_tsf64(ah)((*(ah)->ah_get_tsf64)((ah)))) ==
    ENETRESET52)
	ath_hal_set_associd(ah, ic->ic_bss->ni_bssid, 0)((*(ah)->ah_set_associd)((ah), (ic->ic_bss->ni_bssid
), (0), 0));
break;
default:
break;
}
return;
2910}
2911#endif

2913/*
* Setup driver-specific state for a newly associated node.
* Note that we're called also on a re-associate, the isnew
* param tells us if this is the first time or not.
*/
2918void
2919ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
2920{
if (ic->ic_opmode == IEEE80211_M_MONITOR)
return;
2923}

2925int
2926ath_getchannels(struct ath_softc *sc, HAL_BOOL outdoor, HAL_BOOL xchanmode)
2927{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ath_hal *ah = sc->sc_ah;
HAL_CHANNEL *chans;
int i, ix, nchan;

sc->sc_nchan = 0;
chans = malloc(IEEE80211_CHAN_MAX255 * sizeof(HAL_CHANNEL),
	M_TEMP127, M_NOWAIT0x0002);
if (chans == NULL((void *)0)) {
printf("%s: unable to allocate channel table\n", ifp->if_xname);
return ENOMEM12;
}
if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX255, &nchan,
   HAL_MODE_ALL, outdoor, xchanmode)) {
printf("%s: unable to collect channel list from hal\n",
    ifp->if_xname);
free(chans, M_TEMP127, 0);
return EINVAL22;
}

/*
* Convert HAL channels to ieee80211 ones and insert
* them in the table according to their channel number.
*/
for (i = 0; i < nchan; i++) {
HAL_CHANNEL *c = &chans[i];
ix = ieee80211_mhz2ieee(c->channel, c->channelFlags);
if (ix > IEEE80211_CHAN_MAX255) {
	printf("%s: bad hal channel %u (%u/%x) ignored\n",
		ifp->if_xname, ix, c->channel, c->channelFlags);
	continue;
}
DPRINTF(ATH_DEBUG_ANY,
    ("%s: HAL channel %d/%d freq %d flags %#04x idx %d\n",
    sc->sc_dev.dv_xname, i, nchan, c->channel, c->channelFlags,
    ix));
/* NB: flags are known to be compatible */
if (ic->ic_channels[ix].ic_freq == 0) {
	ic->ic_channels[ix].ic_freq = c->channel;
	ic->ic_channels[ix].ic_flags = c->channelFlags;
} else {
	/* channels overlap; e.g. 11g and 11b */
	ic->ic_channels[ix].ic_flags |= c->channelFlags;
}
/* count valid channels */
sc->sc_nchan++;
}
free(chans, M_TEMP127, 0);

if (sc->sc_nchan < 1) {
printf("%s: no valid channels for regdomain %s(%u)\n",
    ifp->if_xname, ieee80211_regdomain2name(ah->ah_regdomainah_capabilities.cap_regdomain.reg_current),
    ah->ah_regdomainah_capabilities.cap_regdomain.reg_current);
return ENOENT2;
}

/* set an initial channel */
ic->ic_ibss_chan = &ic->ic_channels[0];

return 0;
2989}

2991int
2992ath_rate_setup(struct ath_softc *sc, u_int mode)
2993{
struct ath_hal *ah = sc->sc_ah;
struct ieee80211com *ic = &sc->sc_ic;
const HAL_RATE_TABLE *rt;
struct ieee80211_rateset *rs;
int i, maxrates;

switch (mode) {
case IEEE80211_MODE_11A:
sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11A)((*(ah)->ah_get_rate_table)((ah), (HAL_MODE_11A)));
break;
case IEEE80211_MODE_11B:
sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11B)((*(ah)->ah_get_rate_table)((ah), (HAL_MODE_11B)));
break;
case IEEE80211_MODE_11G:
sc->sc_rates[mode] = ath_hal_get_rate_table(ah, HAL_MODE_11G)((*(ah)->ah_get_rate_table)((ah), (HAL_MODE_11G)));
break;
default:
DPRINTF(ATH_DEBUG_ANY,
    ("%s: invalid mode %u\n", __func__, mode));
return 0;
}
rt = sc->sc_rates[mode];
if (rt == NULL((void *)0))
return 0;
if (rt->rateCount > IEEE80211_RATE_MAXSIZE15) {
DPRINTF(ATH_DEBUG_ANY,
    ("%s: rate table too small (%u > %u)\n",
    __func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
maxrates = IEEE80211_RATE_MAXSIZE15;
} else {
maxrates = rt->rateCount;
}
rs = &ic->ic_sup_rates[mode];
for (i = 0; i < maxrates; i++)
rs->rs_rates[i] = rt->info[i].dot11Rate;
rs->rs_nrates = maxrates;
return 1;
3031}

3033void
3034ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
3035{
const HAL_RATE_TABLE *rt;
struct ieee80211com *ic = &sc->sc_ic;
struct ieee80211_node *ni;
int i;

memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap))__builtin_memset((sc->sc_rixmap), (0xff), (sizeof(sc->sc_rixmap
)));
rt = sc->sc_rates[mode];
KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode))if (!(rt != ((void *)0))) panic ("no h/w rate set for phy mode %u"
, mode);
for (i = 0; i < rt->rateCount; i++)
sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL0x7f] = i;
bzero(sc->sc_hwmap, sizeof(sc->sc_hwmap))__builtin_bzero((sc->sc_hwmap), (sizeof(sc->sc_hwmap)));
for (i = 0; i < 32; i++)
sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
sc->sc_currates = rt;
sc->sc_curmode = mode;
ni = ic->ic_bss;
ni->ni_rates.rs_nrates = sc->sc_currates->rateCount;
if (ni->ni_txrate >= ni->ni_rates.rs_nrates)
ni->ni_txrate = 0;
3055}

3057void
3058ath_rssadapt_updatenode(void *arg, struct ieee80211_node *ni)
3059{
struct ath_node *an = ATH_NODE(ni)((struct ath_node *)(ni));

ieee80211_rssadapt_updatestats(&an->an_rssadapt);
3063}

3065void
3066ath_rssadapt_updatestats(void *arg)
3067{
struct ath_softc *sc = (struct ath_softc *)arg;
struct ieee80211com *ic = &sc->sc_ic;

if (ic->ic_opmode == IEEE80211_M_STA) {
ath_rssadapt_updatenode(arg, ic->ic_bss);
} else {
ieee80211_iterate_nodes(ic, ath_rssadapt_updatenode, arg);
}

timeout_add_msec(&sc->sc_rssadapt_to, 100);
3078}

3080#ifdef AR_DEBUG
3081void
3082ath_printrxbuf(struct ath_buf *bf, int done)
3083{
struct ath_desc *ds;
int i;

for (i = 0, ds = bf->bf_desc; i < bf->bf_nsegbf_dmamap->dm_nsegs; i++, ds++) {
printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
    i, ds, (struct ath_desc *)bf->bf_daddr + i,
    ds->ds_link, ds->ds_data,
    ds->ds_ctl0, ds->ds_ctl1,
    ds->ds_hw[0], ds->ds_hw[1],
    !done ? ' ' : (ds->ds_rxstatds_us.rx.rs_status == 0) ? '*' : '!');
}
3095}

3097void
3098ath_printtxbuf(struct ath_buf *bf, int done)
3099{
struct ath_desc *ds;
int i;

for (i = 0, ds = bf->bf_desc; i < bf->bf_nsegbf_dmamap->dm_nsegs; i++, ds++) {
printf("T%d (%p %p) "
    "%08x %08x %08x %08x %08x %08x %08x %08x %c\n",
    i, ds, (struct ath_desc *)bf->bf_daddr + i,
    ds->ds_link, ds->ds_data,
    ds->ds_ctl0, ds->ds_ctl1,
    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
    !done ? ' ' : (ds->ds_txstatds_us.tx.ts_status == 0) ? '*' : '!');
}
3112}
3113#endif /* AR_DEBUG */

3115int
3116ath_gpio_attach(struct ath_softc *sc, u_int16_t devid)
3117{
struct ath_hal *ah = sc->sc_ah;
struct gpiobus_attach_args gba;
int i;

if (ah->ah_gpio_npins < 1)
return 0;

/* Initialize gpio pins array */
for (i = 0; i < ah->ah_gpio_npins && i < AR5K_MAX_GPIO10; i++) {
sc->sc_gpio_pins[i].pin_num = i;
sc->sc_gpio_pins[i].pin_caps = GPIO_PIN_INPUT0x0001 |
    GPIO_PIN_OUTPUT0x0002;

/* Set pin mode to input */
ath_hal_set_gpio_input(ah, i)((*(ah)->ah_set_gpio_input)((ah), (i)));
sc->sc_gpio_pins[i].pin_flags = GPIO_PIN_INPUT0x0001;

/* Get pin input */
sc->sc_gpio_pins[i].pin_state = ath_hal_get_gpio(ah, i)((*(ah)->ah_get_gpio)((ah), (i))) ?
    GPIO_PIN_HIGH0x01 : GPIO_PIN_LOW0x00;
}

/* Enable GPIO-controlled software LED if available */
if ((ah->ah_version == AR5K_AR5211) ||
   (devid == PCI_PRODUCT_ATHEROS_AR5212_IBM0x1014)) {
sc->sc_softled = 1;
ath_hal_set_gpio_output(ah, AR5K_SOFTLED_PIN)((*(ah)->ah_set_gpio_output)((ah), (0)));
ath_hal_set_gpio(ah, AR5K_SOFTLED_PIN, AR5K_SOFTLED_OFF)((*(ah)->ah_set_gpio)((ah), (0), (1)));
}

/* Create gpio controller tag */
sc->sc_gpio_gc.gp_cookie = sc;
sc->sc_gpio_gc.gp_pin_read = ath_gpio_pin_read;
sc->sc_gpio_gc.gp_pin_write = ath_gpio_pin_write;
sc->sc_gpio_gc.gp_pin_ctl = ath_gpio_pin_ctl;

gba.gba_name = "gpio";
gba.gba_gc = &sc->sc_gpio_gc;
gba.gba_pins = sc->sc_gpio_pins;
gba.gba_npins = ah->ah_gpio_npins;

3159#ifdef notyet
3160#if NGPIO > 0
if (config_found(&sc->sc_dev, &gba, gpiobus_print)config_found_sm((&sc->sc_dev), (&gba), (gpiobus_print
), ((void *)0)) == NULL((void *)0))
return (ENODEV19);
3163#endif
3164#endif

return (0);
3167}

3169int
3170ath_gpio_pin_read(void *arg, int pin)
3171{
struct ath_softc *sc = arg;
struct ath_hal *ah = sc->sc_ah;
return (ath_hal_get_gpio(ah, pin)((*(ah)->ah_get_gpio)((ah), (pin))) ? GPIO_PIN_HIGH0x01 : GPIO_PIN_LOW0x00);
3175}

3177void
3178ath_gpio_pin_write(void *arg, int pin, int value)
3179{
struct ath_softc *sc = arg;
struct ath_hal *ah = sc->sc_ah;
ath_hal_set_gpio(ah, pin, value ? GPIO_PIN_HIGH : GPIO_PIN_LOW)((*(ah)->ah_set_gpio)((ah), (pin), (value ? 0x01 : 0x00)));
3183}

3185void
3186ath_gpio_pin_ctl(void *arg, int pin, int flags)
3187{
struct ath_softc *sc = arg;
struct ath_hal *ah = sc->sc_ah;

if (flags & GPIO_PIN_INPUT0x0001) {
ath_hal_set_gpio_input(ah, pin)((*(ah)->ah_set_gpio_input)((ah), (pin)));
} else if (flags & GPIO_PIN_OUTPUT0x0002) {
ath_hal_set_gpio_output(ah, pin)((*(ah)->ah_set_gpio_output)((ah), (pin)));
}
3196}