imported Sam Leffler's ath driver for atheros multimode wireless nics

from NetBSD and FreeBSD.

ok deraadt@

8 files changed, 4774 insertions, 4 deletions

diff --git a/sys/arch/i386/conf/GENERIC b/sys/arch/i386/conf/GENERIC
index e392ef61dbd..cca92e82002 100644
--- a/sys/arch/i386/conf/GENERIC
+++ b/sys/arch/i386/conf/GENERIC
@@ -1,4 +1,4 @@
-#	$OpenBSD: GENERIC,v 1.382 2004/10/20 12:56:45 deraadt Exp $
+#	$OpenBSD: GENERIC,v 1.383 2004/11/02 02:45:36 reyk Exp $
 #
 #	GENERIC -- everything that's currently supported
 #
@@ -420,6 +420,8 @@ hme*	at pci?				# Sun Happy Meal
 bce*	at pci?				# Broadcom BCM4401
 
 # Wireless network cards
+#ath*	at pci?				# Atheros AR5k (802.11a/b/g)
+#ath*	at cardbus?			# Atheros AR5k (802.11a/b/g)
 atw*	at pci?				# ADMtek ADM8211 (802.11)
 atw*	at cardbus?			# ADMtek ADM8211 (802.11)
 wi*	at pci?				# WaveLAN IEEE 802.11DS
diff --git a/sys/conf/files b/sys/conf/files
index bdcce585abb..6202a5bc5b2 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1,4 +1,4 @@
-#	$OpenBSD: files,v 1.317 2004/10/08 13:04:35 grange Exp $
+#	$OpenBSD: files,v 1.318 2004/11/02 02:45:36 reyk Exp $
 #	$NetBSD: files,v 1.87 1996/05/19 17:17:50 jonathan Exp $
 
 #	@(#)files.newconf	7.5 (Berkeley) 5/10/93
@@ -318,6 +318,17 @@ file	dev/ic/trm.c		trm
 device	lm
 file	dev/ic/nslm7x.c		lm
 
+# Atheros AR5k (802.11/a/b/g) Hardware Abstraction Layer
+define  ar5xxx
+file	dev/ic/ar5xxx.c		ar5xxx
+file	dev/ic/ar5210.c		ar5xxx
+#file	dev/ic/ar5211.c		ar5xxx
+#file	dev/ic/ar5212.c		ar5xxx
+
+# Atheros AR5k (802.11/a/b/g) driver
+device	ath: ether, ifnet, ifmedia, ar5xxx, wlan
+file	dev/ic/ath.c		ath
+
 # ADMtek ADM8211 802.11
 device	atw: ether, ifnet, ifmedia, smc93cx6, wlan
 file	dev/ic/atw.c		atw
@@ -710,6 +721,7 @@ file net80211/ieee80211_node.c		wlan
 file net80211/ieee80211_output.c	wlan
 file net80211/ieee80211_proto.c		wlan
 file net80211/ieee80211_rssadapt.c	wlan
+file net80211/ieee80211_regdomain.c	wlan
 file netccitt/ccitt_proto.c		ccitt
 file netccitt/hd_debug.c		hdlc
 file netccitt/hd_input.c		hdlc
diff --git a/sys/dev/cardbus/files.cardbus b/sys/dev/cardbus/files.cardbus
index aab674080f7..5d775c99baf 100644
--- a/sys/dev/cardbus/files.cardbus
+++ b/sys/dev/cardbus/files.cardbus
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.cardbus,v 1.7 2004/06/22 23:55:23 millert Exp $
+#	$OpenBSD: files.cardbus,v 1.8 2004/11/02 02:45:37 reyk Exp $
 #	$NetBSD: files.cardbus,v 1.8 2000/01/26 06:37:24 thorpej Exp $
 #
 # files.cardbus
@@ -55,6 +55,12 @@ file	dev/cardbus/if_rl_cardbus.c		rl_cardbus
 #file	dev/cardbus/com_cardbus.c		com_cardbus
 
 #
+# Atheros AR5k
+#
+attach	ath at cardbus with ath_cardbus
+file	dev/cardbus/if_ath_cardbus.c		ath_cardbus
+
+#
 # ADMtek ADM8211
 #
 attach	atw at cardbus with atw_cardbus
diff --git a/sys/dev/cardbus/if_ath_cardbus.c b/sys/dev/cardbus/if_ath_cardbus.c
new file mode 100644
index 00000000000..c04fbb0dc91
--- /dev/null
+++ b/sys/dev/cardbus/if_ath_cardbus.c
@@ -0,0 +1,340 @@
+/*      $OpenBSD: if_ath_cardbus.c,v 1.1 2004/11/02 02:45:37 reyk Exp $   */
+/*	$NetBSD: if_ath_cardbus.c,v 1.4 2004/08/02 19:14:28 mycroft Exp $ */
+
+/*
+ * Copyright (c) 2003
+ *	Ichiro FUKUHARA <ichiro@ichiro.org>.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *	This product includes software developed by Ichiro FUKUHARA.
+ * 4. The name of the company nor the name of the author may be used to
+ *    endorse or promote products derived from this software without specific
+ *    prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY ICHIRO FUKUHARA ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL ICHIRO FUKUHARA OR THE VOICES IN HIS HEAD BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * CardBus bus front-end for the AR5001 Wireless LAN 802.11a/b/g CardBus.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h> 
+#include <sys/mbuf.h>   
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/ioctl.h>
+#include <sys/errno.h>
+#include <sys/device.h>
+
+#include <machine/endian.h>
+ 
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+
+#ifdef INET
+#include <netinet/in.h> 
+#include <netinet/if_ether.h>
+#endif
+
+#include <net80211/ieee80211_compat.h>
+#include <net80211/ieee80211_var.h>
+
+#if NBPFILTER > 0 
+#include <net/bpf.h>
+#endif 
+
+
+#ifdef NS
+#include <netns/ns.h>
+#include <netns/ns_if.h>
+#endif
+
+#include <machine/bus.h>
+#include <machine/intr.h>
+
+#include <dev/mii/miivar.h>
+#include <dev/mii/mii_bitbang.h>
+
+#include <dev/ic/athvar.h>
+
+#include <dev/pci/pcivar.h>
+#include <dev/pci/pcireg.h>
+#include <dev/pci/pcidevs.h>
+
+#include <dev/cardbus/cardbusvar.h>
+
+/*
+ * PCI configuration space registers
+ */
+#define	ATH_PCI_MMBA		0x10	/* memory mapped base */
+
+struct ath_cardbus_softc {
+	struct ath_softc	sc_ath;
+
+	/* CardBus-specific goo. */
+	void	*sc_ih;			/* interrupt handle */
+	cardbus_devfunc_t sc_ct;	/* our CardBus devfuncs */
+	cardbustag_t sc_tag;		/* our CardBus tag */
+	bus_size_t sc_mapsize;		/* the size of mapped bus space region */
+
+	pcireg_t sc_bar_val;		/* value of the BAR */
+
+	int	sc_intrline;		/* interrupt line */
+};
+
+int	ath_cardbus_match(struct device *, void *, void *);
+void	ath_cardbus_attach(struct device *, struct device *, void *);
+int	ath_cardbus_detach(struct device *, int);
+
+struct cfattach ath_cardbus_ca = {
+	sizeof(struct ath_cardbus_softc),
+	ath_cardbus_match,
+	ath_cardbus_attach,
+	ath_cardbus_detach
+};
+
+
+void	ath_cardbus_setup(struct ath_cardbus_softc *);
+
+int	ath_cardbus_enable(struct ath_softc *);
+void	ath_cardbus_disable(struct ath_softc *);
+void	ath_cardbus_power(struct ath_softc *, int);
+
+int
+ath_cardbus_match(struct device *parent, void *match, void *aux)
+{
+	struct cardbus_attach_args *ca = aux;
+	const char* devname;
+
+	devname = ath_hal_probe(PCI_VENDOR(ca->ca_id),
+				PCI_PRODUCT(ca->ca_id));
+
+	if (devname)
+		return (1);
+
+	return (0);
+}
+
+void
+ath_cardbus_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct ath_cardbus_softc *csc = (void *)self;
+	struct ath_softc *sc = &csc->sc_ath;
+	struct cardbus_attach_args *ca = aux;
+	cardbus_devfunc_t ct = ca->ca_ct;
+	bus_addr_t adr;
+
+	sc->sc_dmat = ca->ca_dmat;
+	csc->sc_ct = ct;
+	csc->sc_tag = ca->ca_tag;
+
+	/*
+	 * Power management hooks.
+	 */
+	sc->sc_enable = ath_cardbus_enable;
+	sc->sc_disable = ath_cardbus_disable;
+	sc->sc_power = ath_cardbus_power;
+
+	/*
+	 * Map the device.
+	 */
+	if (Cardbus_mapreg_map(ct, ATH_PCI_MMBA, CARDBUS_MAPREG_TYPE_MEM, 0,
+	    &sc->sc_st, &sc->sc_sh, &adr, &csc->sc_mapsize) == 0) {
+#if rbus
+#else
+		(*ct->ct_cf->cardbus_mem_open)(cc, 0, adr, adr+csc->sc_mapsize);
+#endif
+		csc->sc_bar_val = adr | CARDBUS_MAPREG_TYPE_MEM;
+	}
+
+	else {
+	        printf(": unable to map device registers\n");
+		return;
+	}
+
+	/*
+	 * Set up the PCI configuration registers.
+	 */
+	ath_cardbus_setup(csc);
+
+	/* Remember which interrupt line. */
+	csc->sc_intrline = ca->ca_intrline;
+
+	printf(": irq %d\n", csc->sc_intrline);
+
+	/*
+	 * Finish off the attach.
+	 */
+	ath_attach(PCI_PRODUCT(ca->ca_id), sc);
+
+	/*
+	 * Power down the socket.
+	 */
+	Cardbus_function_disable(csc->sc_ct);
+}
+
+int
+ath_cardbus_detach(struct device *self, int flags)
+{
+	struct ath_cardbus_softc *csc = (void *)self;
+	struct ath_softc *sc = &csc->sc_ath;
+	struct cardbus_devfunc *ct = csc->sc_ct;
+	int rv;
+
+#if defined(DIAGNOSTIC)
+	if (ct == NULL)
+		panic("%s: data structure lacks", sc->sc_dev.dv_xname);
+#endif
+
+	rv = ath_detach(sc);
+	if (rv)
+		return (rv);
+
+	/*
+	 * Unhook the interrupt handler.
+	 */
+	if (csc->sc_ih != NULL)
+		cardbus_intr_disestablish(ct->ct_cc, ct->ct_cf, csc->sc_ih);
+		csc->sc_ih = NULL;
+
+	/*
+	 * Release bus space and close window.
+	 */
+	Cardbus_mapreg_unmap(ct, ATH_PCI_MMBA,
+		    sc->sc_st, sc->sc_sh, csc->sc_mapsize);
+
+	return (0);
+}
+
+int
+ath_cardbus_enable(struct ath_softc *sc)
+{
+	struct ath_cardbus_softc *csc = (void *) sc;
+	cardbus_devfunc_t ct = csc->sc_ct;
+	cardbus_chipset_tag_t cc = ct->ct_cc;
+	cardbus_function_tag_t cf = ct->ct_cf;
+
+	/*
+	 * Power on the socket.
+	 */
+	Cardbus_function_enable(ct);
+
+	/*
+	 * Set up the PCI configuration registers.
+	 */
+	ath_cardbus_setup(csc);
+
+	/*
+	 * Map and establish the interrupt.
+	 */
+	csc->sc_ih = cardbus_intr_establish(cc, cf, csc->sc_intrline, IPL_NET,
+	    ath_intr, sc);
+	if (csc->sc_ih == NULL) {
+		printf(": unable to establish irq %d\n",
+		       csc->sc_intrline);
+		Cardbus_function_disable(csc->sc_ct);
+		return (1);
+	}
+	return (0);
+}
+
+void
+ath_cardbus_disable(struct ath_softc *sc)
+{
+	struct ath_cardbus_softc *csc = (void *) sc;
+	cardbus_devfunc_t ct = csc->sc_ct;
+	cardbus_chipset_tag_t cc = ct->ct_cc;
+	cardbus_function_tag_t cf = ct->ct_cf;
+
+	/* Unhook the interrupt handler. */
+	cardbus_intr_disestablish(cc, cf, csc->sc_ih);
+	csc->sc_ih = NULL;
+
+	/* Power down the socket. */
+	Cardbus_function_disable(ct);
+}
+
+void
+ath_cardbus_power(struct ath_softc *sc, int why)
+{
+	struct ath_cardbus_softc *csc = (void *) sc;
+
+	printf("%s: ath_cardbus_power\n", sc->sc_dev.dv_xname);
+
+	if (why == PWR_RESUME) {
+		/*
+		 * Give the PCI configuration registers a kick
+		 * in the head.
+		 */
+#ifdef DIAGNOSTIC
+		if (ATH_IS_ENABLED(sc) == 0)
+			panic("ath_cardbus_power");
+#endif
+		ath_cardbus_setup(csc);
+	}
+}
+
+void
+ath_cardbus_setup(struct ath_cardbus_softc *csc)
+{
+	cardbus_devfunc_t ct = csc->sc_ct;
+	cardbus_chipset_tag_t cc = ct->ct_cc;
+	cardbus_function_tag_t cf = ct->ct_cf;
+	pcireg_t reg;
+
+#ifdef notyet
+	(void)cardbus_setpowerstate(sc->sc_dev.dv_xname, ct, csc->sc_tag,
+	    PCI_PWR_D0);
+#endif
+
+	/* Program the BAR. */
+	cardbus_conf_write(cc, cf, csc->sc_tag, ATH_PCI_MMBA,
+	    csc->sc_bar_val);
+
+	/* Make sure the right access type is on the CardBus bridge. */
+	(*ct->ct_cf->cardbus_ctrl)(cc, CARDBUS_MEM_ENABLE);
+	(*ct->ct_cf->cardbus_ctrl)(cc, CARDBUS_BM_ENABLE);
+
+	/* Enable the appropriate bits in the PCI CSR. */
+	reg = cardbus_conf_read(cc, cf, csc->sc_tag,
+	    CARDBUS_COMMAND_STATUS_REG);
+	reg |= CARDBUS_COMMAND_MASTER_ENABLE | CARDBUS_COMMAND_MEM_ENABLE;
+	cardbus_conf_write(cc, cf, csc->sc_tag, CARDBUS_COMMAND_STATUS_REG,
+	    reg);
+
+	/*
+	 * Make sure the latency timer is set to some reasonable
+	 * value.
+	 */
+	reg = cardbus_conf_read(cc, cf, csc->sc_tag, CARDBUS_BHLC_REG);
+	if (CARDBUS_LATTIMER(reg) < 0x20) {
+		reg &= ~(CARDBUS_LATTIMER_MASK << CARDBUS_LATTIMER_SHIFT);
+		reg |= (0x20 << CARDBUS_LATTIMER_SHIFT);
+		cardbus_conf_write(cc, cf, csc->sc_tag, CARDBUS_BHLC_REG, reg);
+	}
+}
diff --git a/sys/dev/ic/ath.c b/sys/dev/ic/ath.c
new file mode 100644
index 00000000000..74db2c1b027
--- /dev/null
+++ b/sys/dev/ic/ath.c
@@ -0,0 +1,3622 @@
+/*      $OpenBSD: ath.c,v 1.1 2004/11/02 02:45:37 reyk Exp $  */
+/*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/
+
+/*-
+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/*
+ * Driver for the Atheros Wireless LAN controller.
+ *
+ * This software is derived from work of Atsushi Onoe; his contribution
+ * is greatly appreciated.
+ */
+
+#include "bpfilter.h"
+
+#include <sys/param.h>
+#include <sys/systm.h> 
+#include <sys/types.h>
+#include <sys/sysctl.h>
+#include <sys/mbuf.h>   
+#include <sys/malloc.h>
+#include <sys/lock.h>
+#include <sys/kernel.h>
+#include <sys/socket.h>
+#include <sys/sockio.h>
+#include <sys/errno.h>
+#include <sys/timeout.h>
+
+#include <machine/endian.h>
+#include <machine/bus.h>
+ 
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_arp.h>
+#include <net/if_llc.h>
+#ifdef INET
+#include <netinet/in.h>
+#include <netinet/if_ether.h>
+#endif
+
+#if NBPFILTER > 0
+#include <net/bpf.h>
+#endif
+
+#include <net80211/ieee80211_var.h>
+#include <net80211/ieee80211_compat.h>
+
+#include <dev/ic/athvar.h>
+
+/* unaligned little endian access */     
+#define LE_READ_2(p)							\
+	((u_int16_t)							\
+	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
+#define LE_READ_4(p)							\
+	((u_int32_t)							\
+	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
+	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
+
+#ifdef __FreeBSD__
+void	ath_init(void *);
+#else
+int	ath_init(struct ifnet *);
+#endif
+int	ath_init1(struct ath_softc *);
+int	ath_intr1(struct ath_softc *);
+void	ath_stop(struct ifnet *);
+void	ath_start(struct ifnet *);
+void	ath_reset(struct ath_softc *);
+int	ath_media_change(struct ifnet *);
+void	ath_watchdog(struct ifnet *);
+int	ath_ioctl(struct ifnet *, u_long, caddr_t);
+void	ath_fatal_proc(void *, int);
+void	ath_rxorn_proc(void *, int);
+void	ath_bmiss_proc(void *, int);
+u_int   ath_chan2flags(struct ieee80211com *, struct ieee80211_channel *);
+void	ath_initkeytable(struct ath_softc *);
+void    ath_mcastfilter_accum(caddr_t, u_int32_t (*)[2]);
+void    ath_mcastfilter_compute(struct ath_softc *, u_int32_t (*)[2]);
+u_int32_t ath_calcrxfilter(struct ath_softc *);
+void	ath_mode_init(struct ath_softc *);
+int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
+void	ath_beacon_proc(struct ath_softc *, int);
+void	ath_beacon_free(struct ath_softc *);
+void	ath_beacon_config(struct ath_softc *);
+int	ath_desc_alloc(struct ath_softc *);
+void	ath_desc_free(struct ath_softc *);
+struct ieee80211_node *ath_node_alloc(struct ieee80211com *);
+struct mbuf *ath_getmbuf(int, int, u_int);
+void	ath_node_free(struct ieee80211com *, struct ieee80211_node *);
+void	ath_node_copy(struct ieee80211com *,
+			struct ieee80211_node *, const struct ieee80211_node *);
+u_int8_t	ath_node_getrssi(struct ieee80211com *,
+			struct ieee80211_node *);
+int	ath_rxbuf_init(struct ath_softc *, struct ath_buf *);
+void	ath_rx_proc(void *, int);
+int	ath_tx_start(struct ath_softc *, struct ieee80211_node *,
+			     struct ath_buf *, struct mbuf *);
+void	ath_tx_proc(void *, int);
+int	ath_chan_set(struct ath_softc *, struct ieee80211_channel *);
+void	ath_draintxq(struct ath_softc *);
+void	ath_stoprecv(struct ath_softc *);
+int	ath_startrecv(struct ath_softc *);
+void	ath_next_scan(void *);
+void	ath_calibrate(void *);
+HAL_LED_STATE ath_state_to_led(enum ieee80211_state);
+int	ath_newstate(struct ieee80211com *, enum ieee80211_state, int);
+void	ath_newassoc(struct ieee80211com *,
+			struct ieee80211_node *, int);
+int	ath_getchannels(struct ath_softc *, u_int cc, HAL_BOOL outdoor,
+			HAL_BOOL xchanmode);
+
+int	ath_rate_setup(struct ath_softc *sc, u_int mode);
+void	ath_setcurmode(struct ath_softc *, enum ieee80211_phymode);
+void	ath_rate_ctl_reset(struct ath_softc *, enum ieee80211_state);
+void	ath_rate_ctl(void *, struct ieee80211_node *);
+void	ath_recv_mgmt(struct ieee80211com *, struct mbuf *,
+			struct ieee80211_node *, int, int, u_int32_t);
+
+int	ath_enable(struct ath_softc *);
+void	ath_disable(struct ath_softc *);
+void	ath_power(int, void *);
+
+#ifdef __FreeBSD__
+SYSCTL_DECL(_hw_ath);
+/* XXX validate sysctl values */
+SYSCTL_INT(_hw_ath, OID_AUTO, dwell, CTLFLAG_RW, &ath_dwelltime,
+	    0, "channel dwell time (ms) for AP/station scanning");
+SYSCTL_INT(_hw_ath, OID_AUTO, calibrate, CTLFLAG_RW, &ath_calinterval,
+	    0, "chip calibration interval (secs)");
+SYSCTL_INT(_hw_ath, OID_AUTO, outdoor, CTLFLAG_RD, &ath_outdoor,
+	    0, "enable/disable outdoor operation");
+TUNABLE_INT("hw.ath.outdoor", &ath_outdoor);
+SYSCTL_INT(_hw_ath, OID_AUTO, countrycode, CTLFLAG_RD, &ath_countrycode,
+	    0, "country code");
+TUNABLE_INT("hw.ath.countrycode", &ath_countrycode);
+SYSCTL_INT(_hw_ath, OID_AUTO, regdomain, CTLFLAG_RD, &ath_regdomain,
+	    0, "regulatory domain");
+#endif /* __FreeBSD__ */
+
+int ath_dwelltime_nodenum, ath_calibrate_nodenum, ath_outdoor_nodenum,
+           ath_countrycode_nodenum, ath_regdomain_nodenum, ath_debug_nodenum;
+
+static	int ath_dwelltime = 200;		/* 5 channels/second */
+static	int ath_calinterval = 30;		/* calibrate every 30 secs */
+static	int ath_outdoor = AH_TRUE;		/* outdoor operation */
+static	int ath_xchanmode = AH_TRUE;		/* enable extended channels */
+static	int ath_countrycode = CTRY_DEFAULT;	/* country code */
+static	int ath_regdomain = 0;			/* regulatory domain */
+
+#ifdef AR_DEBUG
+enum {
+	ATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
+	ATH_DEBUG_XMIT_DESC	= 0x00000002,	/* xmit descriptors */
+	ATH_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
+	ATH_DEBUG_RECV_DESC	= 0x00000008,	/* recv descriptors */
+	ATH_DEBUG_RATE		= 0x00000010,	/* rate control */
+	ATH_DEBUG_RESET		= 0x00000020,	/* reset processing */
+	ATH_DEBUG_MODE		= 0x00000040,	/* mode init/setup */
+	ATH_DEBUG_BEACON 	= 0x00000080,	/* beacon handling */
+	ATH_DEBUG_WATCHDOG 	= 0x00000100,	/* watchdog timeout */
+	ATH_DEBUG_INTR		= 0x00001000,	/* ISR */
+	ATH_DEBUG_TX_PROC	= 0x00002000,	/* tx ISR proc */
+	ATH_DEBUG_RX_PROC	= 0x00004000,	/* rx ISR proc */
+	ATH_DEBUG_BEACON_PROC	= 0x00008000,	/* beacon ISR proc */
+	ATH_DEBUG_CALIBRATE	= 0x00010000,	/* periodic calibration */
+	ATH_DEBUG_ANY		= 0xffffffff
+};
+int	ath_debug = ATH_DEBUG_ANY;
+#ifdef __FreeBSD__
+SYSCTL_INT(_hw_ath, OID_AUTO, debug, CTLFLAG_RW, &ath_debug,
+	    0, "control debugging printfs");
+TUNABLE_INT("hw.ath.debug", &ath_debug);
+#endif /* __FreeBSD__ */
+#define	IFF_DUMPPKTS(_ifp, _m) \
+	((ath_debug & _m) || \
+	    ((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
+static	void ath_printrxbuf(struct ath_buf *bf, int);
+static	void ath_printtxbuf(struct ath_buf *bf, int);
+#define	DPRINTF(_m,X)	if (ath_debug & (_m)) printf X
+#else
+#define	IFF_DUMPPKTS(_ifp, _m) \
+	(((_ifp)->if_flags & (IFF_DEBUG|IFF_LINK2)) == (IFF_DEBUG|IFF_LINK2))
+#define	DPRINTF(_m, X)
+#endif
+
+#if 0
+int
+ath_activate(struct device *self, enum devact act)
+{
+	struct ath_softc *sc = (struct ath_softc *)self;
+	int rv = 0, s;
+
+	s = splnet();
+	switch (act) {
+	case DVACT_ACTIVATE:
+		rv = EOPNOTSUPP;
+		break;
+	case DVACT_DEACTIVATE:
+		if_deactivate(&sc->sc_ic.ic_if);
+		break;
+	}
+	splx(s);
+	return rv;
+}
+#endif
+
+int
+ath_enable(struct ath_softc *sc)
+{
+	if (ATH_IS_ENABLED(sc) == 0) {
+		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
+			printf("%s: device enable failed\n",
+				sc->sc_dev.dv_xname);
+			return (EIO);
+		}
+		sc->sc_flags |= ATH_ENABLED;
+	}
+	return (0);
+}
+
+void
+ath_disable(struct ath_softc *sc)
+{
+	if (!ATH_IS_ENABLED(sc))
+		return;
+	if (sc->sc_disable != NULL)
+		(*sc->sc_disable)(sc);
+	sc->sc_flags &= ~ATH_ENABLED;
+}
+
+#if 0
+int
+sysctl_ath_verify(SYSCTLFN_ARGS)
+{
+	int error, t;
+	struct sysctlnode node;
+
+	node = *rnode;
+	t = *(int*)rnode->sysctl_data;
+	node.sysctl_data = &t;
+	error = sysctl_lookup(SYSCTLFN_CALL(&node));
+	if (error || newp == NULL)
+		return (error);
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: t = %d, nodenum = %d, rnodenum = %d\n",
+	    __func__, t, node.sysctl_num, rnode->sysctl_num));
+
+	if (node.sysctl_num == ath_dwelltime_nodenum) {
+		if (t <= 0)
+			return (EINVAL);
+	} else if (node.sysctl_num == ath_calibrate_nodenum) {
+		if (t <= 0)
+			return (EINVAL);
+#ifdef AR_DEBUG
+	} else if (node.sysctl_num == ath_debug_nodenum) {
+		if (t < 0 || t > 2)
+			return (EINVAL);
+#endif /* AR_DEBUG */
+	} else
+		return (EINVAL);
+
+	*(int*)rnode->sysctl_data = t;
+
+	return (0);
+}
+
+/*
+ * Setup sysctl(3) MIB, ath.*.
+ *
+ * TBD condition CTLFLAG_PERMANENT on being an LKM or not
+ */
+SYSCTL_SETUP(sysctl_ath, "sysctl ath subtree setup")
+{
+	int rc, ath_node_num;
+	struct sysctlnode *node;
+
+	if ((rc = sysctl_createv(clog, 0, NULL, NULL,
+	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "hw", NULL,
+	    NULL, 0, NULL, 0, CTL_HW, CTL_EOL)) != 0)
+		goto err;
+
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT, CTLTYPE_NODE, "ath",
+	    SYSCTL_DESCR("ath information and options"),
+	    NULL, 0, NULL, 0, CTL_HW, CTL_CREATE, CTL_EOL)) != 0)
+		goto err;
+
+	ath_node_num = node->sysctl_num;
+
+	/* channel dwell time (ms) for AP/station scanning */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+	    CTLTYPE_INT, "dwell",
+	    SYSCTL_DESCR("Channel dwell time (ms) for AP/station scanning"),
+	    sysctl_ath_verify, 0, &ath_dwelltime,
+	    0, CTL_HW, ath_node_num, CTL_CREATE,
+	    CTL_EOL)) != 0)
+		goto err;
+
+	ath_dwelltime_nodenum = node->sysctl_num;
+
+	/* chip calibration interval (secs) */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE,
+	    CTLTYPE_INT, "calibrate",
+	    SYSCTL_DESCR("Chip calibration interval (secs)"), sysctl_ath_verify,
+	    0, &ath_calinterval, 0, CTL_HW,
+	    ath_node_num, CTL_CREATE, CTL_EOL)) != 0)
+		goto err;
+
+	ath_calibrate_nodenum = node->sysctl_num;
+
+	/* enable/disable outdoor operation */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
+	    "outdoor", SYSCTL_DESCR("Enable/disable outdoor operation"),
+	    NULL, 0, &ath_outdoor, 0,
+	    CTL_HW, ath_node_num, CTL_CREATE,
+	    CTL_EOL)) != 0)
+		goto err;
+
+	ath_outdoor_nodenum = node->sysctl_num;
+
+	/* country code */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
+	    "countrycode", SYSCTL_DESCR("Country code"),
+	    NULL, 0, &ath_countrycode, 0,
+	    CTL_HW, ath_node_num, CTL_CREATE,
+	    CTL_EOL)) != 0)
+		goto err;
+
+	ath_countrycode_nodenum = node->sysctl_num;
+
+	/* regulatory domain */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READONLY, CTLTYPE_INT,
+	    "regdomain", SYSCTL_DESCR("Regulatory domain"),
+	    NULL, 0, &ath_regdomain, 0,
+	    CTL_HW, ath_node_num, CTL_CREATE,
+	    CTL_EOL)) != 0)
+		goto err;
+
+	ath_regdomain_nodenum = node->sysctl_num;
+
+#ifdef AR_DEBUG
+
+	/* control debugging printfs */
+	if ((rc = sysctl_createv(clog, 0, NULL, &node,
+	    CTLFLAG_PERMANENT|CTLFLAG_READWRITE, CTLTYPE_INT,
+	    "debug", SYSCTL_DESCR("Enable/disable ath debugging output"),
+	    sysctl_ath_verify, 0, &ath_debug, 0,
+	    CTL_HW, ath_node_num, CTL_CREATE,
+	    CTL_EOL)) != 0)
+		goto err;
+
+	ath_debug_nodenum = node->sysctl_num;
+
+#endif /* AR_DEBUG */
+	return;
+err:
+	printf("%s: sysctl_createv failed (rc = %d)\n", __func__, rc);
+}
+#endif /* 0 */
+
+int
+ath_attach(u_int16_t devid, struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_hal *ah;
+	HAL_STATUS status;
+	HAL_TXQ_INFO qinfo;
+	int error = 0;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: devid 0x%x\n", __func__, devid));
+
+#ifdef __FreeBSD__
+	/* set these up early for if_printf use */
+	if_initname(ifp, device_get_name(sc->sc_dev),
+	    device_get_unit(sc->sc_dev));
+#else
+	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
+#endif
+
+	ah = ath_hal_attach(devid, sc, sc->sc_st, sc->sc_sh, &status);
+	if (ah == NULL) {
+		if_printf(ifp, "unable to attach hardware; HAL status %d\n",
+			status);
+		error = ENXIO;
+		goto bad;
+	}
+	if (ah->ah_abi != HAL_ABI_VERSION) {
+		if_printf(ifp, "HAL ABI mismatch detected (0x%x != 0x%x)\n",
+			ah->ah_abi, HAL_ABI_VERSION);
+		error = ENXIO;
+		goto bad;
+	}
+	if_printf(ifp, "mac %d.%d phy %d.%d",
+		ah->ah_macVersion, ah->ah_macRev,
+		ah->ah_phyRev >> 4, ah->ah_phyRev & 0xf);
+	if (ah->ah_analog5GhzRev != 0)
+		printf(" 5ghz radio %d.%d",
+			ah->ah_analog5GhzRev >> 4, ah->ah_analog5GhzRev & 0xf);
+	if (ah->ah_analog2GhzRev != 0)
+		printf(" 2ghz radio %d.%d",
+			ah->ah_analog2GhzRev >> 4, ah->ah_analog2GhzRev & 0xf);
+	sc->sc_ah = ah;
+	sc->sc_invalid = 0;	/* ready to go, enable interrupt handling */
+
+	/*
+	 * Collect the channel list using the default country
+	 * code and including outdoor channels.  The 802.11 layer
+	 * is resposible for filtering this list based on settings
+	 * like the phy mode.
+	 */
+	error = ath_getchannels(sc, ath_countrycode, ath_outdoor,
+	    ath_xchanmode);
+	if (error != 0)
+		goto bad;
+	/*
+	 * Copy these back; they are set as a side effect
+	 * of constructing the channel list.
+	 */
+	ath_hal_getregdomain(ah, &ath_regdomain);
+	ath_hal_getcountrycode(ah, &ath_countrycode);
+
+	/*
+	 * Setup rate tables for all potential media types.
+	 */
+	ath_rate_setup(sc, IEEE80211_MODE_11A);
+	ath_rate_setup(sc, IEEE80211_MODE_11B);
+	ath_rate_setup(sc, IEEE80211_MODE_11G);
+	ath_rate_setup(sc, IEEE80211_MODE_TURBO);
+
+	error = ath_desc_alloc(sc);
+	if (error != 0) {
+		if_printf(ifp, "failed to allocate descriptors: %d\n", error);
+		goto bad;
+	}
+	timeout_set(&sc->sc_scan_to, ath_next_scan, sc);
+	timeout_set(&sc->sc_cal_to, ath_calibrate, sc);
+
+#ifdef __FreeBSD__
+	ATH_TXBUF_LOCK_INIT(sc);
+	ATH_TXQ_LOCK_INIT(sc);
+#endif
+
+	ATH_TASK_INIT(&sc->sc_txtask, ath_tx_proc, sc);
+	ATH_TASK_INIT(&sc->sc_rxtask, ath_rx_proc, sc);
+	ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc);
+	ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc);
+	ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc);
+
+	/*
+	 * For now just pre-allocate one data queue and one
+	 * beacon queue.  Note that the HAL handles resetting
+	 * them at the needed time.  Eventually we'll want to
+	 * allocate more tx queues for splitting management
+	 * frames and for QOS support.
+	 */
+	sc->sc_bhalq = ath_hal_setuptxqueue(ah,HAL_TX_QUEUE_BEACON,NULL);
+	if (sc->sc_bhalq == (u_int) -1) {
+		if_printf(ifp, "unable to setup a beacon xmit queue!\n");
+		goto bad2;
+	}
+
+	memset(&qinfo, 0, sizeof(qinfo));
+	qinfo.tqi_subtype = HAL_WME_AC_BE;
+	sc->sc_txhalq = ath_hal_setuptxqueue(ah, HAL_TX_QUEUE_DATA, &qinfo);
+	if (sc->sc_txhalq == (u_int) -1) {
+		if_printf(ifp, "unable to setup a data xmit queue!\n");
+		goto bad2;
+	}
+
+	ifp->if_softc = sc;
+	ifp->if_flags = IFF_SIMPLEX | IFF_BROADCAST | IFF_MULTICAST | IFF_NOTRAILERS;
+	ifp->if_start = ath_start;
+	ifp->if_watchdog = ath_watchdog;
+	ifp->if_ioctl = ath_ioctl;
+#ifndef __OpenBSD__
+	ifp->if_init = ath_init;
+#endif
+#ifdef __FreeBSD__
+	ifp->if_snd.ifq_maxlen = IFQ_MAXLEN;
+#else
+#if 0
+	ifp->if_stop = ath_stop;		/* XXX */
+#endif
+	IFQ_SET_READY(&ifp->if_snd);
+#endif
+
+	ic->ic_softc = sc;
+	ic->ic_newassoc = ath_newassoc;
+	/* XXX not right but it's not used anywhere important */
+	ic->ic_phytype = IEEE80211_T_OFDM;
+	ic->ic_opmode = IEEE80211_M_STA;
+	ic->ic_caps = IEEE80211_C_WEP		/* wep supported */
+	        | IEEE80211_C_PMGT
+		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
+		| IEEE80211_C_HOSTAP		/* hostap mode */
+		| IEEE80211_C_MONITOR		/* monitor mode */
+		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
+		;
+
+	/* get mac address from hardware */
+	ath_hal_getmac(ah, ic->ic_myaddr);
+
+	if_attach(ifp);
+
+	/* call MI attach routine. */
+	ieee80211_ifattach(ifp);
+
+	/* override default methods */
+	ic->ic_node_alloc = ath_node_alloc;
+	sc->sc_node_free = ic->ic_node_free;
+	ic->ic_node_free = ath_node_free;
+	sc->sc_node_copy = ic->ic_node_copy;
+	ic->ic_node_copy = ath_node_copy;
+	ic->ic_node_getrssi = ath_node_getrssi;
+	sc->sc_newstate = ic->ic_newstate;
+	ic->ic_newstate = ath_newstate;
+	sc->sc_recv_mgmt = ic->ic_recv_mgmt;
+	ic->ic_recv_mgmt = ath_recv_mgmt;
+	memset(&sc->sc_broadcast_addr, 0xFF, IEEE80211_ADDR_LEN);
+
+	/* complete initialization */
+	ieee80211_media_init(ifp, ath_media_change, ieee80211_media_status);
+
+#if NBPFILTER > 0
+	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
+	    sizeof(struct ieee80211_frame) + 64);
+#endif
+	/*
+	 * Initialize constant fields.
+	 * XXX make header lengths a multiple of 32-bits so subsequent
+	 *     headers are properly aligned; this is a kludge to keep
+	 *     certain applications happy.
+	 *
+	 * NB: the channel is setup each time we transition to the
+	 *     RUN state to avoid filling it in for each frame.
+	 */
+	sc->sc_tx_th_len = roundup(sizeof(sc->sc_tx_th), sizeof(u_int32_t));
+	sc->sc_tx_th.wt_ihdr.it_len = htole16(sc->sc_tx_th_len);
+	sc->sc_tx_th.wt_ihdr.it_present = htole32(ATH_TX_RADIOTAP_PRESENT);
+
+	sc->sc_rx_th_len = roundup(sizeof(sc->sc_rx_th), sizeof(u_int32_t));
+	sc->sc_rx_th.wr_ihdr.it_len = htole16(sc->sc_rx_th_len);
+	sc->sc_rx_th.wr_ihdr.it_present = htole32(ATH_RX_RADIOTAP_PRESENT);
+
+	sc->sc_flags |= ATH_ATTACHED;
+	/*
+	 * Make sure the interface is shutdown during reboot.
+	 */
+	sc->sc_sdhook = shutdownhook_establish(ath_shutdown, sc);
+	if (sc->sc_sdhook == NULL)
+		printf("%s: WARNING: unable to establish shutdown hook\n",
+			sc->sc_dev.dv_xname);
+	sc->sc_powerhook = powerhook_establish(ath_power, sc);
+	if (sc->sc_powerhook == NULL)
+		printf("%s: WARNING: unable to establish power hook\n",
+			sc->sc_dev.dv_xname);
+
+	printf(", %s, address %s\n", ieee80211_regdomain2name(ath_regdomain),
+	       ether_sprintf(ic->ic_myaddr));
+
+	return 0;
+bad2:
+	ath_desc_free(sc);
+bad:
+	if (ah)
+		ath_hal_detach(ah);
+	sc->sc_invalid = 1;
+	return error;
+}
+
+int
+ath_detach(struct ath_softc *sc)
+{
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	int s;
+
+	if ((sc->sc_flags & ATH_ATTACHED) == 0)
+		return (0);
+	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+	
+	s = splnet();
+	ath_stop(ifp);
+#if NBPFILTER > 0
+	bpfdetach(ifp);
+#endif
+	ath_desc_free(sc);
+	ath_hal_detach(sc->sc_ah);
+
+	ieee80211_ifdetach(ifp);
+	if_detach(ifp);
+
+	splx(s);
+	powerhook_disestablish(sc->sc_powerhook);
+	shutdownhook_disestablish(sc->sc_sdhook);
+#ifdef __FreeBSD__
+
+	ATH_TXBUF_LOCK_DESTROY(sc);
+	ATH_TXQ_LOCK_DESTROY(sc);
+
+#endif /* __FreeBSD__ */
+	return 0;
+}
+
+void
+ath_power(int why, void *arg)
+{
+	struct ath_softc *sc = arg;
+	int s;
+
+	DPRINTF(ATH_DEBUG_ANY, ("ath_power(%d)\n", why));
+
+	s = splnet();
+	switch (why) {
+	case PWR_SUSPEND:
+	case PWR_STANDBY:
+		ath_suspend(sc, why);
+		break;
+	case PWR_RESUME:
+		ath_resume(sc, why);
+		break;
+#if !defined(__OpenBSD__)
+	case PWR_SOFTSUSPEND:
+	case PWR_SOFTSTANDBY:
+	case PWR_SOFTRESUME:
+		break;
+#endif
+	}
+	splx(s);
+}
+
+void
+ath_suspend(struct ath_softc *sc, int why)
+{
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+
+	ath_stop(ifp);
+	if (sc->sc_power != NULL)
+		(*sc->sc_power)(sc, why);
+}
+
+void
+ath_resume(struct ath_softc *sc, int why)
+{
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags %x\n", __func__, ifp->if_flags));
+
+	if (ifp->if_flags & IFF_UP) {
+		ath_init(ifp);
+#if 0
+		(void)ath_intr(sc);
+#endif
+		if (sc->sc_power != NULL)
+			(*sc->sc_power)(sc, why);
+		if (ifp->if_flags & IFF_RUNNING)
+			ath_start(ifp);
+	}
+}
+
+void
+ath_shutdown(void *arg)
+{
+	struct ath_softc *sc = arg;
+
+	ath_stop(&sc->sc_ic.ic_if);
+}
+
+int
+ath_intr(void *arg)
+{
+	return ath_intr1((struct ath_softc *)arg);
+}
+
+int
+ath_intr1(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_hal *ah = sc->sc_ah;
+	HAL_INT status;
+
+	if (sc->sc_invalid) {
+		/*
+		 * The hardware is not ready/present, don't touch anything.
+		 * Note this can happen early on if the IRQ is shared.
+		 */
+		DPRINTF(ATH_DEBUG_ANY, ("%s: invalid; ignored\n", __func__));
+		return 0;
+	}
+	if (!ath_hal_intrpend(ah))		/* shared irq, not for us */
+		return 0;
+	if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) != (IFF_RUNNING|IFF_UP)) {
+		DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
+			__func__, ifp->if_flags));
+		ath_hal_getisr(ah, &status);	/* clear ISR */
+		ath_hal_intrset(ah, 0);		/* disable further intr's */
+		return 1; /* XXX */
+	}
+	ath_hal_getisr(ah, &status);		/* NB: clears ISR too */
+	DPRINTF(ATH_DEBUG_INTR, ("%s: status 0x%x\n", __func__, status));
+	status &= sc->sc_imask;			/* discard unasked for bits */
+	if (status & HAL_INT_FATAL) {
+		sc->sc_stats.ast_hardware++;
+		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
+		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_fataltask);
+	} else if (status & HAL_INT_RXORN) {
+		sc->sc_stats.ast_rxorn++;
+		ath_hal_intrset(ah, 0);		/* disable intr's until reset */
+		ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxorntask);
+	} else {
+		if (status & HAL_INT_RXEOL) {
+			/*
+			 * NB: the hardware should re-read the link when
+			 *     RXE bit is written, but it doesn't work at
+			 *     least on older hardware revs.
+			 */
+			sc->sc_stats.ast_rxeol++;
+			sc->sc_rxlink = NULL;
+		}
+		if (status & HAL_INT_TXURN) {
+			sc->sc_stats.ast_txurn++;
+			/* bump tx trigger level */
+			ath_hal_updatetxtriglevel(ah, AH_TRUE);
+		}
+		if (status & HAL_INT_RX)
+			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask);
+		if (status & HAL_INT_TX)
+			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask);
+		if (status & HAL_INT_SWBA) {
+			/*
+			 * Handle beacon transmission directly; deferring
+			 * this is too slow to meet timing constraints
+			 * under load.
+			 */
+			ath_beacon_proc(sc, 0);
+		}
+		if (status & HAL_INT_BMISS) {
+			sc->sc_stats.ast_bmiss++;
+			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask);
+		}
+	}
+	return 1;
+}
+
+void
+ath_fatal_proc(void *arg, int pending)
+{
+	struct ath_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+
+	if_printf(ifp, "hardware error; resetting\n");
+	ath_reset(sc);
+}
+
+void
+ath_rxorn_proc(void *arg, int pending)
+{
+	struct ath_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+
+	if_printf(ifp, "rx FIFO overrun; resetting\n");
+	ath_reset(sc);
+}
+
+void
+ath_bmiss_proc(void *arg, int pending)
+{
+	struct ath_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: pending %u\n", __func__, pending));
+	if (ic->ic_opmode != IEEE80211_M_STA)
+		return;
+	if (ic->ic_state == IEEE80211_S_RUN) {
+		/*
+		 * Rather than go directly to scan state, try to
+		 * reassociate first.  If that fails then the state
+		 * machine will drop us into scanning after timing
+		 * out waiting for a probe response.
+		 */
+		ieee80211_new_state(ic, IEEE80211_S_ASSOC, -1);
+	}
+}
+
+u_int
+ath_chan2flags(struct ieee80211com *ic, struct ieee80211_channel *chan)
+{
+	enum ieee80211_phymode mode = ieee80211_chan2mode(ic, chan);
+
+	switch (mode) {
+	case IEEE80211_MODE_AUTO:
+		return 0;
+	case IEEE80211_MODE_11A:
+		return CHANNEL_A;
+	case IEEE80211_MODE_11B:
+		return CHANNEL_B;
+	case IEEE80211_MODE_11G:
+		return CHANNEL_PUREG;
+	case IEEE80211_MODE_TURBO:
+		return CHANNEL_T;
+	default:
+		panic("%s: unsupported mode %d\n", __func__, mode);
+		return 0;
+	}
+}
+
+int
+ath_init(struct ifnet *ifp)
+{
+	return ath_init1((struct ath_softc *)ifp->if_softc);
+}
+
+int
+ath_init1(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ieee80211_node *ni;
+	enum ieee80211_phymode mode;
+	struct ath_hal *ah = sc->sc_ah;
+	HAL_STATUS status;
+	HAL_CHANNEL hchan;
+	int error = 0, s;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: if_flags 0x%x\n",
+		__func__, ifp->if_flags));
+
+	if ((error = ath_enable(sc)) != 0)
+		return error;
+
+	s = splnet();
+	/*
+	 * Stop anything previously setup.  This is safe
+	 * whether this is the first time through or not.
+	 */
+	ath_stop(ifp);
+
+	/*
+	 * The basic interface to setting the hardware in a good
+	 * state is ``reset''.  On return the hardware is known to
+	 * be powered up and with interrupts disabled.  This must
+	 * be followed by initialization of the appropriate bits
+	 * and then setup of the interrupt mask.
+	 */
+	hchan.channel = ic->ic_ibss_chan->ic_freq;
+	hchan.channelFlags = ath_chan2flags(ic, ic->ic_ibss_chan);
+	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_FALSE, &status)) {
+		if_printf(ifp, "unable to reset hardware; hal status %u\n",
+			status);
+		error = EIO;
+		goto done;
+	}
+
+	/*
+	 * Setup the hardware after reset: the key cache
+	 * is filled as needed and the receive engine is
+	 * set going.  Frame transmit is handled entirely
+	 * in the frame output path; there's nothing to do
+	 * here except setup the interrupt mask.
+	 */
+	if (ic->ic_flags & IEEE80211_F_WEPON)
+		ath_initkeytable(sc);
+	if ((error = ath_startrecv(sc)) != 0) {
+		if_printf(ifp, "unable to start recv logic\n");
+		goto done;
+	}
+
+	/*
+	 * Enable interrupts.
+	 */
+	sc->sc_imask = HAL_INT_RX | HAL_INT_TX
+		  | HAL_INT_RXEOL | HAL_INT_RXORN
+		  | HAL_INT_FATAL | HAL_INT_GLOBAL;
+	ath_hal_intrset(ah, sc->sc_imask);
+
+	ifp->if_flags |= IFF_RUNNING;
+	ic->ic_state = IEEE80211_S_INIT;
+
+	/*
+	 * The hardware should be ready to go now so it's safe
+	 * to kick the 802.11 state machine as it's likely to
+	 * immediately call back to us to send mgmt frames.
+	 */
+	ni = ic->ic_bss;
+	ni->ni_chan = ic->ic_ibss_chan;
+	mode = ieee80211_chan2mode(ic, ni->ni_chan);
+	if (mode != sc->sc_curmode)
+		ath_setcurmode(sc, mode);
+	if (ic->ic_opmode != IEEE80211_M_MONITOR)
+		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
+	else
+		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
+done:
+	splx(s);
+	return error;
+}
+
+void
+ath_stop(struct ifnet *ifp)
+{
+	struct ieee80211com *ic = (struct ieee80211com *) ifp;
+	struct ath_softc *sc = ifp->if_softc;
+	struct ath_hal *ah = sc->sc_ah;
+	int s;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: invalid %u if_flags 0x%x\n",
+		__func__, sc->sc_invalid, ifp->if_flags));
+
+	s = splnet();
+	if (ifp->if_flags & IFF_RUNNING) {
+		/*
+		 * Shutdown the hardware and driver:
+		 *    disable interrupts
+		 *    turn off timers
+		 *    clear transmit machinery
+		 *    clear receive machinery
+		 *    drain and release tx queues
+		 *    reclaim beacon resources
+		 *    reset 802.11 state machine
+		 *    power down hardware
+		 *
+		 * Note that some of this work is not possible if the
+		 * hardware is gone (invalid).
+		 */
+		ifp->if_flags &= ~IFF_RUNNING;
+		ifp->if_timer = 0;
+		if (!sc->sc_invalid)
+			ath_hal_intrset(ah, 0);
+		ath_draintxq(sc);
+		if (!sc->sc_invalid)
+			ath_stoprecv(sc);
+		else
+			sc->sc_rxlink = NULL;
+#ifdef __FreeBSD__
+		IF_DRAIN(&ifp->if_snd);
+#else
+		IF_PURGE(&ifp->if_snd);
+#endif
+		ath_beacon_free(sc);
+		ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
+		if (!sc->sc_invalid) {
+			ath_hal_setpower(ah, HAL_PM_FULL_SLEEP, 0);
+		}
+		ath_disable(sc);
+	}
+	splx(s);
+}
+
+/*
+ * Reset the hardware w/o losing operational state.  This is
+ * basically a more efficient way of doing ath_stop, ath_init,
+ * followed by state transitions to the current 802.11
+ * operational state.  Used to recover from errors rx overrun
+ * and to reset the hardware when rf gain settings must be reset.
+ */
+void
+ath_reset(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211_channel *c;
+	HAL_STATUS status;
+	HAL_CHANNEL hchan;
+
+	/*
+	 * Convert to a HAL channel description with the flags
+	 * constrained to reflect the current operating mode.
+	 */
+	c = ic->ic_ibss_chan;
+	hchan.channel = c->ic_freq;
+	hchan.channelFlags = ath_chan2flags(ic, c);
+
+	ath_hal_intrset(ah, 0);		/* disable interrupts */
+	ath_draintxq(sc);		/* stop xmit side */
+	ath_stoprecv(sc);		/* stop recv side */
+	/* NB: indicate channel change so we do a full reset */
+	if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status))
+		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
+			__func__, status);
+	ath_hal_intrset(ah, sc->sc_imask);
+	if (ath_startrecv(sc) != 0)	/* restart recv */
+		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
+	ath_start(ifp);			/* restart xmit */
+	if (ic->ic_state == IEEE80211_S_RUN)
+		ath_beacon_config(sc);	/* restart beacons */
+}
+
+void
+ath_start(struct ifnet *ifp)
+{
+	struct ath_softc *sc = ifp->if_softc;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni;
+	struct ath_buf *bf;
+	struct mbuf *m;
+	struct ieee80211_frame *wh;
+	int s;
+
+	if ((ifp->if_flags & (IFF_RUNNING|IFF_OACTIVE)) != IFF_RUNNING || sc->sc_invalid)
+		return;
+	for (;;) {
+		/*
+		 * Grab a TX buffer and associated resources.
+		 */
+		s = splnet();
+		bf = TAILQ_FIRST(&sc->sc_txbuf);
+		if (bf != NULL)
+			TAILQ_REMOVE(&sc->sc_txbuf, bf, bf_list);
+		splx(s);
+		if (bf == NULL) {
+			DPRINTF(ATH_DEBUG_ANY, ("%s: out of xmit buffers\n",
+				__func__));
+			sc->sc_stats.ast_tx_qstop++;
+			ifp->if_flags |= IFF_OACTIVE;
+			break;
+		}
+		/*
+		 * Poll the management queue for frames; they
+		 * have priority over normal data frames.
+		 */
+		IF_DEQUEUE(&ic->ic_mgtq, m);
+		if (m == NULL) {
+			/*
+			 * No data frames go out unless we're associated.
+			 */
+			if (ic->ic_state != IEEE80211_S_RUN) {
+				DPRINTF(ATH_DEBUG_ANY,
+					("%s: ignore data packet, state %u\n",
+					__func__, ic->ic_state));
+				sc->sc_stats.ast_tx_discard++;
+				s = splnet();
+				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+				splx(s);
+				break;
+			}
+			IF_DEQUEUE(&ifp->if_snd, m);
+			if (m == NULL) {
+				s = splnet();
+				TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+				splx(s);
+				break;
+			}
+			ifp->if_opackets++;
+
+#if NBPFILTER > 0
+			if (ifp->if_bpf)
+				bpf_mtap(ifp->if_bpf, m);
+#endif
+
+			/*
+			 * Encapsulate the packet in prep for transmission.
+			 */
+			m = ieee80211_encap(ifp, m, &ni);
+			if (m == NULL) {
+				DPRINTF(ATH_DEBUG_ANY,
+					("%s: encapsulation failure\n",
+					__func__));
+				sc->sc_stats.ast_tx_encap++;
+				goto bad;
+			}
+			wh = mtod(m, struct ieee80211_frame *);
+		} else {
+			/*
+			 * Hack!  The referenced node pointer is in the
+			 * rcvif field of the packet header.  This is
+			 * placed there by ieee80211_mgmt_output because
+			 * we need to hold the reference with the frame
+			 * and there's no other way (other than packet
+			 * tags which we consider too expensive to use)
+			 * to pass it along.
+			 */
+			ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
+			m->m_pkthdr.rcvif = NULL;
+
+			wh = mtod(m, struct ieee80211_frame *);
+			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
+			    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
+				/* fill time stamp */
+				u_int64_t tsf;
+				u_int32_t *tstamp;
+
+				tsf = ath_hal_gettsf64(ah);
+				/* XXX: adjust 100us delay to xmit */
+				tsf += 100;
+				tstamp = (u_int32_t *)&wh[1];
+				tstamp[0] = htole32(tsf & 0xffffffff);
+				tstamp[1] = htole32(tsf >> 32);
+			}
+			sc->sc_stats.ast_tx_mgmt++;
+		}
+
+		if (ath_tx_start(sc, ni, bf, m)) {
+	bad:
+			s = splnet();
+			TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+			splx(s);
+			ifp->if_oerrors++;
+			if (ni != NULL && ni != ic->ic_bss)
+			          ieee80211_free_node(ic, ni);
+			continue;
+		}
+
+		sc->sc_tx_timer = 5;
+		ifp->if_timer = 1;
+	}
+}
+
+int
+ath_media_change(struct ifnet *ifp)
+{
+	int error;
+
+	error = ieee80211_media_change(ifp);
+	if (error == ENETRESET) {
+		if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
+		    (IFF_RUNNING|IFF_UP))
+			ath_init(ifp);		/* XXX lose error */
+		error = 0;
+	}
+	return error;
+}
+
+void
+ath_watchdog(struct ifnet *ifp)
+{
+	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+
+	ifp->if_timer = 0;
+	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid)
+		return;
+	if (sc->sc_tx_timer) {
+		if (--sc->sc_tx_timer == 0) {
+			if_printf(ifp, "device timeout\n");
+			ath_reset(sc);
+			ifp->if_oerrors++;
+			sc->sc_stats.ast_watchdog++;
+			return;
+		}
+		ifp->if_timer = 1;
+	}
+	if (ic->ic_fixed_rate == -1) {
+		/*
+		 * Run the rate control algorithm if we're not
+		 * locked at a fixed rate.
+		 */
+		if (ic->ic_opmode == IEEE80211_M_STA)
+			ath_rate_ctl(sc, ic->ic_bss);
+		else
+			ieee80211_iterate_nodes(ic, ath_rate_ctl, sc);
+	}
+	ieee80211_watchdog(ifp);
+}
+
+int
+ath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+	struct ath_softc *sc = ifp->if_softc;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifreq *ifr = (struct ifreq *)data;
+   	struct ifaddr *ifa = (struct ifaddr *)data;
+	int error = 0, s;
+
+	s = splnet();
+	switch (cmd) {
+#if 0
+        case SIOCSIFMTU:
+                if (ifr->ifr_mtu > ETHERMTU || ifr->ifr_mtu < ETHERMIN) {
+                        error = EINVAL;
+                } else if (ifp->if_mtu != ifr->ifr_mtu) {
+                        ifp->if_mtu = ifr->ifr_mtu;
+                }
+                break;
+#endif
+        case SIOCSIFADDR:
+                ifp->if_flags |= IFF_UP;
+#ifdef INET
+                if (ifa->ifa_addr->sa_family == AF_INET) {
+                        arp_ifinit(&ic->ic_ac, ifa);
+                }
+#endif  /* INET */
+		/* FALLTHROUGH */
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP) {
+			if (ifp->if_flags & IFF_RUNNING) {
+				/*
+				 * To avoid rescanning another access point,
+				 * do not call ath_init() here.  Instead,
+				 * only reflect promisc mode settings.
+				 */
+				ath_mode_init(sc);
+			} else {
+				/*
+				 * Beware of being called during detach to
+				 * reset promiscuous mode.  In that case we
+				 * will still be marked UP but not RUNNING.
+				 * However trying to re-init the interface
+				 * is the wrong thing to do as we've already
+				 * torn down much of our state.  There's
+				 * probably a better way to deal with this.
+				 */
+				if (!sc->sc_invalid)
+					ath_init(ifp);	/* XXX lose error */
+			}
+		} else
+			ath_stop(ifp);
+		break;
+	case SIOCADDMULTI:
+	case SIOCDELMULTI:
+#ifdef __FreeBSD__
+		/*
+		 * The upper layer has already installed/removed
+		 * the multicast address(es), just recalculate the
+		 * multicast filter for the card.
+		 */
+		if (ifp->if_flags & IFF_RUNNING)
+			ath_mode_init(sc);
+#endif
+		error = (cmd == SIOCADDMULTI) ?
+		    ether_addmulti(ifr, &sc->sc_ic.ic_ac) :
+		    ether_delmulti(ifr, &sc->sc_ic.ic_ac);
+		if (error == ENETRESET) {
+			if (ifp->if_flags & IFF_RUNNING)
+				ath_mode_init(sc);
+			error = 0;
+		}
+		break;
+	case SIOCGATHSTATS:
+		error = copyout(&sc->sc_stats,
+				ifr->ifr_data, sizeof (sc->sc_stats));
+		break;
+	case SIOCGATHDIAG: {
+#if 0	/* XXX punt */
+		struct ath_diag *ad = (struct ath_diag *)data;
+		struct ath_hal *ah = sc->sc_ah;
+		void *data;
+		u_int size;
+
+		if (ath_hal_getdiagstate(ah, ad->ad_id, &data, &size)) {
+			if (size < ad->ad_size)
+				ad->ad_size = size;
+			if (data)
+				error = copyout(data, ad->ad_data, ad->ad_size);
+		} else
+			error = EINVAL;
+#else
+		error = EINVAL;
+#endif
+		break;
+	}
+	default:
+		error = ieee80211_ioctl(ifp, cmd, data);
+		if (error == ENETRESET) {
+			if ((ifp->if_flags & (IFF_RUNNING|IFF_UP)) ==
+			    (IFF_RUNNING|IFF_UP))
+				ath_init(ifp);		/* XXX lose error */
+			error = 0;
+		}
+		break;
+	}
+	splx(s);
+	return error;
+}
+
+/*
+ * Fill the hardware key cache with key entries.
+ */
+void
+ath_initkeytable(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	int i;
+
+	/* XXX maybe should reset all keys when !WEPON */
+	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
+		struct ieee80211_wepkey *k = &ic->ic_nw_keys[i];
+		if (k->wk_len == 0)
+			ath_hal_keyreset(ah, i);
+		else {
+			HAL_KEYVAL hk;
+
+			memset(&hk, 0, sizeof(hk));
+			hk.wk_len = k->wk_len;
+			memcpy(hk.wk_key, k->wk_key, k->wk_len);
+			/* XXX return value */
+			ath_hal_keyset(ah, i, &hk);
+		}
+	}
+}
+
+void
+ath_mcastfilter_accum(caddr_t dl, u_int32_t (*mfilt)[2])
+{
+	u_int32_t val;
+	u_int8_t pos;
+
+	val = LE_READ_4(dl + 0);
+	pos = (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
+	val = LE_READ_4(dl + 3);
+	pos ^= (val >> 18) ^ (val >> 12) ^ (val >> 6) ^ val;
+	pos &= 0x3f;
+	(*mfilt)[pos / 32] |= (1 << (pos % 32));
+}
+
+void
+ath_mcastfilter_compute(struct ath_softc *sc, u_int32_t (*mfilt)[2])
+{
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	struct ether_multi *enm;
+	struct ether_multistep estep;
+
+	ETHER_FIRST_MULTI(estep, &sc->sc_ic.ic_ac, enm);
+	while (enm != NULL) {   
+		/* XXX Punt on ranges. */
+		if (!IEEE80211_ADDR_EQ(enm->enm_addrlo, enm->enm_addrhi)) {
+			(*mfilt)[0] = (*mfilt)[1] = ~((u_int32_t)0);
+			ifp->if_flags |= IFF_ALLMULTI;
+			return;
+		}
+		ath_mcastfilter_accum(enm->enm_addrlo, mfilt);
+		ETHER_NEXT_MULTI(estep, enm);
+	}
+	ifp->if_flags &= ~IFF_ALLMULTI;
+}
+
+/*
+ * Calculate the receive filter according to the
+ * operating mode and state:
+ *
+ * o always accept unicast, broadcast, and multicast traffic
+ * o maintain current state of phy error reception
+ * o probe request frames are accepted only when operating in
+ *   hostap, adhoc, or monitor modes
+ * o enable promiscuous mode according to the interface state
+ * o accept beacons:
+ *   - when operating in adhoc mode so the 802.11 layer creates
+ *     node table entries for peers,
+ *   - when operating in station mode for collecting rssi data when
+ *     the station is otherwise quiet, or
+ *   - when scanning
+ */
+u_int32_t
+ath_calcrxfilter(struct ath_softc *sc)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ifnet *ifp = &ic->ic_if;
+	u_int32_t rfilt;
+
+	rfilt = (ath_hal_getrxfilter(ah) & HAL_RX_FILTER_PHYERR)
+	      | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
+	if (ic->ic_opmode != IEEE80211_M_STA)
+		rfilt |= HAL_RX_FILTER_PROBEREQ;
+	if (ic->ic_opmode != IEEE80211_M_AHDEMO)
+		rfilt |= HAL_RX_FILTER_BEACON;
+	if (ifp->if_flags & IFF_PROMISC)
+		rfilt |= HAL_RX_FILTER_PROM;
+	return rfilt;
+}
+
+void
+ath_mode_init(struct ath_softc *sc)
+{
+#ifdef __FreeBSD__
+	struct ieee80211com *ic = &sc->sc_ic;
+#endif
+	struct ath_hal *ah = sc->sc_ah;
+	u_int32_t rfilt, mfilt[2];
+
+	/* configure rx filter */
+	rfilt = ath_calcrxfilter(sc);
+	ath_hal_setrxfilter(ah, rfilt);
+
+	/* configure operational mode */
+	ath_hal_setopmode(ah);
+
+	/* calculate and install multicast filter */
+#ifdef __FreeBSD__
+	if ((ic->ic_if.if_flags & IFF_ALLMULTI) == 0) {
+		mfilt[0] = mfilt[1] = 0;
+		ath_mcastfilter_compute(sc, &mfilt);
+	} else {
+		mfilt[0] = mfilt[1] = ~0;
+	}
+#endif
+	mfilt[0] = mfilt[1] = 0;
+	ath_mcastfilter_compute(sc, &mfilt);
+	ath_hal_setmcastfilter(ah, mfilt[0], mfilt[1]);
+	DPRINTF(ATH_DEBUG_MODE, ("%s: RX filter 0x%x, MC filter %08x:%08x\n",
+		__func__, rfilt, mfilt[0], mfilt[1]));
+}
+
+#ifdef __FreeBSD__
+void
+ath_mbuf_load_cb(void *arg, bus_dma_segment_t *seg, int nseg, bus_size_t mapsize, int error)
+{
+	struct ath_buf *bf = arg;
+
+	KASSERT(nseg <= ATH_MAX_SCATTER,
+		("ath_mbuf_load_cb: too many DMA segments %u", nseg));
+	bf->bf_mapsize = mapsize;
+	bf->bf_nseg = nseg;
+	bcopy(seg, bf->bf_segs, nseg * sizeof (seg[0]));
+}
+#endif /* __FreeBSD__ */
+
+struct mbuf *
+ath_getmbuf(int flags, int type, u_int pktlen)
+{
+	struct mbuf *m;
+
+	KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
+#ifdef __FreeBSD__
+	if (pktlen <= MHLEN)
+		MGETHDR(m, flags, type);
+	else
+		m = m_getcl(flags, type, M_PKTHDR);
+#else
+	MGETHDR(m, flags, type);
+	if (m != NULL && pktlen > MHLEN)
+		MCLGET(m, flags);
+#endif
+	return m;
+}
+
+int
+ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211_frame *wh;
+	struct ath_buf *bf;
+	struct ath_desc *ds;
+	struct mbuf *m;
+	int error, pktlen;
+	u_int8_t *frm, rate;
+	u_int16_t capinfo;
+	struct ieee80211_rateset *rs;
+	const HAL_RATE_TABLE *rt;
+	u_int flags;
+
+	bf = sc->sc_bcbuf;
+	if (bf->bf_m != NULL) {
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		m_freem(bf->bf_m);
+		bf->bf_m = NULL;
+		bf->bf_node = NULL;
+	}
+	/*
+	 * NB: the beacon data buffer must be 32-bit aligned;
+	 * we assume the mbuf routines will return us something
+	 * with this alignment (perhaps should assert).
+	 */
+	rs = &ni->ni_rates;
+	pktlen = sizeof (struct ieee80211_frame)
+	       + 8 + 2 + 2 + 2+ni->ni_esslen + 2+rs->rs_nrates + 3 + 6;
+	if (rs->rs_nrates > IEEE80211_RATE_SIZE)
+		pktlen += 2;
+	m = ath_getmbuf(M_DONTWAIT, MT_DATA, pktlen);
+	if (m == NULL) {
+		DPRINTF(ATH_DEBUG_BEACON,
+			("%s: cannot get mbuf/cluster; size %u\n",
+			__func__, pktlen));
+		sc->sc_stats.ast_be_nombuf++;
+		return ENOMEM;
+	}
+
+	wh = mtod(m, struct ieee80211_frame *);
+	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
+	    IEEE80211_FC0_SUBTYPE_BEACON;
+	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
+	*(u_int16_t *)wh->i_dur = 0;
+	memcpy(wh->i_addr1, sc->sc_broadcast_addr, IEEE80211_ADDR_LEN);
+	memcpy(wh->i_addr2, ic->ic_myaddr, IEEE80211_ADDR_LEN);
+	memcpy(wh->i_addr3, ni->ni_bssid, IEEE80211_ADDR_LEN);
+	*(u_int16_t *)wh->i_seq = 0;
+
+	/*
+	 * beacon frame format
+	 *	[8] time stamp
+	 *	[2] beacon interval
+	 *	[2] cabability information
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] parameter set (IBSS)
+	 *	[tlv] extended supported rates
+	 */
+	frm = (u_int8_t *)&wh[1];
+	memset(frm, 0, 8);	/* timestamp is set by hardware */
+	frm += 8;
+	*(u_int16_t *)frm = htole16(ni->ni_intval);
+	frm += 2;
+	if (ic->ic_opmode == IEEE80211_M_IBSS)
+		capinfo = IEEE80211_CAPINFO_IBSS;
+	else
+		capinfo = IEEE80211_CAPINFO_ESS;
+	if (ic->ic_flags & IEEE80211_F_WEPON)
+		capinfo |= IEEE80211_CAPINFO_PRIVACY;
+	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
+	    IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
+		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
+	if (ic->ic_flags & IEEE80211_F_SHSLOT)
+		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
+	*(u_int16_t *)frm = htole16(capinfo);
+	frm += 2;
+	*frm++ = IEEE80211_ELEMID_SSID;
+	*frm++ = ni->ni_esslen;
+	memcpy(frm, ni->ni_essid, ni->ni_esslen);
+	frm += ni->ni_esslen;
+	frm = ieee80211_add_rates(frm, rs);
+	*frm++ = IEEE80211_ELEMID_DSPARMS;
+	*frm++ = 1;
+	*frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
+	if (ic->ic_opmode == IEEE80211_M_IBSS) {
+		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
+		*frm++ = 2;
+		*frm++ = 0; *frm++ = 0;		/* TODO: ATIM window */
+	} else {
+		/* TODO: TIM */
+		*frm++ = IEEE80211_ELEMID_TIM;
+		*frm++ = 4;	/* length */
+		*frm++ = 0;	/* DTIM count */ 
+		*frm++ = 1;	/* DTIM period */
+		*frm++ = 0;	/* bitmap control */
+		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
+	}
+	frm = ieee80211_add_xrates(frm, rs);
+	m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
+	KASSERT(m->m_pkthdr.len <= pktlen,
+		("beacon bigger than expected, len %u calculated %u",
+		m->m_pkthdr.len, pktlen));
+
+	DPRINTF(ATH_DEBUG_BEACON, ("%s: m %p len %u\n", __func__, m, m->m_len));
+	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
+	    BUS_DMA_NOWAIT);
+	if (error != 0) {
+		m_freem(m);
+		return error;
+	}
+	KASSERT(bf->bf_nseg == 1,
+		("%s: multi-segment packet; nseg %u", __func__, bf->bf_nseg));
+	bf->bf_m = m;
+
+	/* setup descriptors */
+	ds = bf->bf_desc;
+
+	if (ic->ic_opmode == IEEE80211_M_IBSS)
+		ds->ds_link = bf->bf_daddr;	/* link to self */
+	else
+		ds->ds_link = 0;
+	ds->ds_data = bf->bf_segs[0].ds_addr;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: segaddr %p seglen %u\n", __func__,
+	    (caddr_t)bf->bf_segs[0].ds_addr, (u_int)bf->bf_segs[0].ds_len));
+
+	/*
+	 * Calculate rate code.
+	 * XXX everything at min xmit rate
+	 */
+	rt = sc->sc_currates;
+	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
+	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
+		rate = rt->info[0].rateCode | rt->info[0].shortPreamble;
+	else
+		rate = rt->info[0].rateCode;
+
+	flags = HAL_TXDESC_NOACK;
+	if (ic->ic_opmode == IEEE80211_M_IBSS)
+		flags |= HAL_TXDESC_VEOL;
+
+	if (!ath_hal_setuptxdesc(ah, ds
+		, m->m_pkthdr.len + IEEE80211_CRC_LEN	/* packet length */
+		, sizeof(struct ieee80211_frame)	/* header length */
+		, HAL_PKT_TYPE_BEACON		/* Atheros packet type */
+		, 0x20				/* txpower XXX */
+		, rate, 1			/* series 0 rate/tries */
+		, HAL_TXKEYIX_INVALID		/* no encryption */
+		, 0				/* antenna mode */
+		, flags				/* no ack for beacons */
+		, 0				/* rts/cts rate */
+		, 0				/* rts/cts duration */
+	)) {
+		printf("%s: ath_hal_setuptxdesc failed\n", __func__);
+		return -1;
+	}
+	/* NB: beacon's BufLen must be a multiple of 4 bytes */
+	/* XXX verify mbuf data area covers this roundup */
+	if (!ath_hal_filltxdesc(ah, ds
+		, roundup(bf->bf_segs[0].ds_len, 4)	/* buffer length */
+		, AH_TRUE				/* first segment */
+		, AH_TRUE				/* last segment */
+	)) {
+		printf("%s: ath_hal_filltxdesc failed\n", __func__);
+		return -1;
+	}
+
+	/* XXX it is not appropriate to bus_dmamap_sync? -dcy */
+
+	return 0;
+}
+
+void
+ath_beacon_proc(struct ath_softc *sc, int pending)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_buf *bf = sc->sc_bcbuf;
+	struct ath_hal *ah = sc->sc_ah;
+
+	DPRINTF(ATH_DEBUG_BEACON_PROC, ("%s: pending %u\n", __func__, pending));
+	if (ic->ic_opmode == IEEE80211_M_STA ||
+	    bf == NULL || bf->bf_m == NULL) {
+		DPRINTF(ATH_DEBUG_ANY, ("%s: ic_flags=%x bf=%p bf_m=%p\n",
+			__func__, ic->ic_flags, bf, bf ? bf->bf_m : NULL));
+		return;
+	}
+	/* TODO: update beacon to reflect PS poll state */
+	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
+		DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
+			__func__, sc->sc_bhalq));
+		/* NB: the HAL still stops DMA, so proceed */
+	}
+	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
+	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);
+
+	ath_hal_puttxbuf(ah, sc->sc_bhalq, bf->bf_daddr);
+	ath_hal_txstart(ah, sc->sc_bhalq);
+	DPRINTF(ATH_DEBUG_BEACON_PROC,
+		("%s: TXDP%u = %p (%p)\n", __func__,
+		sc->sc_bhalq, (caddr_t)bf->bf_daddr, bf->bf_desc));
+}
+
+void
+ath_beacon_free(struct ath_softc *sc)
+{
+	struct ath_buf *bf = sc->sc_bcbuf;
+
+	if (bf->bf_m != NULL) {
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		m_freem(bf->bf_m);
+		bf->bf_m = NULL;
+		bf->bf_node = NULL;
+	}
+}
+
+/*
+ * Configure the beacon and sleep timers.
+ *
+ * When operating as an AP this resets the TSF and sets
+ * up the hardware to notify us when we need to issue beacons.
+ *
+ * When operating in station mode this sets up the beacon
+ * timers according to the timestamp of the last received
+ * beacon and the current TSF, configures PCF and DTIM
+ * handling, programs the sleep registers so the hardware
+ * will wakeup in time to receive beacons, and configures
+ * the beacon miss handling so we'll receive a BMISS
+ * interrupt when we stop seeing beacons from the AP
+ * we've associated with.
+ */
+void
+ath_beacon_config(struct ath_softc *sc)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni = ic->ic_bss;
+	u_int32_t nexttbtt, intval;
+
+	nexttbtt = (LE_READ_4(ni->ni_tstamp + 4) << 22) |
+	    (LE_READ_4(ni->ni_tstamp) >> 10);
+	DPRINTF(ATH_DEBUG_BEACON, ("%s: nexttbtt=%u\n", __func__, nexttbtt));
+	nexttbtt += ni->ni_intval;
+	intval = ni->ni_intval & HAL_BEACON_PERIOD;
+	if (ic->ic_opmode == IEEE80211_M_STA) {
+		HAL_BEACON_STATE bs;
+		u_int32_t bmisstime;
+
+		/* NB: no PCF support right now */
+		memset(&bs, 0, sizeof(bs));
+		/*
+		 * Reset our tsf so the hardware will update the
+		 * tsf register to reflect timestamps found in
+		 * received beacons.
+		 */
+		bs.bs_intval = intval | HAL_BEACON_RESET_TSF;
+		bs.bs_nexttbtt = nexttbtt;
+		bs.bs_dtimperiod = bs.bs_intval;
+		bs.bs_nextdtim = nexttbtt;
+		/*
+		 * Calculate the number of consecutive beacons to miss
+		 * before taking a BMISS interrupt.  The configuration
+		 * is specified in ms, so we need to convert that to
+		 * TU's and then calculate based on the beacon interval.
+		 * Note that we clamp the result to at most 10 beacons.
+		 */
+		bmisstime = (ic->ic_bmisstimeout * 1000) / 1024;
+		bs.bs_bmissthreshold = howmany(bmisstime,ni->ni_intval);
+		if (bs.bs_bmissthreshold > 10)
+			bs.bs_bmissthreshold = 10;
+		else if (bs.bs_bmissthreshold <= 0)
+			bs.bs_bmissthreshold = 1;
+
+		/*
+		 * Calculate sleep duration.  The configuration is
+		 * given in ms.  We insure a multiple of the beacon
+		 * period is used.  Also, if the sleep duration is
+		 * greater than the DTIM period then it makes senses
+		 * to make it a multiple of that.
+		 *
+		 * XXX fixed at 100ms
+		 */
+		bs.bs_sleepduration =
+			roundup((100 * 1000) / 1024, bs.bs_intval);
+		if (bs.bs_sleepduration > bs.bs_dtimperiod)
+			bs.bs_sleepduration = roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
+
+		DPRINTF(ATH_DEBUG_BEACON, 
+			("%s: intval %u nexttbtt %u dtim %u nextdtim %u bmiss %u sleep %u\n"
+			, __func__
+			, bs.bs_intval
+			, bs.bs_nexttbtt
+			, bs.bs_dtimperiod
+			, bs.bs_nextdtim
+			, bs.bs_bmissthreshold
+			, bs.bs_sleepduration
+		));
+		ath_hal_intrset(ah, 0);
+		ath_hal_beacontimers(ah, &bs, 0/*XXX*/, 0, 0);
+		sc->sc_imask |= HAL_INT_BMISS;
+		ath_hal_intrset(ah, sc->sc_imask);
+	} else {
+		ath_hal_intrset(ah, 0);
+		sc->sc_imask |= HAL_INT_SWBA;	/* beacon prepare */
+		intval |= HAL_BEACON_ENA;
+		switch (ic->ic_opmode) {
+		/* No beacons in monitor, ad hoc-demo modes. */
+		case IEEE80211_M_MONITOR:
+		case IEEE80211_M_AHDEMO:
+			intval &= ~HAL_BEACON_ENA;
+			/*FALLTHROUGH*/
+		/* In IBSS mode, I am uncertain how SWBA interrupts
+		 * work, so I just turn them off and use a self-linked
+		 * descriptor.
+		 */
+		case IEEE80211_M_IBSS:
+			sc->sc_imask &= ~HAL_INT_SWBA;
+			nexttbtt = ni->ni_intval;
+			/*FALLTHROUGH*/
+		case IEEE80211_M_HOSTAP:
+		default:
+			if (nexttbtt == ni->ni_intval)
+				intval |= HAL_BEACON_RESET_TSF;
+			break;
+		}
+		DPRINTF(ATH_DEBUG_BEACON, ("%s: intval %u nexttbtt %u\n",
+			__func__, ni->ni_intval, nexttbtt));
+		ath_hal_beaconinit(ah, nexttbtt, intval);
+		ath_hal_intrset(ah, sc->sc_imask);
+		if (ic->ic_opmode == IEEE80211_M_IBSS)
+			ath_beacon_proc(sc, 0);
+	}
+}
+
+#ifdef __FreeBSD__
+void
+ath_load_cb(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
+{
+	bus_addr_t *paddr = (bus_addr_t*) arg;
+	*paddr = segs->ds_addr;
+}
+#endif
+
+#ifdef __FreeBSD__
+int
+ath_desc_alloc(struct ath_softc *sc)
+{
+	int i, bsize, error;
+	struct ath_desc *ds;
+	struct ath_buf *bf;
+
+	/* allocate descriptors */
+	sc->sc_desc_len = sizeof(struct ath_desc) *
+				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
+	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &sc->sc_ddmamap);
+	if (error != 0)
+		return error;
+
+	error = bus_dmamem_alloc(sc->sc_dmat, (void**) &sc->sc_desc,
+				 BUS_DMA_NOWAIT, &sc->sc_ddmamap);
+
+	if (error != 0)
+		goto fail0;
+
+	error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap,
+				sc->sc_desc, sc->sc_desc_len,
+				ath_load_cb, &sc->sc_desc_paddr,
+				BUS_DMA_NOWAIT);
+	if (error != 0)
+		goto fail1;
+
+	ds = sc->sc_desc;
+	DPRINTF(ATH_DEBUG_ANY, ("%s: DMA map: %p (%lu) -> %p (%lu)\n",
+	    __func__, ds, (u_long) sc->sc_desc_len, (caddr_t) sc->sc_desc_paddr,
+	    /*XXX*/ (u_long) sc->sc_desc_len));
+
+	/* allocate buffers */
+	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
+	bf = malloc(bsize, M_DEVBUF, M_NOWAIT);
+	if (bf == NULL) {
+		printf("%s: unable to allocate Tx/Rx buffers\n",
+		    sc->sc_dev.dv_xname);
+		error = -1;
+		goto fail2;
+	}
+	bzero(bf, bsize);
+	sc->sc_bufptr = bf;
+
+	TAILQ_INIT(&sc->sc_rxbuf);
+	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
+		bf->bf_desc = ds;
+		bf->bf_daddr = sc->sc_desc_paddr +
+		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
+		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
+					  &bf->bf_dmamap);
+		if (error != 0)
+			break;
+		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
+	}
+
+	TAILQ_INIT(&sc->sc_txbuf);
+	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
+		bf->bf_desc = ds;
+		bf->bf_daddr = sc->sc_desc_paddr +
+		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
+		error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT,
+					  &bf->bf_dmamap);
+		if (error != 0)
+			break;
+		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+	}
+	TAILQ_INIT(&sc->sc_txq);
+
+	/* beacon buffer */
+	bf->bf_desc = ds;
+	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
+	error = bus_dmamap_create(sc->sc_dmat, BUS_DMA_NOWAIT, &bf->bf_dmamap);
+	if (error != 0)
+		return error;
+	sc->sc_bcbuf = bf;
+	return 0;
+
+fail2:
+	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
+fail1:
+	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
+fail0:
+	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
+	sc->sc_ddmamap = NULL;
+	return error;
+}
+#else
+int
+ath_desc_alloc(struct ath_softc *sc)
+{
+	int i, bsize, error = -1;
+	struct ath_desc *ds;
+	struct ath_buf *bf;
+
+	/* allocate descriptors */
+	sc->sc_desc_len = sizeof(struct ath_desc) *
+				(ATH_TXBUF * ATH_TXDESC + ATH_RXBUF + 1);
+	if ((error = bus_dmamem_alloc(sc->sc_dmat, sc->sc_desc_len, PAGE_SIZE,
+	    0, &sc->sc_dseg, 1, &sc->sc_dnseg, 0)) != 0) {
+		printf("%s: unable to allocate control data, error = %d\n",
+		    sc->sc_dev.dv_xname, error);
+		goto fail0;
+	}
+
+	if ((error = bus_dmamem_map(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg,
+	    sc->sc_desc_len, (caddr_t *)&sc->sc_desc, BUS_DMA_COHERENT)) != 0) {
+		printf("%s: unable to map control data, error = %d\n",
+		    sc->sc_dev.dv_xname, error);
+		goto fail1;
+	}
+
+	if ((error = bus_dmamap_create(sc->sc_dmat, sc->sc_desc_len, 1,
+	    sc->sc_desc_len, 0, 0, &sc->sc_ddmamap)) != 0) {
+		printf("%s: unable to create control data DMA map, "
+		    "error = %d\n", sc->sc_dev.dv_xname, error);
+		goto fail2;
+	}
+
+	if ((error = bus_dmamap_load(sc->sc_dmat, sc->sc_ddmamap, sc->sc_desc,
+	    sc->sc_desc_len, NULL, 0)) != 0) {
+		printf("%s: unable to load control data DMA map, error = %d\n",
+		    sc->sc_dev.dv_xname, error);
+		goto fail3;
+	}
+
+	ds = sc->sc_desc;
+	sc->sc_desc_paddr = sc->sc_ddmamap->dm_segs[0].ds_addr;
+
+	DPRINTF(ATH_DEBUG_XMIT_DESC|ATH_DEBUG_RECV_DESC,
+	    ("ath_desc_alloc: DMA map: %p (%lu) -> %p (%lu)\n",
+	    ds, (u_long)sc->sc_desc_len,
+	    (caddr_t) sc->sc_desc_paddr, /*XXX*/ (u_long) sc->sc_desc_len));
+
+	/* allocate buffers */
+	bsize = sizeof(struct ath_buf) * (ATH_TXBUF + ATH_RXBUF + 1);
+	bf = malloc(bsize, M_DEVBUF, M_NOWAIT);
+	if (bf == NULL) {
+		printf("%s: unable to allocate Tx/Rx buffers\n",
+		    sc->sc_dev.dv_xname);
+		error = ENOMEM;
+		goto fail3;
+	}
+	bzero(bf, bsize);
+	sc->sc_bufptr = bf;
+
+	TAILQ_INIT(&sc->sc_rxbuf);
+	for (i = 0; i < ATH_RXBUF; i++, bf++, ds++) {
+		bf->bf_desc = ds;
+		bf->bf_daddr = sc->sc_desc_paddr +
+		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
+		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1,
+		    MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
+			printf("%s: unable to create Rx dmamap, error = %d\n",
+			    sc->sc_dev.dv_xname, error);
+			goto fail4;
+		}
+		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
+	}
+
+	TAILQ_INIT(&sc->sc_txbuf);
+	for (i = 0; i < ATH_TXBUF; i++, bf++, ds += ATH_TXDESC) {
+		bf->bf_desc = ds;
+		bf->bf_daddr = sc->sc_desc_paddr +
+		    ((caddr_t)ds - (caddr_t)sc->sc_desc);
+		if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
+		    ATH_TXDESC, MCLBYTES, 0, 0, &bf->bf_dmamap)) != 0) {
+			printf("%s: unable to create Tx dmamap, error = %d\n",
+			    sc->sc_dev.dv_xname, error);
+			goto fail5;
+		}
+		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+	}
+	TAILQ_INIT(&sc->sc_txq);
+
+	/* beacon buffer */
+	bf->bf_desc = ds;
+	bf->bf_daddr = sc->sc_desc_paddr + ((caddr_t)ds - (caddr_t)sc->sc_desc);
+	if ((error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES, 0, 0,
+	    &bf->bf_dmamap)) != 0) {
+		printf("%s: unable to create beacon dmamap, error = %d\n",
+		    sc->sc_dev.dv_xname, error);
+		goto fail5;
+	}
+	sc->sc_bcbuf = bf;
+	return 0;
+
+fail5:
+	for (i = ATH_RXBUF; i < ATH_RXBUF + ATH_TXBUF; i++) {
+		if (sc->sc_bufptr[i].bf_dmamap == NULL)
+			continue;
+		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
+	}
+fail4:
+	for (i = 0; i < ATH_RXBUF; i++) {
+		if (sc->sc_bufptr[i].bf_dmamap == NULL)
+			continue;
+		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bufptr[i].bf_dmamap);
+	}
+fail3:
+	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
+fail2:
+	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
+	sc->sc_ddmamap = NULL;
+fail1:
+	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)sc->sc_desc, sc->sc_desc_len);
+fail0:
+	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
+	return error;
+}
+#endif
+
+void
+ath_desc_free(struct ath_softc *sc)
+{
+	struct ath_buf *bf;
+
+#ifdef __FreeBSD__
+	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
+	bus_dmamem_free(sc->sc_dmat, sc->sc_desc, sc->sc_ddmamap);
+	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
+#else
+	bus_dmamap_unload(sc->sc_dmat, sc->sc_ddmamap);
+	bus_dmamap_destroy(sc->sc_dmat, sc->sc_ddmamap);
+	bus_dmamem_free(sc->sc_dmat, &sc->sc_dseg, sc->sc_dnseg);
+#endif
+
+	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
+		m_freem(bf->bf_m);
+	}
+	TAILQ_FOREACH(bf, &sc->sc_txbuf, bf_list)
+		bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
+	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+		if (bf->bf_m) {
+			bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+			bus_dmamap_destroy(sc->sc_dmat, bf->bf_dmamap);
+			m_freem(bf->bf_m);
+			bf->bf_m = NULL;
+		}
+	}
+	if (sc->sc_bcbuf != NULL) {
+		bus_dmamap_unload(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
+		bus_dmamap_destroy(sc->sc_dmat, sc->sc_bcbuf->bf_dmamap);
+		sc->sc_bcbuf = NULL;
+	}
+
+	TAILQ_INIT(&sc->sc_rxbuf);
+	TAILQ_INIT(&sc->sc_txbuf);
+	TAILQ_INIT(&sc->sc_txq);
+	free(sc->sc_bufptr, M_DEVBUF);
+	sc->sc_bufptr = NULL;
+}
+
+struct ieee80211_node *
+ath_node_alloc(struct ieee80211com *ic)
+{
+	struct ath_node *an =
+		malloc(sizeof(struct ath_node), M_DEVBUF, M_NOWAIT);
+	if (an) {
+		int i;
+		bzero(an, sizeof(struct ath_node));
+		for (i = 0; i < ATH_RHIST_SIZE; i++)
+			an->an_rx_hist[i].arh_ticks = ATH_RHIST_NOTIME;
+		an->an_rx_hist_next = ATH_RHIST_SIZE-1;
+		return &an->an_node;
+	} else
+		return NULL;
+}
+
+void
+ath_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
+{
+	struct ath_softc *sc = ic->ic_if.if_softc;
+	struct ath_buf *bf;
+
+	TAILQ_FOREACH(bf, &sc->sc_txq, bf_list) {
+		if (bf->bf_node == ni)
+			bf->bf_node = NULL;
+	}
+	(*sc->sc_node_free)(ic, ni);
+}
+
+void
+ath_node_copy(struct ieee80211com *ic,
+	struct ieee80211_node *dst, const struct ieee80211_node *src)
+{
+        struct ath_softc *sc = ic->ic_if.if_softc;
+
+	memcpy(&dst[1], &src[1],
+		sizeof(struct ath_node) - sizeof(struct ieee80211_node));
+	(*sc->sc_node_copy)(ic, dst, src);
+}
+
+u_int8_t
+ath_node_getrssi(struct ieee80211com *ic, struct ieee80211_node *ni)
+{
+	struct ath_node *an = ATH_NODE(ni);
+	int i, now, nsamples, rssi;
+
+	/*
+	 * Calculate the average over the last second of sampled data.
+	 */
+	now = ATH_TICKS();
+	nsamples = 0;
+	rssi = 0;
+	i = an->an_rx_hist_next;
+	do {
+		struct ath_recv_hist *rh = &an->an_rx_hist[i];
+		if (rh->arh_ticks == ATH_RHIST_NOTIME)
+			goto done;
+		if (now - rh->arh_ticks > hz)
+			goto done;
+		rssi += rh->arh_rssi;
+		nsamples++;
+		if (i == 0)
+			i = ATH_RHIST_SIZE-1;
+		else
+			i--;
+	} while (i != an->an_rx_hist_next);
+done:
+	/*
+	 * Return either the average or the last known
+	 * value if there is no recent data.
+	 */
+	return (nsamples ? rssi / nsamples : an->an_rx_hist[i].arh_rssi);
+}
+
+int
+ath_rxbuf_init(struct ath_softc *sc, struct ath_buf *bf)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	int error;
+	struct mbuf *m;
+	struct ath_desc *ds;
+
+	m = bf->bf_m;
+	if (m == NULL) {
+		/*
+		 * NB: by assigning a page to the rx dma buffer we
+		 * implicitly satisfy the Atheros requirement that
+		 * this buffer be cache-line-aligned and sized to be
+		 * multiple of the cache line size.  Not doing this
+		 * causes weird stuff to happen (for the 5210 at least).
+		 */
+		m = ath_getmbuf(M_DONTWAIT, MT_DATA, MCLBYTES);
+		if (m == NULL) {
+			DPRINTF(ATH_DEBUG_ANY,
+				("%s: no mbuf/cluster\n", __func__));
+			sc->sc_stats.ast_rx_nombuf++;
+			return ENOMEM;
+		}
+		bf->bf_m = m;
+		m->m_pkthdr.len = m->m_len = m->m_ext.ext_size;
+
+		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m,
+		    BUS_DMA_NOWAIT);	
+		if (error != 0) {
+			DPRINTF(ATH_DEBUG_ANY,
+				("%s: ath_bus_dmamap_load_mbuf failed;"
+				" error %d\n", __func__, error));
+			sc->sc_stats.ast_rx_busdma++;
+			return error;
+		}
+		KASSERT(bf->bf_nseg == 1,
+			("ath_rxbuf_init: multi-segment packet; nseg %u",
+			bf->bf_nseg));
+	}
+	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
+	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREREAD);
+
+	/*
+	 * Setup descriptors.  For receive we always terminate
+	 * the descriptor list with a self-linked entry so we'll
+	 * not get overrun under high load (as can happen with a
+	 * 5212 when ANI processing enables PHY errors).
+	 *
+	 * To insure the last descriptor is self-linked we create
+	 * each descriptor as self-linked and add it to the end.  As
+	 * each additional descriptor is added the previous self-linked
+	 * entry is ``fixed'' naturally.  This should be safe even
+	 * if DMA is happening.  When processing RX interrupts we
+	 * never remove/process the last, self-linked, entry on the
+	 * descriptor list.  This insures the hardware always has
+	 * someplace to write a new frame.
+	 */
+	ds = bf->bf_desc;
+	ds->ds_link = bf->bf_daddr;	/* link to self */
+	ds->ds_data = bf->bf_segs[0].ds_addr;
+	ath_hal_setuprxdesc(ah, ds
+		, m->m_len		/* buffer size */
+		, 0
+	);
+
+	if (sc->sc_rxlink != NULL)
+		*sc->sc_rxlink = bf->bf_daddr;
+	sc->sc_rxlink = &ds->ds_link;
+	return 0;
+}
+
+void
+ath_rx_proc(void *arg, int npending)
+{
+#define	PA2DESC(_sc, _pa) \
+	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
+		((_pa) - (_sc)->sc_desc_paddr)))
+	struct ath_softc *sc = arg;
+	struct ath_buf *bf;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ath_desc *ds;
+	struct mbuf *m;
+	struct ieee80211_frame *wh, whbuf;
+	struct ieee80211_node *ni;
+	struct ath_node *an;
+	struct ath_recv_hist *rh;
+	int len;
+	u_int phyerr;
+	HAL_STATUS status;
+
+	DPRINTF(ATH_DEBUG_RX_PROC, ("%s: pending %u\n", __func__, npending));
+	do {
+		bf = TAILQ_FIRST(&sc->sc_rxbuf);
+		if (bf == NULL) {		/* NB: shouldn't happen */
+			if_printf(ifp, "ath_rx_proc: no buffer!\n");
+			break;
+		}
+		ds = bf->bf_desc;
+		if (ds->ds_link == bf->bf_daddr) {
+			/* NB: never process the self-linked entry at the end */
+			break;
+		}
+		m = bf->bf_m;
+		if (m == NULL) {		/* NB: shouldn't happen */
+			if_printf(ifp, "ath_rx_proc: no mbuf!\n");
+			continue;
+		}
+		/* XXX sync descriptor memory */
+		/*
+		 * Must provide the virtual address of the current
+		 * descriptor, the physical address, and the virtual
+		 * address of the next descriptor in the h/w chain.
+		 * This allows the HAL to look ahead to see if the
+		 * hardware is done with a descriptor by checking the
+		 * done bit in the following descriptor and the address
+		 * of the current descriptor the DMA engine is working
+		 * on.  All this is necessary because of our use of
+		 * a self-linked list to avoid rx overruns.
+		 */
+		status = ath_hal_rxprocdesc(ah, ds,
+				bf->bf_daddr, PA2DESC(sc, ds->ds_link));
+#ifdef AR_DEBUG
+		if (ath_debug & ATH_DEBUG_RECV_DESC)
+			ath_printrxbuf(bf, status == HAL_OK); 
+#endif
+		if (status == HAL_EINPROGRESS)
+			break;
+		TAILQ_REMOVE(&sc->sc_rxbuf, bf, bf_list);
+
+		if (ds->ds_rxstat.rs_more) {
+			/*
+			 * Frame spans multiple descriptors; this
+			 * cannot happen yet as we don't support
+			 * jumbograms.  If not in monitor mode,
+			 * discard the frame.
+			 */
+
+			/* enable this if you want to see error frames in Monitor mode */
+#ifdef ERROR_FRAMES
+			if (ic->ic_opmode != IEEE80211_M_MONITOR) {
+				/* XXX statistic */
+				goto rx_next;
+			}
+#endif
+			/* fall thru for monitor mode handling... */
+
+		} else if (ds->ds_rxstat.rs_status != 0) {
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_CRC)
+				sc->sc_stats.ast_rx_crcerr++;
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_FIFO)
+				sc->sc_stats.ast_rx_fifoerr++;
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT)
+				sc->sc_stats.ast_rx_badcrypt++;
+			if (ds->ds_rxstat.rs_status & HAL_RXERR_PHY) {
+				sc->sc_stats.ast_rx_phyerr++;
+				phyerr = ds->ds_rxstat.rs_phyerr & 0x1f;
+				sc->sc_stats.ast_rx_phy[phyerr]++;
+			}
+
+			/*
+			 * reject error frames, we normally don't want
+			 * to see them in monitor mode.
+			 */
+			if ((ds->ds_rxstat.rs_status & HAL_RXERR_DECRYPT ) ||
+			    (ds->ds_rxstat.rs_status & HAL_RXERR_PHY))
+			    goto rx_next;
+
+			/*
+			 * In monitor mode, allow through packets that
+			 * cannot be decrypted
+			 */
+			if ((ds->ds_rxstat.rs_status & ~HAL_RXERR_DECRYPT) ||
+			    sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR)
+				goto rx_next;
+		}
+
+		len = ds->ds_rxstat.rs_datalen;
+		if (len < IEEE80211_MIN_LEN) {
+			DPRINTF(ATH_DEBUG_RECV, ("%s: short packet %d\n",
+				__func__, len));
+			sc->sc_stats.ast_rx_tooshort++;
+			goto rx_next;
+		}
+
+		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0, 
+		    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTREAD);
+
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		bf->bf_m = NULL;
+		m->m_pkthdr.rcvif = ifp;
+		m->m_pkthdr.len = m->m_len = len;
+
+#if NBPFILTER > 0
+		if (sc->sc_drvbpf) {
+			struct mbuf mb;
+
+			sc->sc_rx_th.wr_rate =
+				sc->sc_hwmap[ds->ds_rxstat.rs_rate];
+			sc->sc_rx_th.wr_antsignal = ds->ds_rxstat.rs_rssi;
+			sc->sc_rx_th.wr_antenna = ds->ds_rxstat.rs_antenna;
+			/* XXX TSF */
+			M_DUP_PKTHDR(&mb, m);
+			mb.m_data = (caddr_t)&sc->sc_rx_th;
+			mb.m_len = sc->sc_rx_th_len;
+			mb.m_next = m;
+			mb.m_pkthdr.len += mb.m_len;
+			bpf_mtap(sc->sc_drvbpf, &mb);
+		}
+#endif
+
+		m_adj(m, -IEEE80211_CRC_LEN);
+		wh = mtod(m, struct ieee80211_frame *);
+		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
+			/*
+			 * WEP is decrypted by hardware. Clear WEP bit
+			 * and trim WEP header for ieee80211_input().
+			 */
+			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
+			memcpy(&whbuf, wh, sizeof(whbuf));
+			m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
+			wh = mtod(m, struct ieee80211_frame *);
+			memcpy(wh, &whbuf, sizeof(whbuf));
+			/*
+			 * Also trim WEP ICV from the tail.
+			 */
+			m_adj(m, -IEEE80211_WEP_CRCLEN);
+			/*
+			 * The header has probably moved.
+			 */
+			wh = mtod(m, struct ieee80211_frame *);
+		}
+
+		/*
+		 * Locate the node for sender, track state, and
+		 * then pass this node (referenced) up to the 802.11
+		 * layer for its use.
+		 */
+		ni = ieee80211_find_rxnode(ic, wh);
+
+		/*
+		 * Record driver-specific state.
+		 */
+		an = ATH_NODE(ni);
+		if (++(an->an_rx_hist_next) == ATH_RHIST_SIZE)
+			an->an_rx_hist_next = 0;
+		rh = &an->an_rx_hist[an->an_rx_hist_next];
+		rh->arh_ticks = ATH_TICKS();
+		rh->arh_rssi = ds->ds_rxstat.rs_rssi;
+		rh->arh_antenna = ds->ds_rxstat.rs_antenna;
+
+		/*
+		 * Send frame up for processing.
+		 */
+		ieee80211_input(ifp, m, ni,
+			ds->ds_rxstat.rs_rssi, ds->ds_rxstat.rs_tstamp);
+
+		/*
+		 * The frame may have caused the node to be marked for
+		 * reclamation (e.g. in response to a DEAUTH message)
+		 * so use release_node here instead of unref_node.
+		 */
+		if (ni == ic->ic_bss)
+			ieee80211_unref_node(&ni);
+		else
+			ieee80211_free_node(ic, ni);
+
+  rx_next:
+		TAILQ_INSERT_TAIL(&sc->sc_rxbuf, bf, bf_list);
+	} while (ath_rxbuf_init(sc, bf) == 0);
+
+	ath_hal_rxmonitor(ah);			/* rx signal state monitoring */
+	ath_hal_rxena(ah);			/* in case of RXEOL */
+
+	if ((ifp->if_flags & IFF_OACTIVE) == 0 && !IFQ_IS_EMPTY(&ifp->if_snd))
+		ath_start(ifp);
+#undef PA2DESC
+}
+
+/*
+ * XXX Size of an ACK control frame in bytes.
+ */
+#define	IEEE80211_ACK_SIZE	(2+2+IEEE80211_ADDR_LEN+4)
+
+int
+ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni, struct ath_buf *bf,
+    struct mbuf *m0)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ifnet *ifp = &sc->sc_ic.ic_if;
+	int i, error, iswep, hdrlen, pktlen, s;
+	u_int8_t rix, cix, txrate, ctsrate;
+	struct ath_desc *ds;
+	struct mbuf *m;
+	struct ieee80211_frame *wh;
+	u_int32_t iv;
+	u_int8_t *ivp;
+	u_int8_t hdrbuf[sizeof(struct ieee80211_frame) +
+	    IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN];
+	u_int subtype, flags, ctsduration, antenna;
+	HAL_PKT_TYPE atype;
+	const HAL_RATE_TABLE *rt;
+	HAL_BOOL shortPreamble;
+	struct ath_node *an;
+
+	wh = mtod(m0, struct ieee80211_frame *);
+	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
+	hdrlen = sizeof(struct ieee80211_frame);
+	pktlen = m0->m_pkthdr.len;
+
+	if (iswep) {
+		memcpy(hdrbuf, mtod(m0, caddr_t), hdrlen);
+		m_adj(m0, hdrlen);
+		M_PREPEND(m0, sizeof(hdrbuf), M_DONTWAIT);
+		if (m0 == NULL) {
+			sc->sc_stats.ast_tx_nombuf++;
+			return ENOMEM;
+		}
+		ivp = hdrbuf + hdrlen;
+		wh = mtod(m0, struct ieee80211_frame *);
+		/*
+		 * XXX
+		 * IV must not duplicate during the lifetime of the key.
+		 * But no mechanism to renew keys is defined in IEEE 802.11
+		 * for WEP.  And the IV may be duplicated at other stations
+		 * because the session key itself is shared.  So we use a
+		 * pseudo random IV for now, though it is not the right way.
+		 *
+		 * NB: Rather than use a strictly random IV we select a
+		 * random one to start and then increment the value for
+		 * each frame.  This is an explicit tradeoff between
+		 * overhead and security.  Given the basic insecurity of
+		 * WEP this seems worthwhile.
+		 */
+
+		/*
+		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
+		 * (B, 255, N) with 3 <= B < 16 and 0 <= N <= 255
+		 */
+		iv = ic->ic_iv;
+		if ((iv & 0xff00) == 0xff00) {
+			int B = (iv & 0xff0000) >> 16;
+			if (3 <= B && B < 16)
+				iv = (B+1) << 16;
+		}
+		ic->ic_iv = iv + 1;
+
+		/*
+		 * NB: Preserve byte order of IV for packet
+		 *     sniffers; it doesn't matter otherwise.
+		 */
+#if AH_BYTE_ORDER == AH_BIG_ENDIAN
+		ivp[0] = iv >> 0;
+		ivp[1] = iv >> 8;
+		ivp[2] = iv >> 16;
+#else
+		ivp[2] = iv >> 0;
+		ivp[1] = iv >> 8;
+		ivp[0] = iv >> 16;
+#endif
+		ivp[3] = ic->ic_wep_txkey << 6; /* Key ID and pad */
+		memcpy(mtod(m0, caddr_t), hdrbuf, sizeof(hdrbuf));
+		/*
+		 * The ICV length must be included into hdrlen and pktlen.
+		 */
+		hdrlen = sizeof(hdrbuf) + IEEE80211_WEP_CRCLEN;
+		pktlen = m0->m_pkthdr.len + IEEE80211_WEP_CRCLEN;
+	}
+	pktlen += IEEE80211_CRC_LEN;
+
+	/*
+	 * Load the DMA map so any coalescing is done.  This
+	 * also calculates the number of descriptors we need.
+	 */
+	error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
+	    BUS_DMA_NOWAIT);
+	/*
+	 * Discard null packets and check for packets that
+	 * require too many TX descriptors.  We try to convert
+	 * the latter to a cluster.
+	 */
+	if (error == EFBIG) {		/* too many desc's, linearize */
+		sc->sc_stats.ast_tx_linear++;
+		MGETHDR(m, M_DONTWAIT, MT_DATA);
+		if (m == NULL) {
+			sc->sc_stats.ast_tx_nombuf++;
+			m_freem(m0);
+			return ENOMEM;
+		}
+
+		M_DUP_PKTHDR(m, m0);
+		MCLGET(m, M_DONTWAIT);
+		if ((m->m_flags & M_EXT) == 0) {
+			sc->sc_stats.ast_tx_nomcl++;
+			m_freem(m0);
+			m_free(m);
+			return ENOMEM;
+		}
+		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(m, caddr_t));
+		m_freem(m0);
+		m->m_len = m->m_pkthdr.len;
+		m0 = m;
+		error = bus_dmamap_load_mbuf(sc->sc_dmat, bf->bf_dmamap, m0,
+		    BUS_DMA_NOWAIT);
+		if (error != 0) {
+			sc->sc_stats.ast_tx_busdma++;
+			m_freem(m0);
+			return error;
+		}
+		KASSERT(bf->bf_nseg == 1,
+			("ath_tx_start: packet not one segment; nseg %u",
+			bf->bf_nseg));
+	} else if (error != 0) {
+		sc->sc_stats.ast_tx_busdma++;
+		m_freem(m0);
+		return error;
+	} else if (bf->bf_nseg == 0) {		/* null packet, discard */
+		sc->sc_stats.ast_tx_nodata++;
+		m_freem(m0);
+		return EIO;
+	}
+	DPRINTF(ATH_DEBUG_XMIT, ("%s: m %p len %u\n", __func__, m0, pktlen));
+	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
+	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);
+	bf->bf_m = m0;
+	bf->bf_node = ni;			/* NB: held reference */
+
+	/* setup descriptors */
+	ds = bf->bf_desc;
+	rt = sc->sc_currates;
+	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));
+
+	/*
+	 * Calculate Atheros packet type from IEEE80211 packet header
+	 * and setup for rate calculations.
+	 */
+	atype = HAL_PKT_TYPE_NORMAL;			/* default */
+	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
+	case IEEE80211_FC0_TYPE_MGT:
+		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
+			atype = HAL_PKT_TYPE_BEACON;
+		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+			atype = HAL_PKT_TYPE_PROBE_RESP;
+		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
+			atype = HAL_PKT_TYPE_ATIM;
+		rix = 0;			/* XXX lowest rate */
+		break;
+	case IEEE80211_FC0_TYPE_CTL:
+		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+		if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL)
+			atype = HAL_PKT_TYPE_PSPOLL;
+		rix = 0;			/* XXX lowest rate */
+		break;
+	default:
+		rix = sc->sc_rixmap[ni->ni_rates.rs_rates[ni->ni_txrate] &
+				IEEE80211_RATE_VAL];
+		if (rix == 0xff) {
+			if_printf(ifp, "bogus xmit rate 0x%x\n",
+				ni->ni_rates.rs_rates[ni->ni_txrate]);
+			sc->sc_stats.ast_tx_badrate++;
+			m_freem(m0);
+			return EIO;
+		}
+		break;
+	}
+	/*
+	 * NB: the 802.11 layer marks whether or not we should
+	 * use short preamble based on the current mode and
+	 * negotiated parameters.
+	 */
+	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
+	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
+		txrate = rt->info[rix].rateCode | rt->info[rix].shortPreamble;
+		shortPreamble = AH_TRUE;
+		sc->sc_stats.ast_tx_shortpre++;
+	} else {
+		txrate = rt->info[rix].rateCode;
+		shortPreamble = AH_FALSE;
+	}
+
+	/*
+	 * Calculate miscellaneous flags.
+	 */
+	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for wep errors */
+	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
+		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
+		sc->sc_stats.ast_tx_noack++;
+	} else if (pktlen > ic->ic_rtsthreshold) {
+		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
+		sc->sc_stats.ast_tx_rts++;
+	}
+
+	/*
+	 * Calculate duration.  This logically belongs in the 802.11
+	 * layer but it lacks sufficient information to calculate it.
+	 */
+	if ((flags & HAL_TXDESC_NOACK) == 0 &&
+	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
+		u_int16_t dur;
+		/*
+		 * XXX not right with fragmentation.
+		 */
+		dur = ath_hal_computetxtime(ah, rt, IEEE80211_ACK_SIZE,
+				rix, shortPreamble);
+		*((u_int16_t*) wh->i_dur) = htole16(dur);
+	}
+
+	/*
+	 * Calculate RTS/CTS rate and duration if needed.
+	 */
+	ctsduration = 0;
+	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA)) {
+		/*
+		 * CTS transmit rate is derived from the transmit rate
+		 * by looking in the h/w rate table.  We must also factor
+		 * in whether or not a short preamble is to be used.
+		 */
+		cix = rt->info[rix].controlRate;
+		ctsrate = rt->info[cix].rateCode;
+		if (shortPreamble)
+			ctsrate |= rt->info[cix].shortPreamble;
+		/*
+		 * Compute the transmit duration based on the size
+		 * of an ACK frame.  We call into the HAL to do the
+		 * computation since it depends on the characteristics
+		 * of the actual PHY being used.
+		 */
+		if (flags & HAL_TXDESC_RTSENA) {	/* SIFS + CTS */
+			ctsduration += ath_hal_computetxtime(ah,
+				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
+		}
+		/* SIFS + data */
+		ctsduration += ath_hal_computetxtime(ah,
+			rt, pktlen, rix, shortPreamble);
+		if ((flags & HAL_TXDESC_NOACK) == 0) {	/* SIFS + ACK */
+			ctsduration += ath_hal_computetxtime(ah,
+				rt, IEEE80211_ACK_SIZE, cix, shortPreamble);
+		}
+	} else
+		ctsrate = 0;
+
+	/*
+	 * For now use the antenna on which the last good
+	 * frame was received on.  We assume this field is
+	 * initialized to 0 which gives us ``auto'' or the
+	 * ``default'' antenna.
+	 */
+	an = (struct ath_node *) ni;
+	if (an->an_tx_antenna)
+		antenna = an->an_tx_antenna;
+	else
+		antenna = an->an_rx_hist[an->an_rx_hist_next].arh_antenna;
+
+	if (ic->ic_rawbpf)
+		bpf_mtap(ic->ic_rawbpf, m0);
+	if (sc->sc_drvbpf) {
+	        struct mbuf mb;
+
+		sc->sc_tx_th.wt_flags = 0;
+		if (shortPreamble)
+			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
+		if (iswep)
+			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
+		sc->sc_tx_th.wt_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
+		sc->sc_tx_th.wt_txpower = 60/2;		/* XXX */
+		sc->sc_tx_th.wt_antenna = antenna;
+
+		M_DUP_PKTHDR(&mb, m);
+		mb.m_data = (caddr_t)&sc->sc_tx_th;
+		mb.m_len = sc->sc_tx_th_len;
+		mb.m_next = m;
+		mb.m_pkthdr.len += mb.m_len;
+		bpf_mtap(sc->sc_drvbpf, &mb);
+	}
+
+	/*
+	 * Formulate first tx descriptor with tx controls.
+	 */
+	/* XXX check return value? */
+	ath_hal_setuptxdesc(ah, ds
+		, pktlen		/* packet length */
+		, hdrlen		/* header length */
+		, atype			/* Atheros packet type */
+		, 60			/* txpower XXX */
+		, txrate, 1+10		/* series 0 rate/tries */
+		, iswep ? sc->sc_ic.ic_wep_txkey : HAL_TXKEYIX_INVALID
+		, antenna		/* antenna mode */
+		, flags			/* flags */
+		, ctsrate		/* rts/cts rate */
+		, ctsduration		/* rts/cts duration */
+	);
+#ifdef notyet
+	ath_hal_setupxtxdesc(ah, ds
+		, AH_FALSE		/* short preamble */
+		, 0, 0			/* series 1 rate/tries */
+		, 0, 0			/* series 2 rate/tries */
+		, 0, 0			/* series 3 rate/tries */
+	);
+#endif
+	/*
+	 * Fillin the remainder of the descriptor info.
+	 */
+	for (i = 0; i < bf->bf_nseg; i++, ds++) {
+		ds->ds_data = bf->bf_segs[i].ds_addr;
+		if (i == bf->bf_nseg - 1)
+			ds->ds_link = 0;
+		else
+			ds->ds_link = bf->bf_daddr + sizeof(*ds) * (i + 1);
+		ath_hal_filltxdesc(ah, ds
+			, bf->bf_segs[i].ds_len	/* segment length */
+			, i == 0		/* first segment */
+			, i == bf->bf_nseg - 1	/* last segment */
+		);
+		DPRINTF(ATH_DEBUG_XMIT,
+			("%s: %d: %08x %08x %08x %08x %08x %08x\n",
+			__func__, i, ds->ds_link, ds->ds_data,
+			ds->ds_ctl0, ds->ds_ctl1, ds->ds_hw[0], ds->ds_hw[1]));
+	}
+
+	/*
+	 * Insert the frame on the outbound list and
+	 * pass it on to the hardware.
+	 */
+	s = splnet();
+	TAILQ_INSERT_TAIL(&sc->sc_txq, bf, bf_list);
+	if (sc->sc_txlink == NULL) {
+		ath_hal_puttxbuf(ah, sc->sc_txhalq, bf->bf_daddr);
+		DPRINTF(ATH_DEBUG_XMIT, ("%s: TXDP0 = %p (%p)\n", __func__,
+		    (caddr_t)bf->bf_daddr, bf->bf_desc));
+	} else {
+		*sc->sc_txlink = bf->bf_daddr;
+		DPRINTF(ATH_DEBUG_XMIT, ("%s: link(%p)=%p (%p)\n", __func__,
+		    sc->sc_txlink, (caddr_t)bf->bf_daddr, bf->bf_desc));
+	}
+	sc->sc_txlink = &bf->bf_desc[bf->bf_nseg - 1].ds_link;
+	splx(s);
+
+	ath_hal_txstart(ah, sc->sc_txhalq);
+	return 0;
+}
+
+void
+ath_tx_proc(void *arg, int npending)
+{
+	struct ath_softc *sc = arg;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ath_buf *bf;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_desc *ds;
+	struct ieee80211_node *ni;
+	struct ath_node *an;
+	int sr, lr, s, s2;
+	HAL_STATUS status;
+
+	DPRINTF(ATH_DEBUG_TX_PROC, ("%s: pending %u tx queue %p, link %p\n",
+		__func__, npending,
+		(caddr_t)(u_intptr_t) ath_hal_gettxbuf(sc->sc_ah, sc->sc_txhalq),
+		sc->sc_txlink));
+	for (;;) {
+		s = splnet();
+		bf = TAILQ_FIRST(&sc->sc_txq);
+		if (bf == NULL) {
+			sc->sc_txlink = NULL;
+			splx(s);
+			break;
+		}
+		/* only the last descriptor is needed */
+		ds = &bf->bf_desc[bf->bf_nseg - 1];
+		status = ath_hal_txprocdesc(ah, ds);
+#ifdef AR_DEBUG
+		if (ath_debug & ATH_DEBUG_XMIT_DESC)
+			ath_printtxbuf(bf, status == HAL_OK);
+#endif
+		if (status == HAL_EINPROGRESS) {
+			splx(s);
+			break;
+		}
+		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
+		splx(s);
+
+		ni = bf->bf_node;
+		if (ni != NULL) {
+			an = (struct ath_node *) ni;
+			if (ds->ds_txstat.ts_status == 0) {
+				an->an_tx_ok++;
+				an->an_tx_antenna = ds->ds_txstat.ts_antenna;
+			} else {
+				an->an_tx_err++;
+				ifp->if_oerrors++;
+				if (ds->ds_txstat.ts_status & HAL_TXERR_XRETRY)
+					sc->sc_stats.ast_tx_xretries++;
+				if (ds->ds_txstat.ts_status & HAL_TXERR_FIFO)
+					sc->sc_stats.ast_tx_fifoerr++;
+				if (ds->ds_txstat.ts_status & HAL_TXERR_FILT)
+					sc->sc_stats.ast_tx_filtered++;
+				an->an_tx_antenna = 0;	/* invalidate */
+			}
+			sr = ds->ds_txstat.ts_shortretry;
+			lr = ds->ds_txstat.ts_longretry;
+			sc->sc_stats.ast_tx_shortretry += sr;
+			sc->sc_stats.ast_tx_longretry += lr;
+			if (sr + lr)
+				an->an_tx_retr++;
+			/*
+			 * Reclaim reference to node.
+			 *
+			 * NB: the node may be reclaimed here if, for example
+			 *     this is a DEAUTH message that was sent and the
+			 *     node was timed out due to inactivity.
+			 */
+			if(ni != NULL && ni != ic->ic_bss)
+  			        ieee80211_free_node(ic, ni);
+		}
+		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
+		    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_POSTWRITE);
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		m_freem(bf->bf_m);
+		bf->bf_m = NULL;
+		bf->bf_node = NULL;
+
+		s2 = splnet();
+		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+		splx(s2);
+	}
+	ifp->if_flags &= ~IFF_OACTIVE;
+	sc->sc_tx_timer = 0;
+
+	ath_start(ifp);
+}
+
+/*
+ * Drain the transmit queue and reclaim resources.
+ */
+void
+ath_draintxq(struct ath_softc *sc)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ieee80211_node *ni;
+	struct ath_buf *bf;
+	int s, s2;
+
+	/* XXX return value */
+	if (!sc->sc_invalid) {
+		/* don't touch the hardware if marked invalid */
+		(void) ath_hal_stoptxdma(ah, sc->sc_txhalq);
+		DPRINTF(ATH_DEBUG_RESET,
+		    ("%s: tx queue %p, link %p\n", __func__,
+		    (caddr_t)(u_intptr_t) ath_hal_gettxbuf(ah, sc->sc_txhalq),
+		    sc->sc_txlink));
+		(void) ath_hal_stoptxdma(ah, sc->sc_bhalq);
+		DPRINTF(ATH_DEBUG_RESET,
+		    ("%s: beacon queue %p\n", __func__,
+		    (caddr_t)(u_intptr_t) ath_hal_gettxbuf(ah, sc->sc_bhalq)));
+	}
+	for (;;) {
+		s = splnet();
+		bf = TAILQ_FIRST(&sc->sc_txq);
+		if (bf == NULL) {
+			sc->sc_txlink = NULL;
+			splx(s);
+			break;
+		}
+		TAILQ_REMOVE(&sc->sc_txq, bf, bf_list);
+		splx(s);
+#ifdef AR_DEBUG
+		if (ath_debug & ATH_DEBUG_RESET)
+			ath_printtxbuf(bf,
+				ath_hal_txprocdesc(ah, bf->bf_desc) == HAL_OK);
+#endif /* AR_DEBUG */
+		bus_dmamap_unload(sc->sc_dmat, bf->bf_dmamap);
+		m_freem(bf->bf_m);
+		bf->bf_m = NULL;
+		ni = bf->bf_node;
+		bf->bf_node = NULL;
+		s2 = splnet();
+		if (ni != NULL && ni != ic->ic_bss) {
+			/*
+			 * Reclaim node reference.
+			 */
+			ieee80211_free_node(ic, ni);
+		}
+		TAILQ_INSERT_TAIL(&sc->sc_txbuf, bf, bf_list);
+		splx(s2);
+	}
+	ifp->if_flags &= ~IFF_OACTIVE;
+	sc->sc_tx_timer = 0;
+}
+
+/*
+ * Disable the receive h/w in preparation for a reset.
+ */
+void
+ath_stoprecv(struct ath_softc *sc)
+{
+#define	PA2DESC(_sc, _pa) \
+	((struct ath_desc *)((caddr_t)(_sc)->sc_desc + \
+		((_pa) - (_sc)->sc_desc_paddr)))
+	struct ath_hal *ah = sc->sc_ah;
+
+	ath_hal_stoppcurecv(ah);	/* disable PCU */
+	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
+	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
+	DELAY(3000);			/* long enough for 1 frame */
+#ifdef AR_DEBUG
+	if (ath_debug & ATH_DEBUG_RESET) {
+		struct ath_buf *bf;
+
+		printf("%s: rx queue %p, link %p\n", __func__,
+			(caddr_t)(u_intptr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink);
+		TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+			struct ath_desc *ds = bf->bf_desc;
+			if (ath_hal_rxprocdesc(ah, ds, bf->bf_daddr,
+			    PA2DESC(sc, ds->ds_link)) == HAL_OK)
+				ath_printrxbuf(bf, 1);
+		}
+	}
+#endif
+	sc->sc_rxlink = NULL;		/* just in case */
+#undef PA2DESC
+}
+
+/*
+ * Enable the receive h/w following a reset.
+ */
+int
+ath_startrecv(struct ath_softc *sc)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ath_buf *bf;
+
+	sc->sc_rxlink = NULL;
+	TAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
+		int error = ath_rxbuf_init(sc, bf);
+		if (error != 0) {
+			DPRINTF(ATH_DEBUG_RECV,
+				("%s: ath_rxbuf_init failed %d\n",
+				__func__, error));
+			return error;
+		}
+	}
+
+	bf = TAILQ_FIRST(&sc->sc_rxbuf);
+	ath_hal_putrxbuf(ah, bf->bf_daddr);
+	ath_hal_rxena(ah);		/* enable recv descriptors */
+	ath_mode_init(sc);		/* set filters, etc. */
+	ath_hal_startpcurecv(ah);	/* re-enable PCU/DMA engine */
+	return 0;
+}
+
+/*
+ * Set/change channels.  If the channel is really being changed,
+ * it's done by resetting the chip.  To accomplish this we must
+ * first cleanup any pending DMA, then restart stuff after a la
+ * ath_init.
+ */
+int
+ath_chan_set(struct ath_softc *sc, struct ieee80211_channel *chan)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: %u (%u MHz) -> %u (%u MHz)\n", __func__,
+	    ieee80211_chan2ieee(ic, ic->ic_ibss_chan),
+		ic->ic_ibss_chan->ic_freq,
+	    ieee80211_chan2ieee(ic, chan), chan->ic_freq));
+	if (chan != ic->ic_ibss_chan) {
+		HAL_STATUS status;
+		HAL_CHANNEL hchan;
+		enum ieee80211_phymode mode;
+
+		/*
+		 * To switch channels clear any pending DMA operations;
+		 * wait long enough for the RX fifo to drain, reset the
+		 * hardware at the new frequency, and then re-enable
+		 * the relevant bits of the h/w.
+		 */
+		ath_hal_intrset(ah, 0);		/* disable interrupts */
+		ath_draintxq(sc);		/* clear pending tx frames */
+		ath_stoprecv(sc);		/* turn off frame recv */
+		/*
+		 * Convert to a HAL channel description with
+		 * the flags constrained to reflect the current
+		 * operating mode.
+		 */
+		hchan.channel = chan->ic_freq;
+		hchan.channelFlags = ath_chan2flags(ic, chan);
+		if (!ath_hal_reset(ah, ic->ic_opmode, &hchan, AH_TRUE, &status)) {
+			if_printf(&ic->ic_if, "ath_chan_set: unable to reset "
+				"channel %u (%u Mhz)\n",
+				ieee80211_chan2ieee(ic, chan), chan->ic_freq);
+			return EIO;
+		}
+		/*
+		 * Re-enable rx framework.
+		 */
+		if (ath_startrecv(sc) != 0) {
+			if_printf(&ic->ic_if,
+				"ath_chan_set: unable to restart recv logic\n");
+			return EIO;
+		}
+
+		/*
+		 * Update BPF state.
+		 */
+		sc->sc_tx_th.wt_chan_freq = sc->sc_rx_th.wr_chan_freq =
+			htole16(chan->ic_freq);
+		sc->sc_tx_th.wt_chan_flags = sc->sc_rx_th.wr_chan_flags =
+			htole16(chan->ic_flags);
+
+		/*
+		 * Change channels and update the h/w rate map
+		 * if we're switching; e.g. 11a to 11b/g.
+		 */
+		ic->ic_ibss_chan = chan;
+		mode = ieee80211_chan2mode(ic, chan);
+		if (mode != sc->sc_curmode)
+			ath_setcurmode(sc, mode);
+
+		/*
+		 * Re-enable interrupts.
+		 */
+		ath_hal_intrset(ah, sc->sc_imask);
+	}
+	return 0;
+}
+
+void
+ath_next_scan(void *arg)
+{
+	struct ath_softc *sc = arg;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	int s;
+
+	/* don't call ath_start w/o network interrupts blocked */
+	s = splnet();
+
+	if (ic->ic_state == IEEE80211_S_SCAN)
+		ieee80211_next_scan(ifp);
+	splx(s);
+}
+
+/*
+ * Periodically recalibrate the PHY to account
+ * for temperature/environment changes.
+ */
+void
+ath_calibrate(void *arg)
+{
+	struct ath_softc *sc = arg;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_channel *c;
+	HAL_CHANNEL hchan;
+
+	sc->sc_stats.ast_per_cal++;
+
+	/*
+	 * Convert to a HAL channel description with the flags
+	 * constrained to reflect the current operating mode.
+	 */
+	c = ic->ic_ibss_chan;
+	hchan.channel = c->ic_freq;
+	hchan.channelFlags = ath_chan2flags(ic, c);
+
+	DPRINTF(ATH_DEBUG_CALIBRATE,
+		("%s: channel %u/%x\n", __func__, c->ic_freq, c->ic_flags));
+
+	if (ath_hal_getrfgain(ah) == HAL_RFGAIN_NEED_CHANGE) {
+		/*
+		 * Rfgain is out of bounds, reset the chip
+		 * to load new gain values.
+		 */
+		sc->sc_stats.ast_per_rfgain++;
+		ath_reset(sc);
+	}
+	if (!ath_hal_calibrate(ah, &hchan)) {
+		DPRINTF(ATH_DEBUG_ANY,
+			("%s: calibration of channel %u failed\n",
+			__func__, c->ic_freq));
+		sc->sc_stats.ast_per_calfail++;
+	}
+	timeout_add(&sc->sc_cal_to, hz * ath_calinterval);
+}
+
+HAL_LED_STATE
+ath_state_to_led(enum ieee80211_state state)
+{
+	switch (state) {
+	case IEEE80211_S_INIT:
+		return HAL_LED_INIT;
+	case IEEE80211_S_SCAN:
+		return HAL_LED_SCAN;
+	case IEEE80211_S_AUTH:
+		return HAL_LED_AUTH;
+	case IEEE80211_S_ASSOC:
+		return HAL_LED_ASSOC;
+	case IEEE80211_S_RUN:
+		return HAL_LED_RUN;
+	default:
+		panic("%s: unknown 802.11 state %d\n", __func__, state);
+		return HAL_LED_INIT;
+	}
+}
+
+int
+ath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
+{
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_softc *sc = ifp->if_softc;
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211_node *ni;
+	const u_int8_t *bssid;
+	int i, error;
+	u_int32_t rfilt;
+
+	DPRINTF(ATH_DEBUG_ANY, ("%s: %s -> %s\n", __func__,
+		ieee80211_state_name[ic->ic_state],
+		ieee80211_state_name[nstate]));
+
+	ath_hal_setledstate(ah, ath_state_to_led(nstate));	/* set LED */
+
+	if (nstate == IEEE80211_S_INIT) {
+		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
+		ath_hal_intrset(ah, sc->sc_imask);
+		timeout_del(&sc->sc_scan_to);
+		timeout_del(&sc->sc_cal_to);
+		return (*sc->sc_newstate)(ic, nstate, arg);
+	}
+	ni = ic->ic_bss;
+	error = ath_chan_set(sc, ni->ni_chan);
+	if (error != 0)
+		goto bad;
+	rfilt = ath_calcrxfilter(sc);
+	if (nstate == IEEE80211_S_SCAN) {
+	        timeout_add(&sc->sc_scan_to, (hz * ath_dwelltime) / 1000);
+		bssid = sc->sc_broadcast_addr;
+	} else {
+		timeout_del(&sc->sc_scan_to);
+		bssid = ni->ni_bssid;
+	}
+	ath_hal_setrxfilter(ah, rfilt);
+	DPRINTF(ATH_DEBUG_ANY, ("%s: RX filter 0x%x bssid %s\n",
+		 __func__, rfilt, ether_sprintf((u_char*)bssid)));
+
+	if (nstate == IEEE80211_S_RUN && ic->ic_opmode == IEEE80211_M_STA)
+		ath_hal_setassocid(ah, bssid, ni->ni_associd);
+	else
+		ath_hal_setassocid(ah, bssid, 0);
+	if (ic->ic_flags & IEEE80211_F_WEPON) {
+		for (i = 0; i < IEEE80211_WEP_NKID; i++)
+			if (ath_hal_keyisvalid(ah, i))
+				ath_hal_keysetmac(ah, i, bssid);
+	}
+
+	if (nstate == IEEE80211_S_RUN) {
+		DPRINTF(ATH_DEBUG_ANY, ("%s(RUN): ic_flags=0x%08x iv=%d bssid=%s "
+			"capinfo=0x%04x chan=%d\n"
+			 , __func__
+			 , ic->ic_flags
+			 , ni->ni_intval
+			 , ether_sprintf(ni->ni_bssid)
+			 , ni->ni_capinfo
+			 , ieee80211_chan2ieee(ic, ni->ni_chan)));
+
+		/*
+		 * Allocate and setup the beacon frame for AP or adhoc mode.
+		 */
+		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
+		    ic->ic_opmode == IEEE80211_M_IBSS) {
+			error = ath_beacon_alloc(sc, ni);
+			if (error != 0)
+				goto bad;
+		}
+
+		/*
+		 * Configure the beacon and sleep timers.
+		 */
+		ath_beacon_config(sc);
+
+		/* start periodic recalibration timer */
+	        timeout_add(&sc->sc_cal_to, hz * ath_calinterval);
+	} else {
+		sc->sc_imask &= ~(HAL_INT_SWBA | HAL_INT_BMISS);
+		ath_hal_intrset(ah, sc->sc_imask);
+		timeout_del(&sc->sc_cal_to); /* no calibration */
+	}
+	/*
+	 * Reset the rate control state.
+	 */
+	ath_rate_ctl_reset(sc, nstate);
+	/*
+	 * Invoke the parent method to complete the work.
+	 */
+	return (*sc->sc_newstate)(ic, nstate, arg);
+bad:
+	timeout_del(&sc->sc_scan_to);
+	timeout_del(&sc->sc_cal_to);
+	/* NB: do not invoke the parent */
+	return error;
+}
+
+void
+ath_recv_mgmt(struct ieee80211com *ic, struct mbuf *m,
+    struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
+{
+	struct ath_softc *sc = (struct ath_softc*)ic->ic_softc;
+	struct ath_hal *ah = sc->sc_ah;
+
+	(*sc->sc_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
+
+	switch (subtype) {
+	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
+	case IEEE80211_FC0_SUBTYPE_BEACON:
+		if (ic->ic_opmode != IEEE80211_M_IBSS ||
+		    ic->ic_state != IEEE80211_S_RUN)
+			break;
+		if (ieee80211_ibss_merge(ic, ni, ath_hal_gettsf64(ah)) ==
+		    ENETRESET)
+			ath_hal_setassocid(ah, ic->ic_bss->ni_bssid, 0);
+		break;
+	default:
+		break;
+	}
+	return;
+}
+
+/*
+ * Setup driver-specific state for a newly associated node.
+ * Note that we're called also on a re-associate, the isnew
+ * param tells us if this is the first time or not.
+ */
+void
+ath_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
+{
+	if (isnew) {
+		struct ath_node *an = (struct ath_node *) ni;
+
+		an->an_tx_ok = an->an_tx_err =
+			an->an_tx_retr = an->an_tx_upper = 0;
+		/* start with highest negotiated rate */
+		/*
+		 * XXX should do otherwise but only when
+		 * the rate control algorithm is better.
+		 */
+		KASSERT(ni->ni_rates.rs_nrates > 0,
+			("new association w/ no rates!"));
+		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
+	}
+}
+
+int
+ath_getchannels(struct ath_softc *sc, u_int cc, HAL_BOOL outdoor,
+    HAL_BOOL xchanmode)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ifnet *ifp = &ic->ic_if;
+	struct ath_hal *ah = sc->sc_ah;
+	HAL_CHANNEL *chans;
+	int i, ix, nchan;
+
+	chans = malloc(IEEE80211_CHAN_MAX * sizeof(HAL_CHANNEL),
+			M_TEMP, M_NOWAIT);
+	if (chans == NULL) {
+		if_printf(ifp, "unable to allocate channel table\n");
+		return ENOMEM;
+	}
+	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
+	    cc, HAL_MODE_ALL, outdoor, xchanmode)) {
+		if_printf(ifp, "unable to collect channel list from hal\n");
+		free(chans, M_TEMP);
+		return EINVAL;
+	}
+
+	/*
+	 * Convert HAL channels to ieee80211 ones and insert
+	 * them in the table according to their channel number.
+	 */
+	for (i = 0; i < nchan; i++) {
+		HAL_CHANNEL *c = &chans[i];
+		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
+		if (ix > IEEE80211_CHAN_MAX) {
+			if_printf(ifp, "bad hal channel %u (%u/%x) ignored\n",
+				ix, c->channel, c->channelFlags);
+			continue;
+		}
+		DPRINTF(ATH_DEBUG_ANY,
+		    ("%s: HAL channel %d/%d freq %d flags %#04x idx %d\n",
+		    sc->sc_dev.dv_xname, i, nchan, c->channel, c->channelFlags,
+		    ix));
+		/* NB: flags are known to be compatible */
+		if (ic->ic_channels[ix].ic_freq == 0) {
+			ic->ic_channels[ix].ic_freq = c->channel;
+			ic->ic_channels[ix].ic_flags = c->channelFlags;
+		} else {
+			/* channels overlap; e.g. 11g and 11b */
+			ic->ic_channels[ix].ic_flags |= c->channelFlags;
+		}
+	}
+	free(chans, M_TEMP);
+	return 0;
+}
+
+int
+ath_rate_setup(struct ath_softc *sc, u_int mode)
+{
+	struct ath_hal *ah = sc->sc_ah;
+	struct ieee80211com *ic = &sc->sc_ic;
+	const HAL_RATE_TABLE *rt;
+	struct ieee80211_rateset *rs;
+	int i, maxrates;
+
+	switch (mode) {
+	case IEEE80211_MODE_11A:
+		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11A);
+		break;
+	case IEEE80211_MODE_11B:
+		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11B);
+		break;
+	case IEEE80211_MODE_11G:
+		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_11G);
+		break;
+	case IEEE80211_MODE_TURBO:
+		sc->sc_rates[mode] = ath_hal_getratetable(ah, HAL_MODE_TURBO);
+		break;
+	default:
+		DPRINTF(ATH_DEBUG_ANY,
+			("%s: invalid mode %u\n", __func__, mode));
+		return 0;
+	}
+	rt = sc->sc_rates[mode];
+	if (rt == NULL)
+		return 0;
+	if (rt->rateCount > IEEE80211_RATE_MAXSIZE) {
+		DPRINTF(ATH_DEBUG_ANY,
+			("%s: rate table too small (%u > %u)\n",
+			__func__, rt->rateCount, IEEE80211_RATE_MAXSIZE));
+		maxrates = IEEE80211_RATE_MAXSIZE;
+	} else
+		maxrates = rt->rateCount;
+	rs = &ic->ic_sup_rates[mode];
+	for (i = 0; i < maxrates; i++)
+		rs->rs_rates[i] = rt->info[i].dot11Rate;
+	rs->rs_nrates = maxrates;
+	return 1;
+}
+
+void
+ath_setcurmode(struct ath_softc *sc, enum ieee80211_phymode mode)
+{
+	const HAL_RATE_TABLE *rt;
+	int i;
+
+	memset(sc->sc_rixmap, 0xff, sizeof(sc->sc_rixmap));
+	rt = sc->sc_rates[mode];
+	KASSERT(rt != NULL, ("no h/w rate set for phy mode %u", mode));
+	for (i = 0; i < rt->rateCount; i++)
+		sc->sc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
+	memset(sc->sc_hwmap, 0, sizeof(sc->sc_hwmap));
+	for (i = 0; i < 32; i++)
+		sc->sc_hwmap[i] = rt->info[rt->rateCodeToIndex[i]].dot11Rate;
+	sc->sc_currates = rt;
+	sc->sc_curmode = mode;
+}
+
+/*
+ * Reset the rate control state for each 802.11 state transition.
+ */
+void
+ath_rate_ctl_reset(struct ath_softc *sc, enum ieee80211_state state)
+{
+	struct ieee80211com *ic = &sc->sc_ic;
+	struct ieee80211_node *ni;
+	struct ath_node *an;
+
+	if (ic->ic_opmode != IEEE80211_M_STA) {
+		/*
+		 * When operating as a station the node table holds
+		 * the AP's that were discovered during scanning.
+		 * For any other operating mode we want to reset the
+		 * tx rate state of each node.
+		 */
+		TAILQ_FOREACH(ni, &ic->ic_node, ni_list) {
+			ni->ni_txrate = 0;		/* use lowest rate */
+			an = (struct ath_node *) ni;
+			an->an_tx_ok = an->an_tx_err = an->an_tx_retr =
+			    an->an_tx_upper = 0;
+		}
+	}
+	/*
+	 * Reset local xmit state; this is really only meaningful
+	 * when operating in station or adhoc mode.
+	 */
+	ni = ic->ic_bss;
+	an = (struct ath_node *) ni;
+	an->an_tx_ok = an->an_tx_err = an->an_tx_retr = an->an_tx_upper = 0;
+	if (state == IEEE80211_S_RUN) {
+		/* start with highest negotiated rate */
+		KASSERT(ni->ni_rates.rs_nrates > 0,
+			("transition to RUN state w/ no rates!"));
+		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
+	} else {
+		/* use lowest rate */
+		ni->ni_txrate = 0;
+	}
+}
+
+/* 
+ * Examine and potentially adjust the transmit rate.
+ */
+void
+ath_rate_ctl(void *arg, struct ieee80211_node *ni)
+{
+	struct ath_softc *sc = arg;
+	struct ath_node *an = (struct ath_node *) ni;
+	struct ieee80211_rateset *rs = &ni->ni_rates;
+	int mod = 0, orate, enough;
+
+	/*
+	 * Rate control
+	 * XXX: very primitive version.
+	 */
+	sc->sc_stats.ast_rate_calls++;
+
+	enough = (an->an_tx_ok + an->an_tx_err >= 10);
+
+	/* no packet reached -> down */
+	if (an->an_tx_err > 0 && an->an_tx_ok == 0)
+		mod = -1;
+
+	/* all packets needs retry in average -> down */
+	if (enough && an->an_tx_ok < an->an_tx_retr)
+		mod = -1;
+
+	/* no error and less than 10% of packets needs retry -> up */
+	if (enough && an->an_tx_err == 0 && an->an_tx_ok > an->an_tx_retr * 10)
+		mod = 1;
+
+	orate = ni->ni_txrate;
+	switch (mod) {
+	case 0:
+		if (enough && an->an_tx_upper > 0)
+			an->an_tx_upper--;
+		break;
+	case -1:
+		if (ni->ni_txrate > 0) {
+			ni->ni_txrate--;
+			sc->sc_stats.ast_rate_drop++;
+		}
+		an->an_tx_upper = 0;
+		break;
+	case 1:
+		if (++an->an_tx_upper < 2)
+			break;
+		an->an_tx_upper = 0;
+		if (ni->ni_txrate + 1 < rs->rs_nrates) {
+			ni->ni_txrate++;
+			sc->sc_stats.ast_rate_raise++;
+		}
+		break;
+	}
+
+	if (ni->ni_txrate != orate) {
+		DPRINTF(ATH_DEBUG_RATE,
+		    ("%s: %dM -> %dM (%d ok, %d err, %d retr)\n",
+		    __func__,
+		    (rs->rs_rates[orate] & IEEE80211_RATE_VAL) / 2,
+		    (rs->rs_rates[ni->ni_txrate] & IEEE80211_RATE_VAL) / 2,
+		    an->an_tx_ok, an->an_tx_err, an->an_tx_retr));
+	}
+	if (ni->ni_txrate != orate || enough)
+		an->an_tx_ok = an->an_tx_err = an->an_tx_retr = 0;
+}
+
+#ifdef AR_DEBUG
+#ifdef __FreeBSD__
+int
+sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
+{
+	char dmode[64];
+	int error;
+
+	strlcpy(dmode, "", sizeof(dmode) - 1);
+	dmode[sizeof(dmode) - 1] = '\0';
+	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
+
+	if (error == 0 && req->newptr != NULL) {
+		struct ifnet *ifp;
+		struct ath_softc *sc;
+
+		ifp = ifunit("ath0");		/* XXX */
+		if (!ifp)
+			return EINVAL;
+		sc = ifp->if_softc;
+		if (strcmp(dmode, "hal") == 0)
+			ath_hal_dumpstate(sc->sc_ah);
+		else
+			return EINVAL;
+	}
+	return error;
+}
+SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
+	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
+#endif /* __FreeBSD__ */
+
+#if 0 /* #ifdef __NetBSD__ */
+int
+sysctl_hw_ath_dump(SYSCTL_HANDLER_ARGS)
+{
+	char dmode[64];
+	int error;
+
+	strlcpy(dmode, "", sizeof(dmode) - 1);
+	dmode[sizeof(dmode) - 1] = '\0';
+	error = sysctl_handle_string(oidp, &dmode[0], sizeof(dmode), req);
+
+	if (error == 0 && req->newptr != NULL) {
+		struct ifnet *ifp;
+		struct ath_softc *sc;
+
+		ifp = ifunit("ath0");		/* XXX */
+		if (!ifp)
+			return EINVAL;
+		sc = ifp->if_softc;
+		if (strcmp(dmode, "hal") == 0)
+			ath_hal_dumpstate(sc->sc_ah);
+		else
+			return EINVAL;
+	}
+	return error;
+}
+SYSCTL_PROC(_hw_ath, OID_AUTO, dump, CTLTYPE_STRING | CTLFLAG_RW,
+	0, 0, sysctl_hw_ath_dump, "A", "Dump driver state");
+#endif /* __NetBSD__ */
+
+void
+ath_printrxbuf(struct ath_buf *bf, int done)
+{
+	struct ath_desc *ds;
+	int i;
+
+	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
+		printf("R%d (%p %p) %08x %08x %08x %08x %08x %08x %c\n",
+		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
+		    ds->ds_link, ds->ds_data,
+		    ds->ds_ctl0, ds->ds_ctl1,
+		    ds->ds_hw[0], ds->ds_hw[1],
+		    !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
+	}
+}
+
+void
+ath_printtxbuf(struct ath_buf *bf, int done)
+{
+	struct ath_desc *ds;
+	int i;
+
+	for (i = 0, ds = bf->bf_desc; i < bf->bf_nseg; i++, ds++) {
+		printf("T%d (%p %p) %08x %08x %08x %08x %08x %08x %08x %08x %c\n",
+		    i, ds, (struct ath_desc *)bf->bf_daddr + i,
+		    ds->ds_link, ds->ds_data,
+		    ds->ds_ctl0, ds->ds_ctl1,
+		    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
+		    !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
+	}
+}
+#endif /* AR_DEBUG */
diff --git a/sys/dev/ic/athvar.h b/sys/dev/ic/athvar.h
new file mode 100644
index 00000000000..b58ac745e70
--- /dev/null
+++ b/sys/dev/ic/athvar.h
@@ -0,0 +1,534 @@
+/*      $OpenBSD: athvar.h,v 1.1 2004/11/02 02:45:37 reyk Exp $  */
+/*	$NetBSD: athvar.h,v 1.10 2004/08/10 01:03:53 dyoung Exp $	*/
+
+/*-
+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ *
+ * $FreeBSD: src/sys/dev/ath/if_athvar.h,v 1.14 2004/04/03 03:33:02 sam Exp $
+ */
+
+/*
+ * Defintions for the Atheros Wireless LAN controller driver.
+ */
+#ifndef _DEV_ATH_ATHVAR_H
+#define _DEV_ATH_ATHVAR_H
+
+#include <net80211/ieee80211_radiotap.h>
+
+#include <dev/ic/ar5xxx.h>
+
+#define	ATH_TIMEOUT		1000
+
+#define	ATH_RXBUF	40		/* number of RX buffers */
+#define	ATH_TXBUF	60		/* number of TX buffers */
+#define	ATH_TXDESC	8		/* number of descriptors per buffer */
+
+struct ath_recv_hist {
+	int		arh_ticks;	/* sample time by system clock */
+	u_int8_t	arh_rssi;	/* rssi */
+	u_int8_t	arh_antenna;	/* antenna */
+};
+#define	ATH_RHIST_SIZE		16	/* number of samples */
+#define	ATH_RHIST_NOTIME	(~0)
+
+/*
+ * Ioctl-related defintions for the Atheros Wireless LAN controller driver.
+ */
+struct ath_stats {
+	u_int32_t	ast_watchdog;	/* device reset by watchdog */
+	u_int32_t	ast_hardware;	/* fatal hardware error interrupts */
+	u_int32_t	ast_bmiss;	/* beacon miss interrupts */
+	u_int32_t	ast_rxorn;	/* rx overrun interrupts */
+	u_int32_t	ast_rxeol;	/* rx eol interrupts */
+	u_int32_t	ast_txurn;	/* tx underrun interrupts */
+	u_int32_t	ast_intrcoal;	/* interrupts coalesced */
+	u_int32_t	ast_tx_mgmt;	/* management frames transmitted */
+	u_int32_t	ast_tx_discard;	/* frames discarded prior to assoc */
+	u_int32_t	ast_tx_qstop;	/* output stopped 'cuz no buffer */
+	u_int32_t	ast_tx_encap;	/* tx encapsulation failed */
+	u_int32_t	ast_tx_nonode;	/* tx failed 'cuz no node */
+	u_int32_t	ast_tx_nombuf;	/* tx failed 'cuz no mbuf */
+	u_int32_t	ast_tx_nomcl;	/* tx failed 'cuz no cluster */
+	u_int32_t	ast_tx_linear;	/* tx linearized to cluster */
+	u_int32_t	ast_tx_nodata;	/* tx discarded empty frame */
+	u_int32_t	ast_tx_busdma;	/* tx failed for dma resrcs */
+	u_int32_t	ast_tx_xretries;/* tx failed 'cuz too many retries */
+	u_int32_t	ast_tx_fifoerr;	/* tx failed 'cuz FIFO underrun */
+	u_int32_t	ast_tx_filtered;/* tx failed 'cuz xmit filtered */
+	u_int32_t	ast_tx_shortretry;/* tx on-chip retries (short) */
+	u_int32_t	ast_tx_longretry;/* tx on-chip retries (long) */
+	u_int32_t	ast_tx_badrate;	/* tx failed 'cuz bogus xmit rate */
+	u_int32_t	ast_tx_noack;	/* tx frames with no ack marked */
+	u_int32_t	ast_tx_rts;	/* tx frames with rts enabled */
+	u_int32_t	ast_tx_cts;	/* tx frames with cts enabled */
+	u_int32_t	ast_tx_shortpre;/* tx frames with short preamble */
+	u_int32_t	ast_tx_altrate;	/* tx frames with alternate rate */
+	u_int32_t	ast_tx_protect;	/* tx frames with protection */
+	u_int32_t	ast_rx_nombuf;	/* rx setup failed 'cuz no mbuf */
+	u_int32_t	ast_rx_busdma;	/* rx setup failed for dma resrcs */
+	u_int32_t	ast_rx_orn;	/* rx failed 'cuz of desc overrun */
+	u_int32_t	ast_rx_crcerr;	/* rx failed 'cuz of bad CRC */
+	u_int32_t	ast_rx_fifoerr;	/* rx failed 'cuz of FIFO overrun */
+	u_int32_t	ast_rx_badcrypt;/* rx failed 'cuz decryption */
+	u_int32_t	ast_rx_phyerr;	/* rx failed 'cuz of PHY err */
+	u_int32_t	ast_rx_phy[32];	/* rx PHY error per-code counts */
+	u_int32_t	ast_rx_tooshort;/* rx discarded 'cuz frame too short */
+	u_int32_t	ast_rx_toobig;	/* rx discarded 'cuz frame too large */
+	u_int32_t	ast_rx_ctl;	/* rx discarded 'cuz ctl frame */
+	u_int32_t	ast_be_nombuf;	/* beacon setup failed 'cuz no mbuf */
+	u_int32_t	ast_per_cal;	/* periodic calibration calls */
+	u_int32_t	ast_per_calfail;/* periodic calibration failed */
+	u_int32_t	ast_per_rfgain;	/* periodic calibration rfgain reset */
+	u_int32_t	ast_rate_calls;	/* rate control checks */
+	u_int32_t	ast_rate_raise;	/* rate control raised xmit rate */
+	u_int32_t	ast_rate_drop;	/* rate control dropped xmit rate */
+};
+
+#define	SIOCGATHSTATS	_IOWR('i', 137, struct ifreq)
+
+struct ath_diag {
+	char	ad_name[IFNAMSIZ];	/* if name, e.g. "ath0" */
+	u_int16_t ad_id;
+#define	ATH_DIAG_DYN	0x8000		/* allocate buffer in caller */
+#define	ATH_DIAG_IN	0x4000		/* copy in parameters */
+#define	ATH_DIAG_OUT	0x0000		/* copy out results (always) */
+#define	ATH_DIAG_ID	0x0fff
+	u_int16_t ad_in_size;		/* pack to fit, yech */
+	caddr_t	ad_in_data;
+	caddr_t	ad_out_data;
+	u_int	ad_out_size;
+
+};
+
+#define	SIOCGATHDIAG	_IOWR('i', 138, struct ath_diag)
+
+/*
+ * Radio capture format.
+ */
+#define ATH_RX_RADIOTAP_PRESENT (		\
+	(1 << IEEE80211_RADIOTAP_FLAGS)		| \
+	(1 << IEEE80211_RADIOTAP_RATE)		| \
+	(1 << IEEE80211_RADIOTAP_CHANNEL)	| \
+	(1 << IEEE80211_RADIOTAP_ANTENNA)	| \
+	(1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)	| \
+	0)
+
+struct ath_rx_radiotap_header {
+	struct ieee80211_radiotap_header wr_ihdr;
+	u_int8_t	wr_flags;		/* XXX for padding */
+	u_int8_t	wr_rate;
+	u_int16_t	wr_chan_freq;
+	u_int16_t	wr_chan_flags;
+	u_int8_t	wr_antenna;
+	u_int8_t	wr_antsignal;
+};
+
+#define ATH_TX_RADIOTAP_PRESENT (		\
+	(1 << IEEE80211_RADIOTAP_FLAGS)		| \
+	(1 << IEEE80211_RADIOTAP_RATE)		| \
+	(1 << IEEE80211_RADIOTAP_CHANNEL)	| \
+	(1 << IEEE80211_RADIOTAP_DBM_TX_POWER)	| \
+	(1 << IEEE80211_RADIOTAP_ANTENNA)	| \
+	0)
+
+struct ath_tx_radiotap_header {
+	struct ieee80211_radiotap_header wt_ihdr;
+	u_int8_t	wt_flags;		/* XXX for padding */
+	u_int8_t	wt_rate;
+	u_int16_t	wt_chan_freq;
+	u_int16_t	wt_chan_flags;
+	u_int8_t	wt_txpower;
+	u_int8_t	wt_antenna;
+};
+
+/* 
+ * driver-specific node 
+ */
+struct ath_node {
+	struct ieee80211_node an_node;	/* base class */
+	u_int		an_tx_ok;	/* tx ok pkt */
+	u_int		an_tx_err;	/* tx !ok pkt */
+	u_int		an_tx_retr;	/* tx retry count */
+	int		an_tx_upper;	/* tx upper rate req cnt */
+	u_int		an_tx_antenna;	/* antenna for last good frame */
+	u_int		an_rx_antenna;	/* antenna for last rcvd frame */
+	struct ath_recv_hist an_rx_hist[ATH_RHIST_SIZE];
+	u_int		an_rx_hist_next;/* index of next ``free entry'' */
+};
+#define	ATH_NODE(_n)	((struct ath_node *)(_n))
+
+struct ath_buf {
+	TAILQ_ENTRY(ath_buf)	bf_list;
+	bus_dmamap_t		bf_dmamap;	/* DMA map of the buffer */
+#ifdef __FreeBSD__
+	int			bf_nseg;
+	bus_dma_segment_t	bf_segs[ATH_MAX_SCATTER];
+	bus_size_t		bf_mapsize;
+#else
+#define bf_nseg		bf_dmamap->dm_nsegs
+#define bf_mapsize	bf_dmamap->dm_mapsize
+#define bf_segs		bf_dmamap->dm_segs
+#endif
+	struct ath_desc		*bf_desc;	/* virtual addr of desc */
+	bus_addr_t		bf_daddr;	/* physical addr of desc */
+	struct mbuf		*bf_m;		/* mbuf for buf */
+	struct ieee80211_node	*bf_node;	/* pointer to the node */
+#define	ATH_MAX_SCATTER		64
+};
+
+typedef struct ath_task {
+	void	(*t_func)(void*, int);
+	void	*t_context;
+} ath_task_t;
+
+struct ath_softc {
+#ifndef __FreeBSD__
+	struct device		sc_dev;
+#endif
+	struct ieee80211com	sc_ic;		/* IEEE 802.11 common */
+#ifndef __FreeBSD__
+	int			(*sc_enable)(struct ath_softc *);
+	void			(*sc_disable)(struct ath_softc *);
+	void			(*sc_power)(struct ath_softc *, int);
+#endif
+	int			(*sc_newstate)(struct ieee80211com *,
+					enum ieee80211_state, int);
+	void 			(*sc_node_free)(struct ieee80211com *,
+					struct ieee80211_node *);
+	void			(*sc_node_copy)(struct ieee80211com *,
+					struct ieee80211_node *,
+					const struct ieee80211_node *);
+	void			(*sc_recv_mgmt)(struct ieee80211com *,
+				    struct mbuf *, struct ieee80211_node *,
+				    int, int, u_int32_t);
+#ifdef __FreeBSD__
+	device_t		sc_dev;
+#endif
+	bus_space_tag_t		sc_st;		/* bus space tag */
+	bus_space_handle_t	sc_sh;		/* bus space handle */
+	bus_dma_tag_t		sc_dmat;	/* bus DMA tag */
+#ifdef __FreeBSD__
+	struct mtx		sc_mtx;		/* master lock (recursive) */
+#endif
+	struct ath_hal		*sc_ah;		/* Atheros HAL */
+	unsigned int		sc_invalid  : 1,/* disable hardware accesses */
+				sc_doani    : 1,/* dynamic noise immunity */
+				sc_probing  : 1;/* probing AP on beacon miss */
+						/* rate tables */
+	const HAL_RATE_TABLE	*sc_rates[IEEE80211_MODE_MAX];
+	const HAL_RATE_TABLE	*sc_currates;	/* current rate table */
+	enum ieee80211_phymode	sc_curmode;	/* current phy mode */
+	u_int8_t		sc_rixmap[256];	/* IEEE to h/w rate table ix */
+	u_int8_t		sc_hwmap[32];	/* h/w rate ix to IEEE table */
+	HAL_INT			sc_imask;	/* interrupt mask copy */
+
+#ifdef __FreeBSD__
+	struct bpf_if		*sc_drvbpf;
+#else
+	caddr_t			sc_drvbpf;
+#endif
+	union {
+		struct ath_tx_radiotap_header th;
+		u_int8_t	pad[64];
+	} u_tx_rt;
+	int			sc_tx_th_len;
+	union {
+		struct ath_rx_radiotap_header th;
+		u_int8_t	pad[64];
+	} u_rx_rt;
+	int			sc_rx_th_len;
+
+	struct ath_desc		*sc_desc;	/* TX/RX descriptors */
+	bus_dma_segment_t	sc_dseg;
+#ifndef __NetBSD__
+	int			sc_dnseg;	/* number of segments */
+#endif
+	bus_dmamap_t		sc_ddmamap;	/* DMA map for descriptors */
+	bus_addr_t		sc_desc_paddr;	/* physical addr of sc_desc */
+	bus_addr_t		sc_desc_len;	/* size of sc_desc */
+
+	ath_task_t		sc_fataltask;	/* fatal int processing */
+	ath_task_t		sc_rxorntask;	/* rxorn int processing */
+
+	TAILQ_HEAD(, ath_buf)	sc_rxbuf;	/* receive buffer */
+	u_int32_t		*sc_rxlink;	/* link ptr in last RX desc */
+	ath_task_t		sc_rxtask;	/* rx int processing */
+
+	u_int			sc_txhalq;	/* HAL q for outgoing frames */
+	u_int32_t		*sc_txlink;	/* link ptr in last TX desc */
+	int			sc_tx_timer;	/* transmit timeout */
+	TAILQ_HEAD(, ath_buf)	sc_txbuf;	/* transmit buffer */
+#ifdef __FreeBSD__
+	struct mtx		sc_txbuflock;	/* txbuf lock */
+#endif
+	TAILQ_HEAD(, ath_buf)	sc_txq;		/* transmitting queue */
+#ifdef __FreeBSD__
+	struct mtx		sc_txqlock;	/* lock on txq and txlink */
+#endif
+	ath_task_t		sc_txtask;	/* tx int processing */
+
+	u_int			sc_bhalq;	/* HAL q for outgoing beacons */
+	struct ath_buf		*sc_bcbuf;	/* beacon buffer */
+	struct ath_buf		*sc_bufptr;	/* allocated buffer ptr */
+	ath_task_t		sc_swbatask;	/* swba int processing */
+	ath_task_t		sc_bmisstask;	/* bmiss int processing */
+
+#ifdef __OpenBSD__
+	struct timeval		sc_last_ch;	
+	struct timeout		sc_cal_to;	
+	struct timeval		sc_last_beacon;	
+        struct timeout		sc_scan_to;
+#else
+	struct callout		sc_cal_ch;	/* callout handle for cals */
+	struct callout		sc_scan_ch;	/* callout handle for scan */
+#endif
+	struct ath_stats	sc_stats;	/* interface statistics */
+
+#ifndef __FreeBSD__
+	void			*sc_sdhook;	/* shutdown hook */
+	void			*sc_powerhook;	/* power management hook */
+	u_int			sc_flags;	/* misc flags */
+#endif
+
+        u_int8_t                sc_broadcast_addr[IEEE80211_ADDR_LEN];
+};
+
+/*
+ * Wrapper code
+ */
+#ifndef __FreeBSD__
+#undef KASSERT
+#define KASSERT(cond, complaint) if (!(cond)) panic complaint
+
+#define	ATH_ATTACHED		0x0001		/* attach has succeeded */
+#define ATH_ENABLED		0x0002		/* chip is enabled */
+
+#define	ATH_IS_ENABLED(sc)	((sc)->sc_flags & ATH_ENABLED)
+#endif
+
+#define	sc_tx_th		u_tx_rt.th
+#define	sc_rx_th		u_rx_rt.th
+
+#define	ATH_LOCK_INIT(_sc) \
+	mtx_init(&(_sc)->sc_mtx, device_get_nameunit((_sc)->sc_dev), \
+		 MTX_NETWORK_LOCK, MTX_DEF | MTX_RECURSE)
+#define	ATH_LOCK_DESTROY(_sc)	mtx_destroy(&(_sc)->sc_mtx)
+#define	ATH_LOCK(_sc)		mtx_lock(&(_sc)->sc_mtx)
+#define	ATH_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_mtx)
+#define	ATH_LOCK_ASSERT(_sc)	mtx_assert(&(_sc)->sc_mtx, MA_OWNED)
+
+#define	ATH_TXBUF_LOCK_INIT(_sc) \
+	mtx_init(&(_sc)->sc_txbuflock, \
+		device_get_nameunit((_sc)->sc_dev), "xmit buf q", MTX_DEF)
+#define	ATH_TXBUF_LOCK_DESTROY(_sc)	mtx_destroy(&(_sc)->sc_txbuflock)
+#define	ATH_TXBUF_LOCK(_sc)		mtx_lock(&(_sc)->sc_txbuflock)
+#define	ATH_TXBUF_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_txbuflock)
+#define	ATH_TXBUF_LOCK_ASSERT(_sc) \
+	mtx_assert(&(_sc)->sc_txbuflock, MA_OWNED)
+
+#define	ATH_TXQ_LOCK_INIT(_sc) \
+	mtx_init(&(_sc)->sc_txqlock, \
+		device_get_nameunit((_sc)->sc_dev), "xmit q", MTX_DEF)
+#define	ATH_TXQ_LOCK_DESTROY(_sc)	mtx_destroy(&(_sc)->sc_txqlock)
+#define	ATH_TXQ_LOCK(_sc)		mtx_lock(&(_sc)->sc_txqlock)
+#define	ATH_TXQ_UNLOCK(_sc)		mtx_unlock(&(_sc)->sc_txqlock)
+#define	ATH_TXQ_LOCK_ASSERT(_sc)	mtx_assert(&(_sc)->sc_txqlock, MA_OWNED)
+
+#define ATH_TICKS() (ticks)
+#define ATH_CALLOUT_INIT(chp) callout_init((chp))
+#define ATH_TASK_INIT(task, func, context)	\
+	do {					\
+		(task)->t_func = (func);	\
+		(task)->t_context = (context);	\
+	} while (0)
+#define ATH_TASK_RUN_OR_ENQUEUE(task) ((*(task)->t_func)((task)->t_context, 1))
+
+typedef unsigned long u_intptr_t;
+
+int	ath_attach(u_int16_t, struct ath_softc *);
+int	ath_detach(struct ath_softc *);
+void	ath_resume(struct ath_softc *, int);
+void	ath_suspend(struct ath_softc *, int);
+#ifdef __NetBSD__
+int	ath_activate(struct device *, enum devact);
+void	ath_power(int, void *);
+#endif
+#ifdef __FreeBSD__
+void	ath_shutdown(struct ath_softc *);
+void	ath_intr(void *);
+#else
+void	ath_shutdown(void *);
+int	ath_intr(void *);
+#endif
+
+/*
+ * HAL definitions to comply with local coding convention.
+ */
+#define	ath_hal_reset(_ah, _opmode, _chan, _outdoor, _pstatus) \
+	((*(_ah)->ah_reset)((_ah), (_opmode), (_chan), (_outdoor), (_pstatus)))
+#define	ath_hal_getratetable(_ah, _mode) \
+	((*(_ah)->ah_getRateTable)((_ah), (_mode)))
+#define	ath_hal_getmac(_ah, _mac) \
+	((*(_ah)->ah_getMacAddress)((_ah), (_mac)))
+#define	ath_hal_setmac(_ah, _mac) \
+	((*(_ah)->ah_setMacAddress)((_ah), (_mac)))
+#define	ath_hal_intrset(_ah, _mask) \
+	((*(_ah)->ah_setInterrupts)((_ah), (_mask)))
+#define	ath_hal_intrget(_ah) \
+	((*(_ah)->ah_getInterrupts)((_ah)))
+#define	ath_hal_intrpend(_ah) \
+	((*(_ah)->ah_isInterruptPending)((_ah)))
+#define	ath_hal_getisr(_ah, _pmask) \
+	((*(_ah)->ah_getPendingInterrupts)((_ah), (_pmask)))
+#define	ath_hal_updatetxtriglevel(_ah, _inc) \
+	((*(_ah)->ah_updateTxTrigLevel)((_ah), (_inc)))
+#define	ath_hal_setpower(_ah, _mode, _sleepduration) \
+	((*(_ah)->ah_setPowerMode)((_ah), (_mode), AH_TRUE, (_sleepduration)))
+#define	ath_hal_keyreset(_ah, _ix) \
+	((*(_ah)->ah_resetKeyCacheEntry)((_ah), (_ix)))
+#define	ath_hal_keyset(_ah, _ix, _pk) \
+	((*(_ah)->ah_setKeyCacheEntry)((_ah), (_ix), (_pk), NULL, AH_FALSE))
+#define	ath_hal_keyisvalid(_ah, _ix) \
+	(((*(_ah)->ah_isKeyCacheEntryValid)((_ah), (_ix))))
+#define	ath_hal_keysetmac(_ah, _ix, _mac) \
+	((*(_ah)->ah_setKeyCacheEntryMac)((_ah), (_ix), (_mac)))
+#define	ath_hal_getrxfilter(_ah) \
+	((*(_ah)->ah_getRxFilter)((_ah)))
+#define	ath_hal_setrxfilter(_ah, _filter) \
+	((*(_ah)->ah_setRxFilter)((_ah), (_filter)))
+#define	ath_hal_setmcastfilter(_ah, _mfilt0, _mfilt1) \
+	((*(_ah)->ah_setMulticastFilter)((_ah), (_mfilt0), (_mfilt1)))
+#define	ath_hal_waitforbeacon(_ah, _bf) \
+	((*(_ah)->ah_waitForBeaconDone)((_ah), (_bf)->bf_daddr))
+#define	ath_hal_putrxbuf(_ah, _bufaddr) \
+	((*(_ah)->ah_setRxDP)((_ah), (_bufaddr)))
+#define	ath_hal_gettsf32(_ah) \
+	((*(_ah)->ah_getTsf32)((_ah)))
+#define	ath_hal_gettsf64(_ah) \
+	((*(_ah)->ah_getTsf64)((_ah)))
+#define	ath_hal_resettsf(_ah) \
+	((*(_ah)->ah_resetTsf)((_ah)))
+#define	ath_hal_rxena(_ah) \
+	((*(_ah)->ah_enableReceive)((_ah)))
+#define	ath_hal_puttxbuf(_ah, _q, _bufaddr) \
+	((*(_ah)->ah_setTxDP)((_ah), (_q), (_bufaddr)))
+#define	ath_hal_gettxbuf(_ah, _q) \
+	((*(_ah)->ah_getTxDP)((_ah), (_q)))
+#define	ath_hal_getrxbuf(_ah) \
+	((*(_ah)->ah_getRxDP)((_ah)))
+#define	ath_hal_txstart(_ah, _q) \
+	((*(_ah)->ah_startTxDma)((_ah), (_q)))
+#define	ath_hal_setchannel(_ah, _chan) \
+	((*(_ah)->ah_setChannel)((_ah), (_chan)))
+#define	ath_hal_calibrate(_ah, _chan) \
+	((*(_ah)->ah_perCalibration)((_ah), (_chan)))
+#define	ath_hal_setledstate(_ah, _state) \
+	((*(_ah)->ah_setLedState)((_ah), (_state)))
+#define	ath_hal_beaconinit(_ah, _nextb, _bperiod) \
+	((*(_ah)->ah_beaconInit)((_ah), (_nextb), (_bperiod)))
+#define	ath_hal_beaconreset(_ah) \
+	((*(_ah)->ah_resetStationBeaconTimers)((_ah)))
+#define	ath_hal_beacontimers(_ah, _bs, _tsf, _dc, _cc) \
+	((*(_ah)->ah_setStationBeaconTimers)((_ah), (_bs), (_tsf), \
+		(_dc), (_cc)))
+#define	ath_hal_setassocid(_ah, _bss, _associd) \
+	((*(_ah)->ah_writeAssocid)((_ah), (_bss), (_associd), 0))
+#define	ath_hal_getregdomain(_ah, _prd) \
+	(*(_prd) = (_ah)->ah_getRegDomain(_ah))
+#define	ath_hal_getcountrycode(_ah, _pcc) \
+	(*(_pcc) = (_ah)->ah_countryCode)
+#define	ath_hal_detach(_ah) \
+	((*(_ah)->ah_detach)(_ah))
+
+#ifdef SOFTLED
+#define ath_hal_gpioCfgOutput(_ah, _gpio) \
+        ((*(_ah)->ah_gpioCfgOutput)((_ah), (_gpio)))
+#define ath_hal_gpioCfgInput(_ah, _gpio) \
+        ((*(_ah)->ah_gpioCfgInput)((_ah), (_gpio)))
+#define ath_hal_gpioGet(_ah, _gpio) \
+        ((*(_ah)->ah_gpioGet)((_ah), (_gpio)))
+#define ath_hal_gpioSet(_ah, _gpio, _b) \
+        ((*(_ah)->ah_gpioSet)((_ah), (_gpio), (_b)))
+#define ath_hal_gpioSetIntr(_ah, _gpioSel, _b) \
+        ((*(_ah)->ah_gpioSetIntr)((_ah), (_sel), (_b)))
+#endif
+
+#define	ath_hal_setopmode(_ah) \
+	((*(_ah)->ah_setPCUConfig)((_ah)))
+#define	ath_hal_stoptxdma(_ah, _qnum) \
+	((*(_ah)->ah_stopTxDma)((_ah), (_qnum)))
+#define	ath_hal_stoppcurecv(_ah) \
+	((*(_ah)->ah_stopPcuReceive)((_ah)))
+#define	ath_hal_startpcurecv(_ah) \
+	((*(_ah)->ah_startPcuReceive)((_ah)))
+#define	ath_hal_stopdmarecv(_ah) \
+	((*(_ah)->ah_stopDmaReceive)((_ah)))
+#define	ath_hal_getdiagstate(_ah, _id, _indata, _insize, _outdata, _outsize) \
+	((*(_ah)->ah_getDiagState)((_ah), (_id), \
+		(_indata), (_insize), (_outdata), (_outsize)))
+
+#define	ath_hal_setuptxqueue(_ah, _type, _qinfo) \
+	((*(_ah)->ah_setupTxQueue)((_ah), (_type), (_qinfo)))
+#define	ath_hal_resettxqueue(_ah, _q) \
+	((*(_ah)->ah_resetTxQueue)((_ah), (_q)))
+#define	ath_hal_releasetxqueue(_ah, _q) \
+	((*(_ah)->ah_releaseTxQueue)((_ah), (_q)))
+#define	ath_hal_hasveol(_ah) \
+	((*(_ah)->ah_hasVEOL)((_ah)))
+#define	ath_hal_getrfgain(_ah) \
+	((*(_ah)->ah_getRfGain)((_ah)))
+#define	ath_hal_rxmonitor(_ah) \
+	((*(_ah)->ah_rxMonitor)((_ah)))
+
+#define	ath_hal_setuprxdesc(_ah, _ds, _size, _intreq) \
+	((*(_ah)->ah_setupRxDesc)((_ah), (_ds), (_size), (_intreq)))
+#define	ath_hal_rxprocdesc(_ah, _ds, _dspa, _dsnext) \
+	((*(_ah)->ah_procRxDesc)((_ah), (_ds), (_dspa), (_dsnext)))
+#define	ath_hal_setuptxdesc(_ah, _ds, _plen, _hlen, _atype, _txpow, \
+		_txr0, _txtr0, _keyix, _ant, _flags, \
+		_rtsrate, _rtsdura) \
+	((*(_ah)->ah_setupTxDesc)((_ah), (_ds), (_plen), (_hlen), (_atype), \
+		(_txpow), (_txr0), (_txtr0), (_keyix), (_ant), \
+		(_flags), (_rtsrate), (_rtsdura)))
+#define	ath_hal_setupxtxdesc(_ah, _ds, \
+		_txr1, _txtr1, _txr2, _txtr2, _txr3, _txtr3) \
+	((*(_ah)->ah_setupXTxDesc)((_ah), (_ds), \
+		(_txr1), (_txtr1), (_txr2), (_txtr2), (_txr3), (_txtr3)))
+#define	ath_hal_filltxdesc(_ah, _ds, _l, _first, _last) \
+	((*(_ah)->ah_fillTxDesc)((_ah), (_ds), (_l), (_first), (_last)))
+#define	ath_hal_txprocdesc(_ah, _ds) \
+	((*(_ah)->ah_procTxDesc)((_ah), (_ds)))
+
+#endif /* _DEV_ATH_ATHVAR_H */
diff --git a/sys/dev/pci/files.pci b/sys/dev/pci/files.pci
index 845339842c7..01bcba8a9e4 100644
--- a/sys/dev/pci/files.pci
+++ b/sys/dev/pci/files.pci
@@ -1,4 +1,4 @@
-#	$OpenBSD: files.pci,v 1.160 2004/10/20 12:50:48 deraadt Exp $
+#	$OpenBSD: files.pci,v 1.161 2004/11/02 02:45:37 reyk Exp $
 #	$NetBSD: files.pci,v 1.20 1996/09/24 17:47:15 christos Exp $
 #
 # Config file and device description for machine-independent PCI code.
@@ -506,6 +506,10 @@ device	bce: ether, ifnet, mii, ifmedia, mii_phy
 attach	bce at pci
 file	dev/pci/if_bce.c		bce
 
+# Atheros AR5k (802.11a/b/g) PCI/Mini-PCI
+attach	ath at pci with ath_pci
+file	dev/pci/if_ath_pci.c		ath_pci
+
 # ADMtek ADM8211 PCI/Mini-PCI
 attach	atw at pci with atw_pci
 file	dev/pci/if_atw_pci.c		atw_pci
diff --git a/sys/dev/pci/if_ath_pci.c b/sys/dev/pci/if_ath_pci.c
new file mode 100644
index 00000000000..c760144f632
--- /dev/null
+++ b/sys/dev/pci/if_ath_pci.c
@@ -0,0 +1,250 @@
+/*      $OpenBSD: if_ath_pci.c,v 1.1 2004/11/02 02:45:37 reyk Exp $   */
+/*	$NetBSD: if_ath_pci.c,v 1.7 2004/06/30 05:58:17 mycroft Exp $	*/
+
+/*-
+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * Alternatively, this software may be distributed under the terms of the
+ * GNU General Public License ("GPL") version 2 as published by the Free
+ * Software Foundation.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+/*
+ * PCI/Cardbus front-end for the Atheros Wireless LAN controller driver.
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h> 
+#include <sys/mbuf.h>   
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/lock.h>
+#include <sys/socket.h>
+#include <sys/sockio.h>
+#include <sys/errno.h>
+#include <sys/device.h>
+
+#include <machine/bus.h>
+ 
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <net/if_media.h>
+#include <net/if_llc.h>
+#include <net/if_arp.h>
+#ifdef INET
+#include <netinet/in.h> 
+#include <netinet/if_ether.h>
+#endif
+
+#include <net80211/ieee80211_compat.h>
+#include <net80211/ieee80211_var.h>
+
+#include <dev/ic/athvar.h>
+
+#include <dev/pci/pcivar.h>
+#include <dev/pci/pcireg.h>
+#include <dev/pci/pcidevs.h>
+
+#include <sys/device.h>
+
+/*
+ * PCI glue.
+ */
+
+struct ath_pci_softc {
+	struct ath_softc	sc_sc;
+#ifdef __FreeBSD__
+	struct resource		*sc_sr;		/* memory resource */
+	struct resource		*sc_irq;	/* irq resource */
+#else
+	pci_chipset_tag_t	sc_pc;
+#endif
+	void			*sc_ih;		/* intererupt handler */
+	u_int8_t		sc_saved_intline;
+	u_int8_t		sc_saved_cachelinesz;
+	u_int8_t		sc_saved_lattimer;
+};
+
+#define	BS_BAR	0x10
+
+int ath_pci_match(struct device *, void *, void *);
+void ath_pci_attach(struct device *, struct device *, void *);
+void ath_pci_shutdown(void *);
+int ath_pci_detach(struct device *, int);
+u_int16_t ath_product(pcireg_t);
+
+struct cfattach ath_pci_ca = {
+	sizeof (struct ath_softc), 
+	ath_pci_match,
+	ath_pci_attach, 
+	ath_pci_detach
+};
+struct cfdriver ath_cd = {
+	0, "ath", DV_IFNET
+};
+
+/*
+ * translate some product code.  it is a workaround until HAL gets updated.
+ */
+u_int16_t
+ath_product(pcireg_t pa_id)
+{
+	u_int16_t prodid;
+
+	prodid = PCI_PRODUCT(pa_id);
+	switch (prodid) {
+	case 0x1014:	/* IBM 31P9702 minipci a/b/g card */
+		prodid = PCI_PRODUCT_ATHEROS_AR5212;
+		break;
+	default:
+		break;
+	}
+	return prodid;
+}
+
+int
+ath_pci_match(struct device *parent, void *match, void *aux)
+{
+	const char* devname;
+	struct pci_attach_args *pa = aux;
+	pci_vendor_id_t vendor;
+
+	vendor = PCI_VENDOR(pa->pa_id);
+	/* XXX HACK until HAL is updated. */
+	if (vendor == 0x128c)
+		vendor = PCI_VENDOR_ATHEROS;
+	devname = ath_hal_probe(vendor, ath_product(pa->pa_id));
+	if (devname) 
+		return 1;
+
+	return 0;
+}
+
+void
+ath_pci_attach(struct device *parent, struct device *self, void *aux)
+{
+	struct ath_pci_softc *psc = (struct ath_pci_softc *)self;
+	struct ath_softc *sc = &psc->sc_sc;
+	u_int32_t res;
+	struct pci_attach_args *pa = aux;
+	pci_chipset_tag_t pc = pa->pa_pc;
+	bus_space_tag_t iot;
+	bus_space_handle_t ioh;
+	pci_intr_handle_t ih;
+	void *hook;
+	const char *intrstr = NULL;
+
+	psc->sc_pc = pc;
+
+	pci_conf_write(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG,
+	    pci_conf_read(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG) |
+	        PCI_COMMAND_MASTER_ENABLE | PCI_COMMAND_MEM_ENABLE);
+	res = pci_conf_read(pc, pa->pa_tag, PCI_COMMAND_STATUS_REG);
+
+	if ((res & PCI_COMMAND_MEM_ENABLE) == 0) {
+		printf(": couldn't enable memory mapping\n");
+		goto bad;
+	}
+
+	if ((res & PCI_COMMAND_MASTER_ENABLE) == 0) {
+		printf(": couldn't enable bus mastering\n");
+		goto bad;
+	}
+
+	/* 
+	 * Setup memory-mapping of PCI registers.
+	 */
+	if (pci_mapreg_map(pa, BS_BAR, PCI_MAPREG_TYPE_MEM, 0, &iot, &ioh, 
+	    NULL, NULL, 0)) {
+		printf(": cannot map register space\n");
+		goto bad;
+	}
+	sc->sc_st = iot;
+	sc->sc_sh = ioh;
+
+	sc->sc_invalid = 1;
+
+	/*
+	 * Arrange interrupt line.
+	 */
+	if (pci_intr_map(pa, &ih)) {
+		printf(": couldn't map interrupt\n");
+		goto bad1;
+	}
+
+	intrstr = pci_intr_string(pc, ih); 
+	psc->sc_ih = pci_intr_establish(pc, ih, IPL_NET, ath_intr, sc,
+					sc->sc_dev.dv_xname);
+	if (psc->sc_ih == NULL) {
+		printf(": couldn't map interrupt\n");
+		goto bad2;
+	}
+
+	printf(": %s\n", intrstr);
+
+	sc->sc_dmat = pa->pa_dmat;
+
+	hook = shutdownhook_establish(ath_pci_shutdown, psc);
+	if (hook == NULL) {
+		printf(": couldn't make shutdown hook\n");
+		goto bad3;
+	}
+
+	if (ath_attach(ath_product(pa->pa_id), sc) == 0)
+		return;
+
+	shutdownhook_disestablish(hook);
+
+bad3:	pci_intr_disestablish(pc, psc->sc_ih);
+bad2:	/* XXX */
+bad1:	/* XXX */
+bad:
+	return;
+}
+
+int
+ath_pci_detach(struct device *self, int flags)
+{
+	struct ath_pci_softc *psc = (struct ath_pci_softc *)self;
+
+	ath_detach(&psc->sc_sc);
+	pci_intr_disestablish(psc->sc_pc, psc->sc_ih);
+
+	return (0);
+}
+
+void
+ath_pci_shutdown(void *self)
+{
+	struct ath_pci_softc *psc = (struct ath_pci_softc *)self;
+
+	ath_shutdown(&psc->sc_sc);
+}