xref: /netbsd-src/sys/dev/usb/if_athn_usb.c (revision 2e2322c9c07009df921d11b1268f8506affbb8ba)
1 /*	$NetBSD: if_athn_usb.c,v 1.18 2016/12/11 15:01:37 skrll Exp $	*/
2 /*	$OpenBSD: if_athn_usb.c,v 1.12 2013/01/14 09:50:31 jsing Exp $	*/
3 
4 /*-
5  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * USB front-end for Atheros AR9271 and AR7010 chipsets.
22  */
23 
24 #include <sys/cdefs.h>
25 __KERNEL_RCSID(0, "$NetBSD: if_athn_usb.c,v 1.18 2016/12/11 15:01:37 skrll Exp $");
26 
27 #ifdef	_KERNEL_OPT
28 #include "opt_inet.h"
29 #endif
30 
31 #include <sys/param.h>
32 #include <sys/callout.h>
33 #include <sys/conf.h>
34 #include <sys/device.h>
35 #include <sys/kernel.h>
36 #include <sys/mbuf.h>
37 #include <sys/module.h>
38 #include <sys/proc.h>
39 #include <sys/socket.h>
40 #include <sys/sockio.h>
41 #include <sys/systm.h>
42 #include <sys/kmem.h>
43 
44 #include <sys/bus.h>
45 #include <sys/endian.h>
46 #include <sys/intr.h>
47 
48 #include <net/bpf.h>
49 #include <net/if.h>
50 #include <net/if_arp.h>
51 #include <net/if_dl.h>
52 #include <net/if_ether.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 
56 #include <netinet/if_inarp.h>
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_amrr.h>
64 #include <net80211/ieee80211_radiotap.h>
65 
66 #include <dev/firmload.h>
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdevs.h>
70 #include <dev/usb/usbdi.h>
71 #include <dev/usb/usbdi_util.h>
72 
73 #include <dev/ic/athnreg.h>
74 #include <dev/ic/athnvar.h>
75 #include <dev/ic/arn9285.h>
76 #include <dev/usb/if_athn_usb.h>
77 
78 #define ATHN_USB_SOFTC(sc)	((struct athn_usb_softc *)(sc))
79 #define ATHN_USB_NODE(ni)	((struct athn_usb_node *)(ni))
80 
81 #define IS_UP_AND_RUNNING(ifp) \
82 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
83 
84 #define athn_usb_wmi_cmd(sc, cmd_id) \
85 	athn_usb_wmi_xcmd(sc, cmd_id, NULL, 0, NULL)
86 
87 Static int	athn_usb_activate(device_t, enum devact);
88 Static int	athn_usb_detach(device_t, int);
89 Static int	athn_usb_match(device_t, cfdata_t, void *);
90 Static void	athn_usb_attach(device_t, device_t, void *);
91 
92 CFATTACH_DECL_NEW(athn_usb, sizeof(struct athn_usb_softc), athn_usb_match,
93     athn_usb_attach, athn_usb_detach, athn_usb_activate);
94 
95 Static int	athn_usb_alloc_rx_list(struct athn_usb_softc *);
96 Static int	athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
97 Static int	athn_usb_alloc_tx_msg(struct athn_usb_softc *);
98 Static int	athn_usb_alloc_tx_list(struct athn_usb_softc *);
99 Static void	athn_usb_attachhook(device_t);
100 Static void	athn_usb_bcneof(struct usbd_xfer *, void *,
101 		    usbd_status);
102 Static void	athn_usb_abort_pipes(struct athn_usb_softc *);
103 Static void	athn_usb_close_pipes(struct athn_usb_softc *);
104 Static int	athn_usb_create_hw_node(struct athn_usb_softc *,
105 		    struct ar_htc_target_sta *);
106 Static int	athn_usb_create_node(struct athn_usb_softc *,
107 		    struct ieee80211_node *);
108 Static void	athn_usb_do_async(struct athn_usb_softc *,
109 		    void (*)(struct athn_usb_softc *, void *), void *, int);
110 Static void	athn_usb_free_rx_list(struct athn_usb_softc *);
111 Static void	athn_usb_free_tx_cmd(struct athn_usb_softc *);
112 Static void	athn_usb_free_tx_msg(struct athn_usb_softc *);
113 Static void	athn_usb_free_tx_list(struct athn_usb_softc *);
114 Static int	athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
115 		    uint8_t, uint8_t, uint8_t *);
116 Static int	athn_usb_htc_msg(struct athn_usb_softc *, uint16_t, void *,
117 		    int);
118 Static int	athn_usb_htc_setup(struct athn_usb_softc *);
119 Static int	athn_usb_init(struct ifnet *);
120 Static int	athn_usb_init_locked(struct ifnet *);
121 Static void	athn_usb_intr(struct usbd_xfer *, void *,
122 		    usbd_status);
123 Static int	athn_usb_ioctl(struct ifnet *, u_long, void *);
124 Static int	athn_usb_load_firmware(struct athn_usb_softc *);
125 Static const struct athn_usb_type *
126 		athn_usb_lookup(int, int);
127 Static int	athn_usb_media_change(struct ifnet *);
128 Static void	athn_usb_newassoc(struct ieee80211_node *, int);
129 Static void	athn_usb_newassoc_cb(struct athn_usb_softc *, void *);
130 Static int	athn_usb_newstate(struct ieee80211com *, enum ieee80211_state,
131 		    int);
132 Static void	athn_usb_newstate_cb(struct athn_usb_softc *, void *);
133 Static void	athn_usb_node_cleanup(struct ieee80211_node *);
134 Static void	athn_usb_node_cleanup_cb(struct athn_usb_softc *, void *);
135 Static int	athn_usb_open_pipes(struct athn_usb_softc *);
136 Static uint32_t	athn_usb_read(struct athn_softc *, uint32_t);
137 Static int	athn_usb_remove_hw_node(struct athn_usb_softc *, uint8_t *);
138 Static void	athn_usb_rx_enable(struct athn_softc *);
139 Static void	athn_usb_rx_frame(struct athn_usb_softc *, struct mbuf *);
140 Static void	athn_usb_rx_radiotap(struct athn_softc *, struct mbuf *,
141 		    struct ar_rx_status *);
142 Static void	athn_usb_rx_wmi_ctrl(struct athn_usb_softc *, uint8_t *, size_t);
143 Static void	athn_usb_rxeof(struct usbd_xfer *, void *,
144 		    usbd_status);
145 Static void	athn_usb_start(struct ifnet *);
146 //Static void	athn_usb_start_locked(struct ifnet *);
147 Static void	athn_usb_stop(struct ifnet *);
148 Static void	athn_usb_stop_locked(struct ifnet *);
149 Static void	athn_usb_swba(struct athn_usb_softc *);
150 Static int	athn_usb_switch_chan(struct athn_softc *,
151 		    struct ieee80211_channel *, struct ieee80211_channel *);
152 Static void	athn_usb_task(void *);
153 Static int	athn_usb_tx(struct athn_softc *, struct mbuf *,
154 		    struct ieee80211_node *, struct athn_usb_tx_data *);
155 Static void	athn_usb_txeof(struct usbd_xfer *, void *,
156 		    usbd_status);
157 Static void	athn_usb_updateslot(struct ifnet *);
158 Static void	athn_usb_updateslot_cb(struct athn_usb_softc *, void *);
159 Static void	athn_usb_wait_async(struct athn_usb_softc *);
160 Static int	athn_usb_wait_cmd(struct athn_usb_softc *);
161 Static int	athn_usb_wait_msg(struct athn_usb_softc *);
162 Static void	athn_usb_watchdog(struct ifnet *);
163 Static int	athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
164 		    int, void *);
165 Static void	athn_usb_wmieof(struct usbd_xfer *, void *,
166 		    usbd_status);
167 Static void	athn_usb_write(struct athn_softc *, uint32_t, uint32_t);
168 Static void	athn_usb_write_barrier(struct athn_softc *);
169 
170 /************************************************************************
171  * unused/notyet declarations
172  */
173 #ifdef unused
174 Static int	athn_usb_read_rom(struct athn_softc *);
175 #endif /* unused */
176 
177 #ifdef notyet_edca
178 Static void	athn_usb_updateedca(struct ieee80211com *);
179 Static void	athn_usb_updateedca_cb(struct athn_usb_softc *, void *);
180 #endif /* notyet_edca */
181 
182 #ifdef notyet
183 Static int	athn_usb_ampdu_tx_start(struct ieee80211com *,
184 		    struct ieee80211_node *, uint8_t);
185 Static void	athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *, void *);
186 Static void	athn_usb_ampdu_tx_stop(struct ieee80211com *,
187 		    struct ieee80211_node *, uint8_t);
188 Static void	athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *, void *);
189 Static void	athn_usb_delete_key(struct ieee80211com *,
190 		    struct ieee80211_node *, struct ieee80211_key *);
191 Static void	athn_usb_delete_key_cb(struct athn_usb_softc *, void *);
192 Static int	athn_usb_set_key(struct ieee80211com *,
193 		    struct ieee80211_node *, struct ieee80211_key *);
194 Static void	athn_usb_set_key_cb(struct athn_usb_softc *, void *);
195 #endif /* notyet */
196 /************************************************************************/
197 
198 struct athn_usb_type {
199 	struct usb_devno	devno;
200 	u_int			flags;
201 };
202 
203 Static const struct athn_usb_type *
204 athn_usb_lookup(int vendor, int product)
205 {
206 	static const struct athn_usb_type athn_usb_devs[] = {
207 #define _D(v,p,f) \
208 		{{ USB_VENDOR_##v, USB_PRODUCT_##p }, ATHN_USB_FLAG_##f }
209 
210 		_D( ACCTON,	ACCTON_AR9280,		AR7010 ),
211 		_D( ACTIONTEC,	ACTIONTEC_AR9287,	AR7010 ),
212 		_D( ATHEROS2,	ATHEROS2_AR9271_1,	NONE ),
213 		_D( ATHEROS2,	ATHEROS2_AR9271_2,	NONE ),
214 		_D( ATHEROS2,	ATHEROS2_AR9271_3,	NONE ),
215 		_D( ATHEROS2,	ATHEROS2_AR9280,	AR7010 ),
216 		_D( ATHEROS2,	ATHEROS2_AR9287,	AR7010 ),
217 		_D( AZUREWAVE,	AZUREWAVE_AR9271_1,	NONE ),
218 		_D( AZUREWAVE,	AZUREWAVE_AR9271_2,	NONE ),
219 		_D( AZUREWAVE,	AZUREWAVE_AR9271_3,	NONE ),
220 		_D( AZUREWAVE,	AZUREWAVE_AR9271_4,	NONE ),
221 		_D( AZUREWAVE,	AZUREWAVE_AR9271_5,	NONE ),
222 		_D( AZUREWAVE,	AZUREWAVE_AR9271_6,	NONE ),
223 		_D( DLINK2,	DLINK2_AR9271,	  	NONE ),
224 		_D( LITEON,	LITEON_AR9271,	  	NONE ),
225 		_D( NETGEAR,	NETGEAR_WNA1100,	NONE ),
226 		_D( NETGEAR,	NETGEAR_WNDA3200,	AR7010 ),
227 		_D( VIA,	VIA_AR9271,		NONE )
228 #undef _D
229 	};
230 
231 	return (const void *)usb_lookup(athn_usb_devs, vendor, product);
232 }
233 
234 Static int
235 athn_usb_match(device_t parent, cfdata_t match, void *aux)
236 {
237 	struct usb_attach_arg *uaa = aux;
238 
239 	return athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
240 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
241 }
242 
243 Static void
244 athn_usb_attach(device_t parent, device_t self, void *aux)
245 {
246 	struct athn_usb_softc *usc;
247 	struct athn_softc *sc;
248 	struct usb_attach_arg *uaa;
249 	int error;
250 
251 	usc = device_private(self);
252 	sc = &usc->usc_sc;
253 	uaa = aux;
254 	sc->sc_dev = self;
255 	usc->usc_udev = uaa->uaa_device;
256 
257 	aprint_naive("\n");
258 	aprint_normal("\n");
259 
260 	DPRINTFN(DBG_FN, sc, "\n");
261 
262 	usc->usc_athn_attached = 0;
263 	usc->usc_flags = athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product)->flags;
264 	sc->sc_flags |= ATHN_FLAG_USB;
265 #ifdef notyet
266 	/* Check if it is a combo WiFi+Bluetooth (WB193) device. */
267 	if (strncmp(product, "wb193", 5) == 0)
268 		sc->sc_flags |= ATHN_FLAG_BTCOEX3WIRE;
269 #endif
270 
271 	sc->sc_ops.read = athn_usb_read;
272 	sc->sc_ops.write = athn_usb_write;
273 	sc->sc_ops.write_barrier = athn_usb_write_barrier;
274 
275 	mutex_init(&usc->usc_lock, MUTEX_DEFAULT, IPL_NONE);
276 
277 	cv_init(&usc->usc_cmd_cv, "athncmd");
278 	mutex_init(&usc->usc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
279 	cv_init(&usc->usc_msg_cv, "athnmsg");
280 	mutex_init(&usc->usc_msg_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
281 
282 	cv_init(&usc->usc_task_cv, "athntsk");
283 	mutex_init(&usc->usc_task_mtx, MUTEX_DEFAULT, IPL_NET);
284 	mutex_init(&usc->usc_tx_mtx, MUTEX_DEFAULT, IPL_NONE);
285 
286 	usb_init_task(&usc->usc_task, athn_usb_task, usc, 0);
287 
288 	if (usbd_set_config_no(usc->usc_udev, 1, 0) != 0) {
289 		aprint_error_dev(sc->sc_dev,
290 		    "could not set configuration no\n");
291 		goto fail;
292 	}
293 
294 	/* Get the first interface handle. */
295 	error = usbd_device2interface_handle(usc->usc_udev, 0, &usc->usc_iface);
296 	if (error != 0) {
297 		aprint_error_dev(sc->sc_dev,
298 		    "could not get interface handle\n");
299 		goto fail;
300 	}
301 
302 	if (athn_usb_open_pipes(usc) != 0)
303 		goto fail;
304 
305 	/* Allocate xfer for firmware commands. */
306 	if (athn_usb_alloc_tx_cmd(usc) != 0)
307 		goto fail;
308 
309 	/* Allocate xfer for firmware commands. */
310 	if (athn_usb_alloc_tx_msg(usc) != 0)
311 		goto fail;
312 
313 	/* Allocate Tx/Rx buffers. */
314 	error = athn_usb_alloc_rx_list(usc);
315 	if (error != 0)
316 		goto fail;
317 	error = athn_usb_alloc_tx_list(usc);
318 	if (error != 0)
319 		goto fail;
320 
321 	config_mountroot(self, athn_usb_attachhook);
322 
323 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, usc->usc_udev, sc->sc_dev);
324 	return;
325 
326  fail:
327 
328 	/* Free Tx/Rx buffers. */
329 	athn_usb_abort_pipes(usc);
330 	athn_usb_free_tx_list(usc);
331 	athn_usb_free_rx_list(usc);
332 	athn_usb_free_tx_cmd(usc);
333 	athn_usb_free_tx_msg(usc);
334 	athn_usb_close_pipes(usc);
335 	usb_rem_task(usc->usc_udev, &usc->usc_task);
336 
337 	cv_destroy(&usc->usc_cmd_cv);
338 	cv_destroy(&usc->usc_msg_cv);
339 
340 	mutex_destroy(&usc->usc_lock);
341 
342 	mutex_destroy(&usc->usc_cmd_mtx);
343 	mutex_destroy(&usc->usc_msg_mtx);
344 	mutex_destroy(&usc->usc_tx_mtx);
345 	mutex_destroy(&usc->usc_task_mtx);
346 }
347 
348 Static void
349 athn_usb_node_cleanup_cb(struct athn_usb_softc *usc, void *arg)
350 {
351 	uint8_t sta_index = *(uint8_t *)arg;
352 
353 	DPRINTFN(DBG_FN, usc, "\n");
354 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
355 	athn_usb_remove_hw_node(usc, &sta_index);
356 }
357 
358 Static void
359 athn_usb_node_cleanup(struct ieee80211_node *ni)
360 {
361 	struct athn_usb_softc *usc;
362 	struct ieee80211com *ic;
363 	uint8_t sta_index;
364 
365 	usc = ATHN_USB_SOFTC(ni->ni_ic->ic_ifp->if_softc);
366 	ic = &ATHN_SOFTC(usc)->sc_ic;
367 
368 	DPRINTFN(DBG_FN, usc, "\n");
369 
370 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
371 		sta_index = ATHN_NODE(ni)->sta_index;
372 		if (sta_index != 0)
373 			athn_usb_do_async(usc, athn_usb_node_cleanup_cb,
374 			    &sta_index, sizeof(sta_index));
375 	}
376 	usc->usc_node_cleanup(ni);
377 }
378 
379 Static void
380 athn_usb_attachhook(device_t arg)
381 {
382 	struct athn_usb_softc *usc = device_private(arg);
383 	struct athn_softc *sc = &usc->usc_sc;
384 	struct athn_ops *ops = &sc->sc_ops;
385 	struct ieee80211com *ic = &sc->sc_ic;
386 	struct ifnet *ifp = &sc->sc_if;
387 	size_t i;
388 	int s, error;
389 
390 	if (usc->usc_dying)
391 		return;
392 
393 	DPRINTFN(DBG_FN, usc, "\n");
394 
395 	/* Load firmware. */
396 	error = athn_usb_load_firmware(usc);
397 	if (error != 0) {
398 		aprint_error_dev(sc->sc_dev,
399 		    "could not load firmware (%d)\n", error);
400 		return;
401 	}
402 
403 	/* Setup the host transport communication interface. */
404 	error = athn_usb_htc_setup(usc);
405 	if (error != 0)
406 		return;
407 
408 	/* We're now ready to attach the bus agnostic driver. */
409 	s = splnet();
410 	ic->ic_ifp = ifp;
411 	ic->ic_updateslot = athn_usb_updateslot;
412 	sc->sc_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
413 	sc->sc_media_change = athn_usb_media_change;
414 	error = athn_attach(sc);
415 	if (error != 0) {
416 		splx(s);
417 		return;
418 	}
419 	usc->usc_athn_attached = 1;
420 
421 	/* Override some operations for USB. */
422 	ifp->if_init = athn_usb_init;
423 	ifp->if_ioctl = athn_usb_ioctl;
424 	ifp->if_start = athn_usb_start;
425 	ifp->if_watchdog = athn_usb_watchdog;
426 
427 	/* hooks for HostAP association and disassociation */
428 	ic->ic_newassoc = athn_usb_newassoc;
429 	usc->usc_node_cleanup = ic->ic_node_cleanup;
430 	ic->ic_node_cleanup = athn_usb_node_cleanup;
431 
432 #ifdef notyet_edca
433 	ic->ic_updateedca = athn_usb_updateedca;
434 #endif
435 #ifdef notyet
436 	ic->ic_set_key = athn_usb_set_key;
437 	ic->ic_delete_key = athn_usb_delete_key;
438 	ic->ic_ampdu_tx_start = athn_usb_ampdu_tx_start;
439 	ic->ic_ampdu_tx_stop = athn_usb_ampdu_tx_stop;
440 #endif
441 	ic->ic_newstate = athn_usb_newstate;
442 
443 	ops->rx_enable = athn_usb_rx_enable;
444 	splx(s);
445 
446 	/* Reset HW key cache entries. */
447 	for (i = 0; i < sc->sc_kc_entries; i++)
448 		athn_reset_key(sc, i);
449 
450 	ops->enable_antenna_diversity(sc);
451 
452 #ifdef ATHN_BT_COEXISTENCE
453 	/* Configure bluetooth coexistence for combo chips. */
454 	if (sc->sc_flags & ATHN_FLAG_BTCOEX)
455 		athn_btcoex_init(sc);
456 #endif
457 	/* Configure LED. */
458 	athn_led_init(sc);
459 
460 	ieee80211_announce(ic);
461 }
462 
463 Static int
464 athn_usb_detach(device_t self, int flags)
465 {
466 	struct athn_usb_softc *usc = device_private(self);
467 	struct athn_softc *sc = &usc->usc_sc;
468 	int s;
469 
470 	DPRINTFN(DBG_FN, usc, "\n");
471 
472 	s = splusb();
473 	usc->usc_dying = 1;
474 
475 	mutex_enter(&usc->usc_cmd_mtx);
476 	athn_usb_wait_cmd(usc);
477 	mutex_exit(&usc->usc_cmd_mtx);
478 	mutex_enter(&usc->usc_msg_mtx);
479 	athn_usb_wait_msg(usc);
480 	mutex_exit(&usc->usc_msg_mtx);
481 	athn_usb_wait_async(usc);
482 
483 	usb_rem_task(usc->usc_udev, &usc->usc_task);
484 
485 	if (usc->usc_athn_attached) {
486 		usc->usc_athn_attached = 0;
487 		athn_detach(sc);
488 	}
489 	/* Abort Tx/Rx pipes. */
490 	athn_usb_abort_pipes(usc);
491 	splx(s);
492 
493 	/* Free Tx/Rx buffers. */
494 	athn_usb_free_rx_list(usc);
495 	athn_usb_free_tx_list(usc);
496 	athn_usb_free_tx_cmd(usc);
497 
498 	/* Close Tx/Rx pipes. */
499 	athn_usb_close_pipes(usc);
500 
501 	mutex_destroy(&usc->usc_tx_mtx);
502 	mutex_destroy(&usc->usc_task_mtx);
503 	cv_destroy(&usc->usc_task_cv);
504 
505 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, usc->usc_udev, sc->sc_dev);
506 	return 0;
507 }
508 
509 Static int
510 athn_usb_activate(device_t self, enum devact act)
511 {
512 	struct athn_usb_softc *usc = device_private(self);
513 	struct athn_softc *sc = &usc->usc_sc;
514 
515 	DPRINTFN(DBG_FN, usc, "\n");
516 
517 	switch (act) {
518 	case DVACT_DEACTIVATE:
519 		if_deactivate(sc->sc_ic.ic_ifp);
520 		usc->usc_dying = 1;
521 		return 0;
522 	default:
523 		return EOPNOTSUPP;
524 	}
525 }
526 
527 Static int
528 athn_usb_open_pipes(struct athn_usb_softc *usc)
529 {
530 	usb_endpoint_descriptor_t *ed;
531 	int error;
532 
533 	DPRINTFN(DBG_FN, usc, "\n");
534 
535 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_DATA, 0,
536 	    &usc->usc_tx_data_pipe);
537 	if (error != 0) {
538 		aprint_error_dev(usc->usc_dev,
539 		    "could not open Tx bulk pipe\n");
540 		goto fail;
541 	}
542 
543 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_RX_DATA, 0,
544 	    &usc->usc_rx_data_pipe);
545 	if (error != 0) {
546 		aprint_error_dev(usc->usc_dev,
547 		    "could not open Rx bulk pipe\n");
548 		goto fail;
549 	}
550 
551 	ed = usbd_get_endpoint_descriptor(usc->usc_iface, AR_PIPE_RX_INTR);
552 	if (ed == NULL) {
553 		aprint_error_dev(usc->usc_dev,
554 		    "could not retrieve Rx intr pipe descriptor\n");
555 		goto fail;
556 	}
557 	usc->usc_ibufsize = UGETW(ed->wMaxPacketSize);
558 	if (usc->usc_ibufsize == 0) {
559 		aprint_error_dev(usc->usc_dev,
560 		    "invalid Rx intr pipe descriptor\n");
561 		goto fail;
562 	}
563 	usc->usc_ibuf = kmem_alloc(usc->usc_ibufsize, KM_SLEEP);
564 	if (usc->usc_ibuf == NULL) {
565 		aprint_error_dev(usc->usc_dev,
566 		    "could not allocate Rx intr buffer\n");
567 		goto fail;
568 	}
569 
570 	error = usbd_open_pipe_intr(usc->usc_iface, AR_PIPE_RX_INTR,
571 	    USBD_SHORT_XFER_OK, &usc->usc_rx_intr_pipe, usc, usc->usc_ibuf,
572 	    usc->usc_ibufsize, athn_usb_intr, USBD_DEFAULT_INTERVAL);
573 	if (error != 0) {
574 		aprint_error_dev(usc->usc_dev,
575 		    "could not open Rx intr pipe\n");
576 		goto fail;
577 	}
578 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_INTR, 0,
579 	    &usc->usc_tx_intr_pipe);
580 	if (error != 0) {
581 		aprint_error_dev(usc->usc_dev,
582 		    "could not open Tx intr pipe\n");
583 		goto fail;
584 	}
585 	return 0;
586  fail:
587 	athn_usb_abort_pipes(usc);
588 	athn_usb_close_pipes(usc);
589 	return error;
590 }
591 
592 static inline void
593 athn_usb_kill_pipe(struct usbd_pipe **pipeptr)
594 {
595 	struct usbd_pipe *pipe;
596 
597 	CTASSERT(sizeof(pipe) == sizeof(void *));
598 	pipe = atomic_swap_ptr(pipeptr, NULL);
599 	if (pipe != NULL) {
600 		usbd_close_pipe(pipe);
601 	}
602 }
603 
604 Static void
605 athn_usb_abort_pipes(struct athn_usb_softc *usc)
606 {
607 	DPRINTFN(DBG_FN, usc, "\n");
608 
609 	if (usc->usc_tx_data_pipe != NULL)
610 		usbd_abort_pipe(usc->usc_tx_data_pipe);
611 	if (usc->usc_rx_data_pipe != NULL)
612 		usbd_abort_pipe(usc->usc_rx_data_pipe);
613 	if (usc->usc_tx_intr_pipe != NULL)
614 		usbd_abort_pipe(usc->usc_tx_intr_pipe);
615 	if (usc->usc_rx_intr_pipe != NULL)
616 		usbd_abort_pipe(usc->usc_rx_intr_pipe);
617 }
618 
619 Static void
620 athn_usb_close_pipes(struct athn_usb_softc *usc)
621 {
622 	uint8_t *ibuf;
623 
624 	DPRINTFN(DBG_FN, usc, "\n");
625 
626 	athn_usb_kill_pipe(&usc->usc_tx_data_pipe);
627 	athn_usb_kill_pipe(&usc->usc_rx_data_pipe);
628 	athn_usb_kill_pipe(&usc->usc_tx_intr_pipe);
629 	athn_usb_kill_pipe(&usc->usc_rx_intr_pipe);
630 	ibuf = atomic_swap_ptr(&usc->usc_ibuf, NULL);
631 	if (ibuf != NULL)
632 		kmem_free(ibuf, usc->usc_ibufsize);
633 }
634 
635 Static int
636 athn_usb_alloc_rx_list(struct athn_usb_softc *usc)
637 {
638 	struct athn_usb_rx_data *data;
639 	size_t i;
640 	int error = 0;
641 
642 	DPRINTFN(DBG_FN, usc, "\n");
643 
644 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
645 		data = &usc->usc_rx_data[i];
646 
647 		data->sc = usc;	/* Backpointer for callbacks. */
648 
649 		error = usbd_create_xfer(usc->usc_rx_data_pipe,
650 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK, 0, &data->xfer);
651 		if (error) {
652 			aprint_error_dev(usc->usc_dev,
653 			    "could not allocate xfer\n");
654 			break;
655 		}
656 		data->buf = usbd_get_buffer(data->xfer);
657 	}
658 	if (error != 0)
659 		athn_usb_free_rx_list(usc);
660 	return error;
661 }
662 
663 Static void
664 athn_usb_free_rx_list(struct athn_usb_softc *usc)
665 {
666 	struct usbd_xfer *xfer;
667 	size_t i;
668 
669 	DPRINTFN(DBG_FN, usc, "\n");
670 
671 	/* NB: Caller must abort pipe first. */
672 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
673 		CTASSERT(sizeof(xfer) == sizeof(void *));
674 		xfer = atomic_swap_ptr(&usc->usc_rx_data[i].xfer, NULL);
675 		if (xfer != NULL)
676 			usbd_destroy_xfer(xfer);
677 	}
678 }
679 
680 Static int
681 athn_usb_alloc_tx_list(struct athn_usb_softc *usc)
682 {
683 	struct athn_usb_tx_data *data;
684 	size_t i;
685 	int error = 0;
686 
687 	DPRINTFN(DBG_FN, usc, "\n");
688 
689 	mutex_enter(&usc->usc_tx_mtx);
690 	TAILQ_INIT(&usc->usc_tx_free_list);
691 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
692 		data = &usc->usc_tx_data[i];
693 
694 		data->sc = usc;	/* Backpointer for callbacks. */
695 
696 		error = usbd_create_xfer(usc->usc_tx_data_pipe,
697 		    ATHN_USB_TXBUFSZ, USBD_SHORT_XFER_OK, 0, &data->xfer);
698 		if (error) {
699 			aprint_error_dev(usc->usc_dev,
700 			    "could not create xfer on TX pipe\n");
701 			break;
702 		}
703 		data->buf = usbd_get_buffer(data->xfer);
704 
705 		/* Append this Tx buffer to our free list. */
706 		TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
707 	}
708 	if (error != 0)
709 		athn_usb_free_tx_list(usc);
710 	mutex_exit(&usc->usc_tx_mtx);
711 	return error;
712 }
713 
714 Static void
715 athn_usb_free_tx_list(struct athn_usb_softc *usc)
716 {
717 	struct usbd_xfer *xfer;
718 	size_t i;
719 
720 	DPRINTFN(DBG_FN, usc, "\n");
721 
722 	/* NB: Caller must abort pipe first. */
723 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
724 		CTASSERT(sizeof(xfer) == sizeof(void *));
725 		xfer = atomic_swap_ptr(&usc->usc_tx_data[i].xfer, NULL);
726 		if (xfer != NULL)
727 			usbd_destroy_xfer(xfer);
728 	}
729 }
730 
731 Static int
732 athn_usb_alloc_tx_cmd(struct athn_usb_softc *usc)
733 {
734 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
735 
736 	DPRINTFN(DBG_FN, usc, "\n");
737 
738 	data->sc = usc;	/* Backpointer for callbacks. */
739 
740 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
741 	    0, 0, &data->xfer);
742 	if (err) {
743 		aprint_error_dev(usc->usc_dev,
744 		    "could not allocate command xfer\n");
745 		return err;
746 	}
747 	data->buf = usbd_get_buffer(data->xfer);
748 
749 	return 0;
750 }
751 
752 Static void
753 athn_usb_free_tx_cmd(struct athn_usb_softc *usc)
754 {
755 	struct usbd_xfer *xfer;
756 
757 	DPRINTFN(DBG_FN, usc, "\n");
758 
759 	CTASSERT(sizeof(xfer) == sizeof(void *));
760 	xfer = atomic_swap_ptr(&usc->usc_tx_cmd.xfer, NULL);
761 	if (xfer != NULL)
762 		usbd_destroy_xfer(xfer);
763 }
764 
765 Static int
766 athn_usb_alloc_tx_msg(struct athn_usb_softc *usc)
767 {
768 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
769 
770 	DPRINTFN(DBG_FN, usc, "\n");
771 
772 	data->sc = usc;	/* Backpointer for callbacks. */
773 
774 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
775 	    0, 0, &data->xfer);
776 	if (err) {
777 		aprint_error_dev(usc->usc_dev,
778 		    "could not allocate command xfer\n");
779 		return err;
780 	}
781 	data->buf = usbd_get_buffer(data->xfer);
782 
783 	return 0;
784 }
785 
786 Static void
787 athn_usb_free_tx_msg(struct athn_usb_softc *usc)
788 {
789 	struct usbd_xfer *xfer;
790 
791 	DPRINTFN(DBG_FN, usc, "\n");
792 
793 	CTASSERT(sizeof(xfer) == sizeof(void *));
794 	xfer = atomic_swap_ptr(&usc->usc_tx_msg.xfer, NULL);
795 	if (xfer != NULL)
796 		usbd_destroy_xfer(xfer);
797 }
798 
799 Static void
800 athn_usb_task(void *arg)
801 {
802 	struct athn_usb_softc *usc = arg;
803 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
804 	struct athn_usb_host_cmd *cmd;
805 
806 	DPRINTFN(DBG_FN, usc, "\n");
807 
808 	/* Process host commands. */
809 	mutex_spin_enter(&usc->usc_task_mtx);
810 	while (ring->next != ring->cur) {
811 		cmd = &ring->cmd[ring->next];
812 		mutex_spin_exit(&usc->usc_task_mtx);
813 
814 		/* Invoke callback. */
815 		if (!usc->usc_dying)
816 			cmd->cb(usc, cmd->data);
817 
818 		mutex_spin_enter(&usc->usc_task_mtx);
819 		ring->queued--;
820 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
821 	}
822 	mutex_spin_exit(&usc->usc_task_mtx);
823 	cv_broadcast(&usc->usc_task_cv);
824 }
825 
826 Static void
827 athn_usb_do_async(struct athn_usb_softc *usc,
828     void (*cb)(struct athn_usb_softc *, void *), void *arg, int len)
829 {
830 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
831 	struct athn_usb_host_cmd *cmd;
832 
833 	if (usc->usc_dying)
834 		return;
835 
836 	DPRINTFN(DBG_FN, usc, "\n");
837 
838 	mutex_spin_enter(&usc->usc_task_mtx);
839 	cmd = &ring->cmd[ring->cur];
840 	cmd->cb = cb;
841 	KASSERT(len <= sizeof(cmd->data));
842 	memcpy(cmd->data, arg, len);
843 	ring->cur = (ring->cur + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
844 
845 	/* If there is no pending command already, schedule a task. */
846 	if (++ring->queued == 1) {
847 		usb_add_task(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER);
848 	}
849 	mutex_spin_exit(&usc->usc_task_mtx);
850 }
851 
852 Static void
853 athn_usb_wait_async(struct athn_usb_softc *usc)
854 {
855 
856 	DPRINTFN(DBG_FN, usc, "\n");
857 
858 	/* Wait for all queued asynchronous commands to complete. */
859 	mutex_spin_enter(&usc->usc_task_mtx);
860 	while (usc->usc_cmdq.queued > 0)
861 		cv_wait(&usc->usc_task_cv, &usc->usc_task_mtx);
862 	mutex_spin_exit(&usc->usc_task_mtx);
863 }
864 
865 Static int
866 athn_usb_load_firmware(struct athn_usb_softc *usc)
867 {
868 	struct athn_softc *sc = &usc->usc_sc;
869 	firmware_handle_t fwh;
870 	usb_device_descriptor_t *dd;
871 	usb_device_request_t req;
872 	const char *name;
873 	u_char *fw, *ptr;
874 	size_t size, remain;
875 	uint32_t addr;
876 	int mlen, error;
877 
878 	DPRINTFN(DBG_FN, sc, "\n");
879 
880 	/* Determine which firmware image to load. */
881 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010) {
882 		dd = usbd_get_device_descriptor(usc->usc_udev);
883 		if (UGETW(dd->bcdDevice) == 0x0202)
884 			name = "athn-ar7010-11";
885 		else
886 			name = "athn-ar7010";
887 	} else
888 		name = "athn-ar9271";
889 
890 	/* Read firmware image from the filesystem. */
891 	if ((error = firmware_open("if_athn", name, &fwh)) != 0) {
892 		aprint_error_dev(sc->sc_dev,
893 		    "failed to open firmware file %s (%d)\n", name, error);
894 		return error;
895 	}
896 	size = firmware_get_size(fwh);
897 	fw = firmware_malloc(size);
898 	if (fw == NULL) {
899 		aprint_error_dev(usc->usc_dev,
900 		    "failed to allocate firmware memory\n");
901 		firmware_close(fwh);
902 		return ENOMEM;
903 	}
904 	error = firmware_read(fwh, 0, fw, size);
905 	firmware_close(fwh);
906 	if (error != 0) {
907 		aprint_error_dev(usc->usc_dev,
908 		    "failed to read firmware (error %d)\n", error);
909 		firmware_free(fw, size);
910 		return error;
911 	}
912 
913 	/* Load firmware image. */
914 	ptr = fw;
915 	addr = AR9271_FIRMWARE >> 8;
916 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
917 	req.bRequest = AR_FW_DOWNLOAD;
918 	USETW(req.wIndex, 0);
919 	remain = size;
920 	while (remain > 0) {
921 		mlen = MIN(remain, 4096);
922 
923 		USETW(req.wValue, addr);
924 		USETW(req.wLength, mlen);
925 		error = usbd_do_request(usc->usc_udev, &req, ptr);
926 		if (error != 0) {
927 			firmware_free(fw, size);
928 			return error;
929 		}
930 		addr   += mlen >> 8;
931 		ptr    += mlen;
932 		remain -= mlen;
933 	}
934 	firmware_free(fw, size);
935 
936 	/* Start firmware. */
937 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010)
938 		addr = AR7010_FIRMWARE_TEXT >> 8;
939 	else
940 		addr = AR9271_FIRMWARE_TEXT >> 8;
941 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
942 	req.bRequest = AR_FW_DOWNLOAD_COMP;
943 	USETW(req.wIndex, 0);
944 	USETW(req.wValue, addr);
945 	USETW(req.wLength, 0);
946 
947 	mutex_enter(&usc->usc_msg_mtx);
948 	error = athn_usb_wait_msg(usc);
949 	if (error) {
950 		mutex_exit(&usc->usc_msg_mtx);
951 		return error;
952 	}
953 
954 	usc->usc_wait_msg_id = AR_HTC_MSG_READY;
955 	error = usbd_do_request(usc->usc_udev, &req, NULL);
956 
957 	/* Wait at most 1 second for firmware to boot. */
958 	if (error == 0)
959 		error = athn_usb_wait_msg(usc);
960 
961 	mutex_exit(&usc->usc_msg_mtx);
962 
963 	DPRINTFN(DBG_FN, sc, "return %d\n", error);
964 
965 	return error;
966 }
967 
968 Static int
969 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
970     int len)
971 {
972 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
973 	struct ar_htc_frame_hdr *htc;
974 	struct ar_htc_msg_hdr *msg;
975 
976 	if (usc->usc_dying)
977 		return USBD_CANCELLED;
978 
979 	DPRINTFN(DBG_FN, usc, "\n");
980 
981 	KASSERT(mutex_owned(&usc->usc_msg_mtx));
982 
983 	htc = (struct ar_htc_frame_hdr *)data->buf;
984 	memset(htc, 0, sizeof(*htc));
985 	htc->endpoint_id = 0;
986 	htc->payload_len = htobe16(sizeof(*msg) + len);
987 
988 	msg = (struct ar_htc_msg_hdr *)&htc[1];
989 	msg->msg_id = htobe16(msg_id);
990 
991 	memcpy(&msg[1], buf, len);
992 
993 	usbd_setup_xfer(data->xfer, NULL, data->buf,
994 	    sizeof(*htc) + sizeof(*msg) + len,
995 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT, NULL);
996 	return usbd_sync_transfer(data->xfer);
997 
998 
999 }
1000 
1001 Static int
1002 athn_usb_htc_setup(struct athn_usb_softc *usc)
1003 {
1004 	struct ar_htc_msg_config_pipe cfg;
1005 	int error;
1006 
1007 	/*
1008 	 * Connect WMI services to USB pipes.
1009 	 */
1010 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CONTROL,
1011 	    AR_PIPE_TX_INTR, AR_PIPE_RX_INTR, &usc->usc_ep_ctrl);
1012 	if (error != 0)
1013 		return error;
1014 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_BEACON,
1015 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_bcn);
1016 	if (error != 0)
1017 		return error;
1018 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CAB,
1019 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_cab);
1020 	if (error != 0)
1021 		return error;
1022 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_UAPSD,
1023 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_uapsd);
1024 	if (error != 0)
1025 		return error;
1026 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_MGMT,
1027 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_mgmt);
1028 	if (error != 0)
1029 		return error;
1030 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BE,
1031 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BE]);
1032 	if (error != 0)
1033 		return error;
1034 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BK,
1035 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BK]);
1036 	if (error != 0)
1037 		return error;
1038 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VI,
1039 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VI]);
1040 	if (error != 0)
1041 		return error;
1042 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VO,
1043 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VO]);
1044 	if (error != 0)
1045 		return error;
1046 
1047 	/* Set credits for WLAN Tx pipe. */
1048 	memset(&cfg, 0, sizeof(cfg));
1049 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
1050 	cfg.credits = (usc->usc_flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
1051 
1052 	mutex_enter(&usc->usc_msg_mtx);
1053 	error = athn_usb_wait_msg(usc);
1054 	if (error) {
1055 		mutex_exit(&usc->usc_msg_mtx);
1056 		return error;
1057 	}
1058 
1059 	usc->usc_wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
1060 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
1061 
1062 	if (error != 0) {
1063 		aprint_error_dev(usc->usc_dev, "could not request pipe configurations\n");
1064 		mutex_exit(&usc->usc_msg_mtx);
1065 		return error;
1066 	}
1067 	error = athn_usb_wait_msg(usc);
1068 	if (error) {
1069 		mutex_exit(&usc->usc_msg_mtx);
1070 		return error;
1071 	}
1072 
1073 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
1074 	if (error != 0) {
1075 		aprint_error_dev(usc->usc_dev, "could not request complete setup\n");
1076 		mutex_exit(&usc->usc_msg_mtx);
1077 		return error;
1078 	}
1079 	error = athn_usb_wait_msg(usc);
1080 	if (error) {
1081 		mutex_exit(&usc->usc_msg_mtx);
1082 		return error;
1083 	}
1084 
1085 	mutex_exit(&usc->usc_msg_mtx);
1086 
1087 	return 0;
1088 }
1089 
1090 Static int
1091 athn_usb_htc_connect_svc(struct athn_usb_softc *usc, uint16_t svc_id,
1092     uint8_t ul_pipe, uint8_t dl_pipe, uint8_t *endpoint_id)
1093 {
1094 	struct ar_htc_msg_conn_svc msg;
1095 	struct ar_htc_msg_conn_svc_rsp rsp;
1096 	int error;
1097 
1098 	DPRINTFN(DBG_FN, usc, "\n");
1099 
1100 	memset(&msg, 0, sizeof(msg));
1101 	msg.svc_id = htobe16(svc_id);
1102 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
1103 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
1104 
1105 	mutex_enter(&usc->usc_msg_mtx);
1106 	athn_usb_wait_msg(usc);
1107 
1108 	usc->usc_msg_conn_svc_rsp = &rsp;
1109 
1110 	usc->usc_wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
1111 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
1112 	if (error == 0)
1113 		error = athn_usb_wait_msg(usc);
1114 
1115 	mutex_exit(&usc->usc_msg_mtx);
1116 
1117 	if (error != 0) {
1118 		aprint_error_dev(usc->usc_dev,
1119 		    "error waiting for service %d connection\n", svc_id);
1120 		return error;
1121 	}
1122 	if (rsp.status != AR_HTC_SVC_SUCCESS) {
1123 		aprint_error_dev(usc->usc_dev,
1124 		    "service %d connection failed, error %d\n",
1125 		    svc_id, rsp.status);
1126 		return EIO;
1127 	}
1128 	DPRINTFN(DBG_INIT, usc,
1129 	    "service %d successfully connected to endpoint %d\n",
1130 	    svc_id, rsp.endpoint_id);
1131 
1132 	/* Return endpoint id. */
1133 	*endpoint_id = rsp.endpoint_id;
1134 	return 0;
1135 }
1136 
1137 Static int
1138 athn_usb_wait_msg(struct athn_usb_softc *usc)
1139 {
1140  	DPRINTFN(DBG_FN, usc, "\n");
1141 
1142 	KASSERT(mutex_owned(&usc->usc_msg_mtx));
1143 
1144 	int error = 0;
1145 	while (usc->usc_wait_msg_id)
1146 		error = cv_timedwait(&usc->usc_msg_cv, &usc->usc_msg_mtx, hz);
1147 
1148 	return error;
1149 }
1150 
1151 Static int
1152 athn_usb_wait_cmd(struct athn_usb_softc *usc)
1153 {
1154 
1155  	DPRINTFN(DBG_FN, usc, "\n");
1156 
1157 	KASSERT(mutex_owned(&usc->usc_cmd_mtx));
1158 
1159 	int error = 0;
1160 	while (usc->usc_wait_cmd_id)
1161 		error = cv_timedwait(&usc->usc_cmd_cv, &usc->usc_cmd_mtx, hz);
1162 
1163 	return error;
1164 
1165 }
1166 
1167 Static void
1168 athn_usb_wmieof(struct usbd_xfer *xfer, void * priv,
1169     usbd_status status)
1170 {
1171 	struct athn_usb_softc *usc = priv;
1172 
1173  	DPRINTFN(DBG_FN, usc, "\n");
1174 
1175 	if (__predict_false(status == USBD_STALLED))
1176 		usbd_clear_endpoint_stall_async(usc->usc_tx_intr_pipe);
1177 }
1178 
1179 Static int
1180 athn_usb_wmi_xcmd(struct athn_usb_softc *usc, uint16_t cmd_id, void *ibuf,
1181     int ilen, void *obuf)
1182 {
1183 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
1184 	struct ar_htc_frame_hdr *htc;
1185 	struct ar_wmi_cmd_hdr *wmi;
1186 	int error;
1187 
1188 	if (usc->usc_dying)
1189 		return EIO;
1190 
1191  	DPRINTFN(DBG_FN, usc, "cmd_id %#x\n", cmd_id);
1192 
1193 	mutex_enter(&usc->usc_cmd_mtx);
1194 	error = athn_usb_wait_cmd(usc);
1195 
1196 	if (error) {
1197 		mutex_exit(&usc->usc_cmd_mtx);
1198 		return error;
1199 	}
1200 
1201 	htc = (struct ar_htc_frame_hdr *)data->buf;
1202 	memset(htc, 0, sizeof(*htc));
1203 	htc->endpoint_id = usc->usc_ep_ctrl;
1204 	htc->payload_len = htobe16(sizeof(*wmi) + ilen);
1205 
1206 	wmi = (struct ar_wmi_cmd_hdr *)&htc[1];
1207 	wmi->cmd_id = htobe16(cmd_id);
1208 	usc->usc_wmi_seq_no++;
1209 	wmi->seq_no = htobe16(usc->usc_wmi_seq_no);
1210 
1211 	memcpy(&wmi[1], ibuf, ilen);
1212 
1213 	usbd_setup_xfer(data->xfer, usc, data->buf,
1214 	    sizeof(*htc) + sizeof(*wmi) + ilen,
1215 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT,
1216 	    athn_usb_wmieof);
1217 
1218 	usc->usc_wait_cmd_id = cmd_id;
1219 	usc->usc_obuf = obuf;
1220 
1221 	error = usbd_sync_transfer(data->xfer);
1222 	if (error) {
1223 	    	DPRINTFN(DBG_FN, usc, "transfer error %d\n", error);
1224 
1225 		mutex_exit(&usc->usc_cmd_mtx);
1226 
1227 		return error;
1228 	}
1229 
1230 	error = athn_usb_wait_cmd(usc);
1231 
1232 	mutex_exit(&usc->usc_cmd_mtx);
1233 
1234 	return error;
1235 }
1236 
1237 #ifdef unused
1238 Static int
1239 athn_usb_read_rom(struct athn_softc *sc)
1240 {
1241 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1242 	uint32_t addrs[8], vals[8], addr;
1243 	uint16_t *eep;
1244 	size_t i, j;
1245 	int error = 0;
1246 
1247 	DPRINTFN(DBG_FN, sc, "\n");
1248 
1249 	/* Read EEPROM by blocks of 16 bytes. */
1250 	eep = sc->sc_eep;
1251 	addr = AR_EEPROM_OFFSET(sc->sc_eep_base);
1252 	for (i = 0; i < sc->sc_eep_size / 16; i++) {
1253 		for (j = 0; j < 8; j++, addr += 4)
1254 			addrs[j] = htobe32(addr);
1255 		error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1256 		    addrs, sizeof(addrs), vals);
1257 		if (error != 0)
1258 			break;
1259 		for (j = 0; j < 8; j++)
1260 			*eep++ = be32toh(vals[j]);
1261 	}
1262 	return error;
1263 }
1264 #endif /* unused */
1265 
1266 Static uint32_t
1267 athn_usb_read(struct athn_softc *sc, uint32_t addr)
1268 {
1269 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1270 	uint32_t val;
1271 	int error;
1272 
1273 	if (usc->usc_dying)
1274 		return 0;
1275 
1276  	DPRINTFN(DBG_FN, sc, "addr %#x\n", htobe32(addr));
1277 
1278 	/* Flush pending writes for strict consistency. */
1279 	athn_usb_write_barrier(sc);
1280 
1281 	addr = htobe32(addr);
1282 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1283 	    &addr, sizeof(addr), &val);
1284 	if (error != 0) {
1285 		DPRINTFN(DBG_FN, sc, "error %d\n", addr);
1286 		return 0xdeadbeef;
1287 	}
1288  	DPRINTFN(DBG_FN, sc, "addr %#x return %#x\n", addr, be32toh(val));
1289 
1290 	return be32toh(val);
1291 }
1292 
1293 Static void
1294 athn_usb_write(struct athn_softc *sc, uint32_t addr, uint32_t val)
1295 {
1296 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1297 
1298 	if (usc->usc_dying)
1299 		return;
1300 
1301  	DPRINTFN(DBG_FN, sc, "addr %#x val %#x\n", addr, val);
1302 
1303 	usc->usc_wbuf[usc->usc_wcount].addr = htobe32(addr);
1304 	usc->usc_wbuf[usc->usc_wcount].val  = htobe32(val);
1305 	if (++usc->usc_wcount == AR_MAX_WRITE_COUNT)
1306 		athn_usb_write_barrier(sc);
1307 }
1308 
1309 Static void
1310 athn_usb_write_barrier(struct athn_softc *sc)
1311 {
1312 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1313 
1314 	if (usc->usc_dying)
1315 		goto done;
1316 
1317  	DPRINTFN(DBG_FN, sc, "usc_wcount %d\n", usc->usc_wcount);
1318 
1319 	if (usc->usc_wcount == 0)
1320 		return;
1321 
1322 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_WRITE,
1323 	    usc->usc_wbuf, usc->usc_wcount * sizeof(usc->usc_wbuf[0]), NULL);
1324  done:
1325 	usc->usc_wcount = 0;	/* Always flush buffer. */
1326 }
1327 
1328 Static int
1329 athn_usb_media_change(struct ifnet *ifp)
1330 {
1331 	struct athn_softc *sc = ifp->if_softc;
1332 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1333 	int error;
1334 
1335 	if (usc->usc_dying)
1336 		return EIO;
1337 
1338 	DPRINTFN(DBG_FN, sc, "\n");
1339 
1340 	error = ieee80211_media_change(ifp);
1341 	if (error == ENETRESET && IS_UP_AND_RUNNING(ifp)) {
1342 		athn_usb_stop(ifp);
1343 		error = athn_usb_init(ifp);
1344 	}
1345 	return error;
1346 }
1347 
1348 Static int
1349 athn_usb_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
1350     int arg)
1351 {
1352 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1353 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1354 	struct athn_usb_cmd_newstate cmd;
1355 
1356 	DPRINTFN(DBG_FN, sc, "\n");
1357 
1358 	/* Do it in a process context. */
1359 	cmd.state = nstate;
1360 	cmd.arg = arg;
1361 	athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, sizeof(cmd));
1362 	return 0;
1363 }
1364 
1365 Static void
1366 athn_usb_newstate_cb(struct athn_usb_softc *usc, void *arg)
1367 {
1368 	struct athn_usb_cmd_newstate *cmd = arg;
1369 	struct athn_softc *sc = &usc->usc_sc;
1370 	struct ieee80211com *ic = &sc->sc_ic;
1371 	enum ieee80211_state ostate, nstate;
1372 	uint32_t reg, imask;
1373 	int s;
1374 
1375 	DPRINTFN(DBG_FN, sc, "\n");
1376 
1377 	callout_stop(&sc->sc_calib_to);
1378 
1379 	s = splnet();
1380 
1381 	ostate = ic->ic_state;
1382 	nstate = cmd->state;
1383 	DPRINTFN(DBG_STM, usc, "newstate %s(%d) -> %s(%d)\n",
1384 		    ieee80211_state_name[ostate], ostate,
1385 		    ieee80211_state_name[nstate], nstate);
1386 
1387 	if (ostate == IEEE80211_S_RUN) {
1388 		uint8_t sta_index;
1389 
1390 		sta_index = ATHN_NODE(ic->ic_bss)->sta_index;
1391 		DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
1392 		athn_usb_remove_hw_node(usc, &sta_index);
1393 	}
1394 
1395 	switch (nstate) {
1396 	case IEEE80211_S_INIT:
1397 		athn_set_led(sc, 0);
1398 		break;
1399 	case IEEE80211_S_SCAN:
1400 		/* Make the LED blink while scanning. */
1401 		athn_set_led(sc, !sc->sc_led_state);
1402 		(void)athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1403 		if (!usc->usc_dying)
1404 			callout_schedule(&sc->sc_scan_to, hz / 5);
1405 		break;
1406 	case IEEE80211_S_AUTH:
1407 		athn_set_led(sc, 0);
1408 		athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1409 		break;
1410 	case IEEE80211_S_ASSOC:
1411 		break;
1412 	case IEEE80211_S_RUN:
1413 		athn_set_led(sc, 1);
1414 
1415 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
1416 			break;
1417 
1418 		/* Create node entry for our BSS. */
1419 		DPRINTFN(DBG_NODES, sc, "create node for AID=0x%x\n",
1420 		    ic->ic_bss->ni_associd);
1421 		athn_usb_create_node(usc, ic->ic_bss);	/* XXX: handle error? */
1422 
1423 		athn_set_bss(sc, ic->ic_bss);
1424 		athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1425 #ifndef IEEE80211_STA_ONLY
1426 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1427 			athn_set_hostap_timers(sc);
1428 			/* Enable software beacon alert interrupts. */
1429 			imask = htobe32(AR_IMR_SWBA);
1430 		} else
1431 #endif
1432 		{
1433 			athn_set_sta_timers(sc);
1434 			/* Enable beacon miss interrupts. */
1435 			imask = htobe32(AR_IMR_BMISS);
1436 
1437 			/* Stop receiving beacons from other BSS. */
1438 			reg = AR_READ(sc, AR_RX_FILTER);
1439 			reg = (reg & ~AR_RX_FILTER_BEACON) |
1440 			    AR_RX_FILTER_MYBEACON;
1441 			AR_WRITE(sc, AR_RX_FILTER, reg);
1442 			AR_WRITE_BARRIER(sc);
1443 		}
1444 		athn_usb_wmi_xcmd(usc, AR_WMI_CMD_ENABLE_INTR,
1445 		    &imask, sizeof(imask), NULL);
1446 		break;
1447 	}
1448 	if (!usc->usc_dying)
1449 		(void)sc->sc_newstate(ic, nstate, cmd->arg);
1450 	splx(s);
1451 }
1452 
1453 Static void
1454 athn_usb_newassoc(struct ieee80211_node *ni, int isnew)
1455 {
1456 	struct ieee80211com *ic = ni->ni_ic;
1457 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1458 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1459 
1460 	DPRINTFN(DBG_FN, sc, "\n");
1461 
1462 	if (ic->ic_opmode != IEEE80211_M_HOSTAP || !isnew)
1463 		return;
1464 
1465 	/* Do it in a process context. */
1466 	ieee80211_ref_node(ni);
1467 	athn_usb_do_async(usc, athn_usb_newassoc_cb, &ni, sizeof(ni));
1468 }
1469 
1470 Static void
1471 athn_usb_newassoc_cb(struct athn_usb_softc *usc, void *arg)
1472 {
1473 	struct ieee80211_node *ni = *(void **)arg;
1474 	int s;
1475 
1476 	DPRINTFN(DBG_FN, usc, "\n");
1477 
1478 	s = splnet();
1479 	/* NB: Node may have left before we got scheduled. */
1480 	if (ni->ni_associd != 0) {
1481 		DPRINTFN(DBG_NODES, usc, "creating node for AID=0x%x\n",
1482 		    ni->ni_associd);
1483 		(void)athn_usb_create_node(usc, ni);	/* XXX: handle error? */
1484 	}
1485 	ieee80211_free_node(ni);
1486 	splx(s);
1487 }
1488 
1489 #ifdef notyet
1490 Static int
1491 athn_usb_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
1492     uint8_t tid)
1493 {
1494 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1495 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1496 	struct athn_node *an = ATHN_NODE(ni);
1497 	struct athn_usb_aggr_cmd cmd;
1498 
1499 	DPRINTFN(DBG_FN, sc, "\n");
1500 
1501 	/* Do it in a process context. */
1502 	cmd.sta_index = an->sta_index;
1503 	cmd.tid = tid;
1504 	athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, sizeof(cmd));
1505 	return 0;
1506 }
1507 
1508 Static void
1509 athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *usc, void *arg)
1510 {
1511 	struct athn_usb_aggr_cmd *cmd = arg;
1512 	struct ar_htc_target_aggr aggr;
1513 
1514 	DPRINTFN(DBG_FN, usc, "\n");
1515 
1516 	memset(&aggr, 0, sizeof(aggr));
1517 	aggr.sta_index = cmd->sta_index;
1518 	aggr.tidno = cmd->tid;
1519 	aggr.aggr_enable = 1;
1520 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1521 	    &aggr, sizeof(aggr), NULL);
1522 }
1523 
1524 Static void
1525 athn_usb_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
1526     uint8_t tid)
1527 {
1528 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1529 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1530 	struct athn_node *an = ATHN_NODE(ni);
1531 	struct athn_usb_aggr_cmd cmd;
1532 
1533 	DPRINTFN(DBG_FN, sc, "\n");
1534 
1535 	/* Do it in a process context. */
1536 	cmd.sta_index = an->sta_index;
1537 	cmd.tid = tid;
1538 	athn_usb_do_async(usc, athn_usb_ampdu_tx_stop_cb, &cmd, sizeof(cmd));
1539 }
1540 
1541 Static void
1542 athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *usc, void *arg)
1543 {
1544 	struct athn_usb_aggr_cmd *cmd = arg;
1545 	struct ar_htc_target_aggr aggr;
1546 
1547 	DPRINTFN(DBG_FN, usc, "\n");
1548 
1549 	memset(&aggr, 0, sizeof(aggr));
1550 	aggr.sta_index = cmd->sta_index;
1551 	aggr.tidno = cmd->tid;
1552 	aggr.aggr_enable = 0;
1553 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1554 	    &aggr, sizeof(aggr), NULL);
1555 }
1556 #endif /* notyet */
1557 
1558 Static int
1559 athn_usb_remove_hw_node(struct athn_usb_softc *usc, uint8_t *sta_idx)
1560 {
1561 	int error;
1562 
1563 	DPRINTFN(DBG_FN, usc, "\n");
1564 
1565 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1566 	    sta_idx, sizeof(*sta_idx), NULL);
1567 
1568 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1569 	    *sta_idx, error);
1570 	return error;
1571 }
1572 
1573 Static int
1574 athn_usb_create_hw_node(struct athn_usb_softc *usc,
1575     struct ar_htc_target_sta *sta)
1576 {
1577 	int error;
1578 
1579 	DPRINTFN(DBG_FN, usc, "\n");
1580 
1581 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
1582 	    sta, sizeof(*sta), NULL);
1583 
1584 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1585 	    sta->sta_index, error);
1586 
1587 	return error;
1588 }
1589 
1590 Static int
1591 athn_usb_create_node(struct athn_usb_softc *usc, struct ieee80211_node *ni)
1592 {
1593 	struct athn_node *an = ATHN_NODE(ni);
1594 	struct ar_htc_target_sta sta;
1595 	struct ar_htc_target_rate rate;
1596 	int error;
1597 
1598 	DPRINTFN(DBG_FN | DBG_NODES, usc, "AID=0x%x\n", ni->ni_associd);
1599 
1600 	/*
1601 	 * NB: this is called by ic_newstate and (in HOSTAP mode by)
1602 	 * ic_newassoc.
1603 	 *
1604 	 * The firmware has a limit of 8 nodes.  In HOSTAP mode, we
1605 	 * limit the AID to < 8 and use that value to index the
1606 	 * firmware node table.  Node zero is used for the BSS.
1607 	 *
1608 	 * In STA mode, we simply use node 1 for the BSS.
1609 	 */
1610 	if (ATHN_SOFTC(usc)->sc_ic.ic_opmode == IEEE80211_M_HOSTAP)
1611 		an->sta_index = IEEE80211_NODE_AID(ni);
1612 	else
1613 		an->sta_index = 1;
1614 
1615 	/* Create node entry on target. */
1616 	memset(&sta, 0, sizeof(sta));
1617 	IEEE80211_ADDR_COPY(sta.macaddr, ni->ni_macaddr);
1618 	IEEE80211_ADDR_COPY(sta.bssid, ni->ni_bssid);
1619 
1620 	sta.associd = htobe16(ni->ni_associd);
1621 	sta.valid = 1;
1622 	sta.sta_index = an->sta_index;
1623 
1624 	sta.maxampdu = 0xffff;
1625 #ifndef IEEE80211_NO_HT
1626 	if (ni->ni_flags & IEEE80211_NODE_HT)
1627 		sta.flags |= htobe16(AR_HTC_STA_HT);
1628 #endif
1629 	error = athn_usb_create_hw_node(usc, &sta);
1630 	if (error)
1631 		return error;
1632 
1633 	/* Setup supported rates. */
1634 	memset(&rate, 0, sizeof(rate));
1635 	rate.sta_index = sta.sta_index;
1636 	rate.isnew = 1;
1637 	rate.lg_rates.rs_nrates = ni->ni_rates.rs_nrates;
1638 	memcpy(rate.lg_rates.rs_rates, ni->ni_rates.rs_rates,
1639 	    ni->ni_rates.rs_nrates);
1640 
1641 #ifndef IEEE80211_NO_HT
1642 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1643 		rate.capflags |= htobe32(AR_RC_HT_FLAG);
1644 #ifdef notyet
1645 		/* XXX setup HT rates */
1646 		if (ni->ni_htcaps & IEEE80211_HTCAP_CBW20_40)
1647 			rate.capflags |= htobe32(AR_RC_40_FLAG);
1648 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI40)
1649 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1650 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI20)
1651 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1652 #endif
1653 	}
1654 #endif
1655 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_RC_RATE_UPDATE,
1656 	    &rate, sizeof(rate), NULL);
1657 	return error;
1658 }
1659 
1660 Static void
1661 athn_usb_rx_enable(struct athn_softc *sc)
1662 {
1663 
1664 	DPRINTFN(DBG_FN, sc, "\n");
1665 
1666 	AR_WRITE(sc, AR_CR, AR_CR_RXE);
1667 	AR_WRITE_BARRIER(sc);
1668 }
1669 
1670 Static int
1671 athn_usb_switch_chan(struct athn_softc *sc, struct ieee80211_channel *curchan,
1672     struct ieee80211_channel *extchan)
1673 {
1674 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1675 	uint16_t mode;
1676 	int error;
1677 
1678 	DPRINTFN(DBG_FN, sc, "\n");
1679 
1680 	/* Disable interrupts. */
1681 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1682 	if (error != 0)
1683 		goto reset;
1684 	/* Stop all Tx queues. */
1685 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
1686 	if (error != 0)
1687 		goto reset;
1688 	/* Stop Rx. */
1689 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
1690 	if (error != 0)
1691 		goto reset;
1692 
1693 	/* If band or bandwidth changes, we need to do a full reset. */
1694 	if (curchan->ic_flags != sc->sc_curchan->ic_flags ||
1695 	    ((extchan != NULL) ^ (sc->sc_curchanext != NULL))) {
1696 		DPRINTFN(DBG_RF, sc, "channel band switch\n");
1697 		goto reset;
1698 	}
1699 
1700 	error = athn_set_chan(sc, curchan, extchan);
1701 	if (AR_SREV_9271(sc) && error == 0)
1702 		ar9271_load_ani(sc);
1703 	if (error != 0) {
1704  reset:		/* Error found, try a full reset. */
1705 		DPRINTFN(DBG_RF, sc, "needs a full reset\n");
1706 		error = athn_hw_reset(sc, curchan, extchan, 0);
1707 		if (error != 0)	/* Hopeless case. */
1708 			return error;
1709 	}
1710 
1711 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
1712 	if (error != 0)
1713 		return error;
1714 	athn_rx_start(sc);
1715 
1716 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
1717 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
1718 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
1719 	    &mode, sizeof(mode), NULL);
1720 	if (error != 0)
1721 		return error;
1722 
1723 	/* Re-enable interrupts. */
1724 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ENABLE_INTR);
1725 	return error;
1726 }
1727 
1728 #ifdef notyet_edca
1729 Static void
1730 athn_usb_updateedca(struct ieee80211com *ic)
1731 {
1732 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1733 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1734 
1735 	DPRINTFN(DBG_FN, sc, "\n");
1736 
1737 	/* Do it in a process context. */
1738 	athn_usb_do_async(usc, athn_usb_updateedca_cb, NULL, 0);
1739 }
1740 
1741 Static void
1742 athn_usb_updateedca_cb(struct athn_usb_softc *usc, void *arg)
1743 {
1744 	int s;
1745 
1746 	DPRINTFN(DBG_FN, usc, "\n");
1747 
1748 	s = splnet();
1749 	athn_updateedca(&usc->usc_sc.sc_ic);
1750 	splx(s);
1751 }
1752 #endif /* notyet_edca */
1753 
1754 Static void
1755 athn_usb_updateslot(struct ifnet *ifp)
1756 {
1757 	struct athn_softc *sc = ifp->if_softc;
1758 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1759 
1760 	DPRINTFN(DBG_FN, sc, "\n");
1761 
1762 	/*
1763 	 * NB: athn_updateslog() needs to be done in a process context
1764 	 * to avoid being called by ieee80211_reset_erp() inside a
1765 	 * spinlock held by ieee80211_free_allnodes().
1766 	 *
1767 	 * XXX: calling this during the athn_attach() causes
1768 	 * usb_insert_transfer() to produce a bunch of "not busy"
1769 	 * messages.  Why?
1770 	 */
1771 	if (usc->usc_athn_attached)
1772 		athn_usb_do_async(usc, athn_usb_updateslot_cb, NULL, 0);
1773 }
1774 
1775 Static void
1776 athn_usb_updateslot_cb(struct athn_usb_softc *usc, void *arg)
1777 {
1778 	int s;
1779 
1780 	DPRINTFN(DBG_FN, usc, "\n");
1781 
1782 	s = splnet();
1783 	athn_updateslot(&usc->usc_sc.sc_if);
1784 	splx(s);
1785 }
1786 
1787 #ifdef notyet
1788 Static int
1789 athn_usb_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1790     struct ieee80211_key *k)
1791 {
1792 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1793 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1794 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1795 	struct athn_usb_cmd_key cmd;
1796 
1797 	DPRINTFN(DBG_FN, sc, "\n");
1798 
1799 	/* Defer setting of WEP keys until interface is brought up. */
1800 	if (!IS_UP_AND_RUNNING(ifp))
1801 		return 0;
1802 
1803 	/* Do it in a process context. */
1804 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1805 	cmd.key = k;
1806 	athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, sizeof(cmd));
1807 	return 0;
1808 }
1809 
1810 Static void
1811 athn_usb_set_key_cb(struct athn_usb_softc *usc, void *arg)
1812 {
1813 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1814 	struct athn_usb_cmd_key *cmd = arg;
1815 	int s;
1816 
1817 	DPRINTFN(DBG_FN, usc, "\n");
1818 
1819 	s = splnet();
1820 	athn_set_key(ic, cmd->ni, cmd->key);
1821 	if (cmd->ni != NULL)
1822 		ieee80211_free_node(cmd->ni);
1823 	splx(s);
1824 }
1825 
1826 Static void
1827 athn_usb_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1828     struct ieee80211_key *k)
1829 {
1830 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1831 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1832 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1833 	struct athn_usb_cmd_key cmd;
1834 
1835 	DPRINTFN(DBG_FN, sc, "\n");
1836 
1837 	if (!(ifp->if_flags & IFF_RUNNING) ||
1838 	    ic->ic_state != IEEE80211_S_RUN)
1839 		return;	/* Nothing to do. */
1840 
1841 	/* Do it in a process context. */
1842 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1843 	cmd.key = k;
1844 	athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, sizeof(cmd));
1845 }
1846 
1847 Static void
1848 athn_usb_delete_key_cb(struct athn_usb_softc *usc, void *arg)
1849 {
1850 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1851 	struct athn_usb_cmd_key *cmd = arg;
1852 	int s;
1853 
1854 	DPRINTFN(DBG_FN, usc, "\n");
1855 
1856 	s = splnet();
1857 	athn_delete_key(ic, cmd->ni, cmd->key);
1858 	if (cmd->ni != NULL)
1859 		ieee80211_free_node(cmd->ni);
1860 	splx(s);
1861 }
1862 #endif /* notyet */
1863 
1864 #ifndef IEEE80211_STA_ONLY
1865 Static void
1866 athn_usb_bcneof(struct usbd_xfer *xfer, void * priv,
1867     usbd_status status)
1868 {
1869 	struct athn_usb_tx_data *data = priv;
1870 	struct athn_usb_softc *usc = data->sc;
1871 
1872 	DPRINTFN(DBG_FN, usc, "\n");
1873 
1874 	if (__predict_false(status == USBD_STALLED))
1875 		usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
1876 	usc->usc_tx_bcn = data;
1877 }
1878 
1879 /*
1880  * Process Software Beacon Alert interrupts.
1881  */
1882 Static void
1883 athn_usb_swba(struct athn_usb_softc *usc)
1884 {
1885 	struct athn_softc *sc = &usc->usc_sc;
1886 	struct ieee80211com *ic = &sc->sc_ic;
1887 	struct athn_usb_tx_data *data;
1888 	struct ieee80211_frame *wh;
1889 	struct ieee80211_beacon_offsets bo;
1890 	struct ar_stream_hdr *hdr;
1891 	struct ar_htc_frame_hdr *htc;
1892 	struct ar_tx_bcn *bcn;
1893 	struct mbuf *m;
1894 	int error;
1895 
1896 	if (usc->usc_dying)
1897 		return;
1898 
1899 	DPRINTFN(DBG_FN, sc, "\n");
1900 
1901 	if (ic->ic_dtim_count == 0)
1902 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1903 	else
1904 		ic->ic_dtim_count--;
1905 
1906 	/* Make sure previous beacon has been sent. */
1907 	if (usc->usc_tx_bcn == NULL)
1908 		return;
1909 	data = usc->usc_tx_bcn;
1910 
1911 	/* Get new beacon. */
1912 #ifdef ATHN_DEBUG
1913 	memset(&bo, 0, sizeof(bo));
1914 #endif
1915 	m = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
1916 	if (__predict_false(m == NULL))
1917 		return;
1918 	/* Assign sequence number. */
1919 	/* XXX: use non-QoS tid? */
1920 	wh = mtod(m, struct ieee80211_frame *);
1921 	*(uint16_t *)&wh->i_seq[0] =
1922 	    htole16(ic->ic_bss->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
1923 	ic->ic_bss->ni_txseqs[0]++;
1924 
1925 	hdr = (struct ar_stream_hdr *)data->buf;
1926 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1927 	hdr->len = htole16(sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len);
1928 
1929 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1930 	memset(htc, 0, sizeof(*htc));
1931 	htc->endpoint_id = usc->usc_ep_bcn;
1932 	htc->payload_len = htobe16(sizeof(*bcn) + m->m_pkthdr.len);
1933 
1934 	bcn = (struct ar_tx_bcn *)&htc[1];
1935 	memset(bcn, 0, sizeof(*bcn));
1936 	bcn->vif_idx = 0;
1937 
1938 	m_copydata(m, 0, m->m_pkthdr.len, (void *)&bcn[1]);
1939 
1940 	usbd_setup_xfer(data->xfer, data, data->buf,
1941 	    sizeof(*hdr) + sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len,
1942 	    USBD_SHORT_XFER_OK, ATHN_USB_TX_TIMEOUT,
1943 	    athn_usb_bcneof);
1944 
1945 	m_freem(m);
1946 	usc->usc_tx_bcn = NULL;
1947 	error = usbd_transfer(data->xfer);
1948 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
1949 		usc->usc_tx_bcn = data;
1950 }
1951 #endif
1952 
1953 Static void
1954 athn_usb_rx_wmi_ctrl(struct athn_usb_softc *usc, uint8_t *buf, size_t len)
1955 {
1956 #ifdef ATHN_DEBUG
1957 	struct ar_wmi_evt_txrate *txrate;
1958 #endif
1959 	struct ar_wmi_cmd_hdr *wmi;
1960 	uint16_t cmd_id;
1961 
1962 	if (usc->usc_dying)
1963 		return;
1964 
1965 	DPRINTFN(DBG_FN, usc, "\n");
1966 
1967 	if (__predict_false(len < sizeof(*wmi)))
1968 		return;
1969 	wmi = (struct ar_wmi_cmd_hdr *)buf;
1970 	cmd_id = be16toh(wmi->cmd_id);
1971 
1972 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
1973 		mutex_enter(&usc->usc_cmd_mtx);
1974 		if (usc->usc_wait_cmd_id == cmd_id) {
1975 
1976 			if (usc->usc_obuf != NULL) {
1977 				/* Copy answer into caller supplied buffer. */
1978 				memcpy(usc->usc_obuf, &wmi[1], len - sizeof(*wmi));
1979 			}
1980 			/* Notify caller of completion. */
1981 			usc->usc_wait_cmd_id = 0;
1982 			cv_broadcast(&usc->usc_cmd_cv);
1983 		}
1984 		mutex_exit(&usc->usc_cmd_mtx);
1985 		return;
1986 	}
1987 	/*
1988 	 * XXX: the Linux 2.6 and 3.7.4 kernels differ on the event numbers!
1989 	 * See the alternate defines in if_athn_usb.h.
1990 	 */
1991 	switch (cmd_id & 0xfff) {
1992 #ifndef IEEE80211_STA_ONLY
1993 	case AR_WMI_EVT_SWBA:
1994 		athn_usb_swba(usc);
1995 		break;
1996 #endif
1997 	case AR_WMI_EVT_FATAL:
1998 		aprint_error_dev(usc->usc_dev, "fatal firmware error\n");
1999 		break;
2000 	case AR_WMI_EVT_TXRATE:
2001 #ifdef ATHN_DEBUG
2002 		txrate = (struct ar_wmi_evt_txrate *)&wmi[1];
2003 		DPRINTFN(DBG_TX, usc, "txrate=%d\n", be32toh(txrate->txrate));
2004 #endif
2005 		break;
2006 	default:
2007 		DPRINTFN(DBG_TX, usc, "WMI event 0x%x (%d) ignored\n", cmd_id, cmd_id);
2008 		break;
2009 	}
2010 }
2011 
2012 Static void
2013 athn_usb_intr(struct usbd_xfer *xfer, void * priv,
2014     usbd_status status)
2015 {
2016 	struct athn_usb_softc *usc = priv;
2017 	struct ar_htc_frame_hdr *htc;
2018 	struct ar_htc_msg_hdr *msg;
2019 	uint8_t *buf = usc->usc_ibuf;
2020 	uint16_t msg_id;
2021 	int len;
2022 
2023 	if (usc->usc_dying)
2024 		return;
2025 
2026 	DPRINTFN(DBG_FN, usc, "\n");
2027 
2028 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2029 		DPRINTFN(DBG_INTR, usc, "intr status=%d\n", status);
2030 		if (status == USBD_STALLED)
2031 			usbd_clear_endpoint_stall_async(usc->usc_rx_intr_pipe);
2032 		return;
2033 	}
2034 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2035 
2036 	/* Skip watchdog pattern if present. */
2037 	if (len >= 4 && *(uint32_t *)buf == htobe32(0x00c60000)) {
2038 		buf += 4;
2039 		len -= 4;
2040 	}
2041 	if (__predict_false(len < (int)sizeof(*htc)))
2042 		return;
2043 	htc = (struct ar_htc_frame_hdr *)buf;
2044 	/* Skip HTC header. */
2045 	buf += sizeof(*htc);
2046 	len -= sizeof(*htc);
2047 
2048 	if (htc->endpoint_id != 0) {
2049 		if (__predict_false(htc->endpoint_id != usc->usc_ep_ctrl)) {
2050 			DPRINTFN(DBG_RX, usc, "Rx %d != %d\n",
2051 			    htc->endpoint_id, usc->usc_ep_ctrl);
2052 			return;
2053 		}
2054 		/* Remove trailer if present. */
2055 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
2056 			if (__predict_false(len < htc->control[0])) {
2057 				DPRINTFN(DBG_RX, usc, "Rx trailer %d < %d\n",
2058 				    len,  htc->control[0]);
2059 				return;
2060 			}
2061 			len -= htc->control[0];
2062 		}
2063 		athn_usb_rx_wmi_ctrl(usc, buf, len);
2064 		return;
2065 	}
2066 
2067 	/*
2068 	 * Endpoint 0 carries HTC messages.
2069 	 */
2070 	if (__predict_false(len < (int)sizeof(*msg)))
2071 		return;
2072 	msg = (struct ar_htc_msg_hdr *)buf;
2073 	msg_id = be16toh(msg->msg_id);
2074 	DPRINTFN(DBG_RX, usc, "Rx HTC message %d\n", msg_id);
2075 	switch (msg_id) {
2076 	case AR_HTC_MSG_READY:
2077 	case AR_HTC_MSG_CONF_PIPE_RSP:
2078 		mutex_enter(&usc->usc_msg_mtx);
2079 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_READY: %d vs %d\n",
2080 		    usc->usc_wait_msg_id, msg_id);
2081 		if (usc->usc_wait_msg_id == msg_id) {
2082 			usc->usc_wait_msg_id = 0;
2083 			cv_broadcast(&usc->usc_msg_cv);
2084 		}
2085 		mutex_exit(&usc->usc_msg_mtx);
2086 		break;
2087 	case AR_HTC_MSG_CONN_SVC_RSP:
2088 		mutex_enter(&usc->usc_msg_mtx);
2089 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_CONN_SVC_RSP: %d vs %d\n",
2090 		    usc->usc_wait_msg_id, msg_id);
2091 		if (usc->usc_wait_msg_id == msg_id) {
2092 			if (usc->usc_msg_conn_svc_rsp != NULL) {
2093 				memcpy(usc->usc_msg_conn_svc_rsp, &msg[1],
2094 				    sizeof(*usc->usc_msg_conn_svc_rsp));
2095 			}
2096 			usc->usc_wait_msg_id = 0;
2097 			cv_broadcast(&usc->usc_msg_cv);
2098 		}
2099 		mutex_exit(&usc->usc_msg_mtx);
2100 		break;
2101 	default:
2102 		DPRINTFN(DBG_RX, usc, "HTC message %d ignored\n", msg_id);
2103 		break;
2104 	}
2105 }
2106 
2107 Static void
2108 athn_usb_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
2109     struct ar_rx_status *rs)
2110 {
2111 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
2112 	struct ieee80211com *ic = &sc->sc_ic;
2113 	uint8_t rate;
2114 
2115 	DPRINTFN(DBG_FN, sc, "\n");
2116 
2117 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
2118 	tap->wr_tsft = htole64(be64toh(rs->rs_tstamp));
2119 	tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2120 	tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2121 	tap->wr_dbm_antsignal = rs->rs_rssi;
2122 	/* XXX noise. */
2123 	tap->wr_antenna = rs->rs_antenna;
2124 	rate = rs->rs_rate;
2125 	if (rate & 0x80) {		/* HT. */
2126 		/* Bit 7 set means HT MCS instead of rate. */
2127 		tap->wr_rate = rate;
2128 		if (!(rs->rs_flags & AR_RXS_FLAG_GI))
2129 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
2130 	} else if (rate & 0x10) {	/* CCK. */
2131 		if (rate & 0x04)
2132 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2133 		switch (rate & ~0x14) {
2134 		case 0xb: tap->wr_rate =   2; break;
2135 		case 0xa: tap->wr_rate =   4; break;
2136 		case 0x9: tap->wr_rate =  11; break;
2137 		case 0x8: tap->wr_rate =  22; break;
2138 		default:  tap->wr_rate =   0; break;
2139 		}
2140 	} else {			/* OFDM. */
2141 		switch (rate) {
2142 		case 0xb: tap->wr_rate =  12; break;
2143 		case 0xf: tap->wr_rate =  18; break;
2144 		case 0xa: tap->wr_rate =  24; break;
2145 		case 0xe: tap->wr_rate =  36; break;
2146 		case 0x9: tap->wr_rate =  48; break;
2147 		case 0xd: tap->wr_rate =  72; break;
2148 		case 0x8: tap->wr_rate =  96; break;
2149 		case 0xc: tap->wr_rate = 108; break;
2150 		default:  tap->wr_rate =   0; break;
2151 		}
2152 	}
2153 	bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
2154 }
2155 
2156 Static void
2157 athn_usb_rx_frame(struct athn_usb_softc *usc, struct mbuf *m)
2158 {
2159 	struct athn_softc *sc = &usc->usc_sc;
2160 	struct ieee80211com *ic = &sc->sc_ic;
2161 	struct ifnet *ifp = &sc->sc_if;
2162 	struct ieee80211_frame *wh;
2163 	struct ieee80211_node *ni;
2164 	struct ar_htc_frame_hdr *htc;
2165 	struct ar_rx_status *rs;
2166 	uint16_t datalen;
2167 	int s;
2168 
2169 	DPRINTFN(DBG_FN, sc, "\n");
2170 
2171 	if (__predict_false(m->m_len < (int)sizeof(*htc)))
2172 		goto skip;
2173 	htc = mtod(m, struct ar_htc_frame_hdr *);
2174 	if (__predict_false(htc->endpoint_id == 0)) {
2175 		DPRINTFN(DBG_RX, sc, "bad endpoint %d\n", htc->endpoint_id);
2176 		goto skip;
2177 	}
2178 	if (htc->flags & AR_HTC_FLAG_TRAILER) {
2179 		if (m->m_len < htc->control[0])
2180 			goto skip;
2181 		m_adj(m, -(int)htc->control[0]);
2182 	}
2183 	m_adj(m, sizeof(*htc));	/* Strip HTC header. */
2184 
2185 	if (__predict_false(m->m_len < (int)sizeof(*rs)))
2186 		goto skip;
2187 	rs = mtod(m, struct ar_rx_status *);
2188 
2189 	/* Make sure that payload fits. */
2190 	datalen = be16toh(rs->rs_datalen);
2191 	if (__predict_false(m->m_len < (int)sizeof(*rs) + datalen))
2192 		goto skip;
2193 
2194 	/* Ignore runt frames.  Let ACKs be seen by bpf */
2195 	if (__predict_false(datalen <
2196 		sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN))
2197 		goto skip;
2198 
2199 	m_adj(m, sizeof(*rs));	/* Strip Rx status. */
2200 	m_set_rcvif(m, ifp);
2201 
2202 	s = splnet();
2203 
2204 	/* Grab a reference to the source node. */
2205 	wh = mtod(m, struct ieee80211_frame *);
2206 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
2207 
2208 	/* Remove any HW padding after the 802.11 header. */
2209 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
2210 		u_int hdrlen = ieee80211_anyhdrsize(wh);
2211 		if (hdrlen & 3) {
2212 			ovbcopy(wh, (uint8_t *)wh + 2, hdrlen);
2213 			m_adj(m, 2);
2214 		}
2215 	}
2216 	if (__predict_false(sc->sc_drvbpf != NULL))
2217 		athn_usb_rx_radiotap(sc, m, rs);
2218 
2219 	/* Trim 802.11 FCS after radiotap. */
2220 	m_adj(m, -IEEE80211_CRC_LEN);
2221 
2222 	/* Send the frame to the 802.11 layer. */
2223 	ieee80211_input(ic, m, ni, rs->rs_rssi + AR_USB_DEFAULT_NF, 0);
2224 
2225 	/* Node is no longer needed. */
2226 	ieee80211_free_node(ni);
2227 	splx(s);
2228 	return;
2229  skip:
2230 	m_freem(m);
2231 }
2232 
2233 Static void
2234 athn_usb_rxeof(struct usbd_xfer *xfer, void * priv,
2235     usbd_status status)
2236 {
2237 	struct athn_usb_rx_data *data = priv;
2238 	struct athn_usb_softc *usc = data->sc;
2239 	struct athn_usb_rx_stream *stream = &usc->usc_rx_stream;
2240 	uint8_t *buf = data->buf;
2241 	struct ar_stream_hdr *hdr;
2242 	struct mbuf *m;
2243 	uint16_t pktlen;
2244 	int off, len;
2245 
2246 	if (usc->usc_dying)
2247 		return;
2248 
2249 	DPRINTFN(DBG_FN, usc, "\n");
2250 
2251 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2252 		DPRINTFN(DBG_RX, usc, "RX status=%d\n", status);
2253 		if (status == USBD_STALLED)
2254 			usbd_clear_endpoint_stall_async(usc->usc_rx_data_pipe);
2255 		if (status != USBD_CANCELLED)
2256 			goto resubmit;
2257 		return;
2258 	}
2259 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2260 
2261 	if (stream->left > 0) {
2262 		if (len >= stream->left) {
2263 			/* We have all our pktlen bytes now. */
2264 			if (__predict_true(stream->m != NULL)) {
2265 				memcpy(mtod(stream->m, uint8_t *) +
2266 				    stream->moff, buf, stream->left);
2267 				athn_usb_rx_frame(usc, stream->m);
2268 				stream->m = NULL;
2269 			}
2270 			/* Next header is 32-bit aligned. */
2271 			off = (stream->left + 3) & ~3;
2272 			buf += off;
2273 			len -= off;
2274 			stream->left = 0;
2275 		} else {
2276 			/* Still need more bytes, save what we have. */
2277 			if (__predict_true(stream->m != NULL)) {
2278 				memcpy(mtod(stream->m, uint8_t *) +
2279 				    stream->moff, buf, len);
2280 				stream->moff += len;
2281 			}
2282 			stream->left -= len;
2283 			goto resubmit;
2284 		}
2285 	}
2286 	KASSERT(stream->left == 0);
2287 	while (len >= (int)sizeof(*hdr)) {
2288 		hdr = (struct ar_stream_hdr *)buf;
2289 		if (hdr->tag != htole16(AR_USB_RX_STREAM_TAG)) {
2290 			DPRINTFN(DBG_RX, usc, "invalid tag 0x%x\n", hdr->tag);
2291 			break;
2292 		}
2293 		pktlen = le16toh(hdr->len);
2294 		buf += sizeof(*hdr);
2295 		len -= sizeof(*hdr);
2296 
2297 		if (__predict_true(pktlen <= MCLBYTES)) {
2298 			/* Allocate an mbuf to store the next pktlen bytes. */
2299 			MGETHDR(m, M_DONTWAIT, MT_DATA);
2300 			if (__predict_true(m != NULL)) {
2301 				m->m_pkthdr.len = m->m_len = pktlen;
2302 				if (pktlen > MHLEN) {
2303 					MCLGET(m, M_DONTWAIT);
2304 					if (!(m->m_flags & M_EXT)) {
2305 						m_free(m);
2306 						m = NULL;
2307 					}
2308 				}
2309 			}
2310 		} else	/* Drop frames larger than MCLBYTES. */
2311 			m = NULL;
2312 		/*
2313 		 * NB: m can be NULL, in which case the next pktlen bytes
2314 		 * will be discarded from the Rx stream.
2315 		 */
2316 		if (pktlen > len) {
2317 			/* Need more bytes, save what we have. */
2318 			stream->m = m;	/* NB: m can be NULL. */
2319 			if (__predict_true(stream->m != NULL)) {
2320 				memcpy(mtod(stream->m, uint8_t *), buf, len);
2321 				stream->moff = len;
2322 			}
2323 			stream->left = pktlen - len;
2324 			goto resubmit;
2325 		}
2326 		if (__predict_true(m != NULL)) {
2327 			/* We have all the pktlen bytes in this xfer. */
2328 			memcpy(mtod(m, uint8_t *), buf, pktlen);
2329 			athn_usb_rx_frame(usc, m);
2330 		}
2331 
2332 		/* Next header is 32-bit aligned. */
2333 		off = (pktlen + 3) & ~3;
2334 		buf += off;
2335 		len -= off;
2336 	}
2337 
2338  resubmit:
2339 	/* Setup a new transfer. */
2340 	usbd_setup_xfer(xfer, data, data->buf, ATHN_USB_RXBUFSZ,
2341 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, athn_usb_rxeof);
2342 	(void)usbd_transfer(xfer);
2343 }
2344 
2345 Static void
2346 athn_usb_txeof(struct usbd_xfer *xfer, void * priv,
2347     usbd_status status)
2348 {
2349 	struct athn_usb_tx_data *data = priv;
2350 	struct athn_usb_softc *usc = data->sc;
2351 	struct athn_softc *sc = &usc->usc_sc;
2352 	struct ifnet *ifp = &sc->sc_if;
2353 	int s;
2354 
2355 	if (usc->usc_dying)
2356 		return;
2357 
2358 	DPRINTFN(DBG_FN, usc, "\n");
2359 
2360 	s = splnet();
2361 	/* Put this Tx buffer back to our free list. */
2362 	mutex_enter(&usc->usc_tx_mtx);
2363 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2364 	mutex_exit(&usc->usc_tx_mtx);
2365 
2366 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2367 		DPRINTFN(DBG_TX, sc, "TX status=%d\n", status);
2368 		if (status == USBD_STALLED)
2369 			usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
2370 		ifp->if_oerrors++;
2371 		splx(s);
2372 		/* XXX Why return? */
2373 		return;
2374 	}
2375 	sc->sc_tx_timer = 0;
2376 	ifp->if_opackets++;
2377 
2378 	/* We just released a Tx buffer, notify Tx. */
2379 	if (ifp->if_flags & IFF_OACTIVE) {
2380 		ifp->if_flags &= ~IFF_OACTIVE;
2381 		ifp->if_start(ifp);
2382 	}
2383 	splx(s);
2384 }
2385 
2386 Static int
2387 athn_usb_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2388     struct athn_usb_tx_data *data)
2389 {
2390 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2391 	struct athn_node *an = ATHN_NODE(ni);
2392 	struct ieee80211com *ic = &sc->sc_ic;
2393 	struct ieee80211_frame *wh;
2394 	struct ieee80211_key *k = NULL;
2395 	struct ar_stream_hdr *hdr;
2396 	struct ar_htc_frame_hdr *htc;
2397 	struct ar_tx_frame *txf;
2398 	struct ar_tx_mgmt *txm;
2399 	uint8_t *frm;
2400 	uint8_t sta_index, qid, tid;
2401 	int error, s, xferlen;
2402 
2403 	DPRINTFN(DBG_FN, sc, "\n");
2404 
2405 	wh = mtod(m, struct ieee80211_frame *);
2406 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2407 		k = ieee80211_crypto_encap(ic, ni, m);
2408 		if (k == NULL)
2409 			return ENOBUFS;
2410 
2411 		/* packet header may have moved, reset our local pointer */
2412 		wh = mtod(m, struct ieee80211_frame *);
2413 	}
2414 #ifdef notyet_edca
2415 	if (ieee80211_has_qos(wh)) {
2416 		uint16_t qos;
2417 
2418 		qos = ieee80211_get_qos(wh);
2419 		tid = qos & IEEE80211_QOS_TID;
2420 		qid = ieee80211_up_to_ac(ic, tid);
2421 	} else
2422 #endif /* notyet_edca */
2423 	{
2424 		tid = 0;
2425 		qid = WME_AC_BE;
2426 	}
2427 
2428 	/* XXX Change radiotap Tx header for USB (no txrate). */
2429 	if (__predict_false(sc->sc_drvbpf != NULL)) {
2430 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
2431 
2432 		tap->wt_flags = 0;
2433 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2434 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2435 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
2436 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2437 
2438 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m);
2439 	}
2440 	sta_index = an->sta_index;
2441 
2442 	/* NB: We don't take advantage of USB Tx stream mode for now. */
2443 	hdr = (struct ar_stream_hdr *)data->buf;
2444 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
2445 
2446 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
2447 	memset(htc, 0, sizeof(*htc));
2448 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2449 	    IEEE80211_FC0_TYPE_DATA) {
2450 		htc->endpoint_id = usc->usc_ep_data[qid];
2451 
2452 		txf = (struct ar_tx_frame *)&htc[1];
2453 		memset(txf, 0, sizeof(*txf));
2454 		txf->data_type = AR_HTC_NORMAL;
2455 		txf->node_idx = sta_index;
2456 		txf->vif_idx = 0;
2457 		txf->tid = tid;
2458 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
2459 			txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2460 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2461 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2462 				txf->flags |= htobe32(AR_HTC_TX_CTSONLY);
2463 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2464 				txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2465 		}
2466 		txf->key_idx = 0xff;
2467 		frm = (uint8_t *)&txf[1];
2468 	} else {
2469 		htc->endpoint_id = usc->usc_ep_mgmt;
2470 
2471 		txm = (struct ar_tx_mgmt *)&htc[1];
2472 		memset(txm, 0, sizeof(*txm));
2473 		txm->node_idx = sta_index;
2474 		txm->vif_idx = 0;
2475 		txm->key_idx = 0xff;
2476 		frm = (uint8_t *)&txm[1];
2477 	}
2478 	/* Copy payload. */
2479 	m_copydata(m, 0, m->m_pkthdr.len, (void *)frm);
2480 	frm += m->m_pkthdr.len;
2481 
2482 	/* Finalize headers. */
2483 	htc->payload_len = htobe16(frm - (uint8_t *)&htc[1]);
2484 	hdr->len = htole16(frm - (uint8_t *)&hdr[1]);
2485 	xferlen = frm - data->buf;
2486 
2487 	s = splnet();
2488 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2489 	    USBD_FORCE_SHORT_XFER, ATHN_USB_TX_TIMEOUT, athn_usb_txeof);
2490 	error = usbd_transfer(data->xfer);
2491 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
2492 		splx(s);
2493 		return error;
2494 	}
2495 	splx(s);
2496 	return 0;
2497 }
2498 
2499 Static void
2500 athn_usb_start(struct ifnet *ifp)
2501 {
2502 	struct athn_softc *sc = ifp->if_softc;
2503 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2504 	struct ieee80211com *ic = &sc->sc_ic;
2505 	struct athn_usb_tx_data *data;
2506 	struct ether_header *eh;
2507 	struct ieee80211_node *ni;
2508 	struct mbuf *m;
2509 
2510 	if (usc->usc_dying)
2511 		return;
2512 
2513 	DPRINTFN(DBG_FN, sc, "\n");
2514 
2515 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2516 		return;
2517 
2518 	data = NULL;
2519 	for (;;) {
2520 		mutex_enter(&usc->usc_tx_mtx);
2521 		if (data == NULL && !TAILQ_EMPTY(&usc->usc_tx_free_list)) {
2522 			data = TAILQ_FIRST(&usc->usc_tx_free_list);
2523 			TAILQ_REMOVE(&usc->usc_tx_free_list, data, next);
2524 		}
2525 		mutex_exit(&usc->usc_tx_mtx);
2526 
2527 		if (data == NULL) {
2528 			ifp->if_flags |= IFF_OACTIVE;
2529 			return;
2530 		}
2531 
2532 		/* Send pending management frames first. */
2533 		IF_DEQUEUE(&ic->ic_mgtq, m);
2534 		if (m != NULL) {
2535 			ni = M_GETCTX(m, struct ieee80211_node *);
2536 			M_CLEARCTX(m);
2537 			goto sendit;
2538 		}
2539 		if (ic->ic_state != IEEE80211_S_RUN)
2540 			break;
2541 
2542 		/* Encapsulate and send data frames. */
2543 		IFQ_DEQUEUE(&ifp->if_snd, m);
2544 		if (m == NULL)
2545 			break;
2546 
2547 		if (m->m_len < (int)sizeof(*eh) &&
2548 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
2549 			ifp->if_oerrors++;
2550 			continue;
2551 		}
2552 		eh = mtod(m, struct ether_header *);
2553 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2554 		if (ni == NULL) {
2555 			m_freem(m);
2556 			ifp->if_oerrors++;
2557 			continue;
2558 		}
2559 
2560 		bpf_mtap(ifp, m);
2561 
2562 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
2563 			ieee80211_free_node(ni);
2564 			ifp->if_oerrors++;
2565 			continue;
2566 		}
2567  sendit:
2568 		bpf_mtap3(ic->ic_rawbpf, m);
2569 
2570 		if (athn_usb_tx(sc, m, ni, data) != 0) {
2571 			m_freem(m);
2572 			ieee80211_free_node(ni);
2573 			ifp->if_oerrors++;
2574 			continue;
2575 		}
2576 		data = NULL;
2577 		m_freem(m);
2578 		ieee80211_free_node(ni);
2579 		sc->sc_tx_timer = 5;
2580 		ifp->if_timer = 1;
2581 	}
2582 
2583 	/* Return the Tx buffer to the free list */
2584 	mutex_enter(&usc->usc_tx_mtx);
2585 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2586 	mutex_exit(&usc->usc_tx_mtx);
2587 }
2588 
2589 Static void
2590 athn_usb_watchdog(struct ifnet *ifp)
2591 {
2592 	struct athn_softc *sc = ifp->if_softc;
2593 
2594 	DPRINTFN(DBG_FN, sc, "\n");
2595 
2596 	ifp->if_timer = 0;
2597 
2598 	if (sc->sc_tx_timer > 0) {
2599 		if (--sc->sc_tx_timer == 0) {
2600 			aprint_error_dev(sc->sc_dev, "device timeout\n");
2601 			/* athn_usb_init(ifp); XXX needs a process context! */
2602 			ifp->if_oerrors++;
2603 			return;
2604 		}
2605 		ifp->if_timer = 1;
2606 	}
2607 	ieee80211_watchdog(&sc->sc_ic);
2608 }
2609 
2610 Static int
2611 athn_usb_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2612 {
2613 	struct athn_softc *sc = ifp->if_softc;
2614 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2615 	struct ieee80211com *ic = &sc->sc_ic;
2616 	int s, error = 0;
2617 
2618 	if (usc->usc_dying)
2619 		return EIO;
2620 
2621 	DPRINTFN(DBG_FN, sc, "cmd=0x%08lx\n", cmd);
2622 
2623 	s = splnet();
2624 
2625 	switch (cmd) {
2626 	case SIOCSIFFLAGS:
2627 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2628 			break;
2629 
2630 		switch (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
2631 		case IFF_UP | IFF_RUNNING:
2632 			break;
2633 		case IFF_UP:
2634 			error = athn_usb_init(ifp);
2635 			break;
2636 		case IFF_RUNNING:
2637 			athn_usb_stop(ifp);
2638 			break;
2639 		case 0:
2640 		default:
2641 			break;
2642 		}
2643 		break;
2644 
2645 	case SIOCADDMULTI:
2646 	case SIOCDELMULTI:
2647 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
2648 			/* setup multicast filter, etc */
2649 			error = 0;
2650 		}
2651 		break;
2652 
2653 	case SIOCS80211CHANNEL:
2654 		error = ieee80211_ioctl(ic, cmd, data);
2655 		if (error == ENETRESET &&
2656 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2657 			if (IS_UP_AND_RUNNING(ifp))
2658 				athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
2659 			error = 0;
2660 		}
2661 		break;
2662 
2663 	default:
2664 		error = ieee80211_ioctl(ic, cmd, data);
2665 		break;
2666 	}
2667 	if (error == ENETRESET) {
2668 		error = 0;
2669 		if (IS_UP_AND_RUNNING(ifp) &&
2670 		    ic->ic_roaming != IEEE80211_ROAMING_MANUAL) {
2671 			mutex_enter(&usc->usc_lock);
2672 			athn_usb_stop_locked(ifp);
2673 			error = athn_usb_init_locked(ifp);
2674 			mutex_exit(&usc->usc_lock);
2675 		}
2676 	}
2677 	splx(s);
2678 	return error;
2679 }
2680 
2681 Static int
2682 athn_usb_init(struct ifnet *ifp)
2683 {
2684 	struct athn_softc *sc = ifp->if_softc;
2685 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2686 
2687 	mutex_enter(&usc->usc_lock);
2688 	int ret = athn_usb_init_locked(ifp);
2689 	mutex_exit(&usc->usc_lock);
2690 
2691 	return ret;
2692 }
2693 
2694 Static int
2695 athn_usb_init_locked(struct ifnet *ifp)
2696 {
2697 	struct athn_softc *sc = ifp->if_softc;
2698 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2699 	struct athn_ops *ops = &sc->sc_ops;
2700 	struct ieee80211com *ic = &sc->sc_ic;
2701 	struct ieee80211_channel *curchan, *extchan;
2702 	struct athn_usb_rx_data *data;
2703 	struct ar_htc_target_vif hvif;
2704 	struct ar_htc_target_sta sta;
2705 	struct ar_htc_cap_target hic;
2706 	uint16_t mode;
2707 	size_t i;
2708 	int error;
2709 
2710 	if (usc->usc_dying)
2711 		return USBD_CANCELLED;
2712 
2713 	DPRINTFN(DBG_FN, sc, "\n");
2714 
2715 	/* Init host async commands ring. */
2716 	mutex_spin_enter(&usc->usc_task_mtx);
2717 	usc->usc_cmdq.cur = usc->usc_cmdq.next = usc->usc_cmdq.queued = 0;
2718 	mutex_spin_exit(&usc->usc_task_mtx);
2719 
2720 	/* Steal one buffer for beacons. */
2721 	mutex_enter(&usc->usc_tx_mtx);
2722 	usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
2723 	TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
2724 	mutex_exit(&usc->usc_tx_mtx);
2725 
2726 	curchan = ic->ic_curchan;
2727 	extchan = NULL;
2728 
2729 	/* In case a new MAC address has been configured. */
2730 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2731 
2732 	error = athn_set_power_awake(sc);
2733 	if (error != 0)
2734 		goto fail;
2735 
2736 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_FLUSH_RECV);
2737 	if (error != 0)
2738 		goto fail;
2739 
2740 	error = athn_hw_reset(sc, curchan, extchan, 1);
2741 	if (error != 0)
2742 		goto fail;
2743 
2744 	ops->set_txpower(sc, curchan, extchan);
2745 
2746 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
2747 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
2748 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
2749 	    &mode, sizeof(mode), NULL);
2750 	if (error != 0)
2751 		goto fail;
2752 
2753 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ATH_INIT);
2754 	if (error != 0)
2755 		goto fail;
2756 
2757 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
2758 	if (error != 0)
2759 		goto fail;
2760 
2761 	athn_rx_start(sc);
2762 
2763 	/* Create main interface on target. */
2764 	memset(&hvif, 0, sizeof(hvif));
2765 	hvif.index = 0;
2766 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2767 	switch (ic->ic_opmode) {
2768 	case IEEE80211_M_STA:
2769 		hvif.opmode = htobe32(AR_HTC_M_STA);
2770 		break;
2771 	case IEEE80211_M_MONITOR:
2772 		hvif.opmode = htobe32(AR_HTC_M_MONITOR);
2773 		break;
2774 #ifndef IEEE80211_STA_ONLY
2775 	case IEEE80211_M_IBSS:
2776 		hvif.opmode = htobe32(AR_HTC_M_IBSS);
2777 		break;
2778 	case IEEE80211_M_AHDEMO:
2779 		hvif.opmode = htobe32(AR_HTC_M_AHDEMO);
2780 		break;
2781 	case IEEE80211_M_HOSTAP:
2782 		hvif.opmode = htobe32(AR_HTC_M_HOSTAP);
2783 		break;
2784 #endif
2785 	}
2786 	hvif.rtsthreshold = htobe16(ic->ic_rtsthreshold);
2787 	DPRINTFN(DBG_INIT, sc, "creating VAP\n");
2788 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_CREATE,
2789 	    &hvif, sizeof(hvif), NULL);
2790 	if (error != 0)
2791 		goto fail;
2792 
2793 	/* Create a fake node to send management frames before assoc. */
2794 	memset(&sta, 0, sizeof(sta));
2795 	IEEE80211_ADDR_COPY(sta.macaddr, ic->ic_myaddr);
2796 	sta.sta_index = 0;
2797 	sta.is_vif_sta = 1;
2798 	sta.vif_index = hvif.index;
2799 	sta.maxampdu = 0xffff;
2800 
2801 	DPRINTFN(DBG_INIT | DBG_NODES, sc, "creating default node %u\n",
2802 	    sta.sta_index);
2803 	error = athn_usb_create_hw_node(usc, &sta);
2804 	if (error != 0)
2805 		goto fail;
2806 
2807 	/* Update target capabilities. */
2808 	memset(&hic, 0, sizeof(hic));
2809 	hic.flags = htobe32(0x400c2400);
2810 	hic.flags_ext = htobe32(0x00106080);
2811 	hic.ampdu_limit = htobe32(0x0000ffff);
2812 	hic.ampdu_subframes = 20;
2813 	hic.protmode = 1;	/* XXX */
2814 	hic.lg_txchainmask = sc->sc_txchainmask;
2815 	hic.ht_txchainmask = sc->sc_txchainmask;
2816 	DPRINTFN(DBG_INIT, sc, "updating target configuration\n");
2817 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TARGET_IC_UPDATE,
2818 	    &hic, sizeof(hic), NULL);
2819 	if (error != 0)
2820 		goto fail;
2821 
2822 
2823 	/* Queue Rx xfers. */
2824 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
2825 		data = &usc->usc_rx_data[i];
2826 
2827 		usbd_setup_xfer(data->xfer, data, data->buf,
2828 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK,
2829 		    USBD_NO_TIMEOUT, athn_usb_rxeof);
2830 		error = usbd_transfer(data->xfer);
2831 		if (error != 0 && error != USBD_IN_PROGRESS)
2832 			goto fail;
2833 	}
2834 	/* We're ready to go. */
2835 	ifp->if_flags &= ~IFF_OACTIVE;
2836 	ifp->if_flags |= IFF_RUNNING;
2837 
2838 #ifdef notyet
2839 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2840 		/* Install WEP keys. */
2841 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2842 			athn_usb_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2843 	}
2844 #endif
2845 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2846 		ic->ic_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
2847 	else
2848 		ic->ic_max_aid = sc->sc_max_aid;
2849 
2850 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2851 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2852 	else
2853 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2854 	athn_usb_wait_async(usc);
2855 	return 0;
2856  fail:
2857 	athn_usb_stop(ifp);
2858 	return error;
2859 }
2860 
2861 Static void
2862 athn_usb_stop(struct ifnet *ifp)
2863 {
2864 	struct athn_softc *sc = ifp->if_softc;
2865 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2866 
2867 	mutex_enter(&usc->usc_lock);
2868 	athn_usb_stop_locked(ifp);
2869 	mutex_exit(&usc->usc_lock);
2870 }
2871 
2872 Static void
2873 athn_usb_stop_locked(struct ifnet *ifp)
2874 {
2875 	struct athn_softc *sc = ifp->if_softc;
2876 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2877 	struct ieee80211com *ic = &sc->sc_ic;
2878 	struct ar_htc_target_vif hvif;
2879 	struct mbuf *m;
2880 	uint8_t sta_index;
2881 	int s;
2882 
2883 	DPRINTFN(DBG_FN, sc, "\n");
2884 
2885 	s = splusb();
2886 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2887 	athn_usb_wait_async(usc);
2888 	splx(s);
2889 
2890 	sc->sc_tx_timer = 0;
2891 	ifp->if_timer = 0;
2892 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2893 
2894 	callout_stop(&sc->sc_scan_to);
2895 	callout_stop(&sc->sc_calib_to);
2896 
2897 	/* Abort Tx/Rx. */
2898 	usbd_abort_pipe(usc->usc_tx_data_pipe);
2899 	usbd_abort_pipe(usc->usc_rx_data_pipe);
2900 
2901 	/* Flush Rx stream. */
2902 	CTASSERT(sizeof(m) == sizeof(void *));
2903 	m = atomic_swap_ptr(&usc->usc_rx_stream.m, NULL);
2904 	m_freem(m);
2905 	usc->usc_rx_stream.left = 0;
2906 
2907 	/* Remove main interface. */
2908 	memset(&hvif, 0, sizeof(hvif));
2909 	hvif.index = 0;
2910 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2911 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_REMOVE,
2912 	    &hvif, sizeof(hvif), NULL);
2913 
2914 	/* Remove default node. */
2915 	sta_index = 0;
2916 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
2917 	(void)athn_usb_remove_hw_node(usc, &sta_index);
2918 
2919 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
2920 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
2921 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
2922 
2923 	athn_reset(sc, 0);
2924 	athn_init_pll(sc, NULL);
2925 	athn_set_power_awake(sc);
2926 	athn_reset(sc, 1);
2927 	athn_init_pll(sc, NULL);
2928 	athn_set_power_sleep(sc);
2929 }
2930 
2931 MODULE(MODULE_CLASS_DRIVER, if_athn_usb, "bpf");
2932 
2933 #ifdef _MODULE
2934 #include "ioconf.c"
2935 #endif
2936 
2937 static int
2938 if_athn_usb_modcmd(modcmd_t cmd, void *aux)
2939 {
2940 	int error = 0;
2941 
2942 	switch (cmd) {
2943 	case MODULE_CMD_INIT:
2944 #ifdef _MODULE
2945 		error = config_init_component(cfdriver_ioconf_if_athn_usb,
2946 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
2947 #endif
2948 		return error;
2949 	case MODULE_CMD_FINI:
2950 #ifdef _MODULE
2951 		error = config_fini_component(cfdriver_ioconf_if_athn_usb,
2952 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
2953 #endif
2954 		return error;
2955 	default:
2956 		return ENOTTY;
2957 	}
2958 }
2959