--- a/usr/src/pkgdefs/Makefile	Sun Nov 27 18:29:20 2005 -0800
+++ b/usr/src/pkgdefs/Makefile	Sun Nov 27 19:11:23 2005 -0800
@@ -110,7 +110,8 @@
 	SUNWrmodr \
 	SUNWrmodu \
 	SUNWrtls \
-	SUNWvia823x
+	SUNWvia823x \
+	SUNWatheros
 
 i386_XMODS= \
 	SUNWadpu320 \

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/Makefile	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,36 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+include ../Makefile.com
+
+.KEEP_STATE:
+
+all: $(FILES) depend postinstall postremove
+install: all pkg
+
+include ../Makefile.targ

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/depend	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,53 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+# This package information file defines software dependencies associated
+# with the pkg.  You can define three types of pkg dependencies with this file:
+#	 P indicates a prerequisite for installation
+#	 I indicates an incompatible package
+#	 R indicates a reverse dependency
+# <pkg.abbr> see pkginfo(4), PKG parameter
+# <name> see pkginfo(4), NAME parameter
+# <version> see pkginfo(4), VERSION parameter
+# <arch> see pkginfo(4), ARCH parameter
+# <type> <pkg.abbr> <name>
+# 	(<arch>)<version>
+# 	(<arch>)<version>
+# 	...
+# <type> <pkg.abbr> <name>
+# ...
+
+P SUNWcar	Core Architecture, (Root)
+P SUNWcakr	Core Solaris Kernel Architecture (Root)
+P SUNWkvm	Core Architecture, (Kvm)
+P SUNWcsr	Core Solaris, (Root)
+P SUNWckr	Core Solaris Kernel (Root)
+P SUNWcnetr	Core Solaris Network Infrastructure (Root)
+P SUNWcsu	Core Solaris, (Usr)
+P SUNWcsd	Core Solaris Devices
+P SUNWcsl	Core Solaris Libraries
+

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/pkginfo.tmpl	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,46 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+PKG="SUNWatheros"
+NAME="Atheros 802.11b/g Wireless NIC Driver"
+ARCH="ISA"
+VERSION="ONVERS,REV=0.0.0"
+SUNW_PRODNAME="SunOS"
+SUNW_PRODVERS="RELEASE/VERSION"
+SUNW_PKGVERS="1.0"
+SUNW_PKGTYPE="root"
+MAXINST="1000"
+CATEGORY="system"
+VENDOR="Sun Microsystems, Inc."
+DESC="Atheros AR52xx 802.11b/g Wireless NIC Driver"
+CLASSES="none"
+HOTLINE="Please contact your local service provider"
+EMAIL=""
+BASEDIR=/
+SUNW_PKG_ALLZONES="true"
+SUNW_PKG_HOLLOW="true"

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/postinstall	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,140 @@
+#! /usr/bin/sh
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+# Driver info
+DRV=ath
+DRVALIAS='"pci168c,13" "pci168c,1014"'
+
+BASEDIR=${BASEDIR:-/}
+
+# Function: check_add_drv()
+#
+# This function will check if add_drv has been executed.
+# If not simply calls add_drv. Otherwise adds entries to
+# driver_aliases, driver_classes and minor_perm if necessary.
+# The syntax of this function is the same as add_drv. 
+
+check_add_drv()
+{
+	CMD=$*
+	shift
+
+	ALIAS=""
+	CLASS=""
+	MPERM=""
+	ALIASDIR=${BASEDIR}/etc/driver_aliases
+	CLASSDIR=${BASEDIR}/etc/driver_classes
+	MPERMDIR=${BASEDIR}/etc/minor_perm
+	while getopts i:c:m opt 2>/dev/null; do
+		case "$opt" in
+			i)	ALIAS=`echo ${OPTARG} | /usr/bin/sed -e "s/'//g"`
+				;;
+			c)	CLASS=${OPTARG}
+				;;
+			m)	MPERM=${OPTARG}
+				;;
+		esac
+	done
+	shift `/usr/bin/expr ${OPTIND} - 1`
+	DRIVER=$1
+
+	# Make sure add_drv has not been previously executed
+	# before attempting to add the driver
+	/usr/bin/egrep -s "^${DRIVER}[ 	]" $BASEDIR/etc/name_to_major
+
+	if [ $? -ne 0 ]; then
+		eval ${CMD}
+		if [ $? -ne 0 ]; then
+			echo "Failed add_drv ${DRIVER}!\n" >&2
+			exit 1
+		fi
+	else
+		# Add driver entry if necessary
+		if [ -n "${ALIAS}" ]; then
+			for i in ${ALIAS}; do
+				/usr/bin/egrep -s "^${DRIVER}[ 	]+$i" ${ALIASDIR}
+				if [ $? -ne 0 ]; then
+					echo "${DRIVER} $i" >> ${ALIASDIR}
+				fi
+			done
+		fi
+
+		if [ -n "${CLASS}" ]; then
+			/usr/bin/egrep -s "^${DRIVER}[ 	]+${CLASS}" ${CLASSDIR}
+			if [ $? -ne 0 ]; then
+				echo "${DRIVER}\t${CLASS}" >> ${CLASSDIR}
+			fi
+		fi
+
+		if [ -n "${MPERM}" ]; then
+			/usr/bin/egrep -s "^${DRIVER}:" ${MPERMDIR}
+			if [ $? -ne 0 ]; then
+				echo "${DRIVER}:${PERM}" >> ${MPERMDIR}
+			fi
+		fi
+	fi
+}
+
+# Is the hardware there?
+hw_exists=0
+CLEANALIAS=`echo ${DRVALIAS} | /usr/bin/sed -e 's/\"//g'`
+for i in ${CLEANALIAS}
+do
+	prtconf -v | /usr/bin/egrep -s $i
+	if [ $? -eq 0 ]
+	then
+		hw_exists=1
+	fi
+done
+
+# Only attempt to attach the driver on a running
+# system with the hardware present
+if [ "$BASEDIR" = "/" ]
+then
+	case ${hw_exists} in
+		# On a running system with no hardware
+		# modify the system files only
+		0)	ADD_DRV="add_drv -n"
+			;;
+		# On a running system with hardware
+		# modify the system files and attach the driver
+		1)	ADD_DRV="add_drv"
+			;;
+	esac
+else
+	# On a client
+	# modify the sytem files and touch /reconfigure
+	# for reconfigure reboot
+	ADD_DRV="add_drv -b ${BASEDIR}"
+fi
+
+ARCH=`uname -p`
+if [ ${ARCH} = "i386" ]; then
+	check_add_drv ${ADD_DRV} -i "'${DRVALIAS}'" ${DRV}
+fi

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/postremove	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,52 @@
+#! /usr/bin/sh
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+DRV=ath
+BASEDIR=${BASEDIR:-/}
+
+# Select the correct rem_drv options to execute.
+# Only attempt to unload the driver on a running system
+if [ "$BASEDIR" = "/" ]; then
+	REM_DRV="rem_drv"
+else
+	REM_DRV="rem_drv -b ${BASEDIR}"
+fi
+
+# Make sure rem_drv has not been previously executed
+# before attempting to remove the driver
+/usr/bin/egrep -s "^${DRV}[ 	]" $BASEDIR/etc/name_to_major
+if [ $? -eq 0 ]; then
+	${REM_DRV} ${DRV}
+        if [ $? -ne 0 ]; then
+		echo "Failed rem_drv ${DRV}!\n" >&2
+                exit 1
+        fi
+fi
+
+exit 0

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/prototype_com	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,48 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+#
+# This required package information file contains a list of package contents.
+# The 'pkgmk' command uses this file to identify the contents of a package
+# and their location on the development machine when building the package.
+# Can be created via a text editor or through use of the 'pkgproto' command.
+
+#!search <pathname pathname ...>        # where to find pkg objects
+#!include <filename>                    # include another 'prototype' file
+#!default <mode> <owner> <group>        # default used if not specified on entry
+#!<param>=<value>                       # puts parameter in pkg environment
+
+#
+# SUNWatheros
+#
+
+i pkginfo
+i copyright
+i depend
+i postinstall
+i postremove

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/pkgdefs/SUNWatheros/prototype_i386	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,53 @@
+#
+# CDDL HEADER START
+#
+# The contents of this file are subject to the terms of the
+# Common Development and Distribution License, Version 1.0 only
+# (the "License").  You may not use this file except in compliance
+# with the License.
+#
+# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
+# or http://www.opensolaris.org/os/licensing.
+# See the License for the specific language governing permissions
+# and limitations under the License.
+#
+# When distributing Covered Code, include this CDDL HEADER in each
+# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
+# If applicable, add the following below this CDDL HEADER, with the
+# fields enclosed by brackets "[]" replaced with your own identifying
+# information: Portions Copyright [yyyy] [name of copyright owner]
+#
+# CDDL HEADER END
+#
+#
+# Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+# Use is subject to license terms.
+#
+# ident	"%Z%%M%	%I%	%E% SMI"
+#
+
+#
+# This required package information file contains a list of package contents.
+# The 'pkgmk' command uses this file to identify the contents of a package
+# and their location on the development machine when building the package.
+# Can be created via a text editor or through use of the 'pkgproto' command.
+
+#!search <pathname pathname ...>        # where to find pkg objects
+#!include <filename>                    # include another 'prototype' file
+#!default <mode> <owner> <group>        # default used if not specified on entry
+#!<param>=<value>                       # puts parameter in pkg environment
+
+#
+# SUNWatheros
+#
+
+# Include ISA independent files (prototype_com)
+#
+!include prototype_com
+
+# Atheros IEEE80211a/b/g NIC driver
+d none kernel 0755 root sys
+d none kernel/drv 0755 root sys
+f none kernel/drv/ath 0755 root sys
+d none kernel/drv/amd64 0755 root sys
+f none kernel/drv/amd64/ath 0755 root sys

--- a/usr/src/uts/common/Makefile.files	Sun Nov 27 18:29:20 2005 -0800
+++ b/usr/src/uts/common/Makefile.files	Sun Nov 27 19:11:23 2005 -0800
@@ -1294,6 +1294,9 @@
 		e1000g_tx.o e1000g_rx.o e1000g_stat.o
 RGE_OBJS += rge_main.o rge_chip.o rge_ndd.o rge_kstats.o rge_log.o rge_rxtx.o
 
+ATH_OBJS += ath_aux.o ath_ieee80211.o ath_main.o ath_osdep.o \
+		ath_rate.o ath_wificonfig.o
+
 #
 #	Build up defines and paths.
 #

--- a/usr/src/uts/common/Makefile.rules	Sun Nov 27 18:29:20 2005 -0800
+++ b/usr/src/uts/common/Makefile.rules	Sun Nov 27 19:11:23 2005 -0800
@@ -412,6 +412,10 @@
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
 
+$(OBJS_DIR)/%.o:               $(UTSBASE)/common/io/ath/%.c
+	$(COMPILE.c) -o $@ $<
+	$(CTFCONVERT_O)
+
 $(OBJS_DIR)/%.o:		$(UTSBASE)/common/io/audio/legacy/diaudio/%.c
 	$(COMPILE.c) -o $@ $<
 	$(CTFCONVERT_O)
@@ -1188,6 +1192,9 @@
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/sbp2/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 
+$(LINTS_DIR)/%.ln:              $(UTSBASE)/common/io/ath/%.c
+	@($(LHEAD) $(LINT.c) $< $(LTAIL))
+
 $(LINTS_DIR)/%.ln:		$(UTSBASE)/common/io/audio/legacy/diaudio/%.c
 	@($(LHEAD) $(LINT.c) $< $(LTAIL))
 

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/uts/common/io/ath/LICENSE	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,74 @@
+# ident	"%Z%%M%	%I%	%E% SMI"
+
+SOLARIS WIRELESS DRIVER FOR THE ATHEROS 52XX CHIPSET (ATH)
+
+LICENSE AGREEMENT
+
+Copyright 2005 Sun Microsystems, Inc. All rights reserved.
+Use is subject to license terms.
+Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer, without modification.
+2. Redistributions in binary form must reproduce at minimum a disclaimer
+   similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and
+   any redistribution must be conditioned upon including a substantially
+   similar Disclaimer requirement for further binary redistribution.
+3. Neither the names of the above-listed copyright holders nor the names
+   of any contributors may be used to endorse or promote products derived
+   from this software without specific prior written permission.
+
+NO WARRANTY
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
+PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS
+BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
+LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
+OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
+ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+-------------------------------------------------------------------------------
+
+License for the HAL (Hardware Abstraction Layer) component:
+
+Copyright (c) 2002-2005 Sam Leffler, Errno Consulting, Atheros Communications,
+Inc. All rights reserved.
+
+Use is subject to license terms.
+
+Redistribution and use in source and binary forms are permitted provided that
+the following conditions are met:
+
+1. The materials contained herein are unmodified and are used unmodified.
+2. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following NO ''WARRANTY'' disclaimer below
+   (''Disclaimer''), without modification.
+3. Redistributions in binary form must reproduce at minimum a disclaimer
+   similar to the Disclaimer below and any redistribution must be conditioned
+   upon including a substantially similar Disclaimer requirement for further
+   binary redistribution.
+4. Neither the names of the above-listed copyright holders nor the names of
+   any contributors may be used to endorse or promote product derived from
+   this software without specific prior written permission.
+
+NO WARRANTY
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ''AS IS''
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY AND FITNESS FOR A
+PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR
+CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/uts/common/io/ath/ath_aux.c	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,601 @@
+/*
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer,
+ * without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ * similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ * redistribution must be conditioned upon including a substantially
+ * similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ * of any contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/signal.h>
+#include <sys/stream.h>
+#include <sys/termio.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/cmn_err.h>
+#include <sys/stropts.h>
+#include <sys/strsubr.h>
+#include <sys/strtty.h>
+#include <sys/kbio.h>
+#include <sys/cred.h>
+#include <sys/stat.h>
+#include <sys/consdev.h>
+#include <sys/kmem.h>
+#include <sys/modctl.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+#include <sys/errno.h>
+#include <sys/gld.h>
+#include <sys/dlpi.h>
+#include <sys/ethernet.h>
+#include <sys/list.h>
+#include <sys/byteorder.h>
+#include <sys/strsun.h>
+#include <inet/common.h>
+#include <inet/nd.h>
+#include <inet/mi.h>
+#include <inet/wifi_ioctl.h>
+#include "ath_hal.h"
+#include "ath_impl.h"
+#include "ath_ieee80211.h"
+
+static const char *acnames[] = {
+	"WME_AC_BE",
+	"WME_AC_BK",
+	"WME_AC_VI",
+	"WME_AC_VO",
+	"WME_UPSD"
+};
+
+extern void ath_setup_desc(ath_t *asc, struct ath_buf *bf);
+
+uint32_t
+ath_calcrxfilter(ath_t *asc)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ath_hal *ah = asc->asc_ah;
+	uint32_t rfilt;
+
+	rfilt = (ATH_HAL_GETRXFILTER(ah) & HAL_RX_FILTER_PHYERR)
+	    | HAL_RX_FILTER_UCAST | HAL_RX_FILTER_BCAST | HAL_RX_FILTER_MCAST;
+	if (isc->isc_opmode != IEEE80211_M_STA)
+		rfilt |= HAL_RX_FILTER_PROBEREQ;
+	if (isc->isc_opmode != IEEE80211_M_HOSTAP &&
+	    (asc->asc_promisc & GLD_MAC_PROMISC_PHYS))	/* promiscuous */
+		rfilt |= HAL_RX_FILTER_PROM;
+	if (isc->isc_opmode == IEEE80211_M_STA ||
+	    isc->isc_opmode == IEEE80211_M_IBSS ||
+	    isc->isc_state == IEEE80211_S_SCAN)
+		rfilt |= HAL_RX_FILTER_BEACON;
+	return (rfilt);
+}
+
+static int
+ath_set_data_queue(ath_t *asc, int ac, int haltype)
+{
+	HAL_TXQ_INFO qi;
+	int qnum;
+	struct ath_hal *ah = asc->asc_ah;
+	struct ath_txq *txq;
+
+	if (ac >= ATH_N(asc->asc_ac2q)) {
+		ATH_DEBUG((ATH_DBG_AUX, "ath: ath_set_data_queue(): "
+		    "ac %u out of range, max %u!\n",
+		    ac, ATH_N(asc->asc_ac2q)));
+		return (1);
+	}
+	(void) memset(&qi, 0, sizeof (qi));
+	qi.tqi_subtype = haltype;
+	/*
+	 * Enable interrupts only for EOL and DESC conditions.
+	 * We mark tx descriptors to receive a DESC interrupt
+	 * when a tx queue gets deep; otherwise waiting for the
+	 * EOL to reap descriptors.  Note that this is done to
+	 * reduce interrupt load and this only defers reaping
+	 * descriptors, never transmitting frames.  Aside from
+	 * reducing interrupts this also permits more concurrency.
+	 * The only potential downside is if the tx queue backs
+	 * up in which case the top half of the kernel may backup
+	 * due to a lack of tx descriptors.
+	 */
+	qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE | TXQ_FLAG_TXDESCINT_ENABLE;
+	qnum = ATH_HAL_SETUPTXQUEUE(ah, HAL_TX_QUEUE_DATA, &qi);
+	if (qnum == -1) {
+		ATH_DEBUG((ATH_DBG_AUX, "ath: ath_set_data_queue(): "
+		    "Unable to setup hardware queue for %s traffic!\n",
+		    acnames[ac]));
+		return (1);
+	}
+	if (qnum >= ATH_N(asc->asc_txq)) {
+		ATH_DEBUG((ATH_DBG_AUX, "ath: ath_set_data_queue(): "
+		    "hal qnum %u out of range, max %u!\n",
+		    qnum, ATH_N(asc->asc_txq)));
+		return (1);
+	}
+	if (!ATH_TXQ_SETUP(asc, qnum)) {
+		txq = &asc->asc_txq[qnum];
+		txq->axq_qnum = qnum;
+		txq->axq_depth = 0;
+		txq->axq_intrcnt = 0;
+		txq->axq_link = NULL;
+		list_create(&txq->axq_list, sizeof (struct ath_buf),
+		    offsetof(struct ath_buf, bf_node));
+		mutex_init(&txq->axq_lock, NULL, MUTEX_DRIVER, NULL);
+		asc->asc_txqsetup |= 1<<qnum;
+	}
+	asc->asc_ac2q[ac] = &asc->asc_txq[qnum];
+	return (0);
+}
+
+int
+ath_txq_setup(ath_t *asc)
+{
+	if (ath_set_data_queue(asc, WME_AC_BE, HAL_WME_AC_BK) ||
+	    ath_set_data_queue(asc, WME_AC_BK, HAL_WME_AC_BE) ||
+	    ath_set_data_queue(asc, WME_AC_VI, HAL_WME_AC_VI) ||
+	    ath_set_data_queue(asc, WME_AC_VO, HAL_WME_AC_VO)) {
+		return (1);
+	}
+
+	return (0);
+}
+
+void
+ath_setcurmode(ath_t *asc, enum ieee80211_phymode mode)
+{
+	const HAL_RATE_TABLE *rt;
+	int i;
+
+	for (i = 0; i < sizeof (asc->asc_rixmap); i++)
+		asc->asc_rixmap[i] = 0xff;
+
+	rt = asc->asc_rates[mode];
+	ASSERT(rt != NULL);
+
+	for (i = 0; i < rt->rateCount; i++)
+		asc->asc_rixmap[rt->info[i].dot11Rate & IEEE80211_RATE_VAL] = i;
+
+	asc->asc_currates = rt;
+	asc->asc_curmode = mode;
+}
+
+/* Set correct parameters for a certain mode */
+void
+ath_mode_init(ath_t *asc)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ath_hal *ah = asc->asc_ah;
+	uint32_t rfilt;
+
+	/* configure rx filter */
+	rfilt = ath_calcrxfilter(asc);
+	ATH_HAL_SETRXFILTER(ah, rfilt);
+	ATH_HAL_SETOPMODE(ah);
+	ATH_HAL_SETMCASTFILTER(ah, asc->asc_mfilt[0], asc->asc_mfilt[1]);
+	ATH_DEBUG((ATH_DBG_AUX, "ath: ath_mode_init(): "
+	    "mode =%d RX filter 0x%x, MC filter %08x:%08x\n",
+	    isc->isc_opmode, rfilt,
+	    asc->asc_mfilt[0], asc->asc_mfilt[1]));
+}
+
+
+/*
+ * Disable the receive h/w in preparation for a reset.
+ */
+void
+ath_stoprecv(ath_t *asc)
+{
+	ATH_HAL_STOPPCURECV(asc->asc_ah);	/* disable PCU */
+	ATH_HAL_SETRXFILTER(asc->asc_ah, 0);	/* clear recv filter */
+	ATH_HAL_STOPDMARECV(asc->asc_ah);	/* disable DMA engine */
+	drv_usecwait(3000);
+
+	ATH_DEBUG((ATH_DBG_AUX, "ath: ath_stoprecv(): rx queue %p, link %p\n",
+	    ATH_HAL_GETRXBUF(asc->asc_ah), asc->asc_rxlink));
+	asc->asc_rxlink = NULL;
+}
+
+uint32_t
+ath_chan2flags(ieee80211com_t *isc, struct ieee80211channel *chan)
+{
+	static const uint32_t modeflags[] = {
+	    0,				/* IEEE80211_MODE_AUTO */
+	    CHANNEL_A,			/* IEEE80211_MODE_11A */
+	    CHANNEL_B,			/* IEEE80211_MODE_11B */
+	    CHANNEL_PUREG,		/* IEEE80211_MODE_11G */
+	    CHANNEL_T			/* IEEE80211_MODE_TURBO */
+	};
+	return (modeflags[ieee80211_chan2mode(isc, chan)]);
+}
+
+
+int
+ath_getchannels(ath_t *asc, uint32_t cc, HAL_BOOL outdoor, HAL_BOOL xchanmode)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ath_hal *ah = asc->asc_ah;
+	HAL_CHANNEL *chans;
+	int i, ix;
+	uint32_t nchan;
+
+	chans = (HAL_CHANNEL *)
+	    kmem_zalloc(IEEE80211_CHAN_MAX * sizeof (HAL_CHANNEL), KM_SLEEP);
+
+	if (!ath_hal_init_channels(ah, chans, IEEE80211_CHAN_MAX, &nchan,
+	    cc, HAL_MODE_ALL, outdoor, xchanmode)) {
+		ATH_DEBUG((ATH_DBG_AUX, "ath: ath_getchannels(): "
+		    "unable to get channel list\n");
+		kmem_free(chans, IEEE80211_CHAN_MAX * sizeof (HAL_CHANNEL)));
+		return (EINVAL);
+	}
+
+	/*
+	 * Convert HAL channels to ieee80211 ones and insert
+	 * them in the table according to their channel number.
+	 */
+	for (i = 0; i < nchan; i++) {
+		HAL_CHANNEL *c = &chans[i];
+		ix = ath_hal_mhz2ieee(c->channel, c->channelFlags);
+		if (ix > IEEE80211_CHAN_MAX) {
+			ATH_DEBUG((ATH_DBG_AUX, "ath: ath_getchannels(): "
+			    "bad hal channel %u (%u/%x) ignored\n",
+			    ix, c->channel, c->channelFlags));
+			continue;
+		}
+		/* NB: flags are known to be compatible */
+		if (isc->isc_channels[ix].ich_freq == 0) {
+			isc->isc_channels[ix].ich_freq = c->channel;
+			isc->isc_channels[ix].ich_flags = c->channelFlags;
+		} else {
+			/* channels overlap; e.g. 11g and 11b */
+			isc->isc_channels[ix].ich_flags |= c->channelFlags;
+		}
+		if ((c->channelFlags & CHANNEL_G) == CHANNEL_G)
+			asc->asc_have11g = 1;
+	}
+	kmem_free(chans, IEEE80211_CHAN_MAX * sizeof (HAL_CHANNEL));
+	return (0);
+}
+
+static void
+ath_drainq(ath_t *asc, struct ath_txq *txq)
+{
+	struct ath_buf *bf;
+
+	/*
+	 * This assumes output has been stopped.
+	 */
+	for (;;) {
+		mutex_enter(&txq->axq_lock);
+		bf = list_head(&txq->axq_list);
+		if (bf == NULL) {
+			txq->axq_link = NULL;
+			mutex_exit(&txq->axq_lock);
+			break;
+		}
+		list_remove(&txq->axq_list, bf);
+		mutex_exit(&txq->axq_lock);
+		bf->bf_in = NULL;
+		mutex_enter(&asc->asc_txbuflock);
+		list_insert_tail(&asc->asc_txbuf_list, bf);
+		mutex_exit(&asc->asc_txbuflock);
+	}
+}
+
+
+/*
+ * Drain the transmit queues and reclaim resources.
+ */
+void
+ath_draintxq(ath_t *asc)
+{
+	struct ath_hal *ah = asc->asc_ah;
+	struct ath_txq *txq;
+	int i;
+
+	if (!asc->asc_invalid) {
+		for (i = 0; i < HAL_NUM_TX_QUEUES; i++) {
+			if (ATH_TXQ_SETUP(asc, i)) {
+				txq = &asc->asc_txq[i];
+				(void) ATH_HAL_STOPTXDMA(ah, txq->axq_qnum);
+			}
+		}
+	}
+	for (i = 0; i < HAL_NUM_TX_QUEUES; i++) {
+		if (ATH_TXQ_SETUP(asc, i)) {
+			ath_drainq(asc, &asc->asc_txq[i]);
+		}
+	}
+}
+
+
+/* Enable the receive h/w following a reset */
+int
+ath_startrecv(ath_t *asc)
+{
+	struct ath_buf *bf;
+
+	asc->asc_rxlink = NULL;
+
+	bf = list_head(&asc->asc_rxbuf_list);
+	while (bf != NULL) {
+		ath_setup_desc(asc, bf);
+		bf = list_next(&asc->asc_rxbuf_list, bf);
+	}
+
+	bf = list_head(&asc->asc_rxbuf_list);
+	ATH_HAL_PUTRXBUF(asc->asc_ah, bf->bf_daddr);
+	ATH_HAL_RXENA(asc->asc_ah);		/* enable recv descriptors */
+	ath_mode_init(asc);			/* set filters, etc. */
+	ATH_HAL_STARTPCURECV(asc->asc_ah);	/* re-enable PCU/DMA engine */
+	return (0);
+}
+
+/*
+ * Set/change channels.  If the channel is really being changed,
+ * it's done by resetting the chip.  To accomplish this we must
+ * first cleanup any pending DMA.
+ */
+int
+ath_chan_set(ath_t *asc, struct ieee80211channel *chan)
+{
+	struct ath_hal *ah = asc->asc_ah;
+	ieee80211com_t *isc = &asc->asc_isc;
+
+	if (chan != isc->isc_ibss_chan) {
+		HAL_STATUS status;
+		HAL_CHANNEL hchan;
+		enum ieee80211_phymode mode;
+
+		/*
+		 * To switch channels clear any pending DMA operations;
+		 * wait long enough for the RX fifo to drain, reset the
+		 * hardware at the new frequency, and then re-enable
+		 * the relevant bits of the h/w.
+		 */
+		ATH_HAL_INTRSET(ah, 0);		/* disable interrupts */
+		ath_draintxq(asc);		/* clear pending tx frames */
+		ath_stoprecv(asc);		/* turn off frame recv */
+		/*
+		 * Convert to a HAL channel description with
+		 * the flags constrained to reflect the current
+		 * operating mode.
+		 */
+		hchan.channel = chan->ich_freq;
+		hchan.channelFlags = ath_chan2flags(isc, chan);
+		if (!ATH_HAL_RESET(ah, (HAL_OPMODE)isc->isc_opmode,
+		    &hchan, AH_TRUE, &status)) {
+			ATH_DEBUG((ATH_DBG_AUX, "ath: ath_chan_set():"
+			    "unable to reset channel %u (%uMhz)\n",
+			    ieee80211_chan2ieee(isc, chan), chan->ich_freq));
+			return (EIO);
+		}
+
+		/*
+		 * Re-enable rx framework.
+		 */
+		if (ath_startrecv(asc) != 0) {
+			ath_problem("ath: ath_chan_set(): "
+			    "restarting receiving logic failed\n");
+			return (EIO);
+		}
+
+		/*
+		 * Change channels and update the h/w rate map
+		 * if we're switching; e.g. 11a to 11b/g.
+		 */
+		isc->isc_ibss_chan = chan;
+		mode = ieee80211_chan2mode(isc, chan);
+		if (mode != asc->asc_curmode)
+			ath_setcurmode(asc, mode);
+		/*
+		 * Re-enable interrupts.
+		 */
+		ATH_HAL_INTRSET(ah, asc->asc_imask);
+	}
+	return (0);
+}
+
+
+/*
+ * Configure the beacon and sleep timers.
+ *
+ * When operating as an AP this resets the TSF and sets
+ * up the hardware to notify us when we need to issue beacons.
+ *
+ * When operating in station mode this sets up the beacon
+ * timers according to the timestamp of the last received
+ * beacon and the current TSF, configures PCF and DTIM
+ * handling, programs the sleep registers so the hardware
+ * will wakeup in time to receive beacons, and configures
+ * the beacon miss handling so we'll receive a BMISS
+ * interrupt when we stop seeing beacons from the AP
+ * we've associated with.
+ */
+void
+ath_beacon_config(ath_t *asc)
+{
+	struct ath_hal *ah = asc->asc_ah;
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ieee80211_node *in = isc->isc_bss;
+	uint32_t nexttbtt;
+
+	nexttbtt = (ATH_LE_READ_4(in->in_tstamp + 4) << 22) |
+	    (ATH_LE_READ_4(in->in_tstamp) >> 10);
+	nexttbtt += in->in_intval;
+	if (isc->isc_opmode != IEEE80211_M_HOSTAP) {
+		HAL_BEACON_STATE bs;
+		uint32_t bmisstime;
+
+		/* NB: no PCF support right now */
+		bzero(&bs, sizeof (bs));
+		bs.bs_intval = in->in_intval;
+		bs.bs_nexttbtt = nexttbtt;
+		bs.bs_dtimperiod = bs.bs_intval;
+		bs.bs_nextdtim = nexttbtt;
+
+		/*
+		 * Calculate the number of consecutive beacons to miss
+		 * before taking a BMISS interrupt.  The configuration
+		 * is specified in ms, so we need to convert that to
+		 * TU's and then calculate based on the beacon interval.
+		 * Note that we clamp the result to at most 10 beacons.
+		 */
+		bmisstime = (isc->isc_bmisstimeout * 1000) / 1024;
+		bs.bs_bmissthreshold = howmany(bmisstime, in->in_intval);
+		if (bs.bs_bmissthreshold > 10)
+			bs.bs_bmissthreshold = 10;
+		else if (bs.bs_bmissthreshold <= 0)
+			bs.bs_bmissthreshold = 1;
+		/*
+		 * Calculate sleep duration.  The configuration is
+		 * given in ms.  We insure a multiple of the beacon
+		 * period is used.  Also, if the sleep duration is
+		 * greater than the DTIM period then it makes senses
+		 * to make it a multiple of that.
+		 */
+		bs.bs_sleepduration =
+		    roundup((100 * 1000) / 1024, bs.bs_intval);
+		if (bs.bs_sleepduration > bs.bs_dtimperiod)
+			bs.bs_sleepduration =
+			    roundup(bs.bs_sleepduration, bs.bs_dtimperiod);
+
+
+		ATH_DEBUG((ATH_DBG_AUX, "ath: ath_beacon_config(): "
+		    "intval %u nexttbtt %u dtim %u"
+		    " nextdtim %u bmiss %u sleep %u\n",
+		    bs.bs_intval,
+		    bs.bs_nexttbtt,
+		    bs.bs_dtimperiod,
+		    bs.bs_nextdtim,
+		    bs.bs_bmissthreshold,
+		    bs.bs_sleepduration));
+		ATH_HAL_INTRSET(ah, 0);
+		/*
+		 * Reset our tsf so the hardware will update the
+		 * tsf register to reflect timestamps found in
+		 * received beacons.
+		 */
+		ATH_HAL_RESETTSF(ah);
+		ATH_HAL_BEACONTIMERS(ah, &bs);
+		asc->asc_imask |= HAL_INT_BMISS;
+		ATH_HAL_INTRSET(ah, asc->asc_imask);
+	} else {
+		ATH_HAL_INTRSET(ah, 0);
+		ATH_HAL_BEACONINIT(ah, nexttbtt, in->in_intval);
+		asc->asc_imask |= HAL_INT_SWBA;	/* beacon prepare */
+		ATH_HAL_INTRSET(ah, asc->asc_imask);
+	}
+}
+
+
+
+/*
+ * Fill the hardware key cache with key entries.
+ */
+void
+ath_initkeytable(ath_t *asc)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ath_hal *ah = asc->asc_ah;
+	int32_t i;
+
+	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
+		struct ieee80211_wepkey *k = &isc->isc_nw_keys[i];
+		if (k->iwk_len == 0)
+			ATH_HAL_KEYRESET(ah, i);
+		else {
+			HAL_KEYVAL hk;
+
+#ifdef DEBUG
+			char tmp[200], stmp[10];
+			int j;
+			bzero(tmp, 200);
+			bzero(stmp, 10);
+			for (j = 0; j < k->iwk_len; j++) {
+				(void) sprintf(stmp, "0x%02x ", k->iwk_key[j]);
+				(void) strcat(tmp, stmp);
+			}
+			ATH_DEBUG((ATH_DBG_AUX, "ath: ath_initkeytable(): "
+			    "key%d val=%s\n", i, tmp));
+#endif /* DEBUG */
+			bzero(&hk, sizeof (hk));
+			hk.kv_type = HAL_CIPHER_WEP;
+			hk.kv_len = k->iwk_len;
+			bcopy(k->iwk_key, hk.kv_val, k->iwk_len);
+			ATH_HAL_KEYSET(ah, i, &hk);
+		}
+	}
+}
+
+void
+ath_reset(ath_t *asc)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)asc;
+	struct ath_hal *ah = asc->asc_ah;
+	struct ieee80211channel *ch;
+	HAL_STATUS status;
+	HAL_CHANNEL hchan;
+
+	/*
+	 * Convert to a HAL channel description with the flags
+	 * constrained to reflect the current operating mode.
+	 */
+	ch = isc->isc_ibss_chan;
+	hchan.channel = ch->ich_freq;
+	hchan.channelFlags = ath_chan2flags(isc, ch);
+
+	ATH_HAL_INTRSET(ah, 0);		/* disable interrupts */
+	ath_draintxq(asc);		/* stop xmit side */
+	if (asc->asc_invalid == 0)
+		ath_stoprecv(asc);		/* stop recv side */
+	/* indicate channel change so we do a full reset */
+	if (!ATH_HAL_RESET(ah, (HAL_OPMODE)isc->isc_opmode, &hchan,
+	    AH_TRUE, &status)) {
+		ath_problem("ath: ath_reset(): "
+		    "reseting hardware failed, HAL status %u\n", status);
+	}
+	if (asc->asc_invalid == 0) {
+		ath_initkeytable(asc);
+		if (ath_startrecv(asc) != 0)	/* restart recv */
+			ath_problem("ath: ath_reset(): "
+			    "starting receiving logic failed\n");
+		if (isc->isc_state == IEEE80211_S_RUN) {
+			ath_beacon_config(asc);	/* restart beacons */
+		}
+		ATH_HAL_INTRSET(ah, asc->asc_imask);
+	}
+}

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/uts/common/io/ath/ath_aux.h	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,72 @@
+/*
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+/*
+ * Copyright (c) 2002-2004 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer,
+ * without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ * similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ * redistribution must be conditioned upon including a substantially
+ * similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ * of any contributors may be used to endorse or promote products derived
+ * from this software without specific prior written permission.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#ifndef _ATH_AUX_H
+#define	_ATH_AUX_H
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include "ath_hal.h"
+#include "ath_ieee80211.h"
+#include "ath_impl.h"
+
+uint32_t ath_calcrxfilter(ath_t *asc);
+void ath_beacon_config(ath_t *asc);
+void ath_reset(ath_t *asc);
+int32_t ath_startrecv(ath_t *asc);
+void ath_stoprecv(ath_t *asc);
+uint32_t ath_chan2flags(ieee80211com_t *isc,
+    struct ieee80211channel *chan);
+int32_t ath_getchannels(ath_t *asc, uint32_t cc,
+    HAL_BOOL outdoor, HAL_BOOL xchanmode);
+int32_t ath_chan_set(ath_t *asc, struct ieee80211channel *chan);
+int ath_txq_setup(ath_t *asc);
+void ath_rate_setup(ath_t *asc, uint32_t mode);
+void ath_setcurmode(ath_t *asc, enum ieee80211_phymode mode);
+void ath_mode_init(ath_t *asc);
+void ath_draintxq(ath_t *asc);
+void ath_initkeytable(ath_t *asc);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ATH_AUX_H */

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/uts/common/io/ath/ath_hal.h	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,973 @@
+/*
+ * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting, Atheros
+ * Communications, Inc.  All rights reserved.
+ *
+ * Use is subject to license terms.
+ *
+ * Redistribution and use in source and binary forms are permitted
+ * provided that the following conditions are met:
+ * 1. The materials contained herein are unmodified and are used
+ * unmodified.
+ * 2. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following NO
+ * ''WARRANTY'' disclaimer below (''Disclaimer''), without
+ * modification.
+ * 3. Redistributions in binary form must reproduce at minimum a
+ * disclaimer similar to the Disclaimer below and any redistribution
+ * must be conditioned upon including a substantially similar
+ * Disclaimer requirement for further binary redistribution.
+ * 4. Neither the names of the above-listed copyright holders nor the
+ * names of any contributors may be used to endorse or promote
+ * product derived from this software without specific prior written
+ * permission.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ''AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT,
+ * MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE
+ * FOR SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGES.
+ *
+ */
+
+#ifndef _ATH_HAL_H
+#define	_ATH_HAL_H
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+/*
+ * ath_hal.h is released by Atheros and used to describe the Atheros
+ * Hardware Access Layer(HAL) interface. All kinds of data structures,
+ * constant definition, APIs declaration are defined here.Clients of
+ * the HAL call ath_hal_attach() to obtain a reference to an ath_hal
+ * structure for use with the device. Hardware-related operations that
+ * follow must call back into the HAL through interface, supplying the
+ * reference as the first parameter.
+ */
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* HAL version of this release */
+#define	HAL_ABI_VERSION	0x04112900	/* YYMMDDnn */
+
+/* HAL data type definition */
+typedef void *		HAL_SOFTC;
+typedef int		HAL_BUS_TAG;
+typedef void *		HAL_BUS_HANDLE;
+typedef uint32_t 	HAL_BUS_ADDR;
+typedef uint16_t 	HAL_CTRY_CODE;	/* country code */
+typedef uint16_t 	HAL_REG_DOMAIN;	/* regulatory domain code */
+
+#define	HAL_NUM_TX_QUEUES	10		/* max number of tx queues */
+
+#define	HAL_BEACON_PERIOD	0x0000ffff	/* beacon interval period */
+#define	HAL_BEACON_ENA		0x00800000	/* beacon xmit enable */
+#define	HAL_BEACON_RESET_TSF	0x01000000	/* clear TSF */
+
+#define	CHANNEL_RAD_INT	0x0001	/* Radar interference detected on channel */
+#define	CHANNEL_CW_INT	0x0002	/* CW interference detected on channel */
+#define	CHANNEL_BUSY	0x0004	/* Busy, occupied or overlap with adjoin chan */
+#define	CHANNEL_TURBO	0x0010	/* Turbo Channel */
+#define	CHANNEL_CCK	0x0020	/* CCK channel */
+#define	CHANNEL_OFDM	0x0040	/* OFDM channel */
+#define	CHANNEL_2GHZ	0x0080	/* 2 GHz spectrum channel. */
+#define	CHANNEL_5GHZ	0x0100	/* 5 GHz spectrum channel */
+#define	CHANNEL_PASSIVE	0x0200	/* Only passive scan allowed in the channel */
+#define	CHANNEL_DYN	0x0400	/* dynamic CCK-OFDM channel */
+#define	CHANNEL_XR	0x0800	/* XR channel */
+#define	CHANNEL_AR	0x8000  /* Software use: radar detected */
+
+#define	CHANNEL_A	(CHANNEL_5GHZ|CHANNEL_OFDM)
+#define	CHANNEL_B	(CHANNEL_2GHZ|CHANNEL_CCK)
+#define	CHANNEL_PUREG	(CHANNEL_2GHZ|CHANNEL_OFDM)
+#define	CHANNEL_G	(CHANNEL_2GHZ|CHANNEL_OFDM)
+#define	CHANNEL_T	(CHANNEL_5GHZ|CHANNEL_OFDM|CHANNEL_TURBO)
+#define	CHANNEL_108G	(CHANNEL_2GHZ|CHANNEL_OFDM|CHANNEL_TURBO)
+#define	CHANNEL_X	(CHANNEL_5GHZ|CHANNEL_OFDM|CHANNEL_XR)
+#define	CHANNEL_ALL \
+	(CHANNEL_OFDM|CHANNEL_CCK|CHANNEL_5GHZ|CHANNEL_2GHZ|CHANNEL_TURBO)
+#define	CHANNEL_ALL_NOTURBO 	(CHANNEL_ALL &~ CHANNEL_TURBO)
+
+#define	HAL_RSSI_EP_MULTIPLIER	(1<<7)	/* pow2 to optimize out * and / */
+
+/* flags passed to tx descriptor setup methods */
+#define	HAL_TXDESC_CLRDMASK	0x0001	/* clear destination filter mask */
+#define	HAL_TXDESC_NOACK	0x0002	/* don't wait for ACK */
+#define	HAL_TXDESC_RTSENA	0x0004	/* enable RTS */
+#define	HAL_TXDESC_CTSENA	0x0008	/* enable CTS */
+#define	HAL_TXDESC_INTREQ	0x0010	/* enable per-descriptor interrupt */
+#define	HAL_TXDESC_VEOL		0x0020	/* mark virtual EOL */
+
+/* flags passed to rx descriptor setup methods */
+#define	HAL_RXDESC_INTREQ	0x0020	/* enable per-descriptor interrupt */
+
+/* tx error flags */
+#define	HAL_TXERR_XRETRY	0x01	/* excessive retries */
+#define	HAL_TXERR_FILT		0x02	/* blocked by tx filtering */
+#define	HAL_TXERR_FIFO		0x04	/* fifo underrun */
+#define	HAL_TXSTAT_ALTRATE	0x80	/* alternate xmit rate used */
+
+/* rx error flags */
+#define	HAL_RXERR_CRC		0x01	/* CRC error on frame */
+#define	HAL_RXERR_PHY		0x02	/* PHY error, rs_phyerr is valid */
+#define	HAL_RXERR_FIFO		0x04	/* fifo overrun */
+#define	HAL_RXERR_DECRYPT	0x08	/* non-Michael decrypt error */
+#define	HAL_RXERR_MIC		0x10	/* Michael MIC decrypt error */
+
+/* value found in rs_keyix to mark invalid entries */
+#define	HAL_RXKEYIX_INVALID	((uint8_t)-1)
+
+/* value used to specify no encryption key for xmit */
+#define	HAL_TXKEYIX_INVALID	((uint32_t)-1)
+
+/*
+ * Status codes that may be returned by the HAL.  Note that
+ * interfaces that return a status code set it only when an
+ * error occurs--i.e. you cannot check it for success.
+ */
+typedef enum {
+	HAL_OK		= 0,	/* No error */
+	HAL_ENXIO	= 1,	/* No hardware present */
+	HAL_ENOMEM	= 2,	/* Memory allocation failed */
+	HAL_EIO		= 3,	/* Hardware didn't respond as expected */
+	HAL_EEMAGIC	= 4,	/* EEPROM magic number invalid */
+	HAL_EEVERSION	= 5,	/* EEPROM version invalid */
+	HAL_EELOCKED	= 6,	/* EEPROM unreadable */
+	HAL_EEBADSUM	= 7,	/* EEPROM checksum invalid */
+	HAL_EEREAD	= 8,	/* EEPROM read problem */
+	HAL_EEBADMAC	= 9,	/* EEPROM mac address invalid */
+	HAL_EESIZE	= 10,	/* EEPROM size not supported */
+	HAL_EEWRITE	= 11,	/* Attempt to change write-locked EEPROM */
+	HAL_EINVAL	= 12,	/* Invalid parameter to function */
+	HAL_ENOTSUPP	= 13,	/* Hardware revision not supported */
+	HAL_ESELFTEST	= 14,	/* Hardware self-test failed */
+	HAL_EINPROGRESS	= 15	/* Operation incomplete */
+} HAL_STATUS;
+
+typedef enum {
+	AH_FALSE = 0,		/* NB: lots of code assumes false is zero */
+	AH_TRUE  = 1
+} HAL_BOOL;
+
+typedef enum {
+	HAL_CAP_REG_DMN		= 0,	/* current regulatory domain */
+	HAL_CAP_CIPHER		= 1,	/* hardware supports cipher */
+	HAL_CAP_TKIP_MIC	= 2,	/* handle TKIP MIC in hardware */
+	HAL_CAP_TKIP_SPLIT	= 3,	/* hardware TKIP uses split keys */
+	HAL_CAP_PHYCOUNTERS	= 4,	/* hardware PHY error counters */
+	HAL_CAP_DIVERSITY	= 5,	/* hardware supports fast diversity */
+	HAL_CAP_KEYCACHE_SIZE	= 6,	/* number of entries in key cache */
+	HAL_CAP_NUM_TXQUEUES	= 7,	/* number of hardware xmit queues */
+	HAL_CAP_VEOL		= 9,	/* hardware supports virtual EOL */
+	HAL_CAP_PSPOLL		= 10,	/* hardware has working PS-Poll */
+					/* support */
+	HAL_CAP_DIAG		= 11,	/* hardware diagnostic support */
+	HAL_CAP_COMPRESSION	= 12,	/* hardware supports compression */
+	HAL_CAP_BURST		= 13,	/* hardware supports packet bursting */
+	HAL_CAP_FASTFRAME	= 14,	/* hardware supoprts fast frames */
+	HAL_CAP_TXPOW		= 15,	/* global tx power limit  */
+	HAL_CAP_TPC		= 16	/* per-packet tx power control  */
+} HAL_CAPABILITY_TYPE;
+
+/*
+ * "States" for setting the LED.  These correspond to
+ * the possible 802.11 operational states and there may
+ * be a many-to-one mapping between these states and the
+ * actual hardware states for the LED's (i.e. the hardware
+ * may have fewer states).
+ */
+typedef enum {
+	HAL_LED_INIT	= 0,
+	HAL_LED_SCAN	= 1,
+	HAL_LED_AUTH	= 2,
+	HAL_LED_ASSOC	= 3,
+	HAL_LED_RUN	= 4
+} HAL_LED_STATE;
+
+/*
+ * Transmit queue types/numbers.  These are used to tag
+ * each transmit queue in the hardware and to identify a set
+ * of transmit queues for operations such as start/stop dma.
+ */
+typedef enum {
+	HAL_TX_QUEUE_INACTIVE	= 0,	/* queue is inactive/unused */
+	HAL_TX_QUEUE_DATA	= 1,	/* data xmit q's */
+	HAL_TX_QUEUE_BEACON	= 2,	/* beacon xmit q */
+	HAL_TX_QUEUE_CAB	= 3,	/* "crap after beacon" xmit q */
+	HAL_TX_QUEUE_PSPOLL	= 4	/* power-save poll xmit q */
+} HAL_TX_QUEUE;
+
+
+/*
+ * Transmit queue subtype.  These map directly to
+ * WME Access Categories (except for UPSD).  Refer
+ * to Table 5 of the WME spec.
+ */
+typedef enum {
+	HAL_WME_AC_BK	= 0,		/* background access category */
+	HAL_WME_AC_BE	= 1, 		/* best effort access category */
+	HAL_WME_AC_VI	= 2,		/* video access category */
+	HAL_WME_AC_VO	= 3,		/* voice access category */
+	HAL_WME_UPSD	= 4		/* uplink power save */
+} HAL_TX_QUEUE_SUBTYPE;
+
+/*
+ * Transmit queue flags that control various
+ * operational parameters.
+ */
+typedef enum {
+	TXQ_FLAG_TXOKINT_ENABLE	    = 0x0001,    /* enable TXOK interrupt */
+	TXQ_FLAG_TXERRINT_ENABLE    = 0x0001,    /* enable TXERR interrupt */
+	TXQ_FLAG_TXDESCINT_ENABLE   = 0x0002,    /* enable TXDESC interrupt */
+	TXQ_FLAG_TXEOLINT_ENABLE    = 0x0004,    /* enable TXEOL interrupt */
+	TXQ_FLAG_TXURNINT_ENABLE    = 0x0008,    /* enable TXURN interrupt */
+	TXQ_FLAG_BACKOFF_DISABLE    = 0x0010,    /* disable Post Backoff  */
+	TXQ_FLAG_COMPRESSION_ENABLE = 0x0020,    /* compression enabled */
+	/* enable ready time expiry policy */
+	TXQ_FLAG_RDYTIME_EXP_POLICY_ENABLE = 0x0040,
+	/* enable backoff while	sending fragment burst */
+	TXQ_FLAG_FRAG_BURST_BACKOFF_ENABLE = 0x0080
+} HAL_TX_QUEUE_FLAGS;
+
+typedef struct {
+	uint32_t	tqi_ver;		/* hal TXQ version */
+	HAL_TX_QUEUE_SUBTYPE tqi_subtype;	/* subtype if applicable */
+	HAL_TX_QUEUE_FLAGS tqi_qflags;		/* flags (see above) */
+	uint32_t	tqi_priority;		/* (not used) */
+	uint32_t	tqi_aifs;		/* AIFS shift */
+	int32_t		tqi_cwmin;		/* cwMin shift */
+	int32_t		tqi_cwmax;		/* cwMax shift */
+	uint16_t	tqi_shretry;		/* rts retry limit */
+	uint16_t	tqi_lgretry;		/* long retry limit(not used) */
+	uint32_t	tqi_cbrPeriod;
+	uint32_t	tqi_cbrOverflowLimit;
+	uint32_t	tqi_burstTime;
+	uint32_t	tqi_readyTime;
+} HAL_TXQ_INFO;
+
+/* token to use for aifs, cwmin, cwmax */
+#define	HAL_TXQ_USEDEFAULT	((uint32_t)-1)
+
+/*
+ * Transmit packet types.  This belongs in ah_desc.h, but
+ * is here so we can give a proper type to various parameters
+ * (and not require everyone include the file).
+ *
+ * NB: These values are intentionally assigned for
+ *     direct use when setting up h/w descriptors.
+ */
+typedef enum {
+	HAL_PKT_TYPE_NORMAL	= 0,
+	HAL_PKT_TYPE_ATIM	= 1,
+	HAL_PKT_TYPE_PSPOLL	= 2,
+	HAL_PKT_TYPE_BEACON	= 3,
+	HAL_PKT_TYPE_PROBE_RESP	= 4
+} HAL_PKT_TYPE;
+
+/* Rx Filter Frame Types */
+typedef enum {
+	HAL_RX_FILTER_UCAST	= 0x00000001,	/* Allow unicast frames */
+	HAL_RX_FILTER_MCAST	= 0x00000002,	/* Allow multicast frames */
+	HAL_RX_FILTER_BCAST	= 0x00000004,	/* Allow broadcast frames */
+	HAL_RX_FILTER_CONTROL	= 0x00000008,	/* Allow control frames */
+	HAL_RX_FILTER_BEACON	= 0x00000010,	/* Allow beacon frames */
+	HAL_RX_FILTER_PROM	= 0x00000020,	/* Promiscuous mode */
+	HAL_RX_FILTER_PROBEREQ	= 0x00000080,	/* Allow probe request frames */
+	HAL_RX_FILTER_PHYERR	= 0x00000100,	/* Allow phy errors */
+	HAL_RX_FILTER_PHYRADAR	= 0x00000200	/* Allow phy radar errors */
+} HAL_RX_FILTER;
+
+typedef enum {
+	HAL_PM_UNDEFINED	= 0,
+	HAL_PM_AUTO		= 1,
+	HAL_PM_AWAKE		= 2,
+	HAL_PM_FULL_SLEEP	= 3,
+	HAL_PM_NETWORK_SLEEP	= 4
+} HAL_POWER_MODE;
+
+/*
+ * NOTE WELL:
+ * These are mapped to take advantage of the common locations for many of
+ * the bits on all of the currently supported MAC chips. This is to make
+ * the ISR as efficient as possible, while still abstracting HW differences.
+ * When new hardware breaks this commonality this enumerated type, as well
+ * as the HAL functions using it, must be modified. All values are directly
+ * mapped unless commented otherwise.
+ */
+typedef enum {
+	HAL_INT_RX	= 0x00000001,	/* Non-common mapping */
+	HAL_INT_RXDESC	= 0x00000002,
+	HAL_INT_RXNOFRM	= 0x00000008,
+	HAL_INT_RXEOL	= 0x00000010,
+	HAL_INT_RXORN	= 0x00000020,
+	HAL_INT_TX	= 0x00000040,	/* Non-common mapping */
+	HAL_INT_TXDESC	= 0x00000080,
+	HAL_INT_TXURN	= 0x00000800,
+	HAL_INT_MIB	= 0x00001000,
+	HAL_INT_RXPHY	= 0x00004000,
+	HAL_INT_RXKCM	= 0x00008000,
+	HAL_INT_SWBA	= 0x00010000,
+	HAL_INT_BMISS	= 0x00040000,
+	HAL_INT_BNR	= 0x00100000,	/* Non-common mapping */
+	HAL_INT_GPIO	= 0x01000000,
+	HAL_INT_FATAL	= 0x40000000,	/* Non-common mapping */
+	HAL_INT_GLOBAL	= INT_MIN,	/* Set/clear IER */
+
+	/* Interrupt bits that map directly to ISR/IMR bits */
+	HAL_INT_COMMON  = HAL_INT_RXNOFRM
+			| HAL_INT_RXDESC
+			| HAL_INT_RXEOL
+			| HAL_INT_RXORN
+			| HAL_INT_TXURN
+			| HAL_INT_TXDESC
+			| HAL_INT_MIB
+			| HAL_INT_RXPHY
+			| HAL_INT_RXKCM
+			| HAL_INT_SWBA
+			| HAL_INT_BMISS
+			| HAL_INT_GPIO,
+	HAL_INT_NOCARD	= -1	/* To signal the card was removed */
+} HAL_INT;
+
+typedef enum {
+	HAL_RFGAIN_INACTIVE		= 0,
+	HAL_RFGAIN_READ_REQUESTED	= 1,
+	HAL_RFGAIN_NEED_CHANGE		= 2
+} HAL_RFGAIN;
+
+typedef enum {
+	HAL_PHYERR_UNDERRUN		= 0,	/* Transmit underrun */
+	HAL_PHYERR_TIMING		= 1,	/* Timing error */
+	HAL_PHYERR_PARITY		= 2,	/* Illegal parity */
+	HAL_PHYERR_RATE			= 3,	/* Illegal rate */
+	HAL_PHYERR_LENGTH		= 4,	/* Illegal length */
+	HAL_PHYERR_RADAR		= 5,	/* Radar detect */
+	HAL_PHYERR_SERVICE		= 6,	/* Illegal service */
+	HAL_PHYERR_TOR			= 7,	/* Transmit override receive */
+	/* NB: these are specific to the 5212 */
+	HAL_PHYERR_OFDM_TIMING		= 17,	/* */
+	HAL_PHYERR_OFDM_SIGNAL_PARITY	= 18,	/* */
+	HAL_PHYERR_OFDM_RATE_ILLEGAL	= 19,	/* */
+	HAL_PHYERR_OFDM_LENGTH_ILLEGAL	= 20,	/* */
+	HAL_PHYERR_OFDM_POWER_DROP	= 21,	/* */
+	HAL_PHYERR_OFDM_SERVICE		= 22,	/* */
+	HAL_PHYERR_OFDM_RESTART		= 23,	/* */
+	HAL_PHYERR_CCK_TIMING		= 25,	/* */
+	HAL_PHYERR_CCK_HEADER_CRC	= 26,	/* */
+	HAL_PHYERR_CCK_RATE_ILLEGAL	= 27,	/* */
+	HAL_PHYERR_CCK_SERVICE		= 30,	/* */
+	HAL_PHYERR_CCK_RESTART		= 31	/* */
+}HAL_PHYERR;
+
+/*
+ * Channels are specified by frequency.
+ */
+typedef struct {
+	uint16_t	channel;	/* setting in Mhz */
+	uint16_t	channelFlags;	/* see below */
+} HAL_CHANNEL;
+
+
+typedef struct {
+	uint32_t	ackrcv_bad;
+	uint32_t	rts_bad;
+	uint32_t	rts_good;
+	uint32_t	fcs_bad;
+	uint32_t	beacons;
+} HAL_MIB_STATS;
+
+
+enum {
+	CTRY_DEBUG	= 0x1ff,		/* debug country code */
+	CTRY_DEFAULT	= 0			/* default country code */
+};
+
+enum {
+	HAL_MODE_11A	= 0x001,
+	HAL_MODE_TURBO	= 0x002,
+	HAL_MODE_11B	= 0x004,
+	HAL_MODE_PUREG	= 0x008,
+	HAL_MODE_11G	= 0x008,
+	HAL_MODE_108G	= 0x020,
+	HAL_MODE_ALL	= 0xfff
+};
+
+typedef struct {
+	int		rateCount;		/* NB: for proper padding */
+	uint8_t	rateCodeToIndex[32];	/* back mapping */
+	struct {
+		uint8_t	valid;		/* valid for rate control use */
+		uint8_t	phy;		/* CCK/OFDM/XR */
+		uint16_t rateKbps;	/* transfer rate in kbs */
+		uint8_t	rateCode;	/* rate for h/w descriptors */
+		/* mask for enabling short preamble in CCK rate code */
+		uint8_t	shortPreamble;
+		/* value for supported rates info element of MLME */
+		uint8_t	dot11Rate;
+		/* index of next lower basic rate; used for dur. calcs */
+		uint8_t	controlRate;
+		uint16_t lpAckDuration;	/* long preamble ACK duration */
+		uint16_t spAckDuration;	/* short preamble ACK duration */
+	} info[32];
+} HAL_RATE_TABLE;
+
+typedef struct {
+	uint32_t	rs_count;	/* number of valid entries */
+	uint8_t	rs_rates[32];		/* rates */
+} HAL_RATE_SET;
+
+typedef enum {
+	HAL_ANT_VARIABLE = 0,		/* variable by programming */
+	HAL_ANT_FIXED_A	 = 1,		/* fixed to 11a frequencies */
+	HAL_ANT_FIXED_B	 = 2		/* fixed to 11b frequencies */
+} HAL_ANT_SETTING;
+
+typedef enum {
+	HAL_M_STA	= 1,		/* infrastructure station */
+	HAL_M_IBSS	= 0,		/* IBSS (adhoc) station */
+	HAL_M_HOSTAP	= 6,		/* Software Access Point */
+	HAL_M_MONITOR	= 8		/* Monitor mode */
+} HAL_OPMODE;
+
+typedef struct {
+	uint8_t	kv_type;		/* one of HAL_CIPHER */
+	uint8_t	kv_pad;
+	uint16_t	kv_len;		/* length in bits */
+	uint8_t	kv_val[16];		/* enough for 128-bit keys */
+	uint8_t	kv_mic[8];		/* TKIP MIC key */
+} HAL_KEYVAL;
+
+typedef enum {
+	HAL_CIPHER_WEP		= 0,
+	HAL_CIPHER_AES_OCB	= 1,
+	HAL_CIPHER_AES_CCM	= 2,
+	HAL_CIPHER_CKIP		= 3,
+	HAL_CIPHER_TKIP		= 4,
+	HAL_CIPHER_CLR		= 5,	/* no encryption */
+
+	HAL_CIPHER_MIC		= 127	/* TKIP-MIC, not a cipher */
+} HAL_CIPHER;
+
+enum {
+	HAL_SLOT_TIME_9	 = 9,
+	HAL_SLOT_TIME_20 = 20
+};
+
+/*
+ * Per-station beacon timer state.  Note that the specified
+ * beacon interval (given in TU's) can also include flags
+ * to force a TSF reset and to enable the beacon xmit logic.
+ * If bs_cfpmaxduration is non-zero the hardware is setup to
+ * coexist with a PCF-capable AP.
+ */
+typedef struct {
+	uint32_t	bs_nexttbtt;		/* next beacon in TU */
+	uint32_t	bs_nextdtim;		/* next DTIM in TU */
+	uint32_t	bs_intval;		/* beacon interval+flags */
+	uint32_t	bs_dtimperiod;
+	uint16_t	bs_cfpperiod;		/* CFP period in TU */
+	uint16_t	bs_cfpmaxduration;	/* max CFP duration in TU */
+	uint32_t	bs_cfpnext;		/* next CFP in TU */
+	uint16_t	bs_timoffset;		/* byte offset to TIM bitmap */
+	uint16_t	bs_bmissthreshold;	/* beacon miss threshold */
+	uint32_t	bs_sleepduration;	/* max sleep duration */
+} HAL_BEACON_STATE;
+
+/*
+ * Per-node statistics maintained by the driver for use in
+ * optimizing signal quality and other operational aspects.
+ */
+typedef struct {
+	uint32_t	ns_avgbrssi;	/* average beacon rssi */
+	uint32_t	ns_avgrssi;	/* average data rssi */
+	uint32_t	ns_avgtxrssi;	/* average tx rssi */
+} HAL_NODE_STATS;
+
+/*
+ * Transmit descriptor status.  This structure is filled
+ * in only after the tx descriptor process method finds a
+ * ``done'' descriptor; at which point it returns something
+ * other than HAL_EINPROGRESS.
+ *
+ * Note that ts_antenna may not be valid for all h/w.  It
+ * should be used only if non-zero.
+ */
+struct ath_tx_status {
+	uint16_t	ts_seqnum;	/* h/w assigned sequence number */
+	uint16_t	ts_tstamp;	/* h/w assigned timestamp */
+	uint8_t		ts_status;	/* frame status, 0 => xmit ok */
+	uint8_t		ts_rate;	/* h/w transmit rate index */
+	int8_t		ts_rssi;	/* tx ack RSSI */
+	uint8_t		ts_shortretry;	/* # short retries */
+	uint8_t		ts_longretry;	/* # long retries */
+	uint8_t		ts_virtcol;	/* virtual collision count */
+	uint8_t		ts_antenna;	/* antenna information */
+};
+
+
+/*
+ * Receive descriptor status.  This structure is filled
+ * in only after the rx descriptor process method finds a
+ * ``done'' descriptor; at which point it returns something
+ * other than HAL_EINPROGRESS.
+ *
+ * If rx_status is zero, then the frame was received ok;
+ * otherwise the error information is indicated and rs_phyerr
+ * contains a phy error code if HAL_RXERR_PHY is set.  In general
+ * the frame contents is undefined when an error occurred thought
+ * for some errors (e.g. a decryption error), it may be meaningful.
+ *
+ * Note that the receive timestamp is expanded using the TSF to
+ * a full 16 bits (regardless of what the h/w provides directly).
+ *
+ * rx_rssi is in units of dbm above the noise floor.  This value
+ * is measured during the preamble and PLCP; i.e. with the initial
+ * 4us of detection.  The noise floor is typically a consistent
+ * -96dBm absolute power in a 20MHz channel.
+ */
+struct ath_rx_status {
+	uint16_t	rs_datalen;	/* rx frame length */
+	uint16_t	rs_tstamp;	/* h/w assigned timestamp */
+	uint8_t		rs_status;	/* rx status, 0 => recv ok */
+	uint8_t		rs_phyerr;	/* phy error code */
+	int8_t		rs_rssi;	/* rx frame RSSI */
+	uint8_t		rs_keyix;	/* key cache index */
+	uint8_t		rs_rate;	/* h/w receive rate index */
+	uint8_t		rs_antenna;	/* antenna information */
+	uint8_t		rs_more;	/* see HAL_RXERR_XXX definition */
+};
+
+/*
+ * Definitions for the software frame/packet descriptors used by
+ * the Atheros HAL.  This definition obscures hardware-specific
+ * details from the driver.  Drivers are expected to fillin the
+ * portions of a descriptor that are not opaque then use HAL calls
+ * to complete the work.  Status for completed frames is returned
+ * in a device-independent format.
+ */
+#pragma pack(1)
+struct ath_desc {
+	/*
+	 * The following definitions are passed directly
+	 * the hardware and managed by the HAL.  Drivers
+	 * should not touch those elements marked opaque.
+	 */
+	uint32_t	ds_link;	/* phys address of next descriptor */
+	uint32_t	ds_data;	/* phys address of data buffer */
+	uint32_t	ds_ctl0;	/* opaque DMA control 0 */
+	uint32_t	ds_ctl1;	/* opaque DMA control 1 */
+	uint32_t	ds_hw[4];	/* opaque h/w region */
+	/*
+	 * The remaining definitions are managed by software;
+	 * these are valid only after the rx/tx process descriptor
+	 * methods return a non-EINPROGRESS  code.
+	 */
+	union {
+		struct ath_tx_status tx; /* xmit status */
+		struct ath_rx_status rx; /* recv status */
+	} ds_us;
+};
+#pragma pack()
+
+#define	ds_txstat	ds_us.tx
+#define	ds_rxstat	ds_us.rx
+
+/*
+ * Hardware Access Layer (HAL) API.
+ *
+ * Clients of the HAL call ath_hal_attach to obtain a reference to an
+ * ath_hal structure for use with the device.  Hardware-related operations
+ * that follow must call back into the HAL through interface, supplying
+ * the reference as the first parameter.  Note that before using the
+ * reference returned by ath_hal_attach the caller should verify the
+ * ABI version number.
+ */
+struct ath_hal {
+	uint32_t	ah_magic;	/* consistency check magic number */
+	uint32_t	ah_abi;		/* HAL ABI version */
+	uint16_t	ah_devid;	/* PCI device ID */
+	uint16_t	ah_subvendorid;	/* PCI subvendor ID */
+	HAL_SOFTC	ah_sc;		/* back pointer to driver/os state */
+	HAL_BUS_TAG	ah_st;		/* params for register r+w */
+	HAL_BUS_HANDLE	ah_sh;
+	HAL_CTRY_CODE	ah_countryCode;
+
+	uint32_t	ah_macVersion;	/* MAC version id */
+	uint16_t	ah_macRev;	/* MAC revision */
+	uint16_t	ah_phyRev;	/* PHY revision */
+	uint16_t	ah_analog5GhzRev; /* 2GHz radio revision */
+	uint16_t	ah_analog2GhzRev; /* 5GHz radio revision */
+
+	const HAL_RATE_TABLE *(*ah_getRateTable)(struct ath_hal *,
+				uint32_t mode);
+	void	  (*ah_detach) (struct ath_hal *);
+
+	/* Reset functions */
+	HAL_BOOL  (*ah_reset) (struct ath_hal *, HAL_OPMODE,
+				HAL_CHANNEL *, HAL_BOOL bChannelChange,
+				HAL_STATUS *status);
+	HAL_BOOL   (*ah_phyDisable) (struct ath_hal *);
+	void	   (*ah_setPCUConfig) (struct ath_hal *);
+	HAL_BOOL  (*ah_perCalibration) (struct ath_hal *, HAL_CHANNEL *);
+	HAL_BOOL  (*ah_setTxPowerLimit)(struct ath_hal *, uint32_t);
+
+	/* Transmit functions */
+	HAL_BOOL  (*ah_updateTxTrigLevel) (struct ath_hal *,
+				HAL_BOOL incTrigLevel);
+	int	  (*ah_setupTxQueue) (struct ath_hal *, HAL_TX_QUEUE,
+				const HAL_TXQ_INFO *qInfo);
+	HAL_BOOL  (*ah_setTxQueueProps) (struct ath_hal *, int q,
+				const HAL_TXQ_INFO *qInfo);
+	HAL_BOOL  (*ah_getTxQueueProps)(struct ath_hal *, int q,
+				HAL_TXQ_INFO *qInfo);
+	HAL_BOOL  (*ah_releaseTxQueue) (struct ath_hal *ah, uint32_t q);
+	HAL_BOOL  (*ah_resetTxQueue) (struct ath_hal *ah, uint32_t q);
+	uint32_t (*ah_getTxDP) (struct ath_hal *, uint32_t);
+	HAL_BOOL  (*ah_setTxDP) (struct ath_hal *, uint32_t, uint32_t txdp);
+	uint32_t (*ah_numTxPending)(struct ath_hal *, uint32_t q);
+	HAL_BOOL  (*ah_startTxDma) (struct ath_hal *, uint32_t);
+	HAL_BOOL  (*ah_stopTxDma) (struct ath_hal *, uint32_t);
+	HAL_BOOL  (*ah_updateCTSForBursting)(struct ath_hal *,
+				struct ath_desc *, struct ath_desc *,
+				struct ath_desc *, struct ath_desc *,
+				uint32_t, uint32_t);
+	HAL_BOOL  (*ah_setupTxDesc) (struct ath_hal *, struct ath_desc *,
+				uint32_t pktLen, uint32_t hdrLen,
+				HAL_PKT_TYPE type, uint32_t txPower,
+				uint32_t txRate0, uint32_t txTries0,
+				uint32_t keyIx, uint32_t antMode,
+				uint32_t flags, uint32_t rtsctsRate,
+				uint32_t rtsctsDuration);
+	HAL_BOOL  (*ah_setupXTxDesc) (struct ath_hal *, struct ath_desc *,
+				uint32_t txRate1, uint32_t txTries1,
+				uint32_t txRate2, uint32_t txTries2,
+				uint32_t txRate3, uint32_t txTries3);
+	HAL_BOOL  (*ah_fillTxDesc) (struct ath_hal *, struct ath_desc *,
+				uint32_t segLen, HAL_BOOL firstSeg,
+				HAL_BOOL lastSeg, const struct ath_desc *);
+	HAL_STATUS (*ah_procTxDesc) (struct ath_hal *, struct ath_desc *);
+	void	   (*ah_getTxIntrQueue)(struct ath_hal *, uint32_t *);
+
+	/* Receive Functions */
+	uint32_t (*ah_getRxDP) (struct ath_hal *);
+	void	  (*ah_setRxDP) (struct ath_hal *, uint32_t rxdp);
+	void	  (*ah_enableReceive) (struct ath_hal *);
+	HAL_BOOL  (*ah_stopDmaReceive) (struct ath_hal *);
+	void	  (*ah_startPcuReceive) (struct ath_hal *);
+	void	  (*ah_stopPcuReceive) (struct ath_hal *);
+	void	  (*ah_setMulticastFilter) (struct ath_hal *,
+				uint32_t filter0, uint32_t filter1);
+	HAL_BOOL  (*ah_setMulticastFilterIndex) (struct ath_hal *,
+				uint32_t index);
+	HAL_BOOL  (*ah_clrMulticastFilterIndex) (struct ath_hal *,
+				uint32_t index);
+	uint32_t (*ah_getRxFilter) (struct ath_hal *);
+	void	  (*ah_setRxFilter) (struct ath_hal *, uint32_t);
+	HAL_BOOL  (*ah_setupRxDesc) (struct ath_hal *, struct ath_desc *,
+				uint32_t size, uint32_t flags);
+	HAL_STATUS (*ah_procRxDesc) (struct ath_hal *, struct ath_desc *,
+				uint32_t phyAddr, struct ath_desc *next);
+	void	  (*ah_rxMonitor) (struct ath_hal *,
+				const HAL_NODE_STATS *);
+	void	  (*ah_procMibEvent) (struct ath_hal *,
+				const HAL_NODE_STATS *);
+
+	/* Misc Functions */
+	HAL_STATUS  (*ah_getCapability) (struct ath_hal *,
+				HAL_CAPABILITY_TYPE, uint32_t capability,
+				uint32_t *result);
+	HAL_BOOL    (*ah_setCapability) (struct ath_hal *,
+				HAL_CAPABILITY_TYPE, uint32_t capability,
+				uint32_t setting, HAL_STATUS *);
+	HAL_BOOL    (*ah_getDiagState) (struct ath_hal *, int request,
+				const void *args, uint32_t argsize,
+				void **result, uint32_t *resultsize);
+	void	  (*ah_getMacAddress) (struct ath_hal *, uint8_t *);
+	HAL_BOOL  (*ah_setMacAddress) (struct ath_hal *, const uint8_t *);
+	HAL_BOOL  (*ah_setRegulatoryDomain) (struct ath_hal *,
+				uint16_t, HAL_STATUS *);
+	void	  (*ah_setLedState) (struct ath_hal *, HAL_LED_STATE);
+	void	  (*ah_writeAssocid) (struct ath_hal *,
+				const uint8_t *bssid, uint16_t assocId);
+	HAL_BOOL  (*ah_gpioCfgOutput) (struct ath_hal *, uint32_t gpio);
+	HAL_BOOL  (*ah_gpioCfgInput) (struct ath_hal *, uint32_t gpio);
+	uint32_t (*ah_gpioGet) (struct ath_hal *, uint32_t gpio);
+	HAL_BOOL  (*ah_gpioSet) (struct ath_hal *,
+				uint32_t gpio, uint32_t val);
+	void	  (*ah_gpioSetIntr) (struct ath_hal *, uint32_t, uint32_t);
+	uint32_t (*ah_getTsf32) (struct ath_hal *);
+	uint64_t (*ah_getTsf64) (struct ath_hal *);
+	void	  (*ah_resetTsf) (struct ath_hal *);
+	HAL_BOOL  (*ah_detectCardPresent) (struct ath_hal *);
+	void	  (*ah_updateMibCounters) (struct ath_hal *, HAL_MIB_STATS *);
+	HAL_RFGAIN (*ah_getRfGain) (struct ath_hal *);
+	uint32_t  (*ah_getDefAntenna) (struct ath_hal *);
+	void	  (*ah_setDefAntenna) (struct ath_hal *, uint32_t);
+	HAL_BOOL  (*ah_setSlotTime) (struct ath_hal *, uint32_t);
+	uint32_t  (*ah_getSlotTime) (struct ath_hal *);
+	HAL_BOOL  (*ah_setAckTimeout) (struct ath_hal *, uint32_t);
+	uint32_t  (*ah_getAckTimeout) (struct ath_hal *);
+	HAL_BOOL  (*ah_setCTSTimeout) (struct ath_hal *, uint32_t);
+	uint32_t  (*ah_getCTSTimeout) (struct ath_hal *);
+
+	/* Key Cache Functions */
+	uint32_t (*ah_getKeyCacheSize) (struct ath_hal *);
+	HAL_BOOL  (*ah_resetKeyCacheEntry) (struct ath_hal *, uint16_t);
+	HAL_BOOL  (*ah_isKeyCacheEntryValid) (struct ath_hal *, uint16_t);
+	HAL_BOOL  (*ah_setKeyCacheEntry) (struct ath_hal *,
+				uint16_t, const HAL_KEYVAL *,
+				const uint8_t *, int);
+	HAL_BOOL  (*ah_setKeyCacheEntryMac) (struct ath_hal *,
+				uint16_t, const uint8_t *);
+
+	/* Power Management Functions */
+	HAL_BOOL  (*ah_setPowerMode) (struct ath_hal *,
+				HAL_POWER_MODE mode, int setChip,
+				uint16_t sleepDuration);
+	HAL_POWER_MODE (*ah_getPowerMode) (struct ath_hal *);
+	HAL_BOOL  (*ah_initPSPoll) (struct ath_hal *);
+	HAL_BOOL  (*ah_enablePSPoll) (struct ath_hal *,
+				uint8_t *, uint16_t);
+	HAL_BOOL  (*ah_disablePSPoll) (struct ath_hal *);
+
+	/* Beacon Management Functions */
+	void	  (*ah_beaconInit) (struct ath_hal *,
+				uint32_t nexttbtt, uint32_t intval);
+	void	  (*ah_setStationBeaconTimers) (struct ath_hal *,
+				const HAL_BEACON_STATE *);
+	void	  (*ah_resetStationBeaconTimers) (struct ath_hal *);
+	HAL_BOOL  (*ah_waitForBeaconDone) (struct ath_hal *,
+				HAL_BUS_ADDR);
+
+	/* Interrupt functions */
+	HAL_BOOL  (*ah_isInterruptPending) (struct ath_hal *);
+	HAL_BOOL  (*ah_getPendingInterrupts) (struct ath_hal *, HAL_INT *);
+	HAL_INT	  (*ah_getInterrupts) (struct ath_hal *);
+	HAL_INT	  (*ah_setInterrupts) (struct ath_hal *, HAL_INT);
+};
+
+/*
+ * Check the PCI vendor ID and device ID against Atheros' values
+ * and return a printable description for any Atheros hardware.
+ * AH_NULL is returned if the ID's do not describe Atheros hardware.
+ */
+extern	const char *ath_hal_probe(uint16_t vendorid, uint16_t devid);
+
+/*
+ * Attach the HAL for use with the specified device.  The device is
+ * defined by the PCI device ID.  The caller provides an opaque pointer
+ * to an upper-layer data structure (HAL_SOFTC) that is stored in the
+ * HAL state block for later use.  Hardware register accesses are done
+ * using the specified bus tag and handle.  On successful return a
+ * reference to a state block is returned that must be supplied in all
+ * subsequent HAL calls.  Storage associated with this reference is
+ * dynamically allocated and must be freed by calling the ah_detach
+ * method when the client is done.  If the attach operation fails a
+ * null (AH_NULL) reference will be returned and a status code will
+ * be returned if the status parameter is non-zero.
+ */
+extern	struct ath_hal *ath_hal_attach(uint16_t devid, HAL_SOFTC,
+		HAL_BUS_TAG, HAL_BUS_HANDLE, HAL_STATUS *status);
+
+/*
+ * Return a list of channels available for use with the hardware.
+ * The list is based on what the hardware is capable of, the specified
+ * country code, the modeSelect mask, and whether or not outdoor
+ * channels are to be permitted.
+ *
+ * The channel list is returned in the supplied array.  maxchans
+ * defines the maximum size of this array.  nchans contains the actual
+ * number of channels returned.  If a problem occurred or there were
+ * no channels that met the criteria then AH_FALSE is returned.
+ */
+extern	HAL_BOOL  ath_hal_init_channels(struct ath_hal *,
+		HAL_CHANNEL *chans, uint32_t maxchans, uint32_t *nchans,
+		HAL_CTRY_CODE cc, uint16_t modeSelect,
+		HAL_BOOL enableOutdoor, HAL_BOOL enableExtendedChannels);
+
+/*
+ * Return bit mask of wireless modes supported by the hardware.
+ */
+extern	uint32_t  ath_hal_getwirelessmodes(struct ath_hal *, HAL_CTRY_CODE);
+
+/*
+ * Return rate table for specified mode (11a, 11b, 11g, etc).
+ */
+extern	const HAL_RATE_TABLE *  ath_hal_getratetable(struct ath_hal *,
+		uint32_t mode);
+
+/*
+ * Calculate the transmit duration of a frame.
+ */
+extern uint16_t  ath_hal_computetxtime(struct ath_hal *,
+		const HAL_RATE_TABLE *rates, uint32_t frameLen,
+		uint16_t rateix, HAL_BOOL shortPreamble);
+
+/*
+ * Convert between IEEE channel number and channel frequency
+ * using the specified channel flags; e.g. CHANNEL_2GHZ.
+ */
+extern	uint32_t  ath_hal_mhz2ieee(uint32_t mhz, uint32_t flags);
+extern	uint32_t  ath_hal_ieee2mhz(uint32_t ieee, uint32_t flags);
+
+/*
+ * Return a version string for the HAL release.
+ */
+extern	char ath_hal_version[];
+
+/*
+ * Return a NULL-terminated array of build/configuration options.
+ */
+extern	const char *ath_hal_buildopts[];
+
+/*
+ * Macros to encapsulated HAL functions.
+ */
+#define	ATH_HAL_RESET(_ah, _opmode, _chan, _outdoor, _pstatus) \
+	((*(_ah)->ah_reset)((_ah), (_opmode), (_chan), (_outdoor), (_pstatus)))
+#define	ATH_HAL_GETCAPABILITY(_ah, _cap, _param, _result) \
+	((*(_ah)->ah_getCapability)((_ah), (_cap), (_param), (_result)))
+#define	ATH_HAL_GETREGDOMAIN(_ah, _prd) \
+	ATH_HAL_GETCAPABILITY(_ah, HAL_CAP_REG_DMN, 0, (_prd))
+#define	ATH_HAL_GETCOUNTRYCODE(_ah, _pcc) \
+	(*(_pcc) = (_ah)->ah_countryCode)
+#define	ATH_HAL_GETRATETABLE(_ah, _mode) \
+	((*(_ah)->ah_getRateTable)((_ah), (_mode)))
+#define	ATH_HAL_GETMAC(_ah, _mac) \
+	((*(_ah)->ah_getMacAddress)((_ah), (_mac)))
+#define	ATH_HAL_SETMAC(_ah, _mac) \
+	((*(_ah)->ah_setMacAddress)((_ah), (_mac)))
+#define	ATH_HAL_INTRSET(_ah, _mask) \
+	((*(_ah)->ah_setInterrupts)((_ah), (_mask)))
+#define	ATH_HAL_INTRGET(_ah) \
+	((*(_ah)->ah_getInterrupts)((_ah)))
+#define	ATH_HAL_INTRPEND(_ah) \
+	((*(_ah)->ah_isInterruptPending)((_ah)))
+#define	ATH_HAL_GETISR(_ah, _pmask) \
+	((*(_ah)->ah_getPendingInterrupts)((_ah), (_pmask)))
+#define	ATH_HAL_UPDATETXTRIGLEVEL(_ah, _inc) \
+	((*(_ah)->ah_updateTxTrigLevel)((_ah), (_inc)))
+#define	ATH_HAL_SETPOWER(_ah, _mode, _sleepduration) \
+	((*(_ah)->ah_setPowerMode)((_ah), (_mode), AH_TRUE, (_sleepduration)))
+#define	ATH_HAL_KEYRESET(_ah, _ix) \
+	((*(_ah)->ah_resetKeyCacheEntry)((_ah), (_ix)))
+#define	ATH_HAL_KEYSET(_ah, _ix, _pk) \
+	((*(_ah)->ah_setKeyCacheEntry)((_ah), (_ix), (_pk), NULL, AH_FALSE))
+#define	ATH_HAL_KEYISVALID(_ah, _ix) \
+	(((*(_ah)->ah_isKeyCacheEntryValid)((_ah), (_ix))))
+#define	ATH_HAL_KEYSETMAC(_ah, _ix, _mac) \
+	((*(_ah)->ah_setKeyCacheEntryMac)((_ah), (_ix), (_mac)))
+#define	ATH_HAL_KEYCACHESIZE(_ah) \
+	((*(_ah)->ah_getKeyCacheSize)((_ah)))
+#define	ATH_HAL_GETRXFILTER(_ah) \
+	((*(_ah)->ah_getRxFilter)((_ah)))
+#define	ATH_HAL_SETRXFILTER(_ah, _filter) \
+	((*(_ah)->ah_setRxFilter)((_ah), (_filter)))
+#define	ATH_HAL_SETMCASTFILTER(_ah, _mfilt0, _mfilt1) \
+	((*(_ah)->ah_setMulticastFilter)((_ah), (_mfilt0), (_mfilt1)))
+#define	ATH_HAL_WAITFORBEACON(_ah, _bf) \
+	((*(_ah)->ah_waitForBeaconDone)((_ah), (_bf)->bf_daddr))
+#define	ATH_HAL_PUTRXBUF(_ah, _bufaddr) \
+	((*(_ah)->ah_setRxDP)((_ah), (_bufaddr)))
+#define	ATH_HAL_GETTSF32(_ah) \
+	((*(_ah)->ah_getTsf32)((_ah)))
+#define	ATH_HAL_GETTSF64(_ah) \
+	((*(_ah)->ah_getTsf64)((_ah)))
+#define	ATH_HAL_RESETTSF(_ah) \
+	((*(_ah)->ah_resetTsf)((_ah)))
+#define	ATH_HAL_RXENA(_ah) \
+	((*(_ah)->ah_enableReceive)((_ah)))
+#define	ATH_HAL_PUTTXBUF(_ah, _q, _bufaddr) \
+	((*(_ah)->ah_setTxDP)((_ah), (_q), (_bufaddr)))
+#define	ATH_HAL_GETTXBUF(_ah, _q) \
+	((*(_ah)->ah_getTxDP)((_ah), (_q)))
+#define	ATH_HAL_GETRXBUF(_ah) \
+	((*(_ah)->ah_getRxDP)((_ah)))
+#define	ATH_HAL_TXSTART(_ah, _q) \
+	((*(_ah)->ah_startTxDma)((_ah), (_q)))
+#define	ATH_HAL_SETCHANNEL(_ah, _chan) \
+	((*(_ah)->ah_setChannel)((_ah), (_chan)))
+#define	ATH_HAL_CALIBRATE(_ah, _chan) \
+	((*(_ah)->ah_perCalibration)((_ah), (_chan)))
+#define	ATH_HAL_SETLEDSTATE(_ah, _state) \
+	((*(_ah)->ah_setLedState)((_ah), (_state)))
+#define	ATH_HAL_BEACONINIT(_ah, _nextb, _bperiod) \
+	((*(_ah)->ah_beaconInit)((_ah), (_nextb), (_bperiod)))
+#define	ATH_HAL_BEACONRESET(_ah) \
+	((*(_ah)->ah_resetStationBeaconTimers)((_ah)))
+#define	ATH_HAL_BEACONTIMERS(_ah, _beacon_state) \
+	((*(_ah)->ah_setStationBeaconTimers)((_ah), (_beacon_state)))
+#define	ATH_HAL_SETASSOCID(_ah, _bss, _associd) \
+	((*(_ah)->ah_writeAssocid)((_ah), (_bss), (_associd)))
+#define	ATH_HAL_SETOPMODE(_ah) \
+	((*(_ah)->ah_setPCUConfig)((_ah)))
+#define	ATH_HAL_STOPTXDMA(_ah, _qnum) \
+	((*(_ah)->ah_stopTxDma)((_ah), (_qnum)))
+#define	ATH_HAL_STOPPCURECV(_ah) \
+	((*(_ah)->ah_stopPcuReceive)((_ah)))
+#define	ATH_HAL_STARTPCURECV(_ah) \
+	((*(_ah)->ah_startPcuReceive)((_ah)))
+#define	ATH_HAL_STOPDMARECV(_ah) \
+	((*(_ah)->ah_stopDmaReceive)((_ah)))
+#define	ATH_HAL_DUMPSTATE(_ah) \
+	((*(_ah)->ah_dumpState)((_ah)))
+#define	ATH_HAL_DUMPEEPROM(_ah) \
+	((*(_ah)->ah_dumpEeprom)((_ah)))
+#define	ATH_HAL_DUMPRFGAIN(_ah) \
+	((*(_ah)->ah_dumpRfGain)((_ah)))
+#define	ATH_HAL_DUMPANI(_ah) \
+	((*(_ah)->ah_dumpAni)((_ah)))
+#define	ATH_HAL_SETUPTXQUEUE(_ah, _type, _irq) \
+	((*(_ah)->ah_setupTxQueue)((_ah), (_type), (_irq)))
+#define	ATH_HAL_RESETTXQUEUE(_ah, _q) \
+	((*(_ah)->ah_resetTxQueue)((_ah), (_q)))
+#define	ATH_HAL_RELEASETXQUEUE(_ah, _q) \
+	((*(_ah)->ah_releaseTxQueue)((_ah), (_q)))
+#define	ATH_HAL_HASVEOL \
+	((*(_ah)->ah_hasVEOL)((_ah)))
+#define	ATH_HAL_GETRFGAIN(_ah) \
+	((*(_ah)->ah_getRfGain)((_ah)))
+#define	ATH_HAL_RXMONITOR(_ah, _arg) \
+	((*(_ah)->ah_rxMonitor)((_ah), (_arg)))
+#define	ATH_HAL_SETUPBEACONDESC(_ah, _ds, _opmode, _flen, _hlen, \
+		_rate, _antmode) \
+	((*(_ah)->ah_setupBeaconDesc)((_ah), (_ds), (_opmode), \
+		(_flen), (_hlen), (_rate), (_antmode)))
+#define	ATH_HAL_SETUPRXDESC(_ah, _ds, _size, _intreq) \
+	((*(_ah)->ah_setupRxDesc)((_ah), (_ds), (_size), (_intreq)))
+#define	ATH_HAL_RXPROCDESC(_ah, _ds, _dspa, _dsnext) \
+	((*(_ah)->ah_procRxDesc)((_ah), (_ds), (_dspa), (_dsnext)))
+#define	ATH_HAL_SETUPTXDESC(_ah, _ds, _plen, _hlen, _atype, _txpow, \
+		_txr0, _txtr0, _keyix, _ant, _flags, \
+		_rtsrate, _rtsdura) \
+	((*(_ah)->ah_setupTxDesc)((_ah), (_ds), (_plen), (_hlen), (_atype), \
+		(_txpow), (_txr0), (_txtr0), (_keyix), (_ant), \
+		(_flags), (_rtsrate), (_rtsdura)))
+#define	ATH_HAL_SETUPXTXDESC(_ah, _ds, \
+		_txr1, _txtr1, _txr2, _txtr2, _txr3, _txtr3) \
+	((*(_ah)->ah_setupXTxDesc)((_ah), (_ds), \
+		(_txr1), (_txtr1), (_txr2), (_txtr2), (_txr3), (_txtr3)))
+#define	ATH_HAL_FILLTXDESC(_ah, _ds, _l, _first, _last, _ath_desc) \
+	((*(_ah)->ah_fillTxDesc)((_ah), (_ds), (_l), (_first), (_last), \
+	(_ath_desc)))
+#define	ATH_HAL_TXPROCDESC(_ah, _ds) \
+	((*(_ah)->ah_procTxDesc)((_ah), (_ds)))
+#define	ATH_HAL_CIPHERSUPPORTED(_ah, _cipher) \
+	(ATH_HAL_GETCAPABILITY(_ah, HAL_CAP_CIPHER, _cipher, NULL) == HAL_OK)
+#define	ATH_HAL_TKIPSPLIT(_ah) \
+	(ATH_HAL_GETCAPABILITY(_ah, HAL_CAP_TKIP_SPLIT, 0, NULL) == HAL_OK)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* _ATH_HAL_H */

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/usr/src/uts/common/io/ath/ath_ieee80211.c	Sun Nov 27 19:11:23 2005 -0800
@@ -0,0 +1,2899 @@
+/*
+ * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+/*
+ * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer,
+ *    without modification.
+ * 2. Redistributions in binary form must reproduce at minimum a disclaimer
+ *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
+ *    redistribution must be conditioned upon including a substantially
+ *    similar Disclaimer requirement for further binary redistribution.
+ * 3. Neither the names of the above-listed copyright holders nor the names
+ *    of any contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * NO WARRANTY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
+ * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
+ * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGES.
+ *
+ */
+
+/*
+ * IEEE 802.11 generic handler
+ *
+ * This code is derived from NetBSD code; their copyright notice follows.
+ */
+
+/*
+ * Copyright (c) 2001 The NetBSD Foundation, Inc.
+ * All rights reserved.
+ *
+ * This code is derived from software contributed to The NetBSD Foundation
+ * by Atsushi Onoe.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *        This product includes software developed by the NetBSD
+ *        Foundation, Inc. and its contributors.
+ * 4. Neither the name of The NetBSD Foundation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+ * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/signal.h>
+#include <sys/stream.h>
+#include <sys/termio.h>
+#include <sys/errno.h>
+#include <sys/file.h>
+#include <sys/cmn_err.h>
+#include <sys/stropts.h>
+#include <sys/strsubr.h>
+#include <sys/strtty.h>
+#include <sys/kbio.h>
+#include <sys/cred.h>
+#include <sys/stat.h>
+#include <sys/consdev.h>
+#include <sys/kmem.h>
+#include <sys/modctl.h>
+#include <sys/ddi.h>
+#include <sys/sunddi.h>
+#include <sys/pci.h>
+#include <sys/errno.h>
+#include <sys/gld.h>
+#include <sys/dlpi.h>
+#include <sys/ethernet.h>
+#include <sys/byteorder.h>
+#include <sys/proc.h>
+#include <sys/note.h>
+#include <sys/strsun.h>
+#include <sys/list.h>
+#include <sys/byteorder.h>
+#include <inet/common.h>
+#include <inet/nd.h>
+#include <inet/mi.h>
+#include <inet/wifi_ioctl.h>
+#include "ath_ieee80211.h"
+#include "ath_impl.h"
+
+#define	list_empty(a) ((a)->list_head.list_next == &(a)->list_head)
+
+static const char *ieee80211_mgt_subtype_name[] = {
+	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
+	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
+	"beacon",	"atim",		"disassoc",	"auth",
+	"deauth",	"reserved#13",	"reserved#14",	"reserved#15"
+};
+
+extern pri_t minclsyspri;
+
+static void
+ieee80211_unref_node(struct ieee80211_node **in)
+{
+	*in = NULL;
+}
+
+static uint8_t
+ieee80211_get_rssi(struct ieee80211_node *in)
+{
+	/* no recent samples, use last known value */
+	return (in->in_recv_hist[in->in_hist_cur].irh_rssi);
+}
+
+static void
+ieee80211_reset_recvhist(struct ieee80211_node *in)
+{
+	int i;
+
+	for (i = 0; i < IEEE80211_RECV_HIST_LEN; ++i) {
+		in->in_recv_hist[i].irh_jiffies = IEEE80211_JIFFIES_NONE;
+		in->in_recv_hist[i].irh_rssi = 0;
+		in->in_recv_hist[i].irh_rstamp = 0;
+		in->in_recv_hist[i].irh_rantenna = 0;
+	}
+	in->in_hist_cur = IEEE80211_RECV_HIST_LEN - 1;
+}
+
+
+static void
+ieee80211_add_recvhist(struct ieee80211_node *in, uint8_t rssi,
+    uint32_t rstamp, uint8_t rantenna)
+{
+	if (++in->in_hist_cur >= IEEE80211_RECV_HIST_LEN)
+		in->in_hist_cur = 0;
+	in->in_recv_hist[in->in_hist_cur].irh_rssi = rssi;
+	in->in_recv_hist[in->in_hist_cur].irh_rstamp = rstamp;
+	in->in_recv_hist[in->in_hist_cur].irh_rantenna = rantenna;
+}
+
+/*
+ * Convert MHz frequency to IEEE channel number.
+ */
+uint32_t
+ieee80211_mhz2ieee(uint32_t freq, uint32_t flags)
+{
+	if (flags & IEEE80211_CHAN_2GHZ) {	/* 2GHz band */
+		if (freq == 2484)
+			return (14);
+		if (freq < 2484)
+			return ((freq - 2407) / 5);
+		else
+			return (15 + ((freq - 2512) / 20));
+	} else if (flags & IEEE80211_CHAN_5GHZ) {	/* 5Ghz band */
+		return ((freq - 5000) / 5);
+	} else {				/* either, guess */
+		if (freq == 2484)
+			return (14);
+		if (freq < 2484)
+			return ((freq - 2407) / 5);
+		if (freq < 5000)
+			return (15 + ((freq - 2512) / 20));
+		return ((freq - 5000) / 5);
+	}
+}
+
+/*
+ * Convert channel to IEEE channel number.
+ */
+uint32_t
+ieee80211_chan2ieee(ieee80211com_t *isc, struct ieee80211channel *ch)
+{
+	if (isc->isc_channels <= ch &&
+	    ch <= &isc->isc_channels[IEEE80211_CHAN_MAX])
+		return (ch - isc->isc_channels);
+	else if (ch == IEEE80211_CHAN_ANYC)
+		return (IEEE80211_CHAN_ANY);
+	else {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_chan2ieee(): "
+		    "invalid channel freq %u flags %x\n",
+		    ch->ich_freq, ch->ich_flags));
+		return (0);
+	}
+}
+
+/*
+ * Convert IEEE channel number to MHz frequency.
+ */
+uint32_t
+ieee80211_ieee2mhz(uint32_t chan, uint32_t flags)
+{
+	if (flags & IEEE80211_CHAN_2GHZ) {	/* 2GHz band */
+		if (chan == 14)
+			return (2484);
+		if (chan < 14)
+			return (2407 + chan * 5);
+		else
+			return (2512 + ((chan-15) * 20));
+	} else if (flags & IEEE80211_CHAN_5GHZ) {	/* 5Ghz band */
+		return (5000 + (chan * 5));
+	} else {				/* either, guess */
+		if (chan == 14)
+			return (2484);
+		if (chan < 14)			/* 0-13 */
+			return (2407 + chan * 5);
+		if (chan < 27)			/* 15-26 */
+			return (2512 + ((chan-15) * 20));
+		return (5000 + (chan * 5));
+	}
+}
+
+static void
+ieee80211_free_node(ieee80211com_t *isc, struct ieee80211_node *in)
+{
+	int32_t i, done;
+	struct ieee80211_node *in1;
+
+	/* remove in from list of isc->isc_in_list */
+	list_remove(&isc->isc_in_list, in);
+
+	/* remove in from list of isc->isc_inhash_list */
+	done = 0;
+	for (i = 0; i < IEEE80211_NODE_HASHSIZE; i++) {
+		in1 = list_head(&isc->isc_inhash_list[i]);
+		while (in1 != NULL) {
+			if (in1 == in) {
+				list_remove(&isc->isc_inhash_list[i], in);
+				done = 1;
+				break;
+			}
+			in1 = list_next(&isc->isc_inhash_list[i], in1);
+		}
+		if (done)
+			break;
+	}
+
+	if (list_empty(&isc->isc_in_list))
+		isc->isc_inact_timeout = 0;
+	if (isc->isc_node_free != NULL)
+		(*isc->isc_node_free)(isc, in);
+}
+
+/*
+ * This function is only running in software interrupt thread,
+ * and it will probably call back to LLD by isc_mgmt_send() or isc_new_state(),
+ * to avoid recursive mutex entry, we must make sure that
+ * the callers have release all LLD mutexs before calling ieee80211_input().
+ */
+void
+ieee80211_input(ieee80211com_t *isc, mblk_t *mp,
+	int32_t rssi, uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_node *in;
+	gld_mac_info_t *gld_p = isc->isc_dev;
+	struct ieee80211_frame *wh;
+	void (*rh)(ieee80211com_t *, mblk_t *, int32_t, uint32_t, uint32_t);
+	uint8_t dir, subtype;
+	uint8_t *bssid;
+	uint16_t rxseq;
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	if ((wh->ifrm_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
+	    IEEE80211_FC0_VERSION_0) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_input(): "
+		    "discard pkt with wrong version"));
+		goto out;
+	}
+
+	dir = wh->ifrm_fc[1] & IEEE80211_FC1_DIR_MASK;
+
+	mutex_enter(&isc->isc_genlock);
+	if (isc->isc_state != IEEE80211_S_SCAN) {
+		switch (isc->isc_opmode) {
+		case IEEE80211_M_STA:
+			in = isc->isc_bss;
+			if (!IEEE80211_ADDR_EQ(wh->ifrm_addr2, in->in_bssid))
+				goto out_with_mutex;
+			break;
+		case IEEE80211_M_IBSS:
+		case IEEE80211_M_AHDEMO:
+		case IEEE80211_M_HOSTAP:
+			if (dir == IEEE80211_FC1_DIR_NODS)
+				bssid = wh->ifrm_addr3;
+			else
+				bssid = wh->ifrm_addr1;
+			if (!IEEE80211_ADDR_EQ(bssid, isc->isc_bss->in_bssid) &&
+			    !IEEE80211_ADDR_EQ(bssid,
+			    gld_p->gldm_broadcast_addr)) {
+				/* not interested in */
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "ieee80211_input(): other bss %s\n",
+				    ieee80211_ether_sprintf(wh->ifrm_addr3)));
+				goto out_with_mutex;
+			}
+			in = ieee80211_find_node(isc, wh->ifrm_addr2);
+			if (in == NULL) {
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "ieee80211_input(): unknown src %s\n",
+				    ieee80211_ether_sprintf(wh->ifrm_addr2)));
+				/*
+				 * NB: Node allocation is handled in the
+				 * management handling routines.  Just fake
+				 * up a reference to the hosts's node to do
+				 * the stuff below.
+				 */
+				in = isc->isc_bss;
+			}
+			break;
+		default:
+			/* catch bad values */
+			break;
+		}
+		ieee80211_add_recvhist(in, rssi, rstamp, rantenna);
+		rxseq = in->in_rxseq;
+		in->in_rxseq = LE_16(*(uint16_t *)wh->ifrm_seq)
+		    >> IEEE80211_SEQ_SEQ_SHIFT;
+		/* fragment */
+		if ((wh->ifrm_fc[1] & IEEE80211_FC1_RETRY) &&
+		    rxseq == in->in_rxseq) {
+			/* duplicate, silently discarded */
+			goto out_with_mutex;
+		}
+		in->in_inact = 0;
+	}
+
+	switch (wh->ifrm_fc[0] & IEEE80211_FC0_TYPE_MASK) {
+	case IEEE80211_FC0_TYPE_DATA:
+		switch (isc->isc_opmode) {
+		case IEEE80211_M_STA:
+			if (dir != IEEE80211_FC1_DIR_FROMDS) {
+				ATH_DEBUG((ATH_DBG_80211, "ath: ",
+				    "ieee80211_input(): discard frame "
+				    "with invalid direction %x\n", dir));
+				goto out_with_mutex;
+			}
+			if (IEEE80211_IS_MULTICAST(wh->ifrm_addr1) &&
+			    IEEE80211_ADDR_EQ(wh->ifrm_addr3,
+			    gld_p->gldm_vendor_addr)) {
+				/*
+				 * In IEEE802.11 network, multicast packet
+				 * sent from me is broadcasted from AP.
+				 * It should be silently discarded for
+				 * SIMPLEX interface.
+				 */
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "ieee80211_input(): "
+				    "discard multicast echo\n"));
+				goto out_with_mutex;
+			}
+			break;
+		case IEEE80211_M_IBSS:
+		case IEEE80211_M_AHDEMO:
+			if (dir != IEEE80211_FC1_DIR_NODS)
+				goto out_with_mutex;
+			break;
+		case IEEE80211_M_HOSTAP:
+			/* need more work to support HOSTAP */
+			break;
+		}
+
+		mutex_exit(&isc->isc_genlock);
+		/* copy to listener after decrypt */
+		mp = ieee80211_decap(mp);
+		if (mp == NULL) {
+			ATH_DEBUG((ATH_DBG_80211, "ath: ",
+			    "ieee80211_input(): decapsulation failed\n"));
+			goto out;
+		}
+		gld_recv(gld_p, mp);
+		return;
+
+	case IEEE80211_FC0_TYPE_MGT:
+		if (dir != IEEE80211_FC1_DIR_NODS)
+			goto out_with_mutex;
+		if (isc->isc_opmode == IEEE80211_M_AHDEMO)
+			goto out_with_mutex;
+		subtype = wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
+
+		/* drop uninteresting frames */
+		if (isc->isc_state == IEEE80211_S_SCAN) {
+			if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
+			    subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP)
+				goto out_with_mutex;
+		} else {
+			if (isc->isc_opmode != IEEE80211_M_IBSS &&
+			    subtype == IEEE80211_FC0_SUBTYPE_BEACON)
+				goto out_with_mutex;
+		}
+
+		rh = isc->isc_recv_mgmt[subtype >> IEEE80211_FC0_SUBTYPE_SHIFT];
+		if (rh != NULL)
+			(*rh)(isc, mp, rssi, rstamp, rantenna);
+		goto out_with_mutex;
+
+	case IEEE80211_FC0_TYPE_CTL:
+	default:
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_input(): "
+		    "bad type %x\n", wh->ifrm_fc[0]));
+		break;
+	}
+out_with_mutex:
+	mutex_exit(&isc->isc_genlock);
+out:
+	if (mp != NULL)
+		freemsg(mp);	/* free the buffer alloced in ath_rx_handler */
+}
+
+static void
+ieee80211_free_allnodes(ieee80211com_t *isc)
+{
+	struct ieee80211_node *in;
+
+	in = list_head(&isc->isc_in_list);
+	while (in != NULL) {
+		ieee80211_free_node(isc, in);
+		in = list_head(&isc->isc_in_list);
+	}
+}
+
+/*
+ * Begin an active scan.
+ */
+static void
+ieee80211_begin_scan(ieee80211com_t *isc, struct ieee80211_node *in)
+{
+	ATH_DEBUG((ATH_DBG_80211, "ath: "
+	    "ieee80211_begin_scan(): begin %s scan\n",
+	    isc->isc_opmode != IEEE80211_M_HOSTAP ? "active" : "passive"));
+
+	/*
+	 * Initialize the active channel set based on the set
+	 * of available channels and the current PHY mode.
+	 */
+	bcopy(isc->isc_chan_active, isc->isc_chan_scan,
+	    sizeof (isc->isc_chan_active));
+
+	/*
+	 * Flush any previously seen AP's.  Note that this
+	 * assumes we don't act as both an AP and a station,
+	 * otherwise we'll potentially flush state of stations
+	 * associated with us.
+	 */
+	ieee80211_free_allnodes(isc);
+
+	clrbit(isc->isc_chan_scan, ieee80211_chan2ieee(isc, in->in_chan));
+	if (isc->isc_opmode != IEEE80211_M_HOSTAP) {
+		isc->isc_flags |= IEEE80211_F_ASCAN;
+		IEEE80211_SEND_MGMT(isc, in,
+		    IEEE80211_FC0_SUBTYPE_PROBE_REQ, 0);
+	}
+}
+
+static void
+ieee80211_create_ibss(ieee80211com_t *isc, struct ieee80211channel *chan)
+{
+	struct ieee80211_node *in;
+
+	in = isc->isc_bss;
+	ATH_DEBUG((ATH_DBG_80211, "ath: "
+	    "ieee80211_create_ibss(): creating ibss\n"));
+	isc->isc_flags |= IEEE80211_F_SIBSS;
+	in->in_chan = chan;
+	in->in_rates = isc->isc_sup_rates[
+	    ieee80211_chan2mode(isc, in->in_chan)];
+	IEEE80211_ADDR_COPY(in->in_macaddr, isc->isc_macaddr);
+	IEEE80211_ADDR_COPY(in->in_bssid, isc->isc_macaddr);
+
+	if (isc->isc_opmode == IEEE80211_M_IBSS)
+		in->in_bssid[0] |= 0x02;	/* local bit for IBSS */
+	in->in_esslen = isc->isc_des_esslen;
+	bcopy(isc->isc_des_essid, in->in_essid, in->in_esslen);
+	ieee80211_reset_recvhist(in);
+	bzero(in->in_tstamp, sizeof (in->in_tstamp));
+	in->in_intval = isc->isc_lintval;
+	in->in_capinfo = IEEE80211_CAPINFO_IBSS;
+	if (isc->isc_flags & IEEE80211_F_WEPON)
+		in->in_capinfo |= IEEE80211_CAPINFO_PRIVACY;
+	if (isc->isc_phytype == IEEE80211_T_FH) {
+		in->in_fhdwell = 200;
+		in->in_fhindex = 1;
+	}
+	(void) _ieee80211_new_state(isc, IEEE80211_S_RUN, -1);
+}
+
+
+/*
+ * The difference between _ieee80211_new_state() and ieee80211_new_state()
+ * is the former asserts isc_genlock is already held.
+ * _ieee80211_new_state() is called from Multi-func thread and GLD thread,
+ * because ic_genlock is already owned at its entry in those 2 types of thread.
+ * ieee80211_new_state() is just for software interrupt thread in LLD.
+ *
+ * Because of the reason to avoid recursive mutex entry, the caller can't hold
+ * any other LLD mutexs before calling ieee80211_new_state().
+ */
+int
+_ieee80211_new_state(ieee80211com_t *isc, enum ieee80211_state nstate,
+    int32_t mgt)
+{
+	gld_mac_info_t *gld_p = isc->isc_dev;
+	struct ieee80211_node *in;
+	int error, ostate;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	ostate = isc->isc_state;
+	if (isc->isc_new_state) {
+		error = (*isc->isc_new_state)(isc, nstate);
+		if (error == EINPROGRESS)
+			return (0);
+		if (error != 0)
+			return (error);
+	}
+
+	isc->isc_state = nstate;
+	in = isc->isc_bss;
+
+	/* state transition */
+	switch (nstate) {
+	case IEEE80211_S_INIT:
+		switch (ostate) {
+		case IEEE80211_S_INIT:
+			break;
+		case IEEE80211_S_RUN:
+			switch (isc->isc_opmode) {
+			case IEEE80211_M_STA:
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_DISASSOC,
+				    IEEE80211_REASON_ASSOC_LEAVE);
+				break;
+			default:
+				break;
+			}
+		case IEEE80211_S_ASSOC:
+			switch (isc->isc_opmode) {
+			case IEEE80211_M_STA:
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_DEAUTH,
+				    IEEE80211_REASON_AUTH_LEAVE);
+				break;
+			default:
+				break;
+			}
+		case IEEE80211_S_AUTH:
+		case IEEE80211_S_SCAN:
+			break;
+		}
+		isc->isc_mgt_timeout = 0;
+		isc->isc_inact_timeout = 0;
+		break;
+	case IEEE80211_S_SCAN:
+		isc->isc_flags &= ~IEEE80211_F_SIBSS;
+		/* initialize bss for probe request */
+		IEEE80211_ADDR_COPY(in->in_macaddr, gld_p->gldm_broadcast_addr);
+		IEEE80211_ADDR_COPY(in->in_bssid, gld_p->gldm_broadcast_addr);
+		in->in_rates = isc->isc_sup_rates[
+		    ieee80211_chan2mode(isc, in->in_chan)];
+		in->in_associd = 0;
+		ieee80211_reset_recvhist(in);
+		switch (ostate) {
+		case IEEE80211_S_INIT:
+			if ((isc->isc_opmode == IEEE80211_M_HOSTAP ||
+			    isc->isc_opmode == IEEE80211_M_IBSS) &&
+			    isc->isc_des_chan != IEEE80211_CHAN_ANYC) {
+				/*
+				 * AP operation and we already have a channel;
+				 * bypass the scan and startup immediately.
+				 * Same applies to ad-hoc mode.
+				 */
+				ieee80211_create_ibss(isc, isc->isc_des_chan);
+			} else {
+				ieee80211_begin_scan(isc, in);
+			}
+			break;
+		case IEEE80211_S_SCAN:
+			/* scan next */
+			if (isc->isc_flags & IEEE80211_F_ASCAN) {
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_PROBE_REQ, 0);
+			}
+			break;
+		case IEEE80211_S_RUN:
+			/* beacon miss */
+			ATH_DEBUG((ATH_DBG_80211, "ath: "
+			    "_ieee80211_new_state(): no recent beacons"
+			    " from %s; rescanning\n",
+			    ieee80211_ether_sprintf(isc->isc_bss->in_bssid)));
+			ieee80211_free_allnodes(isc);
+			break;
+		case IEEE80211_S_AUTH:
+		case IEEE80211_S_ASSOC:
+			/* timeout, restart scan */
+			in = ieee80211_find_node(isc, isc->isc_bss->in_macaddr);
+			if (in != NULL) {
+				in->in_fails++;
+			}
+			ieee80211_begin_scan(isc, isc->isc_bss);
+			break;
+		default:
+			break;
+		}
+		break;
+	case IEEE80211_S_AUTH:
+		switch (ostate) {
+		case IEEE80211_S_INIT:
+			ATH_DEBUG((ATH_DBG_80211, "ath(): "
+			    "_ieee80211_new_state(): invalid transition\n"));
+			break;
+		case IEEE80211_S_SCAN:
+			IEEE80211_SEND_MGMT(isc, in,
+			    IEEE80211_FC0_SUBTYPE_AUTH, 1);
+			break;
+		case IEEE80211_S_AUTH:
+		case IEEE80211_S_ASSOC:
+			switch (mgt) {
+			case IEEE80211_FC0_SUBTYPE_AUTH:
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
+				break;
+			case IEEE80211_FC0_SUBTYPE_DEAUTH:
+				/* ignore and retry scan on timeout */
+				break;
+			}
+			break;
+		case IEEE80211_S_RUN:
+			switch (mgt) {
+			case IEEE80211_FC0_SUBTYPE_AUTH:
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
+				isc->isc_state = ostate;	/* stay RUN */
+				break;
+			case IEEE80211_FC0_SUBTYPE_DEAUTH:
+				/* try to reauth */
+				IEEE80211_SEND_MGMT(isc, in,
+				    IEEE80211_FC0_SUBTYPE_AUTH, 1);
+				break;
+			}
+			break;
+		}
+		break;
+	case IEEE80211_S_ASSOC:
+		switch (ostate) {
+		case IEEE80211_S_INIT:
+		case IEEE80211_S_SCAN:
+		case IEEE80211_S_ASSOC:
+			ATH_DEBUG((ATH_DBG_80211, "ath: "
+			    "_ieee80211_new_state(): invalid transition\n"));
+			break;
+		case IEEE80211_S_AUTH:
+			IEEE80211_SEND_MGMT(isc, in,
+			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
+			break;
+		case IEEE80211_S_RUN:
+			IEEE80211_SEND_MGMT(isc, in,
+			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 1);
+			break;
+		}
+		break;
+	case IEEE80211_S_RUN:
+		switch (ostate) {
+		case IEEE80211_S_INIT:
+		case IEEE80211_S_AUTH:
+		case IEEE80211_S_RUN:
+			ATH_DEBUG((ATH_DBG_80211, "ath: "
+			    "_ieee80211_new_state(): invalid transition\n"));
+			break;
+		case IEEE80211_S_SCAN:		/* adhoc/hostap mode */
+		case IEEE80211_S_ASSOC:		/* infra mode */
+			if (isc->isc_opmode == IEEE80211_M_STA)
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "_ieee80211_new_state(): "
+				    "associated with %s\n",
+				    ieee80211_ether_sprintf(in->in_bssid)));
+			else
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "_ieee80211_new_state(): "
+				    "asynchronized with %s\n",
+				    ieee80211_ether_sprintf(in->in_bssid)));
+			ATH_DEBUG((ATH_DBG_80211, "ath: "
+			    "_ieee80211_new_state(): "
+			    "essid %s, channel %d, start %uMb\n",
+			    ieee80211_essid_sprintf(in->in_essid,
+			    in->in_esslen),
+			    ieee80211_chan2ieee(isc, in->in_chan),
+			    IEEE80211_RATE2MBS(in->in_rates.ir_rates[
+			    in->in_txrate])));
+			isc->isc_mgt_timeout = 0;
+			break;
+		}
+		break;
+	}
+	return (0);
+}
+
+int
+ieee80211_new_state(ieee80211com_t *isc, enum ieee80211_state nstate,
+    int32_t mgt)
+{
+	int result;
+
+	mutex_enter(&isc->isc_genlock);
+	result = _ieee80211_new_state(isc, nstate, mgt);
+	mutex_exit(&isc->isc_genlock);
+
+	return (result);
+}
+
+static void
+ieee80211_timeout_nodes(ieee80211com_t *isc)
+{
+	struct ieee80211_node *in, *nextbs;
+
+	for (in = list_head(&isc->isc_in_list); in != NULL; ) {
+		if (++in->in_inact <= IEEE80211_INACT_MAX) {
+			in = list_next(&isc->isc_in_list, in);
+			continue;
+		}
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "station %s timed out due to inactivity"
+		    " (%u secs)\n", ieee80211_ether_sprintf(in->in_macaddr),
+		    in->in_inact));
+		nextbs = list_next(&isc->isc_in_list, in);
+		IEEE80211_SEND_MGMT(isc, in,
+		    IEEE80211_FC0_SUBTYPE_DEAUTH,
+		    IEEE80211_REASON_AUTH_EXPIRE);
+		ieee80211_free_node(isc, in);
+		in = nextbs;
+	}
+	if (!list_empty(&isc->isc_in_list))
+		isc->isc_inact_timeout = IEEE80211_INACT_WAIT;
+}
+
+int
+ieee80211_mgmt_output(ieee80211com_t *isc, struct ieee80211_node *in,
+    mblk_t *mp, int type)
+{
+	struct ieee80211_frame *wh;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	ASSERT(in != NULL);
+
+	in->in_inact = 0;
+	mp->b_rptr -= sizeof (struct ieee80211_frame);
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	wh->ifrm_fc[0] = IEEE80211_FC0_VERSION_0 |
+	    IEEE80211_FC0_TYPE_MGT | type;
+	wh->ifrm_fc[1] = IEEE80211_FC1_DIR_NODS;
+	*(uint16_t *)wh->ifrm_dur = 0;
+	*(uint16_t *)wh->ifrm_seq =
+	    LE_16(in->in_txseq << IEEE80211_SEQ_SEQ_SHIFT);
+	in->in_txseq++;
+	IEEE80211_ADDR_COPY(wh->ifrm_addr1, in->in_macaddr);
+	IEEE80211_ADDR_COPY(wh->ifrm_addr2, isc->isc_macaddr);
+	IEEE80211_ADDR_COPY(wh->ifrm_addr3, in->in_bssid);
+
+	(void) (*isc->isc_mgmt_send)(isc, mp);
+	return (0);
+}
+
+mblk_t *
+ieee80211_fill_header(ieee80211com_t *isc, mblk_t *mp_gld,
+	int32_t wep_txkey, struct ieee80211_node *in)
+{
+	struct ieee80211_frame *wh;
+	struct ieee80211_llc *llc;
+	struct ether_header *eh;
+	mblk_t *mp_header;
+	uint32_t iv;
+	uint8_t *ivp;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	/*
+	 * Alloc a new mblk struct for the whole IEEE80211 header.
+	 */
+	if ((mp_header = allocb(HEADERSPACE, BPRI_MED)) == NULL) {
+		ath_problem("ath: ieee80211_encap(): can't alloc mblk!\n");
+		return (NULL);
+	}
+	mp_header->b_wptr = mp_header->b_rptr +
+		sizeof (struct ieee80211_frame);
+
+	eh = (struct ether_header *)mp_gld->b_rptr;
+
+	/*
+	 * Fill 802.11 field.
+	 */
+	wh = (struct ieee80211_frame *)mp_header->b_rptr;
+	wh->ifrm_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
+	*(uint16_t *)wh->ifrm_dur = 0;
+	*(uint16_t *)wh->ifrm_seq =
+	    LE_16(in->in_txseq << IEEE80211_SEQ_SEQ_SHIFT);
+	in->in_txseq++;
+	switch (isc->isc_opmode) {
+	case IEEE80211_M_STA:
+		wh->ifrm_fc[1] = IEEE80211_FC1_DIR_TODS;
+		IEEE80211_ADDR_COPY(wh->ifrm_addr1, in->in_bssid);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr2,
+		    eh->ether_shost.ether_addr_octet);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr3,
+		    eh->ether_dhost.ether_addr_octet);
+		break;
+	case IEEE80211_M_IBSS:
+	case IEEE80211_M_AHDEMO:
+		wh->ifrm_fc[1] = IEEE80211_FC1_DIR_NODS;
+		IEEE80211_ADDR_COPY(wh->ifrm_addr1,
+		    eh->ether_dhost.ether_addr_octet);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr2,
+		    eh->ether_shost.ether_addr_octet);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr3, in->in_bssid);
+		break;
+	case IEEE80211_M_HOSTAP:
+		wh->ifrm_fc[1] = IEEE80211_FC1_DIR_FROMDS;
+		IEEE80211_ADDR_COPY(wh->ifrm_addr1,
+		    eh->ether_dhost.ether_addr_octet);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr2, in->in_bssid);
+		IEEE80211_ADDR_COPY(wh->ifrm_addr3,
+		    eh->ether_shost.ether_addr_octet);
+		break;
+	}
+
+	if (isc->isc_flags & IEEE80211_F_WEPON) {
+		wh->ifrm_fc[1] |= IEEE80211_FC1_WEP;
+		ivp = mp_header->b_rptr + sizeof (struct ieee80211_frame);
+		/*
+		 * IV must not duplicate during the lifetime of the key.
+		 * But no mechanism to renew keys is defined in IEEE 802.11
+		 * WEP.  And IV may be duplicated between other stations
+		 * because of the session key itself is shared.
+		 * So we use pseudo random IV for now, though it is not the
+		 * right way.
+		 */
+		iv = isc->isc_iv;
+		/*
+		 * Skip 'bad' IVs from Fluhrer/Mantin/Shamir:
+		 * (B, 255, N) with 3 <= B < 8
+		 */
+		if ((iv & 0xff00) == 0xff00) {
+			int B = (iv & 0xff0000) >> 16;
+			if (3 <= B && B < 16)
+				iv = (B+1) << 16;
+		}
+		isc->isc_iv = iv + 1;
+
+#ifdef ATH_HOST_BIG_ENDIAN
+		ivp[0] = iv >> 0;
+		ivp[1] = iv >> 8;
+		ivp[2] = iv >> 16;
+#else
+		ivp[2] = iv >> 0;
+		ivp[1] = iv >> 8;
+		ivp[0] = iv >> 16;
+#endif /* ATH_HOST_BIG_ENDIAN */
+
+		/* Key ID and pad */
+		ivp[IEEE80211_WEP_IVLEN] = wep_txkey << 6;
+		/*
+		 * The ICV length must be included into hdrlen and pktlen.
+		 */
+		mp_header->b_wptr +=
+			IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
+	}
+
+	/*
+	 * CRC are added by H/W, not encaped by driver,
+	 * but we must count it in pkt length.
+	 */
+
+	/*
+	 * fill LLC and SNAP fields.
+	 */
+	llc = (struct ieee80211_llc *)mp_header->b_wptr;
+	llc->illc_dsap = LLC_DSAP;
+	llc->illc_ssap = LLC_SSAP;
+	llc->illc_control = LLC_CONTROL;
+	llc->illc_oc[0] = SNAP_OC0;
+	llc->illc_oc[1] = SNAP_OC1;
+	llc->illc_oc[2] = SNAP_OC2;
+	llc->illc_ether_type = eh->ether_type;
+	mp_header->b_wptr += sizeof (struct ieee80211_llc);
+
+	return (mp_header);
+}
+
+mblk_t *
+ieee80211_decap(mblk_t *mp)
+{
+	struct ether_header *eh;
+	struct ieee80211_frame wh;
+	struct ieee80211_llc *llc;
+
+	if ((mp->b_wptr - mp->b_rptr) < (sizeof (wh) + sizeof (*llc))) {
+		freemsg(mp);
+		return (NULL);
+	}
+
+	bcopy(mp->b_rptr, &wh, sizeof (struct ieee80211_frame));
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+	llc = (struct ieee80211_llc *)mp->b_rptr;
+
+	if (llc->illc_dsap == LLC_DSAP && llc->illc_ssap == LLC_SSAP &&
+	    llc->illc_control == LLC_CONTROL && llc->illc_oc[0] == SNAP_OC0 &&
+	    llc->illc_oc[1] == SNAP_OC1 && llc->illc_oc[2] == SNAP_OC2) {
+		mp->b_rptr += sizeof (struct ieee80211_llc);
+		llc = NULL;
+	}
+	/*
+	 * we are sure that the size of ieee80211_frame plus llc is
+	 * larger than the size of ether_header,
+	 * so there has enough space to encap ether_header in this mblk.
+	 */
+	mp->b_rptr -= sizeof (struct ether_header);
+	eh = (struct ether_header *)mp->b_rptr;
+	switch (wh.ifrm_fc[1] & IEEE80211_FC1_DIR_MASK) {
+	case IEEE80211_FC1_DIR_NODS:
+		IEEE80211_ADDR_COPY(eh->ether_dhost.ether_addr_octet,
+		    wh.ifrm_addr1);
+		IEEE80211_ADDR_COPY(eh->ether_shost.ether_addr_octet,
+		    wh.ifrm_addr2);
+		break;
+	case IEEE80211_FC1_DIR_TODS:
+		IEEE80211_ADDR_COPY(eh->ether_dhost.ether_addr_octet,
+		    wh.ifrm_addr3);
+		IEEE80211_ADDR_COPY(eh->ether_shost.ether_addr_octet,
+		    wh.ifrm_addr2);
+		break;
+	case IEEE80211_FC1_DIR_FROMDS:
+		IEEE80211_ADDR_COPY(eh->ether_dhost.ether_addr_octet,
+		    wh.ifrm_addr1);
+		IEEE80211_ADDR_COPY(eh->ether_shost.ether_addr_octet,
+		    wh.ifrm_addr3);
+		break;
+	case IEEE80211_FC1_DIR_DSTODS:
+		/* not yet supported */
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_decap(): DS to DS\n"));
+		freemsg(mp);
+		return (NULL);
+	}
+
+	if (llc != NULL)
+		eh->ether_type = htons(mp->b_wptr - mp->b_rptr - sizeof (*eh));
+
+	return (mp);
+}
+
+/*
+ * This function doesn't need mutex protection.
+ */
+void
+ieee80211_dump_pkt(uint8_t *buf, int32_t len, int32_t rate, int32_t rssi)
+{
+	struct ieee80211_frame *wh;
+	int32_t i;
+	int8_t buf1[100], buf2[25];
+
+	bzero(buf1, sizeof (buf1));
+	bzero(buf2, sizeof (buf2));
+	wh = (struct ieee80211_frame *)buf;
+	switch (wh->ifrm_fc[1] & IEEE80211_FC1_DIR_MASK) {
+	case IEEE80211_FC1_DIR_NODS:
+		(void) sprintf(buf2, "NODS %s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "->%s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr1));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "(%s)",
+		    ieee80211_ether_sprintf(wh->ifrm_addr3));
+		(void) strcat(buf1, buf2);
+		break;
+	case IEEE80211_FC1_DIR_TODS:
+		(void) sprintf(buf2, "TODS %s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "->%s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr3));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "(%s)",
+		    ieee80211_ether_sprintf(wh->ifrm_addr1));
+		(void) strcat(buf1, buf2);
+		break;
+	case IEEE80211_FC1_DIR_FROMDS:
+		(void) sprintf(buf2, "FRDS %s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr3));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "->%s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr1));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "(%s)",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		(void) strcat(buf1, buf2);
+		break;
+	case IEEE80211_FC1_DIR_DSTODS:
+		(void) sprintf(buf2, "DSDS %s",
+		    ieee80211_ether_sprintf((uint8_t *)&wh[1]));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "->%s  ",
+		    ieee80211_ether_sprintf(wh->ifrm_addr3));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "%s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		(void) strcat(buf1, buf2);
+		(void) sprintf(buf2, "->%s",
+		    ieee80211_ether_sprintf(wh->ifrm_addr1));
+		(void) strcat(buf1, buf2);
+		break;
+	}
+	ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_dump_pkt(): %s", buf1));
+	bzero(buf1, sizeof (buf1));
+
+	switch (wh->ifrm_fc[0] & IEEE80211_FC0_TYPE_MASK) {
+	case IEEE80211_FC0_TYPE_DATA:
+		(void) sprintf(buf2, "data");
+		break;
+	case IEEE80211_FC0_TYPE_MGT:
+		(void) sprintf(buf2, "%s",
+		    ieee80211_mgt_subtype_name[
+		    (wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
+		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
+		break;
+	default:
+		(void) sprintf(buf2, "type#%d",
+		    wh->ifrm_fc[0] & IEEE80211_FC0_TYPE_MASK);
+		break;
+	}
+	(void) strcat(buf1, buf2);
+	if (wh->ifrm_fc[1] & IEEE80211_FC1_WEP) {
+		(void) sprintf(buf2, " WEP");
+		(void) strcat(buf1, buf2);
+	}
+	if (rate >= 0) {
+		(void) sprintf(buf2, " %dM", rate / 2);
+		(void) strcat(buf1, buf2);
+	}
+	if (rssi >= 0) {
+		(void) sprintf(buf2, " +%d", rssi);
+		(void) strcat(buf1, buf2);
+	}
+	ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_dump_pkt(): %s", buf1));
+	bzero(buf1, sizeof (buf1));
+
+	if (len > 0) {
+		for (i = 0; i < (len > 40 ? 40 : len); i++) {
+			if ((i & 0x03) == 0)
+				(void) strcat(buf1, " ");
+			(void) sprintf(buf2, "%02x", buf[i]);
+			(void) strcat(buf1, buf2);
+		}
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_dump_pkt(): %s",
+		    buf1));
+	}
+}
+
+/*
+ * Mark the basic rates for the 11g rate table based on the
+ * operating mode.  For real 11g we mark all the 11b rates
+ * and 6, 12, and 24 OFDM.  For 11b compatibility we mark only
+ * 11b rates.  There's also a pseudo 11a-mode used to mark only
+ * the basic OFDM rates.
+ */
+static void
+ieee80211_set11gbasicrates(struct ieee80211_rateset *rs,
+    enum ieee80211_phymode mode)
+{
+	static const struct ieee80211_rateset basic[] = {
+	    { 3, { 12, 24, 48 } },		/* IEEE80211_MODE_11A */
+	    { 4, { 2, 4, 11, 22 } },		/* IEEE80211_MODE_11B */
+	    { 7, { 2, 4, 11, 22, 12, 24, 48 } },	/* IEEE80211_MODE_11G */
+	    { 0 },				/* IEEE80211_MODE_TURBO	*/
+	};
+	int32_t i, j;
+
+	for (i = 0; i < rs->ir_nrates; i++) {
+		rs->ir_rates[i] &= IEEE80211_RATE_VAL;
+		for (j = 0; j < basic[mode].ir_nrates; j++)
+			if (basic[mode].ir_rates[j] == rs->ir_rates[i]) {
+				rs->ir_rates[i] |= IEEE80211_RATE_BASIC;
+				break;
+			}
+	}
+}
+
+/*
+ * Set the current phy mode and recalculate the active channel
+ * set based on the available channels for this mode.  Also
+ * select a new default/current channel if the current one is
+ * inappropriate for this mode.
+ */
+static int
+ieee80211_setmode(ieee80211com_t *isc, enum ieee80211_phymode mode)
+{
+	static const uint32_t chanflags[] = {
+		0,			/* IEEE80211_MODE_AUTO */
+		IEEE80211_CHAN_A,	/* IEEE80211_MODE_11A */
+		IEEE80211_CHAN_B,	/* IEEE80211_MODE_11B */
+		IEEE80211_CHAN_PUREG,	/* IEEE80211_MODE_11G */
+		IEEE80211_CHAN_T,	/* IEEE80211_MODE_TURBO	*/
+	};
+	struct ieee80211channel *ch;
+	uint32_t modeflags;
+	int32_t i;
+
+	/* validate new mode */
+	if ((isc->isc_modecaps & (1 << mode)) == 0) {
+		ath_problem("ath: ieee80211_setmode(): mode %u not supported"
+		    " (caps 0x%x)\n", mode, isc->isc_modecaps);
+		return (EINVAL);
+	}
+
+	/*
+	 * Verify at least one channel is present in the available
+	 * channel list before committing to the new mode.
+	 */
+	ASSERT(mode < ATH_N(chanflags));
+
+	modeflags = chanflags[mode];
+	/* isc_channels size is IEEE80211_CHAN_MAX + 1, so no problem */
+	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
+		ch = &isc->isc_channels[i];
+		if (mode == IEEE80211_MODE_AUTO) {
+			/* ignore turbo channels for autoselect */
+			if ((ch->ich_flags & ~IEEE80211_CHAN_TURBO) != 0)
+				break;
+		} else {
+			if ((ch->ich_flags & modeflags) == modeflags)
+				break;
+		}
+	}
+	if (i > IEEE80211_CHAN_MAX) {
+		ath_problem("ath: ieee80211_setmode(): "
+		    "no channel found for mode %u\n", mode);
+		return (EINVAL);
+	}
+
+	/*
+	 * Calculate the active channel set.
+	 */
+	bzero(isc->isc_chan_active, sizeof (isc->isc_chan_active));
+	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
+		ch = &isc->isc_channels[i];
+		if (mode == IEEE80211_MODE_AUTO) {
+			/* take anything but pure turbo channels */
+			if ((ch->ich_flags & ~IEEE80211_CHAN_TURBO) != 0)
+				setbit(isc->isc_chan_active, i);
+		} else {
+			if ((ch->ich_flags & modeflags) == modeflags)
+				setbit(isc->isc_chan_active, i);
+		}
+	}
+	/*
+	 * If no current/default channel is setup or the current
+	 * channel is wrong for the mode then pick the first
+	 * available channel from the active list.  This is likely
+	 * not the right one.
+	 */
+	if (isc->isc_ibss_chan == NULL ||
+	    isclr(isc->isc_chan_active,
+	    ieee80211_chan2ieee(isc, isc->isc_ibss_chan))) {
+		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
+			if (isset(isc->isc_chan_active, i)) {
+				isc->isc_ibss_chan = &isc->isc_channels[i];
+				break;
+			}
+	}
+
+	/*
+	 * Set/reset state flags that influence beacon contents, etc.
+	 */
+
+	if (isc->isc_caps & IEEE80211_C_SHPREAMBLE)
+		isc->isc_flags |= IEEE80211_F_SHPREAMBLE;
+	if (mode == IEEE80211_MODE_11G) {
+		if (isc->isc_caps & IEEE80211_C_SHSLOT)
+			isc->isc_flags |= IEEE80211_F_SHSLOT;
+		ieee80211_set11gbasicrates(&isc->isc_sup_rates[mode],
+		    IEEE80211_MODE_11G);
+	} else {
+		isc->isc_flags &= ~(IEEE80211_F_SHSLOT);
+	}
+
+	/*
+	 * Setup an initial rate set according to the
+	 * current/default channel.  This will be changed
+	 * when scanning but must exist now so drivers have
+	 * consistent state of ic_ibss_chan.
+	 */
+	if (isc->isc_bss)
+		isc->isc_bss->in_rates = isc->isc_sup_rates[mode];
+	isc->isc_curmode = mode;
+
+	return (0);
+}
+
+/*
+ * If (its return value & IEEE80211_RATE_BASIC != 0),
+ * the rate negotiation or fix rate is failed.
+ */
+static int
+ieee80211_fix_rate(ieee80211com_t *isc,
+    struct ieee80211_node *in, int32_t flags)
+{
+	int32_t i, j, ignore, error;
+	int32_t okrate, badrate;
+	struct ieee80211_rateset *srs, *nrs;
+	uint8_t r;
+
+	error = 0;
+	okrate = badrate = 0;
+	srs = &isc->isc_sup_rates[ieee80211_chan2mode(isc, in->in_chan)];
+	nrs = &in->in_rates;
+	for (i = 0; i < in->in_rates.ir_nrates; ) {
+		ignore = 0;
+		if (flags & IEEE80211_F_DOSORT) {
+			/*
+			 * Sort rates.
+			 */
+			for (j = i + 1; j < nrs->ir_nrates; j++) {
+				if (IEEE80211_RV(nrs->ir_rates[i]) >
+				    IEEE80211_RV(nrs->ir_rates[j])) {
+					r = nrs->ir_rates[i];
+					nrs->ir_rates[i] = nrs->ir_rates[j];
+					nrs->ir_rates[j] = r;
+				}
+			}
+		}
+		r = nrs->ir_rates[i] & IEEE80211_RATE_VAL;
+		badrate = r;
+		if (flags & IEEE80211_F_DOFRATE) {
+			/*
+			 * Apply fixed rate constraint.  Note that we do
+			 * not apply the constraint to basic rates as
+			 * otherwise we may not be able to associate if
+			 * the rate set we submit to the AP is invalid
+			 * (e.g. fix rate at 36Mb/s which is not a basic
+			 * rate for 11a operation).
+			 */
+			if ((nrs->ir_rates[i] & IEEE80211_RATE_BASIC) == 0 &&
+			    isc->isc_fixed_rate >= 0 &&
+			    r != IEEE80211_RV(srs->ir_rates
+			    [isc->isc_fixed_rate]))
+				ignore++;
+		}
+		if (flags & IEEE80211_F_DONEGO) {
+			/*
+			 * Check against supported rates.
+			 */
+			for (j = 0; j < srs->ir_nrates; j++) {
+				if (r == IEEE80211_RV(srs->ir_rates[j]))
+					break;
+			}
+			if (j == srs->ir_nrates) {
+				if (nrs->ir_rates[i] & IEEE80211_RATE_BASIC)
+					error++;
+				ignore++;
+			}
+		}
+		if (flags & IEEE80211_F_DODEL) {
+			/*
+			 * Delete unacceptable rates.
+			 */
+			if (ignore) {
+				nrs->ir_nrates--;
+				for (j = i; j < nrs->ir_nrates; j++)
+					nrs->ir_rates[j] = nrs->ir_rates[j + 1];
+				nrs->ir_rates[j] = 0;
+				continue;
+			}
+		}
+		if (!ignore)
+			okrate = nrs->ir_rates[i];
+		i++;
+	}
+	if (okrate == 0 || error != 0)
+		return (badrate | IEEE80211_RATE_BASIC);
+	else
+		return (IEEE80211_RV(okrate));
+}
+
+/*
+ * Complete a scan of potential channels.
+ */
+static void
+ieee80211_end_scan(ieee80211com_t *isc)
+{
+	struct ieee80211_node *in, *selbs;
+	uint8_t rate;
+	int32_t fail;
+
+	ASSERT(isc->isc_state == IEEE80211_S_SCAN);
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	isc->isc_flags &= ~IEEE80211_F_ASCAN;
+	cv_broadcast(&isc->isc_scan_cv);
+	in = list_head(&isc->isc_in_list);
+
+	if (in == NULL) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_end_scan(): "
+		    "no scan candidate\n"));
+notfound:
+		if (isc->isc_opmode == IEEE80211_M_IBSS &&
+		    (isc->isc_flags & IEEE80211_F_IBSSON) &&
+		    isc->isc_des_esslen != 0) {
+			ieee80211_create_ibss(isc, isc->isc_ibss_chan);
+			return;
+		}
+		mutex_exit(&isc->isc_genlock);
+		delay(drv_usectohz(200000));
+		mutex_enter(&isc->isc_genlock);
+		ieee80211_begin_scan(isc, isc->isc_bss);
+		return;
+	}
+
+	selbs = NULL;
+	for (; in != NULL; in = list_next(&isc->isc_in_list, in)) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_end_scan(): isc_bss->in_bssid=%s",
+		    ieee80211_ether_sprintf(in->in_bssid)));
+		if (in->in_fails) {
+			/*
+			 * The configuration of the access points may change
+			 * during my scan.  So delete the entry for the AP
+			 * and retry to associate if there is another beacon.
+			 */
+			if (in->in_fails++ > 2)
+				ieee80211_free_node(isc, in);
+			continue;
+		}
+		fail = 0;
+		if (in->in_chan == NULL || in->in_chan->ich_flags == 0)
+			fail |= 0x01;
+		if (isc->isc_des_chan !=
+		    (struct ieee80211channel *)IEEE80211_CHAN_ANY &&
+		    in->in_chan != isc->isc_des_chan)
+			fail |= 0x01;
+		if (isc->isc_opmode == IEEE80211_M_IBSS) {
+			if ((in->in_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
+				fail |= 0x02;
+		} else {
+			if ((in->in_capinfo & IEEE80211_CAPINFO_ESS) == 0)
+				fail |= 0x02;
+		}
+
+		if (isc->isc_flags & IEEE80211_F_WEPON) {
+			if ((in->in_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
+				fail |= 0x04;
+		} else {
+			if (in->in_capinfo & IEEE80211_CAPINFO_PRIVACY)
+				fail |= 0x04;
+		}
+
+		rate = ieee80211_fix_rate(isc, in, IEEE80211_F_DONEGO);
+		if (rate & IEEE80211_RATE_BASIC)
+			fail |= 0x08;
+		if (isc->isc_des_esslen != 0 &&
+		    (in->in_esslen != isc->isc_des_esslen ||
+		    bcmp(in->in_essid, isc->isc_des_essid,
+		    isc->isc_des_esslen) != 0))
+			fail |= 0x10;
+		if ((isc->isc_flags & IEEE80211_F_DESBSSID) &&
+		    !IEEE80211_ADDR_EQ(isc->isc_des_bssid, in->in_bssid))
+			fail |= 0x20;
+		if (!fail) {
+			if (selbs == NULL)
+				selbs = in;
+			else if (ieee80211_get_rssi(in) >
+			    ieee80211_get_rssi(selbs))
+				selbs = in;
+		}
+	}
+	if (selbs == NULL)
+		goto notfound;
+	bcopy(selbs, isc->isc_bss, sizeof (struct ieee80211_node));
+	if (isc->isc_opmode == IEEE80211_M_IBSS) {
+		(void) ieee80211_fix_rate(isc, isc->isc_bss,
+		    IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
+		    IEEE80211_F_DODEL);
+		if (isc->isc_bss->in_rates.ir_nrates == 0) {
+			selbs->in_fails++;
+			goto notfound;
+		}
+		(void) _ieee80211_new_state(isc, IEEE80211_S_RUN, -1);
+	} else
+		(void) _ieee80211_new_state(isc, IEEE80211_S_AUTH, -1);
+}
+
+
+/*
+ * Switch to the next channel marked for scanning.
+ * This one is only called by multi-func thread.
+ */
+static void
+ieee80211_next_scan(ieee80211com_t *isc)
+{
+	struct ieee80211channel *chan;
+
+	ASSERT(isc->isc_state == IEEE80211_S_SCAN);
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	chan = isc->isc_bss->in_chan;
+	for (;;) {
+		if (++chan > &isc->isc_channels[IEEE80211_CHAN_MAX])
+			chan = &isc->isc_channels[0];
+		if (isset(isc->isc_chan_scan, ieee80211_chan2ieee(isc, chan))) {
+			/*
+			 * Honor channels marked passive-only
+			 * during an active scan.
+			 */
+			if ((isc->isc_flags & IEEE80211_F_ASCAN) == 0 ||
+			    (chan->ich_flags & IEEE80211_CHAN_PASSIVE) == 0)
+				break;
+		}
+		if (chan == isc->isc_bss->in_chan) {
+			ieee80211_end_scan(isc);
+			return;
+		}
+	}
+	clrbit(isc->isc_chan_scan, ieee80211_chan2ieee(isc, chan));
+
+	isc->isc_bss->in_chan = chan;
+	(void) _ieee80211_new_state(isc, IEEE80211_S_SCAN, -1);
+}
+
+
+static void
+ieee80211_setup_node(ieee80211com_t *isc,
+	struct ieee80211_node *in, uint8_t *macaddr)
+{
+	int32_t hash;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	IEEE80211_ADDR_COPY(in->in_macaddr, macaddr);
+	hash = IEEE80211_NODE_HASH(macaddr);
+	list_insert_tail(&isc->isc_in_list, in);
+	list_insert_tail(&isc->isc_inhash_list[hash], in);
+	/*
+	 * Note we don't enable the inactive timer when acting
+	 * as a station.  Nodes created in this mode represent
+	 * AP's identified while scanning.  If we time them out
+	 * then several things happen: we can't return the data
+	 * to users to show the list of AP's we encountered, and
+	 * more importantly, we'll incorrectly deauthenticate
+	 * ourself because the inactivity timer will kick us off.
+	 */
+	if (isc->isc_opmode != IEEE80211_M_STA)
+		isc->isc_inact_timeout = IEEE80211_INACT_WAIT;
+}
+
+static struct ieee80211_node *
+ieee80211_alloc_node(ieee80211com_t *isc, uint8_t *macaddr)
+{
+	struct ieee80211_node *in = (*isc->isc_node_alloc)(isc);
+	bzero(in, sizeof (struct ieee80211_node));
+	ieee80211_setup_node(isc, in, macaddr);
+	return (in);
+}
+
+static struct ieee80211_node *
+ieee80211_dup_bss(ieee80211com_t *isc, uint8_t *macaddr)
+{
+	struct ieee80211_node *in;
+
+	in = kmem_zalloc(sizeof (struct ieee80211_node), KM_SLEEP);
+	ieee80211_setup_node(isc, in, macaddr);
+	return (in);
+}
+
+/*
+ * Find a node state block given the mac address.  Note that
+ * this returns the first node found with the mac address.
+ */
+struct ieee80211_node *
+ieee80211_find_node(ieee80211com_t *isc, uint8_t *macaddr)
+{
+	struct ieee80211_node *in;
+	int32_t hash;
+
+	hash = IEEE80211_NODE_HASH(macaddr);
+	in = list_head(&isc->isc_inhash_list[hash]);
+	while (in != NULL) {
+		if (IEEE80211_ADDR_EQ(in->in_macaddr, macaddr))
+			break;
+		in = list_next(&isc->isc_inhash_list[hash], in);
+	}
+	return (in);
+}
+
+/*
+ * Like find but search based on the channel too.
+ */
+struct ieee80211_node *
+ieee80211_lookup_node(ieee80211com_t *isc, uint8_t *macaddr,
+    struct ieee80211channel *chan)
+{
+	struct ieee80211_node *in;
+	int32_t hash;
+
+	hash = IEEE80211_NODE_HASH(macaddr);
+	in = list_head(&isc->isc_inhash_list[hash]);
+	while (in != NULL) {
+		if (IEEE80211_ADDR_EQ(in->in_macaddr, macaddr) &&
+		    (in->in_chan == chan))
+			break;
+		in = list_next(&isc->isc_inhash_list[hash], in);
+	}
+	return (in);
+}
+
+
+
+/*
+ * Install received rate set information in the node's state block.
+ * If (its return value & IEEE80211_RATE_BASIC != 0),
+ * the rate negotiation or fix rate is failed.
+ */
+static int32_t
+ieee80211_setup_rates(ieee80211com_t *isc, struct ieee80211_node *in,
+	uint8_t *rates, uint8_t *xrates, int32_t flags)
+{
+	struct ieee80211_rateset *rs = &in->in_rates;
+
+	bzero(rs, sizeof (*rs));
+	rs->ir_nrates = rates[1];
+	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
+	if (xrates != NULL) {
+		uint8_t nxrates;
+		/*
+		 * Tack on 11g extended supported rate element.
+		 */
+		nxrates = xrates[1];
+		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
+			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
+			ATH_DEBUG((ATH_DBG_80211, "ath: "
+			    "ieee80211_setup_rates(): extended rate set"
+			    " too large; only using %u of %u rates\n",
+			    nxrates, xrates[1]));
+		}
+		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
+		rs->ir_nrates += nxrates;
+	}
+	return (ieee80211_fix_rate(isc, in, flags));
+}
+
+
+/*
+ * Misc management frame encapsulation functions.
+ */
+static uint8_t *
+ieee80211_add_rates(uint8_t *frm, const struct ieee80211_rateset *rs)
+{
+	int32_t nrates;
+
+	*frm++ = IEEE80211_ELEMID_RATES;
+	nrates = rs->ir_nrates;
+	if (nrates > IEEE80211_RATE_SIZE)
+		nrates = IEEE80211_RATE_SIZE;
+	*frm++ = nrates;
+	bcopy(rs->ir_rates, frm, nrates);
+	return (frm + nrates);
+}
+
+static uint8_t *
+ieee80211_add_xrates(uint8_t *frm, const struct ieee80211_rateset *rs)
+{
+	/*
+	 * Add an extended supported rates element if operating in 11g mode.
+	 */
+	if (rs->ir_nrates > IEEE80211_RATE_SIZE) {
+		int32_t nrates = rs->ir_nrates - IEEE80211_RATE_SIZE;
+		*frm++ = IEEE80211_ELEMID_XRATES;
+		*frm++ = nrates;
+		bcopy(rs->ir_rates + IEEE80211_RATE_SIZE, frm, nrates);
+		frm += nrates;
+	}
+	return (frm);
+}
+
+static uint8_t *
+ieee80211_add_ssid(uint8_t *frm, const uint8_t *ssid, uint32_t len)
+{
+	*frm++ = IEEE80211_ELEMID_SSID;
+	*frm++ = len;
+	bcopy(ssid, frm, len);
+	return (frm + len);
+}
+
+/*
+ * Following functions are responsible for management frame encapsulation.
+ */
+static int32_t
+ieee80211_send_prreq(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t dummy)
+{
+	int32_t ret, pktlen;
+	mblk_t *mp;
+	uint8_t *frm;
+	enum ieee80211_phymode mode;
+
+	_NOTE(ARGUNUSED(dummy));
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	/*
+	 * prreq frame format
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] extended supported rates
+	 */
+	pktlen = sizeof (struct ieee80211_frame) +
+	    2 + isc->isc_des_esslen +
+	    2 + IEEE80211_RATE_SIZE +
+	    2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_prreq(): no space\n");
+		return (ENOMEM);
+	}
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+
+	frm = mp->b_rptr;
+	frm = ieee80211_add_ssid(frm, isc->isc_des_essid, isc->isc_des_esslen);
+	mode = ieee80211_chan2mode(isc, in->in_chan);
+	frm = ieee80211_add_rates(frm, &isc->isc_sup_rates[mode]);
+	frm = ieee80211_add_xrates(frm, &isc->isc_sup_rates[mode]);
+	mp->b_wptr = frm;
+
+	ret = ieee80211_mgmt_output(isc, in, mp, type);
+	isc->isc_mgt_timeout = IEEE80211_TRANS_WAIT;
+
+	ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_send_prreq() "
+	    "channel=%u\n", ieee80211_chan2ieee(isc, in->in_chan)));
+
+	return (ret);
+}
+
+static int32_t
+ieee80211_send_prresp(ieee80211com_t *isc, struct ieee80211_node *bs0,
+    int32_t type, int32_t dummy)
+{
+	mblk_t *mp;
+	uint8_t *frm;
+	struct ieee80211_node *in = isc->isc_bss;
+	uint16_t capinfo;
+	int32_t pktlen;
+
+	_NOTE(ARGUNUSED(dummy));
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	/*
+	 * probe response frame format
+	 *	[8] time stamp
+	 *	[2] beacon interval
+	 *	[2] cabability information
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] parameter set (IBSS)
+	 *	[tlv] extended supported rates
+	 */
+	pktlen = sizeof (struct ieee80211_frame) +
+	    8 + 2 + 2 + 2 +
+	    2 + in->in_esslen +
+	    2 + IEEE80211_RATE_SIZE +
+	    6 +
+	    2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_prresp(): alloc failed.\n");
+		return (ENOMEM);
+	}
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+	frm = mp->b_rptr;
+
+	bzero(frm, 8);	/* timestamp */
+	frm += 8;
+
+	*(uint16_t *)frm = LE_16(in->in_intval);
+	frm += 2;
+
+	if (isc->isc_opmode == IEEE80211_M_IBSS)
+		capinfo = IEEE80211_CAPINFO_IBSS;
+	else
+		capinfo = IEEE80211_CAPINFO_ESS;
+	if (isc->isc_flags & IEEE80211_F_WEPON)
+		capinfo |= IEEE80211_CAPINFO_PRIVACY;
+	*(uint16_t *)frm = LE_16(capinfo);
+	frm += 2;
+
+	frm = ieee80211_add_ssid(frm, in->in_essid, in->in_esslen);
+	frm = ieee80211_add_rates(frm, &in->in_rates);
+
+	if (isc->isc_opmode == IEEE80211_M_IBSS) {
+		*frm++ = IEEE80211_ELEMID_IBSSPARMS;
+		*frm++ = 2;
+		*frm++ = 0; *frm++ = 0;		/* ATIM window */
+	} else {	/* IEEE80211_M_HOSTAP */
+		/* TIM */
+		*frm++ = IEEE80211_ELEMID_TIM;
+		*frm++ = 4;	/* length */
+		*frm++ = 0;	/* DTIM count */
+		*frm++ = 1;	/* DTIM period */
+		*frm++ = 0;	/* bitmap control */
+		*frm++ = 0;	/* Partial Virtual Bitmap (variable length) */
+	}
+	frm = ieee80211_add_xrates(frm, &in->in_rates);
+	mp->b_wptr = frm;
+
+	return (ieee80211_mgmt_output(isc, bs0, mp, type));
+}
+
+static int32_t
+ieee80211_send_auth(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t seq)
+{
+	mblk_t *mp;
+	uint16_t *frm;
+	int32_t ret, pktlen;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	pktlen = sizeof (struct ieee80211_frame) + 3 * sizeof (uint16_t);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_auth(): allocb failed\n");
+		return (ENOMEM);
+	}
+	mp->b_wptr = mp->b_rptr + pktlen;
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+
+	frm = (uint16_t *)mp->b_rptr;
+	/* shared key auth */
+	frm[0] = LE_16(IEEE80211_AUTH_ALG_OPEN);
+	frm[1] = LE_16(seq);
+	frm[2] = 0;	/* status */
+	ret = ieee80211_mgmt_output(isc, in, mp, type);
+	if (isc->isc_opmode == IEEE80211_M_STA)
+		isc->isc_mgt_timeout = IEEE80211_TRANS_WAIT;
+	return (ret);
+}
+
+static int32_t
+ieee80211_send_deauth(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t reason)
+{
+	mblk_t *mp;
+	uint16_t *frm;
+	int32_t pktlen;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	ATH_DEBUG((ATH_DBG_80211, "ath: "
+	    "ieee80211_send_deauth(): station %s deauthenticate",
+	    " (reason %d)\n", ieee80211_ether_sprintf(in->in_macaddr), reason));
+	pktlen = sizeof (struct ieee80211_frame) + sizeof (uint16_t);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_deauth(): allocb failed\n");
+		return (ENOMEM);
+	}
+	mp->b_wptr = mp->b_rptr + pktlen;
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+
+	frm = (uint16_t *)mp->b_rptr;
+	frm[0] = LE_16(reason);
+
+	return (ieee80211_mgmt_output(isc, in, mp, type));
+}
+
+static int32_t
+ieee80211_send_asreq(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t dummy)
+{
+	mblk_t *mp;
+	uint8_t *frm;
+	uint16_t capinfo = 0;
+	int32_t ret, pktlen;
+
+	_NOTE(ARGUNUSED(dummy));
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	/*
+	 * asreq frame format
+	 *	[2] capability information
+	 *	[2] listen interval
+	 *	[6*] current AP address (reassoc only)
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] extended supported rates
+	 */
+	pktlen = sizeof (struct ieee80211_frame) +
+	    sizeof (capinfo) + sizeof (uint16_t) + IEEE80211_ADDR_LEN +
+	    2 + in->in_esslen + 2 + IEEE80211_RATE_SIZE +
+	    2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_asreq: allocb failed\n");
+		return (ENOMEM);
+	}
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+
+	frm = (uint8_t *)mp->b_rptr;
+
+	capinfo = 0;
+	if (isc->isc_opmode == IEEE80211_M_IBSS)
+		capinfo |= IEEE80211_CAPINFO_IBSS;
+	else	/* IEEE80211_M_STA */
+		capinfo |= IEEE80211_CAPINFO_ESS;
+	if (isc->isc_flags & IEEE80211_F_WEPON)
+		capinfo |= IEEE80211_CAPINFO_PRIVACY;
+	if (isc->isc_flags & IEEE80211_F_SHPREAMBLE)
+		capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
+	if (isc->isc_flags & IEEE80211_F_SHSLOT)
+		capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
+	capinfo |= 0x0020;
+	*(uint16_t *)frm = LE_16(capinfo);
+	frm += 2;
+
+	*(uint16_t *)frm = LE_16(isc->isc_lintval);
+	frm += 2;
+
+	if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
+		IEEE80211_ADDR_COPY(frm, isc->isc_bss->in_bssid);
+		frm += IEEE80211_ADDR_LEN;
+	}
+
+	frm = ieee80211_add_ssid(frm, in->in_essid, in->in_esslen);
+	frm = ieee80211_add_rates(frm, &in->in_rates);
+	frm = ieee80211_add_xrates(frm, &in->in_rates);
+	mp->b_wptr = frm;
+	ret = ieee80211_mgmt_output(isc, in, mp, type);
+	isc->isc_mgt_timeout = IEEE80211_TRANS_WAIT;
+	return (ret);
+}
+
+static int32_t
+ieee80211_send_asresp(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t status)
+{
+	mblk_t *mp;
+	uint8_t *frm;
+	uint16_t capinfo;
+	int32_t pktlen;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+	/*
+	 * asreq frame format
+	 *	[2] capability information
+	 *	[2] status
+	 *	[2] association ID
+	 *	[tlv] supported rates
+	 *	[tlv] extended supported rates
+	 */
+	pktlen = sizeof (struct ieee80211_frame) +
+	    sizeof (capinfo) +
+	    sizeof (uint16_t) +
+	    sizeof (uint16_t) +
+	    2 + IEEE80211_RATE_SIZE +
+	    2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_asresp: allocb failed\n");
+		return (ENOMEM);
+	}
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+	frm = (uint8_t *)mp->b_rptr;
+
+	capinfo = IEEE80211_CAPINFO_ESS;
+	if (isc->isc_flags & IEEE80211_F_WEPON)
+		capinfo |= IEEE80211_CAPINFO_PRIVACY;
+	*(uint16_t *)frm = LE_16(capinfo);
+	frm += 2;
+
+	*(uint16_t *)frm = LE_16(status);
+	frm += 2;
+
+	if (status == IEEE80211_STATUS_SUCCESS && in != NULL)
+		*(uint16_t *)frm = LE_16(in->in_associd);
+	else
+		*(uint16_t *)frm = LE_16(0);
+	frm += 2;
+
+	if (in != NULL) {
+		frm = ieee80211_add_rates(frm, &in->in_rates);
+		frm = ieee80211_add_xrates(frm, &in->in_rates);
+	} else {
+		frm = ieee80211_add_rates(frm, &isc->isc_bss->in_rates);
+		frm = ieee80211_add_xrates(frm, &isc->isc_bss->in_rates);
+	}
+	mp->b_wptr = frm;
+
+	return (ieee80211_mgmt_output(isc, in, mp, type));
+}
+
+static int32_t
+ieee80211_send_disassoc(ieee80211com_t *isc, struct ieee80211_node *in,
+    int32_t type, int32_t reason)
+{
+	mblk_t *mp;
+	uint16_t *frm;
+	int32_t pktlen;
+
+	_NOTE(ARGUNUSED(type))
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	ATH_DEBUG((ATH_DBG_80211, "ath: "
+	    "ieee80211_send_disassoc(): station %s disassociate",
+	    " (reason %d)\n", ieee80211_ether_sprintf(in->in_macaddr), reason));
+	pktlen = sizeof (struct ieee80211_frame) + sizeof (uint16_t);
+	mp = allocb(pktlen, BPRI_MED);
+	if (mp == NULL) {
+		ath_problem("ath: ieee80211_send_asresp: allocb failed\n");
+		return (ENOMEM);
+	}
+	mp->b_wptr = mp->b_rptr + pktlen;
+	mp->b_rptr += sizeof (struct ieee80211_frame);
+	frm = (uint16_t *)mp->b_rptr;
+	frm[0] = LE_16(reason);
+	return (ieee80211_mgmt_output(isc, in, mp,
+	    IEEE80211_FC0_SUBTYPE_DISASSOC));
+}
+
+/*
+ * This handles both beacon and probe response frames.
+ */
+static void
+ieee80211_recv_beacon(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	struct ieee80211_node *in;
+	uint8_t *frm, *efrm, *tstamp, *bintval, *capinfo, *ssid;
+	uint8_t *rates, *xrates;
+	uint8_t chan, bchan, fhindex, erp;
+	uint16_t fhdwell;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	if (isc->isc_opmode != IEEE80211_M_IBSS &&
+	    isc->isc_state != IEEE80211_S_SCAN) {
+		return;
+	}
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * beacon frame format
+	 *	[8] time stamp
+	 *	[2] beacon interval
+	 *	[2] cabability information
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] country information
+	 *	[tlv] parameter set (FH/DS)
+	 *	[tlv] erp information
+	 *	[tlv] extended supported rates
+	 */
+	tstamp = frm;
+	frm += 8;
+	bintval = frm;
+	frm += 2;
+	capinfo = frm;
+	frm += 2;
+	ssid = rates = xrates = NULL;
+	bchan = ieee80211_chan2ieee(isc, isc->isc_bss->in_chan);
+	chan = bchan;
+	fhdwell = 0;
+	fhindex = 0;
+	erp = 0;
+	while (frm < efrm) {
+		switch (*frm) {
+		case IEEE80211_ELEMID_SSID:
+			ssid = frm;
+			break;
+		case IEEE80211_ELEMID_RATES:
+			rates = frm;
+			break;
+		case IEEE80211_ELEMID_COUNTRY:
+			/*
+			 * don't care 'country', otherwise,
+			 * just do:
+			 * country = frm;
+			 */
+			break;
+		case IEEE80211_ELEMID_FHPARMS:
+			if (isc->isc_phytype == IEEE80211_T_FH) {
+				fhdwell = (frm[3] << 8) | frm[2];
+				chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
+				fhindex = frm[6];
+			}
+			break;
+		case IEEE80211_ELEMID_DSPARMS:
+			/*
+			 * hack this since depending on phytype
+			 * is problematic for multi-mode devices.
+			 */
+			if (isc->isc_phytype != IEEE80211_T_FH)
+				chan = frm[2];
+			break;
+		case IEEE80211_ELEMID_TIM:
+			break;
+		case IEEE80211_ELEMID_XRATES:
+			xrates = frm;
+			break;
+		case IEEE80211_ELEMID_ERP:
+			if (frm[1] != 1) {
+				ATH_DEBUG((ATH_DBG_80211, "ath: "
+				    "ieee80211_recv_beacon(): "
+				    "%s: invalid ERP element; "
+				    "length %u, expecting 1\n",
+				    "ieee80211_recv_beacon", frm[1]));
+				break;
+			}
+			erp = frm[2];
+			break;
+		default:
+			break;
+		}
+		frm += frm[1] + 2;
+	}
+	IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_SIZE, wh);
+	IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, wh);
+
+	if (isclr(isc->isc_chan_active, chan)) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_beacon(): "
+		    "ignore %s with invalid channel %u\n",
+		    IEEE80211_ISPROBE(wh) ? "probe response" : "beacon", chan));
+		return;
+	}
+	if (chan != bchan && isc->isc_phytype != IEEE80211_T_FH) {
+		/*
+		 * Frame was received on a channel different from the
+		 * one indicated in the DS/FH params element id; silently
+		 * discard it.
+		 *
+		 * NB: this can happen due to signal leakage.
+		 */
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_beacon(): "
+		    "ignore %s phytype %u on channel %u marked for %u\n",
+		    IEEE80211_ISPROBE(wh) ? "probe response" : "beacon",
+		    isc->isc_phytype,
+		    bchan, chan));
+		return;
+	}
+
+	/*
+	 * Use mac and channel for lookup so we collect all
+	 * potential AP's when scanning.  Otherwise we may
+	 * see the same AP on multiple channels and will only
+	 * record the last one.  We could filter APs here based
+	 * on rssi, etc. but leave that to the end of the scan
+	 * so we can keep the selection criteria in one spot.
+	 * This may result in a bloat of the scanned AP list but
+	 * it shouldn't be too much.
+	 */
+	in = ieee80211_lookup_node(isc, wh->ifrm_addr2,
+	    &isc->isc_channels[chan]);
+	if (in == NULL || isc->isc_state == IEEE80211_S_SCAN) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_recv_beacon(): essid = %s\n",
+		    ieee80211_essid_sprintf(ssid + 2, ssid[1])));
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_beacon(): "
+		    "from %s\n", ieee80211_ether_sprintf(wh->ifrm_addr2)));
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_recv_beacon(): to %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr1)));
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_beacon(): "
+		    "caps 0x%x bintval %u erp 0x%x\n",
+		    LE_16(*(uint16_t *)capinfo),
+		    LE_16(*(uint16_t *)bintval), erp));
+	}
+
+	if (in == NULL) {
+		in = ieee80211_alloc_node(isc, wh->ifrm_addr2);
+		if (in == NULL)
+			return;
+		in->in_esslen = ssid[1];
+		bzero(in->in_essid, sizeof (in->in_essid));
+		bcopy(ssid + 2, in->in_essid, ssid[1]);
+	} else if (ssid[1] != 0 && IEEE80211_ISPROBE(wh)) {
+		/*
+		 * Update ESSID at probe response to adopt hidden AP by
+		 * Lucent/Cisco, which announces null ESSID in beacon.
+		 */
+		in->in_esslen = ssid[1];
+		bzero(in->in_essid, sizeof (in->in_essid));
+		bcopy(ssid + 2, in->in_essid, ssid[1]);
+	}
+
+	IEEE80211_ADDR_COPY(in->in_bssid, wh->ifrm_addr3);
+	ieee80211_add_recvhist(in, rssi, rstamp, rantenna);
+	bcopy(tstamp, in->in_tstamp, sizeof (in->in_tstamp));
+	in->in_intval = LE_16(*(uint16_t *)bintval);
+	in->in_capinfo = LE_16(*(uint16_t *)capinfo);
+	in->in_chan = &isc->isc_channels[chan];
+	in->in_fhdwell = fhdwell;
+	in->in_fhindex = fhindex;
+	in->in_erp = erp;
+	/* in_chan must have been setup */
+	(void) ieee80211_setup_rates(isc, in, rates, xrates,
+	    IEEE80211_F_DOSORT);
+}
+
+static void
+ieee80211_recv_prreq(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	struct ieee80211_node *in;
+	uint8_t *frm, *efrm, *ssid, *rates, *xrates;
+	uint8_t rate;
+	int32_t allocbs;
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	if (isc->isc_opmode == IEEE80211_M_STA)
+		return;
+	if (isc->isc_state != IEEE80211_S_RUN)
+		return;
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * prreq frame format
+	 *	[tlv] ssid
+	 *	[tlv] supported rates
+	 *	[tlv] extended supported rates
+	 */
+	ssid = rates = xrates = NULL;
+	while (frm < efrm) {
+		switch (*frm) {
+		case IEEE80211_ELEMID_SSID:
+			ssid = frm;
+			break;
+		case IEEE80211_ELEMID_RATES:
+			rates = frm;
+			break;
+		case IEEE80211_ELEMID_XRATES:
+			xrates = frm;
+			break;
+		}
+		frm += frm[1] + 2;
+	}
+	IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_SIZE, wh);
+	IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, wh);
+	if (ssid[1] != 0 &&
+	    (ssid[1] != isc->isc_bss->in_esslen ||
+	    bcmp(ssid + 2, isc->isc_bss->in_essid,
+	    isc->isc_bss->in_esslen) != 0)) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_prreq(): "
+		    "ssid unmatch %s from %s",
+		    ieee80211_essid_sprintf(ssid + 2, ssid[1]),
+		    ieee80211_ether_sprintf(wh->ifrm_addr2)));
+		return;
+	}
+
+	in = ieee80211_find_node(isc, wh->ifrm_addr2);
+	if (in == NULL) {
+		in = ieee80211_dup_bss(isc, wh->ifrm_addr2);
+		if (in == NULL) {
+			ath_problem("ath: ieee80211_recv_prreq(): "
+			    "dup bss failed\n");
+			return;
+		}
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_recv_prreq: new req from %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2)));
+		allocbs = 1;
+	} else
+		allocbs = 0;
+	ieee80211_add_recvhist(in, rssi, rstamp, rantenna);
+	rate = ieee80211_setup_rates(isc, in, rates, xrates,
+	    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
+	    | IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
+	if (rate & IEEE80211_RATE_BASIC) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_prreq(): "
+		    "rate negotiation fail: %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2)));
+	} else {
+		IEEE80211_SEND_MGMT(isc, in, IEEE80211_FC0_SUBTYPE_PROBE_RESP,
+		    0);
+	}
+
+	if (allocbs && isc->isc_opmode == IEEE80211_M_HOSTAP)
+		ieee80211_free_node(isc, in);
+	else
+		ieee80211_unref_node(&in);
+}
+
+static void
+ieee80211_recv_auth(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	struct ieee80211_node *in;
+	uint8_t *frm, *efrm;
+	uint16_t algo, seq, status;
+
+	_NOTE(ARGUNUSED(rssi))
+	_NOTE(ARGUNUSED(rstamp))
+	_NOTE(ARGUNUSED(rantenna))
+	_NOTE(ARGUNUSED(mp))
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * auth frame format
+	 *	[2] algorithm
+	 *	[2] sequence
+	 *	[2] status
+	 *	[tlv*] challenge
+	 */
+	if (frm + 6 > efrm) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: "
+		    "ieee80211_recv_auth: too short from %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2)));
+		return;
+	}
+
+	algo = LE_16(*(uint16_t *)frm);
+	seq = LE_16(*(uint16_t *)(frm + 2));
+	status = LE_16(*(uint16_t *)(frm + 4));
+	if (algo != IEEE80211_AUTH_ALG_OPEN) {
+		/* shared key auth */
+		ath_problem("ath: ieee80211_recv_auth(): "
+		    "unsupported auth %d from %s\n",
+		    algo, ieee80211_ether_sprintf(wh->ifrm_addr2));
+		return;
+	}
+	switch (isc->isc_opmode) {
+	case IEEE80211_M_IBSS:
+		if (isc->isc_state != IEEE80211_S_RUN || seq != 1)
+			return;
+		(void) _ieee80211_new_state(isc, IEEE80211_S_AUTH,
+		    wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+		break;
+
+	case IEEE80211_M_AHDEMO:
+		break;
+
+	case IEEE80211_M_HOSTAP:
+		break;
+
+	case IEEE80211_M_STA:
+		if (isc->isc_state != IEEE80211_S_AUTH || seq != 2)
+			return;
+		if (status != 0) {
+			ath_log("ath: ieee80211_recv_auth(): "
+			    "authentication failed (reason %d) for %s\n",
+			    status, ieee80211_ether_sprintf(wh->ifrm_addr3));
+			in = ieee80211_find_node(isc, wh->ifrm_addr2);
+			if (in != NULL)
+				in->in_fails++;
+			return;
+		}
+		(void) _ieee80211_new_state(isc, IEEE80211_S_ASSOC,
+		    wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+		break;
+	}
+}
+
+static void
+ieee80211_recv_asreq(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	_NOTE(ARGUNUSED(isc))
+	_NOTE(ARGUNUSED(rssi))
+	_NOTE(ARGUNUSED(rstamp))
+	_NOTE(ARGUNUSED(rantenna))
+	_NOTE(ARGUNUSED(mp))
+
+	/* doesn't support HOST-AP mode yet */
+}
+
+static void
+ieee80211_recv_asresp(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	struct ieee80211_node *in;
+	uint8_t *frm, *efrm, *rates, *xrates;
+	int32_t status;
+
+	_NOTE(ARGUNUSED(rssi))
+	_NOTE(ARGUNUSED(rstamp))
+	_NOTE(ARGUNUSED(rantenna))
+	_NOTE(ARGUNUSED(mp))
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	if (isc->isc_opmode != IEEE80211_M_STA ||
+	    isc->isc_state != IEEE80211_S_ASSOC)
+		return;
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * asresp frame format
+	 *	[2] capability information
+	 *	[2] status
+	 *	[2] association ID
+	 *	[tlv] supported rates
+	 *	[tlv] extended supported rates
+	 */
+	if (frm + 6 > efrm) {
+		ath_log("ath: ieee80211_recv_asresp(): too short from %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		return;
+	}
+
+	in = isc->isc_bss;
+	in->in_capinfo = LE_16(*(uint16_t *)frm);
+	frm += 2;
+
+	status = LE_16(*(uint16_t *)frm);
+	frm += 2;
+
+	if (status != 0) {
+		ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_asresp(): "
+		    "association failed (reason %d)\n", status));
+		in = ieee80211_find_node(isc, wh->ifrm_addr2);
+		if (in != NULL) {
+			in->in_fails++;
+		}
+		return;
+	}
+
+	in->in_associd = LE_16(*(uint16_t *)frm);
+	frm += 2;
+
+	rates = xrates = NULL;
+	while (frm < efrm) {
+		switch (*frm) {
+		case IEEE80211_ELEMID_RATES:
+			rates = frm;
+			break;
+		case IEEE80211_ELEMID_XRATES:
+			xrates = frm;
+			break;
+		}
+		frm += frm[1] + 2;
+	}
+
+	IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_SIZE, wh);
+	(void) ieee80211_setup_rates(isc, in, rates, xrates,
+	    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
+	    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
+	if (in->in_rates.ir_nrates != 0)
+		(void) _ieee80211_new_state(isc, IEEE80211_S_RUN,
+			wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+}
+
+static void
+ieee80211_recv_disassoc(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	uint8_t *frm, *efrm;
+	uint16_t reason;
+
+	_NOTE(ARGUNUSED(rssi))
+	_NOTE(ARGUNUSED(rstamp))
+	_NOTE(ARGUNUSED(rantenna))
+	_NOTE(ARGUNUSED(mp))
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * disassoc frame format
+	 *	[2] reason
+	 */
+	if (frm + 2 > efrm) {
+		ath_log("ath: ieee80211_recv_disassoc(): too short from %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		return;
+	}
+	reason = LE_16(*(uint16_t *)frm);
+	ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_disassoc(): "
+	    "disassociation packet, reason:0x%x\n", reason));
+	switch (isc->isc_opmode) {
+	case IEEE80211_M_STA:
+		(void) _ieee80211_new_state(isc, IEEE80211_S_ASSOC,
+		    wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+		break;
+	case IEEE80211_M_HOSTAP:
+		/* don't support HOSTAP */
+		break;
+	default:
+		break;
+	}
+}
+
+static void
+ieee80211_recv_deauth(ieee80211com_t *isc, mblk_t *mp, int32_t rssi,
+    uint32_t rstamp, uint32_t rantenna)
+{
+	struct ieee80211_frame *wh;
+	uint8_t *frm, *efrm;
+	uint16_t reason;
+
+	_NOTE(ARGUNUSED(rssi))
+	_NOTE(ARGUNUSED(rstamp))
+	_NOTE(ARGUNUSED(rantenna))
+	_NOTE(ARGUNUSED(mp))
+
+	ASSERT(mutex_owned(&isc->isc_genlock));
+
+	wh = (struct ieee80211_frame *)mp->b_rptr;
+	frm = (uint8_t *)&wh[1];
+	efrm = mp->b_wptr;
+	/*
+	 * dauth frame format
+	 *	[2] reason
+	 */
+	if (frm + 2 > efrm) {
+		ath_log("ath: ieee80211_recv_deauth(): too short from %s\n",
+		    ieee80211_ether_sprintf(wh->ifrm_addr2));
+		return;
+	}
+	reason = LE_16(*(uint16_t *)frm);
+	ATH_DEBUG((ATH_DBG_80211, "ath: ieee80211_recv_deauth(): "
+	    "deauthentication packet, reason: 0x%x\n", reason));
+	switch (isc->isc_opmode) {
+	case IEEE80211_M_STA:
+		(void) _ieee80211_new_state(isc, IEEE80211_S_AUTH,
+		    wh->ifrm_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
+		break;
+	case IEEE80211_M_HOSTAP:
+		break;
+	default:
+		break;
+	}
+}
+
+/*
+ * Return the phy mode for with the specified channel so the
+ * caller can select a rate set.  This is problematic and the
+ * work here assumes how things work elsewhere in this code.
+ */
+enum ieee80211_phymode
+ieee80211_chan2mode(ieee80211com_t *isc, struct ieee80211channel *chan)
+{
+	/*
+	 * NB: this assumes the channel would not be supplied to us
+	 * unless it was already compatible with the current mode.
+	 */
+	if (isc->isc_curmode != IEEE80211_MODE_AUTO)
+		return (isc->isc_curmode);
+	/*
+	 * In autoselect mode; deduce a mode based on the channel
+	 * characteristics.  We assume that turbo-only channels
+	 * are not considered when the channel set is constructed.
+	 */
+	if (IEEE80211_IS_CHAN_5GHZ(chan))
+		return (IEEE80211_MODE_11A);
+	else if (chan->ich_flags & (IEEE80211_CHAN_OFDM | IEEE80211_CHAN_DYN))
+		return (IEEE80211_MODE_11G);
+	else
+		return (IEEE80211_MODE_11B);
+}
+
+
+/*
+ * Format an Ethernet MAC for printing,
+ * and this function adds NULL byte at the end of string.
+ */
+const char *
+ieee80211_ether_sprintf(const uint8_t *mac)
+{
+	static char etherbuf[18];
+	(void) snprintf(etherbuf, sizeof (etherbuf),
+	    "%02x:%02x:%02x:%02x:%02x:%02x",
+	    mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+	return (etherbuf);
+}
+
+/*
+ * Format an essid for printing,
+ * and this function adds NULL byte at the end of string.
+ */
+const int8_t *
+ieee80211_essid_sprintf(uint8_t *essid, uint32_t len)
+{
+	static int8_t essidbuf[IEEE80211_NWID_LEN * 2 + 1];
+	uint32_t i;
+	uint8_t *p;
+	int8_t tmp[3];
+
+	bzero(essidbuf, sizeof (essidbuf));
+	if (len > IEEE80211_NWID_LEN)
+		len = IEEE80211_NWID_LEN;
+	/* determine printable or not */
+	for (i = 0, p = essid; i < len; i++, p++) {
+		if (*p < ' ' || *p > 0x7e)
+			break;
+	}
+	if (i == len) {
+		for (i = 0; i < len; i++)
+			essidbuf[i] = essid[i];
+		essidbuf[i] = '\0';
+	} else {
+		for (i = 0; i < len; i++) {
+			(void) sprintf(tmp, "%02x", essid[i]);
+			(void) strcat(essidbuf, tmp);
+		}
+	}
+	return (essidbuf);
+}
+
+/*
+ * Following fucntions are registerd to GLD and intercepting
+ * the function calls from GLD to LLD to add appropriate ic_genlock protection.
+ *
+ * We have to protect ieee80211_gld_send() by isc_genlock,
+ * because there have many references to isc struct on this transimit path,
+ * and this may affect performace.
+ */
+static int32_t
+ieee80211_gld_send(gld_mac_info_t *gld_p, mblk_t *mp)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+	int32_t result;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_send)(gld_p, mp);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int32_t
+ieee80211_gld_reset(gld_mac_info_t *gld_p)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_reset)(gld_p);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+
+/*
+ * Following function is for Multi_func thread.
+ * The smallest timing unit is 100ms.
+ * It is created in ieee80211_gld_start(),
+ * and destroy in ieee80211_gld_stop().
+ */
+void
+ieee80211_mf_thread(ieee80211com_t *isc)
+{
+	struct ieee80211_node *in;
+	uint32_t scan_ticks = 0;
+	uint32_t ratectl_ticks = 0;
+	uint32_t cali_ticks = 0;
+	uint32_t mgt_ticks = 0;
+	enum ieee80211_state ostate = IEEE80211_S_INIT;
+
+	mutex_enter(&isc->isc_genlock);
+	while (isc->isc_mfthread_switch) {
+		if (isc->isc_state == IEEE80211_S_SCAN &&
+		    ostate != IEEE80211_S_SCAN)
+			scan_ticks = 0;
+
+		if (isc->isc_state == IEEE80211_S_SCAN) {
+			if (scan_ticks >= (isc->isc_scan_interval/100 - 1)) {
+				ieee80211_next_scan(isc);
+				scan_ticks = 0;
+			} else
+				scan_ticks++;
+		}
+
+		if (ratectl_ticks >= (isc->isc_ratectl_interval/100 - 1)) {
+			if (isc->isc_opmode == IEEE80211_M_STA)
+				(*isc->isc_rate_ctl)(isc, isc->isc_bss);
+			else {
+				in = list_head(&isc->isc_in_list);
+				while (in != NULL) {
+					(*isc->isc_rate_ctl)(isc, in);
+					in = list_next(&isc->isc_in_list, in);
+				}
+			}
+			ratectl_ticks = 0;
+		} else
+			ratectl_ticks++;
+
+		if (cali_ticks >= (isc->isc_cali_interval/100 - 1)) {
+			(*isc->isc_calibrate)(isc);
+			cali_ticks = 0;
+		} else
+			cali_ticks++;
+
+		if (mgt_ticks >= 10) { /* one second */
+			if (isc->isc_mgt_timeout &&
+			    --isc->isc_mgt_timeout == 0) {
+				(void) _ieee80211_new_state(isc,
+				    IEEE80211_S_SCAN, -1);
+			}
+			if (isc->isc_inact_timeout &&
+			    --isc->isc_inact_timeout == 0)
+				ieee80211_timeout_nodes(isc);
+			mgt_ticks = 0;
+		} else
+			mgt_ticks++;
+
+		ostate = isc->isc_state;
+		mutex_exit(&isc->isc_genlock);
+		delay(drv_usectohz(100000)); /* delay 100ms */
+		mutex_enter(&isc->isc_genlock);
+	}
+	isc->isc_mf_thread = NULL;
+	cv_broadcast(&isc->isc_mfthread_cv);
+	mutex_exit(&isc->isc_genlock);
+	thread_exit();
+}
+
+/*
+ * This function is responsible for creating multi-func thread.
+ */
+static int32_t
+ieee80211_gld_start(gld_mac_info_t *gld_p)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	isc->isc_mfthread_switch = 1;
+	if (isc->isc_mf_thread == NULL)
+		isc->isc_mf_thread = thread_create((caddr_t)NULL, 0,
+		    ieee80211_mf_thread, isc, 0, &p0, TS_RUN, minclsyspri);
+	result = (*isc->isc_gld_start)(gld_p);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+/*
+ * This function is responsible for destory multi-func thread.
+ */
+static int32_t
+ieee80211_gld_stop(gld_mac_info_t *gld_p)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	isc->isc_mfthread_switch = 0;
+	while (isc->isc_mf_thread != NULL) {
+		if (cv_wait_sig(&isc->isc_mfthread_cv, &isc->isc_genlock) == 0)
+			break;
+	}
+	result = (*isc->isc_gld_stop)(gld_p);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int32_t
+ieee80211_gld_saddr(gld_mac_info_t *gld_p, uint8_t *macaddr)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_saddr)(gld_p, macaddr);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int
+ieee80211_gld_set_promiscuous(gld_mac_info_t *gld_p, int mode)
+{
+	int result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_set_promiscuous)(gld_p, mode);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int32_t
+ieee80211_gld_gstat(gld_mac_info_t *gld_p, struct gld_stats *glds_p)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_gstat)(gld_p, glds_p);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int32_t
+ieee80211_gld_ioctl(gld_mac_info_t *gld_p, queue_t *wq, mblk_t *mp)
+{
+	int32_t result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_ioctl)(gld_p, wq, mp);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static int
+ieee80211_gld_set_multicast(gld_mac_info_t *gld_p, uint8_t *eth_p, int flag)
+{
+	int result;
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	mutex_enter(&isc->isc_genlock);
+	result = (*isc->isc_gld_set_multicast)(gld_p, eth_p, flag);
+	mutex_exit(&isc->isc_genlock);
+	return (result);
+}
+
+static uint32_t
+ieee80211_gld_intr(gld_mac_info_t *gld_p)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+	return ((*isc->isc_gld_intr)(gld_p));
+}
+
+
+
+int32_t
+ieee80211_ifattach(gld_mac_info_t *gld_p)
+{
+	ieee80211com_t *isc =
+	    (ieee80211com_t *)gld_p->gldm_private;
+	struct ieee80211channel *ch;
+	int32_t i;
+
+	mutex_init(&isc->isc_genlock, NULL, MUTEX_DRIVER, NULL);
+
+	/*
+	 * Fill in 802.11 available channel set, mark
+	 * all available channels as active, and pick
+	 * a default channel if not already specified.
+	 */
+	bzero(isc->isc_chan_avail, sizeof (isc->isc_chan_avail));
+	isc->isc_modecaps |= 1 << IEEE80211_MODE_AUTO;
+	for (i = 0; i <= IEEE80211_CHAN_MAX; i++) {
+		ch = &isc->isc_channels[i];
+		if (ch->ich_flags) {
+			setbit(isc->isc_chan_avail, i);
+			/*
+			 * Identify mode capabilities.
+			 */
+			if (IEEE80211_IS_CHAN_A(ch))
+				isc->isc_modecaps |= 1 << IEEE80211_MODE_11A;
+			if (IEEE80211_IS_CHAN_B(ch))
+				isc->isc_modecaps |= 1 << IEEE80211_MODE_11B;
+			if (IEEE80211_IS_CHAN_PUREG(ch))
+				isc->isc_modecaps |= 1 << IEEE80211_MODE_11G;
+			if (IEEE80211_IS_CHAN_T(ch))
+				isc->isc_modecaps |= 1 << IEEE80211_MODE_TURBO;
+		}
+	}
+
+	/* Start from auto mode */
+	(void) ieee80211_setmode(isc, IEEE80211_MODE_AUTO);
+
+	/* Initialize WEP related variable */
+	isc->isc_wep_txkey = 0;
+	isc->isc_iv = (int32_t)(gethrtime() & 0x00000000ffffffff);
+
+	/* Initialize some config variables */
+	isc->isc_rtsthreshold = IEEE80211_RTS_MAX;
+	isc->isc_fragthreshold = 2346;
+	isc->isc_des_chan = IEEE80211_CHAN_ANYC;	/* any channel is ok */
+	isc->isc_fixed_rate = -1;			/* no fixed rate */
+	if (isc->isc_lintval == 0)
+		isc->isc_lintval = 100;			/* default sleep */
+	isc->isc_txpower = IEEE80211_TXPOWER_MAX;	/* default tx power */
+	isc->isc_bmisstimeout = 7 * isc->isc_lintval;	/* default 7 beacons */
+
+	list_create(&isc->isc_in_list,
+	    sizeof (struct ieee80211_node),
+	    offsetof(struct ieee80211_node, in_node));
+	for (i = 0; i < IEEE80211_NODE_HASHSIZE; i++)
+		list_create(&isc->isc_inhash_list[i],
+		    sizeof (struct ieee80211_node),
+		    offsetof(struct ieee80211_node, in_hash_node));
+
+	/* Initialize management frame handlers */
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_PROBE_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_beacon;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_BEACON
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_beacon;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_PROBE_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_prreq;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_AUTH
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_auth;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_ASSOC_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_asreq;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_REASSOC_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_asreq;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_ASSOC_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_asresp;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_REASSOC_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_asresp;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_DEAUTH
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_deauth;
+	isc->isc_recv_mgmt[IEEE80211_FC0_SUBTYPE_DISASSOC
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_recv_disassoc;
+
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_PROBE_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_prreq;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_PROBE_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_prresp;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_AUTH
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_auth;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_DEAUTH
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_deauth;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_ASSOC_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_asreq;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_REASSOC_REQ
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_asreq;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_ASSOC_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_asresp;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_REASSOC_RESP
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_asresp;
+	isc->isc_send_mgmt[IEEE80211_FC0_SUBTYPE_DISASSOC
+	    >> IEEE80211_FC0_SUBTYPE_SHIFT] = ieee80211_send_disassoc;
+
+	cv_init(&isc->isc_scan_cv, NULL, CV_DRIVER, NULL);
+	cv_init(&isc->isc_mfthread_cv, NULL, CV_DRIVER, NULL);
+	isc->isc_mf_thread = NULL;
+	isc->isc_mfthread_switch = 0;
+
+	ASSERT(isc->isc_node_alloc != NULL);
+	isc->isc_bss = (*isc->isc_node_alloc)(isc);
+	isc->isc_bss->in_chan = IEEE80211_CHAN_ANYC;
+	isc->isc_bss->in_txpower = IEEE80211_TXPOWER_MAX;
+	isc->isc_scan_interval = 200;
+	isc->isc_cali_interval = 30000;
+	isc->isc_ratectl_interval = 500;
+
+	gld_p->gldm_reset		= ieee80211_gld_reset;
+	gld_p->gldm_start		= ieee80211_gld_start;
+	gld_p->gldm_stop		= ieee80211_gld_stop;
+	gld_p->gldm_set_mac_addr	= ieee80211_gld_saddr;
+	gld_p->gldm_send		= ieee80211_gld_send;
+	gld_p->gldm_set_promiscuous	= ieee80211_gld_set_promiscuous;
+	gld_p->gldm_get_stats		= ieee80211_gld_gstat;
+	gld_p->gldm_ioctl		= ieee80211_gld_ioctl;
+	gld_p->gldm_set_multicast	= ieee80211_gld_set_multicast;
+	gld_p->gldm_intr		= ieee80211_gld_intr;
+
+	return (0);
+}
+
+void
+ieee80211_ifdetach(gld_mac_info_t *gld_p)
+{
+	ieee80211com_t *isc = (ieee80211com_t *)gld_p->gldm_private;
+
+	(*isc->isc_node_free)(isc, isc->isc_bss);
+	ieee80211_free_allnodes(isc);
+	cv_destroy(&isc->isc_mfthread_cv);
+	cv_destroy(&isc->isc_scan_cv);
+	mutex_destroy(&isc->isc_genlock);
+}