/usr/src/sys/dev/ic/pgt.c

Bug Summary

File:	dev/ic/pgt.c
Warning:	line 3223, column 3 Access to field '_dmamap_unload' results in a dereference of a null pointer (loaded from field 'sc_dmat')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name pgt.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/ic/pgt.c
1/*	$OpenBSD: pgt.c,v 1.104 2023/11/10 15:51:20 bluhm Exp $  */

3/*
* Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2006 Marcus Glocker <mglocker@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

20/*
* Copyright (c) 2004 Fujitsu Laboratories of America, Inc.
* Copyright (c) 2004 Brian Fundakowski Feldman
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

47#include "bpfilter.h"

49#include <sys/param.h>
50#include <sys/systm.h>
51#include <sys/kernel.h>
52#include <sys/malloc.h>
53#include <sys/socket.h>
54#include <sys/mbuf.h>
55#include <sys/endian.h>
56#include <sys/sockio.h>
57#include <sys/kthread.h>
58#include <sys/time.h>
59#include <sys/ioctl.h>
60#include <sys/device.h>

62#include <machine/bus.h>
63#include <machine/intr.h>

65#include <net/if.h>
66#include <net/if_llc.h>
67#include <net/if_media.h>

69#if NBPFILTER1 > 0
70#include <net/bpf.h>
71#endif

73#include <netinet/in.h>
74#include <netinet/if_ether.h>

76#include <net80211/ieee80211_var.h>
77#include <net80211/ieee80211_radiotap.h>

79#include <dev/ic/pgtreg.h>
80#include <dev/ic/pgtvar.h>

82#include <dev/ic/if_wireg.h>
83#include <dev/ic/if_wi_ieee.h>
84#include <dev/ic/if_wivar.h>

86#ifdef PGT_DEBUG
87#define DPRINTF(x)	do { printf x; } while (0)
88#else
89#define DPRINTF(x)
90#endif

92#define	SETOID(oid, var, size){ if (pgt_oid_set(sc, oid, var, size) != 0) break; } {					\
if (pgt_oid_set(sc, oid, var, size) != 0)			\
break;							\
95}

97/*
* This is a driver for the Intersil Prism family of 802.11g network cards,
* based upon version 1.2 of the Linux driver.
*/

102#define SCAN_TIMEOUT5			5	/* 5 seconds */

104struct cfdriver pgt_cd = {
      NULL((void *)0), "pgt", DV_IFNET
106};

108void	 pgt_media_status(struct ifnet *ifp, struct ifmediareq *imr);
109int	 pgt_media_change(struct ifnet *ifp);
110void	 pgt_write_memory_barrier(struct pgt_softc *);
111uint32_t pgt_read_4(struct pgt_softc *, uint16_t);
112void	 pgt_write_4(struct pgt_softc *, uint16_t, uint32_t);
113void	 pgt_write_4_flush(struct pgt_softc *, uint16_t, uint32_t);
114void	 pgt_debug_events(struct pgt_softc *, const char *);
115uint32_t pgt_queue_frags_pending(struct pgt_softc *, enum pgt_queue);
116void	 pgt_reinit_rx_desc_frag(struct pgt_softc *, struct pgt_desc *);
117int	 pgt_load_tx_desc_frag(struct pgt_softc *, enum pgt_queue,
    struct pgt_desc *);
119void	 pgt_unload_tx_desc_frag(struct pgt_softc *, struct pgt_desc *);
120int	 pgt_load_firmware(struct pgt_softc *);
121void	 pgt_cleanup_queue(struct pgt_softc *, enum pgt_queue,
    struct pgt_frag *);
123int	 pgt_reset(struct pgt_softc *);
124void	 pgt_stop(struct pgt_softc *, unsigned int);
125void	 pgt_reboot(struct pgt_softc *);
126void	 pgt_init_intr(struct pgt_softc *);
127void	 pgt_update_intr(struct pgt_softc *, int);
128struct mbuf
*pgt_ieee80211_encap(struct pgt_softc *, struct ether_header *,
    struct mbuf *, struct ieee80211_node **);
131void	 pgt_input_frames(struct pgt_softc *, struct mbuf *);
132void	 pgt_wakeup_intr(struct pgt_softc *);
133void	 pgt_sleep_intr(struct pgt_softc *);
134void	 pgt_empty_traps(struct pgt_softc_kthread *);
135void	 pgt_per_device_kthread(void *);
136void	 pgt_async_reset(struct pgt_softc *);
137void	 pgt_async_update(struct pgt_softc *);
138void	 pgt_txdone(struct pgt_softc *, enum pgt_queue);
139void	 pgt_rxdone(struct pgt_softc *, enum pgt_queue);
140void	 pgt_trap_received(struct pgt_softc *, uint32_t, void *, size_t);
141void	 pgt_mgmtrx_completion(struct pgt_softc *, struct pgt_mgmt_desc *);
142struct mbuf
*pgt_datarx_completion(struct pgt_softc *, enum pgt_queue);
144int	 pgt_oid_get(struct pgt_softc *, enum pgt_oid, void *, size_t);
145int	 pgt_oid_retrieve(struct pgt_softc *, enum pgt_oid, void *, size_t);
146int	 pgt_oid_set(struct pgt_softc *, enum pgt_oid, const void *, size_t);
147void	 pgt_state_dump(struct pgt_softc *);
148int	 pgt_mgmt_request(struct pgt_softc *, struct pgt_mgmt_desc *);
149void	 pgt_desc_transmit(struct pgt_softc *, enum pgt_queue,
    struct pgt_desc *, uint16_t, int);
151void	 pgt_maybe_trigger(struct pgt_softc *, enum pgt_queue);
152struct ieee80211_node
*pgt_ieee80211_node_alloc(struct ieee80211com *);
154void	 pgt_ieee80211_newassoc(struct ieee80211com *,
    struct ieee80211_node *, int);
156void	 pgt_ieee80211_node_free(struct ieee80211com *,
   struct ieee80211_node *);
158void	 pgt_ieee80211_node_copy(struct ieee80211com *,
    struct ieee80211_node *,
    const struct ieee80211_node *);
161int	 pgt_ieee80211_send_mgmt(struct ieee80211com *,
    struct ieee80211_node *, int, int, int);
163int	 pgt_net_attach(struct pgt_softc *);
164void	 pgt_start(struct ifnet *);
165int	 pgt_ioctl(struct ifnet *, u_long, caddr_t);
166void	 pgt_obj_bss2scanres(struct pgt_softc *,
    struct pgt_obj_bss *, struct wi_scan_res *, uint32_t);
168void	 node_mark_active_ap(void *, struct ieee80211_node *);
169void	 node_mark_active_adhoc(void *, struct ieee80211_node *);
170void	 pgt_watchdog(struct ifnet *);
171int	 pgt_init(struct ifnet *);
172void	 pgt_update_hw_from_sw(struct pgt_softc *, int);
173void	 pgt_hostap_handle_mlme(struct pgt_softc *, uint32_t,
    struct pgt_obj_mlme *);
175void	 pgt_update_sw_from_hw(struct pgt_softc *,
    struct pgt_async_trap *, struct mbuf *);
177int	 pgt_newstate(struct ieee80211com *, enum ieee80211_state, int);
178int	 pgt_drain_tx_queue(struct pgt_softc *, enum pgt_queue);
179int	 pgt_dma_alloc(struct pgt_softc *);
180int	 pgt_dma_alloc_queue(struct pgt_softc *sc, enum pgt_queue pq);
181void	 pgt_dma_free(struct pgt_softc *);
182void	 pgt_dma_free_queue(struct pgt_softc *sc, enum pgt_queue pq);
183void	 pgt_wakeup(struct pgt_softc *);

185void
186pgt_write_memory_barrier(struct pgt_softc *sc)
187{
bus_space_barrier(sc->sc_iotag, sc->sc_iohandle, 0, 0,
   BUS_SPACE_BARRIER_WRITE0x02);
190}

192u_int32_t
193pgt_read_4(struct pgt_softc *sc, uint16_t offset)
194{
return (bus_space_read_4(sc->sc_iotag, sc->sc_iohandle, offset)((sc->sc_iotag)->read_4((sc->sc_iohandle), (offset))
));
196}

198void
199pgt_write_4(struct pgt_softc *sc, uint16_t offset, uint32_t value)
200{
bus_space_write_4(sc->sc_iotag, sc->sc_iohandle, offset, value)((sc->sc_iotag)->write_4((sc->sc_iohandle), (offset)
, (value)));
202}

204/*
* Write out 4 bytes and cause a PCI flush by reading back in on a
* harmless register.
*/
208void
209pgt_write_4_flush(struct pgt_softc *sc, uint16_t offset, uint32_t value)
210{
bus_space_write_4(sc->sc_iotag, sc->sc_iohandle, offset, value)((sc->sc_iotag)->write_4((sc->sc_iohandle), (offset)
, (value)));
(void)bus_space_read_4(sc->sc_iotag, sc->sc_iohandle, PGT_REG_INT_EN)((sc->sc_iotag)->read_4((sc->sc_iohandle), (0x0018))
);
213}

215/*
* Print the state of events in the queues from an interrupt or a trigger.
*/
218void
219pgt_debug_events(struct pgt_softc *sc, const char *when)
220{
221#define	COUNT(i)							\
letoh32(sc->sc_cb->pcb_driver_curfrag[i])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[i])) -			\
letoh32(sc->sc_cb->pcb_device_curfrag[i])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[i]))
if (sc->sc_debug & SC_DEBUG_EVENTS0x00000010)
DPRINTF(("%s: ev%s: %u %u %u %u %u %u\n",
    sc->sc_dev.dv_xname, when, COUNT(0), COUNT(1), COUNT(2),
    COUNT(3), COUNT(4), COUNT(5)));
228#undef COUNT
229}

231uint32_t
232pgt_queue_frags_pending(struct pgt_softc *sc, enum pgt_queue pq)
233{
return (letoh32(sc->sc_cb->pcb_driver_curfrag[pq])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[pq])) -
   letoh32(sc->sc_cb->pcb_device_curfrag[pq])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[pq])));
236}

238void
239pgt_reinit_rx_desc_frag(struct pgt_softc *sc, struct pgt_desc *pd)
240{
pd->pd_fragp->pf_addr = htole32((uint32_t)pd->pd_dmaaddr)((__uint32_t)((uint32_t)pd->pd_dmaaddr));
pd->pd_fragp->pf_size = htole16(PGT_FRAG_SIZE)((__uint16_t)(1536));
pd->pd_fragp->pf_flags = 0;

bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0, pd->pd_dmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08))
   BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08));
247}

249int
250pgt_load_tx_desc_frag(struct pgt_softc *sc, enum pgt_queue pq,
  struct pgt_desc *pd)
252{
int error;

error = bus_dmamap_load(sc->sc_dmat, pd->pd_dmam, pd->pd_mem,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (pd->
pd_dmam), (pd->pd_mem), (1536), (((void *)0)), (0x0001))
   PGT_FRAG_SIZE, NULL, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (pd->
pd_dmam), (pd->pd_mem), (1536), (((void *)0)), (0x0001));
if (error) {
DPRINTF(("%s: unable to load %s tx DMA: %d\n",
    sc->sc_dev.dv_xname,
    pgt_queue_is_data(pq) ? "data" : "mgmt", error));
return (error);
}
pd->pd_dmaaddr = pd->pd_dmam->dm_segs[0].ds_addr;
pd->pd_fragp->pf_addr = htole32((uint32_t)pd->pd_dmaaddr)((__uint32_t)((uint32_t)pd->pd_dmaaddr));
pd->pd_fragp->pf_size = htole16(PGT_FRAG_SIZE)((__uint16_t)(1536));
pd->pd_fragp->pf_flags = htole16(0)((__uint16_t)(0));

bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0, pd->pd_dmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08))
   BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08));

return (0);
272}

274void
275pgt_unload_tx_desc_frag(struct pgt_softc *sc, struct pgt_desc *pd)
276{
      bus_dmamap_unload(sc->sc_dmat, pd->pd_dmam)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (pd->
pd_dmam));
pd->pd_dmaaddr = 0;
279}

281int
282pgt_load_firmware(struct pgt_softc *sc)
283{
int error, reg, dirreg, fwoff, ucodeoff, fwlen;
uint8_t *ucode;
uint32_t *uc;
size_t size;
char *name;

if (sc->sc_flags & SC_ISL38770x00000800)
name = "pgt-isl3877";
else
name = "pgt-isl3890";	/* includes isl3880 */

error = loadfirmware(name, &ucode, &size);

if (error != 0) {
DPRINTF(("%s: error %d, could not read firmware %s\n",
    sc->sc_dev.dv_xname, error, name));
return (EIO5);
}

if (size & 3) {
DPRINTF(("%s: bad firmware size %u\n",
    sc->sc_dev.dv_xname, size));
free(ucode, M_DEVBUF2, 0);
return (EINVAL22);
}

pgt_reboot(sc);

fwoff = 0;
ucodeoff = 0;
uc = (uint32_t *)ucode;
reg = PGT_FIRMWARE_INTERNAL_OFFSET0x20000;
while (fwoff < size) {
pgt_write_4_flush(sc, PGT_REG_DIR_MEM_BASE0x0030, reg);

if ((size - fwoff) >= PGT_DIRECT_MEMORY_SIZE0x1000)
	fwlen = PGT_DIRECT_MEMORY_SIZE0x1000;
else
	fwlen = size - fwoff;

dirreg = PGT_DIRECT_MEMORY_OFFSET0x1000;
while (fwlen > 4) {
	pgt_write_4(sc, dirreg, uc[ucodeoff]);
	fwoff += 4;
	dirreg += 4;
	reg += 4;
	fwlen -= 4;
	ucodeoff++;
}
pgt_write_4_flush(sc, dirreg, uc[ucodeoff]);
fwoff += 4;
dirreg += 4;
reg += 4;
fwlen -= 4;
ucodeoff++;
}
DPRINTF(("%s: %d bytes microcode loaded from %s\n",
   sc->sc_dev.dv_xname, fwoff, name));

reg = pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078);
reg &= ~(PGT_CTRL_STAT_RESET0x10000000 | PGT_CTRL_STAT_CLOCKRUN0x00800000);
reg |= PGT_CTRL_STAT_RAMBOOT0x20000000;
pgt_write_4_flush(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

reg |= PGT_CTRL_STAT_RESET0x10000000;
pgt_write_4(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

reg &= ~PGT_CTRL_STAT_RESET0x10000000;
pgt_write_4(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

free(ucode, M_DEVBUF2, 0);

return (0);
363}

365void
366pgt_cleanup_queue(struct pgt_softc *sc, enum pgt_queue pq,
  struct pgt_frag *pqfrags)
368{
struct pgt_desc *pd;
unsigned int i;

sc->sc_cb->pcb_device_curfrag[pq] = 0;
i = 0;
/* XXX why only freeq ??? */
TAILQ_FOREACH(pd, &sc->sc_freeq[pq], pd_link)for((pd) = ((&sc->sc_freeq[pq])->tqh_first); (pd) !=
 ((void *)0); (pd) = ((pd)->pd_link.tqe_next)) {
pd->pd_fragnum = i;
pd->pd_fragp = &pqfrags[i];
if (pgt_queue_is_rx(pq))
	pgt_reinit_rx_desc_frag(sc, pd);
i++;
}
sc->sc_freeq_count[pq] = i;
/*
* The ring buffer describes how many free buffers are available from
* the host (for receive queues) or how many are pending (for
* transmit queues).
*/
if (pgt_queue_is_rx(pq))
sc->sc_cb->pcb_driver_curfrag[pq] = htole32(i)((__uint32_t)(i));
else
sc->sc_cb->pcb_driver_curfrag[pq] = 0;
392}

394/*
* Turn off interrupts, reset the device (possibly loading firmware),
* and put everything in a known state.
*/
398int
399pgt_reset(struct pgt_softc *sc)
400{
int error;

/* disable all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN0x0018, 0);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

/*
* Set up the management receive queue, assuming there are no
* requests in progress.
*/
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
));
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_LOW_RX,
   &sc->sc_cb->pcb_data_low_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_LOW_TX,
   &sc->sc_cb->pcb_data_low_tx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_HIGH_RX,
   &sc->sc_cb->pcb_data_high_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_DATA_HIGH_TX,
   &sc->sc_cb->pcb_data_high_tx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_MGMT_RX,
   &sc->sc_cb->pcb_mgmt_rx[0]);
pgt_cleanup_queue(sc, PGT_QUEUE_MGMT_TX,
   &sc->sc_cb->pcb_mgmt_tx[0]);
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
));

/* load firmware */
if (sc->sc_flags & SC_NEEDS_FIRMWARE0x00000001) {
error = pgt_load_firmware(sc);
if (error) {
	printf("%s: firmware load failed\n",
	    sc->sc_dev.dv_xname);
	return (error);
}
sc->sc_flags &= ~SC_NEEDS_FIRMWARE0x00000001;
DPRINTF(("%s: firmware loaded\n", sc->sc_dev.dv_xname));
}

/* upload the control block's DMA address */
pgt_write_4_flush(sc, PGT_REG_CTRL_BLK_BASE0x0020,
   htole32((uint32_t)sc->sc_cbdmam->dm_segs[0].ds_addr)((__uint32_t)((uint32_t)sc->sc_cbdmam->dm_segs[0].ds_addr
)));
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

/* send a reset event */
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000, PGT_DEV_INT_RESET0x00000001);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

/* await only the initialization interrupt */
pgt_write_4_flush(sc, PGT_REG_INT_EN0x0018, PGT_INT_STAT_INIT0x00000004);	
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

return (0);
456}

458/*
* If we're trying to reset and the device has seemingly not been detached,
* we'll spend a minute seeing if we can't do the reset.
*/
462void
463pgt_stop(struct pgt_softc *sc, unsigned int flag)
464{
struct ieee80211com *ic;
unsigned int wokeup;
int tryagain = 0;

ic = &sc->sc_ic;

ic->ic_ific_ac.ac_if.if_flags &= ~IFF_RUNNING0x40;
sc->sc_flags |= SC_UNINITIALIZED0x00000002;
sc->sc_flags |= flag;

pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_LOW_TX);
pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
pgt_drain_tx_queue(sc, PGT_QUEUE_MGMT_TX);

479trying_again:
/* disable all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN0x0018, 0);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

/* reboot card */
pgt_reboot(sc);

do {
wokeup = 0;
/*
 * We don't expect to be woken up, just to drop the lock
 * and time out.  Only tx queues can have anything valid
 * on them outside of an interrupt.
 */
while (!TAILQ_EMPTY(&sc->sc_mgmtinprog)(((&sc->sc_mgmtinprog)->tqh_first) == ((void *)0))) {
	struct pgt_mgmt_desc *pmd;

	pmd = TAILQ_FIRST(&sc->sc_mgmtinprog)((&sc->sc_mgmtinprog)->tqh_first);
	TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link)do { if (((pmd)->pmd_link.tqe_next) != ((void *)0)) (pmd)->
pmd_link.tqe_next->pmd_link.tqe_prev = (pmd)->pmd_link.
tqe_prev; else (&sc->sc_mgmtinprog)->tqh_last = (pmd
)->pmd_link.tqe_prev; *(pmd)->pmd_link.tqe_prev = (pmd)
->pmd_link.tqe_next; ((pmd)->pmd_link.tqe_prev) = ((void
 *)-1); ((pmd)->pmd_link.tqe_next) = ((void *)-1); } while
 (0);
	pmd->pmd_error = ENETRESET52;
	wakeup_one(pmd)wakeup_n((pmd), 1);
	if (sc->sc_debug & SC_DEBUG_MGMT0x00000002)
		DPRINTF(("%s: queue: mgmt %p <- %#x "
		    "(drained)\n", sc->sc_dev.dv_xname,
		    pmd, pmd->pmd_oid));
	wokeup++;
}
if (wokeup > 0) {
	if (flag == SC_NEEDS_RESET0x00000008 && sc->sc_flags & SC_DYING0x00000004) {
		sc->sc_flags &= ~flag;
		return;
	}
}
} while (wokeup > 0);

if (flag == SC_NEEDS_RESET0x00000008) {
int error;

DPRINTF(("%s: resetting\n", sc->sc_dev.dv_xname));
sc->sc_flags &= ~SC_POWERSAVE0x00000040;
sc->sc_flags |= SC_NEEDS_FIRMWARE0x00000001;
error = pgt_reset(sc);
if (error == 0) {
	tsleep_nsec(&sc->sc_flags, 0, "pgtres", SEC_TO_NSEC(1));
	if (sc->sc_flags & SC_UNINITIALIZED0x00000002) {
		printf("%s: not responding\n",
		    sc->sc_dev.dv_xname);
		/* Thud.  It was probably removed. */
		if (tryagain)
			panic("pgt went for lunch"); /* XXX */
		tryagain = 1;
	} else {
		/* await all interrupts */
		pgt_write_4_flush(sc, PGT_REG_INT_EN0x0018,
		    PGT_INT_STAT_SOURCES0x8000401e);	
		DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
		ic->ic_ific_ac.ac_if.if_flags |= IFF_RUNNING0x40;
	}
}

if (tryagain)
	goto trying_again;

sc->sc_flags &= ~flag;
if (ic->ic_ific_ac.ac_if.if_flags & IFF_RUNNING0x40)
	pgt_update_hw_from_sw(sc,
	    ic->ic_state != IEEE80211_S_INIT);
}

ic->ic_ific_ac.ac_if.if_flags &= ~IFF_RUNNING0x40;
ifq_clr_oactive(&ic->ic_ific_ac.ac_if.if_snd);
ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1)(((&sc->sc_ic)->ic_newstate)((&sc->sc_ic), (
IEEE80211_S_INIT), (-1)));
552}

554void
555pgt_attach(struct device *self)
556{
struct pgt_softc *sc = (struct pgt_softc *)self;
int error;

/* debug flags */
//sc->sc_debug |= SC_DEBUG_QUEUES;	/* super verbose */
//sc->sc_debug |= SC_DEBUG_MGMT;
sc->sc_debug |= SC_DEBUG_UNEXPECTED0x00000004;
//sc->sc_debug |= SC_DEBUG_TRIGGER;	/* verbose */
//sc->sc_debug |= SC_DEBUG_EVENTS;	/* super verbose */
//sc->sc_debug |= SC_DEBUG_POWER;
sc->sc_debug |= SC_DEBUG_TRAP0x00000040;
sc->sc_debug |= SC_DEBUG_LINK0x00000080;
//sc->sc_debug |= SC_DEBUG_RXANNEX;
//sc->sc_debug |= SC_DEBUG_RXFRAG;
//sc->sc_debug |= SC_DEBUG_RXETHER;

/* enable card if possible */
if (sc->sc_enable != NULL((void *)0))
(*sc->sc_enable)(sc);

error = pgt_dma_alloc(sc);
if (error)
return;

sc->sc_ic.ic_ific_ac.ac_if.if_softc = sc;
TAILQ_INIT(&sc->sc_mgmtinprog)do { (&sc->sc_mgmtinprog)->tqh_first = ((void *)0);
 (&sc->sc_mgmtinprog)->tqh_last = &(&sc->
sc_mgmtinprog)->tqh_first; } while (0);
TAILQ_INIT(&sc->sc_kthread.sck_traps)do { (&sc->sc_kthread.sck_traps)->tqh_first = ((void
 *)0); (&sc->sc_kthread.sck_traps)->tqh_last = &
(&sc->sc_kthread.sck_traps)->tqh_first; } while (0);
sc->sc_flags |= SC_NEEDS_FIRMWARE0x00000001 | SC_UNINITIALIZED0x00000002;
sc->sc_80211_ioc_auth = IEEE80211_AUTH_OPEN1;

error = pgt_reset(sc);
if (error)
return;

tsleep_nsec(&sc->sc_flags, 0, "pgtres", SEC_TO_NSEC(1));
if (sc->sc_flags & SC_UNINITIALIZED0x00000002) {
printf("%s: not responding\n", sc->sc_dev.dv_xname);
sc->sc_flags |= SC_NEEDS_FIRMWARE0x00000001;
return;
} else {
/* await all interrupts */
pgt_write_4_flush(sc, PGT_REG_INT_EN0x0018, PGT_INT_STAT_SOURCES0x8000401e);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
}

error = pgt_net_attach(sc);
if (error)
return;

if (kthread_create(pgt_per_device_kthread, sc, NULL((void *)0),
   sc->sc_dev.dv_xname) != 0)
return;

ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1)(((&sc->sc_ic)->ic_newstate)((&sc->sc_ic), (
IEEE80211_S_INIT), (-1)));
611}

613int
614pgt_detach(struct pgt_softc *sc)
615{
if (sc->sc_flags & SC_NEEDS_FIRMWARE0x00000001 || sc->sc_flags & SC_UNINITIALIZED0x00000002)
1
Assuming the condition is true→
/* device was not initialized correctly, so leave early */
goto out;
2
←
Control jumps to line 629→

/* stop card */
pgt_stop(sc, SC_DYING0x00000004);
pgt_reboot(sc);

ieee80211_ifdetach(&sc->sc_ic.ic_ific_ac.ac_if);
if_detach(&sc->sc_ic.ic_ific_ac.ac_if);

627out:
/* disable card if possible */
if (sc->sc_disable != NULL((void *)0))
3
←
Assuming field 'sc_disable' is equal to NULL→
4
←
Taking false branch→
(*sc->sc_disable)(sc);

pgt_dma_free(sc);
5
←
Calling 'pgt_dma_free'→

return (0);
635}

637void
638pgt_reboot(struct pgt_softc *sc)
639{
uint32_t reg;

reg = pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078);
reg &= ~(PGT_CTRL_STAT_RESET0x10000000 | PGT_CTRL_STAT_RAMBOOT0x20000000);
pgt_write_4(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

reg |= PGT_CTRL_STAT_RESET0x10000000;
pgt_write_4(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);

reg &= ~PGT_CTRL_STAT_RESET0x10000000;
pgt_write_4(sc, PGT_REG_CTRL_STAT0x0078, reg);
pgt_write_memory_barrier(sc);
DELAY(PGT_RESET_DELAY)(*delay_func)(50000);
657}

659void
660pgt_init_intr(struct pgt_softc *sc)
661{
if ((sc->sc_flags & SC_UNINITIALIZED0x00000002) == 0) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: spurious initialization\n",
	    sc->sc_dev.dv_xname));
} else {
sc->sc_flags &= ~SC_UNINITIALIZED0x00000002;
wakeup(&sc->sc_flags);
}
670}

672/*
* If called with a NULL last_nextpkt, only the mgmt queue will be checked
* for new packets.
*/
676void
677pgt_update_intr(struct pgt_softc *sc, int hack)
678{
/* priority order */
enum pgt_queue pqs[PGT_QUEUE_COUNT6] = {
   PGT_QUEUE_MGMT_TX, PGT_QUEUE_MGMT_RX, 
   PGT_QUEUE_DATA_HIGH_TX, PGT_QUEUE_DATA_HIGH_RX, 
   PGT_QUEUE_DATA_LOW_TX, PGT_QUEUE_DATA_LOW_RX
};
struct mbuf *m;
uint32_t npend;
unsigned int dirtycount;
int i;

bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
));
pgt_debug_events(sc, "intr");
/*
* Check for completion of tx in their dirty queues.
* Check completion of rx into their dirty queues.
*/
for (i = 0; i < PGT_QUEUE_COUNT6; i++) {
size_t qdirty, qfree;

qdirty = sc->sc_dirtyq_count[pqs[i]];
qfree = sc->sc_freeq_count[pqs[i]];
/*
 * We want the wrap-around here.
 */
if (pgt_queue_is_rx(pqs[i])) {
	int data;

	data = pgt_queue_is_data(pqs[i]);
710#ifdef PGT_BUGGY_INTERRUPT_RECOVERY
	if (hack && data)
		continue;
713#endif
	npend = pgt_queue_frags_pending(sc, pqs[i]);
	/*
	 * Receive queues clean up below, so qdirty must
	 * always be 0.
	 */
	if (npend > qfree) {
		if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
			DPRINTF(("%s: rx queue [%u] "
			    "overflowed by %u\n",
			    sc->sc_dev.dv_xname, pqs[i],
			    npend - qfree));
		sc->sc_flags |= SC_INTR_RESET0x00000020;
		break;
	}
	while (qfree-- > npend)
		pgt_rxdone(sc, pqs[i]);
} else {
	npend = pgt_queue_frags_pending(sc, pqs[i]);
	if (npend > qdirty) {
		if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
			DPRINTF(("%s: tx queue [%u] "
			    "underflowed by %u\n",
			    sc->sc_dev.dv_xname, pqs[i],
			    npend - qdirty));
		sc->sc_flags |= SC_INTR_RESET0x00000020;
		break;
	}
	/*
	 * If the free queue was empty, or the data transmit
	 * queue just became empty, wake up any waiters.
	 */
	if (qdirty > npend) {
		if (pgt_queue_is_data(pqs[i])) {
			sc->sc_ic.ic_ific_ac.ac_if.if_timer = 0;
			ifq_clr_oactive(
			    &sc->sc_ic.ic_ific_ac.ac_if.if_snd);
		}
		while (qdirty-- > npend)
			pgt_txdone(sc, pqs[i]);
	}
}
}

/*
* This is the deferred completion for received management frames
* and where we queue network frames for stack input. 
*/
dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_MGMT_RX];
while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])(((&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])->tqh_first) ==
 ((void *)0))) {
struct pgt_mgmt_desc *pmd;

pmd = TAILQ_FIRST(&sc->sc_mgmtinprog)((&sc->sc_mgmtinprog)->tqh_first);
/*
 * If there is no mgmt request in progress or the operation
 * returned is explicitly a trap, this pmd will essentially
 * be ignored.
 */
pgt_mgmtrx_completion(sc, pmd);
}
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_MGMT_RX] =
   htole32(dirtycount +((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_MGMT_RX]))))
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_MGMT_RX]))((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_MGMT_RX]))));

dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_DATA_HIGH_RX];
while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_DATA_HIGH_RX])(((&sc->sc_dirtyq[PGT_QUEUE_DATA_HIGH_RX])->tqh_first
) == ((void *)0))) {
if ((m = pgt_datarx_completion(sc, PGT_QUEUE_DATA_HIGH_RX)))
	pgt_input_frames(sc, m);
}
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_HIGH_RX] =
   htole32(dirtycount +((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_DATA_HIGH_RX]))))
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_HIGH_RX]))((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_DATA_HIGH_RX]))));

dirtycount = sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_RX];
while (!TAILQ_EMPTY(&sc->sc_dirtyq[PGT_QUEUE_DATA_LOW_RX])(((&sc->sc_dirtyq[PGT_QUEUE_DATA_LOW_RX])->tqh_first
) == ((void *)0))) {
if ((m = pgt_datarx_completion(sc, PGT_QUEUE_DATA_LOW_RX)))
	pgt_input_frames(sc, m);
}
sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_LOW_RX] =
   htole32(dirtycount +((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_DATA_LOW_RX]))))
letoh32(sc->sc_cb->pcb_driver_curfrag[PGT_QUEUE_DATA_LOW_RX]))((__uint32_t)(dirtycount + ((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[PGT_QUEUE_DATA_LOW_RX]))));

/*
* Write out what we've finished with.
*/
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
));
801}

803struct mbuf *
804pgt_ieee80211_encap(struct pgt_softc *sc, struct ether_header *eh,
  struct mbuf *m, struct ieee80211_node **ni)
806{
struct ieee80211com *ic;
struct ieee80211_frame *frame;
struct llc *snap;

ic = &sc->sc_ic;
if (ni != NULL((void *)0) && ic->ic_opmode == IEEE80211_M_MONITOR) {
*ni = ieee80211_ref_node(ic->ic_bss);
(*ni)->ni_inact = 0;
return (m);
}

M_PREPEND(m, sizeof(*frame) + sizeof(*snap), M_DONTWAIT)(m) = m_prepend((m), (sizeof(*frame) + sizeof(*snap)), (0x0002
));
if (m == NULL((void *)0))
return (m);
if (m->m_lenm_hdr.mh_len < sizeof(*frame) + sizeof(*snap)) {
m = m_pullup(m, sizeof(*frame) + sizeof(*snap));
if (m == NULL((void *)0))
	return (m);
}
frame = mtod(m, struct ieee80211_frame *)((struct ieee80211_frame *)((m)->m_hdr.mh_data));
snap = (struct llc *)&frame[1];
if (ni != NULL((void *)0)) {
if (ic->ic_opmode == IEEE80211_M_STA) {
	*ni = ieee80211_ref_node(ic->ic_bss);
}
832#ifndef IEEE80211_STA_ONLY
else {
	*ni = ieee80211_find_node(ic, eh->ether_shost);
	/*
	 * Make up associations for ad-hoc mode.  To support
	 * ad-hoc WPA, we'll need to maintain a bounded
	 * pool of ad-hoc stations.
	 */
	if (*ni == NULL((void *)0) &&
	    ic->ic_opmode != IEEE80211_M_HOSTAP) {
		*ni = ieee80211_dup_bss(ic, eh->ether_shost);
		if (*ni != NULL((void *)0)) {
			(*ni)->ni_associd = 1;
			ic->ic_newassoc(ic, *ni, 1);
		}
	}
	if (*ni == NULL((void *)0)) {
		m_freem(m);
		return (NULL((void *)0));
	}
}
853#endif
(*ni)->ni_inact = 0;
}
snap->llc_dsap = snap->llc_ssap = LLC_SNAP_LSAP0xaa;
snap->llc_controlllc_un.type_u.control = LLC_UI0x3;
snap->llc_snapllc_un.type_snap.org_code[0] = 0;
snap->llc_snapllc_un.type_snap.org_code[1] = 0;
snap->llc_snapllc_un.type_snap.org_code[2] = 0;
snap->llc_snapllc_un.type_snap.ether_type = eh->ether_type;
frame->i_fc[0] = IEEE80211_FC0_VERSION_00x00 | IEEE80211_FC0_TYPE_DATA0x08;
/* Doesn't look like much of the 802.11 header is available. */
*(uint16_t *)frame->i_dur = *(uint16_t *)frame->i_seq = 0;
/*
* Translate the addresses; WDS is not handled.
*/
switch (ic->ic_opmode) {
case IEEE80211_M_STA:
frame->i_fc[1] = IEEE80211_FC1_DIR_FROMDS0x02;
IEEE80211_ADDR_COPY(frame->i_addr1, eh->ether_dhost)__builtin_memcpy((frame->i_addr1), (eh->ether_dhost), (
6));
IEEE80211_ADDR_COPY(frame->i_addr2, ic->ic_bss->ni_bssid)__builtin_memcpy((frame->i_addr2), (ic->ic_bss->ni_bssid
), (6));
IEEE80211_ADDR_COPY(frame->i_addr3, eh->ether_shost)__builtin_memcpy((frame->i_addr3), (eh->ether_shost), (
6));
break;
875#ifndef IEEE80211_STA_ONLY
case IEEE80211_M_IBSS:
case IEEE80211_M_AHDEMO:
frame->i_fc[1] = IEEE80211_FC1_DIR_NODS0x00;
IEEE80211_ADDR_COPY(frame->i_addr1, eh->ether_dhost)__builtin_memcpy((frame->i_addr1), (eh->ether_dhost), (
6));
IEEE80211_ADDR_COPY(frame->i_addr2, eh->ether_shost)__builtin_memcpy((frame->i_addr2), (eh->ether_shost), (
6));
IEEE80211_ADDR_COPY(frame->i_addr3, ic->ic_bss->ni_bssid)__builtin_memcpy((frame->i_addr3), (ic->ic_bss->ni_bssid
), (6));
break;
case IEEE80211_M_HOSTAP:
/* HostAP forwarding defaults to being done on firmware. */
frame->i_fc[1] = IEEE80211_FC1_DIR_TODS0x01;
IEEE80211_ADDR_COPY(frame->i_addr1, ic->ic_bss->ni_bssid)__builtin_memcpy((frame->i_addr1), (ic->ic_bss->ni_bssid
), (6));
IEEE80211_ADDR_COPY(frame->i_addr2, eh->ether_shost)__builtin_memcpy((frame->i_addr2), (eh->ether_shost), (
6));
IEEE80211_ADDR_COPY(frame->i_addr3, eh->ether_dhost)__builtin_memcpy((frame->i_addr3), (eh->ether_dhost), (
6));
break;
890#endif
default:
break;
}
return (m);
895}

897void
898pgt_input_frames(struct pgt_softc *sc, struct mbuf *m)
899{
struct ether_header eh;
struct mbuf_list ml = MBUF_LIST_INITIALIZER(){ ((void *)0), ((void *)0), 0 };
struct ifnet *ifp;
struct ieee80211_channel *chan;
struct ieee80211_rxinfo rxi;
struct ieee80211_node *ni;
struct ieee80211com *ic;
struct pgt_rx_annex *pra;
struct pgt_rx_header *pha;
struct mbuf *next;
unsigned int n;
uint32_t rstamp;
uint8_t rssi;

ic = &sc->sc_ic;
ifp = &ic->ic_ific_ac.ac_if;
for (next = m; m != NULL((void *)0); m = next) {
next = m->m_nextpktm_hdr.mh_nextpkt;
m->m_nextpktm_hdr.mh_nextpkt = NULL((void *)0);

if (ic->ic_opmode == IEEE80211_M_MONITOR) {
	if (m->m_lenm_hdr.mh_len < sizeof(*pha)) {
		m = m_pullup(m, sizeof(*pha));
		if (m == NULL((void *)0)) {
			if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
				DPRINTF(("%s: m_pullup "
				    "failure\n",
				    sc->sc_dev.dv_xname));
			ifp->if_ierrorsif_data.ifi_ierrors++;
			continue;
		}
	}
	pha = mtod(m, struct pgt_rx_header *)((struct pgt_rx_header *)((m)->m_hdr.mh_data));
	pra = NULL((void *)0);
	goto input;
}

if (m->m_lenm_hdr.mh_len < sizeof(*pra)) {
	m = m_pullup(m, sizeof(*pra));
	if (m == NULL((void *)0)) {
		if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
			DPRINTF(("%s: m_pullup failure\n",
			    sc->sc_dev.dv_xname));
		ifp->if_ierrorsif_data.ifi_ierrors++;
		continue;
	}
}
pra = mtod(m, struct pgt_rx_annex *)((struct pgt_rx_annex *)((m)->m_hdr.mh_data));
pha = &pra->pra_header;
if (sc->sc_debug & SC_DEBUG_RXANNEX0x00000100)
	DPRINTF(("%s: rx annex: ? %04x "
	    "len %u clock %u flags %02x ? %02x rate %u ? %02x "
	    "freq %u ? %04x rssi %u pad %02x%02x%02x\n",
	    sc->sc_dev.dv_xname,
	    letoh16(pha->pra_unknown0),
	    letoh16(pha->pra_length),
	    letoh32(pha->pra_clock), pha->pra_flags,
	    pha->pra_unknown1, pha->pra_rate,
	    pha->pra_unknown2, letoh32(pha->pra_frequency),
	    pha->pra_unknown3, pha->pra_rssi,
	    pha->pra_pad[0], pha->pra_pad[1], pha->pra_pad[2]));
if (sc->sc_debug & SC_DEBUG_RXETHER0x00000400)
	DPRINTF(("%s: rx ether: %s < %s 0x%04x\n",
	    sc->sc_dev.dv_xname,
	    ether_sprintf(pra->pra_ether_dhost),
	    ether_sprintf(pra->pra_ether_shost),
	    ntohs(pra->pra_ether_type)));

memcpy(eh.ether_dhost, pra->pra_ether_dhost, ETHER_ADDR_LEN)__builtin_memcpy((eh.ether_dhost), (pra->pra_ether_dhost),
 (6));
memcpy(eh.ether_shost, pra->pra_ether_shost, ETHER_ADDR_LEN)__builtin_memcpy((eh.ether_shost), (pra->pra_ether_shost),
 (6));
eh.ether_type = pra->pra_ether_type;

972input:
/*
 * This flag is set if e.g. packet could not be decrypted.
 */
if (pha->pra_flags & PRA_FLAG_BAD0x01) {
	ifp->if_ierrorsif_data.ifi_ierrors++;
	m_freem(m);
	continue;
}

/*
 * After getting what we want, chop off the annex, then
 * turn into something that looks like it really was
 * 802.11.
 */
rssi = pha->pra_rssi;
rstamp = letoh32(pha->pra_clock)((__uint32_t)(pha->pra_clock));
n = ieee80211_mhz2ieee(letoh32(pha->pra_frequency)((__uint32_t)(pha->pra_frequency)), 0);
if (n <= IEEE80211_CHAN_MAX255)
	chan = &ic->ic_channels[n];
else
	chan = ic->ic_bss->ni_chan;
/* Send to 802.3 listeners. */
if (pra) {
	m_adj(m, sizeof(*pra));
} else
	m_adj(m, sizeof(*pha));

m = pgt_ieee80211_encap(sc, &eh, m, &ni);
if (m != NULL((void *)0)) {
1002#if NBPFILTER1 > 0
	if (sc->sc_drvbpf != NULL((void *)0)) {
		struct mbuf mb;
		struct pgt_rx_radiotap_hdr *tap = &sc->sc_rxtapsc_rxtapu.th;

		tap->wr_flags = 0;
		tap->wr_chan_freq = htole16(chan->ic_freq)((__uint16_t)(chan->ic_freq));
		tap->wr_chan_flags = htole16(chan->ic_flags)((__uint16_t)(chan->ic_flags));
		tap->wr_rssi = rssi;
		tap->wr_max_rssi = ic->ic_max_rssi;

		mb.m_datam_hdr.mh_data = (caddr_t)tap;
		mb.m_lenm_hdr.mh_len = sc->sc_rxtap_len;
		mb.m_nextm_hdr.mh_next = m;
		mb.m_nextpktm_hdr.mh_nextpkt = NULL((void *)0);
		mb.m_typem_hdr.mh_type = 0;
		mb.m_flagsm_hdr.mh_flags = 0;
		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN(1 << 0));
	}
1021#endif
	memset(&rxi, 0, sizeof(rxi))__builtin_memset((&rxi), (0), (sizeof(rxi)));
	ni->ni_rssi = rxi.rxi_rssi = rssi;
	ni->ni_rstamp = rxi.rxi_tstamp = rstamp;
	ieee80211_inputm(ifp, m, ni, &rxi, &ml);
	/*
	 * The frame may have caused the node to be marked for
	 * reclamation (e.g. in response to a DEAUTH message)
	 * so use free_node here instead of unref_node.
	 */
	if (ni == ic->ic_bss)
		ieee80211_unref_node(&ni);
	else
		ieee80211_release_node(&sc->sc_ic, ni);
} else {
	ifp->if_ierrorsif_data.ifi_ierrors++;
}
}
if_input(ifp, &ml);
1040}

1042void
1043pgt_wakeup_intr(struct pgt_softc *sc)
1044{
int shouldupdate;
int i;

shouldupdate = 0;
/* Check for any queues being empty before updating. */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02))
   BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02));
for (i = 0; !shouldupdate && i < PGT_QUEUE_COUNT6; i++) {
if (pgt_queue_is_tx(i))
	shouldupdate = pgt_queue_frags_pending(sc, i);
else
	shouldupdate = pgt_queue_frags_pending(sc, i) <
	    sc->sc_freeq_count[i];
}
if (!TAILQ_EMPTY(&sc->sc_mgmtinprog)(((&sc->sc_mgmtinprog)->tqh_first) == ((void *)0)))
shouldupdate = 1;
if (sc->sc_debug & SC_DEBUG_POWER0x00000020)
DPRINTF(("%s: wakeup interrupt (update = %d)\n",
    sc->sc_dev.dv_xname, shouldupdate));
sc->sc_flags &= ~SC_POWERSAVE0x00000040;
if (shouldupdate) {
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000, PGT_DEV_INT_UPDATE0x00000002);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
}
1070}

1072void
1073pgt_sleep_intr(struct pgt_softc *sc)
1074{
int allowed;
int i;

allowed = 1;
/* Check for any queues not being empty before allowing. */
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02))
   BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02));
for (i = 0; allowed && i < PGT_QUEUE_COUNT6; i++) {
if (pgt_queue_is_tx(i))
	allowed = pgt_queue_frags_pending(sc, i) == 0;
else
	allowed = pgt_queue_frags_pending(sc, i) >=
	    sc->sc_freeq_count[i];
}
if (!TAILQ_EMPTY(&sc->sc_mgmtinprog)(((&sc->sc_mgmtinprog)->tqh_first) == ((void *)0)))
allowed = 0;
if (sc->sc_debug & SC_DEBUG_POWER0x00000020)
DPRINTF(("%s: sleep interrupt (allowed = %d)\n",
    sc->sc_dev.dv_xname, allowed));
if (allowed && sc->sc_ic.ic_flags & IEEE80211_F_PMGTON0x00000400) {
sc->sc_flags |= SC_POWERSAVE0x00000040;
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000, PGT_DEV_INT_SLEEP0x00000010);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
}
1100}

1102void
1103pgt_empty_traps(struct pgt_softc_kthread *sck)
1104{
struct pgt_async_trap *pa;
struct mbuf *m;

while (!TAILQ_EMPTY(&sck->sck_traps)(((&sck->sck_traps)->tqh_first) == ((void *)0))) {
pa = TAILQ_FIRST(&sck->sck_traps)((&sck->sck_traps)->tqh_first);
TAILQ_REMOVE(&sck->sck_traps, pa, pa_link)do { if (((pa)->pa_link.tqe_next) != ((void *)0)) (pa)->
pa_link.tqe_next->pa_link.tqe_prev = (pa)->pa_link.tqe_prev
; else (&sck->sck_traps)->tqh_last = (pa)->pa_link
.tqe_prev; *(pa)->pa_link.tqe_prev = (pa)->pa_link.tqe_next
; ((pa)->pa_link.tqe_prev) = ((void *)-1); ((pa)->pa_link
.tqe_next) = ((void *)-1); } while (0);
m = pa->pa_mbuf;
m_freem(m);
}
1114}

1116void
1117pgt_per_device_kthread(void *argp)
1118{
struct pgt_softc *sc;
struct pgt_softc_kthread *sck;
struct pgt_async_trap *pa;
struct mbuf *m;
int s;

sc = argp;
sck = &sc->sc_kthread;
while (!sck->sck_exit) {
if (!sck->sck_update && !sck->sck_reset &&
    TAILQ_EMPTY(&sck->sck_traps)(((&sck->sck_traps)->tqh_first) == ((void *)0)))
	tsleep_nsec(&sc->sc_kthread, 0, "pgtkth", INFSLP0xffffffffffffffffULL);
if (sck->sck_reset) {
	DPRINTF(("%s: [thread] async reset\n",
	    sc->sc_dev.dv_xname));
	sck->sck_reset = 0;
	sck->sck_update = 0;
	pgt_empty_traps(sck);
	s = splnet()splraise(0x4);
	pgt_stop(sc, SC_NEEDS_RESET0x00000008);
	splx(s)spllower(s);
} else if (!TAILQ_EMPTY(&sck->sck_traps)(((&sck->sck_traps)->tqh_first) == ((void *)0))) {
	DPRINTF(("%s: [thread] got a trap\n",
	    sc->sc_dev.dv_xname));
	pa = TAILQ_FIRST(&sck->sck_traps)((&sck->sck_traps)->tqh_first);
	TAILQ_REMOVE(&sck->sck_traps, pa, pa_link)do { if (((pa)->pa_link.tqe_next) != ((void *)0)) (pa)->
pa_link.tqe_next->pa_link.tqe_prev = (pa)->pa_link.tqe_prev
; else (&sck->sck_traps)->tqh_last = (pa)->pa_link
.tqe_prev; *(pa)->pa_link.tqe_prev = (pa)->pa_link.tqe_next
; ((pa)->pa_link.tqe_prev) = ((void *)-1); ((pa)->pa_link
.tqe_next) = ((void *)-1); } while (0);
	m = pa->pa_mbuf;
	m_adj(m, sizeof(*pa));
	pgt_update_sw_from_hw(sc, pa, m);
	m_freem(m);
} else if (sck->sck_update) {
	sck->sck_update = 0;
	pgt_update_sw_from_hw(sc, NULL((void *)0), NULL((void *)0));
}
}
pgt_empty_traps(sck);
kthread_exit(0);
1156}

1158void
1159pgt_async_reset(struct pgt_softc *sc)
1160{
if (sc->sc_flags & (SC_DYING0x00000004 | SC_NEEDS_RESET0x00000008))
return;
sc->sc_kthread.sck_reset = 1;
wakeup(&sc->sc_kthread);
1165}

1167void
1168pgt_async_update(struct pgt_softc *sc)
1169{
if (sc->sc_flags & SC_DYING0x00000004)
return;
sc->sc_kthread.sck_update = 1;
wakeup(&sc->sc_kthread);
1174}

1176int
1177pgt_intr(void *arg)
1178{
struct pgt_softc *sc;
struct ifnet *ifp;
u_int32_t reg;

sc = arg;
ifp = &sc->sc_ic.ic_ific_ac.ac_if;

/*
* Here the Linux driver ands in the value of the INT_EN register,
* and masks off everything but the documented interrupt bits.  Why?
*
* Unknown bit 0x4000 is set upon initialization, 0x8000000 some
* other times.
*/
if (sc->sc_ic.ic_flags & IEEE80211_F_PMGTON0x00000400 &&
   sc->sc_flags & SC_POWERSAVE0x00000040) {
/*
 * Don't try handling the interrupt in sleep mode.
 */
reg = pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078);
if (reg & PGT_CTRL_STAT_SLEEPMODE0x00000200)
	return (0);
}
reg = pgt_read_4(sc, PGT_REG_INT_STAT0x0010);
if (reg == 0)
return (0); /* This interrupt is not from us */

pgt_write_4_flush(sc, PGT_REG_INT_ACK0x0014, reg);
if (reg & PGT_INT_STAT_INIT0x00000004)
pgt_init_intr(sc);
if (reg & PGT_INT_STAT_UPDATE0x00000002) {
pgt_update_intr(sc, 0);
/*
 * If we got an update, it's not really asleep.
 */
sc->sc_flags &= ~SC_POWERSAVE0x00000040;
/*
 * Pretend I have any idea what the documentation
 * would say, and just give it a shot sending an
 * "update" after acknowledging the interrupt
 * bits and writing out the new control block.
 */
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000, PGT_DEV_INT_UPDATE0x00000002);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
}
if (reg & PGT_INT_STAT_SLEEP0x00000010 && !(reg & PGT_INT_STAT_WAKEUP0x00000008))
pgt_sleep_intr(sc);
if (reg & PGT_INT_STAT_WAKEUP0x00000008)
pgt_wakeup_intr(sc);

if (sc->sc_flags & SC_INTR_RESET0x00000020) {
sc->sc_flags &= ~SC_INTR_RESET0x00000020;
pgt_async_reset(sc);
}

if (reg & ~PGT_INT_STAT_SOURCES0x8000401e && sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004) {
DPRINTF(("%s: unknown interrupt bits %#x (stat %#x)\n",
    sc->sc_dev.dv_xname,
    reg & ~PGT_INT_STAT_SOURCES,
    pgt_read_4(sc, PGT_REG_CTRL_STAT)));
}

if (!ifq_empty(&ifp->if_snd)(({ typeof((&ifp->if_snd)->ifq_len) __tmp = *(volatile
 typeof((&ifp->if_snd)->ifq_len) *)&((&ifp->
if_snd)->ifq_len); membar_datadep_consumer(); __tmp; }) ==
 0))
pgt_start(ifp);

return (1);
1245}

1247void
1248pgt_txdone(struct pgt_softc *sc, enum pgt_queue pq)
1249{
struct pgt_desc *pd;

pd = TAILQ_FIRST(&sc->sc_dirtyq[pq])((&sc->sc_dirtyq[pq])->tqh_first);
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_dirtyq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
sc->sc_dirtyq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[pq])->tqh_last; *(&sc
->sc_freeq[pq])->tqh_last = (pd); (&sc->sc_freeq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_freeq_count[pq]++;
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02))
   pd->pd_dmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02))
   BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02));
/* Management frames want completion information. */
if (sc->sc_debug & SC_DEBUG_QUEUES0x00000001) {
DPRINTF(("%s: queue: tx %u <- [%u]\n",
    sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
if (sc->sc_debug & SC_DEBUG_MGMT0x00000002 && pgt_queue_is_mgmt(pq)) {
	struct pgt_mgmt_frame *pmf;

	pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
	DPRINTF(("%s: queue: txmgmt %p <- "
	    "(ver %u, op %u, flags %#x)\n",
	    sc->sc_dev.dv_xname,
	    pd, pmf->pmf_version, pmf->pmf_operation,
	    pmf->pmf_flags));
}
}
pgt_unload_tx_desc_frag(sc, pd);
1276}

1278void
1279pgt_rxdone(struct pgt_softc *sc, enum pgt_queue pq)
1280{
struct pgt_desc *pd;

pd = TAILQ_FIRST(&sc->sc_freeq[pq])((&sc->sc_freeq[pq])->tqh_first);
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_freeq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
sc->sc_freeq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_dirtyq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_dirtyq[pq])->tqh_last; *(&
sc->sc_dirtyq[pq])->tqh_last = (pd); (&sc->sc_dirtyq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_dirtyq_count[pq]++;
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02))
   pd->pd_dmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02))
   BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x02));
if (sc->sc_debug & SC_DEBUG_QUEUES0x00000001)
DPRINTF(("%s: queue: rx %u <- [%u]\n",
    sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004 &&
   pd->pd_fragp->pf_flags & ~htole16(PF_FLAG_MF)((__uint16_t)(0x0001)))
DPRINTF(("%s: unknown flags on rx [%u]: %#x\n",
    sc->sc_dev.dv_xname, pq, letoh16(pd->pd_fragp->pf_flags)));
1298}

1300/*
* Traps are generally used for the firmware to report changes in state
* back to the host.  Mostly this processes changes in link state, but
* it needs to also be used to initiate WPA and other authentication
* schemes in terms of client (station) or server (access point).
*/
1306void
1307pgt_trap_received(struct pgt_softc *sc, uint32_t oid, void *trapdata,
  size_t size)
1309{
struct pgt_async_trap *pa;
struct mbuf *m;
char *p;
size_t total;

if (sc->sc_flags & SC_DYING0x00000004)
return;

total = sizeof(oid) + size + sizeof(struct pgt_async_trap);
if (total > MLEN(256 - sizeof(struct m_hdr))) {
MGETHDR(m, M_DONTWAIT, MT_DATA)m = m_gethdr((0x0002), (1));
if (m == NULL((void *)0))
	return;
MCLGET(m, M_DONTWAIT)(void) m_clget((m), (0x0002), (1 << 11));
if (!(m->m_flagsm_hdr.mh_flags & M_EXT0x0001)) {
	m_freem(m);
	m = NULL((void *)0);
}
} else
m = m_get(M_DONTWAIT0x0002, MT_DATA1);

if (m == NULL((void *)0))
return;
else
m->m_lenm_hdr.mh_len = total;

pa = mtod(m, struct pgt_async_trap *)((struct pgt_async_trap *)((m)->m_hdr.mh_data));
p = mtod(m, char *)((char *)((m)->m_hdr.mh_data)) + sizeof(*pa);
*(uint32_t *)p = oid;
p += sizeof(uint32_t);
memcpy(p, trapdata, size)__builtin_memcpy((p), (trapdata), (size));
pa->pa_mbuf = m;

TAILQ_INSERT_TAIL(&sc->sc_kthread.sck_traps, pa, pa_link)do { (pa)->pa_link.tqe_next = ((void *)0); (pa)->pa_link
.tqe_prev = (&sc->sc_kthread.sck_traps)->tqh_last; *
(&sc->sc_kthread.sck_traps)->tqh_last = (pa); (&
sc->sc_kthread.sck_traps)->tqh_last = &(pa)->pa_link
.tqe_next; } while (0);
wakeup(&sc->sc_kthread);
1345}

1347/*
* Process a completed management response (all requests should be
* responded to, quickly) or an event (trap).
*/
1351void
1352pgt_mgmtrx_completion(struct pgt_softc *sc, struct pgt_mgmt_desc *pmd)
1353{
struct pgt_desc *pd;
struct pgt_mgmt_frame *pmf;
uint32_t oid, size;

pd = TAILQ_FIRST(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])((&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])->tqh_first);
TAILQ_REMOVE(&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_dirtyq[PGT_QUEUE_MGMT_RX])->tqh_last
 = (pd)->pd_link.tqe_prev; *(pd)->pd_link.tqe_prev = (pd
)->pd_link.tqe_next; ((pd)->pd_link.tqe_prev) = ((void *
)-1); ((pd)->pd_link.tqe_next) = ((void *)-1); } while (0);
sc->sc_dirtyq_count[PGT_QUEUE_MGMT_RX]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[PGT_QUEUE_MGMT_RX],do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last
; *(&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last = (
pd); (&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last =
 &(pd)->pd_link.tqe_next; } while (0)
   pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last
; *(&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last = (
pd); (&sc->sc_freeq[PGT_QUEUE_MGMT_RX])->tqh_last =
 &(pd)->pd_link.tqe_next; } while (0);
sc->sc_freeq_count[PGT_QUEUE_MGMT_RX]++;
if (letoh16(pd->pd_fragp->pf_size)((__uint16_t)(pd->pd_fragp->pf_size)) < sizeof(*pmf)) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: mgmt desc too small: %u\n",
	    sc->sc_dev.dv_xname,
	    letoh16(pd->pd_fragp->pf_size)));
goto out_nopmd;
}
pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
if (pmf->pmf_version != PMF_VER0x01) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: unknown mgmt version %u\n",
	    sc->sc_dev.dv_xname, pmf->pmf_version));
goto out_nopmd;
}
if (pmf->pmf_device != PMF_DEV0x00) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: unknown mgmt dev %u\n",
	    sc->sc_dev.dv_xname, pmf->pmf_device));
goto out;
}
if (pmf->pmf_flags & ~PMF_FLAG_VALID(0x01 | 0x02)) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: unknown mgmt flags %x\n",
	    sc->sc_dev.dv_xname,
	    pmf->pmf_flags & ~PMF_FLAG_VALID));
goto out;
}
if (pmf->pmf_flags & PMF_FLAG_LE0x02) {
oid = letoh32(pmf->pmf_oid)((__uint32_t)(pmf->pmf_oid));
size = letoh32(pmf->pmf_size)((__uint32_t)(pmf->pmf_size));
} else {
oid = betoh32(pmf->pmf_oid)(__uint32_t)(__builtin_constant_p(pmf->pmf_oid) ? (__uint32_t
)(((__uint32_t)(pmf->pmf_oid) & 0xff) << 24 | ((
__uint32_t)(pmf->pmf_oid) & 0xff00) << 8 | ((__uint32_t
)(pmf->pmf_oid) & 0xff0000) >> 8 | ((__uint32_t)
(pmf->pmf_oid) & 0xff000000) >> 24) : __swap32md
(pmf->pmf_oid));
size = betoh32(pmf->pmf_size)(__uint32_t)(__builtin_constant_p(pmf->pmf_size) ? (__uint32_t
)(((__uint32_t)(pmf->pmf_size) & 0xff) << 24 | (
(__uint32_t)(pmf->pmf_size) & 0xff00) << 8 | ((__uint32_t
)(pmf->pmf_size) & 0xff0000) >> 8 | ((__uint32_t
)(pmf->pmf_size) & 0xff000000) >> 24) : __swap32md
(pmf->pmf_size));
}
if (pmf->pmf_operation == PMF_OP_TRAP) {
pmd = NULL((void *)0); /* ignored */
DPRINTF(("%s: mgmt trap received (op %u, oid %#x, len %u)\n",
    sc->sc_dev.dv_xname,
    pmf->pmf_operation, oid, size));
pgt_trap_received(sc, oid, (char *)pmf + sizeof(*pmf),
    min(size, PGT_FRAG_SIZE1536 - sizeof(*pmf)));
goto out_nopmd;
}
if (pmd == NULL((void *)0)) {
if (sc->sc_debug & (SC_DEBUG_UNEXPECTED0x00000004 | SC_DEBUG_MGMT0x00000002))
	DPRINTF(("%s: spurious mgmt received "
	    "(op %u, oid %#x, len %u)\n", sc->sc_dev.dv_xname,
	    pmf->pmf_operation, oid, size));
goto out_nopmd;
}
switch (pmf->pmf_operation) {
case PMF_OP_RESPONSE:
pmd->pmd_error = 0;
break;
case PMF_OP_ERROR:
pmd->pmd_error = EPERM1;
goto out;
default:
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: unknown mgmt op %u\n",
	    sc->sc_dev.dv_xname, pmf->pmf_operation));
pmd->pmd_error = EIO5;
goto out;
}
if (oid != pmd->pmd_oid) {
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	DPRINTF(("%s: mgmt oid changed from %#x -> %#x\n",
	    sc->sc_dev.dv_xname, pmd->pmd_oid, oid));
pmd->pmd_oid = oid;
}
if (pmd->pmd_recvbuf != NULL((void *)0)) {
if (size > PGT_FRAG_SIZE1536) {
	if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
		DPRINTF(("%s: mgmt oid %#x has bad size %u\n",
		    sc->sc_dev.dv_xname, oid, size));
	pmd->pmd_error = EIO5;
	goto out;
}
if (size > pmd->pmd_len)
	pmd->pmd_error = ENOMEM12;
else
	memcpy(pmd->pmd_recvbuf, (char *)pmf + sizeof(*pmf),__builtin_memcpy((pmd->pmd_recvbuf), ((char *)pmf + sizeof
(*pmf)), (size))
	    size)__builtin_memcpy((pmd->pmd_recvbuf), ((char *)pmf + sizeof
(*pmf)), (size));
pmd->pmd_len = size;
}

1450out:
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link)do { if (((pmd)->pmd_link.tqe_next) != ((void *)0)) (pmd)->
pmd_link.tqe_next->pmd_link.tqe_prev = (pmd)->pmd_link.
tqe_prev; else (&sc->sc_mgmtinprog)->tqh_last = (pmd
)->pmd_link.tqe_prev; *(pmd)->pmd_link.tqe_prev = (pmd)
->pmd_link.tqe_next; ((pmd)->pmd_link.tqe_prev) = ((void
 *)-1); ((pmd)->pmd_link.tqe_next) = ((void *)-1); } while
 (0);
wakeup_one(pmd)wakeup_n((pmd), 1);
if (sc->sc_debug & SC_DEBUG_MGMT0x00000002)
DPRINTF(("%s: queue: mgmt %p <- (op %u, oid %#x, len %u)\n",
    sc->sc_dev.dv_xname, pmd, pmf->pmf_operation,
    pmd->pmd_oid, pmd->pmd_len));
1457out_nopmd:
pgt_reinit_rx_desc_frag(sc, pd);
1459}

1461/*
* Queue packets for reception and defragmentation.  I don't know now
* whether the rx queue being full enough to start, but not finish,
* queueing a fragmented packet, can happen.
*/
1466struct mbuf *
1467pgt_datarx_completion(struct pgt_softc *sc, enum pgt_queue pq)
1468{
struct ifnet *ifp;
struct pgt_desc *pd;
struct mbuf *top, **mp, *m;
size_t datalen;
uint16_t morefrags, dataoff;
int tlen = 0;

ifp = &sc->sc_ic.ic_ific_ac.ac_if;
m = NULL((void *)0);
top = NULL((void *)0);
mp = &top;

while ((pd = TAILQ_FIRST(&sc->sc_dirtyq[pq])((&sc->sc_dirtyq[pq])->tqh_first)) != NULL((void *)0)) {
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_dirtyq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
sc->sc_dirtyq_count[pq]--;
datalen = letoh16(pd->pd_fragp->pf_size)((__uint16_t)(pd->pd_fragp->pf_size));
dataoff = letoh32(pd->pd_fragp->pf_addr)((__uint32_t)(pd->pd_fragp->pf_addr)) - pd->pd_dmaaddr;
morefrags = pd->pd_fragp->pf_flags & htole16(PF_FLAG_MF)((__uint16_t)(0x0001));

if (sc->sc_debug & SC_DEBUG_RXFRAG0x00000200)
	DPRINTF(("%s: rx frag: len %u memoff %u flags %x\n",
	    sc->sc_dev.dv_xname, datalen, dataoff,
	    pd->pd_fragp->pf_flags));

/* Add the (two+?) bytes for the header. */
if (datalen + dataoff > PGT_FRAG_SIZE1536) {
	if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
		DPRINTF(("%s data rx too big: %u\n",
		    sc->sc_dev.dv_xname, datalen));
	goto fail;
}

if (m == NULL((void *)0))
	MGETHDR(m, M_DONTWAIT, MT_DATA)m = m_gethdr((0x0002), (1));
else
	m = m_get(M_DONTWAIT0x0002, MT_DATA1);

if (m == NULL((void *)0))
	goto fail;
if (datalen > MHLEN((256 - sizeof(struct m_hdr)) - sizeof(struct pkthdr))) {
	MCLGET(m, M_DONTWAIT)(void) m_clget((m), (0x0002), (1 << 11));
	if (!(m->m_flagsm_hdr.mh_flags & M_EXT0x0001)) {
		m_free(m);
		goto fail;
	}
}
bcopy(pd->pd_mem + dataoff, mtod(m, char *)((char *)((m)->m_hdr.mh_data)), datalen);
m->m_lenm_hdr.mh_len = datalen;
tlen += datalen;

*mp = m;
mp = &m->m_nextm_hdr.mh_next;

TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[pq])->tqh_last; *(&sc
->sc_freeq[pq])->tqh_last = (pd); (&sc->sc_freeq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_freeq_count[pq]++;
pgt_reinit_rx_desc_frag(sc, pd);

if (!morefrags)
	break;
}

if (top) {
top->m_pkthdrM_dat.MH.MH_pkthdr.len = tlen;
}
return (top);

1535fail:
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[pq])->tqh_last; *(&sc
->sc_freeq[pq])->tqh_last = (pd); (&sc->sc_freeq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_freeq_count[pq]++;
pgt_reinit_rx_desc_frag(sc, pd);

ifp->if_ierrorsif_data.ifi_ierrors++;
m_freem(top);
return (NULL((void *)0));
1543}

1545int
1546pgt_oid_get(struct pgt_softc *sc, enum pgt_oid oid,
  void *arg, size_t arglen)
1548{
struct pgt_mgmt_desc pmd;
int error;

bzero(&pmd, sizeof(pmd))__builtin_bzero((&pmd), (sizeof(pmd)));
pmd.pmd_recvbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;

error = pgt_mgmt_request(sc, &pmd);
if (error == 0)
error = pmd.pmd_error;
if (error != 0 && error != EPERM1 && sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
DPRINTF(("%s: failure getting oid %#x: %d\n",
    sc->sc_dev.dv_xname, oid, error));

return (error);
1565}

1567int
1568pgt_oid_retrieve(struct pgt_softc *sc, enum pgt_oid oid,
  void *arg, size_t arglen)
1570{
struct pgt_mgmt_desc pmd;
int error;

bzero(&pmd, sizeof(pmd))__builtin_bzero((&pmd), (sizeof(pmd)));
pmd.pmd_sendbuf = arg;
pmd.pmd_recvbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;

error = pgt_mgmt_request(sc, &pmd);
if (error == 0)
error = pmd.pmd_error;
if (error != 0 && error != EPERM1 && sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
DPRINTF(("%s: failure retrieving oid %#x: %d\n",
    sc->sc_dev.dv_xname, oid, error));

return (error);
1588}

1590int
1591pgt_oid_set(struct pgt_softc *sc, enum pgt_oid oid,
  const void *arg, size_t arglen)
1593{
struct pgt_mgmt_desc pmd;
int error;

bzero(&pmd, sizeof(pmd))__builtin_bzero((&pmd), (sizeof(pmd)));
pmd.pmd_sendbuf = arg;
pmd.pmd_len = arglen;
pmd.pmd_oid = oid;

error = pgt_mgmt_request(sc, &pmd);
if (error == 0)
error = pmd.pmd_error;
if (error != 0 && error != EPERM1 && sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
DPRINTF(("%s: failure setting oid %#x: %d\n",
    sc->sc_dev.dv_xname, oid, error));

return (error);
1610}

1612void
1613pgt_state_dump(struct pgt_softc *sc)
1614{
printf("%s: state dump: control 0x%08x interrupt 0x%08x\n",
   sc->sc_dev.dv_xname,
   pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078),
   pgt_read_4(sc, PGT_REG_INT_STAT0x0010));

printf("%s: state dump: driver curfrag[]\n",
   sc->sc_dev.dv_xname);

printf("%s: 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
   sc->sc_dev.dv_xname,
   letoh32(sc->sc_cb->pcb_driver_curfrag[0])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[0])),
   letoh32(sc->sc_cb->pcb_driver_curfrag[1])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[1])),
   letoh32(sc->sc_cb->pcb_driver_curfrag[2])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[2])),
   letoh32(sc->sc_cb->pcb_driver_curfrag[3])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[3])),
   letoh32(sc->sc_cb->pcb_driver_curfrag[4])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[4])),
   letoh32(sc->sc_cb->pcb_driver_curfrag[5])((__uint32_t)(sc->sc_cb->pcb_driver_curfrag[5])));

printf("%s: state dump: device curfrag[]\n",
   sc->sc_dev.dv_xname);

printf("%s: 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x 0x%08x\n",
   sc->sc_dev.dv_xname,
   letoh32(sc->sc_cb->pcb_device_curfrag[0])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[0])),
   letoh32(sc->sc_cb->pcb_device_curfrag[1])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[1])),
   letoh32(sc->sc_cb->pcb_device_curfrag[2])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[2])),
   letoh32(sc->sc_cb->pcb_device_curfrag[3])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[3])),
   letoh32(sc->sc_cb->pcb_device_curfrag[4])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[4])),
   letoh32(sc->sc_cb->pcb_device_curfrag[5])((__uint32_t)(sc->sc_cb->pcb_device_curfrag[5])));
1643}

1645int
1646pgt_mgmt_request(struct pgt_softc *sc, struct pgt_mgmt_desc *pmd)
1647{
struct pgt_desc *pd;
struct pgt_mgmt_frame *pmf;
int error, i, ret;

if (sc->sc_flags & (SC_DYING0x00000004 | SC_NEEDS_RESET0x00000008))
return (EIO5);
if (pmd->pmd_len > PGT_FRAG_SIZE1536 - sizeof(*pmf))
return (ENOMEM12);
pd = TAILQ_FIRST(&sc->sc_freeq[PGT_QUEUE_MGMT_TX])((&sc->sc_freeq[PGT_QUEUE_MGMT_TX])->tqh_first);
if (pd == NULL((void *)0))
return (ENOMEM12);
error = pgt_load_tx_desc_frag(sc, PGT_QUEUE_MGMT_TX, pd);
if (error)
return (error);
pmf = (struct pgt_mgmt_frame *)pd->pd_mem;
pmf->pmf_version = PMF_VER0x01;
/* "get" and "retrieve" operations look the same */
if (pmd->pmd_recvbuf != NULL((void *)0))
pmf->pmf_operation = PMF_OP_GET;
else
pmf->pmf_operation = PMF_OP_SET;
pmf->pmf_oid = htobe32(pmd->pmd_oid)(__uint32_t)(__builtin_constant_p(pmd->pmd_oid) ? (__uint32_t
)(((__uint32_t)(pmd->pmd_oid) & 0xff) << 24 | ((
__uint32_t)(pmd->pmd_oid) & 0xff00) << 8 | ((__uint32_t
)(pmd->pmd_oid) & 0xff0000) >> 8 | ((__uint32_t)
(pmd->pmd_oid) & 0xff000000) >> 24) : __swap32md
(pmd->pmd_oid));
pmf->pmf_device = PMF_DEV0x00;
pmf->pmf_flags = 0;
pmf->pmf_size = htobe32(pmd->pmd_len)(__uint32_t)(__builtin_constant_p(pmd->pmd_len) ? (__uint32_t
)(((__uint32_t)(pmd->pmd_len) & 0xff) << 24 | ((
__uint32_t)(pmd->pmd_len) & 0xff00) << 8 | ((__uint32_t
)(pmd->pmd_len) & 0xff0000) >> 8 | ((__uint32_t)
(pmd->pmd_len) & 0xff000000) >> 24) : __swap32md
(pmd->pmd_len));
/* "set" and "retrieve" operations both send data */
if (pmd->pmd_sendbuf != NULL((void *)0))
memcpy(pmf + 1, pmd->pmd_sendbuf, pmd->pmd_len)__builtin_memcpy((pmf + 1), (pmd->pmd_sendbuf), (pmd->pmd_len
));
else
bzero(pmf + 1, pmd->pmd_len)__builtin_bzero((pmf + 1), (pmd->pmd_len));
pmd->pmd_error = EINPROGRESS36;
TAILQ_INSERT_TAIL(&sc->sc_mgmtinprog, pmd, pmd_link)do { (pmd)->pmd_link.tqe_next = ((void *)0); (pmd)->pmd_link
.tqe_prev = (&sc->sc_mgmtinprog)->tqh_last; *(&
sc->sc_mgmtinprog)->tqh_last = (pmd); (&sc->sc_mgmtinprog
)->tqh_last = &(pmd)->pmd_link.tqe_next; } while (0
);
if (sc->sc_debug & SC_DEBUG_MGMT0x00000002)
DPRINTF(("%s: queue: mgmt %p -> (op %u, oid %#x, len %u)\n",
    sc->sc_dev.dv_xname,
    pmd, pmf->pmf_operation,
    pmd->pmd_oid, pmd->pmd_len));
pgt_desc_transmit(sc, PGT_QUEUE_MGMT_TX, pd,
   sizeof(*pmf) + pmd->pmd_len, 0);
/*
* Try for one second, triggering 10 times.
*
* Do our best to work around seemingly buggy CardBus controllers
* on Soekris 4521 that fail to get interrupts with alarming
* regularity: run as if an interrupt occurred and service every
* queue except for mbuf reception.
*/
i = 0;
do {
ret = tsleep_nsec(pmd, 0, "pgtmgm", MSEC_TO_NSEC(100));
if (ret != EWOULDBLOCK35)
	break;
if (pmd->pmd_error != EINPROGRESS36)
	break;
if (sc->sc_flags & (SC_DYING0x00000004 | SC_NEEDS_RESET0x00000008)) {
	pmd->pmd_error = EIO5;
	TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link)do { if (((pmd)->pmd_link.tqe_next) != ((void *)0)) (pmd)->
pmd_link.tqe_next->pmd_link.tqe_prev = (pmd)->pmd_link.
tqe_prev; else (&sc->sc_mgmtinprog)->tqh_last = (pmd
)->pmd_link.tqe_prev; *(pmd)->pmd_link.tqe_prev = (pmd)
->pmd_link.tqe_next; ((pmd)->pmd_link.tqe_prev) = ((void
 *)-1); ((pmd)->pmd_link.tqe_next) = ((void *)-1); } while
 (0);
	break;
}
if (i != 9)
	pgt_maybe_trigger(sc, PGT_QUEUE_MGMT_RX);
1709#ifdef PGT_BUGGY_INTERRUPT_RECOVERY
pgt_update_intr(sc, 0);
1711#endif
} while (i++ < 10);

if (pmd->pmd_error == EINPROGRESS36) {
printf("%s: timeout waiting for management "
    "packet response to %#x\n",
    sc->sc_dev.dv_xname, pmd->pmd_oid);
TAILQ_REMOVE(&sc->sc_mgmtinprog, pmd, pmd_link)do { if (((pmd)->pmd_link.tqe_next) != ((void *)0)) (pmd)->
pmd_link.tqe_next->pmd_link.tqe_prev = (pmd)->pmd_link.
tqe_prev; else (&sc->sc_mgmtinprog)->tqh_last = (pmd
)->pmd_link.tqe_prev; *(pmd)->pmd_link.tqe_prev = (pmd)
->pmd_link.tqe_next; ((pmd)->pmd_link.tqe_prev) = ((void
 *)-1); ((pmd)->pmd_link.tqe_next) = ((void *)-1); } while
 (0);
if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
	pgt_state_dump(sc);
pgt_async_reset(sc);
error = ETIMEDOUT60;
} else
error = 0;

return (error);
1727}

1729void
1730pgt_desc_transmit(struct pgt_softc *sc, enum pgt_queue pq, struct pgt_desc *pd,
  uint16_t len, int morecoming)
1732{
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_freeq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
sc->sc_freeq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_dirtyq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_dirtyq[pq])->tqh_last; *(&
sc->sc_dirtyq[pq])->tqh_last = (pd); (&sc->sc_dirtyq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_dirtyq_count[pq]++;
if (sc->sc_debug & SC_DEBUG_QUEUES0x00000001)
DPRINTF(("%s: queue: tx %u -> [%u]\n", sc->sc_dev.dv_xname,
    pd->pd_fragnum, pq));
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
));
if (morecoming)
pd->pd_fragp->pf_flags |= htole16(PF_FLAG_MF)((__uint16_t)(0x0001));
pd->pd_fragp->pf_size = htole16(len)((__uint16_t)(len));
bus_dmamap_sync(sc->sc_dmat, pd->pd_dmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08))
   pd->pd_dmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08))
   BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (pd->
pd_dmam), (0), (pd->pd_dmam->dm_mapsize), (0x08));
sc->sc_cb->pcb_driver_curfrag[pq] =
   htole32(letoh32(sc->sc_cb->pcb_driver_curfrag[pq]) + 1)((__uint32_t)(((__uint32_t)(sc->sc_cb->pcb_driver_curfrag
[pq])) + 1));
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
));
if (!morecoming)
pgt_maybe_trigger(sc, pq);
1756}

1758void
1759pgt_maybe_trigger(struct pgt_softc *sc, enum pgt_queue pq)
1760{
unsigned int tries = 1000000 / PGT_WRITEIO_DELAY10; /* one second */
uint32_t reg;

if (sc->sc_debug & SC_DEBUG_TRIGGER0x00000008)
DPRINTF(("%s: triggered by queue [%u]\n",
    sc->sc_dev.dv_xname, pq));
pgt_debug_events(sc, "trig");
if (sc->sc_flags & SC_POWERSAVE0x00000040) {
/* Magic values ahoy? */
if (pgt_read_4(sc, PGT_REG_INT_STAT0x0010) == 0xabadface) {
	do {
		reg = pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078);
		if (!(reg & PGT_CTRL_STAT_SLEEPMODE0x00000200))
			DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
	} while (tries-- != 0);
	if (!(reg & PGT_CTRL_STAT_SLEEPMODE0x00000200)) {
		if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
			DPRINTF(("%s: timeout triggering from "
			    "sleep mode\n",
			    sc->sc_dev.dv_xname));
		pgt_async_reset(sc);
		return;
	}
}
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000,
    PGT_DEV_INT_WAKEUP0x00000008);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
/* read the status back in */
(void)pgt_read_4(sc, PGT_REG_CTRL_STAT0x0078);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
} else {
pgt_write_4_flush(sc, PGT_REG_DEV_INT0x0000, PGT_DEV_INT_UPDATE0x00000002);
DELAY(PGT_WRITEIO_DELAY)(*delay_func)(10);
}
1795}

1797struct ieee80211_node *
1798pgt_ieee80211_node_alloc(struct ieee80211com *ic)
1799{
struct pgt_ieee80211_node *pin;

pin = malloc(sizeof(*pin), M_DEVBUF2, M_NOWAIT0x0002 | M_ZERO0x0008);
if (pin != NULL((void *)0)) {
pin->pin_dot1x_auth = PIN_DOT1X_UNAUTHORIZED;
}
return (struct ieee80211_node *)pin;
1807}

1809void
1810pgt_ieee80211_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
  int reallynew)
1812{
ieee80211_ref_node(ni);
1814}

1816void
1817pgt_ieee80211_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1818{
struct pgt_ieee80211_node *pin;

pin = (struct pgt_ieee80211_node *)ni;
free(pin, M_DEVBUF2, 0);
1823}

1825void
1826pgt_ieee80211_node_copy(struct ieee80211com *ic, struct ieee80211_node *dst,
  const struct ieee80211_node *src)
1828{
const struct pgt_ieee80211_node *psrc;
struct pgt_ieee80211_node *pdst;

psrc = (const struct pgt_ieee80211_node *)src;
pdst = (struct pgt_ieee80211_node *)dst;
bcopy(psrc, pdst, sizeof(*psrc));
1835}

1837int
1838pgt_ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
  int type, int arg1, int arg2)
1840{
return (EOPNOTSUPP45);
1842}

1844int
1845pgt_net_attach(struct pgt_softc *sc)
1846{
struct ieee80211com *ic = &sc->sc_ic;
struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
struct ieee80211_rateset *rs;
uint8_t rates[IEEE80211_RATE_MAXSIZE15];
struct pgt_obj_buffer psbuffer;
struct pgt_obj_frequencies *freqs;
uint32_t phymode, country;
unsigned int chan, i, j, firstchan = -1;
int error;

psbuffer.pob_size = htole32(PGT_FRAG_SIZE * PGT_PSM_BUFFER_FRAME_COUNT)((__uint32_t)(1536 * 64));
psbuffer.pob_addr = htole32(sc->sc_psmdmam->dm_segs[0].ds_addr)((__uint32_t)(sc->sc_psmdmam->dm_segs[0].ds_addr));
error = pgt_oid_set(sc, PGT_OID_PSM_BUFFER, &psbuffer, sizeof(country));
if (error)
return (error);
error = pgt_oid_get(sc, PGT_OID_PHY, &phymode, sizeof(phymode));
if (error)
return (error);
error = pgt_oid_get(sc, PGT_OID_MAC_ADDRESS, ic->ic_myaddr,
   sizeof(ic->ic_myaddr));
if (error)
return (error);
error = pgt_oid_get(sc, PGT_OID_COUNTRY, &country, sizeof(country));
if (error)
return (error);

ifp->if_softc = sc;
ifp->if_ioctl = pgt_ioctl;
ifp->if_start = pgt_start;
ifp->if_watchdog = pgt_watchdog;
ifp->if_flags = IFF_SIMPLEX0x800 | IFF_BROADCAST0x2 | IFF_MULTICAST0x8000;
strlcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ16);

ifq_init_maxlen(&ifp->if_snd, IFQ_MAXLEN256);

/*
* Set channels
*
* Prism hardware likes to report supported frequencies that are
* not actually available for the country of origin.
*/
j = sizeof(*freqs) + (IEEE80211_CHAN_MAX255 + 1) * sizeof(uint16_t);
freqs = malloc(j, M_DEVBUF2, M_WAITOK0x0001);
error = pgt_oid_get(sc, PGT_OID_SUPPORTED_FREQUENCIES, freqs, j);
if (error) {
free(freqs, M_DEVBUF2, 0);
return (error);
}

for (i = 0, j = letoh16(freqs->pof_count)((__uint16_t)(freqs->pof_count)); i < j; i++) {
chan = ieee80211_mhz2ieee(letoh16(freqs->pof_freqlist_mhz[i])((__uint16_t)(freqs->pof_freqlist_mhz[i])),
    0);

if (chan > IEEE80211_CHAN_MAX255) {
	printf("%s: reported bogus channel (%uMHz)\n",
	    sc->sc_dev.dv_xname, chan);
	free(freqs, M_DEVBUF2, 0);
	return (EIO5);
}

if (letoh16(freqs->pof_freqlist_mhz[i])((__uint16_t)(freqs->pof_freqlist_mhz[i])) < 5000) {
	if (!(phymode & htole32(PGT_OID_PHY_2400MHZ)((__uint32_t)(0x00000001))))
		continue;
	if (country == letoh32(PGT_COUNTRY_USA)((__uint32_t)(0))) {
		if (chan >= 12 && chan <= 14)
			continue;
	}
	if (chan <= 14)
		ic->ic_channels[chan].ic_flags |=
		    IEEE80211_CHAN_B(0x0080 | 0x0020);
	ic->ic_channels[chan].ic_flags |= IEEE80211_CHAN_PUREG(0x0080 | 0x0040);
} else {
	if (!(phymode & htole32(PGT_OID_PHY_5000MHZ)((__uint32_t)(0x00000002))))
		continue;
	ic->ic_channels[chan].ic_flags |= IEEE80211_CHAN_A(0x0100 | 0x0040);
}

ic->ic_channels[chan].ic_freq =
    letoh16(freqs->pof_freqlist_mhz[i])((__uint16_t)(freqs->pof_freqlist_mhz[i]));

if (firstchan == -1)
	firstchan = chan;

DPRINTF(("%s: set channel %d to freq %uMHz\n",
    sc->sc_dev.dv_xname, chan,
    letoh16(freqs->pof_freqlist_mhz[i])));
}
free(freqs, M_DEVBUF2, 0);
if (firstchan == -1) {
printf("%s: no channels found\n", sc->sc_dev.dv_xname);
return (EIO5);
}

/*
* Set rates
*/
bzero(rates, sizeof(rates))__builtin_bzero((rates), (sizeof(rates)));
error = pgt_oid_get(sc, PGT_OID_SUPPORTED_RATES, rates, sizeof(rates));
if (error)
return (error);
for (i = 0; i < sizeof(rates) && rates[i] != 0; i++) {
switch (rates[i]) {
case 2:
case 4:
case 11:
case 22:
case 44: /* maybe */
	if (phymode & htole32(PGT_OID_PHY_2400MHZ)((__uint32_t)(0x00000001))) {
		rs = &ic->ic_sup_rates[IEEE80211_MODE_11B];
		rs->rs_rates[rs->rs_nrates++] = rates[i];
	}
default:
	if (phymode & htole32(PGT_OID_PHY_2400MHZ)((__uint32_t)(0x00000001))) {
		rs = &ic->ic_sup_rates[IEEE80211_MODE_11G];
		rs->rs_rates[rs->rs_nrates++] = rates[i];
	}
	if (phymode & htole32(PGT_OID_PHY_5000MHZ)((__uint32_t)(0x00000002))) {
		rs = &ic->ic_sup_rates[IEEE80211_MODE_11A];
		rs->rs_rates[rs->rs_nrates++] = rates[i];
	}
	rs = &ic->ic_sup_rates[IEEE80211_MODE_AUTO];
	rs->rs_rates[rs->rs_nrates++] = rates[i];
}
}

ic->ic_caps = IEEE80211_C_WEP0x00000001 | IEEE80211_C_PMGT0x00000004 | IEEE80211_C_TXPMGT0x00000040 |
   IEEE80211_C_SHSLOT0x00000080 | IEEE80211_C_SHPREAMBLE0x00000100 | IEEE80211_C_MONITOR0x00000200;
1974#ifndef IEEE80211_STA_ONLY
ic->ic_caps |= IEEE80211_C_IBSS0x00000002 | IEEE80211_C_HOSTAP0x00000008;
1976#endif
ic->ic_opmode = IEEE80211_M_STA;
ic->ic_state = IEEE80211_S_INIT;

if_attach(ifp);
ieee80211_ifattach(ifp);

/* setup post-attach/pre-lateattach vector functions */
sc->sc_newstate = ic->ic_newstate;
ic->ic_newstate = pgt_newstate;
ic->ic_node_alloc = pgt_ieee80211_node_alloc;
ic->ic_newassoc = pgt_ieee80211_newassoc;
ic->ic_node_free = pgt_ieee80211_node_free;
ic->ic_node_copy = pgt_ieee80211_node_copy;
ic->ic_send_mgmt = pgt_ieee80211_send_mgmt;
ic->ic_max_rssi = 255;	/* rssi is a u_int8_t */

/* let net80211 handle switching around the media + resetting */
ieee80211_media_init(ifp, pgt_media_change, pgt_media_status);

1996#if NBPFILTER1 > 0
bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO127,
   sizeof(struct ieee80211_frame) + 64);

sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_len = htole16(sc->sc_rxtap_len)((__uint16_t)(sc->sc_rxtap_len));
sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_present = htole32(PGT_RX_RADIOTAP_PRESENT)((__uint32_t)(((1 << IEEE80211_RADIOTAP_FLAGS) | (1 <<
 IEEE80211_RADIOTAP_CHANNEL) | (1 << IEEE80211_RADIOTAP_RSSI
))));

sc->sc_txtap_len = sizeof(sc->sc_txtapu);
sc->sc_txtapsc_txtapu.th.wt_ihdr.it_len = htole16(sc->sc_txtap_len)((__uint16_t)(sc->sc_txtap_len));
sc->sc_txtapsc_txtapu.th.wt_ihdr.it_present = htole32(PGT_TX_RADIOTAP_PRESENT)((__uint32_t)(((1 << IEEE80211_RADIOTAP_FLAGS) | (1 <<
 IEEE80211_RADIOTAP_RATE) | (1 << IEEE80211_RADIOTAP_CHANNEL
))));
2007#endif
return (0);
2009}

2011int
2012pgt_media_change(struct ifnet *ifp)
2013{
struct pgt_softc *sc = ifp->if_softc;
int error;

      error = ieee80211_media_change(ifp);
      if (error == ENETRESET52) {
              pgt_update_hw_from_sw(sc, 0);
              error = 0;
      }

      return (error);
2024}

2026void
2027pgt_media_status(struct ifnet *ifp, struct ifmediareq *imr)
2028{
struct pgt_softc *sc = ifp->if_softc;
struct ieee80211com *ic = &sc->sc_ic;
uint32_t rate;
int s;

imr->ifm_status = 0;
imr->ifm_active = IFM_IEEE802110x0000000000000400ULL | IFM_NONE2ULL;

if (!(ifp->if_flags & IFF_UP0x1))
return;

s = splnet()splraise(0x4);

if (ic->ic_fixed_rate != -1) {
rate = ic->ic_sup_rates[ic->ic_curmode].
    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL0x7f;
} else {
if (pgt_oid_get(sc, PGT_OID_LINK_STATE, &rate, sizeof(rate)))
	goto out;
rate = letoh32(rate)((__uint32_t)(rate));
if (sc->sc_debug & SC_DEBUG_LINK0x00000080) {
	DPRINTF(("%s: %s: link rate %u\n",
	    sc->sc_dev.dv_xname, __func__, rate));
}
if (rate == 0)
	goto out;
}

imr->ifm_status = IFM_AVALID0x0000000000000001ULL;
imr->ifm_active = IFM_IEEE802110x0000000000000400ULL;
if (ic->ic_state == IEEE80211_S_RUN)
imr->ifm_status |= IFM_ACTIVE0x0000000000000002ULL;

imr->ifm_active |= ieee80211_rate2media(ic, rate, ic->ic_curmode);

switch (ic->ic_opmode) {
case IEEE80211_M_STA:
break;
2067#ifndef IEEE80211_STA_ONLY
case IEEE80211_M_IBSS:
imr->ifm_active |= IFM_IEEE80211_ADHOC0x0000000000010000ULL;
break;
case IEEE80211_M_AHDEMO:
imr->ifm_active |= IFM_IEEE80211_ADHOC0x0000000000010000ULL | IFM_FLAG00x0000100000000000ULL;
break;
case IEEE80211_M_HOSTAP:
imr->ifm_active |= IFM_IEEE80211_HOSTAP0x0000000000020000ULL;
break;
2077#endif
case IEEE80211_M_MONITOR:
imr->ifm_active |= IFM_IEEE80211_MONITOR0x0000000000100000ULL;
break;
default:
break;
}

2085out:
splx(s)spllower(s);
2087}

2089/*
* Start data frames.  Critical sections surround the boundary of
* management frame transmission / transmission acknowledgement / response
* and data frame transmission / transmission acknowledgement.
*/
2094void
2095pgt_start(struct ifnet *ifp)
2096{
struct pgt_softc *sc;
struct ieee80211com *ic;
struct pgt_desc *pd;
struct mbuf *m;
int error;

sc = ifp->if_softc;
ic = &sc->sc_ic;

if (sc->sc_flags & (SC_DYING0x00000004 | SC_NEEDS_RESET0x00000008) ||
   !(ifp->if_flags & IFF_RUNNING0x40) ||
   ic->ic_state != IEEE80211_S_RUN) {
return;
}

/*
* Management packets should probably be MLME frames
* (i.e. hostap "managed" mode); we don't touch the
* net80211 management queue.
*/
for (; sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] <
   PGT_QUEUE_FULL_THRESHOLD8 && !ifq_empty(&ifp->if_snd)(({ typeof((&ifp->if_snd)->ifq_len) __tmp = *(volatile
 typeof((&ifp->if_snd)->ifq_len) *)&((&ifp->
if_snd)->ifq_len); membar_datadep_consumer(); __tmp; }) ==
 0);) {
pd = TAILQ_FIRST(&sc->sc_freeq[PGT_QUEUE_DATA_LOW_TX])((&sc->sc_freeq[PGT_QUEUE_DATA_LOW_TX])->tqh_first);
m = ifq_deq_begin(&ifp->if_snd);
if (m == NULL((void *)0))
	break;
if (m->m_pkthdrM_dat.MH.MH_pkthdr.len <= PGT_FRAG_SIZE1536) {
	error = pgt_load_tx_desc_frag(sc,
	    PGT_QUEUE_DATA_LOW_TX, pd);
	if (error) {
		ifq_deq_rollback(&ifp->if_snd, m);
		break;
	}
	ifq_deq_commit(&ifp->if_snd, m);
	m_copydata(m, 0, m->m_pkthdrM_dat.MH.MH_pkthdr.len, pd->pd_mem);
	pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
	    pd, m->m_pkthdrM_dat.MH.MH_pkthdr.len, 0);
} else if (m->m_pkthdrM_dat.MH.MH_pkthdr.len <= PGT_FRAG_SIZE1536 * 2) {
	struct pgt_desc *pd2;

	/*
	 * Transmit a fragmented frame if there is
	 * not enough room in one fragment; limit
	 * to two fragments (802.11 itself couldn't
	 * even support a full two.)
	 */
	if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] + 2 >
	    PGT_QUEUE_FULL_THRESHOLD8) {
		ifq_deq_rollback(&ifp->if_snd, m);
		break;
	}
	pd2 = TAILQ_NEXT(pd, pd_link)((pd)->pd_link.tqe_next);
	error = pgt_load_tx_desc_frag(sc,
	    PGT_QUEUE_DATA_LOW_TX, pd);
	if (error == 0) {
		error = pgt_load_tx_desc_frag(sc,
		    PGT_QUEUE_DATA_LOW_TX, pd2);
		if (error) {
			pgt_unload_tx_desc_frag(sc, pd);
			TAILQ_INSERT_HEAD(&sc->sc_freeq[do { if (((pd)->pd_link.tqe_next = (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first) != ((void *)0)) (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first->pd_link.tqe_prev = &(pd)->pd_link
.tqe_next; else (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX]
)->tqh_last = &(pd)->pd_link.tqe_next; (&sc->
sc_freeq[ PGT_QUEUE_DATA_LOW_TX])->tqh_first = (pd); (pd)->
pd_link.tqe_prev = &(&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first; } while (0)
			    PGT_QUEUE_DATA_LOW_TX], pd,do { if (((pd)->pd_link.tqe_next = (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first) != ((void *)0)) (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first->pd_link.tqe_prev = &(pd)->pd_link
.tqe_next; else (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX]
)->tqh_last = &(pd)->pd_link.tqe_next; (&sc->
sc_freeq[ PGT_QUEUE_DATA_LOW_TX])->tqh_first = (pd); (pd)->
pd_link.tqe_prev = &(&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first; } while (0)
			    pd_link)do { if (((pd)->pd_link.tqe_next = (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first) != ((void *)0)) (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first->pd_link.tqe_prev = &(pd)->pd_link
.tqe_next; else (&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX]
)->tqh_last = &(pd)->pd_link.tqe_next; (&sc->
sc_freeq[ PGT_QUEUE_DATA_LOW_TX])->tqh_first = (pd); (pd)->
pd_link.tqe_prev = &(&sc->sc_freeq[ PGT_QUEUE_DATA_LOW_TX
])->tqh_first; } while (0);
		}
	}
	if (error) {
		ifq_deq_rollback(&ifp->if_snd, m);
		break;
	}
	ifq_deq_commit(&ifp->if_snd, m);
	m_copydata(m, 0, PGT_FRAG_SIZE1536, pd->pd_mem);
	pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
	    pd, PGT_FRAG_SIZE1536, 1);
	m_copydata(m, PGT_FRAG_SIZE1536,
	    m->m_pkthdrM_dat.MH.MH_pkthdr.len - PGT_FRAG_SIZE1536, pd2->pd_mem);
	pgt_desc_transmit(sc, PGT_QUEUE_DATA_LOW_TX,
	    pd2, m->m_pkthdrM_dat.MH.MH_pkthdr.len - PGT_FRAG_SIZE1536, 0);
} else {
	ifq_deq_commit(&ifp->if_snd, m);
	ifp->if_oerrorsif_data.ifi_oerrors++;
	m_freem(m);
	m = NULL((void *)0);
}
if (m != NULL((void *)0)) {
	struct ieee80211_node *ni;
2181#if NBPFILTER1 > 0
	if (ifp->if_bpf != NULL((void *)0))
		bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT(1 << 1));
2184#endif
	ifp->if_timer = 1;
	sc->sc_txtimer = 5;
	ni = ieee80211_find_txnode(&sc->sc_ic,
	    mtod(m, struct ether_header *)((struct ether_header *)((m)->m_hdr.mh_data))->ether_dhost);
	if (ni != NULL((void *)0)) {
		ni->ni_inact = 0;
		if (ni != ic->ic_bss)
			ieee80211_release_node(&sc->sc_ic, ni);
	}
2194#if NBPFILTER1 > 0
	if (sc->sc_drvbpf != NULL((void *)0)) {
		struct mbuf mb;
		struct ether_header eh;
		struct pgt_tx_radiotap_hdr *tap = &sc->sc_txtapsc_txtapu.th;

		bcopy(mtod(m, struct ether_header *)((struct ether_header *)((m)->m_hdr.mh_data)), &eh,
		    sizeof(eh));
		m_adj(m, sizeof(eh));
		m = pgt_ieee80211_encap(sc, &eh, m, NULL((void *)0));

		tap->wt_flags = 0;
		//tap->wt_rate = rate;
		tap->wt_rate = 0;
		tap->wt_chan_freq =
		    htole16(ic->ic_bss->ni_chan->ic_freq)((__uint16_t)(ic->ic_bss->ni_chan->ic_freq));
		tap->wt_chan_flags =
		    htole16(ic->ic_bss->ni_chan->ic_flags)((__uint16_t)(ic->ic_bss->ni_chan->ic_flags));

		if (m != NULL((void *)0)) {
			mb.m_datam_hdr.mh_data = (caddr_t)tap;
			mb.m_lenm_hdr.mh_len = sc->sc_txtap_len;
			mb.m_nextm_hdr.mh_next = m;
			mb.m_nextpktm_hdr.mh_nextpkt = NULL((void *)0);
			mb.m_typem_hdr.mh_type = 0;
			mb.m_flagsm_hdr.mh_flags = 0;

			bpf_mtap(sc->sc_drvbpf, &mb,
			    BPF_DIRECTION_OUT(1 << 1));
		}
	}
2225#endif
	m_freem(m);
}
}
2229}

2231int
2232pgt_ioctl(struct ifnet *ifp, u_long cmd, caddr_t req)
2233{
struct pgt_softc *sc = ifp->if_softc;
struct ifreq *ifr;
struct wi_req *wreq;
struct ieee80211_nodereq_all *na;
struct ieee80211com *ic;
      struct pgt_obj_bsslist *pob;
      struct wi_scan_p2_hdr *p2hdr;
      struct wi_scan_res *res;
      uint32_t noise;
int maxscan, i, j, s, error = 0;

ic = &sc->sc_ic;
ifr = (struct ifreq *)req;

s = splnet()splraise(0x4);
switch (cmd) {
case SIOCS80211SCAN((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((210))):
/*
 * This chip scans always as soon as it gets initialized.
 */
break;
case SIOCG80211ALLNODES(((unsigned long)0x80000000|(unsigned long)0x40000000) | ((sizeof
(struct ieee80211_nodereq_all) & 0x1fff) << 16) | (
(('i')) << 8) | ((214))): {
struct ieee80211_nodereq *nr = NULL((void *)0);
na = (struct ieee80211_nodereq_all *)req;
wreq = malloc(sizeof(*wreq), M_DEVBUF2, M_WAITOK0x0001 | M_ZERO0x0008);

maxscan = PGT_OBJ_BSSLIST_NBSS24;
pob = malloc(sizeof(*pob) +
    sizeof(struct pgt_obj_bss) * maxscan, M_DEVBUF2, M_WAITOK0x0001);
error = pgt_oid_get(sc, PGT_OID_NOISE_FLOOR, &noise,
    sizeof(noise));

if (error == 0) {
	noise = letoh32(noise)((__uint32_t)(noise));
	error = pgt_oid_get(sc, PGT_OID_BSS_LIST, pob,
	    sizeof(*pob) +
	    sizeof(struct pgt_obj_bss) * maxscan);
}

if (error == 0) {
	maxscan = min(PGT_OBJ_BSSLIST_NBSS24,
	    letoh32(pob->pob_count)((__uint32_t)(pob->pob_count)));
	maxscan = min(maxscan,
	    (sizeof(wreq->wi_val) - sizeof(*p2hdr)) /
	    WI_PRISM2_RES_SIZE62);
	p2hdr = (struct wi_scan_p2_hdr *)&wreq->wi_val;
	p2hdr->wi_rsvd = 0;
	p2hdr->wi_reason = 1;
	wreq->wi_len = (maxscan * WI_PRISM2_RES_SIZE62) / 2 +
	    sizeof(*p2hdr) / 2;
	wreq->wi_type = WI_RID_SCAN_RES0xFD88;
}

for (na->na_nodes = j = i = 0; i < maxscan &&
    (na->na_size >= j + sizeof(struct ieee80211_nodereq));
    i++) {
	/* allocate node space */
	if (nr == NULL((void *)0))
		nr = malloc(sizeof(*nr), M_DEVBUF2, M_WAITOK0x0001);

	/* get next BSS scan result */
	res = (struct wi_scan_res *)
	    ((char *)&wreq->wi_val + sizeof(*p2hdr) +
	    i * WI_PRISM2_RES_SIZE62);
	pgt_obj_bss2scanres(sc, &pob->pob_bsslist[i],
	    res, noise);

	/* copy it to node structure for ifconfig to read */
	bzero(nr, sizeof(*nr))__builtin_bzero((nr), (sizeof(*nr)));
	IEEE80211_ADDR_COPY(nr->nr_macaddr, res->wi_bssid)__builtin_memcpy((nr->nr_macaddr), (res->wi_bssid), (6)
);
	IEEE80211_ADDR_COPY(nr->nr_bssid, res->wi_bssid)__builtin_memcpy((nr->nr_bssid), (res->wi_bssid), (6));
	nr->nr_channel = letoh16(res->wi_chan)((__uint16_t)(res->wi_chan));
	nr->nr_chan_flags = IEEE80211_CHAN_B(0x0080 | 0x0020);
	nr->nr_rssi = letoh16(res->wi_signal)((__uint16_t)(res->wi_signal));
	nr->nr_max_rssi = 0; /* XXX */
	nr->nr_nwid_len = letoh16(res->wi_ssid_len)((__uint16_t)(res->wi_ssid_len));
	bcopy(res->wi_ssid, nr->nr_nwid, nr->nr_nwid_len);
	nr->nr_intval = letoh16(res->wi_interval)((__uint16_t)(res->wi_interval));
	nr->nr_capinfo = letoh16(res->wi_capinfo)((__uint16_t)(res->wi_capinfo));
	nr->nr_txrate = res->wi_rate == WI_WAVELAN_RES_1M0x0a ? 2 :
	    (res->wi_rate == WI_WAVELAN_RES_2M0x14 ? 4 :
	    (res->wi_rate == WI_WAVELAN_RES_5M0x37 ? 11 :
	    (res->wi_rate == WI_WAVELAN_RES_11M0x6e ? 22 : 0)));
	nr->nr_nrates = 0;
	while (res->wi_srates[nr->nr_nrates] != 0) {
		nr->nr_rates[nr->nr_nrates] =
		    res->wi_srates[nr->nr_nrates] &
		    WI_VAR_SRATES_MASK0x7F;
		nr->nr_nrates++;
	}
	nr->nr_flags = 0;
	if (bcmp(nr->nr_macaddr, nr->nr_bssid,
	    IEEE80211_ADDR_LEN6) == 0)
		nr->nr_flags |= IEEE80211_NODEREQ_AP0x01;
	error = copyout(nr, (caddr_t)na->na_node + j,
	    sizeof(struct ieee80211_nodereq));
	if (error)
		break;

	/* point to next node entry */
	j += sizeof(struct ieee80211_nodereq);
	na->na_nodes++;
}
if (nr)
	free(nr, M_DEVBUF2, 0);
free(pob, M_DEVBUF2, 0);
free(wreq, M_DEVBUF2, 0);
break;
}
case SIOCSIFADDR((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((12))):
ifp->if_flags |= IFF_UP0x1;
/* FALLTHROUGH */
case SIOCSIFFLAGS((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((16))):
if (ifp->if_flags & IFF_UP0x1) {
	if ((ifp->if_flags & IFF_RUNNING0x40) == 0) {
		pgt_init(ifp);
		error = ENETRESET52;
	}
} else {
	if (ifp->if_flags & IFF_RUNNING0x40) {
		pgt_stop(sc, SC_NEEDS_RESET0x00000008);
		error = ENETRESET52;
	}
}
break;
case SIOCSIFMTU((unsigned long)0x80000000 | ((sizeof(struct ifreq) & 0x1fff
) << 16) | ((('i')) << 8) | ((127))):
if (ifr->ifr_mtuifr_ifru.ifru_metric > PGT_FRAG_SIZE1536) {
	error = EINVAL22;
	break;
}
/* FALLTHROUGH */
default:
error = ieee80211_ioctl(ifp, cmd, req);
break;
}

if (error == ENETRESET52) {
pgt_update_hw_from_sw(sc, 0);
error = 0;
}
splx(s)spllower(s);

return (error);
2377}

2379void
2380pgt_obj_bss2scanres(struct pgt_softc *sc, struct pgt_obj_bss *pob,
  struct wi_scan_res *scanres, uint32_t noise)
2382{
struct ieee80211_rateset *rs;
struct wi_scan_res ap;
unsigned int i, n;

rs = &sc->sc_ic.ic_sup_rates[IEEE80211_MODE_AUTO];
bzero(&ap, sizeof(ap))__builtin_bzero((&ap), (sizeof(ap)));
ap.wi_chan = ieee80211_mhz2ieee(letoh16(pob->pob_channel)((__uint16_t)(pob->pob_channel)), 0);
ap.wi_noise = noise;
ap.wi_signal = letoh16(pob->pob_rssi)((__uint16_t)(pob->pob_rssi));
IEEE80211_ADDR_COPY(ap.wi_bssid, pob->pob_address)__builtin_memcpy((ap.wi_bssid), (pob->pob_address), (6));
ap.wi_interval = letoh16(pob->pob_beacon_period)((__uint16_t)(pob->pob_beacon_period));
ap.wi_capinfo = letoh16(pob->pob_capinfo)((__uint16_t)(pob->pob_capinfo));
ap.wi_ssid_len = min(sizeof(ap.wi_ssid), pob->pob_ssid.pos_length);
memcpy(ap.wi_ssid, pob->pob_ssid.pos_ssid, ap.wi_ssid_len)__builtin_memcpy((ap.wi_ssid), (pob->pob_ssid.pos_ssid), (
ap.wi_ssid_len));
n = 0;
for (i = 0; i < 16; i++) {
if (letoh16(pob->pob_rates)((__uint16_t)(pob->pob_rates)) & (1 << i)) {
	if (i >= rs->rs_nrates)
		break;
	ap.wi_srates[n++] = ap.wi_rate = rs->rs_rates[i];
	if (n >= sizeof(ap.wi_srates) / sizeof(ap.wi_srates[0]))
		break;
}
}
memcpy(scanres, &ap, WI_PRISM2_RES_SIZE)__builtin_memcpy((scanres), (&ap), (62));
2408}

2410void
2411node_mark_active_ap(void *arg, struct ieee80211_node *ni)
2412{
/*
* HostAP mode lets all nodes stick around unless
* the firmware AP kicks them off.
*/
ni->ni_inact = 0;
2418}

2420void
2421node_mark_active_adhoc(void *arg, struct ieee80211_node *ni)
2422{
struct pgt_ieee80211_node *pin;

/*
* As there is no association in ad-hoc, we let links just
* time out naturally as long they are not holding any private
* configuration, such as 802.1x authorization.
*/
pin = (struct pgt_ieee80211_node *)ni;
if (pin->pin_dot1x_auth == PIN_DOT1X_AUTHORIZED)
pin->pin_node.ni_inact = 0;
2433}

2435void
2436pgt_watchdog(struct ifnet *ifp)
2437{
struct pgt_softc *sc;

sc = ifp->if_softc;
/*
* Check for timed out transmissions (and make sure to set
* this watchdog to fire again if there is still data in the
* output device queue).
*/
if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] != 0) {
int count;

ifp->if_timer = 1;
if (sc->sc_txtimer && --sc->sc_txtimer == 0) {
	count = pgt_drain_tx_queue(sc, PGT_QUEUE_DATA_LOW_TX);
	if (sc->sc_debug & SC_DEBUG_UNEXPECTED0x00000004)
		DPRINTF(("%s: timeout %d data transmissions\n",
		    sc->sc_dev.dv_xname, count));
}
}
if (sc->sc_flags & (SC_DYING0x00000004 | SC_NEEDS_RESET0x00000008))
return;
/*
* If we're going to kick the device out of power-save mode
* just to update the BSSID and such, we should not do it
* very often; need to determine in what way to do that.
*/
if (ifp->if_flags & IFF_RUNNING0x40 &&
   sc->sc_ic.ic_state != IEEE80211_S_INIT &&
   sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
pgt_async_update(sc);

2469#ifndef IEEE80211_STA_ONLY
/*
* As a firmware-based HostAP, we should not time out
* nodes inside the driver additionally to the timeout
* that exists in the firmware.  The only things we
* should have to deal with timing out when doing HostAP
* are the privacy-related.
*/
switch (sc->sc_ic.ic_opmode) {
case IEEE80211_M_HOSTAP:
ieee80211_iterate_nodes(&sc->sc_ic,
    node_mark_active_ap, NULL((void *)0));
break;
case IEEE80211_M_IBSS:
ieee80211_iterate_nodes(&sc->sc_ic,
    node_mark_active_adhoc, NULL((void *)0));
break;
default:
break;
}
2489#endif
ieee80211_watchdog(ifp);
ifp->if_timer = 1;
2492}

2494int
2495pgt_init(struct ifnet *ifp)
2496{
struct pgt_softc *sc = ifp->if_softc;
struct ieee80211com *ic = &sc->sc_ic;

/* set default channel */
ic->ic_bss->ni_chan = ic->ic_ibss_chan;

if (!(sc->sc_flags & (SC_DYING0x00000004 | SC_UNINITIALIZED0x00000002)))
pgt_update_hw_from_sw(sc,
    ic->ic_state != IEEE80211_S_INIT);

ifp->if_flags |= IFF_RUNNING0x40;
ifq_clr_oactive(&ifp->if_snd);

/* Begin background scanning */
ieee80211_new_state(&sc->sc_ic, IEEE80211_S_SCAN, -1)(((&sc->sc_ic)->ic_newstate)((&sc->sc_ic), (
IEEE80211_S_SCAN), (-1)));

return (0);
2514}

2516/*
* After most every configuration change, everything needs to be fully
* reinitialized.  For some operations (currently, WEP settings
* in ad-hoc+802.1x mode), the change is "soft" and doesn't remove
* "associations," and allows EAP authorization to occur again.
* If keepassoc is specified, the reset operation should try to go
* back to the BSS had before.
*/
2524void
2525pgt_update_hw_from_sw(struct pgt_softc *sc, int keepassoc)
2526{
struct ieee80211com *ic = &sc->sc_ic;
struct arpcom *ac = &ic->ic_ac;
struct ifnet *ifp = &ac->ac_if;
struct pgt_obj_key keyobj;
struct pgt_obj_ssid essid;
uint8_t availrates[IEEE80211_RATE_MAXSIZE15 + 1];
uint32_t mode, bsstype, config, profile, channel, slot, preamble;
uint32_t wep, exunencrypted, wepkey, dot1x, auth, mlme;
unsigned int i;
int success, shouldbeup, s;

config = PGT_CONFIG_MANUAL_RUN0x00000001 | PGT_CONFIG_RX_ANNEX0x00000004;

/*
* Promiscuous mode is currently a no-op since packets transmitted,
* while in promiscuous mode, don't ever seem to go anywhere.
*/
shouldbeup = ifp->if_flags & IFF_RUNNING0x40 && ifp->if_flags & IFF_UP0x1;

if (shouldbeup) {
switch (ic->ic_opmode) {
case IEEE80211_M_STA:
	if (ifp->if_flags & IFF_PROMISC0x100)
		mode = PGT_MODE_CLIENT1;	/* what to do? */
	else
		mode = PGT_MODE_CLIENT1;
	bsstype = PGT_BSS_TYPE_STA1;
	dot1x = PGT_DOT1X_AUTH_ENABLED1;
	break;
2556#ifndef IEEE80211_STA_ONLY
case IEEE80211_M_IBSS:
	if (ifp->if_flags & IFF_PROMISC0x100)
		mode = PGT_MODE_CLIENT1;	/* what to do? */
	else
		mode = PGT_MODE_CLIENT1;
	bsstype = PGT_BSS_TYPE_IBSS2;
	dot1x = PGT_DOT1X_AUTH_ENABLED1;
	break;
case IEEE80211_M_HOSTAP:
	mode = PGT_MODE_AP2;
	bsstype = PGT_BSS_TYPE_STA1;
	/*
	 * For IEEE 802.1x, we need to authenticate and
	 * authorize hosts from here on or they remain
	 * associated but without the ability to send or
	 * receive normal traffic to us (courtesy the
	 * firmware AP implementation).
	 */
	dot1x = PGT_DOT1X_AUTH_ENABLED1;
	/*
	 * WDS mode needs several things to work:
	 * discovery of exactly how creating the WDS
	 * links is meant to function, an interface
	 * for this, and ability to encode or decode
	 * the WDS frames.
	 */
	if (sc->sc_wds)
		config |= PGT_CONFIG_WDS0x00000010;
	break;
2586#endif
case IEEE80211_M_MONITOR:
	mode = PGT_MODE_PROMISCUOUS0;
	bsstype = PGT_BSS_TYPE_ANY3;
	dot1x = PGT_DOT1X_AUTH_NONE0;
	break;
default:
	goto badopmode;
}
} else {
2596badopmode:
mode = PGT_MODE_CLIENT1;
bsstype = PGT_BSS_TYPE_NONE0;
}

DPRINTF(("%s: current mode is ", sc->sc_dev.dv_xname));
switch (ic->ic_curmode) {
case IEEE80211_MODE_11A:
profile = PGT_PROFILE_A_ONLY6;
preamble = PGT_OID_PREAMBLE_MODE_DYNAMIC2;
DPRINTF(("IEEE80211_MODE_11A\n"));
break;
case IEEE80211_MODE_11B:
profile = PGT_PROFILE_B_ONLY0;
preamble = PGT_OID_PREAMBLE_MODE_LONG0;
DPRINTF(("IEEE80211_MODE_11B\n"));
break;
case IEEE80211_MODE_11G:
profile = PGT_PROFILE_G_ONLY3;
preamble = PGT_OID_PREAMBLE_MODE_SHORT1;
DPRINTF(("IEEE80211_MODE_11G\n"));
break;
case IEEE80211_MODE_AUTO:
profile = PGT_PROFILE_MIXED_G_WIFI1;
preamble = PGT_OID_PREAMBLE_MODE_DYNAMIC2;
DPRINTF(("IEEE80211_MODE_AUTO\n"));
break;
default:
panic("unknown mode %d", ic->ic_curmode);
}

switch (sc->sc_80211_ioc_auth) {
case IEEE80211_AUTH_NONE0:
auth = PGT_AUTH_MODE_NONE0;
break;
case IEEE80211_AUTH_OPEN1:
auth = PGT_AUTH_MODE_OPEN1;
break;
default:
auth = PGT_AUTH_MODE_SHARED2;
break;
}

if (sc->sc_ic.ic_flags & IEEE80211_F_WEPON0x00000100) {
wep = 1;
exunencrypted = 1;
} else {
wep = 0;
exunencrypted = 0;
}

mlme = htole32(PGT_MLME_AUTO_LEVEL_AUTO)((__uint32_t)(0));
wep = htole32(wep)((__uint32_t)(wep));
exunencrypted = htole32(exunencrypted)((__uint32_t)(exunencrypted));
profile = htole32(profile)((__uint32_t)(profile));
preamble = htole32(preamble)((__uint32_t)(preamble));
bsstype = htole32(bsstype)((__uint32_t)(bsstype));
config = htole32(config)((__uint32_t)(config));
mode = htole32(mode)((__uint32_t)(mode));

if (!wep || !sc->sc_dot1x)
dot1x = PGT_DOT1X_AUTH_NONE0;
dot1x = htole32(dot1x)((__uint32_t)(dot1x));
auth = htole32(auth)((__uint32_t)(auth));

if (ic->ic_flags & IEEE80211_F_SHSLOT0x00020000)
slot = htole32(PGT_OID_SLOT_MODE_SHORT)((__uint32_t)(1));
else
slot = htole32(PGT_OID_SLOT_MODE_DYNAMIC)((__uint32_t)(2));

if (ic->ic_des_chan == IEEE80211_CHAN_ANYC((struct ieee80211_channel *) ((void *)0))) {
if (keepassoc)
	channel = 0;
else
	channel = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
} else
channel = ieee80211_chan2ieee(ic, ic->ic_des_chan);

DPRINTF(("%s: set rates", sc->sc_dev.dv_xname));
for (i = 0; i < ic->ic_sup_rates[ic->ic_curmode].rs_nrates; i++) {
availrates[i] = ic->ic_sup_rates[ic->ic_curmode].rs_rates[i];
DPRINTF((" %d", availrates[i]));
}
DPRINTF(("\n"));
availrates[i++] = 0;

essid.pos_length = min(ic->ic_des_esslen, sizeof(essid.pos_ssid));
memcpy(&essid.pos_ssid, ic->ic_des_essid, essid.pos_length)__builtin_memcpy((&essid.pos_ssid), (ic->ic_des_essid)
, (essid.pos_length));

s = splnet()splraise(0x4);
for (success = 0; success == 0; success = 1) {
SETOID(PGT_OID_PROFILE, &profile, sizeof(profile)){ if (pgt_oid_set(sc, PGT_OID_PROFILE, &profile, sizeof(profile
)) != 0) break; };
SETOID(PGT_OID_CONFIG, &config, sizeof(config)){ if (pgt_oid_set(sc, PGT_OID_CONFIG, &config, sizeof(config
)) != 0) break; };
SETOID(PGT_OID_MLME_AUTO_LEVEL, &mlme, sizeof(mlme)){ if (pgt_oid_set(sc, PGT_OID_MLME_AUTO_LEVEL, &mlme, sizeof
(mlme)) != 0) break; };

if (!IEEE80211_ADDR_EQ(ic->ic_myaddr, ac->ac_enaddr)(__builtin_memcmp((ic->ic_myaddr), (ac->ac_enaddr), (6)
) == 0)) {
	SETOID(PGT_OID_MAC_ADDRESS, ac->ac_enaddr,{ if (pgt_oid_set(sc, PGT_OID_MAC_ADDRESS, ac->ac_enaddr, sizeof
(ac->ac_enaddr)) != 0) break; }
	    sizeof(ac->ac_enaddr)){ if (pgt_oid_set(sc, PGT_OID_MAC_ADDRESS, ac->ac_enaddr, sizeof
(ac->ac_enaddr)) != 0) break; };
	IEEE80211_ADDR_COPY(ic->ic_myaddr, ac->ac_enaddr)__builtin_memcpy((ic->ic_myaddr), (ac->ac_enaddr), (6));
}

SETOID(PGT_OID_MODE, &mode, sizeof(mode)){ if (pgt_oid_set(sc, PGT_OID_MODE, &mode, sizeof(mode)) !=
 0) break; };
SETOID(PGT_OID_BSS_TYPE, &bsstype, sizeof(bsstype)){ if (pgt_oid_set(sc, PGT_OID_BSS_TYPE, &bsstype, sizeof(
bsstype)) != 0) break; };

if (channel != 0 && channel != IEEE80211_CHAN_ANY0xffff)
	SETOID(PGT_OID_CHANNEL, &channel, sizeof(channel)){ if (pgt_oid_set(sc, PGT_OID_CHANNEL, &channel, sizeof(channel
)) != 0) break; };

if (ic->ic_flags & IEEE80211_F_DESBSSID0x00000800) {
	SETOID(PGT_OID_BSSID, ic->ic_des_bssid,{ if (pgt_oid_set(sc, PGT_OID_BSSID, ic->ic_des_bssid, sizeof
(ic->ic_des_bssid)) != 0) break; }
	    sizeof(ic->ic_des_bssid)){ if (pgt_oid_set(sc, PGT_OID_BSSID, ic->ic_des_bssid, sizeof
(ic->ic_des_bssid)) != 0) break; };
} else if (keepassoc) {
	SETOID(PGT_OID_BSSID, ic->ic_bss->ni_bssid,{ if (pgt_oid_set(sc, PGT_OID_BSSID, ic->ic_bss->ni_bssid
, sizeof(ic->ic_bss->ni_bssid)) != 0) break; }
	    sizeof(ic->ic_bss->ni_bssid)){ if (pgt_oid_set(sc, PGT_OID_BSSID, ic->ic_bss->ni_bssid
, sizeof(ic->ic_bss->ni_bssid)) != 0) break; };
}

SETOID(PGT_OID_SSID, &essid, sizeof(essid)){ if (pgt_oid_set(sc, PGT_OID_SSID, &essid, sizeof(essid)
) != 0) break; };

if (ic->ic_des_esslen > 0)
	SETOID(PGT_OID_SSID_OVERRIDE, &essid, sizeof(essid)){ if (pgt_oid_set(sc, PGT_OID_SSID_OVERRIDE, &essid, sizeof
(essid)) != 0) break; };

SETOID(PGT_OID_RATES, &availrates, i){ if (pgt_oid_set(sc, PGT_OID_RATES, &availrates, i) != 0
) break; };
SETOID(PGT_OID_EXTENDED_RATES, &availrates, i){ if (pgt_oid_set(sc, PGT_OID_EXTENDED_RATES, &availrates
, i) != 0) break; };
SETOID(PGT_OID_PREAMBLE_MODE, &preamble, sizeof(preamble)){ if (pgt_oid_set(sc, PGT_OID_PREAMBLE_MODE, &preamble, sizeof
(preamble)) != 0) break; };
SETOID(PGT_OID_SLOT_MODE, &slot, sizeof(slot)){ if (pgt_oid_set(sc, PGT_OID_SLOT_MODE, &slot, sizeof(slot
)) != 0) break; };
SETOID(PGT_OID_AUTH_MODE, &auth, sizeof(auth)){ if (pgt_oid_set(sc, PGT_OID_AUTH_MODE, &auth, sizeof(auth
)) != 0) break; };
SETOID(PGT_OID_EXCLUDE_UNENCRYPTED, &exunencrypted,{ if (pgt_oid_set(sc, PGT_OID_EXCLUDE_UNENCRYPTED, &exunencrypted
, sizeof(exunencrypted)) != 0) break; }
    sizeof(exunencrypted)){ if (pgt_oid_set(sc, PGT_OID_EXCLUDE_UNENCRYPTED, &exunencrypted
, sizeof(exunencrypted)) != 0) break; };
SETOID(PGT_OID_DOT1X, &dot1x, sizeof(dot1x)){ if (pgt_oid_set(sc, PGT_OID_DOT1X, &dot1x, sizeof(dot1x
)) != 0) break; };
SETOID(PGT_OID_PRIVACY_INVOKED, &wep, sizeof(wep)){ if (pgt_oid_set(sc, PGT_OID_PRIVACY_INVOKED, &wep, sizeof
(wep)) != 0) break; };
/*
 * Setting WEP key(s)
 */
if (letoh32(wep)((__uint32_t)(wep)) != 0) {
	keyobj.pok_type = PGT_OBJ_KEY_TYPE_WEP0;
	/* key 1 */
	keyobj.pok_length = min(sizeof(keyobj.pok_key),
	    IEEE80211_KEYBUF_SIZE16);
	keyobj.pok_length = min(keyobj.pok_length,
	    ic->ic_nw_keys[0].k_len);
	bcopy(ic->ic_nw_keys[0].k_key, keyobj.pok_key,
	    keyobj.pok_length);
	SETOID(PGT_OID_DEFAULT_KEY0, &keyobj, sizeof(keyobj)){ if (pgt_oid_set(sc, PGT_OID_DEFAULT_KEY0, &keyobj, sizeof
(keyobj)) != 0) break; };
	/* key 2 */
	keyobj.pok_length = min(sizeof(keyobj.pok_key),
	    IEEE80211_KEYBUF_SIZE16);
	keyobj.pok_length = min(keyobj.pok_length,
	    ic->ic_nw_keys[1].k_len);
	bcopy(ic->ic_nw_keys[1].k_key, keyobj.pok_key,
	    keyobj.pok_length);
	SETOID(PGT_OID_DEFAULT_KEY1, &keyobj, sizeof(keyobj)){ if (pgt_oid_set(sc, PGT_OID_DEFAULT_KEY1, &keyobj, sizeof
(keyobj)) != 0) break; };
	/* key 3 */
	keyobj.pok_length = min(sizeof(keyobj.pok_key),
	    IEEE80211_KEYBUF_SIZE16);
	keyobj.pok_length = min(keyobj.pok_length,
	    ic->ic_nw_keys[2].k_len);
	bcopy(ic->ic_nw_keys[2].k_key, keyobj.pok_key,
	    keyobj.pok_length);
	SETOID(PGT_OID_DEFAULT_KEY2, &keyobj, sizeof(keyobj)){ if (pgt_oid_set(sc, PGT_OID_DEFAULT_KEY2, &keyobj, sizeof
(keyobj)) != 0) break; };
	/* key 4 */
	keyobj.pok_length = min(sizeof(keyobj.pok_key),
	    IEEE80211_KEYBUF_SIZE16);
	keyobj.pok_length = min(keyobj.pok_length,
	    ic->ic_nw_keys[3].k_len);
	bcopy(ic->ic_nw_keys[3].k_key, keyobj.pok_key,
	    keyobj.pok_length);
	SETOID(PGT_OID_DEFAULT_KEY3, &keyobj, sizeof(keyobj)){ if (pgt_oid_set(sc, PGT_OID_DEFAULT_KEY3, &keyobj, sizeof
(keyobj)) != 0) break; };

	wepkey = htole32(ic->ic_wep_txkey)((__uint32_t)(ic->ic_def_txkey));
	SETOID(PGT_OID_DEFAULT_KEYNUM, &wepkey, sizeof(wepkey)){ if (pgt_oid_set(sc, PGT_OID_DEFAULT_KEYNUM, &wepkey, sizeof
(wepkey)) != 0) break; };
}
/* set mode again to commit */
SETOID(PGT_OID_MODE, &mode, sizeof(mode)){ if (pgt_oid_set(sc, PGT_OID_MODE, &mode, sizeof(mode)) !=
 0) break; };
}
splx(s)spllower(s);

if (success) {
if (shouldbeup)
	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
else
	ieee80211_new_state(ic, IEEE80211_S_INIT, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_INIT), (-1)));
} else {
printf("%s: problem setting modes\n", sc->sc_dev.dv_xname);
ieee80211_new_state(ic, IEEE80211_S_INIT, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_INIT), (-1)));
}
2780}

2782void
2783pgt_hostap_handle_mlme(struct pgt_softc *sc, uint32_t oid,
  struct pgt_obj_mlme *mlme)
2785{
struct ieee80211com *ic = &sc->sc_ic;
struct pgt_ieee80211_node *pin;
struct ieee80211_node *ni;

ni = ieee80211_find_node(ic, mlme->pom_address);
pin = (struct pgt_ieee80211_node *)ni;
switch (oid) {
case PGT_OID_DISASSOCIATE:
if (ni != NULL((void *)0))
	ieee80211_release_node(&sc->sc_ic, ni);
break;
case PGT_OID_ASSOCIATE:
if (ni == NULL((void *)0)) {
	ni = ieee80211_dup_bss(ic, mlme->pom_address);
	if (ni == NULL((void *)0))
		break;
	ic->ic_newassoc(ic, ni, 1);
	pin = (struct pgt_ieee80211_node *)ni;
}
ni->ni_associd = letoh16(mlme->pom_id)((__uint16_t)(mlme->pom_id));
pin->pin_mlme_state = letoh16(mlme->pom_state)((__uint16_t)(mlme->pom_state));
break;
default:
if (pin != NULL((void *)0))
	pin->pin_mlme_state = letoh16(mlme->pom_state)((__uint16_t)(mlme->pom_state));
break;
}
2813}

2815/*
* Either in response to an event or after a certain amount of time,
* synchronize our idea of the network we're part of from the hardware.
*/
2819void
2820pgt_update_sw_from_hw(struct pgt_softc *sc, struct pgt_async_trap *pa,
   struct mbuf *args)
2822{
struct ieee80211com *ic = &sc->sc_ic;
struct pgt_obj_ssid ssid;
struct pgt_obj_bss bss;
uint32_t channel, noise, ls;
int error, s;

if (pa != NULL((void *)0)) {
struct pgt_obj_mlme *mlme;
uint32_t oid;

oid = *mtod(args, uint32_t *)((uint32_t *)((args)->m_hdr.mh_data));
m_adj(args, sizeof(uint32_t));
if (sc->sc_debug & SC_DEBUG_TRAP0x00000040)
	DPRINTF(("%s: trap: oid %#x len %u\n",
	    sc->sc_dev.dv_xname, oid, args->m_len));
switch (oid) {
case PGT_OID_LINK_STATE:
	if (args->m_lenm_hdr.mh_len < sizeof(uint32_t))
		break;
	ls = letoh32(*mtod(args, uint32_t *))((__uint32_t)(*((uint32_t *)((args)->m_hdr.mh_data))));
	if (sc->sc_debug & (SC_DEBUG_TRAP0x00000040 | SC_DEBUG_LINK0x00000080))
		DPRINTF(("%s: %s: link rate %u\n",
		    sc->sc_dev.dv_xname, __func__, ls));
	if (ls)
		ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
	else
		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
	goto gotlinkstate;
case PGT_OID_DEAUTHENTICATE:
case PGT_OID_AUTHENTICATE:
case PGT_OID_DISASSOCIATE:
case PGT_OID_ASSOCIATE:
	if (args->m_lenm_hdr.mh_len < sizeof(struct pgt_obj_mlme))
		break;
	mlme = mtod(args, struct pgt_obj_mlme *)((struct pgt_obj_mlme *)((args)->m_hdr.mh_data));
	if (sc->sc_debug & SC_DEBUG_TRAP0x00000040)
		DPRINTF(("%s: mlme: address "
		    "%s id 0x%02x state 0x%02x code 0x%02x\n",
		    sc->sc_dev.dv_xname,
		    ether_sprintf(mlme->pom_address),
		    letoh16(mlme->pom_id),
		    letoh16(mlme->pom_state),
		    letoh16(mlme->pom_code)));
2866#ifndef IEEE80211_STA_ONLY
	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
		pgt_hostap_handle_mlme(sc, oid, mlme);
2869#endif
	break;
}
return;
}
if (ic->ic_state == IEEE80211_S_SCAN) {
s = splnet()splraise(0x4);
error = pgt_oid_get(sc, PGT_OID_LINK_STATE, &ls, sizeof(ls));
splx(s)spllower(s);
if (error)
	return;
DPRINTF(("%s: up_sw_from_hw: link %u\n", sc->sc_dev.dv_xname,
    htole32(ls)));
if (ls != 0)
	ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
}

2886gotlinkstate:
s = splnet()splraise(0x4);
if (pgt_oid_get(sc, PGT_OID_NOISE_FLOOR, &noise, sizeof(noise)) != 0)
goto out;
sc->sc_noise = letoh32(noise)((__uint32_t)(noise));
if (ic->ic_state == IEEE80211_S_RUN) {
if (pgt_oid_get(sc, PGT_OID_CHANNEL, &channel,
    sizeof(channel)) != 0)
	goto out;
channel = min(letoh32(channel)((__uint32_t)(channel)), IEEE80211_CHAN_MAX255);
ic->ic_bss->ni_chan = &ic->ic_channels[channel];
if (pgt_oid_get(sc, PGT_OID_BSSID, ic->ic_bss->ni_bssid,
    sizeof(ic->ic_bss->ni_bssid)) != 0)
	goto out;
IEEE80211_ADDR_COPY(&bss.pob_address, ic->ic_bss->ni_bssid)__builtin_memcpy((&bss.pob_address), (ic->ic_bss->ni_bssid
), (6));
error = pgt_oid_retrieve(sc, PGT_OID_BSS_FIND, &bss,
    sizeof(bss));
if (error == 0)
	ic->ic_bss->ni_rssi = bss.pob_rssi;
else if (error != EPERM1)
	goto out;
error = pgt_oid_get(sc, PGT_OID_SSID, &ssid, sizeof(ssid));
if (error)
	goto out;
ic->ic_bss->ni_esslen = min(ssid.pos_length,
    sizeof(ic->ic_bss->ni_essid));
memcpy(ic->ic_bss->ni_essid, ssid.pos_ssid,__builtin_memcpy((ic->ic_bss->ni_essid), (ssid.pos_ssid
), (ssid.pos_length))
    ssid.pos_length)__builtin_memcpy((ic->ic_bss->ni_essid), (ssid.pos_ssid
), (ssid.pos_length));
}

2916out:
splx(s)spllower(s);
2918}

2920int
2921pgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
2922{
struct pgt_softc *sc = ic->ic_ific_ac.ac_if.if_softc;
enum ieee80211_state ostate;

ostate = ic->ic_state;

DPRINTF(("%s: newstate %s -> %s\n", sc->sc_dev.dv_xname,
   ieee80211_state_name[ostate], ieee80211_state_name[nstate]));

switch (nstate) {
case IEEE80211_S_INIT:
if (sc->sc_dirtyq_count[PGT_QUEUE_DATA_LOW_TX] == 0)
	ic->ic_ific_ac.ac_if.if_timer = 0;
ic->ic_mgt_timer = 0;
ic->ic_flags &= ~IEEE80211_F_SIBSS0x00000002;
ieee80211_free_allnodes(ic, 1);
ieee80211_set_link_state(ic, LINK_STATE_DOWN2);
break;
case IEEE80211_S_SCAN:
ic->ic_ific_ac.ac_if.if_timer = 1;
ic->ic_mgt_timer = 0;
ieee80211_node_cleanup(ic, ic->ic_bss);
ieee80211_set_link_state(ic, LINK_STATE_DOWN2);
2945#ifndef IEEE80211_STA_ONLY
/* Just use any old channel; we override it anyway. */
if (ic->ic_opmode == IEEE80211_M_HOSTAP)
	ieee80211_create_ibss(ic, ic->ic_ibss_chan);
2949#endif
break;
case IEEE80211_S_RUN:
ic->ic_ific_ac.ac_if.if_timer = 1;
break;
default:
break;
}

return (sc->sc_newstate(ic, nstate, arg));
2959}

2961int
2962pgt_drain_tx_queue(struct pgt_softc *sc, enum pgt_queue pq)
2963{
int wokeup = 0;

bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
))
   BUS_DMASYNC_POSTREAD | BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x02 | 0x04
));
sc->sc_cb->pcb_device_curfrag[pq] =
   sc->sc_cb->pcb_driver_curfrag[pq];
bus_dmamap_sync(sc->sc_dmat, sc->sc_cbdmam, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   sc->sc_cbdmam->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
))
   BUS_DMASYNC_POSTWRITE | BUS_DMASYNC_PREREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc->
sc_cbdmam), (0), (sc->sc_cbdmam->dm_mapsize), (0x08 | 0x01
));
while (!TAILQ_EMPTY(&sc->sc_dirtyq[pq])(((&sc->sc_dirtyq[pq])->tqh_first) == ((void *)0))) {
struct pgt_desc *pd;

pd = TAILQ_FIRST(&sc->sc_dirtyq[pq])((&sc->sc_dirtyq[pq])->tqh_first);
TAILQ_REMOVE(&sc->sc_dirtyq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_dirtyq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
sc->sc_dirtyq_count[pq]--;
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[pq])->tqh_last; *(&sc
->sc_freeq[pq])->tqh_last = (pd); (&sc->sc_freeq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
sc->sc_freeq_count[pq]++;
pgt_unload_tx_desc_frag(sc, pd);
if (sc->sc_debug & SC_DEBUG_QUEUES0x00000001)
	DPRINTF(("%s: queue: tx %u <- [%u] (drained)\n",
	    sc->sc_dev.dv_xname, pd->pd_fragnum, pq));
wokeup++;
if (pgt_queue_is_data(pq))
	sc->sc_ic.ic_ific_ac.ac_if.if_oerrorsif_data.ifi_oerrors++;
}

return (wokeup);
2992}

2994int
2995pgt_dma_alloc(struct pgt_softc *sc)
2996{
size_t size;
int i, error, nsegs;

for (i = 0; i < PGT_QUEUE_COUNT6; i++) {
TAILQ_INIT(&sc->sc_freeq[i])do { (&sc->sc_freeq[i])->tqh_first = ((void *)0); (
&sc->sc_freeq[i])->tqh_last = &(&sc->sc_freeq
[i])->tqh_first; } while (0);
TAILQ_INIT(&sc->sc_dirtyq[i])do { (&sc->sc_dirtyq[i])->tqh_first = ((void *)0); (
&sc->sc_dirtyq[i])->tqh_last = &(&sc->sc_dirtyq
[i])->tqh_first; } while (0);
}

/*
* control block
*/
size = sizeof(struct pgt_control_block);

error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001), (&sc->sc_cbdmam))
   BUS_DMA_NOWAIT, &sc->sc_cbdmam)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0001), (&sc->sc_cbdmam));
if (error != 0) {
printf("%s: can not create DMA tag for control block\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&sc->sc_cbdmas), (1), (&
nsegs), (0x0001 | 0x1000))
   0, &sc->sc_cbdmas, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&sc->sc_cbdmas), (1), (&
nsegs), (0x0001 | 0x1000));
if (error != 0) {
printf("%s: can not allocate DMA memory for control block\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamem_map(sc->sc_dmat, &sc->sc_cbdmas, nsegs,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_cbdmas), (nsegs), (size), ((caddr_t *)&sc->sc_cb
), (0x0001))
   size, (caddr_t *)&sc->sc_cb, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_cbdmas), (nsegs), (size), ((caddr_t *)&sc->sc_cb
), (0x0001));
if (error != 0) {
printf("%s: can not map DMA memory for control block\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamap_load(sc->sc_dmat, sc->sc_cbdmam,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_cbdmam), (sc->sc_cb), (size), (((void *)0)), (0x0001))
   sc->sc_cb, size, NULL, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_cbdmam), (sc->sc_cb), (size), (((void *)0)), (0x0001));
if (error != 0) {
printf("%s: can not load DMA map for control block\n",
    sc->sc_dev.dv_xname);
goto out;
}

/*
* powersave
*/
size = PGT_FRAG_SIZE1536 * PGT_PSM_BUFFER_FRAME_COUNT64;

error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0002), (&sc->sc_psmdmam))
   BUS_DMA_ALLOCNOW, &sc->sc_psmdmam)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size
), (1), (size), (0), (0x0002), (&sc->sc_psmdmam));
if (error != 0) {
printf("%s: can not create DMA tag for powersave\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&sc->sc_psmdmas), (1), (&
nsegs), (0x0001 | 0x1000))
  0, &sc->sc_psmdmas, 1, &nsegs, BUS_DMA_NOWAIT | BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size
), ((1 << 12)), (0), (&sc->sc_psmdmas), (1), (&
nsegs), (0x0001 | 0x1000));
if (error != 0) {
printf("%s: can not allocate DMA memory for powersave\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamem_map(sc->sc_dmat, &sc->sc_psmdmas, nsegs,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_psmdmas), (nsegs), (size), ((caddr_t *)&sc->sc_psmbuf
), (0x0001))
   size, (caddr_t *)&sc->sc_psmbuf, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc
->sc_psmdmas), (nsegs), (size), ((caddr_t *)&sc->sc_psmbuf
), (0x0001));
if (error != 0) {
printf("%s: can not map DMA memory for powersave\n",
    sc->sc_dev.dv_xname);
goto out;
}

error = bus_dmamap_load(sc->sc_dmat, sc->sc_psmdmam,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_psmdmam), (sc->sc_psmbuf), (size), (((void *)0)), (0x0000
))
   sc->sc_psmbuf, size, NULL, BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc->
sc_psmdmam), (sc->sc_psmbuf), (size), (((void *)0)), (0x0000
));
if (error != 0) {
printf("%s: can not load DMA map for powersave\n",
    sc->sc_dev.dv_xname);
goto out;
}

/*
* fragments
*/
error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_LOW_RX);
if (error != 0)
goto out;

error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_LOW_TX);
if (error != 0)
goto out;

error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_HIGH_RX);
if (error != 0)
goto out;

error = pgt_dma_alloc_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
if (error != 0)
goto out;

error = pgt_dma_alloc_queue(sc, PGT_QUEUE_MGMT_RX);
if (error != 0)
goto out;

error = pgt_dma_alloc_queue(sc, PGT_QUEUE_MGMT_TX);
if (error != 0)
goto out;

3106out:
if (error) {
printf("%s: error in DMA allocation\n", sc->sc_dev.dv_xname);
pgt_dma_free(sc);
}

return (error);
3113}

3115int
3116pgt_dma_alloc_queue(struct pgt_softc *sc, enum pgt_queue pq)
3117{
struct pgt_desc *pd;
size_t i, qsize;
int error, nsegs;

switch (pq) {
case PGT_QUEUE_DATA_LOW_RX:
	qsize = PGT_QUEUE_DATA_RX_SIZE8;
	break;
case PGT_QUEUE_DATA_LOW_TX:
	qsize = PGT_QUEUE_DATA_TX_SIZE32;
	break;
case PGT_QUEUE_DATA_HIGH_RX:
	qsize = PGT_QUEUE_DATA_RX_SIZE8;
	break;
case PGT_QUEUE_DATA_HIGH_TX:
	qsize = PGT_QUEUE_DATA_TX_SIZE32;
	break;
case PGT_QUEUE_MGMT_RX:
	qsize = PGT_QUEUE_MGMT_SIZE4;
	break;
case PGT_QUEUE_MGMT_TX:
	qsize = PGT_QUEUE_MGMT_SIZE4;
	break;
default:
	return (EINVAL22);
}

for (i = 0; i < qsize; i++) {
pd = malloc(sizeof(*pd), M_DEVBUF2, M_WAITOK0x0001);

error = bus_dmamap_create(sc->sc_dmat, PGT_FRAG_SIZE, 1,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (1536
), (1), (1536), (0), (0x0002), (&pd->pd_dmam))
    PGT_FRAG_SIZE, 0, BUS_DMA_ALLOCNOW, &pd->pd_dmam)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (1536
), (1), (1536), (0), (0x0002), (&pd->pd_dmam));
if (error != 0) {
	printf("%s: can not create DMA tag for fragment\n",
	    sc->sc_dev.dv_xname);
	free(pd, M_DEVBUF2, 0);
	break;
}

error = bus_dmamem_alloc(sc->sc_dmat, PGT_FRAG_SIZE, PAGE_SIZE,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (1536
), ((1 << 12)), (0), (&pd->pd_dmas), (1), (&
nsegs), (0x0000))
    0, &pd->pd_dmas, 1, &nsegs, BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (1536
), ((1 << 12)), (0), (&pd->pd_dmas), (1), (&
nsegs), (0x0000));
if (error != 0) {
	printf("%s: error alloc frag %zu on queue %u\n",
	    sc->sc_dev.dv_xname, i, pq);
	free(pd, M_DEVBUF2, 0);
	break;
}

error = bus_dmamem_map(sc->sc_dmat, &pd->pd_dmas, nsegs,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&pd
->pd_dmas), (nsegs), (1536), ((caddr_t *)&pd->pd_mem
), (0x0000))
    PGT_FRAG_SIZE, (caddr_t *)&pd->pd_mem, BUS_DMA_WAITOK)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&pd
->pd_dmas), (nsegs), (1536), ((caddr_t *)&pd->pd_mem
), (0x0000));
if (error != 0) {
	printf("%s: error map frag %zu on queue %u\n",
	    sc->sc_dev.dv_xname, i, pq);
	free(pd, M_DEVBUF2, 0);
	break;
}

if (pgt_queue_is_rx(pq)) {
	error = bus_dmamap_load(sc->sc_dmat, pd->pd_dmam,(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (pd->
pd_dmam), (pd->pd_mem), (1536), (((void *)0)), (0x0001))
	    pd->pd_mem, PGT_FRAG_SIZE, NULL, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (pd->
pd_dmam), (pd->pd_mem), (1536), (((void *)0)), (0x0001));
	if (error != 0) {
		printf("%s: error load frag %zu on queue %u\n",
		    sc->sc_dev.dv_xname, i, pq);
		bus_dmamem_free(sc->sc_dmat, &pd->pd_dmas,(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
pd->pd_dmas), (nsegs))
		    nsegs)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
pd->pd_dmas), (nsegs));
		free(pd, M_DEVBUF2, 0);
		break;
	}
	pd->pd_dmaaddr = pd->pd_dmam->dm_segs[0].ds_addr;
}
TAILQ_INSERT_TAIL(&sc->sc_freeq[pq], pd, pd_link)do { (pd)->pd_link.tqe_next = ((void *)0); (pd)->pd_link
.tqe_prev = (&sc->sc_freeq[pq])->tqh_last; *(&sc
->sc_freeq[pq])->tqh_last = (pd); (&sc->sc_freeq
[pq])->tqh_last = &(pd)->pd_link.tqe_next; } while (
0);
}

return (error);
3192}

3194void
3195pgt_dma_free(struct pgt_softc *sc)
3196{
/*
* fragments
*/
if (sc->sc_dmat != NULL((void *)0)) {
6
←
Assuming field 'sc_dmat' is equal to NULL→
7
←
Taking false branch→
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_LOW_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_LOW_TX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_HIGH_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_DATA_HIGH_TX);
pgt_dma_free_queue(sc, PGT_QUEUE_MGMT_RX);
pgt_dma_free_queue(sc, PGT_QUEUE_MGMT_TX);
}

/*
* powersave
*/
if (sc->sc_psmbuf != NULL((void *)0)) {
8
←
Assuming field 'sc_psmbuf' is equal to NULL→
9
←
Taking false branch→
bus_dmamap_unload(sc->sc_dmat, sc->sc_psmdmam)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc->
sc_psmdmam));
bus_dmamem_free(sc->sc_dmat, &sc->sc_psmdmas, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
sc->sc_psmdmas), (1));
sc->sc_psmbuf = NULL((void *)0);
sc->sc_psmdmam = NULL((void *)0);
}

/*
* control block
*/
if (sc->sc_cb != NULL((void *)0)) {
10
←
Assuming field 'sc_cb' is not equal to NULL→
11
←
Taking true branch→
bus_dmamap_unload(sc->sc_dmat, sc->sc_cbdmam)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc->
sc_cbdmam));
12
←
Access to field '_dmamap_unload' results in a dereference of a null pointer (loaded from field 'sc_dmat')
bus_dmamem_free(sc->sc_dmat, &sc->sc_cbdmas, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
sc->sc_cbdmas), (1));
sc->sc_cb = NULL((void *)0);
sc->sc_cbdmam = NULL((void *)0);
}
3228}

3230void
3231pgt_dma_free_queue(struct pgt_softc *sc, enum pgt_queue pq)
3232{
struct pgt_desc	*pd;

while (!TAILQ_EMPTY(&sc->sc_freeq[pq])(((&sc->sc_freeq[pq])->tqh_first) == ((void *)0))) {
pd = TAILQ_FIRST(&sc->sc_freeq[pq])((&sc->sc_freeq[pq])->tqh_first);
TAILQ_REMOVE(&sc->sc_freeq[pq], pd, pd_link)do { if (((pd)->pd_link.tqe_next) != ((void *)0)) (pd)->
pd_link.tqe_next->pd_link.tqe_prev = (pd)->pd_link.tqe_prev
; else (&sc->sc_freeq[pq])->tqh_last = (pd)->pd_link
.tqe_prev; *(pd)->pd_link.tqe_prev = (pd)->pd_link.tqe_next
; ((pd)->pd_link.tqe_prev) = ((void *)-1); ((pd)->pd_link
.tqe_next) = ((void *)-1); } while (0);
if (pd->pd_dmam != NULL((void *)0)) {
	bus_dmamap_unload(sc->sc_dmat, pd->pd_dmam)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (pd->
pd_dmam));
	pd->pd_dmam = NULL((void *)0);
}
bus_dmamem_free(sc->sc_dmat, &pd->pd_dmas, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (&
pd->pd_dmas), (1));
free(pd, M_DEVBUF2, 0);
}
3245}

3247int
3248pgt_activate(struct device *self, int act)
3249{
struct pgt_softc *sc = (struct pgt_softc *)self;
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;

DPRINTF(("%s: %s(%d)\n", sc->sc_dev.dv_xname, __func__, why));

switch (act) {
case DVACT_SUSPEND3:
if (ifp->if_flags & IFF_RUNNING0x40) {
	pgt_stop(sc, SC_NEEDS_RESET0x00000008);
	pgt_update_hw_from_sw(sc, 0);
}
if (sc->sc_power != NULL((void *)0))
	(*sc->sc_power)(sc, act);
break;
case DVACT_WAKEUP5:
pgt_wakeup(sc);
break;
}
return 0;
3269}

3271void
3272pgt_wakeup(struct pgt_softc *sc)
3273{
struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;

if (sc->sc_power != NULL((void *)0))
(*sc->sc_power)(sc, DVACT_RESUME4);

pgt_stop(sc, SC_NEEDS_RESET0x00000008);
pgt_update_hw_from_sw(sc, 0);

if (ifp->if_flags & IFF_UP0x1) {
pgt_init(ifp);
pgt_update_hw_from_sw(sc, 0);
}
3286}