xref: /netbsd-src/sys/dev/usb/if_athn_usb.c (revision c34236556bea94afcaca1782d7d228301edc3ea0)
1 /*	$NetBSD: if_athn_usb.c,v 1.20 2016/12/24 11:51:33 skrll Exp $	*/
2 /*	$OpenBSD: if_athn_usb.c,v 1.12 2013/01/14 09:50:31 jsing Exp $	*/
3 
4 /*-
5  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * USB front-end for Atheros AR9271 and AR7010 chipsets.
22  */
23 
24 #include <sys/cdefs.h>
25 __KERNEL_RCSID(0, "$NetBSD: if_athn_usb.c,v 1.20 2016/12/24 11:51:33 skrll Exp $");
26 
27 #ifdef	_KERNEL_OPT
28 #include "opt_inet.h"
29 #endif
30 
31 #include <sys/param.h>
32 #include <sys/callout.h>
33 #include <sys/conf.h>
34 #include <sys/device.h>
35 #include <sys/kernel.h>
36 #include <sys/mbuf.h>
37 #include <sys/module.h>
38 #include <sys/proc.h>
39 #include <sys/socket.h>
40 #include <sys/sockio.h>
41 #include <sys/systm.h>
42 #include <sys/kmem.h>
43 
44 #include <sys/bus.h>
45 #include <sys/endian.h>
46 #include <sys/intr.h>
47 
48 #include <net/bpf.h>
49 #include <net/if.h>
50 #include <net/if_arp.h>
51 #include <net/if_dl.h>
52 #include <net/if_ether.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 
56 #include <netinet/if_inarp.h>
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_amrr.h>
64 #include <net80211/ieee80211_radiotap.h>
65 
66 #include <dev/firmload.h>
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdevs.h>
70 #include <dev/usb/usbdi.h>
71 #include <dev/usb/usbdi_util.h>
72 
73 #include <dev/ic/athnreg.h>
74 #include <dev/ic/athnvar.h>
75 #include <dev/ic/arn9285.h>
76 #include <dev/usb/if_athn_usb.h>
77 
78 #define ATHN_USB_SOFTC(sc)	((struct athn_usb_softc *)(sc))
79 #define ATHN_USB_NODE(ni)	((struct athn_usb_node *)(ni))
80 
81 #define IS_UP_AND_RUNNING(ifp) \
82 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
83 
84 #define athn_usb_wmi_cmd(sc, cmd_id) \
85 	athn_usb_wmi_xcmd(sc, cmd_id, NULL, 0, NULL)
86 
87 Static int	athn_usb_activate(device_t, enum devact);
88 Static int	athn_usb_detach(device_t, int);
89 Static int	athn_usb_match(device_t, cfdata_t, void *);
90 Static void	athn_usb_attach(device_t, device_t, void *);
91 
92 CFATTACH_DECL_NEW(athn_usb, sizeof(struct athn_usb_softc), athn_usb_match,
93     athn_usb_attach, athn_usb_detach, athn_usb_activate);
94 
95 Static int	athn_usb_alloc_rx_list(struct athn_usb_softc *);
96 Static int	athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
97 Static int	athn_usb_alloc_tx_msg(struct athn_usb_softc *);
98 Static int	athn_usb_alloc_tx_list(struct athn_usb_softc *);
99 Static void	athn_usb_attachhook(device_t);
100 Static void	athn_usb_bcneof(struct usbd_xfer *, void *,
101 		    usbd_status);
102 Static void	athn_usb_abort_pipes(struct athn_usb_softc *);
103 Static void	athn_usb_close_pipes(struct athn_usb_softc *);
104 Static int	athn_usb_create_hw_node(struct athn_usb_softc *,
105 		    struct ar_htc_target_sta *);
106 Static int	athn_usb_create_node(struct athn_usb_softc *,
107 		    struct ieee80211_node *);
108 Static void	athn_usb_do_async(struct athn_usb_softc *,
109 		    void (*)(struct athn_usb_softc *, void *), void *, int);
110 Static void	athn_usb_free_rx_list(struct athn_usb_softc *);
111 Static void	athn_usb_free_tx_cmd(struct athn_usb_softc *);
112 Static void	athn_usb_free_tx_msg(struct athn_usb_softc *);
113 Static void	athn_usb_free_tx_list(struct athn_usb_softc *);
114 Static int	athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
115 		    uint8_t, uint8_t, uint8_t *);
116 Static int	athn_usb_htc_msg(struct athn_usb_softc *, uint16_t, void *,
117 		    int);
118 Static int	athn_usb_htc_setup(struct athn_usb_softc *);
119 Static int	athn_usb_init(struct ifnet *);
120 Static int	athn_usb_init_locked(struct ifnet *);
121 Static void	athn_usb_intr(struct usbd_xfer *, void *,
122 		    usbd_status);
123 Static int	athn_usb_ioctl(struct ifnet *, u_long, void *);
124 Static int	athn_usb_load_firmware(struct athn_usb_softc *);
125 Static const struct athn_usb_type *
126 		athn_usb_lookup(int, int);
127 Static int	athn_usb_media_change(struct ifnet *);
128 Static void	athn_usb_newassoc(struct ieee80211_node *, int);
129 Static void	athn_usb_newassoc_cb(struct athn_usb_softc *, void *);
130 Static int	athn_usb_newstate(struct ieee80211com *, enum ieee80211_state,
131 		    int);
132 Static void	athn_usb_newstate_cb(struct athn_usb_softc *, void *);
133 Static void	athn_usb_node_cleanup(struct ieee80211_node *);
134 Static void	athn_usb_node_cleanup_cb(struct athn_usb_softc *, void *);
135 Static int	athn_usb_open_pipes(struct athn_usb_softc *);
136 Static uint32_t	athn_usb_read(struct athn_softc *, uint32_t);
137 Static int	athn_usb_remove_hw_node(struct athn_usb_softc *, uint8_t *);
138 Static void	athn_usb_rx_enable(struct athn_softc *);
139 Static void	athn_usb_rx_frame(struct athn_usb_softc *, struct mbuf *);
140 Static void	athn_usb_rx_radiotap(struct athn_softc *, struct mbuf *,
141 		    struct ar_rx_status *);
142 Static void	athn_usb_rx_wmi_ctrl(struct athn_usb_softc *, uint8_t *, size_t);
143 Static void	athn_usb_rxeof(struct usbd_xfer *, void *,
144 		    usbd_status);
145 Static void	athn_usb_start(struct ifnet *);
146 //Static void	athn_usb_start_locked(struct ifnet *);
147 Static void	athn_usb_stop(struct ifnet *);
148 Static void	athn_usb_stop_locked(struct ifnet *);
149 Static void	athn_usb_swba(struct athn_usb_softc *);
150 Static int	athn_usb_switch_chan(struct athn_softc *,
151 		    struct ieee80211_channel *, struct ieee80211_channel *);
152 Static void	athn_usb_task(void *);
153 Static int	athn_usb_tx(struct athn_softc *, struct mbuf *,
154 		    struct ieee80211_node *, struct athn_usb_tx_data *);
155 Static void	athn_usb_txeof(struct usbd_xfer *, void *,
156 		    usbd_status);
157 Static void	athn_usb_updateslot(struct ifnet *);
158 Static void	athn_usb_updateslot_cb(struct athn_usb_softc *, void *);
159 Static void	athn_usb_wait_async(struct athn_usb_softc *);
160 Static int	athn_usb_wait_cmd(struct athn_usb_softc *);
161 Static int	athn_usb_wait_msg(struct athn_usb_softc *);
162 Static void	athn_usb_watchdog(struct ifnet *);
163 Static int	athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
164 		    int, void *);
165 Static void	athn_usb_wmieof(struct usbd_xfer *, void *,
166 		    usbd_status);
167 Static void	athn_usb_write(struct athn_softc *, uint32_t, uint32_t);
168 Static void	athn_usb_write_barrier(struct athn_softc *);
169 
170 /************************************************************************
171  * unused/notyet declarations
172  */
173 #ifdef unused
174 Static int	athn_usb_read_rom(struct athn_softc *);
175 #endif /* unused */
176 
177 #ifdef notyet_edca
178 Static void	athn_usb_updateedca(struct ieee80211com *);
179 Static void	athn_usb_updateedca_cb(struct athn_usb_softc *, void *);
180 #endif /* notyet_edca */
181 
182 #ifdef notyet
183 Static int	athn_usb_ampdu_tx_start(struct ieee80211com *,
184 		    struct ieee80211_node *, uint8_t);
185 Static void	athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *, void *);
186 Static void	athn_usb_ampdu_tx_stop(struct ieee80211com *,
187 		    struct ieee80211_node *, uint8_t);
188 Static void	athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *, void *);
189 Static void	athn_usb_delete_key(struct ieee80211com *,
190 		    struct ieee80211_node *, struct ieee80211_key *);
191 Static void	athn_usb_delete_key_cb(struct athn_usb_softc *, void *);
192 Static int	athn_usb_set_key(struct ieee80211com *,
193 		    struct ieee80211_node *, struct ieee80211_key *);
194 Static void	athn_usb_set_key_cb(struct athn_usb_softc *, void *);
195 #endif /* notyet */
196 /************************************************************************/
197 
198 struct athn_usb_type {
199 	struct usb_devno	devno;
200 	u_int			flags;
201 };
202 
203 Static const struct athn_usb_type *
204 athn_usb_lookup(int vendor, int product)
205 {
206 	static const struct athn_usb_type athn_usb_devs[] = {
207 #define _D(v,p,f) \
208 		{{ USB_VENDOR_##v, USB_PRODUCT_##p }, ATHN_USB_FLAG_##f }
209 
210 		_D( ACCTON,	ACCTON_AR9280,		AR7010 ),
211 		_D( ACTIONTEC,	ACTIONTEC_AR9287,	AR7010 ),
212 		_D( ATHEROS2,	ATHEROS2_AR9271_1,	NONE ),
213 		_D( ATHEROS2,	ATHEROS2_AR9271_2,	NONE ),
214 		_D( ATHEROS2,	ATHEROS2_AR9271_3,	NONE ),
215 		_D( ATHEROS2,	ATHEROS2_AR9280,	AR7010 ),
216 		_D( ATHEROS2,	ATHEROS2_AR9287,	AR7010 ),
217 		_D( AZUREWAVE,	AZUREWAVE_AR9271_1,	NONE ),
218 		_D( AZUREWAVE,	AZUREWAVE_AR9271_2,	NONE ),
219 		_D( AZUREWAVE,	AZUREWAVE_AR9271_3,	NONE ),
220 		_D( AZUREWAVE,	AZUREWAVE_AR9271_4,	NONE ),
221 		_D( AZUREWAVE,	AZUREWAVE_AR9271_5,	NONE ),
222 		_D( AZUREWAVE,	AZUREWAVE_AR9271_6,	NONE ),
223 		_D( DLINK2,	DLINK2_AR9271,	  	NONE ),
224 		_D( LITEON,	LITEON_AR9271,	  	NONE ),
225 		_D( NETGEAR,	NETGEAR_WNA1100,	NONE ),
226 		_D( NETGEAR,	NETGEAR_WNDA3200,	AR7010 ),
227 		_D( VIA,	VIA_AR9271,		NONE )
228 #undef _D
229 	};
230 
231 	return (const void *)usb_lookup(athn_usb_devs, vendor, product);
232 }
233 
234 Static int
235 athn_usb_match(device_t parent, cfdata_t match, void *aux)
236 {
237 	struct usb_attach_arg *uaa = aux;
238 
239 	return athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
240 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
241 }
242 
243 Static void
244 athn_usb_attach(device_t parent, device_t self, void *aux)
245 {
246 	struct athn_usb_softc *usc;
247 	struct athn_softc *sc;
248 	struct usb_attach_arg *uaa;
249 	int error;
250 
251 	usc = device_private(self);
252 	sc = &usc->usc_sc;
253 	uaa = aux;
254 	sc->sc_dev = self;
255 	usc->usc_udev = uaa->uaa_device;
256 
257 	aprint_naive("\n");
258 	aprint_normal("\n");
259 
260 	DPRINTFN(DBG_FN, sc, "\n");
261 
262 	usc->usc_athn_attached = 0;
263 	usc->usc_flags = athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product)->flags;
264 	sc->sc_flags |= ATHN_FLAG_USB;
265 #ifdef notyet
266 	/* Check if it is a combo WiFi+Bluetooth (WB193) device. */
267 	if (strncmp(product, "wb193", 5) == 0)
268 		sc->sc_flags |= ATHN_FLAG_BTCOEX3WIRE;
269 #endif
270 
271 	sc->sc_ops.read = athn_usb_read;
272 	sc->sc_ops.write = athn_usb_write;
273 	sc->sc_ops.write_barrier = athn_usb_write_barrier;
274 
275 	mutex_init(&usc->usc_lock, MUTEX_DEFAULT, IPL_NONE);
276 
277 	cv_init(&usc->usc_cmd_cv, "athncmd");
278 	mutex_init(&usc->usc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
279 	cv_init(&usc->usc_msg_cv, "athnmsg");
280 	mutex_init(&usc->usc_msg_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
281 
282 	cv_init(&usc->usc_task_cv, "athntsk");
283 	mutex_init(&usc->usc_task_mtx, MUTEX_DEFAULT, IPL_NET);
284 	mutex_init(&usc->usc_tx_mtx, MUTEX_DEFAULT, IPL_NONE);
285 
286 	usb_init_task(&usc->usc_task, athn_usb_task, usc, 0);
287 
288 	if (usbd_set_config_no(usc->usc_udev, 1, 0) != 0) {
289 		aprint_error_dev(sc->sc_dev,
290 		    "could not set configuration no\n");
291 		goto fail;
292 	}
293 
294 	/* Get the first interface handle. */
295 	error = usbd_device2interface_handle(usc->usc_udev, 0, &usc->usc_iface);
296 	if (error != 0) {
297 		aprint_error_dev(sc->sc_dev,
298 		    "could not get interface handle\n");
299 		goto fail;
300 	}
301 
302 	if (athn_usb_open_pipes(usc) != 0)
303 		goto fail;
304 
305 	/* Allocate xfer for firmware commands. */
306 	if (athn_usb_alloc_tx_cmd(usc) != 0)
307 		goto fail;
308 
309 	/* Allocate xfer for firmware commands. */
310 	if (athn_usb_alloc_tx_msg(usc) != 0)
311 		goto fail;
312 
313 	/* Allocate Tx/Rx buffers. */
314 	error = athn_usb_alloc_rx_list(usc);
315 	if (error != 0)
316 		goto fail;
317 	error = athn_usb_alloc_tx_list(usc);
318 	if (error != 0)
319 		goto fail;
320 
321 	config_mountroot(self, athn_usb_attachhook);
322 
323 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, usc->usc_udev, sc->sc_dev);
324 	return;
325 
326  fail:
327 
328 	/* Free Tx/Rx buffers. */
329 	athn_usb_abort_pipes(usc);
330 	athn_usb_free_tx_list(usc);
331 	athn_usb_free_rx_list(usc);
332 	athn_usb_free_tx_cmd(usc);
333 	athn_usb_free_tx_msg(usc);
334 	athn_usb_close_pipes(usc);
335 	usb_rem_task(usc->usc_udev, &usc->usc_task);
336 
337 	cv_destroy(&usc->usc_cmd_cv);
338 	cv_destroy(&usc->usc_msg_cv);
339 
340 	mutex_destroy(&usc->usc_lock);
341 
342 	mutex_destroy(&usc->usc_cmd_mtx);
343 	mutex_destroy(&usc->usc_msg_mtx);
344 	mutex_destroy(&usc->usc_tx_mtx);
345 	mutex_destroy(&usc->usc_task_mtx);
346 }
347 
348 Static void
349 athn_usb_node_cleanup_cb(struct athn_usb_softc *usc, void *arg)
350 {
351 	uint8_t sta_index = *(uint8_t *)arg;
352 
353 	DPRINTFN(DBG_FN, usc, "\n");
354 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
355 	athn_usb_remove_hw_node(usc, &sta_index);
356 }
357 
358 Static void
359 athn_usb_node_cleanup(struct ieee80211_node *ni)
360 {
361 	struct athn_usb_softc *usc;
362 	struct ieee80211com *ic;
363 	uint8_t sta_index;
364 
365 	usc = ATHN_USB_SOFTC(ni->ni_ic->ic_ifp->if_softc);
366 	ic = &ATHN_SOFTC(usc)->sc_ic;
367 
368 	DPRINTFN(DBG_FN, usc, "\n");
369 
370 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
371 		sta_index = ATHN_NODE(ni)->sta_index;
372 		if (sta_index != 0)
373 			athn_usb_do_async(usc, athn_usb_node_cleanup_cb,
374 			    &sta_index, sizeof(sta_index));
375 	}
376 	usc->usc_node_cleanup(ni);
377 }
378 
379 Static void
380 athn_usb_attachhook(device_t arg)
381 {
382 	struct athn_usb_softc *usc = device_private(arg);
383 	struct athn_softc *sc = &usc->usc_sc;
384 	struct athn_ops *ops = &sc->sc_ops;
385 	struct ieee80211com *ic = &sc->sc_ic;
386 	struct ifnet *ifp = &sc->sc_if;
387 	size_t i;
388 	int s, error;
389 
390 	if (usc->usc_dying)
391 		return;
392 
393 	DPRINTFN(DBG_FN, usc, "\n");
394 
395 	/* Load firmware. */
396 	error = athn_usb_load_firmware(usc);
397 	if (error != 0) {
398 		aprint_error_dev(sc->sc_dev,
399 		    "could not load firmware (%d)\n", error);
400 		return;
401 	}
402 
403 	/* Setup the host transport communication interface. */
404 	error = athn_usb_htc_setup(usc);
405 	if (error != 0)
406 		return;
407 
408 	/* We're now ready to attach the bus agnostic driver. */
409 	s = splnet();
410 	ic->ic_ifp = ifp;
411 	ic->ic_updateslot = athn_usb_updateslot;
412 	sc->sc_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
413 	sc->sc_media_change = athn_usb_media_change;
414 	error = athn_attach(sc);
415 	if (error != 0) {
416 		splx(s);
417 		return;
418 	}
419 	usc->usc_athn_attached = 1;
420 
421 	/* Override some operations for USB. */
422 	ifp->if_init = athn_usb_init;
423 	ifp->if_ioctl = athn_usb_ioctl;
424 	ifp->if_start = athn_usb_start;
425 	ifp->if_watchdog = athn_usb_watchdog;
426 
427 	/* hooks for HostAP association and disassociation */
428 	ic->ic_newassoc = athn_usb_newassoc;
429 	usc->usc_node_cleanup = ic->ic_node_cleanup;
430 	ic->ic_node_cleanup = athn_usb_node_cleanup;
431 
432 #ifdef notyet_edca
433 	ic->ic_updateedca = athn_usb_updateedca;
434 #endif
435 #ifdef notyet
436 	ic->ic_set_key = athn_usb_set_key;
437 	ic->ic_delete_key = athn_usb_delete_key;
438 	ic->ic_ampdu_tx_start = athn_usb_ampdu_tx_start;
439 	ic->ic_ampdu_tx_stop = athn_usb_ampdu_tx_stop;
440 #endif
441 	ic->ic_newstate = athn_usb_newstate;
442 
443 	ops->rx_enable = athn_usb_rx_enable;
444 	splx(s);
445 
446 	/* Reset HW key cache entries. */
447 	for (i = 0; i < sc->sc_kc_entries; i++)
448 		athn_reset_key(sc, i);
449 
450 	ops->enable_antenna_diversity(sc);
451 
452 #ifdef ATHN_BT_COEXISTENCE
453 	/* Configure bluetooth coexistence for combo chips. */
454 	if (sc->sc_flags & ATHN_FLAG_BTCOEX)
455 		athn_btcoex_init(sc);
456 #endif
457 	/* Configure LED. */
458 	athn_led_init(sc);
459 
460 	ieee80211_announce(ic);
461 }
462 
463 Static int
464 athn_usb_detach(device_t self, int flags)
465 {
466 	struct athn_usb_softc *usc = device_private(self);
467 	struct athn_softc *sc = &usc->usc_sc;
468 	int s;
469 
470 	DPRINTFN(DBG_FN, usc, "\n");
471 
472 	s = splusb();
473 	usc->usc_dying = 1;
474 
475 	mutex_enter(&usc->usc_cmd_mtx);
476 	athn_usb_wait_cmd(usc);
477 	mutex_exit(&usc->usc_cmd_mtx);
478 	mutex_enter(&usc->usc_msg_mtx);
479 	athn_usb_wait_msg(usc);
480 	mutex_exit(&usc->usc_msg_mtx);
481 	athn_usb_wait_async(usc);
482 
483 	usb_rem_task(usc->usc_udev, &usc->usc_task);
484 
485 	if (usc->usc_athn_attached) {
486 		usc->usc_athn_attached = 0;
487 		athn_detach(sc);
488 	}
489 	/* Abort Tx/Rx pipes. */
490 	athn_usb_abort_pipes(usc);
491 	splx(s);
492 
493 	/* Free Tx/Rx buffers. */
494 	athn_usb_free_rx_list(usc);
495 	athn_usb_free_tx_list(usc);
496 	athn_usb_free_tx_cmd(usc);
497 
498 	/* Close Tx/Rx pipes. */
499 	athn_usb_close_pipes(usc);
500 
501 	mutex_destroy(&usc->usc_tx_mtx);
502 	cv_destroy(&usc->usc_task_cv);
503 	mutex_destroy(&usc->usc_task_mtx);
504 
505 	mutex_destroy(&usc->usc_cmd_mtx);
506 	cv_destroy(&usc->usc_cmd_cv);
507 	mutex_destroy(&usc->usc_msg_mtx);
508 	cv_destroy(&usc->usc_msg_cv);
509 
510 	mutex_destroy(&usc->usc_lock);
511 
512 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, usc->usc_udev, sc->sc_dev);
513 	return 0;
514 }
515 
516 Static int
517 athn_usb_activate(device_t self, enum devact act)
518 {
519 	struct athn_usb_softc *usc = device_private(self);
520 	struct athn_softc *sc = &usc->usc_sc;
521 
522 	DPRINTFN(DBG_FN, usc, "\n");
523 
524 	switch (act) {
525 	case DVACT_DEACTIVATE:
526 		if_deactivate(sc->sc_ic.ic_ifp);
527 		usc->usc_dying = 1;
528 		return 0;
529 	default:
530 		return EOPNOTSUPP;
531 	}
532 }
533 
534 Static int
535 athn_usb_open_pipes(struct athn_usb_softc *usc)
536 {
537 	usb_endpoint_descriptor_t *ed;
538 	int error;
539 
540 	DPRINTFN(DBG_FN, usc, "\n");
541 
542 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_DATA, 0,
543 	    &usc->usc_tx_data_pipe);
544 	if (error != 0) {
545 		aprint_error_dev(usc->usc_dev,
546 		    "could not open Tx bulk pipe\n");
547 		goto fail;
548 	}
549 
550 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_RX_DATA, 0,
551 	    &usc->usc_rx_data_pipe);
552 	if (error != 0) {
553 		aprint_error_dev(usc->usc_dev,
554 		    "could not open Rx bulk pipe\n");
555 		goto fail;
556 	}
557 
558 	ed = usbd_get_endpoint_descriptor(usc->usc_iface, AR_PIPE_RX_INTR);
559 	if (ed == NULL) {
560 		aprint_error_dev(usc->usc_dev,
561 		    "could not retrieve Rx intr pipe descriptor\n");
562 		goto fail;
563 	}
564 	usc->usc_ibufsize = UGETW(ed->wMaxPacketSize);
565 	if (usc->usc_ibufsize == 0) {
566 		aprint_error_dev(usc->usc_dev,
567 		    "invalid Rx intr pipe descriptor\n");
568 		goto fail;
569 	}
570 	usc->usc_ibuf = kmem_alloc(usc->usc_ibufsize, KM_SLEEP);
571 	if (usc->usc_ibuf == NULL) {
572 		aprint_error_dev(usc->usc_dev,
573 		    "could not allocate Rx intr buffer\n");
574 		goto fail;
575 	}
576 
577 	error = usbd_open_pipe_intr(usc->usc_iface, AR_PIPE_RX_INTR,
578 	    USBD_SHORT_XFER_OK, &usc->usc_rx_intr_pipe, usc, usc->usc_ibuf,
579 	    usc->usc_ibufsize, athn_usb_intr, USBD_DEFAULT_INTERVAL);
580 	if (error != 0) {
581 		aprint_error_dev(usc->usc_dev,
582 		    "could not open Rx intr pipe\n");
583 		goto fail;
584 	}
585 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_INTR, 0,
586 	    &usc->usc_tx_intr_pipe);
587 	if (error != 0) {
588 		aprint_error_dev(usc->usc_dev,
589 		    "could not open Tx intr pipe\n");
590 		goto fail;
591 	}
592 	return 0;
593  fail:
594 	athn_usb_abort_pipes(usc);
595 	athn_usb_close_pipes(usc);
596 	return error;
597 }
598 
599 static inline void
600 athn_usb_kill_pipe(struct usbd_pipe **pipeptr)
601 {
602 	struct usbd_pipe *pipe;
603 
604 	CTASSERT(sizeof(pipe) == sizeof(void *));
605 	pipe = atomic_swap_ptr(pipeptr, NULL);
606 	if (pipe != NULL) {
607 		usbd_close_pipe(pipe);
608 	}
609 }
610 
611 Static void
612 athn_usb_abort_pipes(struct athn_usb_softc *usc)
613 {
614 	DPRINTFN(DBG_FN, usc, "\n");
615 
616 	if (usc->usc_tx_data_pipe != NULL)
617 		usbd_abort_pipe(usc->usc_tx_data_pipe);
618 	if (usc->usc_rx_data_pipe != NULL)
619 		usbd_abort_pipe(usc->usc_rx_data_pipe);
620 	if (usc->usc_tx_intr_pipe != NULL)
621 		usbd_abort_pipe(usc->usc_tx_intr_pipe);
622 	if (usc->usc_rx_intr_pipe != NULL)
623 		usbd_abort_pipe(usc->usc_rx_intr_pipe);
624 }
625 
626 Static void
627 athn_usb_close_pipes(struct athn_usb_softc *usc)
628 {
629 	uint8_t *ibuf;
630 
631 	DPRINTFN(DBG_FN, usc, "\n");
632 
633 	athn_usb_kill_pipe(&usc->usc_tx_data_pipe);
634 	athn_usb_kill_pipe(&usc->usc_rx_data_pipe);
635 	athn_usb_kill_pipe(&usc->usc_tx_intr_pipe);
636 	athn_usb_kill_pipe(&usc->usc_rx_intr_pipe);
637 	ibuf = atomic_swap_ptr(&usc->usc_ibuf, NULL);
638 	if (ibuf != NULL)
639 		kmem_free(ibuf, usc->usc_ibufsize);
640 }
641 
642 Static int
643 athn_usb_alloc_rx_list(struct athn_usb_softc *usc)
644 {
645 	struct athn_usb_rx_data *data;
646 	size_t i;
647 	int error = 0;
648 
649 	DPRINTFN(DBG_FN, usc, "\n");
650 
651 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
652 		data = &usc->usc_rx_data[i];
653 
654 		data->sc = usc;	/* Backpointer for callbacks. */
655 
656 		error = usbd_create_xfer(usc->usc_rx_data_pipe,
657 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK, 0, &data->xfer);
658 		if (error) {
659 			aprint_error_dev(usc->usc_dev,
660 			    "could not allocate xfer\n");
661 			break;
662 		}
663 		data->buf = usbd_get_buffer(data->xfer);
664 	}
665 	if (error != 0)
666 		athn_usb_free_rx_list(usc);
667 	return error;
668 }
669 
670 Static void
671 athn_usb_free_rx_list(struct athn_usb_softc *usc)
672 {
673 	struct usbd_xfer *xfer;
674 	size_t i;
675 
676 	DPRINTFN(DBG_FN, usc, "\n");
677 
678 	/* NB: Caller must abort pipe first. */
679 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
680 		CTASSERT(sizeof(xfer) == sizeof(void *));
681 		xfer = atomic_swap_ptr(&usc->usc_rx_data[i].xfer, NULL);
682 		if (xfer != NULL)
683 			usbd_destroy_xfer(xfer);
684 	}
685 }
686 
687 Static int
688 athn_usb_alloc_tx_list(struct athn_usb_softc *usc)
689 {
690 	struct athn_usb_tx_data *data;
691 	size_t i;
692 	int error = 0;
693 
694 	DPRINTFN(DBG_FN, usc, "\n");
695 
696 	mutex_enter(&usc->usc_tx_mtx);
697 	TAILQ_INIT(&usc->usc_tx_free_list);
698 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
699 		data = &usc->usc_tx_data[i];
700 
701 		data->sc = usc;	/* Backpointer for callbacks. */
702 
703 		error = usbd_create_xfer(usc->usc_tx_data_pipe,
704 		    ATHN_USB_TXBUFSZ, USBD_SHORT_XFER_OK, 0, &data->xfer);
705 		if (error) {
706 			aprint_error_dev(usc->usc_dev,
707 			    "could not create xfer on TX pipe\n");
708 			break;
709 		}
710 		data->buf = usbd_get_buffer(data->xfer);
711 
712 		/* Append this Tx buffer to our free list. */
713 		TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
714 	}
715 	if (error != 0)
716 		athn_usb_free_tx_list(usc);
717 	mutex_exit(&usc->usc_tx_mtx);
718 	return error;
719 }
720 
721 Static void
722 athn_usb_free_tx_list(struct athn_usb_softc *usc)
723 {
724 	struct usbd_xfer *xfer;
725 	size_t i;
726 
727 	DPRINTFN(DBG_FN, usc, "\n");
728 
729 	/* NB: Caller must abort pipe first. */
730 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
731 		CTASSERT(sizeof(xfer) == sizeof(void *));
732 		xfer = atomic_swap_ptr(&usc->usc_tx_data[i].xfer, NULL);
733 		if (xfer != NULL)
734 			usbd_destroy_xfer(xfer);
735 	}
736 }
737 
738 Static int
739 athn_usb_alloc_tx_cmd(struct athn_usb_softc *usc)
740 {
741 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
742 
743 	DPRINTFN(DBG_FN, usc, "\n");
744 
745 	data->sc = usc;	/* Backpointer for callbacks. */
746 
747 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
748 	    0, 0, &data->xfer);
749 	if (err) {
750 		aprint_error_dev(usc->usc_dev,
751 		    "could not allocate command xfer\n");
752 		return err;
753 	}
754 	data->buf = usbd_get_buffer(data->xfer);
755 
756 	return 0;
757 }
758 
759 Static void
760 athn_usb_free_tx_cmd(struct athn_usb_softc *usc)
761 {
762 	struct usbd_xfer *xfer;
763 
764 	DPRINTFN(DBG_FN, usc, "\n");
765 
766 	CTASSERT(sizeof(xfer) == sizeof(void *));
767 	xfer = atomic_swap_ptr(&usc->usc_tx_cmd.xfer, NULL);
768 	if (xfer != NULL)
769 		usbd_destroy_xfer(xfer);
770 }
771 
772 Static int
773 athn_usb_alloc_tx_msg(struct athn_usb_softc *usc)
774 {
775 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
776 
777 	DPRINTFN(DBG_FN, usc, "\n");
778 
779 	data->sc = usc;	/* Backpointer for callbacks. */
780 
781 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
782 	    0, 0, &data->xfer);
783 	if (err) {
784 		aprint_error_dev(usc->usc_dev,
785 		    "could not allocate command xfer\n");
786 		return err;
787 	}
788 	data->buf = usbd_get_buffer(data->xfer);
789 
790 	return 0;
791 }
792 
793 Static void
794 athn_usb_free_tx_msg(struct athn_usb_softc *usc)
795 {
796 	struct usbd_xfer *xfer;
797 
798 	DPRINTFN(DBG_FN, usc, "\n");
799 
800 	CTASSERT(sizeof(xfer) == sizeof(void *));
801 	xfer = atomic_swap_ptr(&usc->usc_tx_msg.xfer, NULL);
802 	if (xfer != NULL)
803 		usbd_destroy_xfer(xfer);
804 }
805 
806 Static void
807 athn_usb_task(void *arg)
808 {
809 	struct athn_usb_softc *usc = arg;
810 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
811 	struct athn_usb_host_cmd *cmd;
812 
813 	DPRINTFN(DBG_FN, usc, "\n");
814 
815 	/* Process host commands. */
816 	mutex_spin_enter(&usc->usc_task_mtx);
817 	while (ring->next != ring->cur) {
818 		cmd = &ring->cmd[ring->next];
819 		mutex_spin_exit(&usc->usc_task_mtx);
820 
821 		/* Invoke callback. */
822 		if (!usc->usc_dying)
823 			cmd->cb(usc, cmd->data);
824 
825 		mutex_spin_enter(&usc->usc_task_mtx);
826 		ring->queued--;
827 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
828 	}
829 	cv_broadcast(&usc->usc_task_cv);
830 	mutex_spin_exit(&usc->usc_task_mtx);
831 }
832 
833 Static void
834 athn_usb_do_async(struct athn_usb_softc *usc,
835     void (*cb)(struct athn_usb_softc *, void *), void *arg, int len)
836 {
837 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
838 	struct athn_usb_host_cmd *cmd;
839 
840 	if (usc->usc_dying)
841 		return;
842 
843 	DPRINTFN(DBG_FN, usc, "\n");
844 
845 	mutex_spin_enter(&usc->usc_task_mtx);
846 	cmd = &ring->cmd[ring->cur];
847 	cmd->cb = cb;
848 	KASSERT(len <= sizeof(cmd->data));
849 	memcpy(cmd->data, arg, len);
850 	ring->cur = (ring->cur + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
851 
852 	/* If there is no pending command already, schedule a task. */
853 	if (++ring->queued == 1) {
854 		usb_add_task(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER);
855 	}
856 	mutex_spin_exit(&usc->usc_task_mtx);
857 }
858 
859 Static void
860 athn_usb_wait_async(struct athn_usb_softc *usc)
861 {
862 
863 	DPRINTFN(DBG_FN, usc, "\n");
864 
865 	/* Wait for all queued asynchronous commands to complete. */
866 	mutex_spin_enter(&usc->usc_task_mtx);
867 	while (usc->usc_cmdq.queued > 0)
868 		cv_wait(&usc->usc_task_cv, &usc->usc_task_mtx);
869 	mutex_spin_exit(&usc->usc_task_mtx);
870 }
871 
872 Static int
873 athn_usb_load_firmware(struct athn_usb_softc *usc)
874 {
875 	struct athn_softc *sc = &usc->usc_sc;
876 	firmware_handle_t fwh;
877 	usb_device_descriptor_t *dd;
878 	usb_device_request_t req;
879 	const char *name;
880 	u_char *fw, *ptr;
881 	size_t size, remain;
882 	uint32_t addr;
883 	int mlen, error;
884 
885 	DPRINTFN(DBG_FN, sc, "\n");
886 
887 	/* Determine which firmware image to load. */
888 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010) {
889 		dd = usbd_get_device_descriptor(usc->usc_udev);
890 		if (UGETW(dd->bcdDevice) == 0x0202)
891 			name = "athn-ar7010-11";
892 		else
893 			name = "athn-ar7010";
894 	} else
895 		name = "athn-ar9271";
896 
897 	/* Read firmware image from the filesystem. */
898 	if ((error = firmware_open("if_athn", name, &fwh)) != 0) {
899 		aprint_error_dev(sc->sc_dev,
900 		    "failed to open firmware file %s (%d)\n", name, error);
901 		return error;
902 	}
903 	size = firmware_get_size(fwh);
904 	fw = firmware_malloc(size);
905 	if (fw == NULL) {
906 		aprint_error_dev(usc->usc_dev,
907 		    "failed to allocate firmware memory\n");
908 		firmware_close(fwh);
909 		return ENOMEM;
910 	}
911 	error = firmware_read(fwh, 0, fw, size);
912 	firmware_close(fwh);
913 	if (error != 0) {
914 		aprint_error_dev(usc->usc_dev,
915 		    "failed to read firmware (error %d)\n", error);
916 		firmware_free(fw, size);
917 		return error;
918 	}
919 
920 	/* Load firmware image. */
921 	ptr = fw;
922 	addr = AR9271_FIRMWARE >> 8;
923 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
924 	req.bRequest = AR_FW_DOWNLOAD;
925 	USETW(req.wIndex, 0);
926 	remain = size;
927 	while (remain > 0) {
928 		mlen = MIN(remain, 4096);
929 
930 		USETW(req.wValue, addr);
931 		USETW(req.wLength, mlen);
932 		error = usbd_do_request(usc->usc_udev, &req, ptr);
933 		if (error != 0) {
934 			firmware_free(fw, size);
935 			return error;
936 		}
937 		addr   += mlen >> 8;
938 		ptr    += mlen;
939 		remain -= mlen;
940 	}
941 	firmware_free(fw, size);
942 
943 	/* Start firmware. */
944 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010)
945 		addr = AR7010_FIRMWARE_TEXT >> 8;
946 	else
947 		addr = AR9271_FIRMWARE_TEXT >> 8;
948 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
949 	req.bRequest = AR_FW_DOWNLOAD_COMP;
950 	USETW(req.wIndex, 0);
951 	USETW(req.wValue, addr);
952 	USETW(req.wLength, 0);
953 
954 	mutex_enter(&usc->usc_msg_mtx);
955 	error = athn_usb_wait_msg(usc);
956 	if (error) {
957 		mutex_exit(&usc->usc_msg_mtx);
958 		return error;
959 	}
960 
961 	usc->usc_wait_msg_id = AR_HTC_MSG_READY;
962 	error = usbd_do_request(usc->usc_udev, &req, NULL);
963 
964 	/* Wait at most 1 second for firmware to boot. */
965 	if (error == 0)
966 		error = athn_usb_wait_msg(usc);
967 
968 	mutex_exit(&usc->usc_msg_mtx);
969 
970 	DPRINTFN(DBG_FN, sc, "return %d\n", error);
971 
972 	return error;
973 }
974 
975 Static int
976 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
977     int len)
978 {
979 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
980 	struct ar_htc_frame_hdr *htc;
981 	struct ar_htc_msg_hdr *msg;
982 
983 	if (usc->usc_dying)
984 		return USBD_CANCELLED;
985 
986 	DPRINTFN(DBG_FN, usc, "\n");
987 
988 	KASSERT(mutex_owned(&usc->usc_msg_mtx));
989 
990 	htc = (struct ar_htc_frame_hdr *)data->buf;
991 	memset(htc, 0, sizeof(*htc));
992 	htc->endpoint_id = 0;
993 	htc->payload_len = htobe16(sizeof(*msg) + len);
994 
995 	msg = (struct ar_htc_msg_hdr *)&htc[1];
996 	msg->msg_id = htobe16(msg_id);
997 
998 	memcpy(&msg[1], buf, len);
999 
1000 	usbd_setup_xfer(data->xfer, NULL, data->buf,
1001 	    sizeof(*htc) + sizeof(*msg) + len,
1002 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT, NULL);
1003 	return usbd_sync_transfer(data->xfer);
1004 
1005 
1006 }
1007 
1008 Static int
1009 athn_usb_htc_setup(struct athn_usb_softc *usc)
1010 {
1011 	struct ar_htc_msg_config_pipe cfg;
1012 	int error;
1013 
1014 	/*
1015 	 * Connect WMI services to USB pipes.
1016 	 */
1017 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CONTROL,
1018 	    AR_PIPE_TX_INTR, AR_PIPE_RX_INTR, &usc->usc_ep_ctrl);
1019 	if (error != 0)
1020 		return error;
1021 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_BEACON,
1022 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_bcn);
1023 	if (error != 0)
1024 		return error;
1025 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CAB,
1026 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_cab);
1027 	if (error != 0)
1028 		return error;
1029 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_UAPSD,
1030 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_uapsd);
1031 	if (error != 0)
1032 		return error;
1033 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_MGMT,
1034 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_mgmt);
1035 	if (error != 0)
1036 		return error;
1037 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BE,
1038 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BE]);
1039 	if (error != 0)
1040 		return error;
1041 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BK,
1042 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BK]);
1043 	if (error != 0)
1044 		return error;
1045 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VI,
1046 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VI]);
1047 	if (error != 0)
1048 		return error;
1049 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VO,
1050 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VO]);
1051 	if (error != 0)
1052 		return error;
1053 
1054 	/* Set credits for WLAN Tx pipe. */
1055 	memset(&cfg, 0, sizeof(cfg));
1056 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
1057 	cfg.credits = (usc->usc_flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
1058 
1059 	mutex_enter(&usc->usc_msg_mtx);
1060 	error = athn_usb_wait_msg(usc);
1061 	if (error) {
1062 		mutex_exit(&usc->usc_msg_mtx);
1063 		return error;
1064 	}
1065 
1066 	usc->usc_wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
1067 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
1068 
1069 	if (error != 0) {
1070 		aprint_error_dev(usc->usc_dev, "could not request pipe configurations\n");
1071 		mutex_exit(&usc->usc_msg_mtx);
1072 		return error;
1073 	}
1074 	error = athn_usb_wait_msg(usc);
1075 	if (error) {
1076 		mutex_exit(&usc->usc_msg_mtx);
1077 		return error;
1078 	}
1079 
1080 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
1081 	if (error != 0) {
1082 		aprint_error_dev(usc->usc_dev, "could not request complete setup\n");
1083 		mutex_exit(&usc->usc_msg_mtx);
1084 		return error;
1085 	}
1086 	error = athn_usb_wait_msg(usc);
1087 	if (error) {
1088 		mutex_exit(&usc->usc_msg_mtx);
1089 		return error;
1090 	}
1091 
1092 	mutex_exit(&usc->usc_msg_mtx);
1093 
1094 	return 0;
1095 }
1096 
1097 Static int
1098 athn_usb_htc_connect_svc(struct athn_usb_softc *usc, uint16_t svc_id,
1099     uint8_t ul_pipe, uint8_t dl_pipe, uint8_t *endpoint_id)
1100 {
1101 	struct ar_htc_msg_conn_svc msg;
1102 	struct ar_htc_msg_conn_svc_rsp rsp;
1103 	int error;
1104 
1105 	DPRINTFN(DBG_FN, usc, "\n");
1106 
1107 	memset(&msg, 0, sizeof(msg));
1108 	msg.svc_id = htobe16(svc_id);
1109 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
1110 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
1111 
1112 	mutex_enter(&usc->usc_msg_mtx);
1113 	athn_usb_wait_msg(usc);
1114 
1115 	usc->usc_msg_conn_svc_rsp = &rsp;
1116 
1117 	usc->usc_wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
1118 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
1119 	if (error == 0)
1120 		error = athn_usb_wait_msg(usc);
1121 
1122 	mutex_exit(&usc->usc_msg_mtx);
1123 
1124 	if (error != 0) {
1125 		aprint_error_dev(usc->usc_dev,
1126 		    "error waiting for service %d connection\n", svc_id);
1127 		return error;
1128 	}
1129 	if (rsp.status != AR_HTC_SVC_SUCCESS) {
1130 		aprint_error_dev(usc->usc_dev,
1131 		    "service %d connection failed, error %d\n",
1132 		    svc_id, rsp.status);
1133 		return EIO;
1134 	}
1135 	DPRINTFN(DBG_INIT, usc,
1136 	    "service %d successfully connected to endpoint %d\n",
1137 	    svc_id, rsp.endpoint_id);
1138 
1139 	/* Return endpoint id. */
1140 	*endpoint_id = rsp.endpoint_id;
1141 	return 0;
1142 }
1143 
1144 Static int
1145 athn_usb_wait_msg(struct athn_usb_softc *usc)
1146 {
1147  	DPRINTFN(DBG_FN, usc, "\n");
1148 
1149 	KASSERT(mutex_owned(&usc->usc_msg_mtx));
1150 
1151 	int error = 0;
1152 	while (usc->usc_wait_msg_id)
1153 		error = cv_timedwait(&usc->usc_msg_cv, &usc->usc_msg_mtx, hz);
1154 
1155 	return error;
1156 }
1157 
1158 Static int
1159 athn_usb_wait_cmd(struct athn_usb_softc *usc)
1160 {
1161 
1162  	DPRINTFN(DBG_FN, usc, "\n");
1163 
1164 	KASSERT(mutex_owned(&usc->usc_cmd_mtx));
1165 
1166 	int error = 0;
1167 	while (usc->usc_wait_cmd_id)
1168 		error = cv_timedwait(&usc->usc_cmd_cv, &usc->usc_cmd_mtx, hz);
1169 
1170 	return error;
1171 
1172 }
1173 
1174 Static void
1175 athn_usb_wmieof(struct usbd_xfer *xfer, void * priv,
1176     usbd_status status)
1177 {
1178 	struct athn_usb_softc *usc = priv;
1179 
1180  	DPRINTFN(DBG_FN, usc, "\n");
1181 
1182 	if (__predict_false(status == USBD_STALLED))
1183 		usbd_clear_endpoint_stall_async(usc->usc_tx_intr_pipe);
1184 }
1185 
1186 Static int
1187 athn_usb_wmi_xcmd(struct athn_usb_softc *usc, uint16_t cmd_id, void *ibuf,
1188     int ilen, void *obuf)
1189 {
1190 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
1191 	struct ar_htc_frame_hdr *htc;
1192 	struct ar_wmi_cmd_hdr *wmi;
1193 	int error;
1194 
1195 	if (usc->usc_dying)
1196 		return EIO;
1197 
1198  	DPRINTFN(DBG_FN, usc, "cmd_id %#x\n", cmd_id);
1199 
1200 	mutex_enter(&usc->usc_cmd_mtx);
1201 	error = athn_usb_wait_cmd(usc);
1202 
1203 	if (error) {
1204 		mutex_exit(&usc->usc_cmd_mtx);
1205 		return error;
1206 	}
1207 
1208 	htc = (struct ar_htc_frame_hdr *)data->buf;
1209 	memset(htc, 0, sizeof(*htc));
1210 	htc->endpoint_id = usc->usc_ep_ctrl;
1211 	htc->payload_len = htobe16(sizeof(*wmi) + ilen);
1212 
1213 	wmi = (struct ar_wmi_cmd_hdr *)&htc[1];
1214 	wmi->cmd_id = htobe16(cmd_id);
1215 	usc->usc_wmi_seq_no++;
1216 	wmi->seq_no = htobe16(usc->usc_wmi_seq_no);
1217 
1218 	memcpy(&wmi[1], ibuf, ilen);
1219 
1220 	usbd_setup_xfer(data->xfer, usc, data->buf,
1221 	    sizeof(*htc) + sizeof(*wmi) + ilen,
1222 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT,
1223 	    athn_usb_wmieof);
1224 
1225 	usc->usc_wait_cmd_id = cmd_id;
1226 	usc->usc_obuf = obuf;
1227 
1228 	error = usbd_sync_transfer(data->xfer);
1229 	if (error) {
1230 	    	DPRINTFN(DBG_FN, usc, "transfer error %d\n", error);
1231 
1232 		mutex_exit(&usc->usc_cmd_mtx);
1233 
1234 		return error;
1235 	}
1236 
1237 	error = athn_usb_wait_cmd(usc);
1238 
1239 	mutex_exit(&usc->usc_cmd_mtx);
1240 
1241 	return error;
1242 }
1243 
1244 #ifdef unused
1245 Static int
1246 athn_usb_read_rom(struct athn_softc *sc)
1247 {
1248 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1249 	uint32_t addrs[8], vals[8], addr;
1250 	uint16_t *eep;
1251 	size_t i, j;
1252 	int error = 0;
1253 
1254 	DPRINTFN(DBG_FN, sc, "\n");
1255 
1256 	/* Read EEPROM by blocks of 16 bytes. */
1257 	eep = sc->sc_eep;
1258 	addr = AR_EEPROM_OFFSET(sc->sc_eep_base);
1259 	for (i = 0; i < sc->sc_eep_size / 16; i++) {
1260 		for (j = 0; j < 8; j++, addr += 4)
1261 			addrs[j] = htobe32(addr);
1262 		error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1263 		    addrs, sizeof(addrs), vals);
1264 		if (error != 0)
1265 			break;
1266 		for (j = 0; j < 8; j++)
1267 			*eep++ = be32toh(vals[j]);
1268 	}
1269 	return error;
1270 }
1271 #endif /* unused */
1272 
1273 Static uint32_t
1274 athn_usb_read(struct athn_softc *sc, uint32_t addr)
1275 {
1276 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1277 	uint32_t val;
1278 	int error;
1279 
1280 	if (usc->usc_dying)
1281 		return 0;
1282 
1283  	DPRINTFN(DBG_FN, sc, "addr %#x\n", htobe32(addr));
1284 
1285 	/* Flush pending writes for strict consistency. */
1286 	athn_usb_write_barrier(sc);
1287 
1288 	addr = htobe32(addr);
1289 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1290 	    &addr, sizeof(addr), &val);
1291 	if (error != 0) {
1292 		DPRINTFN(DBG_FN, sc, "error %d\n", addr);
1293 		return 0xdeadbeef;
1294 	}
1295  	DPRINTFN(DBG_FN, sc, "addr %#x return %#x\n", addr, be32toh(val));
1296 
1297 	return be32toh(val);
1298 }
1299 
1300 Static void
1301 athn_usb_write(struct athn_softc *sc, uint32_t addr, uint32_t val)
1302 {
1303 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1304 
1305 	if (usc->usc_dying)
1306 		return;
1307 
1308  	DPRINTFN(DBG_FN, sc, "addr %#x val %#x\n", addr, val);
1309 
1310 	usc->usc_wbuf[usc->usc_wcount].addr = htobe32(addr);
1311 	usc->usc_wbuf[usc->usc_wcount].val  = htobe32(val);
1312 	if (++usc->usc_wcount == AR_MAX_WRITE_COUNT)
1313 		athn_usb_write_barrier(sc);
1314 }
1315 
1316 Static void
1317 athn_usb_write_barrier(struct athn_softc *sc)
1318 {
1319 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1320 
1321 	if (usc->usc_dying)
1322 		goto done;
1323 
1324  	DPRINTFN(DBG_FN, sc, "usc_wcount %d\n", usc->usc_wcount);
1325 
1326 	if (usc->usc_wcount == 0)
1327 		return;
1328 
1329 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_WRITE,
1330 	    usc->usc_wbuf, usc->usc_wcount * sizeof(usc->usc_wbuf[0]), NULL);
1331  done:
1332 	usc->usc_wcount = 0;	/* Always flush buffer. */
1333 }
1334 
1335 Static int
1336 athn_usb_media_change(struct ifnet *ifp)
1337 {
1338 	struct athn_softc *sc = ifp->if_softc;
1339 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1340 	int error;
1341 
1342 	if (usc->usc_dying)
1343 		return EIO;
1344 
1345 	DPRINTFN(DBG_FN, sc, "\n");
1346 
1347 	error = ieee80211_media_change(ifp);
1348 	if (error == ENETRESET && IS_UP_AND_RUNNING(ifp)) {
1349 		athn_usb_stop(ifp);
1350 		error = athn_usb_init(ifp);
1351 	}
1352 	return error;
1353 }
1354 
1355 Static int
1356 athn_usb_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
1357     int arg)
1358 {
1359 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1360 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1361 	struct athn_usb_cmd_newstate cmd;
1362 
1363 	DPRINTFN(DBG_FN, sc, "\n");
1364 
1365 	/* Do it in a process context. */
1366 	cmd.state = nstate;
1367 	cmd.arg = arg;
1368 	athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, sizeof(cmd));
1369 	return 0;
1370 }
1371 
1372 Static void
1373 athn_usb_newstate_cb(struct athn_usb_softc *usc, void *arg)
1374 {
1375 	struct athn_usb_cmd_newstate *cmd = arg;
1376 	struct athn_softc *sc = &usc->usc_sc;
1377 	struct ieee80211com *ic = &sc->sc_ic;
1378 	enum ieee80211_state ostate, nstate;
1379 	uint32_t reg, imask;
1380 	int s;
1381 
1382 	DPRINTFN(DBG_FN, sc, "\n");
1383 
1384 	callout_stop(&sc->sc_calib_to);
1385 
1386 	s = splnet();
1387 
1388 	ostate = ic->ic_state;
1389 	nstate = cmd->state;
1390 	DPRINTFN(DBG_STM, usc, "newstate %s(%d) -> %s(%d)\n",
1391 		    ieee80211_state_name[ostate], ostate,
1392 		    ieee80211_state_name[nstate], nstate);
1393 
1394 	if (ostate == IEEE80211_S_RUN) {
1395 		uint8_t sta_index;
1396 
1397 		sta_index = ATHN_NODE(ic->ic_bss)->sta_index;
1398 		DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
1399 		athn_usb_remove_hw_node(usc, &sta_index);
1400 	}
1401 
1402 	switch (nstate) {
1403 	case IEEE80211_S_INIT:
1404 		athn_set_led(sc, 0);
1405 		break;
1406 	case IEEE80211_S_SCAN:
1407 		/* Make the LED blink while scanning. */
1408 		athn_set_led(sc, !sc->sc_led_state);
1409 		(void)athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1410 		if (!usc->usc_dying)
1411 			callout_schedule(&sc->sc_scan_to, hz / 5);
1412 		break;
1413 	case IEEE80211_S_AUTH:
1414 		athn_set_led(sc, 0);
1415 		athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1416 		break;
1417 	case IEEE80211_S_ASSOC:
1418 		break;
1419 	case IEEE80211_S_RUN:
1420 		athn_set_led(sc, 1);
1421 
1422 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
1423 			break;
1424 
1425 		/* Create node entry for our BSS. */
1426 		DPRINTFN(DBG_NODES, sc, "create node for AID=0x%x\n",
1427 		    ic->ic_bss->ni_associd);
1428 		athn_usb_create_node(usc, ic->ic_bss);	/* XXX: handle error? */
1429 
1430 		athn_set_bss(sc, ic->ic_bss);
1431 		athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1432 #ifndef IEEE80211_STA_ONLY
1433 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1434 			athn_set_hostap_timers(sc);
1435 			/* Enable software beacon alert interrupts. */
1436 			imask = htobe32(AR_IMR_SWBA);
1437 		} else
1438 #endif
1439 		{
1440 			athn_set_sta_timers(sc);
1441 			/* Enable beacon miss interrupts. */
1442 			imask = htobe32(AR_IMR_BMISS);
1443 
1444 			/* Stop receiving beacons from other BSS. */
1445 			reg = AR_READ(sc, AR_RX_FILTER);
1446 			reg = (reg & ~AR_RX_FILTER_BEACON) |
1447 			    AR_RX_FILTER_MYBEACON;
1448 			AR_WRITE(sc, AR_RX_FILTER, reg);
1449 			AR_WRITE_BARRIER(sc);
1450 		}
1451 		athn_usb_wmi_xcmd(usc, AR_WMI_CMD_ENABLE_INTR,
1452 		    &imask, sizeof(imask), NULL);
1453 		break;
1454 	}
1455 	if (!usc->usc_dying)
1456 		(void)sc->sc_newstate(ic, nstate, cmd->arg);
1457 	splx(s);
1458 }
1459 
1460 Static void
1461 athn_usb_newassoc(struct ieee80211_node *ni, int isnew)
1462 {
1463 	struct ieee80211com *ic = ni->ni_ic;
1464 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1465 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1466 
1467 	DPRINTFN(DBG_FN, sc, "\n");
1468 
1469 	if (ic->ic_opmode != IEEE80211_M_HOSTAP || !isnew)
1470 		return;
1471 
1472 	/* Do it in a process context. */
1473 	ieee80211_ref_node(ni);
1474 	athn_usb_do_async(usc, athn_usb_newassoc_cb, &ni, sizeof(ni));
1475 }
1476 
1477 Static void
1478 athn_usb_newassoc_cb(struct athn_usb_softc *usc, void *arg)
1479 {
1480 	struct ieee80211_node *ni = *(void **)arg;
1481 	int s;
1482 
1483 	DPRINTFN(DBG_FN, usc, "\n");
1484 
1485 	s = splnet();
1486 	/* NB: Node may have left before we got scheduled. */
1487 	if (ni->ni_associd != 0) {
1488 		DPRINTFN(DBG_NODES, usc, "creating node for AID=0x%x\n",
1489 		    ni->ni_associd);
1490 		(void)athn_usb_create_node(usc, ni);	/* XXX: handle error? */
1491 	}
1492 	ieee80211_free_node(ni);
1493 	splx(s);
1494 }
1495 
1496 #ifdef notyet
1497 Static int
1498 athn_usb_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
1499     uint8_t tid)
1500 {
1501 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1502 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1503 	struct athn_node *an = ATHN_NODE(ni);
1504 	struct athn_usb_aggr_cmd cmd;
1505 
1506 	DPRINTFN(DBG_FN, sc, "\n");
1507 
1508 	/* Do it in a process context. */
1509 	cmd.sta_index = an->sta_index;
1510 	cmd.tid = tid;
1511 	athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, sizeof(cmd));
1512 	return 0;
1513 }
1514 
1515 Static void
1516 athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *usc, void *arg)
1517 {
1518 	struct athn_usb_aggr_cmd *cmd = arg;
1519 	struct ar_htc_target_aggr aggr;
1520 
1521 	DPRINTFN(DBG_FN, usc, "\n");
1522 
1523 	memset(&aggr, 0, sizeof(aggr));
1524 	aggr.sta_index = cmd->sta_index;
1525 	aggr.tidno = cmd->tid;
1526 	aggr.aggr_enable = 1;
1527 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1528 	    &aggr, sizeof(aggr), NULL);
1529 }
1530 
1531 Static void
1532 athn_usb_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
1533     uint8_t tid)
1534 {
1535 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1536 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1537 	struct athn_node *an = ATHN_NODE(ni);
1538 	struct athn_usb_aggr_cmd cmd;
1539 
1540 	DPRINTFN(DBG_FN, sc, "\n");
1541 
1542 	/* Do it in a process context. */
1543 	cmd.sta_index = an->sta_index;
1544 	cmd.tid = tid;
1545 	athn_usb_do_async(usc, athn_usb_ampdu_tx_stop_cb, &cmd, sizeof(cmd));
1546 }
1547 
1548 Static void
1549 athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *usc, void *arg)
1550 {
1551 	struct athn_usb_aggr_cmd *cmd = arg;
1552 	struct ar_htc_target_aggr aggr;
1553 
1554 	DPRINTFN(DBG_FN, usc, "\n");
1555 
1556 	memset(&aggr, 0, sizeof(aggr));
1557 	aggr.sta_index = cmd->sta_index;
1558 	aggr.tidno = cmd->tid;
1559 	aggr.aggr_enable = 0;
1560 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1561 	    &aggr, sizeof(aggr), NULL);
1562 }
1563 #endif /* notyet */
1564 
1565 Static int
1566 athn_usb_remove_hw_node(struct athn_usb_softc *usc, uint8_t *sta_idx)
1567 {
1568 	int error;
1569 
1570 	DPRINTFN(DBG_FN, usc, "\n");
1571 
1572 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1573 	    sta_idx, sizeof(*sta_idx), NULL);
1574 
1575 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1576 	    *sta_idx, error);
1577 	return error;
1578 }
1579 
1580 Static int
1581 athn_usb_create_hw_node(struct athn_usb_softc *usc,
1582     struct ar_htc_target_sta *sta)
1583 {
1584 	int error;
1585 
1586 	DPRINTFN(DBG_FN, usc, "\n");
1587 
1588 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
1589 	    sta, sizeof(*sta), NULL);
1590 
1591 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1592 	    sta->sta_index, error);
1593 
1594 	return error;
1595 }
1596 
1597 Static int
1598 athn_usb_create_node(struct athn_usb_softc *usc, struct ieee80211_node *ni)
1599 {
1600 	struct athn_node *an = ATHN_NODE(ni);
1601 	struct ar_htc_target_sta sta;
1602 	struct ar_htc_target_rate rate;
1603 	int error;
1604 
1605 	DPRINTFN(DBG_FN | DBG_NODES, usc, "AID=0x%x\n", ni->ni_associd);
1606 
1607 	/*
1608 	 * NB: this is called by ic_newstate and (in HOSTAP mode by)
1609 	 * ic_newassoc.
1610 	 *
1611 	 * The firmware has a limit of 8 nodes.  In HOSTAP mode, we
1612 	 * limit the AID to < 8 and use that value to index the
1613 	 * firmware node table.  Node zero is used for the BSS.
1614 	 *
1615 	 * In STA mode, we simply use node 1 for the BSS.
1616 	 */
1617 	if (ATHN_SOFTC(usc)->sc_ic.ic_opmode == IEEE80211_M_HOSTAP)
1618 		an->sta_index = IEEE80211_NODE_AID(ni);
1619 	else
1620 		an->sta_index = 1;
1621 
1622 	/* Create node entry on target. */
1623 	memset(&sta, 0, sizeof(sta));
1624 	IEEE80211_ADDR_COPY(sta.macaddr, ni->ni_macaddr);
1625 	IEEE80211_ADDR_COPY(sta.bssid, ni->ni_bssid);
1626 
1627 	sta.associd = htobe16(ni->ni_associd);
1628 	sta.valid = 1;
1629 	sta.sta_index = an->sta_index;
1630 
1631 	sta.maxampdu = 0xffff;
1632 #ifndef IEEE80211_NO_HT
1633 	if (ni->ni_flags & IEEE80211_NODE_HT)
1634 		sta.flags |= htobe16(AR_HTC_STA_HT);
1635 #endif
1636 	error = athn_usb_create_hw_node(usc, &sta);
1637 	if (error)
1638 		return error;
1639 
1640 	/* Setup supported rates. */
1641 	memset(&rate, 0, sizeof(rate));
1642 	rate.sta_index = sta.sta_index;
1643 	rate.isnew = 1;
1644 	rate.lg_rates.rs_nrates = ni->ni_rates.rs_nrates;
1645 	memcpy(rate.lg_rates.rs_rates, ni->ni_rates.rs_rates,
1646 	    ni->ni_rates.rs_nrates);
1647 
1648 #ifndef IEEE80211_NO_HT
1649 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1650 		rate.capflags |= htobe32(AR_RC_HT_FLAG);
1651 #ifdef notyet
1652 		/* XXX setup HT rates */
1653 		if (ni->ni_htcaps & IEEE80211_HTCAP_CBW20_40)
1654 			rate.capflags |= htobe32(AR_RC_40_FLAG);
1655 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI40)
1656 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1657 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI20)
1658 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1659 #endif
1660 	}
1661 #endif
1662 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_RC_RATE_UPDATE,
1663 	    &rate, sizeof(rate), NULL);
1664 	return error;
1665 }
1666 
1667 Static void
1668 athn_usb_rx_enable(struct athn_softc *sc)
1669 {
1670 
1671 	DPRINTFN(DBG_FN, sc, "\n");
1672 
1673 	AR_WRITE(sc, AR_CR, AR_CR_RXE);
1674 	AR_WRITE_BARRIER(sc);
1675 }
1676 
1677 Static int
1678 athn_usb_switch_chan(struct athn_softc *sc, struct ieee80211_channel *curchan,
1679     struct ieee80211_channel *extchan)
1680 {
1681 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1682 	uint16_t mode;
1683 	int error;
1684 
1685 	DPRINTFN(DBG_FN, sc, "\n");
1686 
1687 	/* Disable interrupts. */
1688 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1689 	if (error != 0)
1690 		goto reset;
1691 	/* Stop all Tx queues. */
1692 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
1693 	if (error != 0)
1694 		goto reset;
1695 	/* Stop Rx. */
1696 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
1697 	if (error != 0)
1698 		goto reset;
1699 
1700 	/* If band or bandwidth changes, we need to do a full reset. */
1701 	if (curchan->ic_flags != sc->sc_curchan->ic_flags ||
1702 	    ((extchan != NULL) ^ (sc->sc_curchanext != NULL))) {
1703 		DPRINTFN(DBG_RF, sc, "channel band switch\n");
1704 		goto reset;
1705 	}
1706 
1707 	error = athn_set_chan(sc, curchan, extchan);
1708 	if (AR_SREV_9271(sc) && error == 0)
1709 		ar9271_load_ani(sc);
1710 	if (error != 0) {
1711  reset:		/* Error found, try a full reset. */
1712 		DPRINTFN(DBG_RF, sc, "needs a full reset\n");
1713 		error = athn_hw_reset(sc, curchan, extchan, 0);
1714 		if (error != 0)	/* Hopeless case. */
1715 			return error;
1716 	}
1717 
1718 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
1719 	if (error != 0)
1720 		return error;
1721 	athn_rx_start(sc);
1722 
1723 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
1724 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
1725 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
1726 	    &mode, sizeof(mode), NULL);
1727 	if (error != 0)
1728 		return error;
1729 
1730 	/* Re-enable interrupts. */
1731 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ENABLE_INTR);
1732 	return error;
1733 }
1734 
1735 #ifdef notyet_edca
1736 Static void
1737 athn_usb_updateedca(struct ieee80211com *ic)
1738 {
1739 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1740 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1741 
1742 	DPRINTFN(DBG_FN, sc, "\n");
1743 
1744 	/* Do it in a process context. */
1745 	athn_usb_do_async(usc, athn_usb_updateedca_cb, NULL, 0);
1746 }
1747 
1748 Static void
1749 athn_usb_updateedca_cb(struct athn_usb_softc *usc, void *arg)
1750 {
1751 	int s;
1752 
1753 	DPRINTFN(DBG_FN, usc, "\n");
1754 
1755 	s = splnet();
1756 	athn_updateedca(&usc->usc_sc.sc_ic);
1757 	splx(s);
1758 }
1759 #endif /* notyet_edca */
1760 
1761 Static void
1762 athn_usb_updateslot(struct ifnet *ifp)
1763 {
1764 	struct athn_softc *sc = ifp->if_softc;
1765 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1766 
1767 	DPRINTFN(DBG_FN, sc, "\n");
1768 
1769 	/*
1770 	 * NB: athn_updateslog() needs to be done in a process context
1771 	 * to avoid being called by ieee80211_reset_erp() inside a
1772 	 * spinlock held by ieee80211_free_allnodes().
1773 	 *
1774 	 * XXX: calling this during the athn_attach() causes
1775 	 * usb_insert_transfer() to produce a bunch of "not busy"
1776 	 * messages.  Why?
1777 	 */
1778 	if (usc->usc_athn_attached)
1779 		athn_usb_do_async(usc, athn_usb_updateslot_cb, NULL, 0);
1780 }
1781 
1782 Static void
1783 athn_usb_updateslot_cb(struct athn_usb_softc *usc, void *arg)
1784 {
1785 	int s;
1786 
1787 	DPRINTFN(DBG_FN, usc, "\n");
1788 
1789 	s = splnet();
1790 	athn_updateslot(&usc->usc_sc.sc_if);
1791 	splx(s);
1792 }
1793 
1794 #ifdef notyet
1795 Static int
1796 athn_usb_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1797     struct ieee80211_key *k)
1798 {
1799 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1800 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1801 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1802 	struct athn_usb_cmd_key cmd;
1803 
1804 	DPRINTFN(DBG_FN, sc, "\n");
1805 
1806 	/* Defer setting of WEP keys until interface is brought up. */
1807 	if (!IS_UP_AND_RUNNING(ifp))
1808 		return 0;
1809 
1810 	/* Do it in a process context. */
1811 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1812 	cmd.key = k;
1813 	athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, sizeof(cmd));
1814 	return 0;
1815 }
1816 
1817 Static void
1818 athn_usb_set_key_cb(struct athn_usb_softc *usc, void *arg)
1819 {
1820 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1821 	struct athn_usb_cmd_key *cmd = arg;
1822 	int s;
1823 
1824 	DPRINTFN(DBG_FN, usc, "\n");
1825 
1826 	s = splnet();
1827 	athn_set_key(ic, cmd->ni, cmd->key);
1828 	if (cmd->ni != NULL)
1829 		ieee80211_free_node(cmd->ni);
1830 	splx(s);
1831 }
1832 
1833 Static void
1834 athn_usb_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1835     struct ieee80211_key *k)
1836 {
1837 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1838 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1839 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1840 	struct athn_usb_cmd_key cmd;
1841 
1842 	DPRINTFN(DBG_FN, sc, "\n");
1843 
1844 	if (!(ifp->if_flags & IFF_RUNNING) ||
1845 	    ic->ic_state != IEEE80211_S_RUN)
1846 		return;	/* Nothing to do. */
1847 
1848 	/* Do it in a process context. */
1849 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1850 	cmd.key = k;
1851 	athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, sizeof(cmd));
1852 }
1853 
1854 Static void
1855 athn_usb_delete_key_cb(struct athn_usb_softc *usc, void *arg)
1856 {
1857 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1858 	struct athn_usb_cmd_key *cmd = arg;
1859 	int s;
1860 
1861 	DPRINTFN(DBG_FN, usc, "\n");
1862 
1863 	s = splnet();
1864 	athn_delete_key(ic, cmd->ni, cmd->key);
1865 	if (cmd->ni != NULL)
1866 		ieee80211_free_node(cmd->ni);
1867 	splx(s);
1868 }
1869 #endif /* notyet */
1870 
1871 #ifndef IEEE80211_STA_ONLY
1872 Static void
1873 athn_usb_bcneof(struct usbd_xfer *xfer, void * priv,
1874     usbd_status status)
1875 {
1876 	struct athn_usb_tx_data *data = priv;
1877 	struct athn_usb_softc *usc = data->sc;
1878 
1879 	DPRINTFN(DBG_FN, usc, "\n");
1880 
1881 	if (__predict_false(status == USBD_STALLED))
1882 		usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
1883 	usc->usc_tx_bcn = data;
1884 }
1885 
1886 /*
1887  * Process Software Beacon Alert interrupts.
1888  */
1889 Static void
1890 athn_usb_swba(struct athn_usb_softc *usc)
1891 {
1892 	struct athn_softc *sc = &usc->usc_sc;
1893 	struct ieee80211com *ic = &sc->sc_ic;
1894 	struct athn_usb_tx_data *data;
1895 	struct ieee80211_frame *wh;
1896 	struct ieee80211_beacon_offsets bo;
1897 	struct ar_stream_hdr *hdr;
1898 	struct ar_htc_frame_hdr *htc;
1899 	struct ar_tx_bcn *bcn;
1900 	struct mbuf *m;
1901 	int error;
1902 
1903 	if (usc->usc_dying)
1904 		return;
1905 
1906 	DPRINTFN(DBG_FN, sc, "\n");
1907 
1908 	if (ic->ic_dtim_count == 0)
1909 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1910 	else
1911 		ic->ic_dtim_count--;
1912 
1913 	/* Make sure previous beacon has been sent. */
1914 	if (usc->usc_tx_bcn == NULL)
1915 		return;
1916 	data = usc->usc_tx_bcn;
1917 
1918 	/* Get new beacon. */
1919 #ifdef ATHN_DEBUG
1920 	memset(&bo, 0, sizeof(bo));
1921 #endif
1922 	m = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
1923 	if (__predict_false(m == NULL))
1924 		return;
1925 	/* Assign sequence number. */
1926 	/* XXX: use non-QoS tid? */
1927 	wh = mtod(m, struct ieee80211_frame *);
1928 	*(uint16_t *)&wh->i_seq[0] =
1929 	    htole16(ic->ic_bss->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
1930 	ic->ic_bss->ni_txseqs[0]++;
1931 
1932 	hdr = (struct ar_stream_hdr *)data->buf;
1933 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1934 	hdr->len = htole16(sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len);
1935 
1936 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1937 	memset(htc, 0, sizeof(*htc));
1938 	htc->endpoint_id = usc->usc_ep_bcn;
1939 	htc->payload_len = htobe16(sizeof(*bcn) + m->m_pkthdr.len);
1940 
1941 	bcn = (struct ar_tx_bcn *)&htc[1];
1942 	memset(bcn, 0, sizeof(*bcn));
1943 	bcn->vif_idx = 0;
1944 
1945 	m_copydata(m, 0, m->m_pkthdr.len, (void *)&bcn[1]);
1946 
1947 	usbd_setup_xfer(data->xfer, data, data->buf,
1948 	    sizeof(*hdr) + sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len,
1949 	    USBD_SHORT_XFER_OK, ATHN_USB_TX_TIMEOUT,
1950 	    athn_usb_bcneof);
1951 
1952 	m_freem(m);
1953 	usc->usc_tx_bcn = NULL;
1954 	error = usbd_transfer(data->xfer);
1955 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
1956 		usc->usc_tx_bcn = data;
1957 }
1958 #endif
1959 
1960 Static void
1961 athn_usb_rx_wmi_ctrl(struct athn_usb_softc *usc, uint8_t *buf, size_t len)
1962 {
1963 #ifdef ATHN_DEBUG
1964 	struct ar_wmi_evt_txrate *txrate;
1965 #endif
1966 	struct ar_wmi_cmd_hdr *wmi;
1967 	uint16_t cmd_id;
1968 
1969 	if (usc->usc_dying)
1970 		return;
1971 
1972 	DPRINTFN(DBG_FN, usc, "\n");
1973 
1974 	if (__predict_false(len < sizeof(*wmi)))
1975 		return;
1976 	wmi = (struct ar_wmi_cmd_hdr *)buf;
1977 	cmd_id = be16toh(wmi->cmd_id);
1978 
1979 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
1980 		mutex_enter(&usc->usc_cmd_mtx);
1981 		if (usc->usc_wait_cmd_id == cmd_id) {
1982 
1983 			if (usc->usc_obuf != NULL) {
1984 				/* Copy answer into caller supplied buffer. */
1985 				memcpy(usc->usc_obuf, &wmi[1], len - sizeof(*wmi));
1986 			}
1987 			/* Notify caller of completion. */
1988 			usc->usc_wait_cmd_id = 0;
1989 			cv_broadcast(&usc->usc_cmd_cv);
1990 		}
1991 		mutex_exit(&usc->usc_cmd_mtx);
1992 		return;
1993 	}
1994 	/*
1995 	 * XXX: the Linux 2.6 and 3.7.4 kernels differ on the event numbers!
1996 	 * See the alternate defines in if_athn_usb.h.
1997 	 */
1998 	switch (cmd_id & 0xfff) {
1999 #ifndef IEEE80211_STA_ONLY
2000 	case AR_WMI_EVT_SWBA:
2001 		athn_usb_swba(usc);
2002 		break;
2003 #endif
2004 	case AR_WMI_EVT_FATAL:
2005 		aprint_error_dev(usc->usc_dev, "fatal firmware error\n");
2006 		break;
2007 	case AR_WMI_EVT_TXRATE:
2008 #ifdef ATHN_DEBUG
2009 		txrate = (struct ar_wmi_evt_txrate *)&wmi[1];
2010 		DPRINTFN(DBG_TX, usc, "txrate=%d\n", be32toh(txrate->txrate));
2011 #endif
2012 		break;
2013 	default:
2014 		DPRINTFN(DBG_TX, usc, "WMI event 0x%x (%d) ignored\n", cmd_id, cmd_id);
2015 		break;
2016 	}
2017 }
2018 
2019 Static void
2020 athn_usb_intr(struct usbd_xfer *xfer, void * priv,
2021     usbd_status status)
2022 {
2023 	struct athn_usb_softc *usc = priv;
2024 	struct ar_htc_frame_hdr *htc;
2025 	struct ar_htc_msg_hdr *msg;
2026 	uint8_t *buf = usc->usc_ibuf;
2027 	uint16_t msg_id;
2028 	int len;
2029 
2030 	if (usc->usc_dying)
2031 		return;
2032 
2033 	DPRINTFN(DBG_FN, usc, "\n");
2034 
2035 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2036 		DPRINTFN(DBG_INTR, usc, "intr status=%d\n", status);
2037 		if (status == USBD_STALLED)
2038 			usbd_clear_endpoint_stall_async(usc->usc_rx_intr_pipe);
2039 		return;
2040 	}
2041 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2042 
2043 	/* Skip watchdog pattern if present. */
2044 	if (len >= 4 && *(uint32_t *)buf == htobe32(0x00c60000)) {
2045 		buf += 4;
2046 		len -= 4;
2047 	}
2048 	if (__predict_false(len < (int)sizeof(*htc)))
2049 		return;
2050 	htc = (struct ar_htc_frame_hdr *)buf;
2051 	/* Skip HTC header. */
2052 	buf += sizeof(*htc);
2053 	len -= sizeof(*htc);
2054 
2055 	if (htc->endpoint_id != 0) {
2056 		if (__predict_false(htc->endpoint_id != usc->usc_ep_ctrl)) {
2057 			DPRINTFN(DBG_RX, usc, "Rx %d != %d\n",
2058 			    htc->endpoint_id, usc->usc_ep_ctrl);
2059 			return;
2060 		}
2061 		/* Remove trailer if present. */
2062 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
2063 			if (__predict_false(len < htc->control[0])) {
2064 				DPRINTFN(DBG_RX, usc, "Rx trailer %d < %d\n",
2065 				    len,  htc->control[0]);
2066 				return;
2067 			}
2068 			len -= htc->control[0];
2069 		}
2070 		athn_usb_rx_wmi_ctrl(usc, buf, len);
2071 		return;
2072 	}
2073 
2074 	/*
2075 	 * Endpoint 0 carries HTC messages.
2076 	 */
2077 	if (__predict_false(len < (int)sizeof(*msg)))
2078 		return;
2079 	msg = (struct ar_htc_msg_hdr *)buf;
2080 	msg_id = be16toh(msg->msg_id);
2081 	DPRINTFN(DBG_RX, usc, "Rx HTC message %d\n", msg_id);
2082 	switch (msg_id) {
2083 	case AR_HTC_MSG_READY:
2084 	case AR_HTC_MSG_CONF_PIPE_RSP:
2085 		mutex_enter(&usc->usc_msg_mtx);
2086 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_READY: %d vs %d\n",
2087 		    usc->usc_wait_msg_id, msg_id);
2088 		if (usc->usc_wait_msg_id == msg_id) {
2089 			usc->usc_wait_msg_id = 0;
2090 			cv_broadcast(&usc->usc_msg_cv);
2091 		}
2092 		mutex_exit(&usc->usc_msg_mtx);
2093 		break;
2094 	case AR_HTC_MSG_CONN_SVC_RSP:
2095 		mutex_enter(&usc->usc_msg_mtx);
2096 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_CONN_SVC_RSP: %d vs %d\n",
2097 		    usc->usc_wait_msg_id, msg_id);
2098 		if (usc->usc_wait_msg_id == msg_id) {
2099 			if (usc->usc_msg_conn_svc_rsp != NULL) {
2100 				memcpy(usc->usc_msg_conn_svc_rsp, &msg[1],
2101 				    sizeof(*usc->usc_msg_conn_svc_rsp));
2102 			}
2103 			usc->usc_wait_msg_id = 0;
2104 			cv_broadcast(&usc->usc_msg_cv);
2105 		}
2106 		mutex_exit(&usc->usc_msg_mtx);
2107 		break;
2108 	default:
2109 		DPRINTFN(DBG_RX, usc, "HTC message %d ignored\n", msg_id);
2110 		break;
2111 	}
2112 }
2113 
2114 Static void
2115 athn_usb_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
2116     struct ar_rx_status *rs)
2117 {
2118 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
2119 	struct ieee80211com *ic = &sc->sc_ic;
2120 	uint8_t rate;
2121 
2122 	DPRINTFN(DBG_FN, sc, "\n");
2123 
2124 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
2125 	tap->wr_tsft = htole64(be64toh(rs->rs_tstamp));
2126 	tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2127 	tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2128 	tap->wr_dbm_antsignal = rs->rs_rssi;
2129 	/* XXX noise. */
2130 	tap->wr_antenna = rs->rs_antenna;
2131 	rate = rs->rs_rate;
2132 	if (rate & 0x80) {		/* HT. */
2133 		/* Bit 7 set means HT MCS instead of rate. */
2134 		tap->wr_rate = rate;
2135 		if (!(rs->rs_flags & AR_RXS_FLAG_GI))
2136 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
2137 	} else if (rate & 0x10) {	/* CCK. */
2138 		if (rate & 0x04)
2139 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2140 		switch (rate & ~0x14) {
2141 		case 0xb: tap->wr_rate =   2; break;
2142 		case 0xa: tap->wr_rate =   4; break;
2143 		case 0x9: tap->wr_rate =  11; break;
2144 		case 0x8: tap->wr_rate =  22; break;
2145 		default:  tap->wr_rate =   0; break;
2146 		}
2147 	} else {			/* OFDM. */
2148 		switch (rate) {
2149 		case 0xb: tap->wr_rate =  12; break;
2150 		case 0xf: tap->wr_rate =  18; break;
2151 		case 0xa: tap->wr_rate =  24; break;
2152 		case 0xe: tap->wr_rate =  36; break;
2153 		case 0x9: tap->wr_rate =  48; break;
2154 		case 0xd: tap->wr_rate =  72; break;
2155 		case 0x8: tap->wr_rate =  96; break;
2156 		case 0xc: tap->wr_rate = 108; break;
2157 		default:  tap->wr_rate =   0; break;
2158 		}
2159 	}
2160 	bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
2161 }
2162 
2163 Static void
2164 athn_usb_rx_frame(struct athn_usb_softc *usc, struct mbuf *m)
2165 {
2166 	struct athn_softc *sc = &usc->usc_sc;
2167 	struct ieee80211com *ic = &sc->sc_ic;
2168 	struct ifnet *ifp = &sc->sc_if;
2169 	struct ieee80211_frame *wh;
2170 	struct ieee80211_node *ni;
2171 	struct ar_htc_frame_hdr *htc;
2172 	struct ar_rx_status *rs;
2173 	uint16_t datalen;
2174 	int s;
2175 
2176 	DPRINTFN(DBG_FN, sc, "\n");
2177 
2178 	if (__predict_false(m->m_len < (int)sizeof(*htc)))
2179 		goto skip;
2180 	htc = mtod(m, struct ar_htc_frame_hdr *);
2181 	if (__predict_false(htc->endpoint_id == 0)) {
2182 		DPRINTFN(DBG_RX, sc, "bad endpoint %d\n", htc->endpoint_id);
2183 		goto skip;
2184 	}
2185 	if (htc->flags & AR_HTC_FLAG_TRAILER) {
2186 		if (m->m_len < htc->control[0])
2187 			goto skip;
2188 		m_adj(m, -(int)htc->control[0]);
2189 	}
2190 	m_adj(m, sizeof(*htc));	/* Strip HTC header. */
2191 
2192 	if (__predict_false(m->m_len < (int)sizeof(*rs)))
2193 		goto skip;
2194 	rs = mtod(m, struct ar_rx_status *);
2195 
2196 	/* Make sure that payload fits. */
2197 	datalen = be16toh(rs->rs_datalen);
2198 	if (__predict_false(m->m_len < (int)sizeof(*rs) + datalen))
2199 		goto skip;
2200 
2201 	/* Ignore runt frames.  Let ACKs be seen by bpf */
2202 	if (__predict_false(datalen <
2203 		sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN))
2204 		goto skip;
2205 
2206 	m_adj(m, sizeof(*rs));	/* Strip Rx status. */
2207 	m_set_rcvif(m, ifp);
2208 
2209 	s = splnet();
2210 
2211 	/* Grab a reference to the source node. */
2212 	wh = mtod(m, struct ieee80211_frame *);
2213 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
2214 
2215 	/* Remove any HW padding after the 802.11 header. */
2216 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
2217 		u_int hdrlen = ieee80211_anyhdrsize(wh);
2218 		if (hdrlen & 3) {
2219 			ovbcopy(wh, (uint8_t *)wh + 2, hdrlen);
2220 			m_adj(m, 2);
2221 		}
2222 	}
2223 	if (__predict_false(sc->sc_drvbpf != NULL))
2224 		athn_usb_rx_radiotap(sc, m, rs);
2225 
2226 	/* Trim 802.11 FCS after radiotap. */
2227 	m_adj(m, -IEEE80211_CRC_LEN);
2228 
2229 	/* Send the frame to the 802.11 layer. */
2230 	ieee80211_input(ic, m, ni, rs->rs_rssi + AR_USB_DEFAULT_NF, 0);
2231 
2232 	/* Node is no longer needed. */
2233 	ieee80211_free_node(ni);
2234 	splx(s);
2235 	return;
2236  skip:
2237 	m_freem(m);
2238 }
2239 
2240 Static void
2241 athn_usb_rxeof(struct usbd_xfer *xfer, void * priv,
2242     usbd_status status)
2243 {
2244 	struct athn_usb_rx_data *data = priv;
2245 	struct athn_usb_softc *usc = data->sc;
2246 	struct athn_usb_rx_stream *stream = &usc->usc_rx_stream;
2247 	uint8_t *buf = data->buf;
2248 	struct ar_stream_hdr *hdr;
2249 	struct mbuf *m;
2250 	uint16_t pktlen;
2251 	int off, len;
2252 
2253 	if (usc->usc_dying)
2254 		return;
2255 
2256 	DPRINTFN(DBG_FN, usc, "\n");
2257 
2258 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2259 		DPRINTFN(DBG_RX, usc, "RX status=%d\n", status);
2260 		if (status == USBD_STALLED)
2261 			usbd_clear_endpoint_stall_async(usc->usc_rx_data_pipe);
2262 		if (status != USBD_CANCELLED)
2263 			goto resubmit;
2264 		return;
2265 	}
2266 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2267 
2268 	if (stream->left > 0) {
2269 		if (len >= stream->left) {
2270 			/* We have all our pktlen bytes now. */
2271 			if (__predict_true(stream->m != NULL)) {
2272 				memcpy(mtod(stream->m, uint8_t *) +
2273 				    stream->moff, buf, stream->left);
2274 				athn_usb_rx_frame(usc, stream->m);
2275 				stream->m = NULL;
2276 			}
2277 			/* Next header is 32-bit aligned. */
2278 			off = (stream->left + 3) & ~3;
2279 			buf += off;
2280 			len -= off;
2281 			stream->left = 0;
2282 		} else {
2283 			/* Still need more bytes, save what we have. */
2284 			if (__predict_true(stream->m != NULL)) {
2285 				memcpy(mtod(stream->m, uint8_t *) +
2286 				    stream->moff, buf, len);
2287 				stream->moff += len;
2288 			}
2289 			stream->left -= len;
2290 			goto resubmit;
2291 		}
2292 	}
2293 	KASSERT(stream->left == 0);
2294 	while (len >= (int)sizeof(*hdr)) {
2295 		hdr = (struct ar_stream_hdr *)buf;
2296 		if (hdr->tag != htole16(AR_USB_RX_STREAM_TAG)) {
2297 			DPRINTFN(DBG_RX, usc, "invalid tag 0x%x\n", hdr->tag);
2298 			break;
2299 		}
2300 		pktlen = le16toh(hdr->len);
2301 		buf += sizeof(*hdr);
2302 		len -= sizeof(*hdr);
2303 
2304 		if (__predict_true(pktlen <= MCLBYTES)) {
2305 			/* Allocate an mbuf to store the next pktlen bytes. */
2306 			MGETHDR(m, M_DONTWAIT, MT_DATA);
2307 			if (__predict_true(m != NULL)) {
2308 				m->m_pkthdr.len = m->m_len = pktlen;
2309 				if (pktlen > MHLEN) {
2310 					MCLGET(m, M_DONTWAIT);
2311 					if (!(m->m_flags & M_EXT)) {
2312 						m_free(m);
2313 						m = NULL;
2314 					}
2315 				}
2316 			}
2317 		} else	/* Drop frames larger than MCLBYTES. */
2318 			m = NULL;
2319 		/*
2320 		 * NB: m can be NULL, in which case the next pktlen bytes
2321 		 * will be discarded from the Rx stream.
2322 		 */
2323 		if (pktlen > len) {
2324 			/* Need more bytes, save what we have. */
2325 			stream->m = m;	/* NB: m can be NULL. */
2326 			if (__predict_true(stream->m != NULL)) {
2327 				memcpy(mtod(stream->m, uint8_t *), buf, len);
2328 				stream->moff = len;
2329 			}
2330 			stream->left = pktlen - len;
2331 			goto resubmit;
2332 		}
2333 		if (__predict_true(m != NULL)) {
2334 			/* We have all the pktlen bytes in this xfer. */
2335 			memcpy(mtod(m, uint8_t *), buf, pktlen);
2336 			athn_usb_rx_frame(usc, m);
2337 		}
2338 
2339 		/* Next header is 32-bit aligned. */
2340 		off = (pktlen + 3) & ~3;
2341 		buf += off;
2342 		len -= off;
2343 	}
2344 
2345  resubmit:
2346 	/* Setup a new transfer. */
2347 	usbd_setup_xfer(xfer, data, data->buf, ATHN_USB_RXBUFSZ,
2348 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, athn_usb_rxeof);
2349 	(void)usbd_transfer(xfer);
2350 }
2351 
2352 Static void
2353 athn_usb_txeof(struct usbd_xfer *xfer, void * priv,
2354     usbd_status status)
2355 {
2356 	struct athn_usb_tx_data *data = priv;
2357 	struct athn_usb_softc *usc = data->sc;
2358 	struct athn_softc *sc = &usc->usc_sc;
2359 	struct ifnet *ifp = &sc->sc_if;
2360 	int s;
2361 
2362 	if (usc->usc_dying)
2363 		return;
2364 
2365 	DPRINTFN(DBG_FN, usc, "\n");
2366 
2367 	s = splnet();
2368 	/* Put this Tx buffer back to our free list. */
2369 	mutex_enter(&usc->usc_tx_mtx);
2370 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2371 	mutex_exit(&usc->usc_tx_mtx);
2372 
2373 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2374 		DPRINTFN(DBG_TX, sc, "TX status=%d\n", status);
2375 		if (status == USBD_STALLED)
2376 			usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
2377 		ifp->if_oerrors++;
2378 		splx(s);
2379 		/* XXX Why return? */
2380 		return;
2381 	}
2382 	sc->sc_tx_timer = 0;
2383 	ifp->if_opackets++;
2384 
2385 	/* We just released a Tx buffer, notify Tx. */
2386 	if (ifp->if_flags & IFF_OACTIVE) {
2387 		ifp->if_flags &= ~IFF_OACTIVE;
2388 		ifp->if_start(ifp);
2389 	}
2390 	splx(s);
2391 }
2392 
2393 Static int
2394 athn_usb_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2395     struct athn_usb_tx_data *data)
2396 {
2397 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2398 	struct athn_node *an = ATHN_NODE(ni);
2399 	struct ieee80211com *ic = &sc->sc_ic;
2400 	struct ieee80211_frame *wh;
2401 	struct ieee80211_key *k = NULL;
2402 	struct ar_stream_hdr *hdr;
2403 	struct ar_htc_frame_hdr *htc;
2404 	struct ar_tx_frame *txf;
2405 	struct ar_tx_mgmt *txm;
2406 	uint8_t *frm;
2407 	uint8_t sta_index, qid, tid;
2408 	int error, s, xferlen;
2409 
2410 	DPRINTFN(DBG_FN, sc, "\n");
2411 
2412 	wh = mtod(m, struct ieee80211_frame *);
2413 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2414 		k = ieee80211_crypto_encap(ic, ni, m);
2415 		if (k == NULL)
2416 			return ENOBUFS;
2417 
2418 		/* packet header may have moved, reset our local pointer */
2419 		wh = mtod(m, struct ieee80211_frame *);
2420 	}
2421 #ifdef notyet_edca
2422 	if (ieee80211_has_qos(wh)) {
2423 		uint16_t qos;
2424 
2425 		qos = ieee80211_get_qos(wh);
2426 		tid = qos & IEEE80211_QOS_TID;
2427 		qid = ieee80211_up_to_ac(ic, tid);
2428 	} else
2429 #endif /* notyet_edca */
2430 	{
2431 		tid = 0;
2432 		qid = WME_AC_BE;
2433 	}
2434 
2435 	/* XXX Change radiotap Tx header for USB (no txrate). */
2436 	if (__predict_false(sc->sc_drvbpf != NULL)) {
2437 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
2438 
2439 		tap->wt_flags = 0;
2440 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2441 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2442 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
2443 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2444 
2445 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m);
2446 	}
2447 	sta_index = an->sta_index;
2448 
2449 	/* NB: We don't take advantage of USB Tx stream mode for now. */
2450 	hdr = (struct ar_stream_hdr *)data->buf;
2451 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
2452 
2453 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
2454 	memset(htc, 0, sizeof(*htc));
2455 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2456 	    IEEE80211_FC0_TYPE_DATA) {
2457 		htc->endpoint_id = usc->usc_ep_data[qid];
2458 
2459 		txf = (struct ar_tx_frame *)&htc[1];
2460 		memset(txf, 0, sizeof(*txf));
2461 		txf->data_type = AR_HTC_NORMAL;
2462 		txf->node_idx = sta_index;
2463 		txf->vif_idx = 0;
2464 		txf->tid = tid;
2465 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
2466 			txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2467 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2468 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2469 				txf->flags |= htobe32(AR_HTC_TX_CTSONLY);
2470 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2471 				txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2472 		}
2473 		txf->key_idx = 0xff;
2474 		frm = (uint8_t *)&txf[1];
2475 	} else {
2476 		htc->endpoint_id = usc->usc_ep_mgmt;
2477 
2478 		txm = (struct ar_tx_mgmt *)&htc[1];
2479 		memset(txm, 0, sizeof(*txm));
2480 		txm->node_idx = sta_index;
2481 		txm->vif_idx = 0;
2482 		txm->key_idx = 0xff;
2483 		frm = (uint8_t *)&txm[1];
2484 	}
2485 	/* Copy payload. */
2486 	m_copydata(m, 0, m->m_pkthdr.len, (void *)frm);
2487 	frm += m->m_pkthdr.len;
2488 
2489 	/* Finalize headers. */
2490 	htc->payload_len = htobe16(frm - (uint8_t *)&htc[1]);
2491 	hdr->len = htole16(frm - (uint8_t *)&hdr[1]);
2492 	xferlen = frm - data->buf;
2493 
2494 	s = splnet();
2495 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2496 	    USBD_FORCE_SHORT_XFER, ATHN_USB_TX_TIMEOUT, athn_usb_txeof);
2497 	error = usbd_transfer(data->xfer);
2498 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
2499 		splx(s);
2500 		return error;
2501 	}
2502 	splx(s);
2503 	return 0;
2504 }
2505 
2506 Static void
2507 athn_usb_start(struct ifnet *ifp)
2508 {
2509 	struct athn_softc *sc = ifp->if_softc;
2510 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2511 	struct ieee80211com *ic = &sc->sc_ic;
2512 	struct athn_usb_tx_data *data;
2513 	struct ether_header *eh;
2514 	struct ieee80211_node *ni;
2515 	struct mbuf *m;
2516 
2517 	if (usc->usc_dying)
2518 		return;
2519 
2520 	DPRINTFN(DBG_FN, sc, "\n");
2521 
2522 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2523 		return;
2524 
2525 	data = NULL;
2526 	for (;;) {
2527 		mutex_enter(&usc->usc_tx_mtx);
2528 		if (data == NULL && !TAILQ_EMPTY(&usc->usc_tx_free_list)) {
2529 			data = TAILQ_FIRST(&usc->usc_tx_free_list);
2530 			TAILQ_REMOVE(&usc->usc_tx_free_list, data, next);
2531 		}
2532 		mutex_exit(&usc->usc_tx_mtx);
2533 
2534 		if (data == NULL) {
2535 			ifp->if_flags |= IFF_OACTIVE;
2536 			return;
2537 		}
2538 
2539 		/* Send pending management frames first. */
2540 		IF_DEQUEUE(&ic->ic_mgtq, m);
2541 		if (m != NULL) {
2542 			ni = M_GETCTX(m, struct ieee80211_node *);
2543 			M_CLEARCTX(m);
2544 			goto sendit;
2545 		}
2546 		if (ic->ic_state != IEEE80211_S_RUN)
2547 			break;
2548 
2549 		/* Encapsulate and send data frames. */
2550 		IFQ_DEQUEUE(&ifp->if_snd, m);
2551 		if (m == NULL)
2552 			break;
2553 
2554 		if (m->m_len < (int)sizeof(*eh) &&
2555 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
2556 			ifp->if_oerrors++;
2557 			continue;
2558 		}
2559 		eh = mtod(m, struct ether_header *);
2560 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2561 		if (ni == NULL) {
2562 			m_freem(m);
2563 			ifp->if_oerrors++;
2564 			continue;
2565 		}
2566 
2567 		bpf_mtap(ifp, m);
2568 
2569 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
2570 			ieee80211_free_node(ni);
2571 			ifp->if_oerrors++;
2572 			continue;
2573 		}
2574  sendit:
2575 		bpf_mtap3(ic->ic_rawbpf, m);
2576 
2577 		if (athn_usb_tx(sc, m, ni, data) != 0) {
2578 			m_freem(m);
2579 			ieee80211_free_node(ni);
2580 			ifp->if_oerrors++;
2581 			continue;
2582 		}
2583 		data = NULL;
2584 		m_freem(m);
2585 		ieee80211_free_node(ni);
2586 		sc->sc_tx_timer = 5;
2587 		ifp->if_timer = 1;
2588 	}
2589 
2590 	/* Return the Tx buffer to the free list */
2591 	mutex_enter(&usc->usc_tx_mtx);
2592 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2593 	mutex_exit(&usc->usc_tx_mtx);
2594 }
2595 
2596 Static void
2597 athn_usb_watchdog(struct ifnet *ifp)
2598 {
2599 	struct athn_softc *sc = ifp->if_softc;
2600 
2601 	DPRINTFN(DBG_FN, sc, "\n");
2602 
2603 	ifp->if_timer = 0;
2604 
2605 	if (sc->sc_tx_timer > 0) {
2606 		if (--sc->sc_tx_timer == 0) {
2607 			aprint_error_dev(sc->sc_dev, "device timeout\n");
2608 			/* athn_usb_init(ifp); XXX needs a process context! */
2609 			ifp->if_oerrors++;
2610 			return;
2611 		}
2612 		ifp->if_timer = 1;
2613 	}
2614 	ieee80211_watchdog(&sc->sc_ic);
2615 }
2616 
2617 Static int
2618 athn_usb_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2619 {
2620 	struct athn_softc *sc = ifp->if_softc;
2621 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2622 	struct ieee80211com *ic = &sc->sc_ic;
2623 	int s, error = 0;
2624 
2625 	if (usc->usc_dying)
2626 		return EIO;
2627 
2628 	DPRINTFN(DBG_FN, sc, "cmd=0x%08lx\n", cmd);
2629 
2630 	s = splnet();
2631 
2632 	switch (cmd) {
2633 	case SIOCSIFFLAGS:
2634 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2635 			break;
2636 
2637 		switch (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
2638 		case IFF_UP | IFF_RUNNING:
2639 			break;
2640 		case IFF_UP:
2641 			error = athn_usb_init(ifp);
2642 			break;
2643 		case IFF_RUNNING:
2644 			athn_usb_stop(ifp);
2645 			break;
2646 		case 0:
2647 		default:
2648 			break;
2649 		}
2650 		break;
2651 
2652 	case SIOCADDMULTI:
2653 	case SIOCDELMULTI:
2654 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
2655 			/* setup multicast filter, etc */
2656 			error = 0;
2657 		}
2658 		break;
2659 
2660 	case SIOCS80211CHANNEL:
2661 		error = ieee80211_ioctl(ic, cmd, data);
2662 		if (error == ENETRESET &&
2663 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2664 			if (IS_UP_AND_RUNNING(ifp))
2665 				athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
2666 			error = 0;
2667 		}
2668 		break;
2669 
2670 	default:
2671 		error = ieee80211_ioctl(ic, cmd, data);
2672 		break;
2673 	}
2674 	if (error == ENETRESET) {
2675 		error = 0;
2676 		if (IS_UP_AND_RUNNING(ifp) &&
2677 		    ic->ic_roaming != IEEE80211_ROAMING_MANUAL) {
2678 			mutex_enter(&usc->usc_lock);
2679 			athn_usb_stop_locked(ifp);
2680 			error = athn_usb_init_locked(ifp);
2681 			mutex_exit(&usc->usc_lock);
2682 		}
2683 	}
2684 	splx(s);
2685 	return error;
2686 }
2687 
2688 Static int
2689 athn_usb_init(struct ifnet *ifp)
2690 {
2691 	struct athn_softc *sc = ifp->if_softc;
2692 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2693 
2694 	mutex_enter(&usc->usc_lock);
2695 	int ret = athn_usb_init_locked(ifp);
2696 	mutex_exit(&usc->usc_lock);
2697 
2698 	return ret;
2699 }
2700 
2701 Static int
2702 athn_usb_init_locked(struct ifnet *ifp)
2703 {
2704 	struct athn_softc *sc = ifp->if_softc;
2705 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2706 	struct athn_ops *ops = &sc->sc_ops;
2707 	struct ieee80211com *ic = &sc->sc_ic;
2708 	struct ieee80211_channel *curchan, *extchan;
2709 	struct athn_usb_rx_data *data;
2710 	struct ar_htc_target_vif hvif;
2711 	struct ar_htc_target_sta sta;
2712 	struct ar_htc_cap_target hic;
2713 	uint16_t mode;
2714 	size_t i;
2715 	int error;
2716 
2717 	if (usc->usc_dying)
2718 		return USBD_CANCELLED;
2719 
2720 	DPRINTFN(DBG_FN, sc, "\n");
2721 
2722 	/* Init host async commands ring. */
2723 	mutex_spin_enter(&usc->usc_task_mtx);
2724 	usc->usc_cmdq.cur = usc->usc_cmdq.next = usc->usc_cmdq.queued = 0;
2725 	mutex_spin_exit(&usc->usc_task_mtx);
2726 
2727 	/* Steal one buffer for beacons. */
2728 	mutex_enter(&usc->usc_tx_mtx);
2729 	usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
2730 	TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
2731 	mutex_exit(&usc->usc_tx_mtx);
2732 
2733 	curchan = ic->ic_curchan;
2734 	extchan = NULL;
2735 
2736 	/* In case a new MAC address has been configured. */
2737 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2738 
2739 	error = athn_set_power_awake(sc);
2740 	if (error != 0)
2741 		goto fail;
2742 
2743 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_FLUSH_RECV);
2744 	if (error != 0)
2745 		goto fail;
2746 
2747 	error = athn_hw_reset(sc, curchan, extchan, 1);
2748 	if (error != 0)
2749 		goto fail;
2750 
2751 	ops->set_txpower(sc, curchan, extchan);
2752 
2753 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
2754 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
2755 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
2756 	    &mode, sizeof(mode), NULL);
2757 	if (error != 0)
2758 		goto fail;
2759 
2760 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ATH_INIT);
2761 	if (error != 0)
2762 		goto fail;
2763 
2764 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
2765 	if (error != 0)
2766 		goto fail;
2767 
2768 	athn_rx_start(sc);
2769 
2770 	/* Create main interface on target. */
2771 	memset(&hvif, 0, sizeof(hvif));
2772 	hvif.index = 0;
2773 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2774 	switch (ic->ic_opmode) {
2775 	case IEEE80211_M_STA:
2776 		hvif.opmode = htobe32(AR_HTC_M_STA);
2777 		break;
2778 	case IEEE80211_M_MONITOR:
2779 		hvif.opmode = htobe32(AR_HTC_M_MONITOR);
2780 		break;
2781 #ifndef IEEE80211_STA_ONLY
2782 	case IEEE80211_M_IBSS:
2783 		hvif.opmode = htobe32(AR_HTC_M_IBSS);
2784 		break;
2785 	case IEEE80211_M_AHDEMO:
2786 		hvif.opmode = htobe32(AR_HTC_M_AHDEMO);
2787 		break;
2788 	case IEEE80211_M_HOSTAP:
2789 		hvif.opmode = htobe32(AR_HTC_M_HOSTAP);
2790 		break;
2791 #endif
2792 	}
2793 	hvif.rtsthreshold = htobe16(ic->ic_rtsthreshold);
2794 	DPRINTFN(DBG_INIT, sc, "creating VAP\n");
2795 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_CREATE,
2796 	    &hvif, sizeof(hvif), NULL);
2797 	if (error != 0)
2798 		goto fail;
2799 
2800 	/* Create a fake node to send management frames before assoc. */
2801 	memset(&sta, 0, sizeof(sta));
2802 	IEEE80211_ADDR_COPY(sta.macaddr, ic->ic_myaddr);
2803 	sta.sta_index = 0;
2804 	sta.is_vif_sta = 1;
2805 	sta.vif_index = hvif.index;
2806 	sta.maxampdu = 0xffff;
2807 
2808 	DPRINTFN(DBG_INIT | DBG_NODES, sc, "creating default node %u\n",
2809 	    sta.sta_index);
2810 	error = athn_usb_create_hw_node(usc, &sta);
2811 	if (error != 0)
2812 		goto fail;
2813 
2814 	/* Update target capabilities. */
2815 	memset(&hic, 0, sizeof(hic));
2816 	hic.flags = htobe32(0x400c2400);
2817 	hic.flags_ext = htobe32(0x00106080);
2818 	hic.ampdu_limit = htobe32(0x0000ffff);
2819 	hic.ampdu_subframes = 20;
2820 	hic.protmode = 1;	/* XXX */
2821 	hic.lg_txchainmask = sc->sc_txchainmask;
2822 	hic.ht_txchainmask = sc->sc_txchainmask;
2823 	DPRINTFN(DBG_INIT, sc, "updating target configuration\n");
2824 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TARGET_IC_UPDATE,
2825 	    &hic, sizeof(hic), NULL);
2826 	if (error != 0)
2827 		goto fail;
2828 
2829 
2830 	/* Queue Rx xfers. */
2831 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
2832 		data = &usc->usc_rx_data[i];
2833 
2834 		usbd_setup_xfer(data->xfer, data, data->buf,
2835 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK,
2836 		    USBD_NO_TIMEOUT, athn_usb_rxeof);
2837 		error = usbd_transfer(data->xfer);
2838 		if (error != 0 && error != USBD_IN_PROGRESS)
2839 			goto fail;
2840 	}
2841 	/* We're ready to go. */
2842 	ifp->if_flags &= ~IFF_OACTIVE;
2843 	ifp->if_flags |= IFF_RUNNING;
2844 
2845 #ifdef notyet
2846 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2847 		/* Install WEP keys. */
2848 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2849 			athn_usb_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2850 	}
2851 #endif
2852 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2853 		ic->ic_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
2854 	else
2855 		ic->ic_max_aid = sc->sc_max_aid;
2856 
2857 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2858 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2859 	else
2860 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2861 	athn_usb_wait_async(usc);
2862 	return 0;
2863  fail:
2864 	athn_usb_stop(ifp);
2865 	return error;
2866 }
2867 
2868 Static void
2869 athn_usb_stop(struct ifnet *ifp)
2870 {
2871 	struct athn_softc *sc = ifp->if_softc;
2872 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2873 
2874 	mutex_enter(&usc->usc_lock);
2875 	athn_usb_stop_locked(ifp);
2876 	mutex_exit(&usc->usc_lock);
2877 }
2878 
2879 Static void
2880 athn_usb_stop_locked(struct ifnet *ifp)
2881 {
2882 	struct athn_softc *sc = ifp->if_softc;
2883 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2884 	struct ieee80211com *ic = &sc->sc_ic;
2885 	struct ar_htc_target_vif hvif;
2886 	struct mbuf *m;
2887 	uint8_t sta_index;
2888 	int s;
2889 
2890 	DPRINTFN(DBG_FN, sc, "\n");
2891 
2892 	s = splusb();
2893 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2894 	athn_usb_wait_async(usc);
2895 	splx(s);
2896 
2897 	sc->sc_tx_timer = 0;
2898 	ifp->if_timer = 0;
2899 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2900 
2901 	callout_stop(&sc->sc_scan_to);
2902 	callout_stop(&sc->sc_calib_to);
2903 
2904 	/* Abort Tx/Rx. */
2905 	usbd_abort_pipe(usc->usc_tx_data_pipe);
2906 	usbd_abort_pipe(usc->usc_rx_data_pipe);
2907 
2908 	/* Flush Rx stream. */
2909 	CTASSERT(sizeof(m) == sizeof(void *));
2910 	m = atomic_swap_ptr(&usc->usc_rx_stream.m, NULL);
2911 	m_freem(m);
2912 	usc->usc_rx_stream.left = 0;
2913 
2914 	/* Remove main interface. */
2915 	memset(&hvif, 0, sizeof(hvif));
2916 	hvif.index = 0;
2917 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2918 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_REMOVE,
2919 	    &hvif, sizeof(hvif), NULL);
2920 
2921 	/* Remove default node. */
2922 	sta_index = 0;
2923 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
2924 	(void)athn_usb_remove_hw_node(usc, &sta_index);
2925 
2926 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
2927 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
2928 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
2929 
2930 	athn_reset(sc, 0);
2931 	athn_init_pll(sc, NULL);
2932 	athn_set_power_awake(sc);
2933 	athn_reset(sc, 1);
2934 	athn_init_pll(sc, NULL);
2935 	athn_set_power_sleep(sc);
2936 }
2937 
2938 MODULE(MODULE_CLASS_DRIVER, if_athn_usb, "bpf");
2939 
2940 #ifdef _MODULE
2941 #include "ioconf.c"
2942 #endif
2943 
2944 static int
2945 if_athn_usb_modcmd(modcmd_t cmd, void *aux)
2946 {
2947 	int error = 0;
2948 
2949 	switch (cmd) {
2950 	case MODULE_CMD_INIT:
2951 #ifdef _MODULE
2952 		error = config_init_component(cfdriver_ioconf_if_athn_usb,
2953 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
2954 #endif
2955 		return error;
2956 	case MODULE_CMD_FINI:
2957 #ifdef _MODULE
2958 		error = config_fini_component(cfdriver_ioconf_if_athn_usb,
2959 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
2960 #endif
2961 		return error;
2962 	default:
2963 		return ENOTTY;
2964 	}
2965 }
2966