fix beacon handling

8 files changed, 226 insertions, 90 deletions

diff --git a/sys/dev/ic/ar5210.c b/sys/dev/ic/ar5210.c
index f4a8f23c811..5ef33368436 100644
--- a/sys/dev/ic/ar5210.c
+++ b/sys/dev/ic/ar5210.c
@@ -1,4 +1,4 @@
-/*     $OpenBSD: ar5210.c,v 1.13 2005/02/17 23:52:05 reyk Exp $        */
+/*     $OpenBSD: ar5210.c,v 1.14 2005/03/10 08:30:55 reyk Exp $        */
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -207,7 +207,7 @@ ar5k_ar5210_attach(device, sc, st, sh, status)
 	hal->ah_radio = AR5K_AR5110;
 	hal->ah_phy = AR5K_AR5210_PHY(0);
 
-	memset(&mac, 0xff, sizeof(mac));
+	bcopy(etherbroadcastaddr, mac, IEEE80211_ADDR_LEN);
 	ar5k_ar5210_writeAssocid(hal, mac, 0, 0);
 	ar5k_ar5210_getMacAddress(hal, mac);
 	ar5k_ar5210_setPCUConfig(hal);
@@ -484,8 +484,8 @@ ar5k_ar5210_setPCUConfig(hal)
 	/*
 	 * Set PCU and BCR registers
 	 */
-	memcpy(&low_id, &(hal->ah_sta_id[0]), 4);
-	memcpy(&high_id, &(hal->ah_sta_id[4]), 2);
+	bcopy(&(hal->ah_sta_id[0]), &low_id, 4);
+	bcopy(&(hal->ah_sta_id[4]), &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5210_STA_ID0, low_id);
 	AR5K_REG_WRITE(AR5K_AR5210_STA_ID1, pcu_reg | high_id);
 	AR5K_REG_WRITE(AR5K_AR5210_BCR, beacon_reg);
@@ -1087,7 +1087,7 @@ ar5k_ar5210_fillTxDesc(hal, desc, segment_length, first_segment, last_segment)
 	tx_desc = (struct ar5k_ar5210_tx_desc*)&desc->ds_ctl0;
 
 	/* Clear status descriptor */
-	desc->ds_hw[0] = desc->ds_hw[1] = 0;
+	bzero(desc->ds_hw, sizeof(desc->ds_hw));
 
 	/* Validate segment length and initialize the descriptor */
 	if ((tx_desc->buf_len = segment_length) != segment_length)
@@ -1519,7 +1519,7 @@ ar5k_ar5210_getMacAddress(hal, mac)
 	struct ath_hal *hal;
 	u_int8_t *mac;
 {
-	memcpy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
+	bcopy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
 }
 
 HAL_BOOL
@@ -1530,10 +1530,10 @@ ar5k_ar5210_setMacAddress(hal, mac)
 	u_int32_t low_id, high_id;
 
 	/* Set new station ID */
-	memcpy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
+	bcopy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
 
-	memcpy(&low_id, mac, 4);
-	memcpy(&high_id, mac + 4, 2);
+	bcopy(mac, &low_id, 4);
+	bcopy(mac + 4, &high_id, 2);
 	high_id = 0x0000ffff & htole32(high_id);
 
 	AR5K_REG_WRITE(AR5K_AR5210_STA_ID0, htole32(low_id));
@@ -1609,12 +1609,12 @@ ar5k_ar5210_writeAssocid(hal, bssid, assoc_id, tim_offset)
 	/*
 	 * Set BSSID which triggers the "SME Join" operation
 	 */
-	memcpy(&low_id, bssid, 4);
-	memcpy(&high_id, bssid + 4, 2);
-	memcpy(&hal->ah_bssid, bssid, IEEE80211_ADDR_LEN);
+	bcopy(bssid, &low_id, 4);
+	bcopy(bssid + 4, &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5210_BSS_ID0, htole32(low_id));
 	AR5K_REG_WRITE(AR5K_AR5210_BSS_ID1, htole32(high_id) |
 	    ((assoc_id & 0x3fff) << AR5K_AR5210_BSS_ID1_AID_S));
+	bcopy(bssid, &hal->ah_bssid, IEEE80211_ADDR_LEN);
 
 	if (assoc_id == 0) {
 		ar5k_ar5210_disablePSPoll(hal);
diff --git a/sys/dev/ic/ar5211.c b/sys/dev/ic/ar5211.c
index ff125d7717e..a4840457557 100644
--- a/sys/dev/ic/ar5211.c
+++ b/sys/dev/ic/ar5211.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5211.c,v 1.2 2005/03/03 16:39:54 reyk Exp $	*/
+/*	$OpenBSD: ar5211.c,v 1.3 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -212,7 +212,7 @@ ar5k_ar5211_attach(device, sc, st, sh, status)
 	hal->ah_radio = AR5K_AR5111;
 	hal->ah_phy = AR5K_AR5211_PHY(0);
 
-	memset(&mac, 0xff, sizeof(mac));
+	bcopy(etherbroadcastaddr, mac, IEEE80211_ADDR_LEN);
 	ar5k_ar5211_writeAssocid(hal, mac, 0, 0);
 	ar5k_ar5211_getMacAddress(hal, mac);
 	ar5k_ar5211_setPCUConfig(hal);
@@ -534,7 +534,7 @@ ar5k_ar5211_reset(hal, op_mode, channel, change_channel, status)
 	    ee->ee_q_cal[ee_mode]);
 
 	/* Misc */
-	memset(&mac, 0xff, sizeof(mac));
+	bcopy(etherbroadcastaddr, mac, IEEE80211_ADDR_LEN);
 	ar5k_ar5211_writeAssocid(hal, mac, 0, 0);
 	ar5k_ar5211_setPCUConfig(hal);
 	AR5K_REG_WRITE(AR5K_AR5211_PISR, 0xffffffff);
@@ -640,8 +640,8 @@ ar5k_ar5211_setPCUConfig(hal)
 	/*
 	 * Set PCU registers
 	 */
-	memcpy(&low_id, &(hal->ah_sta_id[0]), 4);
-	memcpy(&high_id, &(hal->ah_sta_id[4]), 2);
+	bcopy(&(hal->ah_sta_id[0]), &low_id, 4);
+	bcopy(&(hal->ah_sta_id[4]), &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5211_STA_ID0, low_id);
 	AR5K_REG_WRITE(AR5K_AR5211_STA_ID1, pcu_reg | high_id);
 
@@ -1055,6 +1055,9 @@ ar5k_ar5211_stopTxDma(hal, queue)
 	ret = ar5k_register_timeout(hal, AR5K_AR5211_QCU_STS(queue),
 	    AR5K_AR5211_QCU_STS_FRMPENDCNT, 0, AH_FALSE);
 
+	if (AR5K_REG_READ_Q(AR5K_AR5211_QCU_TXE, queue))
+		return (AH_FALSE);
+
 	/* Clear register */
 	AR5K_REG_WRITE(AR5K_AR5211_QCU_TXD, 0);
 
@@ -1134,7 +1137,7 @@ ar5k_ar5211_fillTxDesc(hal, desc, segment_length, first_segment, last_segment)
 	tx_desc = (struct ar5k_ar5211_tx_desc*)&desc->ds_ctl0;
 
 	/* Clear status descriptor */
-	desc->ds_hw[0] = desc->ds_hw[1] = 0;
+	bzero(desc->ds_hw, sizeof(desc->ds_hw));
 
 	/* Validate segment length and initialize the descriptor */
 	if ((tx_desc->buf_len = segment_length) != segment_length)
@@ -1436,8 +1439,90 @@ void
 ar5k_ar5211_dumpState(hal)
 	struct ath_hal *hal;
 {
-	/* Not used */
-	return;
+#ifdef AR5K_DEBUG
+#define AR5K_PRINT_REGISTER(_x)						\
+	printf("(%s: %08x) ", #_x, AR5K_REG_READ(AR5K_AR5211_##_x));
+
+	printf("MAC registers:\n");
+	AR5K_PRINT_REGISTER(CR);
+	AR5K_PRINT_REGISTER(CFG);
+	AR5K_PRINT_REGISTER(IER);
+	AR5K_PRINT_REGISTER(RTSD0);
+	AR5K_PRINT_REGISTER(TXCFG);
+	AR5K_PRINT_REGISTER(RXCFG);
+	AR5K_PRINT_REGISTER(RXJLA);
+	AR5K_PRINT_REGISTER(MIBC);
+	AR5K_PRINT_REGISTER(TOPS);
+	AR5K_PRINT_REGISTER(RXNOFRM);
+	AR5K_PRINT_REGISTER(RPGTO);
+	AR5K_PRINT_REGISTER(RFCNT);
+	AR5K_PRINT_REGISTER(MISC);
+	AR5K_PRINT_REGISTER(PISR);
+	AR5K_PRINT_REGISTER(SISR0);
+	AR5K_PRINT_REGISTER(SISR1);
+	AR5K_PRINT_REGISTER(SISR3);
+	AR5K_PRINT_REGISTER(SISR4);
+	AR5K_PRINT_REGISTER(QCU_TXE);
+	AR5K_PRINT_REGISTER(QCU_TXD);
+	AR5K_PRINT_REGISTER(DCU_GBL_IFS_SIFS);
+	AR5K_PRINT_REGISTER(DCU_GBL_IFS_SLOT);
+	AR5K_PRINT_REGISTER(DCU_FP);
+	AR5K_PRINT_REGISTER(DCU_TXP);
+	AR5K_PRINT_REGISTER(DCU_TX_FILTER);
+	AR5K_PRINT_REGISTER(RC);
+	AR5K_PRINT_REGISTER(SCR);
+	AR5K_PRINT_REGISTER(INTPEND);
+	AR5K_PRINT_REGISTER(PCICFG);
+	AR5K_PRINT_REGISTER(GPIOCR);
+	AR5K_PRINT_REGISTER(GPIODO);
+	AR5K_PRINT_REGISTER(SREV);
+	AR5K_PRINT_REGISTER(EEPROM_BASE);
+	AR5K_PRINT_REGISTER(EEPROM_DATA);
+	AR5K_PRINT_REGISTER(EEPROM_CMD);
+	AR5K_PRINT_REGISTER(EEPROM_CFG);
+	AR5K_PRINT_REGISTER(PCU_MIN);
+	AR5K_PRINT_REGISTER(STA_ID0);
+	AR5K_PRINT_REGISTER(STA_ID1);
+	AR5K_PRINT_REGISTER(BSS_ID0);
+	AR5K_PRINT_REGISTER(SLOT_TIME);
+	AR5K_PRINT_REGISTER(TIME_OUT);
+	AR5K_PRINT_REGISTER(RSSI_THR);
+	AR5K_PRINT_REGISTER(BEACON);
+	AR5K_PRINT_REGISTER(CFP_PERIOD);
+	AR5K_PRINT_REGISTER(TIMER0);
+	AR5K_PRINT_REGISTER(TIMER2);
+	AR5K_PRINT_REGISTER(TIMER3);
+	AR5K_PRINT_REGISTER(CFP_DUR);
+	AR5K_PRINT_REGISTER(MCAST_FIL0);
+	AR5K_PRINT_REGISTER(MCAST_FIL1);
+	AR5K_PRINT_REGISTER(DIAG_SW);
+	AR5K_PRINT_REGISTER(TSF_U32);
+	AR5K_PRINT_REGISTER(ADDAC_TEST);
+	AR5K_PRINT_REGISTER(DEFAULT_ANTENNA);
+	AR5K_PRINT_REGISTER(LAST_TSTP);
+	AR5K_PRINT_REGISTER(NAV);
+	AR5K_PRINT_REGISTER(RTS_OK);
+	AR5K_PRINT_REGISTER(ACK_FAIL);
+	AR5K_PRINT_REGISTER(FCS_FAIL);
+	AR5K_PRINT_REGISTER(BEACON_CNT);
+	AR5K_PRINT_REGISTER(KEYTABLE_0);
+	printf("\n");
+
+	printf("PHY registers:\n");
+	AR5K_PRINT_REGISTER(PHY_TURBO);
+	AR5K_PRINT_REGISTER(PHY_AGC);
+	AR5K_PRINT_REGISTER(PHY_CHIP_ID);
+	AR5K_PRINT_REGISTER(PHY_AGCCTL);
+	AR5K_PRINT_REGISTER(PHY_NF);
+	AR5K_PRINT_REGISTER(PHY_RX_DELAY);
+	AR5K_PRINT_REGISTER(PHY_IQ);
+	AR5K_PRINT_REGISTER(PHY_PAPD_PROBE);
+	AR5K_PRINT_REGISTER(PHY_FC);
+	AR5K_PRINT_REGISTER(PHY_RADAR);
+	AR5K_PRINT_REGISTER(PHY_ANT_SWITCH_TABLE_0);
+	AR5K_PRINT_REGISTER(PHY_ANT_SWITCH_TABLE_1);
+	printf("\n");
+#endif
 }
 
 HAL_BOOL
@@ -1460,7 +1545,7 @@ ar5k_ar5211_getMacAddress(hal, mac)
 	struct ath_hal *hal;
 	u_int8_t *mac;
 {
-	memcpy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
+	bcopy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
 }
 
 HAL_BOOL
@@ -1471,10 +1556,10 @@ ar5k_ar5211_setMacAddress(hal, mac)
 	u_int32_t low_id, high_id;
 
 	/* Set new station ID */
-	memcpy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
+	bcopy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
 
-	memcpy(&low_id, mac, 4);
-	memcpy(&high_id, mac + 4, 2);
+	bcopy(mac, &low_id, 4);
+	bcopy(mac + 4, &high_id, 2);
 	high_id = 0x0000ffff & htole32(high_id);
 
 	AR5K_REG_WRITE(AR5K_AR5211_STA_ID0, htole32(low_id));
@@ -1557,12 +1642,12 @@ ar5k_ar5211_writeAssocid(hal, bssid, assoc_id, tim_offset)
 	/*
 	 * Set BSSID which triggers the "SME Join" operation
 	 */
-	memcpy(&low_id, bssid, 4);
-	memcpy(&high_id, bssid + 4, 2);
+	bcopy(bssid, &low_id, 4);
+	bcopy(bssid + 4, &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5211_BSS_ID0, htole32(low_id));
 	AR5K_REG_WRITE(AR5K_AR5211_BSS_ID1, htole32(high_id) |
 	    ((assoc_id & 0x3fff) << AR5K_AR5211_BSS_ID1_AID_S));
-	memcpy(&hal->ah_bssid, bssid, IEEE80211_ADDR_LEN);
+	bcopy(bssid, hal->ah_bssid, IEEE80211_ADDR_LEN);
 
 	if (assoc_id == 0) {
 		ar5k_ar5211_disablePSPoll(hal);
@@ -2168,12 +2253,14 @@ ar5k_ar5211_setStationBeaconTimers(hal, state, tsf, dtim_count, cfp_count)
 	/*
 	 * Write new beacon miss threshold, if it appears to be valid
 	 */
-	if ((state->bs_bmiss_threshold > (AR5K_AR5211_RSSI_THR_BMISS >>
-	    AR5K_AR5211_RSSI_THR_BMISS_S)) &&
-	    (state->bs_bmiss_threshold & 0x00007) != 0) {
-		AR5K_REG_WRITE_BITS(AR5K_AR5211_RSSI_THR_M,
-		    AR5K_AR5211_RSSI_THR_BMISS, state->bs_bmiss_threshold);
-	}
+	if ((AR5K_AR5211_RSSI_THR_BMISS >> AR5K_AR5211_RSSI_THR_BMISS_S) <
+	    state->bs_bmiss_threshold)
+		return;
+
+	AR5K_REG_WRITE_BITS(AR5K_AR5211_RSSI_THR_M,
+	    AR5K_AR5211_RSSI_THR_BMISS, state->bs_bmiss_threshold);
+	AR5K_REG_WRITE_BITS(AR5K_AR5211_SCR, AR5K_AR5211_SCR_SLDUR,
+	    (state->bs_sleepduration - 3) << 3);
 }
 
 void
@@ -2204,9 +2291,12 @@ ar5k_ar5211_waitForBeaconDone(hal, phys_addr)
 	 * Wait for beaconn queue to be done
 	 */
 	ret = ar5k_register_timeout(hal,
-	    AR5K_AR5211_QCU_STS(HAL_TX_QUEUE_BEACON),
+	    AR5K_AR5211_QCU_STS(HAL_TX_QUEUE_ID_BEACON),
 	    AR5K_AR5211_QCU_STS_FRMPENDCNT, 0, AH_FALSE);
 
+	if (AR5K_REG_READ_Q(AR5K_AR5211_QCU_TXE, HAL_TX_QUEUE_ID_BEACON))
+		return (AH_FALSE);
+
 	return (ret);
 }
 
diff --git a/sys/dev/ic/ar5211reg.h b/sys/dev/ic/ar5211reg.h
index febf1bd8009..197bc0300c7 100644
--- a/sys/dev/ic/ar5211reg.h
+++ b/sys/dev/ic/ar5211reg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5211reg.h,v 1.1 2005/02/25 22:25:30 reyk Exp $	*/
+/*	$OpenBSD: ar5211reg.h,v 1.2 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -549,6 +549,7 @@ typedef enum {
  */
 #define AR5K_AR5211_SCR			0x4004
 #define AR5K_AR5211_SCR_SLDUR		0x0000ffff
+#define AR5K_AR5211_SCR_SLDUR_S		0
 #define AR5K_AR5211_SCR_SLE		0x00030000
 #define AR5K_AR5211_SCR_SLE_S		16
 #define AR5K_AR5211_SCR_SLE_WAKE	0x00000000
diff --git a/sys/dev/ic/ar5212.c b/sys/dev/ic/ar5212.c
index 98572919edd..57136196f1e 100644
--- a/sys/dev/ic/ar5212.c
+++ b/sys/dev/ic/ar5212.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5212.c,v 1.4 2005/03/03 16:39:54 reyk Exp $	*/
+/*	$OpenBSD: ar5212.c,v 1.5 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -214,7 +214,7 @@ ar5k_ar5212_attach(device, sc, st, sh, status)
 	    AR5K_AR5111 : AR5K_AR5112;
 	hal->ah_phy = AR5K_AR5212_PHY(0);
 
-	memset(&mac, 0xff, sizeof(mac));
+	bcopy(etherbroadcastaddr, mac, IEEE80211_ADDR_LEN);
 	ar5k_ar5212_writeAssocid(hal, mac, 0, 0);
 	ar5k_ar5212_getMacAddress(hal, mac);
 	ar5k_ar5212_setPCUConfig(hal);
@@ -621,7 +621,7 @@ ar5k_ar5212_reset(hal, op_mode, channel, change_channel, status)
 	}
 
 	/* Misc */
-	memset(&mac, 0xff, sizeof(mac));
+	bcopy(etherbroadcastaddr, mac, IEEE80211_ADDR_LEN);
 	ar5k_ar5212_writeAssocid(hal, mac, 0, 0);
 	ar5k_ar5212_setPCUConfig(hal);
 	AR5K_REG_WRITE(AR5K_AR5212_PISR, 0xffffffff);
@@ -738,8 +738,8 @@ ar5k_ar5212_setPCUConfig(hal)
 	/*
 	 * Set PCU registers
 	 */
-	memcpy(&low_id, &(hal->ah_sta_id[0]), 4);
-	memcpy(&high_id, &(hal->ah_sta_id[4]), 2);
+	bcopy(&(hal->ah_sta_id[0]), &low_id, 4);
+	bcopy(&(hal->ah_sta_id[4]), &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5212_STA_ID0, low_id);
 	AR5K_REG_WRITE(AR5K_AR5212_STA_ID1, pcu_reg | high_id);
 
@@ -1154,13 +1154,17 @@ ar5k_ar5212_stopTxDma(hal, queue)
 	 */
 	AR5K_REG_WRITE_Q(AR5K_AR5212_QCU_TXD, queue);
 
-	ret = ar5k_register_timeout(hal, AR5K_AR5212_QCU_STS(queue),
-	    AR5K_AR5212_QCU_STS_FRMPENDCNT, 0, AH_FALSE);
+	ret = ar5k_register_timeout(hal,
+	    AR5K_AR5212_QCU_STS(queue), AR5K_AR5212_QCU_STS_FRMPENDCNT,
+	    0, AH_FALSE);
 
 	/* Clear register */
 	AR5K_REG_WRITE(AR5K_AR5212_QCU_TXD, 0);
 
-	return (AH_TRUE);
+	if (AR5K_REG_READ_Q(AR5K_AR5212_QCU_TXE, queue))
+		return (AH_FALSE);
+
+	return (ret);
 }
 
 HAL_BOOL
@@ -1250,7 +1254,7 @@ ar5k_ar5212_fillTxDesc(hal, desc, segment_length, first_segment, last_segment)
 	tx_desc = (struct ar5k_ar5212_tx_desc*)&desc->ds_ctl0;
 
 	/* Clear status descriptor */
-	desc->ds_hw[0] = desc->ds_hw[1] = 0;
+	bzero(desc->ds_hw, sizeof(desc->ds_hw));
 
 	/* Validate segment length and initialize the descriptor */
 	if ((tx_desc->buf_len = segment_length) != segment_length)
@@ -1478,7 +1482,7 @@ ar5k_ar5212_getRxFilter(hal)
 
 	if (data & AR5K_AR5212_PHY_ERR_FIL_RADAR)
 		filter |= HAL_RX_FILTER_PHYRADAR;
-	if (data & (AR5K_AR5212_PHY_ERR_FIL_OFDM |
+	if (data & (AR5K_AR5212_PHY_ERR_FIL_OFDM|
 		AR5K_AR5212_PHY_ERR_FIL_CCK))
 		filter |= HAL_RX_FILTER_PHYERR;
 
@@ -1699,6 +1703,9 @@ ar5k_ar5212_dumpState(hal)
 	AR5K_PRINT_REGISTER(PHY_CHIP_ID);
 	AR5K_PRINT_REGISTER(PHY_AGCCTL);
 	AR5K_PRINT_REGISTER(PHY_NF);
+	AR5K_PRINT_REGISTER(PHY_SCR);
+	AR5K_PRINT_REGISTER(PHY_SLMT);
+	AR5K_PRINT_REGISTER(PHY_SCAL);
 	AR5K_PRINT_REGISTER(PHY_RX_DELAY);
 	AR5K_PRINT_REGISTER(PHY_IQ);
 	AR5K_PRINT_REGISTER(PHY_PAPD_PROBE);
@@ -1732,7 +1739,7 @@ ar5k_ar5212_getMacAddress(hal, mac)
 	struct ath_hal *hal;
 	u_int8_t *mac;
 {
-	memcpy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
+	bcopy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
 }
 
 HAL_BOOL
@@ -1743,10 +1750,10 @@ ar5k_ar5212_setMacAddress(hal, mac)
 	u_int32_t low_id, high_id;
 
 	/* Set new station ID */
-	memcpy(hal->ah_sta_id, mac, IEEE80211_ADDR_LEN);
+	bcopy(mac, hal->ah_sta_id, IEEE80211_ADDR_LEN);
 
-	memcpy(&low_id, mac, 4);
-	memcpy(&high_id, mac + 4, 2);
+	bcopy(mac, &low_id, 4);
+	bcopy(mac + 4, &high_id, 2);
 	high_id = 0x0000ffff & htole32(high_id);
 
 	AR5K_REG_WRITE(AR5K_AR5212_STA_ID0, htole32(low_id));
@@ -1835,12 +1842,12 @@ ar5k_ar5212_writeAssocid(hal, bssid, assoc_id, tim_offset)
 	/*
 	 * Set BSSID which triggers the "SME Join" operation
 	 */
-	memcpy(&low_id, bssid, 4);
-	memcpy(&high_id, bssid + 4, 2);
+	bcopy(bssid, &low_id, 4);
+	bcopy(bssid + 4, &high_id, 2);
 	AR5K_REG_WRITE(AR5K_AR5212_BSS_ID0, htole32(low_id));
 	AR5K_REG_WRITE(AR5K_AR5212_BSS_ID1, htole32(high_id) |
 	    ((assoc_id & 0x3fff) << AR5K_AR5212_BSS_ID1_AID_S));
-	memcpy(&hal->ah_bssid, bssid, IEEE80211_ADDR_LEN);
+	bcopy(bssid, &hal->ah_bssid, IEEE80211_ADDR_LEN);
 
 	if (assoc_id == 0) {
 		ar5k_ar5212_disablePSPoll(hal);
@@ -2398,12 +2405,15 @@ ar5k_ar5212_setStationBeaconTimers(hal, state, tsf, dtim_count, cfp_count)
 	u_int32_t cfp_count;
 
 {
-	u_int32_t cfp_period, next_cfp;
+	u_int32_t cfp_period, next_cfp, dtim, interval, next_beacon;
 
 	/* Return on an invalid beacon state */
 	if (state->bs_interval < 1)
 		return;
 
+	interval = state->bs_intval;
+	dtim = state->bs_dtimperiod;
+
 	/*
 	 * PCF support?
 	 */
@@ -2414,8 +2424,7 @@ ar5k_ar5212_setStationBeaconTimers(hal, state, tsf, dtim_count, cfp_count)
 		next_cfp = (cfp_count * state->bs_dtim_period + dtim_count) *
 		    state->bs_interval;
 
-		AR5K_REG_DISABLE_BITS(AR5K_AR5212_STA_ID1,
-		    AR5K_AR5212_STA_ID1_DEFAULT_ANTENNA |
+		AR5K_REG_ENABLE_BITS(AR5K_AR5212_STA_ID1,
 		    AR5K_AR5212_STA_ID1_PCF);
 		AR5K_REG_WRITE(AR5K_AR5212_CFP_PERIOD, cfp_period);
 		AR5K_REG_WRITE(AR5K_AR5212_CFP_DUR, state->bs_cfp_max_duration);
@@ -2424,7 +2433,6 @@ ar5k_ar5212_setStationBeaconTimers(hal, state, tsf, dtim_count, cfp_count)
 	} else {
 		/* Disable PCF mode */
 		AR5K_REG_DISABLE_BITS(AR5K_AR5212_STA_ID1,
-		    AR5K_AR5212_STA_ID1_DEFAULT_ANTENNA |
 		    AR5K_AR5212_STA_ID1_PCF);
 	}
 
@@ -2446,12 +2454,45 @@ ar5k_ar5212_setStationBeaconTimers(hal, state, tsf, dtim_count, cfp_count)
 	/*
 	 * Write new beacon miss threshold, if it appears to be valid
 	 */
-	if ((state->bs_bmiss_threshold > (AR5K_AR5212_RSSI_THR_BMISS >>
-	    AR5K_AR5212_RSSI_THR_BMISS_S)) &&
-	    (state->bs_bmiss_threshold & 0x00007) != 0) {
-		AR5K_REG_WRITE_BITS(AR5K_AR5212_RSSI_THR_M,
-		    AR5K_AR5212_RSSI_THR_BMISS, state->bs_bmiss_threshold);
-	}
+	if ((AR5K_AR5212_RSSI_THR_BMISS >> AR5K_AR5212_RSSI_THR_BMISS_S) <
+	    state->bs_bmiss_threshold)
+		return;
+
+	AR5K_REG_WRITE_BITS(AR5K_AR5212_RSSI_THR_M,
+	    AR5K_AR5212_RSSI_THR_BMISS, state->bs_bmiss_threshold);
+
+	/*
+	 * Set sleep registers
+	 */
+	if ((state->bs_sleepduration > state->bs_interval) &&
+	    (roundup(state->bs_sleepduration, interval) ==
+	    state->bs_sleepduration))
+		interval = state->bs_sleepduration;
+
+	if (state->bs_sleepduration > dtim &&
+	    (dtim == 0 || roundup(state->bs_sleepduration, dtim) ==
+	    state->bs_sleepduration))
+		dtim = state->bs_sleepduration;
+
+	if (interval > dtim)
+		return;
+
+	next_beacon = interval == dtim ?
+	    state->bs_nextdtim: state->bs_nexttbtt;
+
+	AR5K_REG_WRITE(AR5K_AR5212_SLEEP0,
+	    AR5K_REG_SM((state->bs_nextdtim - 3) << 3,
+	    AR5K_AR5212_SLEEP0_NEXT_DTIM) |
+	    AR5K_REG_SM(10, AR5K_AR5212_SLEEP0_CABTO) |
+	    AR5K_AR5212_SLEEP0_ENH_SLEEP_EN |
+	    AR5K_AR5212_SLEEP0_ASSUME_DTIM);
+	AR5K_REG_WRITE(AR5K_AR5212_SLEEP1,
+	    AR5K_REG_SM((next_beacon - 3) << 3,
+	    AR5K_AR5212_SLEEP1_NEXT_TIM) |
+	    AR5K_REG_SM(10, AR5K_AR5212_SLEEP1_BEACON_TO));
+	AR5K_REG_WRITE(AR5K_AR5212_SLEEP2,
+	    AR5K_REG_SM(interval, AR5K_AR5212_SLEEP2_TIM_PER) |
+	    AR5K_REG_SM(dtim, AR5K_AR5212_SLEEP2_DTIM_PER));
 }
 
 void
@@ -2482,9 +2523,12 @@ ar5k_ar5212_waitForBeaconDone(hal, phys_addr)
 	 * Wait for beaconn queue to be done
 	 */
 	ret = ar5k_register_timeout(hal,
-	    AR5K_AR5212_QCU_STS(HAL_TX_QUEUE_BEACON),
+	    AR5K_AR5212_QCU_STS(HAL_TX_QUEUE_ID_BEACON),
 	    AR5K_AR5212_QCU_STS_FRMPENDCNT, 0, AH_FALSE);
 
+	if (AR5K_REG_READ_Q(AR5K_AR5212_QCU_TXE, HAL_TX_QUEUE_ID_BEACON))
+		return (AH_FALSE);
+
 	return (ret);
 }
 
@@ -2813,3 +2857,4 @@ ar5k_ar5212_txpower(hal, channel, txpower)
 
 	return (AH_TRUE);
 }
+
diff --git a/sys/dev/ic/ar5212reg.h b/sys/dev/ic/ar5212reg.h
index a11691ef111..bf3e76bc861 100644
--- a/sys/dev/ic/ar5212reg.h
+++ b/sys/dev/ic/ar5212reg.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5212reg.h,v 1.1 2005/02/19 16:58:00 reyk Exp $	*/
+/*	$OpenBSD: ar5212reg.h,v 1.2 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -932,29 +932,29 @@ typedef enum {
  * First enhanced sleep register
  */
 #define AR5K_AR5212_SLEEP0		0x80d4
-#define AR5K_AR5212_SLEEP0_NEXT_DTIM_M	0x0007ffff
+#define AR5K_AR5212_SLEEP0_NEXT_DTIM	0x0007ffff
 #define AR5K_AR5212_SLEEP0_NEXT_DTIM_S	0
 #define AR5K_AR5212_SLEEP0_ASSUME_DTIM	0x00080000
 #define AR5K_AR5212_SLEEP0_ENH_SLEEP_EN	0x00100000
-#define AR5K_AR5212_SLEEP0_CAPTO_M	0xff000000
-#define AR5K_AR5212_SLEEP0_CAPTO_S	24
+#define AR5K_AR5212_SLEEP0_CABTO	0xff000000
+#define AR5K_AR5212_SLEEP0_CABTO_S	24
 
 /*
  * Second enhanced sleep register
  */
 #define AR5K_AR5212_SLEEP1		0x80d8
-#define AR5K_AR5212_SLEEP1_NEXT_TIM_M	0x0007ffff
+#define AR5K_AR5212_SLEEP1_NEXT_TIM	0x0007ffff
 #define AR5K_AR5212_SLEEP1_NEXT_TIM_S	0
-#define AR5K_AR5212_SLEEP1_BEACON_TO_M	0xff000000
+#define AR5K_AR5212_SLEEP1_BEACON_TO	0xff000000
 #define AR5K_AR5212_SLEEP1_BEACON_TO_S	24
 
 /*
  * Third enhanced sleep register
  */
 #define AR5K_AR5212_SLEEP2		0x80dc
-#define AR5K_AR5212_SLEEP2_TIM_PER_M	0x0000ffff
+#define AR5K_AR5212_SLEEP2_TIM_PER	0x0000ffff
 #define AR5K_AR5212_SLEEP2_TIM_PER_S	0
-#define AR5K_AR5212_SLEEP2_DTIM_PER_M	0xffff0000
+#define AR5K_AR5212_SLEEP2_DTIM_PER	0xffff0000
 #define AR5K_AR5212_SLEEP2_DTIM_PER_S	16
 
 /*
diff --git a/sys/dev/ic/ar5212var.h b/sys/dev/ic/ar5212var.h
index 22340f0f2c0..366b569dab0 100644
--- a/sys/dev/ic/ar5212var.h
+++ b/sys/dev/ic/ar5212var.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5212var.h,v 1.2 2005/02/25 22:25:30 reyk Exp $	*/
+/*	$OpenBSD: ar5212var.h,v 1.3 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -233,6 +233,7 @@ struct ar5k_ar5212_ini {
 	{ AR5K_INI_FLAG_BOTH, 0x004c, 0x00000010 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x0050, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x0054, 0x0000001f },			\
+	{ AR5K_INI_FLAG_BOTH, 0x0400, 0x0000000e },			\
 	{ AR5K_INI_FLAG_BOTH, 0x0800, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x0804, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x0808, 0x00000000 },			\
@@ -298,6 +299,7 @@ struct ar5k_ar5212_ini {
 	{ AR5K_INI_FLAG_BOTH, 0x8004, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x8008, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x800c, 0x00000000 },			\
+	{ AR5K_INI_FLAG_BOTH, 0x8014, 0x08400840 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x8018, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x8020, 0x00000000 },			\
 	{ AR5K_INI_FLAG_BOTH, 0x8024, 0x00000000 },			\
diff --git a/sys/dev/ic/ar5xxx.c b/sys/dev/ic/ar5xxx.c
index aa50782c007..1c3ccfd023e 100644
--- a/sys/dev/ic/ar5xxx.c
+++ b/sys/dev/ic/ar5xxx.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5xxx.c,v 1.16 2005/03/03 16:39:54 reyk Exp $	*/
+/*	$OpenBSD: ar5xxx.c,v 1.17 2005/03/10 08:30:56 reyk Exp $	*/
 
 /*
  * Copyright (c) 2004, 2005 Reyk Floeter <reyk@vantronix.net>
@@ -203,6 +203,10 @@ ath_hal_attach(device, sc, st, sh, status)
 	if (attach(device, hal, st, sh, status) == NULL)
 		goto failed;
 
+#ifdef AR5K_DEBUG
+	hal->ah_dumpState(hal);
+#endif
+
 	/*
 	 * Get card capabilities, values, ...
 	 */
@@ -492,7 +496,7 @@ ath_hal_init_channels(hal, channels, max_channels, channels_size, country, mode,
 	}
 
  done:
-	memcpy(channels, &all_channels, sizeof(all_channels));
+	bcopy(all_channels, channels, sizeof(all_channels));
 	*channels_size = c;
 
 	return (AH_TRUE);
@@ -612,9 +616,9 @@ ar5k_rt_copy(dst, src)
 	HAL_RATE_TABLE *dst;
 	HAL_RATE_TABLE *src;
 {
-	memset(dst, 0, sizeof(HAL_RATE_TABLE));
+	bzero(dst, sizeof(HAL_RATE_TABLE));
 	dst->rateCount = src->rateCount;
-	memcpy(&dst->info, &src->info, sizeof(dst->info));
+	bcopy(src->info, dst->info, sizeof(dst->info));
 }
 
 HAL_BOOL
@@ -1031,7 +1035,7 @@ ar5k_eeprom_read_mac(hal, mac)
 		octet += 2;
 	}
 
-	memcpy(mac, &mac_d, IEEE80211_ADDR_LEN);
+	bcopy(mac_d, mac, IEEE80211_ADDR_LEN);
 
 	if ((!total) || total == (3 * 0xffff))
 		return (EINVAL);
@@ -1078,7 +1082,6 @@ ar5k_channel(hal, channel)
 	HAL_CHANNEL *channel;
 {
 	HAL_BOOL ret;
-	AR5K_TRACE;
 
 	/*
 	 * Check bounds supported by the PHY
diff --git a/sys/dev/ic/ath.c b/sys/dev/ic/ath.c
index 9671386b3da..8b61f318fde 100644
--- a/sys/dev/ic/ath.c
+++ b/sys/dev/ic/ath.c
@@ -1,4 +1,4 @@
-/*      $OpenBSD: ath.c,v 1.12 2005/03/10 03:12:30 reyk Exp $  */
+/*      $OpenBSD: ath.c,v 1.13 2005/03/10 08:30:56 reyk Exp $  */
 /*	$NetBSD: ath.c,v 1.37 2004/08/18 21:59:39 dyoung Exp $	*/
 
 /*-
@@ -103,7 +103,7 @@ void    ath_mcastfilter_compute(struct ath_softc *, u_int32_t (*)[2]);
 u_int32_t ath_calcrxfilter(struct ath_softc *);
 void	ath_mode_init(struct ath_softc *);
 int	ath_beacon_alloc(struct ath_softc *, struct ieee80211_node *);
-void	ath_beacon_proc(struct ath_softc *, int);
+void	ath_beacon_proc(void *, int);
 void	ath_beacon_free(struct ath_softc *);
 void	ath_beacon_config(struct ath_softc *);
 int	ath_desc_alloc(struct ath_softc *);
@@ -308,6 +308,7 @@ ath_attach(u_int16_t devid, struct ath_softc *sc)
 	ATH_TASK_INIT(&sc->sc_rxorntask, ath_rxorn_proc, sc);
 	ATH_TASK_INIT(&sc->sc_fataltask, ath_fatal_proc, sc);
 	ATH_TASK_INIT(&sc->sc_bmisstask, ath_bmiss_proc, sc);
+	ATH_TASK_INIT(&sc->sc_swbatask, ath_beacon_proc, sc);
 
 	/*
 	 * For now just pre-allocate one data queue and one
@@ -593,14 +594,8 @@ ath_intr1(struct ath_softc *sc)
 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_rxtask);
 		if (status & HAL_INT_TX)
 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_txtask);
-		if (status & HAL_INT_SWBA) {
-			/*
-			 * Handle beacon transmission directly; deferring
-			 * this is too slow to meet timing constraints
-			 * under load.
-			 */
-			ath_beacon_proc(sc, 0);
-		}
+		if (status & HAL_INT_SWBA)
+			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_swbatask);
 		if (status & HAL_INT_BMISS) {
 			sc->sc_stats.ast_bmiss++;
 			ATH_TASK_RUN_OR_ENQUEUE(&sc->sc_bmisstask);
@@ -1355,8 +1350,9 @@ ath_beacon_alloc(struct ath_softc *sc, struct ieee80211_node *ni)
 }
 
 void
-ath_beacon_proc(struct ath_softc *sc, int pending)
+ath_beacon_proc(void *arg, int pending)
 {
+	struct ath_softc *sc = arg;
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_buf *bf = sc->sc_bcbuf;
 	struct ath_hal *ah = sc->sc_ah;
@@ -1372,7 +1368,6 @@ ath_beacon_proc(struct ath_softc *sc, int pending)
 	if (!ath_hal_stoptxdma(ah, sc->sc_bhalq)) {
 		DPRINTF(ATH_DEBUG_ANY, ("%s: beacon queue %u did not stop?\n",
 		    __func__, sc->sc_bhalq));
-		/* NB: the HAL still stops DMA, so proceed */
 	}
 	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, 0,
 	    bf->bf_dmamap->dm_mapsize, BUS_DMASYNC_PREWRITE);