wlan - Update wlan from Adrian / FreeBSD

[dragonfly.git] / sys / dev / netif / ath / ath / if_ath_tx.c

/*-
 * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
 * Copyright (c) 2010-2012 Adrian Chadd, Xenion Pty Ltd
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer,
 *    without modification.
 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
 *    redistribution must be conditioned upon including a substantially
 *    similar Disclaimer requirement for further binary redistribution.
 *
 * NO WARRANTY
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGES.
 */

#include <sys/cdefs.h>

/*
 * Driver for the Atheros Wireless LAN controller.
 *
 * This software is derived from work of Atsushi Onoe; his contribution
 * is greatly appreciated.
 */

#include "opt_inet.h"
#include "opt_ath.h"
#include "opt_wlan.h"

#include <sys/param.h>
#include <sys/systm.h>
#include <sys/sysctl.h>
#include <sys/mbuf.h>
#include <sys/malloc.h>
#include <sys/lock.h>
#include <sys/mutex.h>
#include <sys/kernel.h>
#include <sys/socket.h>
#include <sys/sockio.h>
#include <sys/errno.h>
#include <sys/callout.h>
#include <sys/bus.h>
#include <sys/endian.h>
#include <sys/kthread.h>
#include <sys/taskqueue.h>
#include <sys/priv.h>
#include <sys/ktr.h>

#include <net/if.h>
#include <net/if_var.h>
#include <net/if_dl.h>
#include <net/if_media.h>
#include <net/if_types.h>
#include <net/if_arp.h>
#include <net/ethernet.h>
#include <net/if_llc.h>

#include <netproto/802_11/ieee80211_var.h>
#include <netproto/802_11/ieee80211_regdomain.h>
#ifdef IEEE80211_SUPPORT_SUPERG
#include <netproto/802_11/ieee80211_superg.h>
#endif
#ifdef IEEE80211_SUPPORT_TDMA
#include <netproto/802_11/ieee80211_tdma.h>
#endif
#include <netproto/802_11/ieee80211_ht.h>

#include <net/bpf.h>

#ifdef INET
#include <netinet/in.h>
#include <netinet/if_ether.h>
#endif

#include <dev/netif/ath/ath/if_athvar.h>
#include <dev/netif/ath/ath_hal/ah_devid.h>		/* XXX for softled */
#include <dev/netif/ath/ath_hal/ah_diagcodes.h>

#include <dev/netif/ath/ath/if_ath_debug.h>

#ifdef ATH_TX99_DIAG
#include <dev/netif/ath/ath_tx99/ath_tx99.h>
#endif

#include <dev/netif/ath/ath/if_ath_misc.h>
#include <dev/netif/ath/ath/if_ath_tx.h>
#include <dev/netif/ath/ath/if_ath_tx_ht.h>

#ifdef	ATH_DEBUG_ALQ
#include <dev/netif/ath/ath/if_ath_alq.h>
#endif

extern  const char* ath_hal_ether_sprintf(const uint8_t *mac);

/*
 * How many retries to perform in software
 */
#define	SWMAX_RETRIES		10

/*
 * What queue to throw the non-QoS TID traffic into
 */
#define	ATH_NONQOS_TID_AC	WME_AC_VO

#if 0
static int ath_tx_node_is_asleep(struct ath_softc *sc, struct ath_node *an);
#endif
static int ath_tx_ampdu_pending(struct ath_softc *sc, struct ath_node *an,
    int tid);
static int ath_tx_ampdu_running(struct ath_softc *sc, struct ath_node *an,
    int tid);
static ieee80211_seq ath_tx_tid_seqno_assign(struct ath_softc *sc,
    struct ieee80211_node *ni, struct ath_buf *bf, struct mbuf *m0);
static int ath_tx_action_frame_override_queue(struct ath_softc *sc,
    struct ieee80211_node *ni, struct mbuf *m0, int *tid);
static struct ath_buf *
ath_tx_retry_clone(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, struct ath_buf *bf);

#ifdef	ATH_DEBUG_ALQ
void
ath_tx_alq_post(struct ath_softc *sc, struct ath_buf *bf_first)
{
	struct ath_buf *bf;
	int i, n;
	const char *ds;

	/* XXX we should skip out early if debugging isn't enabled! */
	bf = bf_first;

	while (bf != NULL) {
		/* XXX should ensure bf_nseg > 0! */
		if (bf->bf_nseg == 0)
			break;
		n = ((bf->bf_nseg - 1) / sc->sc_tx_nmaps) + 1;
		for (i = 0, ds = (const char *) bf->bf_desc;
		    i < n;
		    i++, ds += sc->sc_tx_desclen) {
			if_ath_alq_post(&sc->sc_alq,
			    ATH_ALQ_EDMA_TXDESC,
			    sc->sc_tx_desclen,
			    ds);
		}
		bf = bf->bf_next;
	}
}
#endif /* ATH_DEBUG_ALQ */

/*
 * Whether to use the 11n rate scenario functions or not
 */
static inline int
ath_tx_is_11n(struct ath_softc *sc)
{
	return ((sc->sc_ah->ah_magic == 0x20065416) ||
		    (sc->sc_ah->ah_magic == 0x19741014));
}

/*
 * Obtain the current TID from the given frame.
 *
 * Non-QoS frames need to go into TID 16 (IEEE80211_NONQOS_TID.)
 * This has implications for which AC/priority the packet is placed
 * in.
 */
static int
ath_tx_gettid(struct ath_softc *sc, const struct mbuf *m0)
{
	const struct ieee80211_frame *wh;
	int pri = M_WME_GETAC(m0);

	wh = mtod(m0, const struct ieee80211_frame *);
	if (! IEEE80211_QOS_HAS_SEQ(wh))
		return IEEE80211_NONQOS_TID;
	else
		return WME_AC_TO_TID(pri);
}

static void
ath_tx_set_retry(struct ath_softc *sc, struct ath_buf *bf)
{
	struct ieee80211_frame *wh;

	wh = mtod(bf->bf_m, struct ieee80211_frame *);
	/* Only update/resync if needed */
	if (bf->bf_state.bfs_isretried == 0) {
		wh->i_fc[1] |= IEEE80211_FC1_RETRY;
		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
		    BUS_DMASYNC_PREWRITE);
	}
	bf->bf_state.bfs_isretried = 1;
	bf->bf_state.bfs_retries ++;
}

/*
 * Determine what the correct AC queue for the given frame
 * should be.
 *
 * This code assumes that the TIDs map consistently to
 * the underlying hardware (or software) ath_txq.
 * Since the sender may try to set an AC which is
 * arbitrary, non-QoS TIDs may end up being put on
 * completely different ACs. There's no way to put a
 * TID into multiple ath_txq's for scheduling, so
 * for now we override the AC/TXQ selection and set
 * non-QOS TID frames into the BE queue.
 *
 * This may be completely incorrect - specifically,
 * some management frames may end up out of order
 * compared to the QoS traffic they're controlling.
 * I'll look into this later.
 */
static int
ath_tx_getac(struct ath_softc *sc, const struct mbuf *m0)
{
	const struct ieee80211_frame *wh;
	int pri = M_WME_GETAC(m0);
	wh = mtod(m0, const struct ieee80211_frame *);
	if (IEEE80211_QOS_HAS_SEQ(wh))
		return pri;

	return ATH_NONQOS_TID_AC;
}

void
ath_txfrag_cleanup(struct ath_softc *sc,
	ath_bufhead *frags, struct ieee80211_node *ni)
{
	struct ath_buf *bf;
	struct ath_buf *next;

	ATH_TXBUF_LOCK_ASSERT(sc);

	next = TAILQ_FIRST(frags);
	while ((bf = next) != NULL) {
		next = TAILQ_NEXT(bf, bf_list);
		/* NB: bf assumed clean */
		TAILQ_REMOVE(frags, bf, bf_list);
		ath_returnbuf_head(sc, bf);
		ieee80211_node_decref(ni);
	}
}

/*
 * Setup xmit of a fragmented frame.  Allocate a buffer
 * for each frag and bump the node reference count to
 * reflect the held reference to be setup by ath_tx_start.
 */
int
ath_txfrag_setup(struct ath_softc *sc, ath_bufhead *frags,
	struct mbuf *m0, struct ieee80211_node *ni)
{
	struct mbuf *m;
	struct ath_buf *bf;

	ATH_TXBUF_LOCK(sc);
	for (m = m0->m_nextpkt; m != NULL; m = m->m_nextpkt) {
		/* XXX non-management? */
		bf = _ath_getbuf_locked(sc, ATH_BUFTYPE_NORMAL);
		if (bf == NULL) {	/* out of buffers, cleanup */
			DPRINTF(sc, ATH_DEBUG_XMIT, "%s: no buffer?\n",
			    __func__);
			ath_txfrag_cleanup(sc, frags, ni);
			break;
		}
		ieee80211_node_incref(ni);
		TAILQ_INSERT_TAIL(frags, bf, bf_list);
	}
	ATH_TXBUF_UNLOCK(sc);

	return !TAILQ_EMPTY(frags);
}

/*
 * Reclaim mbuf resources.  For fragmented frames we
 * need to claim each frag chained with m_nextpkt.
 */
void
ath_freetx(struct mbuf *m)
{
	struct mbuf *next;

	do {
		next = m->m_nextpkt;
		m->m_nextpkt = NULL;
		m_freem(m);
	} while ((m = next) != NULL);
}

static int
ath_tx_dmasetup(struct ath_softc *sc, struct ath_buf *bf, struct mbuf *m0)
{
	int error;

	/*
	 * Load the DMA map so any coalescing is done.  This
	 * also calculates the number of descriptors we need.
	 */
	error = bus_dmamap_load_mbuf_defrag(sc->sc_dmat, bf->bf_dmamap, &m0,
				     bf->bf_segs, ATH_TXDESC, &bf->bf_nseg,
				     BUS_DMA_NOWAIT);
	if (error != 0) {
		sc->sc_stats.ast_tx_busdma++;
		ath_freetx(m0);
		return error;
	}

	/*
	 * Discard null packets.
	 */
	if (bf->bf_nseg == 0) {
		sc->sc_stats.ast_tx_nodata++;
		ath_freetx(m0);
		return EIO;
	}
	DPRINTF(sc, ATH_DEBUG_XMIT, "%s: m %p len %u\n",
		__func__, m0, m0->m_pkthdr.len);
	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
	bf->bf_m = m0;

	return 0;
}

/*
 * Chain together segments+descriptors for a frame - 11n or otherwise.
 *
 * For aggregates, this is called on each frame in the aggregate.
 */
static void
ath_tx_chaindesclist(struct ath_softc *sc, struct ath_desc *ds0,
    struct ath_buf *bf, int is_aggr, int is_first_subframe,
    int is_last_subframe)
{
	struct ath_hal *ah = sc->sc_ah;
	char *ds;
	int i, bp, dsp;
	HAL_DMA_ADDR bufAddrList[4];
	uint32_t segLenList[4];
	int numTxMaps = 1;
	int isFirstDesc = 1;

	/*
	 * XXX There's txdma and txdma_mgmt; the descriptor
	 * sizes must match.
	 */
	struct ath_descdma *dd = &sc->sc_txdma;

	/*
	 * Fillin the remainder of the descriptor info.
	 */

	/*
	 * We need the number of TX data pointers in each descriptor.
	 * EDMA and later chips support 4 TX buffers per descriptor;
	 * previous chips just support one.
	 */
	numTxMaps = sc->sc_tx_nmaps;

	/*
	 * For EDMA and later chips ensure the TX map is fully populated
	 * before advancing to the next descriptor.
	 */
	ds = (char *) bf->bf_desc;
	bp = dsp = 0;
	bzero(bufAddrList, sizeof(bufAddrList));
	bzero(segLenList, sizeof(segLenList));
	for (i = 0; i < bf->bf_nseg; i++) {
		bufAddrList[bp] = bf->bf_segs[i].ds_addr;
		segLenList[bp] = bf->bf_segs[i].ds_len;
		bp++;

		/*
		 * Go to the next segment if this isn't the last segment
		 * and there's space in the current TX map.
		 */
		if ((i != bf->bf_nseg - 1) && (bp < numTxMaps))
			continue;

		/*
		 * Last segment or we're out of buffer pointers.
		 */
		bp = 0;

		if (i == bf->bf_nseg - 1)
			ath_hal_settxdesclink(ah, (struct ath_desc *) ds, 0);
		else
			ath_hal_settxdesclink(ah, (struct ath_desc *) ds,
			    bf->bf_daddr + dd->dd_descsize * (dsp + 1));

		/*
		 * XXX This assumes that bfs_txq is the actual destination
		 * hardware queue at this point.  It may not have been
		 * assigned, it may actually be pointing to the multicast
		 * software TXQ id.  These must be fixed!
		 */
		ath_hal_filltxdesc(ah, (struct ath_desc *) ds
			, bufAddrList
			, segLenList
			, bf->bf_descid		/* XXX desc id */
			, bf->bf_state.bfs_tx_queue
			, isFirstDesc		/* first segment */
			, i == bf->bf_nseg - 1	/* last segment */
			, (struct ath_desc *) ds0	/* first descriptor */
		);

		/*
		 * Make sure the 11n aggregate fields are cleared.
		 *
		 * XXX TODO: this doesn't need to be called for
		 * aggregate frames; as it'll be called on all
		 * sub-frames.  Since the descriptors are in
		 * non-cacheable memory, this leads to some
		 * rather slow writes on MIPS/ARM platforms.
		 */
		if (ath_tx_is_11n(sc))
			ath_hal_clr11n_aggr(sc->sc_ah, (struct ath_desc *) ds);

		/*
		 * If 11n is enabled, set it up as if it's an aggregate
		 * frame.
		 */
		if (is_last_subframe) {
			ath_hal_set11n_aggr_last(sc->sc_ah,
			    (struct ath_desc *) ds);
		} else if (is_aggr) {
			/*
			 * This clears the aggrlen field; so
			 * the caller needs to call set_aggr_first()!
			 *
			 * XXX TODO: don't call this for the first
			 * descriptor in the first frame in an
			 * aggregate!
			 */
			ath_hal_set11n_aggr_middle(sc->sc_ah,
			    (struct ath_desc *) ds,
			    bf->bf_state.bfs_ndelim);
		}
		isFirstDesc = 0;
		bf->bf_lastds = (struct ath_desc *) ds;

		/*
		 * Don't forget to skip to the next descriptor.
		 */
		ds += sc->sc_tx_desclen;
		dsp++;

		/*
		 * .. and don't forget to blank these out!
		 */
		bzero(bufAddrList, sizeof(bufAddrList));
		bzero(segLenList, sizeof(segLenList));
	}
	bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap, BUS_DMASYNC_PREWRITE);
}

/*
 * Set the rate control fields in the given descriptor based on
 * the bf_state fields and node state.
 *
 * The bfs fields should already be set with the relevant rate
 * control information, including whether MRR is to be enabled.
 *
 * Since the FreeBSD HAL currently sets up the first TX rate
 * in ath_hal_setuptxdesc(), this will setup the MRR
 * conditionally for the pre-11n chips, and call ath_buf_set_rate
 * unconditionally for 11n chips. These require the 11n rate
 * scenario to be set if MCS rates are enabled, so it's easier
 * to just always call it. The caller can then only set rates 2, 3
 * and 4 if multi-rate retry is needed.
 */
static void
ath_tx_set_ratectrl(struct ath_softc *sc, struct ieee80211_node *ni,
    struct ath_buf *bf)
{
	struct ath_rc_series *rc = bf->bf_state.bfs_rc;

	/* If mrr is disabled, blank tries 1, 2, 3 */
	if (! bf->bf_state.bfs_ismrr)
		rc[1].tries = rc[2].tries = rc[3].tries = 0;

#if 0
	/*
	 * If NOACK is set, just set ntries=1.
	 */
	else if (bf->bf_state.bfs_txflags & HAL_TXDESC_NOACK) {
		rc[1].tries = rc[2].tries = rc[3].tries = 0;
		rc[0].tries = 1;
	}
#endif

	/*
	 * Always call - that way a retried descriptor will
	 * have the MRR fields overwritten.
	 *
	 * XXX TODO: see if this is really needed - setting up
	 * the first descriptor should set the MRR fields to 0
	 * for us anyway.
	 */
	if (ath_tx_is_11n(sc)) {
		ath_buf_set_rate(sc, ni, bf);
	} else {
		ath_hal_setupxtxdesc(sc->sc_ah, bf->bf_desc
			, rc[1].ratecode, rc[1].tries
			, rc[2].ratecode, rc[2].tries
			, rc[3].ratecode, rc[3].tries
		);
	}
}

/*
 * Setup segments+descriptors for an 11n aggregate.
 * bf_first is the first buffer in the aggregate.
 * The descriptor list must already been linked together using
 * bf->bf_next.
 */
static void
ath_tx_setds_11n(struct ath_softc *sc, struct ath_buf *bf_first)
{
	struct ath_buf *bf, *bf_prev = NULL;
	struct ath_desc *ds0 = bf_first->bf_desc;

	DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR, "%s: nframes=%d, al=%d\n",
	    __func__, bf_first->bf_state.bfs_nframes,
	    bf_first->bf_state.bfs_al);

	bf = bf_first;

	if (bf->bf_state.bfs_txrate0 == 0)
		DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR, "%s: bf=%p, txrate0=%d\n",
		    __func__, bf, 0);
	if (bf->bf_state.bfs_rc[0].ratecode == 0)
		DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR, "%s: bf=%p, rix0=%d\n",
		    __func__, bf, 0);

	/*
	 * Setup all descriptors of all subframes - this will
	 * call ath_hal_set11naggrmiddle() on every frame.
	 */
	while (bf != NULL) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR,
		    "%s: bf=%p, nseg=%d, pktlen=%d, seqno=%d\n",
		    __func__, bf, bf->bf_nseg, bf->bf_state.bfs_pktlen,
		    SEQNO(bf->bf_state.bfs_seqno));

		/*
		 * Setup the initial fields for the first descriptor - all
		 * the non-11n specific stuff.
		 */
		ath_hal_setuptxdesc(sc->sc_ah, bf->bf_desc
			, bf->bf_state.bfs_pktlen	/* packet length */
			, bf->bf_state.bfs_hdrlen	/* header length */
			, bf->bf_state.bfs_atype	/* Atheros packet type */
			, bf->bf_state.bfs_txpower	/* txpower */
			, bf->bf_state.bfs_txrate0
			, bf->bf_state.bfs_try0		/* series 0 rate/tries */
			, bf->bf_state.bfs_keyix	/* key cache index */
			, bf->bf_state.bfs_txantenna	/* antenna mode */
			, bf->bf_state.bfs_txflags | HAL_TXDESC_INTREQ	/* flags */
			, bf->bf_state.bfs_ctsrate	/* rts/cts rate */
			, bf->bf_state.bfs_ctsduration	/* rts/cts duration */
		);

		/*
		 * First descriptor? Setup the rate control and initial
		 * aggregate header information.
		 */
		if (bf == bf_first) {
			/*
			 * setup first desc with rate and aggr info
			 */
			ath_tx_set_ratectrl(sc, bf->bf_node, bf);
		}

		/*
		 * Setup the descriptors for a multi-descriptor frame.
		 * This is both aggregate and non-aggregate aware.
		 */
		ath_tx_chaindesclist(sc, ds0, bf,
		    1, /* is_aggr */
		    !! (bf == bf_first), /* is_first_subframe */
		    !! (bf->bf_next == NULL) /* is_last_subframe */
		    );

		if (bf == bf_first) {
			/*
			 * Initialise the first 11n aggregate with the
			 * aggregate length and aggregate enable bits.
			 */
			ath_hal_set11n_aggr_first(sc->sc_ah,
			    ds0,
			    bf->bf_state.bfs_al,
			    bf->bf_state.bfs_ndelim);
		}

		/*
		 * Link the last descriptor of the previous frame
		 * to the beginning descriptor of this frame.
		 */
		if (bf_prev != NULL)
			ath_hal_settxdesclink(sc->sc_ah, bf_prev->bf_lastds,
			    bf->bf_daddr);

		/* Save a copy so we can link the next descriptor in */
		bf_prev = bf;
		bf = bf->bf_next;
	}

	/*
	 * Set the first descriptor bf_lastds field to point to
	 * the last descriptor in the last subframe, that's where
	 * the status update will occur.
	 */
	bf_first->bf_lastds = bf_prev->bf_lastds;

	/*
	 * And bf_last in the first descriptor points to the end of
	 * the aggregate list.
	 */
	bf_first->bf_last = bf_prev;

	/*
	 * For non-AR9300 NICs, which require the rate control
	 * in the final descriptor - let's set that up now.
	 *
	 * This is because the filltxdesc() HAL call doesn't
	 * populate the last segment with rate control information
	 * if firstSeg is also true.  For non-aggregate frames
	 * that is fine, as the first frame already has rate control
	 * info.  But if the last frame in an aggregate has one
	 * descriptor, both firstseg and lastseg will be true and
	 * the rate info isn't copied.
	 *
	 * This is inefficient on MIPS/ARM platforms that have
	 * non-cachable memory for TX descriptors, but we'll just
	 * make do for now.
	 *
	 * As to why the rate table is stashed in the last descriptor
	 * rather than the first descriptor?  Because proctxdesc()
	 * is called on the final descriptor in an MPDU or A-MPDU -
	 * ie, the one that gets updated by the hardware upon
	 * completion.  That way proctxdesc() doesn't need to know
	 * about the first _and_ last TX descriptor.
	 */
	ath_hal_setuplasttxdesc(sc->sc_ah, bf_prev->bf_lastds, ds0);

	DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR, "%s: end\n", __func__);
}

/*
 * Hand-off a frame to the multicast TX queue.
 *
 * This is a software TXQ which will be appended to the CAB queue
 * during the beacon setup code.
 *
 * XXX TODO: since the AR9300 EDMA TX queue support wants the QCU ID
 * as part of the TX descriptor, bf_state.bfs_tx_queue must be updated
 * with the actual hardware txq, or all of this will fall apart.
 *
 * XXX It may not be a bad idea to just stuff the QCU ID into bf_state
 * and retire bfs_tx_queue; then make sure the CABQ QCU ID is populated
 * correctly.
 */
static void
ath_tx_handoff_mcast(struct ath_softc *sc, struct ath_txq *txq,
    struct ath_buf *bf)
{
	ATH_TX_LOCK_ASSERT(sc);

	KASSERT((bf->bf_flags & ATH_BUF_BUSY) == 0,
	     ("%s: busy status 0x%x", __func__, bf->bf_flags));

	/*
	 * Ensure that the tx queue is the cabq, so things get
	 * mapped correctly.
	 */
	if (bf->bf_state.bfs_tx_queue != sc->sc_cabq->axq_qnum) {
		DPRINTF(sc, ATH_DEBUG_XMIT,
		    "%s: bf=%p, bfs_tx_queue=%d, axq_qnum=%d\n",
		    __func__, bf, bf->bf_state.bfs_tx_queue,
		    txq->axq_qnum);
	}

	ATH_TXQ_LOCK(txq);
	if (ATH_TXQ_LAST(txq, axq_q_s) != NULL) {
		struct ath_buf *bf_last = ATH_TXQ_LAST(txq, axq_q_s);
		struct ieee80211_frame *wh;

		/* mark previous frame */
		wh = mtod(bf_last->bf_m, struct ieee80211_frame *);
		wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
		bus_dmamap_sync(sc->sc_dmat, bf_last->bf_dmamap,
		    BUS_DMASYNC_PREWRITE);

		/* link descriptor */
		ath_hal_settxdesclink(sc->sc_ah,
		    bf_last->bf_lastds,
		    bf->bf_daddr);
	}
	ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
	ATH_TXQ_UNLOCK(txq);
}

/*
 * Hand-off packet to a hardware queue.
 */
static void
ath_tx_handoff_hw(struct ath_softc *sc, struct ath_txq *txq,
    struct ath_buf *bf)
{
	struct ath_hal *ah = sc->sc_ah;
	struct ath_buf *bf_first;

	/*
	 * Insert the frame on the outbound list and pass it on
	 * to the hardware.  Multicast frames buffered for power
	 * save stations and transmit from the CAB queue are stored
	 * on a s/w only queue and loaded on to the CAB queue in
	 * the SWBA handler since frames only go out on DTIM and
	 * to avoid possible races.
	 */
	ATH_TX_LOCK_ASSERT(sc);
	KASSERT((bf->bf_flags & ATH_BUF_BUSY) == 0,
	     ("%s: busy status 0x%x", __func__, bf->bf_flags));
	KASSERT(txq->axq_qnum != ATH_TXQ_SWQ,
	     ("ath_tx_handoff_hw called for mcast queue"));

	/*
	 * XXX We should instead just verify that sc_txstart_cnt
	 * or ath_txproc_cnt > 0.  That would mean that
	 * the reset is going to be waiting for us to complete.
	 */
	if (sc->sc_txproc_cnt == 0 && sc->sc_txstart_cnt == 0) {
		device_printf(sc->sc_dev,
		    "%s: TX dispatch without holding txcount/txstart refcnt!\n",
		    __func__);
	}

	/*
	 * XXX .. this is going to cause the hardware to get upset;
	 * so we really should find some way to drop or queue
	 * things.
	 */

	ATH_TXQ_LOCK(txq);

	/*
	 * XXX TODO: if there's a holdingbf, then
	 * ATH_TXQ_PUTRUNNING should be clear.
	 *
	 * If there is a holdingbf and the list is empty,
	 * then axq_link should be pointing to the holdingbf.
	 *
	 * Otherwise it should point to the last descriptor
	 * in the last ath_buf.
	 *
	 * In any case, we should really ensure that we
	 * update the previous descriptor link pointer to
	 * this descriptor, regardless of all of the above state.
	 *
	 * For now this is captured by having axq_link point
	 * to either the holdingbf (if the TXQ list is empty)
	 * or the end of the list (if the TXQ list isn't empty.)
	 * I'd rather just kill axq_link here and do it as above.
	 */

	/*
	 * Append the frame to the TX queue.
	 */
	ATH_TXQ_INSERT_TAIL(txq, bf, bf_list);
	ATH_KTR(sc, ATH_KTR_TX, 3,
	    "ath_tx_handoff: non-tdma: txq=%u, add bf=%p "
	    "depth=%d",
	    txq->axq_qnum,
	    bf,
	    txq->axq_depth);

	/*
	 * If there's a link pointer, update it.
	 *
	 * XXX we should replace this with the above logic, just
	 * to kill axq_link with fire.
	 */
	if (txq->axq_link != NULL) {
		*txq->axq_link = bf->bf_daddr;
		DPRINTF(sc, ATH_DEBUG_XMIT,
		    "%s: link[%u](%p)=%p (%p) depth %d\n", __func__,
		    txq->axq_qnum, txq->axq_link,
		    (caddr_t)bf->bf_daddr, bf->bf_desc,
		    txq->axq_depth);
		ATH_KTR(sc, ATH_KTR_TX, 5,
		    "ath_tx_handoff: non-tdma: link[%u](%p)=%p (%p) "
		    "lastds=%d",
		    txq->axq_qnum, txq->axq_link,
		    (caddr_t)bf->bf_daddr, bf->bf_desc,
		    bf->bf_lastds);
	}

	/*
	 * If we've not pushed anything into the hardware yet,
	 * push the head of the queue into the TxDP.
	 *
	 * Once we've started DMA, there's no guarantee that
	 * updating the TxDP with a new value will actually work.
	 * So we just don't do that - if we hit the end of the list,
	 * we keep that buffer around (the "holding buffer") and
	 * re-start DMA by updating the link pointer of _that_
	 * descriptor and then restart DMA.
	 */
	if (! (txq->axq_flags & ATH_TXQ_PUTRUNNING)) {
		bf_first = TAILQ_FIRST(&txq->axq_q);
		txq->axq_flags |= ATH_TXQ_PUTRUNNING;
		ath_hal_puttxbuf(ah, txq->axq_qnum, bf_first->bf_daddr);
		DPRINTF(sc, ATH_DEBUG_XMIT,
		    "%s: TXDP[%u] = %p (%p) depth %d\n",
		    __func__, txq->axq_qnum,
		    (caddr_t)bf_first->bf_daddr, bf_first->bf_desc,
		    txq->axq_depth);
		ATH_KTR(sc, ATH_KTR_TX, 5,
		    "ath_tx_handoff: TXDP[%u] = %p (%p) "
		    "lastds=%p depth %d",
		    txq->axq_qnum,
		    (caddr_t)bf_first->bf_daddr, bf_first->bf_desc,
		    bf_first->bf_lastds,
		    txq->axq_depth);
	}

	/*
	 * Ensure that the bf TXQ matches this TXQ, so later
	 * checking and holding buffer manipulation is sane.
	 */
	if (bf->bf_state.bfs_tx_queue != txq->axq_qnum) {
		DPRINTF(sc, ATH_DEBUG_XMIT,
		    "%s: bf=%p, bfs_tx_queue=%d, axq_qnum=%d\n",
		    __func__, bf, bf->bf_state.bfs_tx_queue,
		    txq->axq_qnum);
	}

	/*
	 * Track aggregate queue depth.
	 */
	if (bf->bf_state.bfs_aggr)
		txq->axq_aggr_depth++;

	/*
	 * Update the link pointer.
	 */
	ath_hal_gettxdesclinkptr(ah, bf->bf_lastds, &txq->axq_link);

	/*
	 * Start DMA.
	 *
	 * If we wrote a TxDP above, DMA will start from here.
	 *
	 * If DMA is running, it'll do nothing.
	 *
	 * If the DMA engine hit the end of the QCU list (ie LINK=NULL,
	 * or VEOL) then it stops at the last transmitted write.
	 * We then append a new frame by updating the link pointer
	 * in that descriptor and then kick TxE here; it will re-read
	 * that last descriptor and find the new descriptor to transmit.
	 *
	 * This is why we keep the holding descriptor around.
	 */
	ath_hal_txstart(ah, txq->axq_qnum);
	ATH_TXQ_UNLOCK(txq);
	ATH_KTR(sc, ATH_KTR_TX, 1,
	    "ath_tx_handoff: txq=%u, txstart", txq->axq_qnum);
}

/*
 * Restart TX DMA for the given TXQ.
 *
 * This must be called whether the queue is empty or not.
 */
static void
ath_legacy_tx_dma_restart(struct ath_softc *sc, struct ath_txq *txq)
{
	struct ath_buf *bf, *bf_last;

	ATH_TXQ_LOCK_ASSERT(txq);

	/* XXX make this ATH_TXQ_FIRST */
	bf = TAILQ_FIRST(&txq->axq_q);
	bf_last = ATH_TXQ_LAST(txq, axq_q_s);

	if (bf == NULL)
		return;

	DPRINTF(sc, ATH_DEBUG_RESET,
	    "%s: Q%d: bf=%p, bf_last=%p, daddr=0x%08x\n",
	    __func__,
	    txq->axq_qnum,
	    bf,
	    bf_last,
	    (uint32_t) bf->bf_daddr);

#ifdef	ATH_DEBUG
	if (sc->sc_debug & ATH_DEBUG_RESET)
		ath_tx_dump(sc, txq);
#endif

	/*
	 * This is called from a restart, so DMA is known to be
	 * completely stopped.
	 */
	KASSERT((!(txq->axq_flags & ATH_TXQ_PUTRUNNING)),
	    ("%s: Q%d: called with PUTRUNNING=1\n",
	    __func__,
	    txq->axq_qnum));

	ath_hal_puttxbuf(sc->sc_ah, txq->axq_qnum, bf->bf_daddr);
	txq->axq_flags |= ATH_TXQ_PUTRUNNING;

	ath_hal_gettxdesclinkptr(sc->sc_ah, bf_last->bf_lastds,
	    &txq->axq_link);
	ath_hal_txstart(sc->sc_ah, txq->axq_qnum);
}

/*
 * Hand off a packet to the hardware (or mcast queue.)
 *
 * The relevant hardware txq should be locked.
 */
static void
ath_legacy_xmit_handoff(struct ath_softc *sc, struct ath_txq *txq,
    struct ath_buf *bf)
{
	ATH_TX_LOCK_ASSERT(sc);

#ifdef	ATH_DEBUG_ALQ
	if (if_ath_alq_checkdebug(&sc->sc_alq, ATH_ALQ_EDMA_TXDESC))
		ath_tx_alq_post(sc, bf);
#endif

	if (txq->axq_qnum == ATH_TXQ_SWQ)
		ath_tx_handoff_mcast(sc, txq, bf);
	else
		ath_tx_handoff_hw(sc, txq, bf);
}

static int
ath_tx_tag_crypto(struct ath_softc *sc, struct ieee80211_node *ni,
    struct mbuf *m0, int iswep, int isfrag, int *hdrlen, int *pktlen,
    int *keyix)
{
	DPRINTF(sc, ATH_DEBUG_XMIT,
	    "%s: hdrlen=%d, pktlen=%d, isfrag=%d, iswep=%d, m0=%p\n",
	    __func__,
	    *hdrlen,
	    *pktlen,
	    isfrag,
	    iswep,
	    m0);

	if (iswep) {
		const struct ieee80211_cipher *cip;
		struct ieee80211_key *k;

		/*
		 * Construct the 802.11 header+trailer for an encrypted
		 * frame. The only reason this can fail is because of an
		 * unknown or unsupported cipher/key type.
		 */
		k = ieee80211_crypto_encap(ni, m0);
		if (k == NULL) {
			/*
			 * This can happen when the key is yanked after the
			 * frame was queued.  Just discard the frame; the
			 * 802.11 layer counts failures and provides
			 * debugging/diagnostics.
			 */
			return (0);
		}
		/*
		 * Adjust the packet + header lengths for the crypto
		 * additions and calculate the h/w key index.  When
		 * a s/w mic is done the frame will have had any mic
		 * added to it prior to entry so m0->m_pkthdr.len will
		 * account for it. Otherwise we need to add it to the
		 * packet length.
		 */
		cip = k->wk_cipher;
		(*hdrlen) += cip->ic_header;
		(*pktlen) += cip->ic_header + cip->ic_trailer;
		/* NB: frags always have any TKIP MIC done in s/w */
		if ((k->wk_flags & IEEE80211_KEY_SWMIC) == 0 && !isfrag)
			(*pktlen) += cip->ic_miclen;
		(*keyix) = k->wk_keyix;
	} else if (ni->ni_ucastkey.wk_cipher == &ieee80211_cipher_none) {
		/*
		 * Use station key cache slot, if assigned.
		 */
		(*keyix) = ni->ni_ucastkey.wk_keyix;
		if ((*keyix) == IEEE80211_KEYIX_NONE)
			(*keyix) = HAL_TXKEYIX_INVALID;
	} else
		(*keyix) = HAL_TXKEYIX_INVALID;

	return (1);
}

/*
 * Calculate whether interoperability protection is required for
 * this frame.
 *
 * This requires the rate control information be filled in,
 * as the protection requirement depends upon the current
 * operating mode / PHY.
 */
static void
ath_tx_calc_protection(struct ath_softc *sc, struct ath_buf *bf)
{
	struct ieee80211_frame *wh;
	uint8_t rix;
	uint16_t flags;
	int shortPreamble;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211com *ic = ifp->if_l2com;

	flags = bf->bf_state.bfs_txflags;
	rix = bf->bf_state.bfs_rc[0].rix;
	shortPreamble = bf->bf_state.bfs_shpream;
	wh = mtod(bf->bf_m, struct ieee80211_frame *);

	/*
	 * If 802.11g protection is enabled, determine whether
	 * to use RTS/CTS or just CTS.  Note that this is only
	 * done for OFDM unicast frames.
	 */
	if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
	    rt->info[rix].phy == IEEE80211_T_OFDM &&
	    (flags & HAL_TXDESC_NOACK) == 0) {
		bf->bf_state.bfs_doprot = 1;
		/* XXX fragments must use CCK rates w/ protection */
		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
			flags |= HAL_TXDESC_RTSENA;
		} else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
			flags |= HAL_TXDESC_CTSENA;
		}
		/*
		 * For frags it would be desirable to use the
		 * highest CCK rate for RTS/CTS.  But stations
		 * farther away may detect it at a lower CCK rate
		 * so use the configured protection rate instead
		 * (for now).
		 */
		sc->sc_stats.ast_tx_protect++;
	}

	/*
	 * If 11n protection is enabled and it's a HT frame,
	 * enable RTS.
	 *
	 * XXX ic_htprotmode or ic_curhtprotmode?
	 * XXX should it_htprotmode only matter if ic_curhtprotmode 
	 * XXX indicates it's not a HT pure environment?
	 */
	if ((ic->ic_htprotmode == IEEE80211_PROT_RTSCTS) &&
	    rt->info[rix].phy == IEEE80211_T_HT &&
	    (flags & HAL_TXDESC_NOACK) == 0) {
		flags |= HAL_TXDESC_RTSENA;
		sc->sc_stats.ast_tx_htprotect++;
	}
	bf->bf_state.bfs_txflags = flags;
}

/*
 * Update the frame duration given the currently selected rate.
 *
 * This also updates the frame duration value, so it will require
 * a DMA flush.
 */
static void
ath_tx_calc_duration(struct ath_softc *sc, struct ath_buf *bf)
{
	struct ieee80211_frame *wh;
	uint8_t rix;
	uint16_t flags;
	int shortPreamble;
	struct ath_hal *ah = sc->sc_ah;
	const HAL_RATE_TABLE *rt = sc->sc_currates;
	int isfrag = bf->bf_m->m_flags & M_FRAG;

	flags = bf->bf_state.bfs_txflags;
	rix = bf->bf_state.bfs_rc[0].rix;
	shortPreamble = bf->bf_state.bfs_shpream;
	wh = mtod(bf->bf_m, struct ieee80211_frame *);

	/*
	 * Calculate duration.  This logically belongs in the 802.11
	 * layer but it lacks sufficient information to calculate it.
	 */
	if ((flags & HAL_TXDESC_NOACK) == 0 &&
	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_CTL) {
		u_int16_t dur;
		if (shortPreamble)
			dur = rt->info[rix].spAckDuration;
		else
			dur = rt->info[rix].lpAckDuration;
		if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG) {
			dur += dur;		/* additional SIFS+ACK */
			/*
			 * Include the size of next fragment so NAV is
			 * updated properly.  The last fragment uses only
			 * the ACK duration
			 *
			 * XXX TODO: ensure that the rate lookup for each
			 * fragment is the same as the rate used by the
			 * first fragment!
			 */
			dur += ath_hal_computetxtime(ah,
			    rt,
			    bf->bf_nextfraglen,
			    rix, shortPreamble);
		}
		if (isfrag) {
			/*
			 * Force hardware to use computed duration for next
			 * fragment by disabling multi-rate retry which updates
			 * duration based on the multi-rate duration table.
			 */
			bf->bf_state.bfs_ismrr = 0;
			bf->bf_state.bfs_try0 = ATH_TXMGTTRY;
			/* XXX update bfs_rc[0].try? */
		}

		/* Update the duration field itself */
		*(u_int16_t *)wh->i_dur = htole16(dur);
	}
}

static uint8_t
ath_tx_get_rtscts_rate(struct ath_hal *ah, const HAL_RATE_TABLE *rt,
    int cix, int shortPreamble)
{
	uint8_t ctsrate;

	/*
	 * CTS transmit rate is derived from the transmit rate
	 * by looking in the h/w rate table.  We must also factor
	 * in whether or not a short preamble is to be used.
	 */
	/* NB: cix is set above where RTS/CTS is enabled */
	KASSERT(cix != 0xff, ("cix not setup"));
	ctsrate = rt->info[cix].rateCode;

	/* XXX this should only matter for legacy rates */
	if (shortPreamble)
		ctsrate |= rt->info[cix].shortPreamble;

	return (ctsrate);
}

/*
 * Calculate the RTS/CTS duration for legacy frames.
 */
static int
ath_tx_calc_ctsduration(struct ath_hal *ah, int rix, int cix,
    int shortPreamble, int pktlen, const HAL_RATE_TABLE *rt,
    int flags)
{
	int ctsduration = 0;

	/* This mustn't be called for HT modes */
	if (rt->info[cix].phy == IEEE80211_T_HT) {
		kprintf("%s: HT rate where it shouldn't be (0x%x)\n",
		    __func__, rt->info[cix].rateCode);
		return (-1);
	}

	/*
	 * Compute the transmit duration based on the frame
	 * size and the size of an ACK frame.  We call into the
	 * HAL to do the computation since it depends on the
	 * characteristics of the actual PHY being used.
	 *
	 * NB: CTS is assumed the same size as an ACK so we can
	 *     use the precalculated ACK durations.
	 */
	if (shortPreamble) {
		if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
			ctsduration += rt->info[cix].spAckDuration;
		ctsduration += ath_hal_computetxtime(ah,
			rt, pktlen, rix, AH_TRUE);
		if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
			ctsduration += rt->info[rix].spAckDuration;
	} else {
		if (flags & HAL_TXDESC_RTSENA)		/* SIFS + CTS */
			ctsduration += rt->info[cix].lpAckDuration;
		ctsduration += ath_hal_computetxtime(ah,
			rt, pktlen, rix, AH_FALSE);
		if ((flags & HAL_TXDESC_NOACK) == 0)	/* SIFS + ACK */
			ctsduration += rt->info[rix].lpAckDuration;
	}

	return (ctsduration);
}

/*
 * Update the given ath_buf with updated rts/cts setup and duration
 * values.
 *
 * To support rate lookups for each software retry, the rts/cts rate
 * and cts duration must be re-calculated.
 *
 * This function assumes the RTS/CTS flags have been set as needed;
 * mrr has been disabled; and the rate control lookup has been done.
 *
 * XXX TODO: MRR need only be disabled for the pre-11n NICs.
 * XXX The 11n NICs support per-rate RTS/CTS configuration.
 */
static void
ath_tx_set_rtscts(struct ath_softc *sc, struct ath_buf *bf)
{
	uint16_t ctsduration = 0;
	uint8_t ctsrate = 0;
	uint8_t rix = bf->bf_state.bfs_rc[0].rix;
	uint8_t cix = 0;
	const HAL_RATE_TABLE *rt = sc->sc_currates;

	/*
	 * No RTS/CTS enabled? Don't bother.
	 */
	if ((bf->bf_state.bfs_txflags &
	    (HAL_TXDESC_RTSENA | HAL_TXDESC_CTSENA)) == 0) {
		/* XXX is this really needed? */
		bf->bf_state.bfs_ctsrate = 0;
		bf->bf_state.bfs_ctsduration = 0;
		return;
	}

	/*
	 * If protection is enabled, use the protection rix control
	 * rate. Otherwise use the rate0 control rate.
	 */
	if (bf->bf_state.bfs_doprot)
		rix = sc->sc_protrix;
	else
		rix = bf->bf_state.bfs_rc[0].rix;

	/*
	 * If the raw path has hard-coded ctsrate0 to something,
	 * use it.
	 */
	if (bf->bf_state.bfs_ctsrate0 != 0)
		cix = ath_tx_findrix(sc, bf->bf_state.bfs_ctsrate0);
	else
		/* Control rate from above */
		cix = rt->info[rix].controlRate;

	/* Calculate the rtscts rate for the given cix */
	ctsrate = ath_tx_get_rtscts_rate(sc->sc_ah, rt, cix,
	    bf->bf_state.bfs_shpream);

	/* The 11n chipsets do ctsduration calculations for you */
	if (! ath_tx_is_11n(sc))
		ctsduration = ath_tx_calc_ctsduration(sc->sc_ah, rix, cix,
		    bf->bf_state.bfs_shpream, bf->bf_state.bfs_pktlen,
		    rt, bf->bf_state.bfs_txflags);

	/* Squirrel away in ath_buf */
	bf->bf_state.bfs_ctsrate = ctsrate;
	bf->bf_state.bfs_ctsduration = ctsduration;
	
	/*
	 * Must disable multi-rate retry when using RTS/CTS.
	 */
	if (!sc->sc_mrrprot) {
		bf->bf_state.bfs_ismrr = 0;
		bf->bf_state.bfs_try0 =
		    bf->bf_state.bfs_rc[0].tries = ATH_TXMGTTRY; /* XXX ew */
	}
}

/*
 * Setup the descriptor chain for a normal or fast-frame
 * frame.
 *
 * XXX TODO: extend to include the destination hardware QCU ID.
 * Make sure that is correct.  Make sure that when being added
 * to the mcastq, the CABQ QCUID is set or things will get a bit
 * odd.
 */
static void
ath_tx_setds(struct ath_softc *sc, struct ath_buf *bf)
{
	struct ath_desc *ds = bf->bf_desc;
	struct ath_hal *ah = sc->sc_ah;

	if (bf->bf_state.bfs_txrate0 == 0)
		DPRINTF(sc, ATH_DEBUG_XMIT, 
		    "%s: bf=%p, txrate0=%d\n", __func__, bf, 0);

	ath_hal_setuptxdesc(ah, ds
		, bf->bf_state.bfs_pktlen	/* packet length */
		, bf->bf_state.bfs_hdrlen	/* header length */
		, bf->bf_state.bfs_atype	/* Atheros packet type */
		, bf->bf_state.bfs_txpower	/* txpower */
		, bf->bf_state.bfs_txrate0
		, bf->bf_state.bfs_try0		/* series 0 rate/tries */
		, bf->bf_state.bfs_keyix	/* key cache index */
		, bf->bf_state.bfs_txantenna	/* antenna mode */
		, bf->bf_state.bfs_txflags	/* flags */
		, bf->bf_state.bfs_ctsrate	/* rts/cts rate */
		, bf->bf_state.bfs_ctsduration	/* rts/cts duration */
	);

	/*
	 * This will be overriden when the descriptor chain is written.
	 */
	bf->bf_lastds = ds;
	bf->bf_last = bf;

	/* Set rate control and descriptor chain for this frame */
	ath_tx_set_ratectrl(sc, bf->bf_node, bf);
	ath_tx_chaindesclist(sc, ds, bf, 0, 0, 0);
}

/*
 * Do a rate lookup.
 *
 * This performs a rate lookup for the given ath_buf only if it's required.
 * Non-data frames and raw frames don't require it.
 *
 * This populates the primary and MRR entries; MRR values are
 * then disabled later on if something requires it (eg RTS/CTS on
 * pre-11n chipsets.
 *
 * This needs to be done before the RTS/CTS fields are calculated
 * as they may depend upon the rate chosen.
 */
static void
ath_tx_do_ratelookup(struct ath_softc *sc, struct ath_buf *bf)
{
	uint8_t rate, rix;
	int try0;

	if (! bf->bf_state.bfs_doratelookup)
		return;

	/* Get rid of any previous state */
	bzero(bf->bf_state.bfs_rc, sizeof(bf->bf_state.bfs_rc));

	ATH_NODE_LOCK(ATH_NODE(bf->bf_node));
	ath_rate_findrate(sc, ATH_NODE(bf->bf_node), bf->bf_state.bfs_shpream,
	    bf->bf_state.bfs_pktlen, &rix, &try0, &rate);

	/* In case MRR is disabled, make sure rc[0] is setup correctly */
	bf->bf_state.bfs_rc[0].rix = rix;
	bf->bf_state.bfs_rc[0].ratecode = rate;
	bf->bf_state.bfs_rc[0].tries = try0;

	if (bf->bf_state.bfs_ismrr && try0 != ATH_TXMAXTRY)
		ath_rate_getxtxrates(sc, ATH_NODE(bf->bf_node), rix,
		    bf->bf_state.bfs_rc);
	ATH_NODE_UNLOCK(ATH_NODE(bf->bf_node));

	sc->sc_txrix = rix;	/* for LED blinking */
	sc->sc_lastdatarix = rix;	/* for fast frames */
	bf->bf_state.bfs_try0 = try0;
	bf->bf_state.bfs_txrate0 = rate;
}

/*
 * Update the CLRDMASK bit in the ath_buf if it needs to be set.
 */
static void
ath_tx_update_clrdmask(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf)
{
	struct ath_node *an = ATH_NODE(bf->bf_node);

	ATH_TX_LOCK_ASSERT(sc);

	if (an->clrdmask == 1) {
		bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
		an->clrdmask = 0;
	}
}

/*
 * Return whether this frame should be software queued or
 * direct dispatched.
 *
 * When doing powersave, BAR frames should be queued but other management
 * frames should be directly sent.
 *
 * When not doing powersave, stick BAR frames into the hardware queue
 * so it goes out even though the queue is paused.
 *
 * For now, management frames are also software queued by default.
 */
static int
ath_tx_should_swq_frame(struct ath_softc *sc, struct ath_node *an,
    struct mbuf *m0, int *queue_to_head)
{
	struct ieee80211_node *ni = &an->an_node;
	struct ieee80211_frame *wh;
	uint8_t type, subtype;

	wh = mtod(m0, struct ieee80211_frame *);
	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	(*queue_to_head) = 0;

	/* If it's not in powersave - direct-dispatch BAR */
	if ((ATH_NODE(ni)->an_is_powersave == 0)
	    && type == IEEE80211_FC0_TYPE_CTL &&
	    subtype == IEEE80211_FC0_SUBTYPE_BAR) {
		DPRINTF(sc, ATH_DEBUG_SW_TX,
		    "%s: BAR: TX'ing direct\n", __func__);
		return (0);
	} else if ((ATH_NODE(ni)->an_is_powersave == 1)
	    && type == IEEE80211_FC0_TYPE_CTL &&
	    subtype == IEEE80211_FC0_SUBTYPE_BAR) {
		/* BAR TX whilst asleep; queue */
		DPRINTF(sc, ATH_DEBUG_SW_TX,
		    "%s: swq: TX'ing\n", __func__);
		(*queue_to_head) = 1;
		return (1);
	} else if ((ATH_NODE(ni)->an_is_powersave == 1)
	    && (type == IEEE80211_FC0_TYPE_MGT ||
	        type == IEEE80211_FC0_TYPE_CTL)) {
		/*
		 * Other control/mgmt frame; bypass software queuing
		 * for now!
		 */
		DPRINTF(sc, ATH_DEBUG_XMIT, 
		    "%s: %s: Node is asleep; sending mgmt "
		    "(type=%d, subtype=%d)\n",
		    __func__, ath_hal_ether_sprintf(ni->ni_macaddr),
		    type, subtype);
		return (0);
	} else {
		return (1);
	}
}


/*
 * Transmit the given frame to the hardware.
 *
 * The frame must already be setup; rate control must already have
 * been done.
 *
 * XXX since the TXQ lock is being held here (and I dislike holding
 * it for this long when not doing software aggregation), later on
 * break this function into "setup_normal" and "xmit_normal". The
 * lock only needs to be held for the ath_tx_handoff call.
 *
 * XXX we don't update the leak count here - if we're doing
 * direct frame dispatch, we need to be able to do it without
 * decrementing the leak count (eg multicast queue frames.)
 */
static void
ath_tx_xmit_normal(struct ath_softc *sc, struct ath_txq *txq,
    struct ath_buf *bf)
{
	struct ath_node *an = ATH_NODE(bf->bf_node);
	struct ath_tid *tid = &an->an_tid[bf->bf_state.bfs_tid];

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * For now, just enable CLRDMASK. ath_tx_xmit_normal() does
	 * set a completion handler however it doesn't (yet) properly
	 * handle the strict ordering requirements needed for normal,
	 * non-aggregate session frames.
	 *
	 * Once this is implemented, only set CLRDMASK like this for
	 * frames that must go out - eg management/raw frames.
	 */
	bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;

	/* Setup the descriptor before handoff */
	ath_tx_do_ratelookup(sc, bf);
	ath_tx_calc_duration(sc, bf);
	ath_tx_calc_protection(sc, bf);
	ath_tx_set_rtscts(sc, bf);
	ath_tx_rate_fill_rcflags(sc, bf);
	ath_tx_setds(sc, bf);

	/* Track per-TID hardware queue depth correctly */
	tid->hwq_depth++;

	/* Assign the completion handler */
	bf->bf_comp = ath_tx_normal_comp;

	/* Hand off to hardware */
	ath_tx_handoff(sc, txq, bf);
}

/*
 * Do the basic frame setup stuff that's required before the frame
 * is added to a software queue.
 *
 * All frames get mostly the same treatment and it's done once.
 * Retransmits fiddle with things like the rate control setup,
 * setting the retransmit bit in the packet; doing relevant DMA/bus
 * syncing and relinking it (back) into the hardware TX queue.
 *
 * Note that this may cause the mbuf to be reallocated, so
 * m0 may not be valid.
 */
static int
ath_tx_normal_setup(struct ath_softc *sc, struct ieee80211_node *ni,
    struct ath_buf *bf, struct mbuf *m0, struct ath_txq *txq)
{
	struct ieee80211vap *vap = ni->ni_vap;
	struct ath_hal *ah = sc->sc_ah;
	struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211com *ic = ifp->if_l2com;
	const struct chanAccParams *cap = &ic->ic_wme.wme_chanParams;
	int error, iswep, ismcast, isfrag, ismrr;
	int keyix, hdrlen, pktlen, try0 = 0;
	u_int8_t rix = 0, txrate = 0;
	struct ath_desc *ds;
	struct ieee80211_frame *wh;
	u_int subtype, flags;
	HAL_PKT_TYPE atype;
	const HAL_RATE_TABLE *rt;
	HAL_BOOL shortPreamble;
	struct ath_node *an;
	u_int pri;

	/*
	 * To ensure that both sequence numbers and the CCMP PN handling
	 * is "correct", make sure that the relevant TID queue is locked.
	 * Otherwise the CCMP PN and seqno may appear out of order, causing
	 * re-ordered frames to have out of order CCMP PN's, resulting
	 * in many, many frame drops.
	 */
	ATH_TX_LOCK_ASSERT(sc);

	wh = mtod(m0, struct ieee80211_frame *);
	iswep = wh->i_fc[1] & IEEE80211_FC1_PROTECTED;
	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
	isfrag = m0->m_flags & M_FRAG;
	hdrlen = ieee80211_anyhdrsize(wh);
	/*
	 * Packet length must not include any
	 * pad bytes; deduct them here.
	 */
	pktlen = m0->m_pkthdr.len - (hdrlen & 3);

	/* Handle encryption twiddling if needed */
	if (! ath_tx_tag_crypto(sc, ni, m0, iswep, isfrag, &hdrlen,
	    &pktlen, &keyix)) {
		ath_freetx(m0);
		return EIO;
	}

	/* packet header may have moved, reset our local pointer */
	wh = mtod(m0, struct ieee80211_frame *);

	pktlen += IEEE80211_CRC_LEN;

	/*
	 * Load the DMA map so any coalescing is done.  This
	 * also calculates the number of descriptors we need.
	 */
	error = ath_tx_dmasetup(sc, bf, m0);
	if (error != 0)
		return error;
	KASSERT((ni != NULL), ("%s: ni=NULL!", __func__));
	bf->bf_node = ni;			/* NB: held reference */
	m0 = bf->bf_m;				/* NB: may have changed */
	wh = mtod(m0, struct ieee80211_frame *);

	/* setup descriptors */
	ds = bf->bf_desc;
	rt = sc->sc_currates;
	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));

	/*
	 * NB: the 802.11 layer marks whether or not we should
	 * use short preamble based on the current mode and
	 * negotiated parameters.
	 */
	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
		shortPreamble = AH_TRUE;
		sc->sc_stats.ast_tx_shortpre++;
	} else {
		shortPreamble = AH_FALSE;
	}

	an = ATH_NODE(ni);
	//flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for crypto errs */
	flags = 0;
	ismrr = 0;				/* default no multi-rate retry*/
	pri = M_WME_GETAC(m0);			/* honor classification */
	/* XXX use txparams instead of fixed values */
	/*
	 * Calculate Atheros packet type from IEEE80211 packet header,
	 * setup for rate calculations, and select h/w transmit queue.
	 */
	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
	case IEEE80211_FC0_TYPE_MGT:
		subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON)
			atype = HAL_PKT_TYPE_BEACON;
		else if (subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
			atype = HAL_PKT_TYPE_PROBE_RESP;
		else if (subtype == IEEE80211_FC0_SUBTYPE_ATIM)
			atype = HAL_PKT_TYPE_ATIM;
		else
			atype = HAL_PKT_TYPE_NORMAL;	/* XXX */
		rix = an->an_mgmtrix;
		txrate = rt->info[rix].rateCode;
		if (shortPreamble)
			txrate |= rt->info[rix].shortPreamble;
		try0 = ATH_TXMGTTRY;
		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
		break;
	case IEEE80211_FC0_TYPE_CTL:
		atype = HAL_PKT_TYPE_PSPOLL;	/* stop setting of duration */
		rix = an->an_mgmtrix;
		txrate = rt->info[rix].rateCode;
		if (shortPreamble)
			txrate |= rt->info[rix].shortPreamble;
		try0 = ATH_TXMGTTRY;
		flags |= HAL_TXDESC_INTREQ;	/* force interrupt */
		break;
	case IEEE80211_FC0_TYPE_DATA:
		atype = HAL_PKT_TYPE_NORMAL;		/* default */
		/*
		 * Data frames: multicast frames go out at a fixed rate,
		 * EAPOL frames use the mgmt frame rate; otherwise consult
		 * the rate control module for the rate to use.
		 */
		if (ismcast) {
			rix = an->an_mcastrix;
			txrate = rt->info[rix].rateCode;
			if (shortPreamble)
				txrate |= rt->info[rix].shortPreamble;
			try0 = 1;
		} else if (m0->m_flags & M_EAPOL) {
			/* XXX? maybe always use long preamble? */
			rix = an->an_mgmtrix;
			txrate = rt->info[rix].rateCode;
			if (shortPreamble)
				txrate |= rt->info[rix].shortPreamble;
			try0 = ATH_TXMAXTRY;	/* XXX?too many? */
		} else {
			/*
			 * Do rate lookup on each TX, rather than using
			 * the hard-coded TX information decided here.
			 */
			ismrr = 1;
			bf->bf_state.bfs_doratelookup = 1;
		}
		if (cap->cap_wmeParams[pri].wmep_noackPolicy)
			flags |= HAL_TXDESC_NOACK;
		break;
	default:
		if_printf(ifp, "bogus frame type 0x%x (%s)\n",
			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
		/* XXX statistic */
		/* XXX free tx dmamap */
		ath_freetx(m0);
		return EIO;
	}

	/*
	 * There are two known scenarios where the frame AC doesn't match
	 * what the destination TXQ is.
	 *
	 * + non-QoS frames (eg management?) that the net80211 stack has
	 *   assigned a higher AC to, but since it's a non-QoS TID, it's
	 *   being thrown into TID 16.  TID 16 gets the AC_BE queue.
	 *   It's quite possible that management frames should just be
	 *   direct dispatched to hardware rather than go via the software
	 *   queue; that should be investigated in the future.  There are
	 *   some specific scenarios where this doesn't make sense, mostly
	 *   surrounding ADDBA request/response - hence why that is special
	 *   cased.
	 *
	 * + Multicast frames going into the VAP mcast queue.  That shows up
	 *   as "TXQ 11".
	 *
	 * This driver should eventually support separate TID and TXQ locking,
	 * allowing for arbitrary AC frames to appear on arbitrary software
	 * queues, being queued to the "correct" hardware queue when needed.
	 */
#if 0
	if (txq != sc->sc_ac2q[pri]) {
		DPRINTF(sc, ATH_DEBUG_XMIT, 
		    "%s: txq=%p (%d), pri=%d, pri txq=%p (%d)\n",
		    __func__,
		    txq,
		    txq->axq_qnum,
		    pri,
		    sc->sc_ac2q[pri],
		    sc->sc_ac2q[pri]->axq_qnum);
	}
#endif

	/*
	 * Calculate miscellaneous flags.
	 */
	if (ismcast) {
		flags |= HAL_TXDESC_NOACK;	/* no ack on broad/multicast */
	} else if (pktlen > vap->iv_rtsthreshold &&
	    (ni->ni_ath_flags & IEEE80211_NODE_FF) == 0) {
		flags |= HAL_TXDESC_RTSENA;	/* RTS based on frame length */
		sc->sc_stats.ast_tx_rts++;
	}
	if (flags & HAL_TXDESC_NOACK)		/* NB: avoid double counting */
		sc->sc_stats.ast_tx_noack++;
#ifdef IEEE80211_SUPPORT_TDMA
	if (sc->sc_tdma && (flags & HAL_TXDESC_NOACK) == 0) {
		DPRINTF(sc, ATH_DEBUG_TDMA,
		    "%s: discard frame, ACK required w/ TDMA\n", __func__);
		sc->sc_stats.ast_tdma_ack++;
		/* XXX free tx dmamap */
		ath_freetx(m0);
		return EIO;
	}
#endif

	/*
	 * Determine if a tx interrupt should be generated for
	 * this descriptor.  We take a tx interrupt to reap
	 * descriptors when the h/w hits an EOL condition or
	 * when the descriptor is specifically marked to generate
	 * an interrupt.  We periodically mark descriptors in this
	 * way to insure timely replenishing of the supply needed
	 * for sending frames.  Defering interrupts reduces system
	 * load and potentially allows more concurrent work to be
	 * done but if done to aggressively can cause senders to
	 * backup.
	 *
	 * NB: use >= to deal with sc_txintrperiod changing
	 *     dynamically through sysctl.
	 */
	if (flags & HAL_TXDESC_INTREQ) {
		txq->axq_intrcnt = 0;
	} else if (++txq->axq_intrcnt >= sc->sc_txintrperiod) {
		flags |= HAL_TXDESC_INTREQ;
		txq->axq_intrcnt = 0;
	}

	/* This point forward is actual TX bits */

	/*
	 * At this point we are committed to sending the frame
	 * and we don't need to look at m_nextpkt; clear it in
	 * case this frame is part of frag chain.
	 */
	m0->m_nextpkt = NULL;

	if (IFF_DUMPPKTS(sc, ATH_DEBUG_XMIT))
		ieee80211_dump_pkt(ic, mtod(m0, const uint8_t *), m0->m_len,
		    sc->sc_hwmap[rix].ieeerate, -1);

	if (ieee80211_radiotap_active_vap(vap)) {
		u_int64_t tsf = ath_hal_gettsf64(ah);

		sc->sc_tx_th.wt_tsf = htole64(tsf);
		sc->sc_tx_th.wt_flags = sc->sc_hwmap[rix].txflags;
		if (iswep)
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
		if (isfrag)
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
		sc->sc_tx_th.wt_rate = sc->sc_hwmap[rix].ieeerate;
		sc->sc_tx_th.wt_txpower = ieee80211_get_node_txpower(ni);
		sc->sc_tx_th.wt_antenna = sc->sc_txantenna;

		ieee80211_radiotap_tx(vap, m0);
	}

	/* Blank the legacy rate array */
	bzero(&bf->bf_state.bfs_rc, sizeof(bf->bf_state.bfs_rc));

	/*
	 * ath_buf_set_rate needs at least one rate/try to setup
	 * the rate scenario.
	 */
	bf->bf_state.bfs_rc[0].rix = rix;
	bf->bf_state.bfs_rc[0].tries = try0;
	bf->bf_state.bfs_rc[0].ratecode = txrate;

	/* Store the decided rate index values away */
	bf->bf_state.bfs_pktlen = pktlen;
	bf->bf_state.bfs_hdrlen = hdrlen;
	bf->bf_state.bfs_atype = atype;
	bf->bf_state.bfs_txpower = ieee80211_get_node_txpower(ni);
	bf->bf_state.bfs_txrate0 = txrate;
	bf->bf_state.bfs_try0 = try0;
	bf->bf_state.bfs_keyix = keyix;
	bf->bf_state.bfs_txantenna = sc->sc_txantenna;
	bf->bf_state.bfs_txflags = flags;
	bf->bf_state.bfs_shpream = shortPreamble;

	/* XXX this should be done in ath_tx_setrate() */
	bf->bf_state.bfs_ctsrate0 = 0;	/* ie, no hard-coded ctsrate */
	bf->bf_state.bfs_ctsrate = 0;	/* calculated later */
	bf->bf_state.bfs_ctsduration = 0;
	bf->bf_state.bfs_ismrr = ismrr;

	return 0;
}

/*
 * Queue a frame to the hardware or software queue.
 *
 * This can be called by the net80211 code.
 *
 * XXX what about locking? Or, push the seqno assign into the
 * XXX aggregate scheduler so its serialised?
 *
 * XXX When sending management frames via ath_raw_xmit(),
 *     should CLRDMASK be set unconditionally?
 */
int
ath_tx_start(struct ath_softc *sc, struct ieee80211_node *ni,
    struct ath_buf *bf, struct mbuf *m0)
{
	struct ieee80211vap *vap = ni->ni_vap;
	struct ath_vap *avp = ATH_VAP(vap);
	int r = 0;
	u_int pri;
	int tid;
	struct ath_txq *txq;
	int ismcast;
	const struct ieee80211_frame *wh;
	int is_ampdu, is_ampdu_tx, is_ampdu_pending;
	ieee80211_seq seqno;
	uint8_t type, subtype;
	int queue_to_head;

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * Determine the target hardware queue.
	 *
	 * For multicast frames, the txq gets overridden appropriately
	 * depending upon the state of PS.
	 *
	 * For any other frame, we do a TID/QoS lookup inside the frame
	 * to see what the TID should be. If it's a non-QoS frame, the
	 * AC and TID are overridden. The TID/TXQ code assumes the
	 * TID is on a predictable hardware TXQ, so we don't support
	 * having a node TID queued to multiple hardware TXQs.
	 * This may change in the future but would require some locking
	 * fudgery.
	 */
	pri = ath_tx_getac(sc, m0);
	tid = ath_tx_gettid(sc, m0);

	txq = sc->sc_ac2q[pri];
	wh = mtod(m0, struct ieee80211_frame *);
	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	/*
	 * Enforce how deep the multicast queue can grow.
	 *
	 * XXX duplicated in ath_raw_xmit().
	 */
	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
		if (sc->sc_cabq->axq_depth + sc->sc_cabq->fifo.axq_depth
		    > sc->sc_txq_mcastq_maxdepth) {
			sc->sc_stats.ast_tx_mcastq_overflow++;
			m_freem(m0);
			return (ENOBUFS);
		}
	}

	/*
	 * Enforce how deep the unicast queue can grow.
	 *
	 * If the node is in power save then we don't want
	 * the software queue to grow too deep, or a node may
	 * end up consuming all of the ath_buf entries.
	 *
	 * For now, only do this for DATA frames.
	 *
	 * We will want to cap how many management/control
	 * frames get punted to the software queue so it doesn't
	 * fill up.  But the correct solution isn't yet obvious.
	 * In any case, this check should at least let frames pass
	 * that we are direct-dispatching.
	 *
	 * XXX TODO: duplicate this to the raw xmit path!
	 */
	if (type == IEEE80211_FC0_TYPE_DATA &&
	    ATH_NODE(ni)->an_is_powersave &&
	    ATH_NODE(ni)->an_swq_depth >
	     sc->sc_txq_node_psq_maxdepth) {
		sc->sc_stats.ast_tx_node_psq_overflow++;
		m_freem(m0);
		return (ENOBUFS);
	}

	/* A-MPDU TX */
	is_ampdu_tx = ath_tx_ampdu_running(sc, ATH_NODE(ni), tid);
	is_ampdu_pending = ath_tx_ampdu_pending(sc, ATH_NODE(ni), tid);
	is_ampdu = is_ampdu_tx | is_ampdu_pending;

	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: tid=%d, ac=%d, is_ampdu=%d\n",
	    __func__, tid, pri, is_ampdu);

	/* Set local packet state, used to queue packets to hardware */
	bf->bf_state.bfs_tid = tid;
	bf->bf_state.bfs_tx_queue = txq->axq_qnum;
	bf->bf_state.bfs_pri = pri;

#if 1
	/*
	 * When servicing one or more stations in power-save mode
	 * (or) if there is some mcast data waiting on the mcast
	 * queue (to prevent out of order delivery) multicast frames
	 * must be bufferd until after the beacon.
	 *
	 * TODO: we should lock the mcastq before we check the length.
	 */
	if (sc->sc_cabq_enable && ismcast && (vap->iv_ps_sta || avp->av_mcastq.axq_depth)) {
		txq = &avp->av_mcastq;
		/*
		 * Mark the frame as eventually belonging on the CAB
		 * queue, so the descriptor setup functions will
		 * correctly initialise the descriptor 'qcuId' field.
		 */
		bf->bf_state.bfs_tx_queue = sc->sc_cabq->axq_qnum;
	}
#endif

	/* Do the generic frame setup */
	/* XXX should just bzero the bf_state? */
	bf->bf_state.bfs_dobaw = 0;

	/* A-MPDU TX? Manually set sequence number */
	/*
	 * Don't do it whilst pending; the net80211 layer still
	 * assigns them.
	 */
	if (is_ampdu_tx) {
		/*
		 * Always call; this function will
		 * handle making sure that null data frames
		 * don't get a sequence number from the current
		 * TID and thus mess with the BAW.
		 */
		seqno = ath_tx_tid_seqno_assign(sc, ni, bf, m0);

		/*
		 * Don't add QoS NULL frames to the BAW.
		 */
		if (IEEE80211_QOS_HAS_SEQ(wh) &&
		    subtype != IEEE80211_FC0_SUBTYPE_QOS_NULL) {
			bf->bf_state.bfs_dobaw = 1;
		}
	}

	/*
	 * If needed, the sequence number has been assigned.
	 * Squirrel it away somewhere easy to get to.
	 */
	bf->bf_state.bfs_seqno = M_SEQNO_GET(m0) << IEEE80211_SEQ_SEQ_SHIFT;

	/* Is ampdu pending? fetch the seqno and print it out */
	if (is_ampdu_pending)
		DPRINTF(sc, ATH_DEBUG_SW_TX,
		    "%s: tid %d: ampdu pending, seqno %d\n",
		    __func__, tid, M_SEQNO_GET(m0));

	/* This also sets up the DMA map */
	r = ath_tx_normal_setup(sc, ni, bf, m0, txq);

	if (r != 0)
		goto done;

	/* At this point m0 could have changed! */
	m0 = bf->bf_m;

#if 1
	/*
	 * If it's a multicast frame, do a direct-dispatch to the
	 * destination hardware queue. Don't bother software
	 * queuing it.
	 */
	/*
	 * If it's a BAR frame, do a direct dispatch to the
	 * destination hardware queue. Don't bother software
	 * queuing it, as the TID will now be paused.
	 * Sending a BAR frame can occur from the net80211 txa timer
	 * (ie, retries) or from the ath txtask (completion call.)
	 * It queues directly to hardware because the TID is paused
	 * at this point (and won't be unpaused until the BAR has
	 * either been TXed successfully or max retries has been
	 * reached.)
	 */
	/*
	 * Until things are better debugged - if this node is asleep
	 * and we're sending it a non-BAR frame, direct dispatch it.
	 * Why? Because we need to figure out what's actually being
	 * sent - eg, during reassociation/reauthentication after
	 * the node (last) disappeared whilst asleep, the driver should
	 * have unpaused/unsleep'ed the node.  So until that is
	 * sorted out, use this workaround.
	 */
	if (txq == &avp->av_mcastq) {
		DPRINTF(sc, ATH_DEBUG_SW_TX,
		    "%s: bf=%p: mcastq: TX'ing\n", __func__, bf);
		bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
		ath_tx_xmit_normal(sc, txq, bf);
	} else if (ath_tx_should_swq_frame(sc, ATH_NODE(ni), m0,
	    &queue_to_head)) {
		ath_tx_swq(sc, ni, txq, queue_to_head, bf);
	} else {
		bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
		ath_tx_xmit_normal(sc, txq, bf);
	}
#else
	/*
	 * For now, since there's no software queue,
	 * direct-dispatch to the hardware.
	 */
	bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
	/*
	 * Update the current leak count if
	 * we're leaking frames; and set the
	 * MORE flag as appropriate.
	 */
	ath_tx_leak_count_update(sc, tid, bf);
	ath_tx_xmit_normal(sc, txq, bf);
#endif
done:
	return 0;
}

static int
ath_tx_raw_start(struct ath_softc *sc, struct ieee80211_node *ni,
	struct ath_buf *bf, struct mbuf *m0,
	const struct ieee80211_bpf_params *params)
{
	struct ifnet *ifp = sc->sc_ifp;
	struct ieee80211com *ic = ifp->if_l2com;
	struct ath_hal *ah = sc->sc_ah;
	struct ieee80211vap *vap = ni->ni_vap;
	int error, ismcast, ismrr;
	int keyix, hdrlen, pktlen, try0, txantenna;
	u_int8_t rix, txrate;
	struct ieee80211_frame *wh;
	u_int flags;
	HAL_PKT_TYPE atype;
	const HAL_RATE_TABLE *rt;
	struct ath_desc *ds;
	u_int pri;
	int o_tid = -1;
	int do_override;
	uint8_t type, subtype;
	int queue_to_head;
	struct ath_node *an = ATH_NODE(ni);

	ATH_TX_LOCK_ASSERT(sc);

	wh = mtod(m0, struct ieee80211_frame *);
	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
	hdrlen = ieee80211_anyhdrsize(wh);
	/*
	 * Packet length must not include any
	 * pad bytes; deduct them here.
	 */
	/* XXX honor IEEE80211_BPF_DATAPAD */
	pktlen = m0->m_pkthdr.len - (hdrlen & 3) + IEEE80211_CRC_LEN;

	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;

	ATH_KTR(sc, ATH_KTR_TX, 2,
	     "ath_tx_raw_start: ni=%p, bf=%p, raw", ni, bf);

	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: ismcast=%d\n",
	    __func__, ismcast);

	pri = params->ibp_pri & 3;
	/* Override pri if the frame isn't a QoS one */
	if (! IEEE80211_QOS_HAS_SEQ(wh))
		pri = ath_tx_getac(sc, m0);

	/* XXX If it's an ADDBA, override the correct queue */
	do_override = ath_tx_action_frame_override_queue(sc, ni, m0, &o_tid);

	/* Map ADDBA to the correct priority */
	if (do_override) {
#if 0
		DPRINTF(sc, ATH_DEBUG_XMIT, 
		    "%s: overriding tid %d pri %d -> %d\n",
		    __func__, o_tid, pri, TID_TO_WME_AC(o_tid));
#endif
		pri = TID_TO_WME_AC(o_tid);
	}

	/* Handle encryption twiddling if needed */
	if (! ath_tx_tag_crypto(sc, ni,
	    m0, params->ibp_flags & IEEE80211_BPF_CRYPTO, 0,
	    &hdrlen, &pktlen, &keyix)) {
		ath_freetx(m0);
		return EIO;
	}
	/* packet header may have moved, reset our local pointer */
	wh = mtod(m0, struct ieee80211_frame *);

	/* Do the generic frame setup */
	/* XXX should just bzero the bf_state? */
	bf->bf_state.bfs_dobaw = 0;

	error = ath_tx_dmasetup(sc, bf, m0);
	if (error != 0)
		return error;
	m0 = bf->bf_m;				/* NB: may have changed */
	wh = mtod(m0, struct ieee80211_frame *);
	KASSERT((ni != NULL), ("%s: ni=NULL!", __func__));
	bf->bf_node = ni;			/* NB: held reference */

	/* Always enable CLRDMASK for raw frames for now.. */
	flags = HAL_TXDESC_CLRDMASK;		/* XXX needed for crypto errs */
	flags |= HAL_TXDESC_INTREQ;		/* force interrupt */
	if (params->ibp_flags & IEEE80211_BPF_RTS)
		flags |= HAL_TXDESC_RTSENA;
	else if (params->ibp_flags & IEEE80211_BPF_CTS) {
		/* XXX assume 11g/11n protection? */
		bf->bf_state.bfs_doprot = 1;
		flags |= HAL_TXDESC_CTSENA;
	}
	/* XXX leave ismcast to injector? */
	if ((params->ibp_flags & IEEE80211_BPF_NOACK) || ismcast)
		flags |= HAL_TXDESC_NOACK;

	rt = sc->sc_currates;
	KASSERT(rt != NULL, ("no rate table, mode %u", sc->sc_curmode));

	/* Fetch first rate information */
	rix = ath_tx_findrix(sc, params->ibp_rate0);
	try0 = params->ibp_try0;

	/*
	 * Override EAPOL rate as appropriate.
	 */
	if (m0->m_flags & M_EAPOL) {
		/* XXX? maybe always use long preamble? */
		rix = an->an_mgmtrix;
		try0 = ATH_TXMAXTRY;	/* XXX?too many? */
	}

	txrate = rt->info[rix].rateCode;
	if (params->ibp_flags & IEEE80211_BPF_SHORTPRE)
		txrate |= rt->info[rix].shortPreamble;
	sc->sc_txrix = rix;
	ismrr = (params->ibp_try1 != 0);
	txantenna = params->ibp_pri >> 2;
	if (txantenna == 0)			/* XXX? */
		txantenna = sc->sc_txantenna;

	/*
	 * Since ctsrate is fixed, store it away for later
	 * use when the descriptor fields are being set.
	 */
	if (flags & (HAL_TXDESC_RTSENA|HAL_TXDESC_CTSENA))
		bf->bf_state.bfs_ctsrate0 = params->ibp_ctsrate;

	/*
	 * NB: we mark all packets as type PSPOLL so the h/w won't
	 * set the sequence number, duration, etc.
	 */
	atype = HAL_PKT_TYPE_PSPOLL;

	if (IFF_DUMPPKTS(sc, ATH_DEBUG_XMIT))
		ieee80211_dump_pkt(ic, mtod(m0, caddr_t), m0->m_len,
		    sc->sc_hwmap[rix].ieeerate, -1);

	if (ieee80211_radiotap_active_vap(vap)) {
		u_int64_t tsf = ath_hal_gettsf64(ah);

		sc->sc_tx_th.wt_tsf = htole64(tsf);
		sc->sc_tx_th.wt_flags = sc->sc_hwmap[rix].txflags;
		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_WEP;
		if (m0->m_flags & M_FRAG)
			sc->sc_tx_th.wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
		sc->sc_tx_th.wt_rate = sc->sc_hwmap[rix].ieeerate;
		sc->sc_tx_th.wt_txpower = MIN(params->ibp_power,
		    ieee80211_get_node_txpower(ni));
		sc->sc_tx_th.wt_antenna = sc->sc_txantenna;

		ieee80211_radiotap_tx(vap, m0);
	}

	/*
	 * Formulate first tx descriptor with tx controls.
	 */
	ds = bf->bf_desc;
	/* XXX check return value? */

	/* Store the decided rate index values away */
	bf->bf_state.bfs_pktlen = pktlen;
	bf->bf_state.bfs_hdrlen = hdrlen;
	bf->bf_state.bfs_atype = atype;
	bf->bf_state.bfs_txpower = MIN(params->ibp_power,
	    ieee80211_get_node_txpower(ni));
	bf->bf_state.bfs_txrate0 = txrate;
	bf->bf_state.bfs_try0 = try0;
	bf->bf_state.bfs_keyix = keyix;
	bf->bf_state.bfs_txantenna = txantenna;
	bf->bf_state.bfs_txflags = flags;
	bf->bf_state.bfs_shpream =
	    !! (params->ibp_flags & IEEE80211_BPF_SHORTPRE);

	/* Set local packet state, used to queue packets to hardware */
	bf->bf_state.bfs_tid = WME_AC_TO_TID(pri);
	bf->bf_state.bfs_tx_queue = sc->sc_ac2q[pri]->axq_qnum;
	bf->bf_state.bfs_pri = pri;

	/* XXX this should be done in ath_tx_setrate() */
	bf->bf_state.bfs_ctsrate = 0;
	bf->bf_state.bfs_ctsduration = 0;
	bf->bf_state.bfs_ismrr = ismrr;

	/* Blank the legacy rate array */
	bzero(&bf->bf_state.bfs_rc, sizeof(bf->bf_state.bfs_rc));

	bf->bf_state.bfs_rc[0].rix = rix;
	bf->bf_state.bfs_rc[0].tries = try0;
	bf->bf_state.bfs_rc[0].ratecode = txrate;

	if (ismrr) {
		int rix;

		rix = ath_tx_findrix(sc, params->ibp_rate1);
		bf->bf_state.bfs_rc[1].rix = rix;
		bf->bf_state.bfs_rc[1].tries = params->ibp_try1;

		rix = ath_tx_findrix(sc, params->ibp_rate2);
		bf->bf_state.bfs_rc[2].rix = rix;
		bf->bf_state.bfs_rc[2].tries = params->ibp_try2;

		rix = ath_tx_findrix(sc, params->ibp_rate3);
		bf->bf_state.bfs_rc[3].rix = rix;
		bf->bf_state.bfs_rc[3].tries = params->ibp_try3;
	}
	/*
	 * All the required rate control decisions have been made;
	 * fill in the rc flags.
	 */
	ath_tx_rate_fill_rcflags(sc, bf);

	/* NB: no buffered multicast in power save support */

	/*
	 * If we're overiding the ADDBA destination, dump directly
	 * into the hardware queue, right after any pending
	 * frames to that node are.
	 */
	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: dooverride=%d\n",
	    __func__, do_override);

#if 1
	/*
	 * Put addba frames in the right place in the right TID/HWQ.
	 */
	if (do_override) {
		bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
		/*
		 * XXX if it's addba frames, should we be leaking
		 * them out via the frame leak method?
		 * XXX for now let's not risk it; but we may wish
		 * to investigate this later.
		 */
		ath_tx_xmit_normal(sc, sc->sc_ac2q[pri], bf);
	} else if (ath_tx_should_swq_frame(sc, ATH_NODE(ni), m0,
	    &queue_to_head)) {
		/* Queue to software queue */
		ath_tx_swq(sc, ni, sc->sc_ac2q[pri], queue_to_head, bf);
	} else {
		bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
		ath_tx_xmit_normal(sc, sc->sc_ac2q[pri], bf);
	}
#else
	/* Direct-dispatch to the hardware */
	bf->bf_state.bfs_txflags |= HAL_TXDESC_CLRDMASK;
	/*
	 * Update the current leak count if
	 * we're leaking frames; and set the
	 * MORE flag as appropriate.
	 */
	ath_tx_leak_count_update(sc, tid, bf);
	ath_tx_xmit_normal(sc, sc->sc_ac2q[pri], bf);
#endif
	return 0;
}

/*
 * Send a raw frame.
 *
 * This can be called by net80211.
 */
int
ath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
	const struct ieee80211_bpf_params *params)
{
	struct ieee80211com *ic = ni->ni_ic;
	struct ifnet *ifp = ic->ic_ifp;
	struct ath_softc *sc = ifp->if_softc;
	struct ath_buf *bf;
	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
	int error = 0;

	ATH_PCU_LOCK(sc);
	if (sc->sc_inreset_cnt > 0) {
		DPRINTF(sc, ATH_DEBUG_XMIT, 
		    "%s: sc_inreset_cnt > 0; bailing\n", __func__);
		error = EIO;
		ATH_PCU_UNLOCK(sc);
		goto badbad;
	}
	sc->sc_txstart_cnt++;
	ATH_PCU_UNLOCK(sc);

	/* Wake the hardware up already */
	ath_power_set_power_state(sc, HAL_PM_AWAKE);

	ATH_TX_LOCK(sc);

	if ((ifp->if_flags & IFF_RUNNING) == 0 || sc->sc_invalid) {
		DPRINTF(sc, ATH_DEBUG_XMIT, "%s: discard frame, %s", __func__,
		    (ifp->if_flags & IFF_RUNNING) == 0 ?
			"!running" : "invalid");
		m_freem(m);
		error = ENETDOWN;
		goto bad;
	}

	/*
	 * Enforce how deep the multicast queue can grow.
	 *
	 * XXX duplicated in ath_tx_start().
	 */
	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
		if (sc->sc_cabq->axq_depth + sc->sc_cabq->fifo.axq_depth
		    > sc->sc_txq_mcastq_maxdepth) {
			sc->sc_stats.ast_tx_mcastq_overflow++;
			error = ENOBUFS;
		}

		if (error != 0) {
			m_freem(m);
			goto bad;
		}
	}

	/*
	 * Grab a TX buffer and associated resources.
	 */
	bf = ath_getbuf(sc, ATH_BUFTYPE_MGMT);
	if (bf == NULL) {
		sc->sc_stats.ast_tx_nobuf++;
		m_freem(m);
		error = ENOBUFS;
		goto bad;
	}
	ATH_KTR(sc, ATH_KTR_TX, 3, "ath_raw_xmit: m=%p, params=%p, bf=%p\n",
	    m, params,  bf);

	if (params == NULL) {
		/*
		 * Legacy path; interpret frame contents to decide
		 * precisely how to send the frame.
		 */
		if (ath_tx_start(sc, ni, bf, m)) {
			error = EIO;		/* XXX */
			goto bad2;
		}
	} else {
		/*
		 * Caller supplied explicit parameters to use in
		 * sending the frame.
		 */
		if (ath_tx_raw_start(sc, ni, bf, m, params)) {
			error = EIO;		/* XXX */
			goto bad2;
		}
	}
	sc->sc_wd_timer = 5;
	ifp->if_opackets++;
	sc->sc_stats.ast_tx_raw++;

	/*
	 * Update the TIM - if there's anything queued to the
	 * software queue and power save is enabled, we should
	 * set the TIM.
	 */
	ath_tx_update_tim(sc, ni, 1);

	ATH_TX_UNLOCK(sc);

	ATH_PCU_LOCK(sc);
	sc->sc_txstart_cnt--;
	ATH_PCU_UNLOCK(sc);


	/* Put the hardware back to sleep if required */
	ath_power_restore_power_state(sc);

	return 0;

bad2:
	ATH_KTR(sc, ATH_KTR_TX, 3, "ath_raw_xmit: bad2: m=%p, params=%p, "
	    "bf=%p",
	    m,
	    params,
	    bf);
	ATH_TXBUF_LOCK(sc);
	ath_returnbuf_head(sc, bf);
	ATH_TXBUF_UNLOCK(sc);

bad:
	ATH_TX_UNLOCK(sc);

	ATH_PCU_LOCK(sc);
	sc->sc_txstart_cnt--;
	ATH_PCU_UNLOCK(sc);

	/* Put the hardware back to sleep if required */
	ath_power_restore_power_state(sc);

badbad:
	ATH_KTR(sc, ATH_KTR_TX, 2, "ath_raw_xmit: bad0: m=%p, params=%p",
	    m, params);
	ifp->if_oerrors++;
	sc->sc_stats.ast_tx_raw_fail++;
	ieee80211_free_node(ni);

	return error;
}

/* Some helper functions */

/*
 * ADDBA (and potentially others) need to be placed in the same
 * hardware queue as the TID/node it's relating to. This is so
 * it goes out after any pending non-aggregate frames to the
 * same node/TID.
 *
 * If this isn't done, the ADDBA can go out before the frames
 * queued in hardware. Even though these frames have a sequence
 * number -earlier- than the ADDBA can be transmitted (but
 * no frames whose sequence numbers are after the ADDBA should
 * be!) they'll arrive after the ADDBA - and the receiving end
 * will simply drop them as being out of the BAW.
 *
 * The frames can't be appended to the TID software queue - it'll
 * never be sent out. So these frames have to be directly
 * dispatched to the hardware, rather than queued in software.
 * So if this function returns true, the TXQ has to be
 * overridden and it has to be directly dispatched.
 *
 * It's a dirty hack, but someone's gotta do it.
 */

/*
 * XXX doesn't belong here!
 */
static int
ieee80211_is_action(struct ieee80211_frame *wh)
{
	/* Type: Management frame? */
	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
	    IEEE80211_FC0_TYPE_MGT)
		return 0;

	/* Subtype: Action frame? */
	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) !=
	    IEEE80211_FC0_SUBTYPE_ACTION)
		return 0;

	return 1;
}

#define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
/*
 * Return an alternate TID for ADDBA request frames.
 *
 * Yes, this likely should be done in the net80211 layer.
 */
static int
ath_tx_action_frame_override_queue(struct ath_softc *sc,
    struct ieee80211_node *ni,
    struct mbuf *m0, int *tid)
{
	struct ieee80211_frame *wh = mtod(m0, struct ieee80211_frame *);
	struct ieee80211_action_ba_addbarequest *ia;
	uint8_t *frm;
	uint16_t baparamset;

	/* Not action frame? Bail */
	if (! ieee80211_is_action(wh))
		return 0;

	/* XXX Not needed for frames we send? */
#if 0
	/* Correct length? */
	if (! ieee80211_parse_action(ni, m))
		return 0;
#endif

	/* Extract out action frame */
	frm = (u_int8_t *)&wh[1];
	ia = (struct ieee80211_action_ba_addbarequest *) frm;

	/* Not ADDBA? Bail */
	if (ia->rq_header.ia_category != IEEE80211_ACTION_CAT_BA)
		return 0;
	if (ia->rq_header.ia_action != IEEE80211_ACTION_BA_ADDBA_REQUEST)
		return 0;

	/* Extract TID, return it */
	baparamset = le16toh(ia->rq_baparamset);
	*tid = (int) MS(baparamset, IEEE80211_BAPS_TID);

	return 1;
}
#undef	MS

/* Per-node software queue operations */

/*
 * Add the current packet to the given BAW.
 * It is assumed that the current packet
 *
 * + fits inside the BAW;
 * + already has had a sequence number allocated.
 *
 * Since the BAW status may be modified by both the ath task and
 * the net80211/ifnet contexts, the TID must be locked.
 */
void
ath_tx_addto_baw(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, struct ath_buf *bf)
{
	int index, cindex;
	struct ieee80211_tx_ampdu *tap;

	ATH_TX_LOCK_ASSERT(sc);

	if (bf->bf_state.bfs_isretried)
		return;

	tap = ath_tx_get_tx_tid(an, tid->tid);

	if (! bf->bf_state.bfs_dobaw) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: dobaw=0, seqno=%d, window %d:%d\n",
		    __func__, SEQNO(bf->bf_state.bfs_seqno),
		    tap->txa_start, tap->txa_wnd);
	}

	if (bf->bf_state.bfs_addedbaw)
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: re-added? tid=%d, seqno %d; window %d:%d; "
		    "baw head=%d tail=%d\n",
		    __func__, tid->tid, SEQNO(bf->bf_state.bfs_seqno),
		    tap->txa_start, tap->txa_wnd, tid->baw_head,
		    tid->baw_tail);

	/*
	 * Verify that the given sequence number is not outside of the
	 * BAW.  Complain loudly if that's the case.
	 */
	if (! BAW_WITHIN(tap->txa_start, tap->txa_wnd,
	    SEQNO(bf->bf_state.bfs_seqno))) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: bf=%p: outside of BAW?? tid=%d, seqno %d; window %d:%d; "
		    "baw head=%d tail=%d\n",
		    __func__, bf, tid->tid, SEQNO(bf->bf_state.bfs_seqno),
		    tap->txa_start, tap->txa_wnd, tid->baw_head,
		    tid->baw_tail);
	}

	/*
	 * ni->ni_txseqs[] is the currently allocated seqno.
	 * the txa state contains the current baw start.
	 */
	index  = ATH_BA_INDEX(tap->txa_start, SEQNO(bf->bf_state.bfs_seqno));
	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);
	DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
	    "%s: tid=%d, seqno %d; window %d:%d; index=%d cindex=%d "
	    "baw head=%d tail=%d\n",
	    __func__, tid->tid, SEQNO(bf->bf_state.bfs_seqno),
	    tap->txa_start, tap->txa_wnd, index, cindex, tid->baw_head,
	    tid->baw_tail);


#if 0
	assert(tid->tx_buf[cindex] == NULL);
#endif
	if (tid->tx_buf[cindex] != NULL) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: ba packet dup (index=%d, cindex=%d, "
		    "head=%d, tail=%d)\n",
		    __func__, index, cindex, tid->baw_head, tid->baw_tail);
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: BA bf: %p; seqno=%d ; new bf: %p; seqno=%d\n",
		    __func__,
		    tid->tx_buf[cindex],
		    SEQNO(tid->tx_buf[cindex]->bf_state.bfs_seqno),
		    bf,
		    SEQNO(bf->bf_state.bfs_seqno)
		);
	}
	tid->tx_buf[cindex] = bf;

	if (index >= ((tid->baw_tail - tid->baw_head) &
	    (ATH_TID_MAX_BUFS - 1))) {
		tid->baw_tail = cindex;
		INCR(tid->baw_tail, ATH_TID_MAX_BUFS);
	}
}

/*
 * Flip the BAW buffer entry over from the existing one to the new one.
 *
 * When software retransmitting a (sub-)frame, it is entirely possible that
 * the frame ath_buf is marked as BUSY and can't be immediately reused.
 * In that instance the buffer is cloned and the new buffer is used for
 * retransmit. We thus need to update the ath_buf slot in the BAW buf
 * tracking array to maintain consistency.
 */
static void
ath_tx_switch_baw_buf(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, struct ath_buf *old_bf, struct ath_buf *new_bf)
{
	int index, cindex;
	struct ieee80211_tx_ampdu *tap;
	int seqno = SEQNO(old_bf->bf_state.bfs_seqno);

	ATH_TX_LOCK_ASSERT(sc);

	tap = ath_tx_get_tx_tid(an, tid->tid);
	index  = ATH_BA_INDEX(tap->txa_start, seqno);
	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);

	/*
	 * Just warn for now; if it happens then we should find out
	 * about it. It's highly likely the aggregation session will
	 * soon hang.
	 */
	if (old_bf->bf_state.bfs_seqno != new_bf->bf_state.bfs_seqno) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: retransmitted buffer"
		    " has mismatching seqno's, BA session may hang.\n",
		    __func__);
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: old seqno=%d, new_seqno=%d\n", __func__,
		    old_bf->bf_state.bfs_seqno, new_bf->bf_state.bfs_seqno);
	}

	if (tid->tx_buf[cindex] != old_bf) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: ath_buf pointer incorrect; "
		    " has m BA session may hang.\n", __func__);
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: old bf=%p, new bf=%p\n", __func__, old_bf, new_bf);
	}

	tid->tx_buf[cindex] = new_bf;
}

/*
 * seq_start - left edge of BAW
 * seq_next - current/next sequence number to allocate
 *
 * Since the BAW status may be modified by both the ath task and
 * the net80211/ifnet contexts, the TID must be locked.
 */
static void
ath_tx_update_baw(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, const struct ath_buf *bf)
{
	int index, cindex;
	struct ieee80211_tx_ampdu *tap;
	int seqno = SEQNO(bf->bf_state.bfs_seqno);

	ATH_TX_LOCK_ASSERT(sc);

	tap = ath_tx_get_tx_tid(an, tid->tid);
	index  = ATH_BA_INDEX(tap->txa_start, seqno);
	cindex = (tid->baw_head + index) & (ATH_TID_MAX_BUFS - 1);

	DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
	    "%s: tid=%d, baw=%d:%d, seqno=%d, index=%d, cindex=%d, "
	    "baw head=%d, tail=%d\n",
	    __func__, tid->tid, tap->txa_start, tap->txa_wnd, seqno, index,
	    cindex, tid->baw_head, tid->baw_tail);

	/*
	 * If this occurs then we have a big problem - something else
	 * has slid tap->txa_start along without updating the BAW
	 * tracking start/end pointers. Thus the TX BAW state is now
	 * completely busted.
	 *
	 * But for now, since I haven't yet fixed TDMA and buffer cloning,
	 * it's quite possible that a cloned buffer is making its way
	 * here and causing it to fire off. Disable TDMA for now.
	 */
	if (tid->tx_buf[cindex] != bf) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
		    "%s: comp bf=%p, seq=%d; slot bf=%p, seqno=%d\n",
		    __func__, bf, SEQNO(bf->bf_state.bfs_seqno),
		    tid->tx_buf[cindex],
		    (tid->tx_buf[cindex] != NULL) ?
		      SEQNO(tid->tx_buf[cindex]->bf_state.bfs_seqno) : -1);
	}

	tid->tx_buf[cindex] = NULL;

	while (tid->baw_head != tid->baw_tail &&
	    !tid->tx_buf[tid->baw_head]) {
		INCR(tap->txa_start, IEEE80211_SEQ_RANGE);
		INCR(tid->baw_head, ATH_TID_MAX_BUFS);
	}
	DPRINTF(sc, ATH_DEBUG_SW_TX_BAW,
	    "%s: tid=%d: baw is now %d:%d, baw head=%d\n",
	    __func__, tid->tid, tap->txa_start, tap->txa_wnd, tid->baw_head);
}

static void
ath_tx_leak_count_update(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf)
{
	struct ieee80211_frame *wh;

	ATH_TX_LOCK_ASSERT(sc);

	if (tid->an->an_leak_count > 0) {
		wh = mtod(bf->bf_m, struct ieee80211_frame *);

		/*
		 * Update MORE based on the software/net80211 queue states.
		 */
		if ((tid->an->an_stack_psq > 0)
		    || (tid->an->an_swq_depth > 0))
			wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
		else
			wh->i_fc[1] &= ~IEEE80211_FC1_MORE_DATA;

		DPRINTF(sc, ATH_DEBUG_NODE_PWRSAVE,
		    "%s: %s: leak count = %d, psq=%d, swq=%d, MORE=%d\n",
		    __func__,
		    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
		    tid->an->an_leak_count,
		    tid->an->an_stack_psq,
		    tid->an->an_swq_depth,
		    !! (wh->i_fc[1] & IEEE80211_FC1_MORE_DATA));

		/*
		 * Re-sync the underlying buffer.
		 */
		bus_dmamap_sync(sc->sc_dmat, bf->bf_dmamap,
		    BUS_DMASYNC_PREWRITE);

		tid->an->an_leak_count --;
	}
}

static int
ath_tx_tid_can_tx_or_sched(struct ath_softc *sc, struct ath_tid *tid)
{

	ATH_TX_LOCK_ASSERT(sc);

	if (tid->an->an_leak_count > 0) {
		return (1);
	}
	if (tid->paused)
		return (0);
	return (1);
}

/*
 * Mark the current node/TID as ready to TX.
 *
 * This is done to make it easy for the software scheduler to
 * find which nodes have data to send.
 *
 * The TXQ lock must be held.
 */
void
ath_tx_tid_sched(struct ath_softc *sc, struct ath_tid *tid)
{
	struct ath_txq *txq = sc->sc_ac2q[tid->ac];

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * If we are leaking out a frame to this destination
	 * for PS-POLL, ensure that we allow scheduling to
	 * occur.
	 */
	if (! ath_tx_tid_can_tx_or_sched(sc, tid))
		return;		/* paused, can't schedule yet */

	if (tid->sched)
		return;		/* already scheduled */

	tid->sched = 1;

#if 0
	/*
	 * If this is a sleeping node we're leaking to, given
	 * it a higher priority.  This is so bad for QoS it hurts.
	 */
	if (tid->an->an_leak_count) {
		TAILQ_INSERT_HEAD(&txq->axq_tidq, tid, axq_qelem);
	} else {
		TAILQ_INSERT_TAIL(&txq->axq_tidq, tid, axq_qelem);
	}
#endif

	/*
	 * We can't do the above - it'll confuse the TXQ software
	 * scheduler which will keep checking the _head_ TID
	 * in the list to see if it has traffic.  If we queue
	 * a TID to the head of the list and it doesn't transmit,
	 * we'll check it again.
	 *
	 * So, get the rest of this leaking frames support working
	 * and reliable first and _then_ optimise it so they're
	 * pushed out in front of any other pending software
	 * queued nodes.
	 */
	TAILQ_INSERT_TAIL(&txq->axq_tidq, tid, axq_qelem);
}

/*
 * Mark the current node as no longer needing to be polled for
 * TX packets.
 *
 * The TXQ lock must be held.
 */
static void
ath_tx_tid_unsched(struct ath_softc *sc, struct ath_tid *tid)
{
	struct ath_txq *txq = sc->sc_ac2q[tid->ac];

	ATH_TX_LOCK_ASSERT(sc);

	if (tid->sched == 0)
		return;

	tid->sched = 0;
	TAILQ_REMOVE(&txq->axq_tidq, tid, axq_qelem);
}

/*
 * Assign a sequence number manually to the given frame.
 *
 * This should only be called for A-MPDU TX frames.
 */
static ieee80211_seq
ath_tx_tid_seqno_assign(struct ath_softc *sc, struct ieee80211_node *ni,
    struct ath_buf *bf, struct mbuf *m0)
{
	struct ieee80211_frame *wh;
	int tid, pri;
	ieee80211_seq seqno;
	uint8_t subtype;

	/* TID lookup */
	wh = mtod(m0, struct ieee80211_frame *);
	pri = M_WME_GETAC(m0);			/* honor classification */
	tid = WME_AC_TO_TID(pri);
	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: pri=%d, tid=%d, qos has seq=%d\n",
	    __func__, pri, tid, IEEE80211_QOS_HAS_SEQ(wh));

	/* XXX Is it a control frame? Ignore */

	/* Does the packet require a sequence number? */
	if (! IEEE80211_QOS_HAS_SEQ(wh))
		return -1;

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * Is it a QOS NULL Data frame? Give it a sequence number from
	 * the default TID (IEEE80211_NONQOS_TID.)
	 *
	 * The RX path of everything I've looked at doesn't include the NULL
	 * data frame sequence number in the aggregation state updates, so
	 * assigning it a sequence number there will cause a BAW hole on the
	 * RX side.
	 */
	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
	if (subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL) {
		/* XXX no locking for this TID? This is a bit of a problem. */
		seqno = ni->ni_txseqs[IEEE80211_NONQOS_TID];
		INCR(ni->ni_txseqs[IEEE80211_NONQOS_TID], IEEE80211_SEQ_RANGE);
	} else {
		/* Manually assign sequence number */
		seqno = ni->ni_txseqs[tid];
		INCR(ni->ni_txseqs[tid], IEEE80211_SEQ_RANGE);
	}
	*(uint16_t *)&wh->i_seq[0] = htole16(seqno << IEEE80211_SEQ_SEQ_SHIFT);
	M_SEQNO_SET(m0, seqno);

	/* Return so caller can do something with it if needed */
	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s:  -> seqno=%d\n", __func__, seqno);
	return seqno;
}

/*
 * Attempt to direct dispatch an aggregate frame to hardware.
 * If the frame is out of BAW, queue.
 * Otherwise, schedule it as a single frame.
 */
static void
ath_tx_xmit_aggr(struct ath_softc *sc, struct ath_node *an,
    struct ath_txq *txq, struct ath_buf *bf)
{
	struct ath_tid *tid = &an->an_tid[bf->bf_state.bfs_tid];
	struct ieee80211_tx_ampdu *tap;

	ATH_TX_LOCK_ASSERT(sc);

	tap = ath_tx_get_tx_tid(an, tid->tid);

	/* paused? queue */
	if (! ath_tx_tid_can_tx_or_sched(sc, tid)) {
		ATH_TID_INSERT_HEAD(tid, bf, bf_list);
		/* XXX don't sched - we're paused! */
		return;
	}

	/* outside baw? queue */
	if (bf->bf_state.bfs_dobaw &&
	    (! BAW_WITHIN(tap->txa_start, tap->txa_wnd,
	    SEQNO(bf->bf_state.bfs_seqno)))) {
		ATH_TID_INSERT_HEAD(tid, bf, bf_list);
		ath_tx_tid_sched(sc, tid);
		return;
	}

	/*
	 * This is a temporary check and should be removed once
	 * all the relevant code paths have been fixed.
	 *
	 * During aggregate retries, it's possible that the head
	 * frame will fail (which has the bfs_aggr and bfs_nframes
	 * fields set for said aggregate) and will be retried as
	 * a single frame.  In this instance, the values should
	 * be reset or the completion code will get upset with you.
	 */
	if (bf->bf_state.bfs_aggr != 0 || bf->bf_state.bfs_nframes > 1) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_AGGR,
		    "%s: bfs_aggr=%d, bfs_nframes=%d\n", __func__,
		    bf->bf_state.bfs_aggr, bf->bf_state.bfs_nframes);
		bf->bf_state.bfs_aggr = 0;
		bf->bf_state.bfs_nframes = 1;
	}

	/* Update CLRDMASK just before this frame is queued */
	ath_tx_update_clrdmask(sc, tid, bf);

	/* Direct dispatch to hardware */
	ath_tx_do_ratelookup(sc, bf);
	ath_tx_calc_duration(sc, bf);
	ath_tx_calc_protection(sc, bf);
	ath_tx_set_rtscts(sc, bf);
	ath_tx_rate_fill_rcflags(sc, bf);
	ath_tx_setds(sc, bf);

	/* Statistics */
	sc->sc_aggr_stats.aggr_low_hwq_single_pkt++;

	/* Track per-TID hardware queue depth correctly */
	tid->hwq_depth++;

	/* Add to BAW */
	if (bf->bf_state.bfs_dobaw) {
		ath_tx_addto_baw(sc, an, tid, bf);
		bf->bf_state.bfs_addedbaw = 1;
	}

	/* Set completion handler, multi-frame aggregate or not */
	bf->bf_comp = ath_tx_aggr_comp;

	/*
	 * Update the current leak count if
	 * we're leaking frames; and set the
	 * MORE flag as appropriate.
	 */
	ath_tx_leak_count_update(sc, tid, bf);

	/* Hand off to hardware */
	ath_tx_handoff(sc, txq, bf);
}

/*
 * Attempt to send the packet.
 * If the queue isn't busy, direct-dispatch.
 * If the queue is busy enough, queue the given packet on the
 *  relevant software queue.
 */
void
ath_tx_swq(struct ath_softc *sc, struct ieee80211_node *ni,
    struct ath_txq *txq, int queue_to_head, struct ath_buf *bf)
{
	struct ath_node *an = ATH_NODE(ni);
	struct ieee80211_frame *wh;
	struct ath_tid *atid;
	int pri, tid;
	struct mbuf *m0 = bf->bf_m;

	ATH_TX_LOCK_ASSERT(sc);

	/* Fetch the TID - non-QoS frames get assigned to TID 16 */
	wh = mtod(m0, struct ieee80211_frame *);
	pri = ath_tx_getac(sc, m0);
	tid = ath_tx_gettid(sc, m0);
	atid = &an->an_tid[tid];

	DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: bf=%p, pri=%d, tid=%d, qos=%d\n",
	    __func__, bf, pri, tid, IEEE80211_QOS_HAS_SEQ(wh));

	/* Set local packet state, used to queue packets to hardware */
	/* XXX potentially duplicate info, re-check */
	bf->bf_state.bfs_tid = tid;
	bf->bf_state.bfs_tx_queue = txq->axq_qnum;
	bf->bf_state.bfs_pri = pri;

	/*
	 * If the hardware queue isn't busy, queue it directly.
	 * If the hardware queue is busy, queue it.
	 * If the TID is paused or the traffic it outside BAW, software
	 * queue it.
	 *
	 * If the node is in power-save and we're leaking a frame,
	 * leak a single frame.
	 */
	if (! ath_tx_tid_can_tx_or_sched(sc, atid)) {
		/* TID is paused, queue */
		DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: paused\n", __func__);
		/*
		 * If the caller requested that it be sent at a high
		 * priority, queue it at the head of the list.
		 */
		if (queue_to_head)
			ATH_TID_INSERT_HEAD(atid, bf, bf_list);
		else
			ATH_TID_INSERT_TAIL(atid, bf, bf_list);
	} else if (ath_tx_ampdu_pending(sc, an, tid)) {
		/* AMPDU pending; queue */
		DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: pending\n", __func__);
		ATH_TID_INSERT_TAIL(atid, bf, bf_list);
		/* XXX sched? */
	} else if (ath_tx_ampdu_running(sc, an, tid)) {
		/* AMPDU running, attempt direct dispatch if possible */

		/*
		 * Always queue the frame to the tail of the list.
		 */
		ATH_TID_INSERT_TAIL(atid, bf, bf_list);

		/*
		 * If the hardware queue isn't busy, direct dispatch
		 * the head frame in the list.  Don't schedule the
		 * TID - let it build some more frames first?
		 *
		 * When running A-MPDU, always just check the hardware
		 * queue depth against the aggregate frame limit.
		 * We don't want to burst a large number of single frames
		 * out to the hardware; we want to aggressively hold back.
		 *
		 * Otherwise, schedule the TID.
		 */
		/* XXX TXQ locking */
		if (txq->axq_depth + txq->fifo.axq_depth < sc->sc_hwq_limit_aggr) {
			bf = ATH_TID_FIRST(atid);
			ATH_TID_REMOVE(atid, bf, bf_list);

			/*
			 * Ensure it's definitely treated as a non-AMPDU
			 * frame - this information may have been left
			 * over from a previous attempt.
			 */
			bf->bf_state.bfs_aggr = 0;
			bf->bf_state.bfs_nframes = 1;

			/* Queue to the hardware */
			ath_tx_xmit_aggr(sc, an, txq, bf);
			DPRINTF(sc, ATH_DEBUG_SW_TX,
			    "%s: xmit_aggr\n",
			    __func__);
		} else {
			DPRINTF(sc, ATH_DEBUG_SW_TX,
			    "%s: ampdu; swq'ing\n",
			    __func__);

			ath_tx_tid_sched(sc, atid);
		}
	/*
	 * If we're not doing A-MPDU, be prepared to direct dispatch
	 * up to both limits if possible.  This particular corner
	 * case may end up with packet starvation between aggregate
	 * traffic and non-aggregate traffic: we wnat to ensure
	 * that non-aggregate stations get a few frames queued to the
	 * hardware before the aggregate station(s) get their chance.
	 *
	 * So if you only ever see a couple of frames direct dispatched
	 * to the hardware from a non-AMPDU client, check both here
	 * and in the software queue dispatcher to ensure that those
	 * non-AMPDU stations get a fair chance to transmit.
	 */
	/* XXX TXQ locking */
	} else if ((txq->axq_depth + txq->fifo.axq_depth < sc->sc_hwq_limit_nonaggr) &&
		    (txq->axq_aggr_depth < sc->sc_hwq_limit_aggr)) {
		/* AMPDU not running, attempt direct dispatch */
		DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: xmit_normal\n", __func__);
		/* See if clrdmask needs to be set */
		ath_tx_update_clrdmask(sc, atid, bf);

		/*
		 * Update the current leak count if
		 * we're leaking frames; and set the
		 * MORE flag as appropriate.
		 */
		ath_tx_leak_count_update(sc, atid, bf);

		/*
		 * Dispatch the frame.
		 */
		ath_tx_xmit_normal(sc, txq, bf);
	} else {
		/* Busy; queue */
		DPRINTF(sc, ATH_DEBUG_SW_TX, "%s: swq'ing\n", __func__);
		ATH_TID_INSERT_TAIL(atid, bf, bf_list);
		ath_tx_tid_sched(sc, atid);
	}
}

/*
 * Only set the clrdmask bit if none of the nodes are currently
 * filtered.
 *
 * XXX TODO: go through all the callers and check to see
 * which are being called in the context of looping over all
 * TIDs (eg, if all tids are being paused, resumed, etc.)
 * That'll avoid O(n^2) complexity here.
 */
static void
ath_tx_set_clrdmask(struct ath_softc *sc, struct ath_node *an)
{
	int i;

	ATH_TX_LOCK_ASSERT(sc);

	for (i = 0; i < IEEE80211_TID_SIZE; i++) {
		if (an->an_tid[i].isfiltered == 1)
			return;
	}
	an->clrdmask = 1;
}

/*
 * Configure the per-TID node state.
 *
 * This likely belongs in if_ath_node.c but I can't think of anywhere
 * else to put it just yet.
 *
 * This sets up the SLISTs and the mutex as appropriate.
 */
void
ath_tx_tid_init(struct ath_softc *sc, struct ath_node *an)
{
	int i, j;
	struct ath_tid *atid;

	for (i = 0; i < IEEE80211_TID_SIZE; i++) {
		atid = &an->an_tid[i];

		/* XXX now with this bzer(), is the field 0'ing needed? */
		bzero(atid, sizeof(*atid));

		TAILQ_INIT(&atid->tid_q);
		TAILQ_INIT(&atid->filtq.tid_q);
		atid->tid = i;
		atid->an = an;
		for (j = 0; j < ATH_TID_MAX_BUFS; j++)
			atid->tx_buf[j] = NULL;
		atid->baw_head = atid->baw_tail = 0;
		atid->paused = 0;
		atid->sched = 0;
		atid->hwq_depth = 0;
		atid->cleanup_inprogress = 0;
		if (i == IEEE80211_NONQOS_TID)
			atid->ac = ATH_NONQOS_TID_AC;
		else
			atid->ac = TID_TO_WME_AC(i);
	}
	an->clrdmask = 1;	/* Always start by setting this bit */
}

/*
 * Pause the current TID. This stops packets from being transmitted
 * on it.
 *
 * Since this is also called from upper layers as well as the driver,
 * it will get the TID lock.
 */
static void
ath_tx_tid_pause(struct ath_softc *sc, struct ath_tid *tid)
{

	ATH_TX_LOCK_ASSERT(sc);
	tid->paused++;
	DPRINTF(sc, ATH_DEBUG_SW_TX_CTRL, "%s: [%s]: tid=%d, paused = %d\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid,
	    tid->paused);
}

/*
 * Unpause the current TID, and schedule it if needed.
 */
static void
ath_tx_tid_resume(struct ath_softc *sc, struct ath_tid *tid)
{
	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * There's some odd places where ath_tx_tid_resume() is called
	 * when it shouldn't be; this works around that particular issue
	 * until it's actually resolved.
	 */
	if (tid->paused == 0) {
		device_printf(sc->sc_dev,
			      "%s: [%s]: tid=%d, paused=0?\n",
			      __func__,
			      ath_hal_ether_sprintf(
						tid->an->an_node.ni_macaddr),
			      tid->tid);
	} else {
		tid->paused--;
	}

	DPRINTF(sc, ATH_DEBUG_SW_TX_CTRL,
	    "%s: [%s]: tid=%d, unpaused = %d\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid,
	    tid->paused);

	if (tid->paused)
		return;

	/*
	 * Override the clrdmask configuration for the next frame
	 * from this TID, just to get the ball rolling.
	 */
	ath_tx_set_clrdmask(sc, tid->an);

	if (tid->axq_depth == 0)
		return;

	/* XXX isfiltered shouldn't ever be 0 at this point */
	if (tid->isfiltered == 1) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_CTRL, "%s: filtered?!\n",
		    __func__);
		return;
	}

	ath_tx_tid_sched(sc, tid);

	/*
	 * Queue the software TX scheduler.
	 */
	ath_tx_swq_kick(sc);
}

/*
 * Add the given ath_buf to the TID filtered frame list.
 * This requires the TID be filtered.
 */
static void
ath_tx_tid_filt_addbuf(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf)
{

	ATH_TX_LOCK_ASSERT(sc);

	if (!tid->isfiltered)
		DPRINTF(sc, ATH_DEBUG_SW_TX_FILT, "%s: not filtered?!\n",
		    __func__);

	DPRINTF(sc, ATH_DEBUG_SW_TX_FILT, "%s: bf=%p\n", __func__, bf);

	/* Set the retry bit and bump the retry counter */
	ath_tx_set_retry(sc, bf);
	sc->sc_stats.ast_tx_swfiltered++;

	ATH_TID_FILT_INSERT_TAIL(tid, bf, bf_list);
}

/*
 * Handle a completed filtered frame from the given TID.
 * This just enables/pauses the filtered frame state if required
 * and appends the filtered frame to the filtered queue.
 */
static void
ath_tx_tid_filt_comp_buf(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf)
{

	ATH_TX_LOCK_ASSERT(sc);

	if (! tid->isfiltered) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_FILT, "%s: tid=%d; filter transition\n",
		    __func__, tid->tid);
		tid->isfiltered = 1;
		ath_tx_tid_pause(sc, tid);
	}

	/* Add the frame to the filter queue */
	ath_tx_tid_filt_addbuf(sc, tid, bf);
}

/*
 * Complete the filtered frame TX completion.
 *
 * If there are no more frames in the hardware queue, unpause/unfilter
 * the TID if applicable.  Otherwise we will wait for a node PS transition
 * to unfilter.
 */
static void
ath_tx_tid_filt_comp_complete(struct ath_softc *sc, struct ath_tid *tid)
{
	struct ath_buf *bf;
	int do_resume = 0;

	ATH_TX_LOCK_ASSERT(sc);

	if (tid->hwq_depth != 0)
		return;

	DPRINTF(sc, ATH_DEBUG_SW_TX_FILT, "%s: tid=%d, hwq=0, transition back\n",
	    __func__, tid->tid);
	if (tid->isfiltered == 1) {
		tid->isfiltered = 0;
		do_resume = 1;
	}

	/* XXX ath_tx_tid_resume() also calls ath_tx_set_clrdmask()! */
	ath_tx_set_clrdmask(sc, tid->an);

	/* XXX this is really quite inefficient */
	while ((bf = ATH_TID_FILT_LAST(tid, ath_bufhead_s)) != NULL) {
		ATH_TID_FILT_REMOVE(tid, bf, bf_list);
		ATH_TID_INSERT_HEAD(tid, bf, bf_list);
	}

	/* And only resume if we had paused before */
	if (do_resume)
		ath_tx_tid_resume(sc, tid);
}

/*
 * Called when a single (aggregate or otherwise) frame is completed.
 *
 * Returns 0 if the buffer could be added to the filtered list
 * (cloned or otherwise), 1 if the buffer couldn't be added to the
 * filtered list (failed clone; expired retry) and the caller should
 * free it and handle it like a failure (eg by sending a BAR.)
 *
 * since the buffer may be cloned, bf must be not touched after this
 * if the return value is 0.
 */
static int
ath_tx_tid_filt_comp_single(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf)
{
	struct ath_buf *nbf;
	int retval;

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * Don't allow a filtered frame to live forever.
	 */
	if (bf->bf_state.bfs_retries > SWMAX_RETRIES) {
		sc->sc_stats.ast_tx_swretrymax++;
		DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
		    "%s: bf=%p, seqno=%d, exceeded retries\n",
		    __func__,
		    bf,
		    SEQNO(bf->bf_state.bfs_seqno));
		retval = 1; /* error */
		goto finish;
	}

	/*
	 * A busy buffer can't be added to the retry list.
	 * It needs to be cloned.
	 */
	if (bf->bf_flags & ATH_BUF_BUSY) {
		nbf = ath_tx_retry_clone(sc, tid->an, tid, bf);
		DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
		    "%s: busy buffer clone: %p -> %p\n",
		    __func__, bf, nbf);
	} else {
		nbf = bf;
	}

	if (nbf == NULL) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
		    "%s: busy buffer couldn't be cloned (%p)!\n",
		    __func__, bf);
		retval = 1; /* error */
	} else {
		ath_tx_tid_filt_comp_buf(sc, tid, nbf);
		retval = 0; /* ok */
	}
finish:
	ath_tx_tid_filt_comp_complete(sc, tid);

	return (retval);
}

static void
ath_tx_tid_filt_comp_aggr(struct ath_softc *sc, struct ath_tid *tid,
    struct ath_buf *bf_first, ath_bufhead *bf_q)
{
	struct ath_buf *bf, *bf_next, *nbf;

	ATH_TX_LOCK_ASSERT(sc);

	bf = bf_first;
	while (bf) {
		bf_next = bf->bf_next;
		bf->bf_next = NULL;	/* Remove it from the aggr list */

		/*
		 * Don't allow a filtered frame to live forever.
		 */
		if (bf->bf_state.bfs_retries > SWMAX_RETRIES) {
			sc->sc_stats.ast_tx_swretrymax++;
			DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
			    "%s: tid=%d, bf=%p, seqno=%d, exceeded retries\n",
			    __func__,
			    tid->tid,
			    bf,
			    SEQNO(bf->bf_state.bfs_seqno));
			TAILQ_INSERT_TAIL(bf_q, bf, bf_list);
			goto next;
		}

		if (bf->bf_flags & ATH_BUF_BUSY) {
			nbf = ath_tx_retry_clone(sc, tid->an, tid, bf);
			DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
			    "%s: tid=%d, busy buffer cloned: %p -> %p, seqno=%d\n",
			    __func__, tid->tid, bf, nbf, SEQNO(bf->bf_state.bfs_seqno));
		} else {
			nbf = bf;
		}

		/*
		 * If the buffer couldn't be cloned, add it to bf_q;
		 * the caller will free the buffer(s) as required.
		 */
		if (nbf == NULL) {
			DPRINTF(sc, ATH_DEBUG_SW_TX_FILT,
			    "%s: tid=%d, buffer couldn't be cloned! (%p) seqno=%d\n",
			    __func__, tid->tid, bf, SEQNO(bf->bf_state.bfs_seqno));
			TAILQ_INSERT_TAIL(bf_q, bf, bf_list);
		} else {
			ath_tx_tid_filt_comp_buf(sc, tid, nbf);
		}
next:
		bf = bf_next;
	}

	ath_tx_tid_filt_comp_complete(sc, tid);
}

/*
 * Suspend the queue because we need to TX a BAR.
 */
static void
ath_tx_tid_bar_suspend(struct ath_softc *sc, struct ath_tid *tid)
{

	ATH_TX_LOCK_ASSERT(sc);

	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: tid=%d, bar_wait=%d, bar_tx=%d, called\n",
	    __func__,
	    tid->tid,
	    tid->bar_wait,
	    tid->bar_tx);

	/* We shouldn't be called when bar_tx is 1 */
	if (tid->bar_tx) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
		    "%s: bar_tx is 1?!\n", __func__);
	}

	/* If we've already been called, just be patient. */
	if (tid->bar_wait)
		return;

	/* Wait! */
	tid->bar_wait = 1;

	/* Only one pause, no matter how many frames fail */
	ath_tx_tid_pause(sc, tid);
}

/*
 * We've finished with BAR handling - either we succeeded or
 * failed. Either way, unsuspend TX.
 */
static void
ath_tx_tid_bar_unsuspend(struct ath_softc *sc, struct ath_tid *tid)
{

	ATH_TX_LOCK_ASSERT(sc);

	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: %s: TID=%d, called\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid);

	if (tid->bar_tx == 0 || tid->bar_wait == 0) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
		    "%s: %s: TID=%d, bar_tx=%d, bar_wait=%d: ?\n",
		    __func__,
		    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
		    tid->tid, tid->bar_tx, tid->bar_wait);
	}

	tid->bar_tx = tid->bar_wait = 0;
	ath_tx_tid_resume(sc, tid);
}

/*
 * Return whether we're ready to TX a BAR frame.
 *
 * Requires the TID lock be held.
 */
static int
ath_tx_tid_bar_tx_ready(struct ath_softc *sc, struct ath_tid *tid)
{

	ATH_TX_LOCK_ASSERT(sc);

	if (tid->bar_wait == 0 || tid->hwq_depth > 0)
		return (0);

	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: %s: TID=%d, bar ready\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid);

	return (1);
}

/*
 * Check whether the current TID is ready to have a BAR
 * TXed and if so, do the TX.
 *
 * Since the TID/TXQ lock can't be held during a call to
 * ieee80211_send_bar(), we have to do the dirty thing of unlocking it,
 * sending the BAR and locking it again.
 *
 * Eventually, the code to send the BAR should be broken out
 * from this routine so the lock doesn't have to be reacquired
 * just to be immediately dropped by the caller.
 */
static void
ath_tx_tid_bar_tx(struct ath_softc *sc, struct ath_tid *tid)
{
	struct ieee80211_tx_ampdu *tap;

	ATH_TX_LOCK_ASSERT(sc);

	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: %s: TID=%d, called\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid);

	tap = ath_tx_get_tx_tid(tid->an, tid->tid);

	/*
	 * This is an error condition!
	 */
	if (tid->bar_wait == 0 || tid->bar_tx == 1) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
		    "%s: %s: TID=%d, bar_tx=%d, bar_wait=%d: ?\n",
		    __func__,
		    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
		    tid->tid, tid->bar_tx, tid->bar_wait);
		return;
	}

	/* Don't do anything if we still have pending frames */
	if (tid->hwq_depth > 0) {
		DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
		    "%s: %s: TID=%d, hwq_depth=%d, waiting\n",
		    __func__,
		    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
		    tid->tid,
		    tid->hwq_depth);
		return;
	}

	/* We're now about to TX */
	tid->bar_tx = 1;

	/*
	 * Override the clrdmask configuration for the next frame,
	 * just to get the ball rolling.
	 */
	ath_tx_set_clrdmask(sc, tid->an);

	/*
	 * Calculate new BAW left edge, now that all frames have either
	 * succeeded or failed.
	 *
	 * XXX verify this is _actually_ the valid value to begin at!
	 */
	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: %s: TID=%d, new BAW left edge=%d\n",
	    __func__,
	    ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid,
	    tap->txa_start);

	/* Try sending the BAR frame */
	/* We can't hold the lock here! */

	ATH_TX_UNLOCK(sc);
	if (ieee80211_send_bar(&tid->an->an_node, tap, tap->txa_start) == 0) {
		/* Success? Now we wait for notification that it's done */
		ATH_TX_LOCK(sc);
		return;
	}

	/* Failure? For now, warn loudly and continue */
	ATH_TX_LOCK(sc);
	DPRINTF(sc, ATH_DEBUG_SW_TX_BAR,
	    "%s: %s: TID=%d, failed to TX BAR, continue!\n",
	    __func__, ath_hal_ether_sprintf(tid->an->an_node.ni_macaddr),
	    tid->tid);
	ath_tx_tid_bar_unsuspend(sc, tid);
}

static void
ath_tx_tid_drain_pkt(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, ath_bufhead *bf_cq, struct ath_buf *bf)
{

	ATH_TX_LOCK_ASSERT(sc);

	/*
	 * If the current TID is running AMPDU, update
	 * the BAW.
	 */
	if (ath_tx_ampdu_running(sc, an, tid->tid) &&
	    bf->bf_state.bfs_dobaw) {
		/*
		 * Only remove the frame from the BAW if it's
		 * been transmitted at least once; this means
		 * the frame was in the BAW to begin with.
		 */
		if (bf->bf_state.bfs_retries > 0) {
			ath_tx_update_baw(sc, an, tid, bf);
			bf->bf_state.bfs_dobaw = 0;
		}
#if 0
		/*
		 * This has become a non-fatal error now
		 */
		if (! bf->bf_state.bfs_addedbaw)
			DPRINTF(sc, ATH_DEBUG_SW_TX_BAW
			    "%s: wasn't added: seqno %d\n",
			    __func__, SEQNO(bf->bf_state.bfs_seqno));
#endif
	}

	/* Strip it out of an aggregate list if it was in one */
	bf->bf_next = NULL;

	/* Insert on the free queue to be freed by the caller */
	TAILQ_INSERT_TAIL(bf_cq, bf, bf_list);
}

static void
ath_tx_tid_drain_print(struct ath_softc *sc, struct ath_node *an,
    const char *pfx, struct ath_tid *tid, struct ath_buf *bf)
{
	struct ieee80211_node *ni = &an->an_node;
	struct ath_txq *txq;
	struct ieee80211_tx_ampdu *tap;

	txq = sc->sc_ac2q[tid->ac];
	tap = ath_tx_get_tx_tid(an, tid->tid);

	DPRINTF(sc, ATH_DEBUG_SW_TX | ATH_DEBUG_RESET,
	    "%s: %s: %s: bf=%p: addbaw=%d, dobaw=%d, "
	    "seqno=%d, retry=%d\n",
	    __func__,
	    pfx,
	    ath_hal_ether_sprintf(ni->ni_macaddr),
	    bf,
	    bf->bf_state.bfs_addedbaw,
	    bf->bf_state.bfs_dobaw,
	    SEQNO(bf->bf_state.bfs_seqno),
	    bf->bf_state.bfs_retries);
	DPRINTF(sc, ATH_DEBUG_SW_TX | ATH_DEBUG_RESET,
	    "%s: %s: %s: bf=%p: txq[%d] axq_depth=%d, axq_aggr_depth=%d\n",
	    __func__,
	    pfx,
	    ath_hal_ether_sprintf(ni->ni_macaddr),
	    bf,
	    txq->axq_qnum,
	    txq->axq_depth,
	    txq->axq_aggr_depth);
	DPRINTF(sc, ATH_DEBUG_SW_TX | ATH_DEBUG_RESET,
	    "%s: %s: %s: bf=%p: tid txq_depth=%d hwq_depth=%d, bar_wait=%d, "
	      "isfiltered=%d\n",
	    __func__,
	    pfx,
	    ath_hal_ether_sprintf(ni->ni_macaddr),
	    bf,
	    tid->axq_depth,
	    tid->hwq_depth,
	    tid->bar_wait,
	    tid->isfiltered);
	DPRINTF(sc, ATH_DEBUG_SW_TX | ATH_DEBUG_RESET,
	    "%s: %s: %s: tid %d: "
	    "sched=%d, paused=%d, "
	    "incomp=%d, baw_head=%d, "
	    "baw_tail=%d txa_start=%d, ni_txseqs=%d\n",
	     __func__,
	     pfx,
	     ath_hal_ether_sprintf(ni->ni_macaddr),
	     tid->tid,
	     tid->sched, tid->paused,
	     tid->incomp, tid->baw_head,
	     tid->baw_tail, tap == NULL ? -1 : tap->txa_start,
	     ni->ni_txseqs[tid->tid]);

	/* XXX Dump the frame, see what it is? */
	if (IFF_DUMPPKTS(sc, ATH_DEBUG_XMIT))
		ieee80211_dump_pkt(ni->ni_ic,
		    mtod(bf->bf_m, const uint8_t *),
		    bf->bf_m->m_len, 0, -1);
}

/*
 * Free any packets currently pending in the software TX queue.
 *
 * This will be called when a node is being deleted.
 *
 * It can also be called on an active node during an interface
 * reset or state transition.
 *
 * (From Linux/reference):
 *
 * TODO: For frame(s) that are in the retry state, we will reuse the
 * sequence number(s) without setting the retry bit. The
 * alternative is to give up on these and BAR the receiver's window
 * forward.
 */
static void
ath_tx_tid_drain(struct ath_softc *sc, struct ath_node *an,
    struct ath_tid *tid, ath_bufhead *bf_cq)
{
	struct ath_buf *bf;
	struct ieee80211_tx_ampdu *tap;
	struct ieee80211_node *ni = &an->an_node;
	int t;

	tap = ath_tx_get_tx_tid(an, tid->tid);

	ATH_TX_LOCK_ASSERT(sc);

	/* Walk the queue, free frames */
	t = 0;
	for (;;) {
		bf = ATH_TID_FIRST(tid);
		if (bf == NULL) {
			break;
		}

		if (t == 0) {
			ath_tx_tid_drain_print(sc, an, "norm", tid, bf);
//			t = 1;
		}

		ATH_TID_REMOVE(tid, bf, bf_list);
		ath_tx_tid_drain_pkt(sc, an, tid, bf_cq, bf);
	}

	/* And now, drain the filtered frame queue */
	t = 0;
	for (;;) {
		bf = ATH_TID_FILT_FIRST(tid);
		if (bf == NULL)
			break;

		if (t == 0) {
			ath_tx_tid_drain_print(sc, an, "filt", tid, bf);
//			t = 1;
		}

		ATH_TID_FILT_REMOVE(tid, bf, bf_list);
		ath_tx_tid_drain_pkt(sc, an, tid, bf_cq, bf);
	}

	/*
	 * Override the clrdmask configuration for the next frame
	 * in case there is some future transmission, just to get
	 * the ball rolling.
	 *
	 * This won't hurt things if the TID is about to be freed.
	 */
	ath_tx_set_clrdmask(sc, tid->an);

	/*
	 * Now that it's completed, grab the TID lock and update
	 * the sequence number and BAW window.
	 * Because sequence numbers have been assigned to frames
	 * that haven't been sent yet, it's entirely possible
	 * we'll be called with some pending frames that have not
	 * been transmitted.
	 *
	 * The cleaner solution is to do the sequence number allocation
	 * when the packet is first transmitted - and thus the "retries"
	 * check above would be enough to update the BAW/seqno.
	 */

	/* But don't do it for non-QoS TIDs */
	if (tap) {
#if 1
		DPRINTF(sc, ATH_DEBUG_SW_TX_CTRL,
		    "%s: %s: node %p: TID %d: sliding BAW left edge to %d\n",
		    __func__,
		    ath_hal_ether_sprintf(ni->ni_macaddr),
		    an,
		    tid->tid,
		    tap->txa_start);
#endif
		ni->ni_txseqs[tid->tid] = tap->txa_start;
		tid->baw_tail = tid->baw_head;
	}
}

/*
 * Reset the TID state.  This must be only called once the node has
 * had its frames flushed from this TID, to ensure that no other
 * pause / unpause logic can kick in.
 */
static void
ath_tx_tid_reset(struct ath_softc *sc, struct ath_tid *tid)
{

#if 0
	tid->bar_wait = tid->bar_tx = tid->isfiltered = 0;
	tid->paused = tid->sched = tid->addba_tx_pending = 0;
	tid->incomp = tid->cleanup_inprogress = 0;
#endif

	/*
	 * If we have a bar_wait set, we need to unpause the TID
	 * here.  Otherwise once cleanup has finished, the TID won't
	 * have the right paused counter.
	 *
	 * XXX I'm not going through resume here - I don't want the
	 * node to be rescheuled just yet.  This however should be
	 * methodized!
	 */
	if (tid->bar_wait) {
		if (tid->paused > 0) {
			tid->paused --;
		}
	}

	/*
	 * XXX same with a currently filtered TID.
	 *
	 * Since this is being called during a flush, we assume that
	 * the filtered frame list is actually empty.
	 *
	 * XXX TODO: add in a check to ensure that the filtered queue
	 * depth is actually 0!
	 */
	if (tid->isfiltered) {
		if (tid->paused > 0) {
			tid->paused --;
		}
	}

	/*
	 * Clear