xref: /illumos-gate/usr/src/uts/common/io/arn/arn_xmit.c (revision fd7c5980)

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2008 Atheros Communications Inc.
 *
 * Permission to use, copy, modify, and/or distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
#include <sys/param.h>
#include <sys/types.h>
#include <sys/signal.h>
#include <sys/stream.h>
#include <sys/termio.h>
#include <sys/errno.h>
#include <sys/file.h>
#include <sys/cmn_err.h>
#include <sys/stropts.h>
#include <sys/strsubr.h>
#include <sys/strtty.h>
#include <sys/kbio.h>
#include <sys/cred.h>
#include <sys/stat.h>
#include <sys/consdev.h>
#include <sys/kmem.h>
#include <sys/modctl.h>
#include <sys/ddi.h>
#include <sys/sunddi.h>
#include <sys/pci.h>
#include <sys/errno.h>
#include <sys/mac_provider.h>
#include <sys/dlpi.h>
#include <sys/ethernet.h>
#include <sys/list.h>
#include <sys/byteorder.h>
#include <sys/strsun.h>
#include <sys/policy.h>
#include <inet/common.h>
#include <inet/nd.h>
#include <inet/mi.h>
#include <inet/wifi_ioctl.h>
#include <sys/mac_wifi.h>

#include "arn_core.h"

#define	BITS_PER_BYTE		8
#define	OFDM_PLCP_BITS		22
#define	HT_RC_2_MCS(_rc)	((_rc) & 0x0f)
#define	HT_RC_2_STREAMS(_rc)	((((_rc) & 0x78) >> 3) + 1)
#define	L_STF			8
#define	L_LTF			8
#define	L_SIG			4
#define	HT_SIG			8
#define	HT_STF			4
#define	HT_LTF(_ns)		(4 * (_ns))
#define	SYMBOL_TIME(_ns)	((_ns) << 2) /* ns * 4 us */
#define	SYMBOL_TIME_HALFGI(_ns)	(((_ns) * 18 + 4) / 5)  /* ns * 3.6 us */
#define	NUM_SYMBOLS_PER_USEC(_usec)	(_usec >> 2)
#define	NUM_SYMBOLS_PER_USEC_HALFGI(_usec)	(((_usec*5)-4)/18)

#define	OFDM_SIFS_TIME	16

static uint32_t bits_per_symbol[][2] = {
	/* 20MHz 40MHz */
	{    26,  54 },		/*  0: BPSK */
	{    52,  108 },	/*  1: QPSK 1/2 */
	{    78,  162 },	/*  2: QPSK 3/4 */
	{   104,  216 },	/*  3: 16-QAM 1/2 */
	{   156,  324 },	/*  4: 16-QAM 3/4 */
	{   208,  432 },	/*  5: 64-QAM 2/3 */
	{   234,  486 },	/*  6: 64-QAM 3/4 */
	{   260,  540 },	/*  7: 64-QAM 5/6 */
	{    52,  108 },	/*  8: BPSK */
	{   104,  216 },	/*  9: QPSK 1/2 */
	{   156,  324 },	/* 10: QPSK 3/4 */
	{   208,  432 },	/* 11: 16-QAM 1/2 */
	{   312,  648 },	/* 12: 16-QAM 3/4 */
	{   416,  864 },	/* 13: 64-QAM 2/3 */
	{   468,  972 },	/* 14: 64-QAM 3/4 */
	{   520,  1080 },	/* 15: 64-QAM 5/6 */
};

#define	IS_HT_RATE(_rate)	((_rate) & 0x80)

#ifdef ARN_TX_AGGREGRATION
static void arn_tx_send_ht_normal(struct arn_softc *sc, struct ath_txq *txq,
    struct ath_atx_tid *tid, list_t *bf_list);
static void arn_tx_complete_buf(struct arn_softc *sc, struct ath_buf *bf,
    list_t *bf_q, int txok, int sendbar);
static void arn_tx_txqaddbuf(struct arn_softc *sc, struct ath_txq *txq,
    list_t *buf_list);
static void arn_buf_set_rate(struct arn_softc *sc, struct ath_buf *bf);
static int arn_tx_num_badfrms(struct arn_softc *sc,
    struct ath_buf *bf, int txok);
static void arn_tx_rc_status(struct ath_buf *bf, struct ath_desc *ds,
    int nbad, int txok, boolean_t update_rc);
#endif

static void
arn_get_beaconconfig(struct arn_softc *sc, struct ath_beacon_config *conf)
{
	ieee80211com_t *ic = (ieee80211com_t *)sc;
	struct ieee80211_node *in = ic->ic_bss;

	/* fill in beacon config data */

	conf->beacon_interval = in->in_intval ?
	    in->in_intval : ATH_DEFAULT_BINTVAL;
	conf->listen_interval = 100;
	conf->dtim_count = 1;
	conf->bmiss_timeout = ATH_DEFAULT_BMISS_LIMIT * conf->listen_interval;
}

/* Aggregation logic */

#ifdef ARN_TX_AGGREGATION

/* Check if it's okay to send out aggregates */
static int
arn_aggr_query(struct arn_softc *sc, struct ath_node *an, uint8_t tidno)
{
	struct ath_atx_tid *tid;
	tid = ATH_AN_2_TID(an, tidno);

	if (tid->state & AGGR_ADDBA_COMPLETE ||
	    tid->state & AGGR_ADDBA_PROGRESS)
		return (1);
	else
		return (0);
}

/*
 * queue up a dest/ac pair for tx scheduling
 * NB: must be called with txq lock held
 */
static void
arn_tx_queue_tid(struct ath_txq *txq, struct ath_atx_tid *tid)
{
	struct ath_atx_ac *ac = tid->ac;

	/* if tid is paused, hold off */
	if (tid->paused)
		return;

	/* add tid to ac atmost once */
	if (tid->sched)
		return;

	tid->sched = B_TRUE;
	list_insert_tail(&ac->tid_q, &tid->list);

	/* add node ac to txq atmost once */
	if (ac->sched)
		return;

	ac->sched = B_TRUE;
	list_insert_tail(&txq->axq_acq, &ac->list);
}

/* pause a tid */
static void
arn_tx_pause_tid(struct arn_softc *sc, struct ath_atx_tid *tid)
{
	struct ath_txq *txq = &sc->sc_txq[tid->ac->qnum];

	mutex_enter(&txq->axq_lock);

	tid->paused++;

	mutex_exit(&txq->axq_lock);
}

/* resume a tid and schedule aggregate */
void
arn_tx_resume_tid(struct arn_softc *sc, struct ath_atx_tid *tid)
{
	struct ath_txq *txq = &sc->sc_txq[tid->ac->qnum];

	ASSERT(tid->paused > 0);
	mutex_enter(&txq->axq_lock);

	tid->paused--;

	if (tid->paused > 0)
		goto unlock;

	if (list_empty(&tid->buf_q))
		goto unlock;

	/*
	 * Add this TID to scheduler and try to send out aggregates
	 */
	arn_tx_queue_tid(txq, tid);
	arn_txq_schedule(sc, txq);
unlock:
	mutex_exit(&txq->axq_lock);
}

/* flush tid's software queue and send frames as non-ampdu's */
static void
arn_tx_flush_tid(struct arn_softc *sc, struct ath_atx_tid *tid)
{
	struct ath_txq *txq = &sc->sc_txq[tid->ac->qnum];
	struct ath_buf *bf;

	list_t list;
	list_create(&list, sizeof (struct ath_buf),
	    offsetof(struct ath_buf, bf_node));

	ASSERT(tid->paused > 0);
	mutex_enter(&txq->axq_lock);

	tid->paused--;

	if (tid->paused > 0) {
		mutex_exit(&txq->axq_lock);
		return;
	}

	while (!list_empty(&tid->buf_q)) {
		bf = list_head(&tid->buf_q);
		ASSERT(!bf_isretried(bf));
		list_remove(&tid->buf_q, bf);
		list_insert_tail(&list, bf);
		arn_tx_send_ht_normal(sc, txq, tid, &list);
	}

	mutex_exit(&txq->axq_lock);
}

/* Update block ack window */
static void
arn_tx_update_baw(struct arn_softc *sc, struct ath_atx_tid *tid, int seqno)
{
	int index, cindex;

	index  = ATH_BA_INDEX(tid->seq_start, seqno);
	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);

	tid->tx_buf[cindex] = NULL;

	while (tid->baw_head != tid->baw_tail && !tid->tx_buf[tid->baw_head]) {
		INCR(tid->seq_start, IEEE80211_SEQ_MAX);
		INCR(tid->baw_head, ATH_TID_MAX_BUFS);
	}
}

/* Add a sub-frame to block ack window */
static void
arn_tx_addto_baw(struct arn_softc *sc, struct ath_atx_tid *tid,
    struct ath_buf *bf)
{
	int index, cindex;

	if (bf_isretried(bf))
		return;

	index  = ATH_BA_INDEX(tid->seq_start, bf->bf_seqno);
	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);

	ASSERT(tid->tx_buf[cindex] == NULL);
	tid->tx_buf[cindex] = bf;

	if (index >= ((tid->baw_tail - tid->baw_head) &
	    (ATH_TID_MAX_BUFS - 1))) {
		tid->baw_tail = cindex;
		INCR(tid->baw_tail, ATH_TID_MAX_BUFS);
	}
}

/*
 * TODO: For frame(s) that are in the retry state, we will reuse the
 * sequence number(s) without setting the retry bit. The
 * alternative is to give up on these and BAR the receiver's window
 * forward.
 */
static void
arn_tid_drain(struct arn_softc *sc,
    struct ath_txq *txq,
    struct ath_atx_tid *tid)
{
	struct ath_buf *bf;

	list_t list;
	list_create(&list, sizeof (struct ath_buf),
	    offsetof(struct ath_buf, bf_node));

	for (;;) {
		if (list_empty(&tid->buf_q))
			break;

		bf = list_head(&tid->buf_q);
		list_remove(&tid->buf_q, bf);
		list_insert_tail(&list, bf);

		if (bf_isretried(bf))
			arn_tx_update_baw(sc, tid, bf->bf_seqno);

		mutex_enter(&txq->axq_lock);
		arn_tx_complete_buf(sc, bf, &list, 0, 0);
		mutex_exit(&txq->axq_lock);
	}

	tid->seq_next = tid->seq_start;
	tid->baw_tail = tid->baw_head;
}

static void
arn_tx_set_retry(struct arn_softc *sc, struct ath_buf *bf)
{
	struct ieee80211_frame *wh;
	wh = (struct ieee80211_frame *)bf->bf_dma.mem_va;

	bf->bf_state.bf_type |= BUF_RETRY;
	bf->bf_retries++;

	*(uint16_t *)&wh->i_seq[0] |= LE_16(0x0800); /* ??? */
}

static struct ath_buf *
arn_clone_txbuf(struct arn_softc *sc, struct ath_buf *bf)
{
	struct ath_buf *tbf;

	mutex_enter(&sc->sc_txbuflock);
	ASSERT(!list_empty((&sc->sc_txbuf_list)));

	tbf = list_head(&sc->sc_txbuf_list);
	list_remove(&sc->sc_txbuf_list, tbf);
	mutex_exit(&sc->sc_txbuflock);

	ATH_TXBUF_RESET(tbf);

	tbf->bf_daddr = bf->bf_daddr; /* physical addr of desc */
	tbf->bf_dma = bf->bf_dma; /* dma area for buf */
	*(tbf->bf_desc) = *(bf->bf_desc); /* virtual addr of desc */
	tbf->bf_state = bf->bf_state; /* buffer state */

	return (tbf);
}

static void
arn_tx_complete_aggr(struct arn_softc *sc, struct ath_txq *txq,
    struct ath_buf *bf, list_t *bf_q, int txok)
{
	struct ieee80211_node *in;
	struct ath_node *an = NULL;
	struct ath_atx_tid *tid = NULL;
	struct ath_buf *bf_next, *bf_last = bf->bf_lastbf;
	struct ath_desc *ds = bf_last->bf_desc;

	list_t list, list_pending;
	uint16_t seq_st = 0, acked_cnt = 0, txfail_cnt = 0;
	uint32_t ba[WME_BA_BMP_SIZE >> 5];
	int isaggr, txfail, txpending, sendbar = 0, needreset = 0, nbad = 0;
	boolean_t rc_update = B_TRUE;

	an = ATH_NODE(in); /* Be sure in != NULL */
	tid = ATH_AN_2_TID(an, bf->bf_tidno);

	isaggr = bf_isaggr(bf);
	memset(ba, 0, WME_BA_BMP_SIZE >> 3);

	if (isaggr && txok) {
		if (ATH_DS_TX_BA(ds)) {
			seq_st = ATH_DS_BA_SEQ(ds);
			memcpy(ba, ATH_DS_BA_BITMAP(ds),
			    WME_BA_BMP_SIZE >> 3);
		} else {
			/*
			 * AR5416 can become deaf/mute when BA
			 * issue happens. Chip needs to be reset.
			 * But AP code may have sychronization issues
			 * when perform internal reset in this routine.
			 * Only enable reset in STA mode for now.
			 */
			if (sc->sc_ah->ah_opmode == ATH9K_M_STA)
				needreset = 1;
		}
	}

	list_create(&list_pending, sizeof (struct ath_buf),
	    offsetof(struct ath_buf, bf_node));
	list_create(&list, sizeof (struct ath_buf),
	    offsetof(struct ath_buf, bf_node));

	nbad = arn_tx_num_badfrms(sc, bf, txok);
	while (bf) {
		txfail = txpending = 0;
		bf_next = bf->bf_next;

		if (ATH_BA_ISSET(ba, ATH_BA_INDEX(seq_st, bf->bf_seqno))) {
			/*
			 * transmit completion, subframe is
			 * acked by block ack
			 */
			acked_cnt++;
		} else if (!isaggr && txok) {
			/* transmit completion */
			acked_cnt++;
		} else {
			if (!(tid->state & AGGR_CLEANUP) &&
			    ds->ds_txstat.ts_flags != ATH9K_TX_SW_ABORTED) {
				if (bf->bf_retries < ATH_MAX_SW_RETRIES) {
					arn_tx_set_retry(sc, bf);
					txpending = 1;
				} else {
					bf->bf_state.bf_type |= BUF_XRETRY;
					txfail = 1;
					sendbar = 1;
					txfail_cnt++;
				}
			} else {
				/*
				 * cleanup in progress, just fail
				 * the un-acked sub-frames
				 */
				txfail = 1;
			}
		}

		if (bf_next == NULL) {
			/* INIT_LIST_HEAD */
			list_create(&list, sizeof (struct ath_buf),
			    offsetof(struct ath_buf, bf_node));
		} else {
			ASSERT(!list_empty(bf_q));
			list_remove(bf_q, bf);
			list_insert_tail(&list, bf);
		}

		if (!txpending) {
			/*
			 * complete the acked-ones/xretried ones; update
			 * block-ack window
			 */
			mutex_enter(&txq->axq_lock);
			arn_tx_update_baw(sc, tid, bf->bf_seqno);
			mutex_exit(&txq->axq_lock);

			if (rc_update && (acked_cnt == 1 || txfail_cnt == 1)) {
				ath_tx_rc_status(bf, ds, nbad, txok, B_TRUE);
				rc_update = B_FALSE;
			} else {
				ath_tx_rc_status(bf, ds, nbad, txok, B_FALSE);
			}

			ath_tx_complete_buf(sc, bf, list, !txfail, sendbar);
		} else {
			/* retry the un-acked ones */
			if (bf->bf_next == NULL &&
			    bf_last->bf_status & ATH_BUFSTATUS_STALE) {
				struct ath_buf *tbf;

				tbf = arn_clone_txbuf(sc, bf_last);
				ath9k_hw_cleartxdesc(sc->sc_ah, tbf->bf_desc);
				list_insert_tail(&list, tbf);
			} else {
				/*
				 * Clear descriptor status words for
				 * software retry
				 */
				ath9k_hw_cleartxdesc(sc->sc_ah, bf->bf_desc);
			}

			/*
			 * Put this buffer to the temporary pending
			 * queue to retain ordering
			 */
			list_splice_tail_init(&list, &list_pending);
			/*
			 * Insert src list after dst list.
			 * Empty src list thereafter
			 */
			list_move_tail(&list_pending, &list);
			/* should re-initialize list here??? */
		}

		bf = bf_next;
	}

	if (tid->state & AGGR_CLEANUP) {
		if (tid->baw_head == tid->baw_tail) {
			tid->state &= ~AGGR_ADDBA_COMPLETE;
			tid->addba_exchangeattempts = 0;
			tid->state &= ~AGGR_CLEANUP;

			/* send buffered frames as singles */
			arn_tx_flush_tid(sc, tid);
		}
		return;
	}

	/*
	 * prepend un-acked frames to the beginning of
	 * the pending frame queue
	 */

	if (!list_empty(&list_pending)) {
		mutex_enter(&txq->axq_lock);
		list_move_tail(&list_pending, &tid->buf_q);
		arn_tx_queue_tid(txq, tid);
		mutex_exit(&txq->axq_lock);
	}
}

static uint32_t
arn_lookup_rate(struct arn_softc *sc, struct ath_buf *bf,
    struct ath_atx_tid *tid)
{
	struct ath_rate_table *rate_table = sc->sc_currates;
	struct ath9k_tx_rate *rates;
	struct ath_tx_info_priv *tx_info_priv;
	uint32_t max_4ms_framelen, frmlen;
	uint16_t aggr_limit, legacy = 0, maxampdu;
	int i;

	/* ???  */
	rates = (struct ath9k_tx_rate *)bf->rates;
	tx_info_priv = (struct ath_tx_info_priv *)&bf->tx_info_priv;

	/*
	 * Find the lowest frame length among the rate series that will have a
	 * 4ms transmit duration.
	 * TODO - TXOP limit needs to be considered.
	 */
	max_4ms_framelen = ATH_AMPDU_LIMIT_MAX;

	for (i = 0; i < 4; i++) {
		if (rates[i].count) {
			if (!WLAN_RC_PHY_HT
			    (rate_table->info[rates[i].idx].phy)) {
				legacy = 1;
				break;
			}

			frmlen =
			    rate_table->info[rates[i].idx].max_4ms_framelen;
			max_4ms_framelen = min(max_4ms_framelen, frmlen);
		}
	}

	/*
	 * limit aggregate size by the minimum rate if rate selected is
	 * not a probe rate, if rate selected is a probe rate then
	 * avoid aggregation of this packet.
	 */
	if (legacy)
		return (0);

	aggr_limit = min(max_4ms_framelen, (uint32_t)ATH_AMPDU_LIMIT_DEFAULT);

	/*
	 * h/w can accept aggregates upto 16 bit lengths (65535).
	 * The IE, however can hold upto 65536, which shows up here
	 * as zero. Ignore 65536 since we  are constrained by hw.
	 */
	maxampdu = tid->an->maxampdu;
	if (maxampdu)
		aggr_limit = min(aggr_limit, maxampdu);

	return (aggr_limit);
}

/*
 * Returns the number of delimiters to be added to
 * meet the minimum required mpdudensity.
 * caller should make sure that the rate is HT rate .
 */
static int
arn_compute_num_delims(struct arn_softc *sc, struct ath_atx_tid *tid,
    struct ath_buf *bf, uint16_t frmlen)
{
	struct ath_rate_table *rt = sc->sc_currates;
	struct ath9k_tx_rate *rates = (struct ath9k_tx_rate *)bf->rates;
	uint32_t nsymbits, nsymbols, mpdudensity;
	uint16_t minlen;
	uint8_t rc, flags, rix;
	int width, half_gi, ndelim, mindelim;

	/* Select standard number of delimiters based on frame length alone */
	ndelim = ATH_AGGR_GET_NDELIM(frmlen);

	/*
	 * If encryption enabled, hardware requires some more padding between
	 * subframes.
	 * TODO - this could be improved to be dependent on the rate.
	 * The hardware can keep up at lower rates, but not higher rates
	 */
	if (bf->bf_keytype != ATH9K_KEY_TYPE_CLEAR)
		ndelim += ATH_AGGR_ENCRYPTDELIM;

	/*
	 * Convert desired mpdu density from microeconds to bytes based
	 * on highest rate in rate series (i.e. first rate) to determine
	 * required minimum length for subframe. Take into account
	 * whether high rate is 20 or 40Mhz and half or full GI.
	 */
	mpdudensity = tid->an->mpdudensity;

	/*
	 * If there is no mpdu density restriction, no further calculation
	 * is needed.
	 */
	if (mpdudensity == 0)
		return (ndelim);

	rix = rates[0].idx;
	flags = rates[0].flags;
	rc = rt->info[rix].ratecode;
	width = (flags & ATH9K_TX_RC_40_MHZ_WIDTH) ? 1 : 0;
	half_gi = (flags & ATH9K_TX_RC_SHORT_GI) ? 1 : 0;

	if (half_gi)
		nsymbols = NUM_SYMBOLS_PER_USEC_HALFGI(mpdudensity);
	else
		nsymbols = NUM_SYMBOLS_PER_USEC(mpdudensity);

	if (nsymbols == 0)
		nsymbols = 1;

	nsymbits = bits_per_symbol[HT_RC_2_MCS(rc)][width];
	minlen = (nsymbols * nsymbits) / BITS_PER_BYTE;

	if (frmlen < minlen) {
		mindelim = (minlen - frmlen) / ATH_AGGR_DELIM_SZ;
		ndelim = max(mindelim, ndelim);
	}

	return (ndelim);
}

static enum ATH_AGGR_STATUS
arn_tx_form_aggr(struct arn_softc *sc, struct ath_atx_tid *tid,
    list_t *bf_q)
{
#define	PADBYTES(_len) ((4 - ((_len) % 4)) % 4)
	struct ath_buf *bf, *bf_first, *bf_prev = NULL;
	int rl = 0, nframes = 0, ndelim, prev_al = 0;
	uint16_t aggr_limit = 0, al = 0, bpad = 0,
	    al_delta, h_baw = tid->baw_size / 2;
	enum ATH_AGGR_STATUS status = ATH_AGGR_DONE;

	bf_first = list_head(&tid->buf_q);

	do {
		bf = list_head(&tid->buf_q);

		/* do not step over block-ack window */
		if (!BAW_WITHIN(tid->seq_start, tid->baw_size, bf->bf_seqno)) {
			status = ATH_AGGR_BAW_CLOSED;
			break;
		}

		if (!rl) {
			aggr_limit = arn_lookup_rate(sc, bf, tid);
			rl = 1;
		}

		/* do not exceed aggregation limit */
		al_delta = ATH_AGGR_DELIM_SZ + bf->bf_frmlen;

		if (nframes &&
		    (aggr_limit < (al + bpad + al_delta + prev_al))) {
			status = ATH_AGGR_LIMITED;
			break;
		}

		/* do not exceed subframe limit */
		if (nframes >= min((int)h_baw, ATH_AMPDU_SUBFRAME_DEFAULT)) {
			status = ATH_AGGR_LIMITED;
			break;
		}
		nframes++;

		/* add padding for previous frame to aggregation length */
		al += bpad + al_delta;

		/*
		 * Get the delimiters needed to meet the MPDU
		 * density for this node.
		 */
		ndelim =
		    arn_compute_num_delims(sc, tid, bf_first, bf->bf_frmlen);
		bpad = PADBYTES(al_delta) + (ndelim << 2);

		bf->bf_next = NULL;
		bf->bf_desc->ds_link = 0;

		/* link buffers of this frame to the aggregate */
		arn_tx_addto_baw(sc, tid, bf);
		ath9k_hw_set11n_aggr_middle(sc->sc_ah, bf->bf_desc, ndelim);
		list_remove(&tid->buf_q, bf);
		list_insert_tail(bf_q, bf);
		if (bf_prev) {
			bf_prev->bf_next = bf;
			bf_prev->bf_desc->ds_link = bf->bf_daddr;
		}
		bf_prev = bf;
	} while (!list_empty(&tid->buf_q));

	bf_first->bf_al = al;
	bf_first->bf_nframes = nframes;

	return (status);
#undef PADBYTES
}

static void
arn_tx_sched_aggr(struct arn_softc *sc, struct ath_txq *txq,
    struct ath_atx_tid *tid)
{
	struct ath_buf *bf;
	enum ATH_AGGR_STATUS status;
	list_t bf_q;

	do {
		if (list_empty(&tid->buf_q))
			return;

		/* INIT_LIST_HEAD */
		list_create(&bf_q, sizeof (struct ath_buf),
		    offsetof(struct ath_buf, bf_node));

		status = arn_tx_form_aggr(sc, tid, &bf_q);

		/*
		 * no frames picked up to be aggregated;
		 * block-ack window is not open.
		 */
		if (list_empty(&bf_q))
			break;

		bf = list_head(&bf_q);
		bf->bf_lastbf = list_object(&bf_q, bf->bf_node.list_prev);

		/* if only one frame, send as non-aggregate */
		if (bf->bf_nframes == 1) {
			bf->bf_state.bf_type &= ~BUF_AGGR;
			ath9k_hw_clr11n_aggr(sc->sc_ah, bf->bf_desc);
			ath_buf_set_rate(sc, bf);
			arn_tx_txqaddbuf(sc, txq, &bf_q);
			continue;
		}

		/* setup first desc of aggregate */
		bf->bf_state.bf_type |= BUF_AGGR;
		ath_buf_set_rate(sc, bf);
		ath9k_hw_set11n_aggr_first(sc->sc_ah, bf->bf_desc, bf->bf_al);

		/* anchor last desc of aggregate */
		ath9k_hw_set11n_aggr_last(sc->sc_ah, bf->bf_lastbf->bf_desc);

		txq->axq_aggr_depth++;
		arn_tx_txqaddbuf(sc, txq, &bf_q);

	} while (txq->axq_depth < ATH_AGGR_MIN_QDEPTH &&
	    status != ATH_AGGR_BAW_CLOSED);
}

int
arn_tx_aggr_start(struct arn_softc *sc, struct ieee80211_node *in,
    uint16_t tid, uint16_t *ssn)
{
	struct ath_atx_tid *txtid;
	struct ath_node *an;

	an = ATH_NODE(in);

	if (sc->sc_flags & SC_OP_TXAGGR) {
		txtid = ATH_AN_2_TID(an, tid);
		txtid->state |= AGGR_ADDBA_PROGRESS;
		arn_tx_pause_tid(sc, txtid);
		*ssn = txtid->seq_start;
	}

	return (0);
}

int
arn_tx_aggr_stop(struct arn_softc *sc, struct ieee80211_node *in, uint16_t tid)
{
	struct ath_node *an = ATH_NODE(in);
	struct ath_atx_tid *txtid = ATH_AN_2_TID(an, tid);
	struct ath_txq *txq = &sc->sc_txq[txtid->ac->qnum];
	struct ath_buf *bf;

	list_t list;
	list_create(&list, sizeof (struct ath_buf),
	    offsetof(struct ath_buf, bf_node));

	if (txtid->state & AGGR_CLEANUP)
		return (0);

	if (!(txtid->state & AGGR_ADDBA_COMPLETE)) {
		txtid->addba_exchangeattempts = 0;
		return (0);
	}

	arn_tx_pause_tid(sc, txtid);

	/* drop all software retried frames and mark this TID */
	mutex_enter(&txq->axq_lock);
	while (!list_empty(&txtid->buf_q)) {
		/* list_first_entry */
		bf = list_head(&txtid->buf_q);
		if (!bf_isretried(bf)) {
			/*
			 * NB: it's based on the assumption that
			 * software retried frame will always stay
			 * at the head of software queue.
			 */
			break;
		}
		list_remove(&txtid->buf_q, bf);
		list_insert_tail(&list, bf);
		arn_tx_update_baw(sc, txtid, bf->bf_seqno);
		// ath_tx_complete_buf(sc, bf, &list, 0, 0); /* to do */
	}
	mutex_exit(&txq->axq_lock);

	if (txtid->baw_head != txtid->baw_tail) {
		txtid->state |= AGGR_CLEANUP;
	} else {
		txtid->state &= ~AGGR_ADDBA_COMPLETE;
		txtid->addba_exchangeattempts = 0;
		arn_tx_flush_tid(sc, txtid);
	}

	return (0);
}

void
arn_tx_aggr_resume(struct arn_softc *sc,
    struct ieee80211_node *in,
    uint16_t tid)
{
	struct ath_atx_tid *txtid;
	struct ath_node *an;

	an = ATH_NODE(in);

	if (sc->sc_flags & SC_OP_TXAGGR) {
		txtid = ATH_AN_2_TID(an, tid);
		txtid->baw_size = (0x8) << sc->sc_ht_conf.ampdu_factor;
		txtid->state |= AGGR_ADDBA_COMPLETE;
		txtid->state &= ~AGGR_ADDBA_PROGRESS;
		arn_tx_resume_tid(sc, txtid);
	}
}

boolean_t
arn_tx_aggr_check(struct arn_softc *sc, struct ath_node *an, uint8_t tidno)
{
	struct ath_atx_tid *txtid;

	if (!(sc->sc_flags & SC_OP_TXAGGR))
		return (B_FALSE);

	txtid = ATH_AN_2_TID(an, tidno);

	if (!(txtid->state & AGGR_ADDBA_COMPLETE)) {
		if (!(txtid->state & AGGR_ADDBA_PROGRESS) &&
		    (txtid->addba_exchangeattempts < ADDBA_EXCHANGE_ATTEMPTS)) {
			txtid->addba_exchangeattempts++;
			return (B_TRUE);
		}
	}

	return (B_FALSE);
}

/* Queue Management */

static void
arn_txq_drain_pending_buffers(struct arn_softc *sc, struct ath_txq *txq)
{
	struct ath_atx_ac *ac, *ac_tmp;
	struct ath_atx_tid *tid, *tid_tmp;

	list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq) {
		list_remove(&txq->axq_acq, ac);
		ac->sched = B_FALSE;
		list_for_each_entry_safe(tid, tid_tmp, &ac->tid_q) {
			list_remove(&ac->tid_q, tid);
			tid->sched = B_FALSE;
			arn_tid_drain(sc, txq, tid);
		}
	}
}

int
arn_tx_get_qnum(struct arn_softc *sc, int qtype, int haltype)
{
	int qnum;

	switch (qtype) {
	case ATH9K_TX_QUEUE_DATA:
		if (haltype >= ARRAY_SIZE(sc->sc_haltype2q)) {
			ARN_DBG((ARN_DBG_FATAL, "arn: arn_tx_get_qnum(): "
			    "HAL AC %u out of range, max %zu!\n",
			    haltype, ARRAY_SIZE(sc->sc_haltype2q)));
			return (-1);
		}
		qnum = sc->sc_haltype2q[haltype];
		break;
	case ATH9K_TX_QUEUE_BEACON:
		qnum = sc->sc_beaconq;
		break;
	case ATH9K_TX_QUEUE_CAB:
		qnum = sc->sc_cabq->axq_qnum;
		break;
	default:
		qnum = -1;
	}
	return (qnum);
}

struct ath_txq *
arn_test_get_txq(struct arn_softc *sc, struct ieee80211_node *in,
    struct ieee80211_frame *wh, uint8_t type)
{
	struct ieee80211_qosframe *qwh = NULL;
	struct ath_txq *txq = NULL;
	int tid = -1;
	int qos_ac;
	int qnum;

	if (in->in_flags & IEEE80211_NODE_QOS) {

		if ((type & IEEE80211_FC0_TYPE_MASK) ==
		    IEEE80211_FC0_TYPE_DATA) {

			if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
				qwh = (struct ieee80211_qosframe *)wh;

				tid = qwh->i_qos[0] & IEEE80211_QOS_TID;
				switch (tid) {
				case 1:
				case 2:
					qos_ac = WME_AC_BK;
				case 0:
				case 3:
					qos_ac = WME_AC_BE;
				case 4:
				case 5:
					qos_ac = WME_AC_VI;
				case 6:
				case 7:
					qos_ac = WME_AC_VO;
				}
			}
		} else {
			qos_ac = WME_AC_VO;
		}
	} else if ((type & IEEE80211_FC0_TYPE_MASK) ==
	    IEEE80211_FC0_TYPE_MGT) {
			qos_ac = WME_AC_VO;
	} else if ((type & IEEE80211_FC0_TYPE_MASK) ==
	    IEEE80211_FC0_TYPE_CTL) {
			qos_ac = WME_AC_VO;
	} else {
			qos_ac = WME_AC_BK;
	}
	qnum = arn_get_hal_qnum(qos_ac, sc);
	txq = &sc->sc_txq[qnum];

	mutex_enter(&txq->axq_lock);

	if (txq->axq_depth >= (ATH_TXBUF - 20)) {
		ARN_DBG((ARN_DBG_XMIT,
		    "TX queue: %d is full, depth: %d\n",
		    qnum, txq->axq_depth));
		/* stop th queue */
		sc->sc_resched_needed = B_TRUE;
		txq->stopped = 1;
		mutex_exit(&txq->axq_lock);
		return (NULL);
	}

	mutex_exit(&txq->axq_lock);

	return (txq);
}

/* Called only when tx aggregation is enabled and HT is supported */
static void
assign_aggr_tid_seqno(struct arn_softc *sc,
    struct ath_buf *bf,
    struct ieee80211_frame *wh)
{
	struct ath_node *an;
	struct ath_atx_tid *tid;
	struct ieee80211_node *in;
	struct ieee80211_qosframe *qwh = NULL;
	ieee80211com_t *ic = (ieee80211com_t *)sc;

	in = ieee80211_find_txnode(ic, wh->i_addr1);
	if (in == NULL) {
		arn_problem("assign_aggr_tid_seqno():"
		    "failed to find tx node\n");
		return;
	}
	an = ATH_NODE(in);

	/* Get tidno */
	if (in->in_flags & IEEE80211_NODE_QOS) {
		if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
			qwh = (struct ieee80211_qosframe *)wh;
			bf->bf_tidno = qwh->i_qos[0] & IEEE80211_QOS_TID;
		}
	}

	/* Get seqno */
	/*
	 * For HT capable stations, we save tidno for later use.
	 * We also override seqno set by upper layer with the one
	 * in tx aggregation state.
	 *
	 * If fragmentation is on, the sequence number is
	 * not overridden, since it has been
	 * incremented by the fragmentation routine.
	 *
	 * FIXME: check if the fragmentation threshold exceeds
	 * IEEE80211 max.
	 */
	tid = ATH_AN_2_TID(an, bf->bf_tidno);

	*(uint16_t *)&wh->i_seq[0] =
	    LE_16(tid->seq_next << IEEE80211_SEQ_SEQ_SHIFT);
	bf->bf_seqno = tid->seq_next;
	/* LINTED E_CONSTANT_CONDITION */
	INCR(tid->seq_next, IEEE80211_SEQ_MAX);

	/* release node */
	ieee80211_free_node(in);
}

/* Compute the number of bad frames */
/* ARGSUSED */
static int
arn_tx_num_badfrms(struct arn_softc *sc, struct ath_buf *bf, int txok)
{
	struct ath_buf *bf_last = bf->bf_lastbf;
	struct ath_desc *ds = bf_last->bf_desc;
	uint16_t seq_st = 0;
	uint32_t ba[WME_BA_BMP_SIZE >> 5];
	int ba_index;
	int nbad = 0;
	int isaggr = 0;

	if (ds->ds_txstat.ts_flags == ATH9K_TX_SW_ABORTED)
		return (0);

	isaggr = bf_isaggr(bf);
	if (isaggr) {
		seq_st = ATH_DS_BA_SEQ(ds);
		memcpy(ba, ATH_DS_BA_BITMAP(ds), WME_BA_BMP_SIZE >> 3);
	}

	while (bf) {
		ba_index = ATH_BA_INDEX(seq_st, bf->bf_seqno);
		if (!txok || (isaggr && !ATH_BA_ISSET(ba, ba_index)))
			nbad++;

		bf = bf->bf_next;
	}

	return (nbad);
}

static void
arn_tx_send_ht_normal(struct arn_softc *sc,
    struct ath_txq *txq,
    struct ath_atx_tid *tid,
    list_t *list)
{
	struct ath_buf *bf;

	bf = list_head(list);
	bf->bf_state.bf_type &= ~BUF_AMPDU;

	/* update starting sequence number for subsequent ADDBA request */
	INCR(tid->seq_start, IEEE80211_SEQ_MAX);

	bf->bf_nframes = 1;
	bf->bf_lastbf = bf;
	ath_buf_set_rate(sc, bf);
	arn_tx_txqaddbuf(sc, txq, list);
}

/*
 * Insert a chain of ath_buf (descriptors) on a txq and
 * assume the descriptors are already chained together by caller.
 */
static void
arn_tx_txqaddbuf(struct arn_softc *sc,
    struct ath_txq *txq,
    list_t *list)
{
	struct ath_buf *bf;

	/*
	 * Insert the frame on the outbound list and
	 * pass it on to the hardware.
	 */

	if (list_empty(list))
		return;

	bf = list_head(list);

	list_splice_tail_init(list, &txq->axq_q);

	txq->axq_depth++;
	txq->axq_totalqueued++;
	txq->axq_linkbuf = list_object(list, txq->axq_q.prev);

	ARN_DBG((ARN_DBG_QUEUE,
	    "qnum: %d, txq depth: %d\n", txq->axq_qnum, txq->axq_depth));

	if (txq->axq_link == NULL) {
		ath9k_hw_puttxbuf(sc->sc_ah, txq->axq_qnum, bf->bf_daddr);
		ARN_DBG((ARN_DBG_XMIT,
		    "TXDP[%u] = %llx (%p)\n",
		    txq->axq_qnum, ito64(bf->bf_daddr), bf->bf_desc));
	} else {
		*txq->axq_link = bf->bf_daddr;
		ARN_DBG((ARN_DBG_XMIT, "link[%u] (%p)=%llx (%p)\n",
		    txq->axq_qnum, txq->axq_link,
		    ito64(bf->bf_daddr), bf->bf_desc));
	}
	txq->axq_link = &(bf->bf_lastbf->bf_desc->ds_link);
	ath9k_hw_txstart(sc->sc_ah, txq->axq_qnum);
}
#endif /* ARN_TX_AGGREGATION */

static struct ath_buf *
arn_tx_get_buffer(struct arn_softc *sc)
{
	struct ath_buf *bf = NULL;

	mutex_enter(&sc->sc_txbuflock);
	bf = list_head(&sc->sc_txbuf_list);
	/* Check if a tx buffer is available */
	if (bf != NULL)
		list_remove(&sc->sc_txbuf_list, bf);
	if (list_empty(&sc->sc_txbuf_list)) {
		ARN_DBG((ARN_DBG_XMIT, "arn: arn_tx(): "
		    "stop queue\n"));
		sc->sc_stats.ast_tx_qstop++;
	}
	mutex_exit(&sc->sc_txbuflock);

	return (bf);
}

static uint32_t
setup_tx_flags(struct arn_softc *sc,
    struct ieee80211_frame *wh,
    uint32_t pktlen)
{
	int flags = 0;
	ieee80211com_t *ic = (ieee80211com_t *)sc;

	flags |= ATH9K_TXDESC_CLRDMASK; /* needed for crypto errors */
	flags |= ATH9K_TXDESC_INTREQ;

	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
		flags |= ATH9K_TXDESC_NOACK;	/* no ack on broad/multicast */
		sc->sc_stats.ast_tx_noack++;
	}
	if (pktlen > ic->ic_rtsthreshold) {
		flags |= ATH9K_TXDESC_RTSENA;	/* RTS based on frame length */
		sc->sc_stats.ast_tx_rts++;
	}

	return (flags);
}

static void
ath_tx_setup_buffer(struct arn_softc *sc, struct ath_buf *bf,
    struct ieee80211_node *in, struct ieee80211_frame *wh,
    uint32_t pktlen, uint32_t keytype)
{
	ieee80211com_t *ic = (ieee80211com_t *)sc;
	int i;

	/* Buf reset */
	ATH_TXBUF_RESET(bf);
	for (i = 0; i < 4; i++) {
		bf->rates[i].idx = -1;
		bf->rates[i].flags = 0;
		bf->rates[i].count = 1;
	}

	bf->bf_in = in;
	/* LINTED E_ASSIGN_NARROW_CONV */
	bf->bf_frmlen = pktlen;

	/* Frame type */
	IEEE80211_IS_DATA(wh) ?
	    (bf->bf_state.bf_type |= BUF_DATA) :
	    (bf->bf_state.bf_type &= ~BUF_DATA);
	IEEE80211_IS_BACK_REQ(wh) ?
	    (bf->bf_state.bf_type |= BUF_BAR) :
	    (bf->bf_state.bf_type &= ~BUF_BAR);
	IEEE80211_IS_PSPOLL(wh) ?
	    (bf->bf_state.bf_type |= BUF_PSPOLL) :
	    (bf->bf_state.bf_type &= ~BUF_PSPOLL);
	/*
	 * The 802.11 layer marks whether or not we should
	 * use short preamble based on the current mode and
	 * negotiated parameters.
	 */
	((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
	    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) ?
	    (bf->bf_state.bf_type |= BUF_SHORT_PREAMBLE) :
	    (bf->bf_state.bf_type &= ~BUF_SHORT_PREAMBLE);

	bf->bf_flags = setup_tx_flags(sc, wh, pktlen);

	/* Crypto */
	bf->bf_keytype = keytype;

	/* Assign seqno, tidno for tx aggrefation */

#ifdef ARN_TX_AGGREGATION
	if (ieee80211_is_data_qos(wh) && (sc->sc_flags & SC_OP_TXAGGR))
		assign_aggr_tid_seqno(sc, bf, wh);
#endif /* ARN_TX_AGGREGATION */

}

/*
 * ath_pkt_dur - compute packet duration (NB: not NAV)
 *
 * rix - rate index
 * pktlen - total bytes (delims + data + fcs + pads + pad delims)
 * width  - 0 for 20 MHz, 1 for 40 MHz
 * half_gi - to use 4us v/s 3.6 us for symbol time
 */
static uint32_t
ath_pkt_duration(struct arn_softc *sc, uint8_t rix, struct ath_buf *bf,
    int width, int half_gi, boolean_t shortPreamble)
{
	struct ath_rate_table *rate_table = sc->sc_currates;
	uint32_t nbits, nsymbits, duration, nsymbols;
	uint8_t rc;
	int streams, pktlen;

	pktlen = bf_isaggr(bf) ? bf->bf_al : bf->bf_frmlen;
	rc = rate_table->info[rix].ratecode;

	/* for legacy rates, use old function to compute packet duration */
	if (!IS_HT_RATE(rc))
		return (ath9k_hw_computetxtime(sc->sc_ah, rate_table, pktlen,
		    rix, shortPreamble));

	/* find number of symbols: PLCP + data */
	nbits = (pktlen << 3) + OFDM_PLCP_BITS;
	nsymbits = bits_per_symbol[HT_RC_2_MCS(rc)][width];
	nsymbols = (nbits + nsymbits - 1) / nsymbits;

	if (!half_gi)
		duration = SYMBOL_TIME(nsymbols);
	else
		duration = SYMBOL_TIME_HALFGI(nsymbols);

	/* addup duration for legacy/ht training and signal fields */
	streams = HT_RC_2_STREAMS(rc);
	duration += L_STF + L_LTF + L_SIG + HT_SIG + HT_STF + HT_LTF(streams);

	return (duration);
}

/* Rate module function to set rate related fields in tx descriptor */
static void
ath_buf_set_rate(struct arn_softc *sc,
    struct ath_buf *bf,
    struct ieee80211_frame *wh)
{
	struct ath_hal *ah = sc->sc_ah;
	struct ath_rate_table *rt;
	struct ath_desc *ds = bf->bf_desc;
	struct ath_desc *lastds = bf->bf_desc; /* temp workground */
	struct ath9k_11n_rate_series series[4];
	struct ath9k_tx_rate *rates;
	int i, flags, rtsctsena = 0;
	uint32_t ctsduration = 0;
	uint8_t rix = 0, cix, ctsrate = 0;

	(void) memset(series, 0, sizeof (struct ath9k_11n_rate_series) * 4);

	rates = bf->rates;

	if (IEEE80211_HAS_MOREFRAGS(wh) ||
	    wh->i_seq[0] & IEEE80211_SEQ_FRAG_MASK) {
		rates[1].count = rates[2].count = rates[3].count = 0;
		rates[1].idx = rates[2].idx = rates[3].idx = 0;
		rates[0].count = ATH_TXMAXTRY;
	}

	/* get the cix for the lowest valid rix */
	rt = sc->sc_currates;
	for (i = 3; i >= 0; i--) {
		if (rates[i].count && (rates[i].idx >= 0)) {
			rix = rates[i].idx;
			break;
		}
	}

	flags = (bf->bf_flags & (ATH9K_TXDESC_RTSENA | ATH9K_TXDESC_CTSENA));
	cix = rt->info[rix].ctrl_rate;

	/*
	 * If 802.11g protection is enabled, determine whether to use RTS/CTS or
	 * just CTS.  Note that this is only done for OFDM/HT unicast frames.
	 */
	if (sc->sc_protmode != PROT_M_NONE &&
	    !(bf->bf_flags & ATH9K_TXDESC_NOACK) &&
	    (rt->info[rix].phy == WLAN_RC_PHY_OFDM ||
	    WLAN_RC_PHY_HT(rt->info[rix].phy))) {
		if (sc->sc_protmode == PROT_M_RTSCTS)
			flags = ATH9K_TXDESC_RTSENA;
		else if (sc->sc_protmode == PROT_M_CTSONLY)
			flags = ATH9K_TXDESC_CTSENA;

		cix = rt->info[sc->sc_protrix].ctrl_rate;
		rtsctsena = 1;
	}

	/*
	 * For 11n, the default behavior is to enable RTS for hw retried frames.
	 * We enable the global flag here and let rate series flags determine
	 * which rates will actually use RTS.
	 */
	if ((ah->ah_caps.hw_caps & ATH9K_HW_CAP_HT) && bf_isdata(bf)) {
		/* 802.11g protection not needed, use our default behavior */
		if (!rtsctsena)
			flags = ATH9K_TXDESC_RTSENA;
	}

	/* Set protection if aggregate protection on */
	if (sc->sc_config.ath_aggr_prot &&
	    (!bf_isaggr(bf) || (bf_isaggr(bf) && bf->bf_al < 8192))) {
		flags = ATH9K_TXDESC_RTSENA;
		cix = rt->info[sc->sc_protrix].ctrl_rate;
		rtsctsena = 1;
	}

	/* For AR5416 - RTS cannot be followed by a frame larger than 8K */
	if (bf_isaggr(bf) && (bf->bf_al > ah->ah_caps.rts_aggr_limit))
		flags &= ~(ATH9K_TXDESC_RTSENA);

	/*
	 * CTS transmit rate is derived from the transmit rate by looking in the
	 * h/w rate table.  We must also factor in whether or not a short
	 * preamble is to be used. NB: cix is set above where RTS/CTS is enabled
	 */
	ctsrate = rt->info[cix].ratecode |
	    (bf_isshpreamble(bf) ? rt->info[cix].short_preamble : 0);

	for (i = 0; i < 4; i++) {
		if (!rates[i].count || (rates[i].idx < 0))
			continue;

		rix = rates[i].idx;

		series[i].Rate = rt->info[rix].ratecode |
		    (bf_isshpreamble(bf) ?
		    rt->info[rix].short_preamble : 0);

		series[i].Tries = rates[i].count;

		series[i].RateFlags =
		    ((rates[i].flags & ATH9K_TX_RC_USE_RTS_CTS) ?
		    ATH9K_RATESERIES_RTS_CTS : 0) |
		    ((rates[i].flags & ATH9K_TX_RC_40_MHZ_WIDTH) ?
		    ATH9K_RATESERIES_2040 : 0) |
		    ((rates[i].flags & ATH9K_TX_RC_SHORT_GI) ?
		    ATH9K_RATESERIES_HALFGI : 0);

		series[i].PktDuration = ath_pkt_duration(sc, rix, bf,
		    (rates[i].flags & ATH9K_TX_RC_40_MHZ_WIDTH) != 0,
		    (rates[i].flags & ATH9K_TX_RC_SHORT_GI),
		    bf_isshpreamble(bf));

		series[i].ChSel = sc->sc_tx_chainmask;

		if (rtsctsena)
			series[i].RateFlags |= ATH9K_RATESERIES_RTS_CTS;

		ARN_DBG((ARN_DBG_RATE,
		    "series[%d]--flags & ATH9K_TX_RC_USE_RTS_CTS = %08x"
		    "--flags & ATH9K_TX_RC_40_MHZ_WIDTH = %08x"
		    "--flags & ATH9K_TX_RC_SHORT_GI = %08x\n",
		    rates[i].flags & ATH9K_TX_RC_USE_RTS_CTS,
		    rates[i].flags & ATH9K_TX_RC_40_MHZ_WIDTH,
		    rates[i].flags & ATH9K_TX_RC_SHORT_GI));

		ARN_DBG((ARN_DBG_RATE,
		    "series[%d]:"
		    "dot11rate:%d"
		    "index:%d"
		    "retry count:%d\n",
		    i,
		    (rt->info[rates[i].idx].ratekbps)/1000,
		    rates[i].idx,
		    rates[i].count));
	}

	/* set dur_update_en for l-sig computation except for PS-Poll frames */
	ath9k_hw_set11n_ratescenario(ah, ds, lastds, !bf_ispspoll(bf),
	    ctsrate, ctsduration,
	    series, 4, flags);

	if (sc->sc_config.ath_aggr_prot && flags)
		ath9k_hw_set11n_burstduration(ah, ds, 8192);
}

static void
ath_tx_complete(struct arn_softc *sc, struct ath_buf *bf,
    struct ath_xmit_status *tx_status)
{
	boolean_t is_data = bf_isdata(bf);

	ARN_DBG((ARN_DBG_XMIT, "TX complete\n"));

	if (tx_status->flags & ATH_TX_BAR)
		tx_status->flags &= ~ATH_TX_BAR;

	bf->rates[0].count = tx_status->retries + 1;

	arn_tx_status(sc, bf, is_data);
}

/* To complete a chain of buffers associated a frame */
static void
ath_tx_complete_buf(struct arn_softc *sc, struct ath_buf *bf,
    int txok, int sendbar)
{
	struct ath_xmit_status tx_status;

	/*
	 * Set retry information.
	 * NB: Don't use the information in the descriptor, because the frame
	 * could be software retried.
	 */
	tx_status.retries = bf->bf_retries;
	tx_status.flags = 0;

	if (sendbar)
		tx_status.flags = ATH_TX_BAR;

	if (!txok) {
		tx_status.flags |= ATH_TX_ERROR;

		if (bf_isxretried(bf))
			tx_status.flags |= ATH_TX_XRETRY;
	}

	/* complete this frame */
	ath_tx_complete(sc, bf, &tx_status);

	/*
	 * Return the list of ath_buf of this mpdu to free queue
	 */
}

static void
arn_tx_stopdma(struct arn_softc *sc, struct ath_txq *txq)
{
	struct ath_hal *ah = sc->sc_ah;

	(void) ath9k_hw_stoptxdma(ah, txq->axq_qnum);

	ARN_DBG((ARN_DBG_XMIT, "arn: arn_drain_txdataq(): "
	    "tx queue [%u] %x, link %p\n",
	    txq->axq_qnum,
	    ath9k_hw_gettxbuf(ah, txq->axq_qnum), txq->axq_link));

}

/* Drain only the data queues */
/* ARGSUSED */
static void
arn_drain_txdataq(struct arn_softc *sc, boolean_t retry_tx)
{
	struct ath_hal *ah = sc->sc_ah;
	int i, status, npend = 0;

	if (!(sc->sc_flags & SC_OP_INVALID)) {
		for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
			if (ARN_TXQ_SETUP(sc, i)) {
				arn_tx_stopdma(sc, &sc->sc_txq[i]);
				/*
				 * The TxDMA may not really be stopped.
				 * Double check the hal tx pending count
				 */
				npend += ath9k_hw_numtxpending(ah,
				    sc->sc_txq[i].axq_qnum);
			}
		}
	}

	if (npend) {
		/* TxDMA not stopped, reset the hal */
		ARN_DBG((ARN_DBG_XMIT, "arn: arn_drain_txdataq(): "
		    "Unable to stop TxDMA. Reset HAL!\n"));

		if (!ath9k_hw_reset(ah,
		    sc->sc_ah->ah_curchan,
		    sc->tx_chan_width,
		    sc->sc_tx_chainmask, sc->sc_rx_chainmask,
		    sc->sc_ht_extprotspacing, B_TRUE, &status)) {
			ARN_DBG((ARN_DBG_FATAL, "arn: arn_drain_txdataq(): "
			    "unable to reset hardware; hal status %u\n",
			    status));
		}
	}

	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
		if (ARN_TXQ_SETUP(sc, i))
			arn_tx_draintxq(sc, &sc->sc_txq[i]);
	}
}

/* Setup a h/w transmit queue */
struct ath_txq *
arn_txq_setup(struct arn_softc *sc, int qtype, int subtype)
{
	struct ath_hal *ah = sc->sc_ah;
	struct ath9k_tx_queue_info qi;
	int qnum;

	(void) memset(&qi, 0, sizeof (qi));
	qi.tqi_subtype = subtype;
	qi.tqi_aifs = ATH9K_TXQ_USEDEFAULT;
	qi.tqi_cwmin = ATH9K_TXQ_USEDEFAULT;
	qi.tqi_cwmax = ATH9K_TXQ_USEDEFAULT;
	qi.tqi_physCompBuf = 0;

	/*
	 * Enable interrupts only for EOL and DESC conditions.
	 * We mark tx descriptors to receive a DESC interrupt
	 * when a tx queue gets deep; otherwise waiting for the
	 * EOL to reap descriptors.  Note that this is done to
	 * reduce interrupt load and this only defers reaping
	 * descriptors, never transmitting frames.  Aside from
	 * reducing interrupts this also permits more concurrency.
	 * The only potential downside is if the tx queue backs
	 * up in which case the top half of the kernel may backup
	 * due to a lack of tx descriptors.
	 *
	 * The UAPSD queue is an exception, since we take a desc-
	 * based intr on the EOSP frames.
	 */
	if (qtype == ATH9K_TX_QUEUE_UAPSD)
		qi.tqi_qflags = TXQ_FLAG_TXDESCINT_ENABLE;
	else
		qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE |
		    TXQ_FLAG_TXDESCINT_ENABLE;
	qnum = ath9k_hw_setuptxqueue(ah, qtype, &qi);
	if (qnum == -1) {
		/*
		 * NB: don't print a message, this happens
		 * normally on parts with too few tx queues
		 */
		return (NULL);
	}
	if (qnum >= ARRAY_SIZE(sc->sc_txq)) {
		ARN_DBG((ARN_DBG_FATAL, "arn: arn_txq_setup(): "
		    "hal qnum %u out of range, max %u!\n",
		    qnum, (unsigned int)ARRAY_SIZE(sc->sc_txq)));
		(void) ath9k_hw_releasetxqueue(ah, qnum);
		return (NULL);
	}
	if (!ARN_TXQ_SETUP(sc, qnum)) {
		struct ath_txq *txq = &sc->sc_txq[qnum];

		txq->axq_qnum = qnum;
		txq->axq_intrcnt = 0; /* legacy */
		txq->axq_link = NULL;

		list_create(&txq->axq_list, sizeof (struct ath_buf),
		    offsetof(struct ath_buf, bf_node));
		list_create(&txq->axq_acq, sizeof (struct ath_buf),
		    offsetof(struct ath_buf, bf_node));
		mutex_init(&txq->axq_lock, NULL, MUTEX_DRIVER, NULL);

		txq->axq_depth = 0;
		txq->axq_aggr_depth = 0;
		txq->axq_totalqueued = 0;
		txq->axq_linkbuf = NULL;
		sc->sc_txqsetup |= 1<<qnum;
	}
	return (&sc->sc_txq[qnum]);
}

/* Reclaim resources for a setup queue */

void
arn_tx_cleanupq(struct arn_softc *sc, struct ath_txq *txq)
{
	(void) ath9k_hw_releasetxqueue(sc->sc_ah, txq->axq_qnum);
	sc->sc_txqsetup &= ~(1<<txq->axq_qnum);
}

/*
 * Setup a hardware data transmit queue for the specified
 * access control.  The hal may not support all requested
 * queues in which case it will return a reference to a
 * previously setup queue.  We record the mapping from ac's
 * to h/w queues for use by arn_tx_start and also track
 * the set of h/w queues being used to optimize work in the
 * transmit interrupt handler and related routines.
 */

int
arn_tx_setup(struct arn_softc *sc, int haltype)
{
	struct ath_txq *txq;

	if (haltype >= ARRAY_SIZE(sc->sc_haltype2q)) {
		ARN_DBG((ARN_DBG_FATAL, "arn: arn_tx_setup(): "
		    "HAL AC %u out of range, max %zu!\n",
		    haltype, ARRAY_SIZE(sc->sc_haltype2q)));
		return (0);
	}
	txq = arn_txq_setup(sc, ATH9K_TX_QUEUE_DATA, haltype);
	if (txq != NULL) {
		sc->sc_haltype2q[haltype] = txq->axq_qnum;
		return (1);
	} else
		return (0);
}

void
arn_tx_draintxq(struct arn_softc *sc, struct ath_txq *txq)
{
	struct ath_buf *bf;

	/*
	 * This assumes output has been stopped.
	 */
	for (;;) {
		mutex_enter(&txq->axq_lock);
		bf = list_head(&txq->axq_list);
		if (bf == NULL) {
			txq->axq_link = NULL;
			mutex_exit(&txq->axq_lock);
			break;
		}
		list_remove(&txq->axq_list, bf);
		mutex_exit(&txq->axq_lock);
		bf->bf_in = NULL;
		mutex_enter(&sc->sc_txbuflock);
		list_insert_tail(&sc->sc_txbuf_list, bf);
		mutex_exit(&sc->sc_txbuflock);
	}
}

/* Drain the transmit queues and reclaim resources */

void
arn_draintxq(struct arn_softc *sc, boolean_t retry_tx)
{
	/*
	 * stop beacon queue. The beacon will be freed when
	 * we go to INIT state
	 */
	if (!(sc->sc_flags & SC_OP_INVALID)) {
		(void) ath9k_hw_stoptxdma(sc->sc_ah, sc->sc_beaconq);
		ARN_DBG((ARN_DBG_XMIT, "arn: arn_draintxq(): "
		    "beacon queue %x\n",
		    ath9k_hw_gettxbuf(sc->sc_ah, sc->sc_beaconq)));
	}

	arn_drain_txdataq(sc, retry_tx);
}

uint32_t
arn_txq_depth(struct arn_softc *sc, int qnum)
{
	return (sc->sc_txq[qnum].axq_depth);
}

uint32_t
arn_txq_aggr_depth(struct arn_softc *sc, int qnum)
{
	return (sc->sc_txq[qnum].axq_aggr_depth);
}

/* Update parameters for a transmit queue */
int
arn_txq_update(struct arn_softc *sc, int qnum,
    struct ath9k_tx_queue_info *qinfo)
{
	struct ath_hal *ah = sc->sc_ah;
	int error = 0;
	struct ath9k_tx_queue_info qi;

	if (qnum == sc->sc_beaconq) {
		/*
		 * XXX: for beacon queue, we just save the parameter.
		 * It will be picked up by arn_beaconq_config() when
		 * it's necessary.
		 */
		sc->sc_beacon_qi = *qinfo;
		return (0);
	}

	ASSERT(sc->sc_txq[qnum].axq_qnum == qnum);

	(void) ath9k_hw_get_txq_props(ah, qnum, &qi);
	qi.tqi_aifs = qinfo->tqi_aifs;
	qi.tqi_cwmin = qinfo->tqi_cwmin;
	qi.tqi_cwmax = qinfo->tqi_cwmax;
	qi.tqi_burstTime = qinfo->tqi_burstTime;
	qi.tqi_readyTime = qinfo->tqi_readyTime;

	if (!ath9k_hw_set_txq_props(ah, qnum, &qi)) {
		ARN_DBG((ARN_DBG_FATAL,
		    "Unable to update hardware queue %u!\n", qnum));
		error = -EIO;
	} else {
		(void) ath9k_hw_resettxqueue(ah, qnum); /* push to h/w */
	}

	return (error);
}

int
ath_cabq_update(struct arn_softc *sc)
{
	struct ath9k_tx_queue_info qi;
	int qnum = sc->sc_cabq->axq_qnum;
	struct ath_beacon_config conf;

	(void) ath9k_hw_get_txq_props(sc->sc_ah, qnum, &qi);
	/*
	 * Ensure the readytime % is within the bounds.
	 */
	if (sc->sc_config.cabqReadytime < ATH9K_READY_TIME_LO_BOUND)
		sc->sc_config.cabqReadytime = ATH9K_READY_TIME_LO_BOUND;
	else if (sc->sc_config.cabqReadytime > ATH9K_READY_TIME_HI_BOUND)
		sc->sc_config.cabqReadytime = ATH9K_READY_TIME_HI_BOUND;

	arn_get_beaconconfig(sc, &conf);
	qi.tqi_readyTime =
	    (conf.beacon_interval * sc->sc_config.cabqReadytime) / 100;
	(void) arn_txq_update(sc, qnum, &qi);

	return (0);
}

static uint32_t
arn_tx_get_keytype(const struct ieee80211_cipher *cip)
{
	uint32_t index;
	static const uint8_t ciphermap[] = {
	    ATH9K_CIPHER_WEP,		/* IEEE80211_CIPHER_WEP */
	    ATH9K_CIPHER_TKIP,		/* IEEE80211_CIPHER_TKIP */
	    ATH9K_CIPHER_AES_OCB,	/* IEEE80211_CIPHER_AES_OCB */
	    ATH9K_CIPHER_AES_CCM,	/* IEEE80211_CIPHER_AES_CCM */
	    ATH9K_CIPHER_CKIP,		/* IEEE80211_CIPHER_CKIP */
	    ATH9K_CIPHER_CLR,		/* IEEE80211_CIPHER_NONE */
	};

	ASSERT(cip->ic_cipher < ARRAY_SIZE(ciphermap));
	index = cip->ic_cipher;

	if (ciphermap[index] == ATH9K_CIPHER_WEP)
		return (ATH9K_KEY_TYPE_WEP);
	else if (ciphermap[index] == ATH9K_CIPHER_TKIP)
		return (ATH9K_KEY_TYPE_TKIP);
	else if (ciphermap[index] == ATH9K_CIPHER_AES_CCM)
		return (ATH9K_KEY_TYPE_AES);

	return (ATH9K_KEY_TYPE_CLEAR);

}

/* Display buffer */
void
arn_dump_line(unsigned char *p, uint32_t len, boolean_t isaddress,
    uint32_t group)
{
	char *pnumeric = "0123456789ABCDEF";
	char hex[((2 + 1) * 16) + 1];
	char *phex = hex;
	char ascii[16 + 1];
	char *pascii = ascii;
	uint32_t grouped = 0;

	if (isaddress) {
		arn_problem("arn: %08x: ", p);
	} else {
		arn_problem("arn: ");
	}

	while (len) {
		*phex++ = pnumeric[((uint8_t)*p) / 16];
		*phex++ = pnumeric[((uint8_t)*p) % 16];
		if (++grouped >= group) {
			*phex++ = ' ';
			grouped = 0;
		}

		*pascii++ = (*p >= 32 && *p < 128) ? *p : '.';

		++p;
		--len;
	}

	*phex = '\0';
	*pascii = '\0';

	arn_problem("%-*s|%-*s|\n", (2 * 16) +
	    (16 / group), hex, 16, ascii);
}

void
arn_dump_pkg(unsigned char *p, uint32_t len, boolean_t isaddress,
    uint32_t group)
{
	uint32_t perline;
	while (len) {
		perline = (len < 16) ? len : 16;
		arn_dump_line(p, perline, isaddress, group);
		len -= perline;
		p += perline;
	}
}

/*
 * The input parameter mp has following assumption:
 * For data packets, GLDv3 mac_wifi plugin allocates and fills the
 * ieee80211 header. For management packets, net80211 allocates and
 * fills the ieee80211 header. In both cases, enough spaces in the
 * header are left for encryption option.
 */
static int32_t
arn_tx_start(struct arn_softc *sc, struct ieee80211_node *in,
    struct ath_buf *bf, mblk_t *mp)
{
	ieee80211com_t *ic = (ieee80211com_t *)sc;
	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
	struct ath_hal *ah = sc->sc_ah;
	struct ath_node *an;
	struct ath_desc *ds;
	struct ath_txq *txq;
	struct ath_rate_table *rt;
	enum ath9k_pkt_type atype;
	boolean_t shortPreamble, is_padding = B_FALSE;
	uint32_t subtype, keytype = ATH9K_KEY_TYPE_CLEAR;
	int32_t keyix, iswep, hdrlen, pktlen, mblen, mbslen;
	caddr_t dest;

	/*
	 * CRC are added by H/W, not encaped by driver,
	 * but we must count it in pkt length.
	 */
	pktlen = IEEE80211_CRC_LEN;
	iswep = wh->i_fc[1] & IEEE80211_FC1_WEP;
	keyix = ATH9K_TXKEYIX_INVALID;
	hdrlen = ieee80211_hdrspace(ic, mp->b_rptr);
	if (hdrlen == 28)
		is_padding = B_TRUE;

	if (iswep != 0) {
		const struct ieee80211_cipher *cip;
		struct ieee80211_key *k;

		/*
		 * Construct the 802.11 header+trailer for an encrypted
		 * frame. The only reason this can fail is because of an
		 * unknown or unsupported cipher/key type.
		 */
		k = ieee80211_crypto_encap(ic, mp);
		if (k == NULL) {
			ARN_DBG((ARN_DBG_XMIT, "arn: arn_tx_start "
			    "crypto_encap failed\n"));
			/*
			 * This can happen when the key is yanked after the
			 * frame was queued.  Just discard the frame; the
			 * 802.11 layer counts failures and provides
			 * debugging/diagnostics.
			 */
			return (EIO);
		}
		cip = k->wk_cipher;

		keytype = arn_tx_get_keytype(cip);

		/*
		 * Adjust the packet + header lengths for the crypto
		 * additions and calculate the h/w key index.  When
		 * a s/w mic is done the frame will have had any mic
		 * added to it prior to entry so m0->m_pkthdr.len above will
		 * account for it. Otherwise we need to add it to the
		 * packet length.
		 */
		hdrlen += cip->ic_header;
		pktlen += cip->ic_trailer;
		if ((k->wk_flags & IEEE80211_KEY_SWMIC) == 0)
			pktlen += cip->ic_miclen;

		keyix = k->wk_keyix;

		/* packet header may have moved, reset our local pointer */
		wh = (struct ieee80211_frame *)mp->b_rptr;
	}

	dest = bf->bf_dma.mem_va;
	for (; mp != NULL; mp = mp->b_cont) {
		mblen = MBLKL(mp);
		bcopy(mp->b_rptr, dest, mblen);
		dest += mblen;
	}
	mbslen = (uintptr_t)dest - (uintptr_t)bf->bf_dma.mem_va;
	pktlen += mbslen;
	if (is_padding && (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
	    IEEE80211_FC0_TYPE_DATA)
		pktlen -= 2; /* real pkg len */

	/* buf setup */
	ath_tx_setup_buffer(sc, bf, in, wh, pktlen, keytype);

	/* setup descriptors */
	ds = bf->bf_desc;
	rt = sc->sc_currates;
	ASSERT(rt != NULL);

	arn_get_rate(sc, bf, wh);
	an = (struct ath_node *)(in);

	/*
	 * Calculate Atheros packet type from IEEE80211 packet header
	 * and setup for rate calculations.
	 */
	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
	case IEEE80211_FC0_TYPE_MGT:
		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
			atype = ATH9K_PKT_TYPE_BEACON;
		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
			atype = ATH9K_PKT_TYPE_PROBE_RESP;
		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
			atype = ATH9K_PKT_TYPE_ATIM;
		else
			atype = ATH9K_PKT_TYPE_NORMAL;

		/* force all ctl frames to highest queue */
		txq = &sc->sc_txq[arn_get_hal_qnum(WME_AC_VO, sc)];
		break;
	case IEEE80211_FC0_TYPE_CTL:
		atype = ATH9K_PKT_TYPE_PSPOLL;
		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

		/* force all ctl frames to highest queue */
		txq = &sc->sc_txq[arn_get_hal_qnum(WME_AC_VO, sc)];
		break;
	case IEEE80211_FC0_TYPE_DATA:
		// arn_dump_pkg((unsigned char *)bf->bf_dma.mem_va,
		//    pktlen, 1, 1);
		atype = ATH9K_PKT_TYPE_NORMAL;

		/* Always use background queue */
		txq = &sc->sc_txq[arn_get_hal_qnum(WME_AC_BE, sc)];
		break;
	default:
		/* Unknown 802.11 frame */
		sc->sc_stats.ast_tx_invalid++;
		return (1);
	}

	/* setup descriptor */
	ds->ds_link = 0;
	ds->ds_data = bf->bf_dma.cookie.dmac_address;

	/*
	 * Formulate first tx descriptor with tx controls.
	 */
	ath9k_hw_set11n_txdesc(ah, ds,
	    (pktlen), /* packet length */
	    atype, /* Atheros packet type */
	    MAX_RATE_POWER /* MAX_RATE_POWER */,
	    keyix /* ATH9K_TXKEYIX_INVALID */,
	    keytype /* ATH9K_KEY_TYPE_CLEAR */,
	    bf->bf_flags /* flags */);

	/* LINTED E_BAD_PTR_CAST_ALIGN */
	ARN_DBG((ARN_DBG_XMIT, "arn: arn_tx_start(): to %s totlen=%d "
	    "an->an_tx_rate1sp=%d tx_rate2sp=%d tx_rate3sp=%d "
	    "qnum=%d sht=%d dur = %d\n",
	    ieee80211_macaddr_sprintf(wh->i_addr1), mbslen, an->an_tx_rate1sp,
	    an->an_tx_rate2sp, an->an_tx_rate3sp,
	    txq->axq_qnum, shortPreamble, *(uint16_t *)wh->i_dur));

	(void) ath9k_hw_filltxdesc(ah, ds,
	    mbslen,		/* segment length */
	    B_TRUE,		/* first segment */
	    B_TRUE,		/* last segment */
	    ds);		/* first descriptor */

	/* set rate related fields in tx descriptor */
	ath_buf_set_rate(sc, bf, wh);

	ARN_DMA_SYNC(bf->bf_dma, DDI_DMA_SYNC_FORDEV);

	mutex_enter(&txq->axq_lock);
	list_insert_tail(&txq->axq_list, bf);
	if (txq->axq_link == NULL) {
		(void) ath9k_hw_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
	} else {
		*txq->axq_link = bf->bf_daddr;
	}
	txq->axq_link = &ds->ds_link;
	mutex_exit(&txq->axq_lock);

	// arn_dump_pkg((unsigned char *)bf->bf_dma.mem_va, pktlen, 1, 1);

	(void) ath9k_hw_txstart(ah, txq->axq_qnum);

	ic->ic_stats.is_tx_frags++;
	ic->ic_stats.is_tx_bytes += pktlen;

	return (0);
}

/*
 * Transmit a management frame.
 * Note that management frames come directly from the 802.11 layer
 * and do not honor the send queue flow control.
 */
/* Upon failure caller should free mp */
int
arn_tx(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
{
	struct arn_softc *sc = (struct arn_softc *)ic;
	struct ath_hal *ah = sc->sc_ah;
	struct ieee80211_node *in = NULL;
	struct ath_buf *bf = NULL;
	struct ieee80211_frame *wh;
	int error = 0;

	ASSERT(mp->b_next == NULL);
	/* should check later */
	if (sc->sc_flags & SC_OP_INVALID) {
		if ((type & IEEE80211_FC0_TYPE_MASK) !=
		    IEEE80211_FC0_TYPE_DATA) {
			freemsg(mp);
		}
		return (ENXIO);
	}

	/* Grab a TX buffer */
	bf = arn_tx_get_buffer(sc);
	if (bf == NULL) {
		ARN_DBG((ARN_DBG_XMIT, "arn: arn_tx(): discard, "
		    "no xmit buf\n"));
		ic->ic_stats.is_tx_nobuf++;
		if ((type & IEEE80211_FC0_TYPE_MASK) ==
		    IEEE80211_FC0_TYPE_DATA) {
			sc->sc_stats.ast_tx_nobuf++;
			mutex_enter(&sc->sc_resched_lock);
			sc->sc_resched_needed = B_TRUE;
			mutex_exit(&sc->sc_resched_lock);
		} else {
			sc->sc_stats.ast_tx_nobufmgt++;
			freemsg(mp);
		}
		return (ENOMEM);
	}

	wh = (struct ieee80211_frame *)mp->b_rptr;

	/* Locate node */
	in = ieee80211_find_txnode(ic,  wh->i_addr1);
	if (in == NULL) {
		error = EIO;
		goto bad;
	}

	in->in_inact = 0;
	switch (type & IEEE80211_FC0_TYPE_MASK) {
	case IEEE80211_FC0_TYPE_DATA:
		(void) ieee80211_encap(ic, mp, in);
		break;
	default:
		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
		    IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
			/* fill time stamp */
			uint64_t tsf;
			uint32_t *tstamp;

			tsf = ath9k_hw_gettsf64(ah);
			/* adjust 100us delay to xmit */
			tsf += 100;
			/* LINTED E_BAD_PTR_CAST_ALIGN */
			tstamp = (uint32_t *)&wh[1];
			tstamp[0] = LE_32(tsf & 0xffffffff);
			tstamp[1] = LE_32(tsf >> 32);
		}
		sc->sc_stats.ast_tx_mgmt++;
		break;
	}

	error = arn_tx_start(sc, in, bf, mp);

	if (error != 0) {
bad:
		ic->ic_stats.is_tx_failed++;
		if (bf != NULL) {
			mutex_enter(&sc->sc_txbuflock);
			list_insert_tail(&sc->sc_txbuf_list, bf);
			mutex_exit(&sc->sc_txbuflock);
		}
	}
	if (in != NULL)
		ieee80211_free_node(in);
	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
	    error == 0) {
		freemsg(mp);
	}

	return (error);
}

static void
arn_printtxbuf(struct ath_buf *bf, int done)
{
	struct ath_desc *ds = bf->bf_desc;
	const struct ath_tx_status *ts = &ds->ds_txstat;

	ARN_DBG((ARN_DBG_XMIT, "arn: T(%p %p) %08x %08x %08x %08x %08x"
	    " %08x %08x %08x %c\n",
	    ds, bf->bf_daddr,
	    ds->ds_link, ds->ds_data,
	    ds->ds_ctl0, ds->ds_ctl1,
	    ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
	    !done ? ' ' : (ts->ts_status == 0) ? '*' : '!'));
}

/* ARGSUSED */
static void
ath_tx_rc_status(struct ath_buf *bf,
    struct ath_desc *ds,
    int nbad,
    int txok,
    boolean_t update_rc)
{
	struct ath_tx_info_priv *tx_info_priv =
	    (struct ath_tx_info_priv *)&bf->tx_info_priv;

	tx_info_priv->update_rc = B_FALSE;

	if ((ds->ds_txstat.ts_status & ATH9K_TXERR_FILT) == 0 &&
	    (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0) {
		if (bf_isdata(bf)) {
			(void) memcpy(&tx_info_priv->tx, &ds->ds_txstat,
			    sizeof (tx_info_priv->tx));
			tx_info_priv->n_frames = bf->bf_nframes;
			tx_info_priv->n_bad_frames = nbad;
			tx_info_priv->update_rc = B_TRUE;
		}
	}
}

/* Process completed xmit descriptors from the specified queue */
static int
arn_tx_processq(struct arn_softc *sc, struct ath_txq *txq)
{
	ieee80211com_t *ic = (ieee80211com_t *)sc;
	struct ath_hal *ah = sc->sc_ah;
	struct ath_buf *bf;
	struct ath_desc *ds;
	struct ieee80211_node *in;
	struct ath_tx_status *ts;
	struct ath_node *an;
	int32_t sr, lr, nacked = 0;
	int txok, nbad = 0;
	int status;

	for (;;) {
		mutex_enter(&txq->axq_lock);
		bf = list_head(&txq->axq_list);
		if (bf == NULL) {
			txq->axq_link = NULL;
			/* txq->axq_linkbuf = NULL; */
			mutex_exit(&txq->axq_lock);
			break;
		}
		ds = bf->bf_desc;	/* last decriptor */
		ts = &ds->ds_txstat;
		status = ath9k_hw_txprocdesc(ah, ds);

#ifdef DEBUG
		arn_printtxbuf(bf, status == 0);
#endif

		if (status == EINPROGRESS) {
			mutex_exit(&txq->axq_lock);
			break;
		}
		list_remove(&txq->axq_list, bf);
		mutex_exit(&txq->axq_lock);
		in = bf->bf_in;
		if (in != NULL) {
			an = ATH_NODE(in);
			/* Successful transmition */
			if (ts->ts_status == 0) {
				an->an_tx_ok++;
				an->an_tx_antenna = ts->ts_antenna;
				sc->sc_stats.ast_tx_rssidelta =
				    ts->ts_rssi - sc->sc_stats.ast_tx_rssi;
				sc->sc_stats.ast_tx_rssi = ts->ts_rssi;
			} else {
				an->an_tx_err++;
				if (ts->ts_status & ATH9K_TXERR_XRETRY) {
					sc->sc_stats.ast_tx_xretries++;
				}
				if (ts->ts_status & ATH9K_TXERR_FIFO) {
					sc->sc_stats.ast_tx_fifoerr++;
				}
				if (ts->ts_status & ATH9K_TXERR_FILT) {
					sc->sc_stats.ast_tx_filtered++;
				}
				an->an_tx_antenna = 0;	/* invalidate */
			}
			sr = ts->ts_shortretry;
			lr = ts->ts_longretry;
			sc->sc_stats.ast_tx_shortretry += sr;
			sc->sc_stats.ast_tx_longretry += lr;
			/*
			 * Hand the descriptor to the rate control algorithm.
			 */
			if ((ts->ts_status & ATH9K_TXERR_FILT) == 0 &&
			    (bf->bf_flags & ATH9K_TXDESC_NOACK) == 0) {
				/*
				 * If frame was ack'd update the last rx time
				 * used to workaround phantom bmiss interrupts.
				 */
				if (ts->ts_status == 0) {
					nacked++;
					an->an_tx_ok++;
				} else {
					an->an_tx_err++;
				}
				an->an_tx_retr += sr + lr;
			}
		}

		txok = (ds->ds_txstat.ts_status == 0);
		if (!bf_isampdu(bf)) {
			/*
			 * This frame is sent out as a single frame.
			 * Use hardware retry status for this frame.
			 */
			bf->bf_retries = ds->ds_txstat.ts_longretry;
			if (ds->ds_txstat.ts_status & ATH9K_TXERR_XRETRY)
				bf->bf_state.bf_type |= BUF_XRETRY;
			nbad = 0;
		}
		ath_tx_rc_status(bf, ds, nbad, B_TRUE, txok);

		ath_tx_complete_buf(sc, bf, txok, 0);

		// arn_dump_pkg((unsigned char *)bf->bf_dma.mem_va,
		//    bf->bf_frmlen, 1, 1);

		bf->bf_in = NULL;
		mutex_enter(&sc->sc_txbuflock);
		list_insert_tail(&sc->sc_txbuf_list, bf);
		mutex_exit(&sc->sc_txbuflock);

		/*
		 * Reschedule stalled outbound packets
		 */
		mutex_enter(&sc->sc_resched_lock);
		if (sc->sc_resched_needed) {
			sc->sc_resched_needed = B_FALSE;
			mac_tx_update(ic->ic_mach);
		}
		mutex_exit(&sc->sc_resched_lock);
	}

	return (nacked);
}

static void
arn_tx_handler(struct arn_softc *sc)
{
	int i;
	int nacked = 0;
	uint32_t qcumask = ((1 << ATH9K_NUM_TX_QUEUES) - 1);
	ath9k_hw_gettxintrtxqs(sc->sc_ah, &qcumask);

	/*
	 * Process each active queue.
	 */
	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
		if (ARN_TXQ_SETUP(sc, i) && (qcumask & (1 << i))) {
			nacked += arn_tx_processq(sc, &sc->sc_txq[i]);
		}
	}

	if (nacked)
		sc->sc_lastrx = ath9k_hw_gettsf64(sc->sc_ah);
}

/* Deferred processing of transmit interrupt */

void
arn_tx_int_proc(void *arg)
{
	struct arn_softc *sc = arg;
	arn_tx_handler(sc);
}

/* Node init & cleanup functions */

#ifdef ARN_TX_AGGREGATION
void
arn_tx_node_init(struct arn_softc *sc, struct ath_node *an)
{
	struct ath_atx_tid *tid;
	struct ath_atx_ac *ac;
	int tidno, acno;

	for (tidno = 0, tid = &an->tid[tidno]; tidno < WME_NUM_TID;
	    tidno++, tid++) {
		tid->an = an;
		tid->tidno = tidno;
		tid->seq_start = tid->seq_next = 0;
		tid->baw_size  = WME_MAX_BA;
		tid->baw_head  = tid->baw_tail = 0;
		tid->sched = B_FALSE;
		tid->paused = B_FALSE;
		tid->state &= ~AGGR_CLEANUP;
		list_create(&tid->buf_q, sizeof (struct ath_buf),
		    offsetof(struct ath_buf, bf_node));
		acno = TID_TO_WME_AC(tidno);
		tid->ac = &an->ac[acno];
		tid->state &= ~AGGR_ADDBA_COMPLETE;
		tid->state &= ~AGGR_ADDBA_PROGRESS;
		tid->addba_exchangeattempts = 0;
	}

	for (acno = 0, ac = &an->ac[acno]; acno < WME_NUM_AC; acno++, ac++) {
		ac->sched = B_FALSE;
		list_create(&ac->tid_q, sizeof (struct ath_atx_tid),
		    offsetof(struct ath_atx_tid, list));

		switch (acno) {
		case WME_AC_BE:
			ac->qnum = arn_tx_get_qnum(sc,
			    ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BE);
			break;
		case WME_AC_BK:
			ac->qnum = arn_tx_get_qnum(sc,
			    ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_BK);
			break;
		case WME_AC_VI:
			ac->qnum = arn_tx_get_qnum(sc,
			    ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_VI);
			break;
		case WME_AC_VO:
			ac->qnum = arn_tx_get_qnum(sc,
			    ATH9K_TX_QUEUE_DATA, ATH9K_WME_AC_VO);
			break;
		}
	}
}

void
arn_tx_node_cleanup(struct arn_softc *sc, struct ieee80211_node *in)
{
	int i;
	struct ath_atx_ac *ac, *ac_tmp;
	struct ath_atx_tid *tid, *tid_tmp;
	struct ath_txq *txq;
	struct ath_node *an = ATH_NODE(in);

	for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
		if (ARN_TXQ_SETUP(sc, i)) {
			txq = &sc->sc_txq[i];

			mutex_enter(&txq->axq_lock);

			list_for_each_entry_safe(ac, ac_tmp, &txq->axq_acq) {
				tid = list_head(&ac->tid_q);
				if (tid && tid->an != an)
					continue;
				list_remove(&txq->axq_acq, ac);
				ac->sched = B_FALSE;

				list_for_each_entry_safe(tid, tid_tmp,
				    &ac->tid_q) {
					list_remove(&ac->tid_q, tid);
					bf = list_head(&tid->buf_q);
					while (bf != NULL) {
						if (bf->bf_in == in)
							bf->bf_in = NULL;
					}
					bf = list_next(&txq->axq_list, bf);
					tid->sched = B_FALSE;
					arn_tid_drain(sc, txq, tid);
					tid->state &= ~AGGR_ADDBA_COMPLETE;
					tid->addba_exchangeattempts = 0;
					tid->state &= ~AGGR_CLEANUP;
				}
			}

			mutex_exit(&txq->axq_lock);
		}
	}
}
#endif /* ARN_TX_AGGREGATION */