 @@ -1,14 +1,14 @@
-/*	$NetBSD: ath.c,v 1.102.4.1 2009/08/07 06:43:27 snj Exp $	*/
+/*	$NetBSD: ath.c,v 1.102.4.2 2009/08/07 06:48:09 snj Exp $	*/
 /*-
  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer,
  *    without modification.
  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
 @@ -31,27 +31,27 @@
  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  * THE POSSIBILITY OF SUCH DAMAGES.
  */
 #include <sys/cdefs.h>
 #ifdef __FreeBSD__
 __FBSDID("$FreeBSD: src/sys/dev/ath/if_ath.c,v 1.104 2005/09/16 10:09:23 ru Exp $");
 #endif
 #ifdef __NetBSD__
-__KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.102.4.1 2009/08/07 06:43:27 snj Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ath.c,v 1.102.4.2 2009/08/07 06:48:09 snj Exp $");
 #endif
 /*
  * Driver for the Atheros Wireless LAN controller.
+ *
  * This software is derived from work of Atsushi Onoe; his contribution
  * is greatly appreciated.
  */
 #include "opt_inet.h"
 #ifdef __NetBSD__
 #include "bpfilter.h"
 @@ -510,48 +510,60 @@ ath_attach(u_int16_t devid, struct ath_s
 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_OCB))
 		ic->ic_caps |= IEEE80211_C_AES;
 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_AES_CCM))
 		ic->ic_caps |= IEEE80211_C_AES_CCM;
 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_CKIP))
 		ic->ic_caps |= IEEE80211_C_CKIP;
 	if (ath_hal_ciphersupported(ah, HAL_CIPHER_TKIP)) {
 		ic->ic_caps |= IEEE80211_C_TKIP;
 		/*
 		 * Check if h/w does the MIC and/or whether the
 		 * separate key cache entries are required to
 		 * handle both tx+rx MIC keys.
 		 */
-		if (ath_hal_ciphersupported(ah, HAL_CIPHER_MIC)) {
+		if (ath_hal_ciphersupported(ah, HAL_CIPHER_MIC))
 			ic->ic_caps |= IEEE80211_C_TKIPMIC;
 			/*
 			 * Check if h/w does MIC correctly when
 			 * WMM is turned on.
 			 */
 			if (ath_hal_wmetkipmic(ah))
 				ic->ic_caps |= IEEE80211_C_WME_TKIPMIC;
 		/*
 		 * If the h/w supports storing tx+rx MIC keys
 		 * in one cache slot automatically enable use.
 		 */
-		if (ath_hal_tkipsplit(ah) ||
+		if (ath_hal_hastkipsplit(ah) ||
 		    !ath_hal_settkipsplit(ah, AH_FALSE))
 			sc->sc_splitmic = 1;
 		/*
 		 * If the h/w can do TKIP MIC together with WME then
 		 * we use it; otherwise we force the MIC to be done
 		 * in software by the net80211 layer.
 		 */
 		if (ath_hal_haswmetkipmic(ah))
 			ic->ic_caps |= IEEE80211_C_WME_TKIPMIC;
+	}
 	sc->sc_hasclrkey = ath_hal_ciphersupported(ah, HAL_CIPHER_CLR);
 #if 0
 	sc->sc_mcastkey = ath_hal_getmcastkeysearch(ah);
-#endif
+	/*
 	 * Mark key cache slots associated with global keys
 	 * as in use.  If we knew TKIP was not to be used we
 	 * could leave the +32, +64, and +32+64 slots free.
 	 */
 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
 		setbit(sc->sc_keymap, i);
 		setbit(sc->sc_keymap, i+64);
 		if (sc->sc_splitmic) {
 			setbit(sc->sc_keymap, i+32);
 			setbit(sc->sc_keymap, i+32+64);
+		}
+	}
 	/*
 	 * TPC support can be done either with a global cap or
 	 * per-packet support.  The latter is not available on
 	 * all parts.  We're a bit pedantic here as all parts
 	 * support a global cap.
 	 */
 	if (ath_hal_hastpc(ah) || ath_hal_hastxpowlimit(ah))
 		ic->ic_caps |= IEEE80211_C_TXPMGT;
 	/*
 	 * Mark WME capability only if we have sufficient
 	 * hardware queues to do proper priority scheduling.
 	 */
 @@ -938,69 +950,77 @@ ath_chan2flags(struct ieee80211com *ic,
 	KASSERT(modeflags[mode] != 0, ("mode %u undefined", mode));
 	return modeflags[mode];
 #undef N
+}
 static int
 ath_ifinit(struct ifnet *ifp)
+{
 	struct ath_softc *sc = (struct ath_softc *)ifp->if_softc;
 	return ath_init(sc);
+}
 static void
 ath_settkipmic(struct ath_softc *sc)
+{
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
 	if ((ic->ic_caps & IEEE80211_C_TKIP) &&
 	    !(ic->ic_caps & IEEE80211_C_WME_TKIPMIC)) {
 		if (ic->ic_flags & IEEE80211_F_WME) {
 			(void)ath_hal_settkipmic(ah, AH_FALSE);
 			ic->ic_caps &= ~IEEE80211_C_TKIPMIC;
 		} else {
 			(void)ath_hal_settkipmic(ah, AH_TRUE);
 			ic->ic_caps |= IEEE80211_C_TKIPMIC;
+		}
+	}
+}
 static int
 ath_init(struct ath_softc *sc)
+{
 	struct ifnet *ifp = &sc->sc_if;
 	struct ieee80211com *ic = &sc->sc_ic;
 	struct ath_hal *ah = sc->sc_ah;
 	HAL_STATUS status;
 	int error = 0;
 	DPRINTF(sc, ATH_DEBUG_ANY, "%s: if_flags 0x%x\n",
 		__func__, ifp->if_flags);
 	if (device_is_active(sc->sc_dev)) {
 		ATH_LOCK(sc);
 	} else if (!pmf_device_resume_self(sc->sc_dev))
 		return ENXIO;
 	else
 		ATH_LOCK(sc);
 	/*
 	 * Stop anything previously setup.  This is safe
 	 * whether this is the first time through or not.
 	 */
 	ath_stop_locked(ifp, 0);
 	int dummy;	/* XXX: gcc */
 	/* Whether we should enable h/w TKIP MIC */
 	if ((ic->ic_caps & IEEE80211_C_WME) &&
 	    ((ic->ic_caps & IEEE80211_C_WME_TKIPMIC) ||
 	    !(ic->ic_flags & IEEE80211_F_WME))) {
 		dummy = ath_hal_settkipmic(ah, AH_TRUE);
 	} else {
 		dummy = ath_hal_settkipmic(ah, AH_FALSE);
 	/*
 	 * The basic interface to setting the hardware in a good
 	 * state is ``reset''.  On return the hardware is known to
 	 * be powered up and with interrupts disabled.  This must
 	 * be followed by initialization of the appropriate bits
 	 * and then setup of the interrupt mask.
 	 */
 	ath_settkipmic(sc);
 	sc->sc_curchan.channel = ic->ic_curchan->ic_freq;
 	sc->sc_curchan.channelFlags = ath_chan2flags(ic, ic->ic_curchan);
 	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_FALSE, &status)) {
 		if_printf(ifp, "unable to reset hardware; hal status %u\n",
 			status);
 		error = EIO;
 		goto done;
+	}
 	/*
 	 * This is needed only to setup initial state
 	 * but it's best done after a reset.
 	 */
 @@ -1160,26 +1180,27 @@ ath_reset(struct ifnet *ifp)
 	HAL_STATUS status;
 	/*
 	 * Convert to a HAL channel description with the flags
 	 * constrained to reflect the current operating mode.
 	 */
 	c = ic->ic_curchan;
 	sc->sc_curchan.channel = c->ic_freq;
 	sc->sc_curchan.channelFlags = ath_chan2flags(ic, c);
 	ath_hal_intrset(ah, 0);		/* disable interrupts */
 	ath_draintxq(sc);		/* stop xmit side */
 	ath_stoprecv(sc);		/* stop recv side */
 	ath_settkipmic(sc);		/* configure TKIP MIC handling */
 	/* NB: indicate channel change so we do a full reset */
 	if (!ath_hal_reset(ah, ic->ic_opmode, &sc->sc_curchan, AH_TRUE, &status))
 		if_printf(ifp, "%s: unable to reset hardware; hal status %u\n",
 			__func__, status);
 	ath_update_txpow(sc);		/* update tx power state */
 	ath_restore_diversity(sc);
 	sc->sc_calinterval = 1;
 	sc->sc_caltries = 0;
 	if (ath_startrecv(sc) != 0)	/* restart recv */
 		if_printf(ifp, "%s: unable to start recv logic\n", __func__);
 	/*
 	 * We may be doing a reset in response to an ioctl
 	 * that changes the channel so update any state that
 @@ -1502,41 +1523,45 @@ ath_keyset_tkip(struct ath_softc *sc, co
 			memcpy(hk->kv_mic, k->wk_rxmic, sizeof(hk->kv_mic));
 			KEYPRINTF(sc, k->wk_keyix+32, hk, mac);
 			/* XXX delete tx key on failure? */
 			return ath_hal_keyset(ah, ATH_KEY(k->wk_keyix+32),
 					hk, mac);
 		} else {
 			/*
 			 * Room for both TX+RX MIC keys in one key cache
 			 * slot, just set key at the first index; the HAL
 			 * will handle the reset.
 			 */
 			memcpy(hk->kv_mic, k->wk_rxmic, sizeof(hk->kv_mic));
 #if HAL_ABI_VERSION > 0x06052200
 			memcpy(hk->kv_txmic, k->wk_txmic, sizeof(hk->kv_txmic));
 #endif
 			KEYPRINTF(sc, k->wk_keyix, hk, mac);
 			return ath_hal_keyset(ah, ATH_KEY(k->wk_keyix), hk, mac);
+		}
-	} else if (k->wk_flags & IEEE80211_KEY_XR) {
+	} else if (k->wk_flags & IEEE80211_KEY_XMIT) {
-		/*
+		if (sc->sc_splitmic) {
-		 * TX/RX key goes at first index.
+			/*
-		 * The hal handles the MIC keys are index+64.
+			 * NB: must pass MIC key in expected location when
-		 */
+			 * the keycache only holds one MIC key per entry.
-		memcpy(hk->kv_mic, k->wk_flags & IEEE80211_KEY_XMIT ?
+			 */
-			k->wk_txmic : k->wk_rxmic, sizeof(hk->kv_mic));
+			memcpy(hk->kv_mic, k->wk_txmic, sizeof(hk->kv_txmic));
 		} else
 			memcpy(hk->kv_txmic, k->wk_txmic, sizeof(hk->kv_txmic));
 		KEYPRINTF(sc, k->wk_keyix, hk, mac);
 		return ath_hal_keyset(ah, ATH_KEY(k->wk_keyix), hk, mac);
 	} else if (k->wk_flags & IEEE80211_KEY_RECV) {
 		memcpy(hk->kv_mic, k->wk_rxmic, sizeof(hk->kv_mic));
 		KEYPRINTF(sc, k->wk_keyix, hk, mac);
 		return ath_hal_keyset(ah, k->wk_keyix, hk, mac);
+	}
 	return 0;
 #undef IEEE80211_KEY_XR
+}
 /*
  * Set a net80211 key into the hardware.  This handles the
  * potential distribution of key state to multiple key
  * cache slots for TKIP with hardware MIC support.
  */
 static int
 ath_keyset(struct ath_softc *sc, const struct ieee80211_key *k,
 	const u_int8_t mac0[IEEE80211_ADDR_LEN],
 @@ -1576,27 +1601,27 @@ ath_keyset(struct ath_softc *sc, const s
 	if ((k->wk_flags & IEEE80211_KEY_GROUP) && sc->sc_mcastkey) {
 		/*
 		 * Group keys on hardware that supports multicast frame
 		 * key search use a mac that is the sender's address with
 		 * the high bit set instead of the app-specified address.
 		 */
 		IEEE80211_ADDR_COPY(gmac, bss->ni_macaddr);
 		gmac[0] |= 0x80;
 		mac = gmac;
 	} else
 		mac = mac0;
 	if ((hk.kv_type == HAL_CIPHER_TKIP &&
-	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0) && sc->sc_splitmic) {
+	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0)) {
 		return ath_keyset_tkip(sc, k, &hk, mac);
 	} else {
 		KEYPRINTF(sc, k->wk_keyix, &hk, mac);
 		return ath_hal_keyset(ah, ATH_KEY(k->wk_keyix), &hk, mac);
+	}
 #undef N
+}
 /*
  * Allocate tx/rx key slots for TKIP.  We allocate two slots for
  * each key, one for decrypt/encrypt and the other for the MIC.
  */
 static u_int16_t
 @@ -1641,26 +1666,74 @@ key_alloc_2pair(struct ath_softc *sc,
 				__func__, keyix, keyix+64,
 				keyix+32, keyix+32+64);
 			*txkeyix = keyix;
 			*rxkeyix = keyix+32;
 			return keyix;
+		}
+	}
 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of pair space\n", __func__);
 	return IEEE80211_KEYIX_NONE;
 #undef N
+}
 /*
  * Allocate tx/rx key slots for TKIP.  We allocate two slots for
  * each key, one for decrypt/encrypt and the other for the MIC.
  */
 static int
 key_alloc_pair(struct ath_softc *sc, ieee80211_keyix *txkeyix,
     ieee80211_keyix *rxkeyix)
+{
 #define N(a)	(sizeof(a)/sizeof(a[0]))
 	u_int i, keyix;
 	KASSERT(!sc->sc_splitmic, ("key cache split"));
 	/* XXX could optimize */
 	for (i = 0; i < N(sc->sc_keymap)/4; i++) {
 		uint8_t b = sc->sc_keymap[i];
 		if (b != 0xff) {
 			/*
 			 * One or more slots in this byte are free.
 			 */
 			keyix = i*NBBY;
 			while (b & 1) {
 		again:
 				keyix++;
 				b >>= 1;
+			}
 			if (isset(sc->sc_keymap, keyix+64)) {
 				/* full pair unavailable */
 				/* XXX statistic */
 				if (keyix == (i+1)*NBBY) {
 					/* no slots were appropriate, advance */
 					continue;
+				}
 				goto again;
+			}
 			setbit(sc->sc_keymap, keyix);
 			setbit(sc->sc_keymap, keyix+64);
 			DPRINTF(sc, ATH_DEBUG_KEYCACHE,
 				"%s: key pair %u,%u\n",
 				__func__, keyix, keyix+64);
 			*txkeyix = *rxkeyix = keyix;
 			return 1;
+		}
+	}
 	DPRINTF(sc, ATH_DEBUG_KEYCACHE, "%s: out of pair space\n", __func__);
 	return 0;
 #undef N
+}
 /*
  * Allocate a single key cache slot.
  */
 static int
 key_alloc_single(struct ath_softc *sc,
 	ieee80211_keyix *txkeyix, ieee80211_keyix *rxkeyix)
+{
 #define	N(a)	(sizeof(a)/sizeof(a[0]))
 	u_int i, keyix;
 	/* XXX try i,i+32,i+64,i+32+64 to minimize key pair conflicts */
 	for (i = 0; i < N(sc->sc_keymap); i++) {
 		u_int8_t b = sc->sc_keymap[i];
 		if (b != 0xff) {
 @@ -1725,28 +1798,31 @@ ath_key_alloc(struct ieee80211com *ic, c
+	}
 	/*
 	 * We allocate two pair for TKIP when using the h/w to do
 	 * the MIC.  For everything else, including software crypto,
 	 * we allocate a single entry.  Note that s/w crypto requires
 	 * a pass-through slot on the 5211 and 5212.  The 5210 does
 	 * not support pass-through cache entries and we map all
 	 * those requests to slot 0.
 	 */
 	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
 		return key_alloc_single(sc, keyix, rxkeyix);
 	} else if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP &&
-	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic) {
+	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0) {
-		return key_alloc_2pair(sc, keyix, rxkeyix);
+		if (sc->sc_splitmic)
 			return key_alloc_2pair(sc, keyix, rxkeyix);
 		else
 			return key_alloc_pair(sc, keyix, rxkeyix);
 	} else {
 		return key_alloc_single(sc, keyix, rxkeyix);
+	}
+}
 /*
  * Delete an entry in the key cache allocated by ath_key_alloc.
  */
 static int
 ath_key_delete(struct ieee80211com *ic, const struct ieee80211_key *k)
+{
 	struct ath_softc *sc = ic->ic_ifp->if_softc;
 	struct ath_hal *ah = sc->sc_ah;
 @@ -1764,31 +1840,33 @@ ath_key_delete(struct ieee80211com *ic,
 	/*
 	 * Handle split tx/rx keying required for TKIP with h/w MIC.
 	 */
 	if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
 	    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && sc->sc_splitmic)
 		ath_hal_keyreset(ah, keyix+32);		/* RX key */
 	if (keyix >= IEEE80211_WEP_NKID) {
 		/*
 		 * Don't touch keymap entries for global keys so
 		 * they are never considered for dynamic allocation.
 		 */
 		clrbit(sc->sc_keymap, keyix);
 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP &&
-		    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0 &&
+		    (k->wk_flags & IEEE80211_KEY_SWMIC) == 0) {
 		    sc->sc_splitmic) {
 			clrbit(sc->sc_keymap, keyix+64);	/* TX key MIC */
-			clrbit(sc->sc_keymap, keyix+32);	/* RX key */
+			if (sc->sc_splitmic) {
-			clrbit(sc->sc_keymap, keyix+32+64);	/* RX key MIC */
+				/* +32 for RX key, +32+64 for RX key MIC */
 				clrbit(sc->sc_keymap, keyix+32);
 				clrbit(sc->sc_keymap, keyix+32+64);
+			}
+		}
+	}
 	return 1;
+}
 /*
  * Set the key cache contents for the specified key.  Key cache
  * slot(s) must already have been allocated by ath_key_alloc.
  */
 static int
 ath_key_set(struct ieee80211com *ic, const struct ieee80211_key *k,
 	const u_int8_t mac[IEEE80211_ADDR_LEN])
+{
 @@ -2972,27 +3050,27 @@ ath_rx_proc(void *arg, int npending)
 		/*
 		 * Must provide the virtual address of the current
 		 * descriptor, the physical address, and the virtual
 		 * address of the next descriptor in the h/w chain.
 		 * This allows the HAL to look ahead to see if the
 		 * hardware is done with a descriptor by checking the
 		 * done bit in the following descriptor and the address
 		 * of the current descriptor the DMA engine is working
 		 * on.  All this is necessary because of our use of
 		 * a self-linked list to avoid rx overruns.
 		 */
 		status = ath_hal_rxprocdesc(ah, ds,
 				bf->bf_daddr, PA2DESC(sc, ds->ds_link),
-				tsf, &ds->ds_rxstat);
+				&ds->ds_rxstat);
 #ifdef AR_DEBUG
 		if (sc->sc_debug & ATH_DEBUG_RECV_DESC)
 			ath_printrxbuf(bf, status == HAL_OK);
 #endif
 		if (status == HAL_EINPROGRESS)
 			break;
 		STAILQ_REMOVE_HEAD(&sc->sc_rxbuf, bf_list);
 		if (ds->ds_rxstat.rs_more) {
 			/*
 			 * Frame spans multiple descriptors; this
 			 * cannot happen yet as we don't support
 			 * jumbograms.  If not in monitor mode,
 			 * discard the frame.
 @@ -4291,27 +4369,27 @@ ath_stoprecv(struct ath_softc *sc)
 	ath_hal_setrxfilter(ah, 0);	/* clear recv filter */
 	ath_hal_stopdmarecv(ah);	/* disable DMA engine */
 	DELAY(3000);			/* 3ms is long enough for 1 frame */
 	if (sc->sc_debug & (ATH_DEBUG_RESET | ATH_DEBUG_FATAL)) {
 		struct ath_buf *bf;
 		printf("%s: rx queue %p, link %p\n", __func__,
 			(void *)(uintptr_t) ath_hal_getrxbuf(ah), sc->sc_rxlink);
 		STAILQ_FOREACH(bf, &sc->sc_rxbuf, bf_list) {
 			struct ath_desc *ds = bf->bf_desc;
 			tsf = ath_hal_gettsf64(sc->sc_ah);
 			HAL_STATUS status = ath_hal_rxprocdesc(ah, ds,
 				bf->bf_daddr, PA2DESC(sc, ds->ds_link),
-				tsf, &ds->ds_rxstat);
+				&ds->ds_rxstat);
 			if (status == HAL_OK || (sc->sc_debug & ATH_DEBUG_FATAL))
 				ath_printrxbuf(bf, status == HAL_OK);
+		}
+	}
 	sc->sc_rxlink = NULL;		/* just in case */
 #undef PA2DESC
+}
 /*
  * Enable the receive h/w following a reset.
  */
 static int
 ath_startrecv(struct ath_softc *sc)

 @@ -1,14 +1,14 @@
-/*	$NetBSD: athvar.h,v 1.25.4.1 2009/08/07 06:43:28 snj Exp $	*/
+/*	$NetBSD: athvar.h,v 1.25.4.2 2009/08/07 06:48:09 snj Exp $	*/
 /*-
  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer,
  *    without modification.
  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
 @@ -48,27 +48,27 @@
 #include <external/isc/atheros_hal/dist/ah.h>
 #include <dev/ic/ath_netbsd.h>
 #include <dev/ic/athioctl.h>
 #include <dev/ic/athrate.h>
 #define	ATH_TIMEOUT		1000
 #ifndef ATH_RXBUF
 #define	ATH_RXBUF	40		/* number of RX buffers */
 #endif
 #ifndef ATH_TXBUF
-#define	ATH_TXBUF	100		/* number of TX buffers */
+#define	ATH_TXBUF	200		/* number of TX buffers */
 #endif
 #define	ATH_TXDESC	10		/* number of descriptors per buffer */
 #define	ATH_TXMAXTRY	11		/* max number of transmit attempts */
 #define	ATH_TXMGTTRY	4		/* xmit attempts for mgt/ctl frames */
 #define	ATH_TXINTR_PERIOD 5		/* max number of batched tx descriptors */
 #define	ATH_BEACON_AIFS_DEFAULT	 0	/* default aifs for ap beacon q */
 #define	ATH_BEACON_CWMIN_DEFAULT 0	/* default cwmin for ap beacon q */
 #define	ATH_BEACON_CWMAX_DEFAULT 0	/* default cwmax for ap beacon q */
 /*
  * The key cache is used for h/w cipher state and also for
  * tracking station state such as the current tx antenna.
 @@ -118,27 +118,27 @@ struct ath_buf {
 #define bf_mapsize	bf_dmamap->dm_mapsize
 #define	ATH_MAX_SCATTER		ATH_TXDESC	/* max(tx,rx,beacon) desc's */
 #define bf_segs		bf_dmamap->dm_segs
 };
 typedef STAILQ_HEAD(, ath_buf) ath_bufhead;
 /*
  * DMA state for tx/rx descriptors.
  */
 struct ath_descdma {
 	const char*		dd_name;
 	struct ath_desc		*dd_desc;	/* descriptors */
 	bus_addr_t		dd_desc_paddr;	/* physical addr of dd_desc */
-	bus_addr_t		dd_desc_len;	/* size of dd_desc */
+	bus_size_t		dd_desc_len;	/* size of dd_desc */
 	bus_dma_segment_t	dd_dseg;
 	int			dd_dnseg;	/* number of segments */
 	bus_dma_tag_t		dd_dmat;	/* bus DMA tag */
 	bus_dmamap_t		dd_dmamap;	/* DMA map for descriptors */
 	struct ath_buf		*dd_bufptr;	/* associated buffers */
 };
 /*
  * Data transmit queue state.  One of these exists for each
  * hardware transmit queue.  Packets sent to us from above
  * are assigned to queues based on their priority.  Not all
  * devices support a complete set of hardware transmit queues.
  * For those devices the array sc_ac2q will map multiple
 @@ -447,36 +447,40 @@ extern int ath_txbuf;
 #define	ath_hal_setctstimeout(_ah, _us) \
 	((*(_ah)->ah_setCTSTimeout)((_ah), (_us)))
 #define	ath_hal_getctstimeout(_ah) \
 	((*(_ah)->ah_getCTSTimeout)((_ah)))
 #define	ath_hal_getcapability(_ah, _cap, _param, _result) \
 	((*(_ah)->ah_getCapability)((_ah), (_cap), (_param), (_result)))
 #define	ath_hal_setcapability(_ah, _cap, _param, _v, _status) \
 	((*(_ah)->ah_setCapability)((_ah), (_cap), (_param), (_v), (_status)))
 #define	ath_hal_ciphersupported(_ah, _cipher) \
 	(ath_hal_getcapability(_ah, HAL_CAP_CIPHER, _cipher, NULL) == HAL_OK)
 #define	ath_hal_getregdomain(_ah, _prd) \
 	(ath_hal_getcapability(_ah, HAL_CAP_REG_DMN, 0, (_prd)) == HAL_OK)
 #define	ath_hal_setregdomain(_ah, _rd) \
-	((*(_ah)->ah_setRegulatoryDomain)((_ah), (_rd), NULL))
+	ath_hal_setcapability(_ah, HAL_CAP_REG_DMN, 0, _rd, NULL)
 #define	ath_hal_getcountrycode(_ah, _pcc) \
 	(*(_pcc) = (_ah)->ah_countryCode)
-#define	ath_hal_tkipsplit(_ah) \
+#define	ath_hal_gettkipmic(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_TKIP_MIC, 1, NULL) == HAL_OK)
 #define	ath_hal_settkipmic(_ah, _v) \
 	ath_hal_setcapability(_ah, HAL_CAP_TKIP_MIC, 1, _v, NULL)
 #define	ath_hal_hastkipsplit(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_TKIP_SPLIT, 0, NULL) == HAL_OK)
-#define ath_hal_settkipmic(_ah, _v) \
+#define	ath_hal_gettkipsplit(_ah) \
-	(ath_hal_setcapability(_ah, HAL_CAP_TKIP_MIC, 1, _v, NULL) == HAL_OK)
+	(ath_hal_getcapability(_ah, HAL_CAP_TKIP_SPLIT, 1, NULL) == HAL_OK)
-#define ath_hal_settkipsplit(_ah, _v) \
+#define	ath_hal_settkipsplit(_ah, _v) \
-	(ath_hal_setcapability(_ah, HAL_CAP_TKIP_SPLIT, 1, _v, NULL) == HAL_OK)
+	ath_hal_setcapability(_ah, HAL_CAP_TKIP_SPLIT, 1, _v, NULL)
-#define ath_hal_wmetkipmic(_ah) \
+#define	ath_hal_haswmetkipmic(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_WME_TKIPMIC, 0, NULL) == HAL_OK)
 #define	ath_hal_hwphycounters(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_PHYCOUNTERS, 0, NULL) == HAL_OK)
 #define	ath_hal_hasdiversity(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_DIVERSITY, 0, NULL) == HAL_OK)
 #define	ath_hal_getdiversity(_ah) \
 	(ath_hal_getcapability(_ah, HAL_CAP_DIVERSITY, 1, NULL) == HAL_OK)
 #define	ath_hal_setdiversity(_ah, _v) \
 	ath_hal_setcapability(_ah, HAL_CAP_DIVERSITY, 1, _v, NULL)
 #define	ath_hal_getdiag(_ah, _pv) \
 	(ath_hal_getcapability(_ah, HAL_CAP_DIAG, 0, _pv) == HAL_OK)
 #define	ath_hal_setdiag(_ah, _v) \
 	ath_hal_setcapability(_ah, HAL_CAP_DIAG, 0, _v, NULL)
 @@ -520,54 +524,52 @@ extern int ath_txbuf;
 	ath_hal_setcapability(_ah, HAL_CAP_RFSILENT, 1, _onoff, NULL)
 #define	ath_hal_getrfsilent(_ah, _prfsilent) \
 	(ath_hal_getcapability(_ah, HAL_CAP_RFSILENT, 2, _prfsilent) == HAL_OK)
 #define	ath_hal_setrfsilent(_ah, _rfsilent) \
 	ath_hal_setcapability(_ah, HAL_CAP_RFSILENT, 2, _rfsilent, NULL)
 #define	ath_hal_gettpack(_ah, _ptpack) \
 	(ath_hal_getcapability(_ah, HAL_CAP_TPC_ACK, 0, _ptpack) == HAL_OK)
 #define	ath_hal_settpack(_ah, _tpack) \
 	ath_hal_setcapability(_ah, HAL_CAP_TPC_ACK, 0, _tpack, NULL)
 #define	ath_hal_gettpcts(_ah, _ptpcts) \
 	(ath_hal_getcapability(_ah, HAL_CAP_TPC_CTS, 0, _ptpcts) == HAL_OK)
 #define	ath_hal_settpcts(_ah, _tpcts) \
 	ath_hal_setcapability(_ah, HAL_CAP_TPC_CTS, 0, _tpcts, NULL)
 #if HAL_ABI_VERSION < 0x05120700
 #define	ath_hal_process_noisefloor(_ah)
 #define	ath_hal_getchannoise(_ah, _c)	(-96)
 #define	HAL_CAP_TPC_ACK	99
 #define	HAL_CAP_TPC_CTS	100
 #else
 #define	ath_hal_getchannoise(_ah, _c) \
 	((*(_ah)->ah_getChanNoise)((_ah), (_c)))
 #endif
 #define	ath_hal_setuprxdesc(_ah, _ds, _size, _intreq) \
 	((*(_ah)->ah_setupRxDesc)((_ah), (_ds), (_size), (_intreq)))
 #if 0
 #define	ath_hal_rxprocdesc(_ah, _ds, _dspa, _dsnext, tsf, a5) \
 	((*(_ah)->ah_procRxDesc)((_ah), (_ds), (_dspa), (_dsnext), (tsf), (a5)))
 #else
 #define	ath_hal_rxprocdesc(_ah, _ds, _dspa, _dsnext, _rs) \
 	((*(_ah)->ah_procRxDesc)((_ah), (_ds), (_dspa), (_dsnext), 0, (_rs)))
 #endif
 #define	ath_hal_setuptxdesc(_ah, _ds, _plen, _hlen, _atype, _txpow, \
 		_txr0, _txtr0, _keyix, _ant, _flags, \
 		_rtsrate, _rtsdura) \
 	((*(_ah)->ah_setupTxDesc)((_ah), (_ds), (_plen), (_hlen), (_atype), \
 		(_txpow), (_txr0), (_txtr0), (_keyix), (_ant), \
 		(_flags), (_rtsrate), (_rtsdura), 0, 0, 0))
 #define	ath_hal_setupxtxdesc(_ah, _ds, \
 		_txr1, _txtr1, _txr2, _txtr2, _txr3, _txtr3) \
 	((*(_ah)->ah_setupXTxDesc)((_ah), (_ds), \
 		(_txr1), (_txtr1), (_txr2), (_txtr2), (_txr3), (_txtr3)))
 #define	ath_hal_filltxdesc(_ah, _ds, _l, _first, _last, _ds0) \
 	((*(_ah)->ah_fillTxDesc)((_ah), (_ds), (_l), (_first), (_last), (_ds0)))
-#define	ath_hal_txprocdesc(_ah, _ds, _a2) \
+#define	ath_hal_txprocdesc(_ah, _ds, _ts) \
-	((*(_ah)->ah_procTxDesc)((_ah), (_ds), (_a2)))
+	((*(_ah)->ah_procTxDesc)((_ah), (_ds), (_ts)))
 #define	ath_hal_gettxintrtxqs(_ah, _txqs) \
 	((*(_ah)->ah_getTxIntrQueue)((_ah), (_txqs)))
 #define ath_hal_gpioCfgOutput(_ah, _gpio) \
         ((*(_ah)->ah_gpioCfgOutput)((_ah), (_gpio)))
 #define ath_hal_gpioset(_ah, _gpio, _b) \
         ((*(_ah)->ah_gpioSet)((_ah), (_gpio), (_b)))
 #define ath_hal_radar_event(_ah) \
 	((*(_ah)->ah_radarHaveEvent)((_ah)))
 #define ath_hal_procdfs(_ah, _chan) \
 	((*(_ah)->ah_processDfs)((_ah), (_chan)))
 #define ath_hal_checknol(_ah, _chan, _nchans) \