xref: /openbsd-src/sys/dev/usb/if_athn_usb.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: if_athn_usb.c,v 1.22 2014/07/13 15:52:49 mpi Exp $	*/
2 
3 /*-
4  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * USB front-end for Atheros AR9271 and AR7010 chipsets.
21  */
22 
23 #include "bpfilter.h"
24 
25 #include <sys/param.h>
26 #include <sys/sockio.h>
27 #include <sys/mbuf.h>
28 #include <sys/kernel.h>
29 #include <sys/socket.h>
30 #include <sys/systm.h>
31 #include <sys/timeout.h>
32 #include <sys/conf.h>
33 #include <sys/device.h>
34 
35 #include <machine/bus.h>
36 #include <machine/endian.h>
37 #include <machine/intr.h>
38 
39 #if NBPFILTER > 0
40 #include <net/bpf.h>
41 #endif
42 #include <net/if.h>
43 #include <net/if_arp.h>
44 #include <net/if_dl.h>
45 #include <net/if_media.h>
46 #include <net/if_types.h>
47 
48 #include <netinet/in.h>
49 #include <netinet/if_ether.h>
50 
51 #include <net80211/ieee80211_var.h>
52 #include <net80211/ieee80211_amrr.h>
53 #include <net80211/ieee80211_radiotap.h>
54 
55 #include <dev/ic/athnreg.h>
56 #include <dev/ic/athnvar.h>
57 
58 #include <dev/usb/usb.h>
59 #include <dev/usb/usbdi.h>
60 #include <dev/usb/usbdi_util.h>
61 #include <dev/usb/usbdevs.h>
62 
63 #include <dev/usb/if_athn_usb.h>
64 
65 static const struct athn_usb_type {
66 	struct usb_devno	devno;
67 	u_int			flags;
68 } athn_usb_devs[] = {
69 	{{ USB_VENDOR_ACCTON, USB_PRODUCT_ACCTON_AR9280 },
70 	   ATHN_USB_FLAG_AR7010 },
71 	{{ USB_VENDOR_ACTIONTEC, USB_PRODUCT_ACTIONTEC_AR9287 },
72 	   ATHN_USB_FLAG_AR7010 },
73 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_1 }},
74 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_2 }},
75 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_3 }},
76 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9280 },
77 	   ATHN_USB_FLAG_AR7010 },
78 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9287 },
79 	   ATHN_USB_FLAG_AR7010 },
80 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_1 }},
81 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_2 }},
82 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_3 }},
83 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_4 }},
84 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_5 }},
85 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_6 }},
86 	{{ USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_AR9271 }},
87 	{{ USB_VENDOR_LITEON, USB_PRODUCT_LITEON_AR9271 }},
88 	{{ USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_WNA1100 }},
89 	{{ USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_WNDA3200 },
90 	   ATHN_USB_FLAG_AR7010 },
91 	{{ USB_VENDOR_VIA, USB_PRODUCT_VIA_AR9271 }}
92 };
93 #define athn_usb_lookup(v, p)	\
94 	((const struct athn_usb_type *)usb_lookup(athn_usb_devs, v, p))
95 
96 int		athn_usb_match(struct device *, void *, void *);
97 void		athn_usb_attach(struct device *, struct device *, void *);
98 int		athn_usb_detach(struct device *, int);
99 void		athn_usb_attachhook(void *);
100 int		athn_usb_open_pipes(struct athn_usb_softc *);
101 void		athn_usb_close_pipes(struct athn_usb_softc *);
102 int		athn_usb_alloc_rx_list(struct athn_usb_softc *);
103 void		athn_usb_free_rx_list(struct athn_usb_softc *);
104 int		athn_usb_alloc_tx_list(struct athn_usb_softc *);
105 void		athn_usb_free_tx_list(struct athn_usb_softc *);
106 int		athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
107 void		athn_usb_free_tx_cmd(struct athn_usb_softc *);
108 void		athn_usb_task(void *);
109 void		athn_usb_do_async(struct athn_usb_softc *,
110 		    void (*)(struct athn_usb_softc *, void *), void *, int);
111 void		athn_usb_wait_async(struct athn_usb_softc *);
112 int		athn_usb_load_firmware(struct athn_usb_softc *);
113 int		athn_usb_htc_msg(struct athn_usb_softc *, uint16_t, void *,
114 		    int);
115 int		athn_usb_htc_setup(struct athn_usb_softc *);
116 int		athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
117 		    uint8_t, uint8_t, uint8_t *);
118 void		athn_usb_wmieof(struct usbd_xfer *, void *,
119 		    usbd_status);
120 int		athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
121 		    int, void *);
122 int		athn_usb_read_rom(struct athn_softc *);
123 uint32_t	athn_usb_read(struct athn_softc *, uint32_t);
124 void		athn_usb_write(struct athn_softc *, uint32_t, uint32_t);
125 void		athn_usb_write_barrier(struct athn_softc *);
126 int		athn_usb_media_change(struct ifnet *);
127 int		athn_usb_newstate(struct ieee80211com *, enum ieee80211_state,
128 		    int);
129 void		athn_usb_newstate_cb(struct athn_usb_softc *, void *);
130 void		athn_usb_newassoc(struct ieee80211com *,
131 		    struct ieee80211_node *, int);
132 void		athn_usb_newassoc_cb(struct athn_usb_softc *, void *);
133 void		athn_usb_node_leave(struct ieee80211com *,
134 		    struct ieee80211_node *);
135 void		athn_usb_node_leave_cb(struct athn_usb_softc *, void *);
136 int		athn_usb_ampdu_tx_start(struct ieee80211com *,
137 		    struct ieee80211_node *, uint8_t);
138 void		athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *, void *);
139 void		athn_usb_ampdu_tx_stop(struct ieee80211com *,
140 		    struct ieee80211_node *, uint8_t);
141 void		athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *, void *);
142 int		athn_usb_create_node(struct athn_usb_softc *,
143 		    struct ieee80211_node *);
144 void		athn_usb_rx_enable(struct athn_softc *);
145 int		athn_set_chan(struct athn_softc *, struct ieee80211_channel *,
146 		    struct ieee80211_channel *);
147 int		athn_usb_switch_chan(struct athn_softc *,
148 		    struct ieee80211_channel *, struct ieee80211_channel *);
149 void		athn_usb_updateedca(struct ieee80211com *);
150 void		athn_usb_updateedca_cb(struct athn_usb_softc *, void *);
151 void		athn_usb_updateslot(struct ieee80211com *);
152 void		athn_usb_updateslot_cb(struct athn_usb_softc *, void *);
153 int		athn_usb_set_key(struct ieee80211com *,
154 		    struct ieee80211_node *, struct ieee80211_key *);
155 void		athn_usb_set_key_cb(struct athn_usb_softc *, void *);
156 void		athn_usb_delete_key(struct ieee80211com *,
157 		    struct ieee80211_node *, struct ieee80211_key *);
158 void		athn_usb_delete_key_cb(struct athn_usb_softc *, void *);
159 void		athn_usb_bcneof(struct usbd_xfer *, void *,
160 		    usbd_status);
161 void		athn_usb_swba(struct athn_usb_softc *);
162 void		athn_usb_rx_wmi_ctrl(struct athn_usb_softc *, uint8_t *, int);
163 void		athn_usb_intr(struct usbd_xfer *, void *,
164 		    usbd_status);
165 void		athn_usb_rx_radiotap(struct athn_softc *, struct mbuf *,
166 		    struct ar_rx_status *);
167 void		athn_usb_rx_frame(struct athn_usb_softc *, struct mbuf *);
168 void		athn_usb_rxeof(struct usbd_xfer *, void *,
169 		    usbd_status);
170 void		athn_usb_txeof(struct usbd_xfer *, void *,
171 		    usbd_status);
172 int		athn_usb_tx(struct athn_softc *, struct mbuf *,
173 		    struct ieee80211_node *);
174 void		athn_usb_start(struct ifnet *);
175 void		athn_usb_watchdog(struct ifnet *);
176 int		athn_usb_ioctl(struct ifnet *, u_long, caddr_t);
177 int		athn_usb_init(struct ifnet *);
178 void		athn_usb_stop(struct ifnet *);
179 void		ar9271_load_ani(struct athn_softc *);
180 
181 /* Shortcut. */
182 #define athn_usb_wmi_cmd(sc, cmd_id)	\
183 	athn_usb_wmi_xcmd(sc, cmd_id, NULL, 0, NULL)
184 
185 /* Extern functions. */
186 void		athn_led_init(struct athn_softc *);
187 void		athn_set_led(struct athn_softc *, int);
188 void		athn_btcoex_init(struct athn_softc *);
189 void		athn_set_rxfilter(struct athn_softc *, uint32_t);
190 int		athn_reset(struct athn_softc *, int);
191 void		athn_init_pll(struct athn_softc *,
192 		    const struct ieee80211_channel *);
193 int		athn_set_power_awake(struct athn_softc *);
194 void		athn_set_power_sleep(struct athn_softc *);
195 void		athn_reset_key(struct athn_softc *, int);
196 int		athn_set_key(struct ieee80211com *, struct ieee80211_node *,
197 		    struct ieee80211_key *);
198 void		athn_delete_key(struct ieee80211com *, struct ieee80211_node *,
199 		    struct ieee80211_key *);
200 void		athn_rx_start(struct athn_softc *);
201 void		athn_set_sta_timers(struct athn_softc *);
202 void		athn_set_hostap_timers(struct athn_softc *);
203 void		athn_set_opmode(struct athn_softc *);
204 void		athn_set_bss(struct athn_softc *, struct ieee80211_node *);
205 int		athn_hw_reset(struct athn_softc *, struct ieee80211_channel *,
206 		    struct ieee80211_channel *, int);
207 void		athn_updateedca(struct ieee80211com *);
208 void		athn_updateslot(struct ieee80211com *);
209 
210 const struct cfattach athn_usb_ca = {
211 	sizeof(struct athn_usb_softc),
212 	athn_usb_match,
213 	athn_usb_attach,
214 	athn_usb_detach
215 };
216 
217 int
218 athn_usb_match(struct device *parent, void *match, void *aux)
219 {
220 	struct usb_attach_arg *uaa = aux;
221 
222 	if (uaa->iface != NULL)
223 		return (UMATCH_NONE);
224 
225 	return ((athn_usb_lookup(uaa->vendor, uaa->product) != NULL) ?
226 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE);
227 }
228 
229 void
230 athn_usb_attach(struct device *parent, struct device *self, void *aux)
231 {
232 	struct athn_usb_softc *usc = (struct athn_usb_softc *)self;
233 	struct athn_softc *sc = &usc->sc_sc;
234 	struct usb_attach_arg *uaa = aux;
235 	int error;
236 
237 	usc->sc_udev = uaa->device;
238 
239 	usc->flags = athn_usb_lookup(uaa->vendor, uaa->product)->flags;
240 	sc->flags |= ATHN_FLAG_USB;
241 #ifdef notyet
242 	/* Check if it is a combo WiFi+Bluetooth (WB193) device. */
243 	if (strncmp(product, "wb193", 5) == 0)
244 		sc->flags |= ATHN_FLAG_BTCOEX3WIRE;
245 #endif
246 
247 	sc->ops.read = athn_usb_read;
248 	sc->ops.write = athn_usb_write;
249 	sc->ops.write_barrier = athn_usb_write_barrier;
250 
251 	usb_init_task(&usc->sc_task, athn_usb_task, sc, USB_TASK_TYPE_GENERIC);
252 
253 	if (usbd_set_config_no(usc->sc_udev, 1, 0) != 0) {
254 		printf("%s: could not set configuration no\n",
255 		    sc->sc_dev.dv_xname);
256 		return;
257 	}
258 
259 	/* Get the first interface handle. */
260 	error = usbd_device2interface_handle(usc->sc_udev, 0, &usc->sc_iface);
261 	if (error != 0) {
262 		printf("%s: could not get interface handle\n",
263 		    sc->sc_dev.dv_xname);
264 		return;
265 	}
266 
267 	if (athn_usb_open_pipes(usc) != 0)
268 		return;
269 
270 	/* Allocate xfer for firmware commands. */
271 	if (athn_usb_alloc_tx_cmd(usc) != 0)
272 		return;
273 
274 	if (rootvp == NULL)
275 		mountroothook_establish(athn_usb_attachhook, usc);
276 	else
277 		athn_usb_attachhook(usc);
278 }
279 
280 int
281 athn_usb_detach(struct device *self, int flags)
282 {
283 	struct athn_usb_softc *usc = (struct athn_usb_softc *)self;
284 	struct athn_softc *sc = &usc->sc_sc;
285 
286 	if (usc->sc_athn_attached)
287 		athn_detach(sc);
288 
289 	/* Wait for all async commands to complete. */
290 	athn_usb_wait_async(usc);
291 
292 	/* Abort and close Tx/Rx pipes. */
293 	athn_usb_close_pipes(usc);
294 
295 	/* Free Tx/Rx buffers. */
296 	athn_usb_free_tx_cmd(usc);
297 	athn_usb_free_tx_list(usc);
298 	athn_usb_free_rx_list(usc);
299 
300 	return (0);
301 }
302 
303 void
304 athn_usb_attachhook(void *xsc)
305 {
306 	struct athn_usb_softc *usc = xsc;
307 	struct athn_softc *sc = &usc->sc_sc;
308 	struct athn_ops *ops = &sc->ops;
309 	struct ieee80211com *ic = &sc->sc_ic;
310 	struct ifnet *ifp = &ic->ic_if;
311 	int s, i, error;
312 
313 	/* Load firmware. */
314 	error = athn_usb_load_firmware(usc);
315 	if (error != 0) {
316 		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
317 		return;
318 	}
319 
320 	/* Setup the host transport communication interface. */
321 	error = athn_usb_htc_setup(usc);
322 	if (error != 0)
323 		return;
324 
325 	/* We're now ready to attach the bus agnostic driver. */
326 	s = splnet();
327 	error = athn_attach(sc);
328 	if (error != 0) {
329 		splx(s);
330 		return;
331 	}
332 	usc->sc_athn_attached = 1;
333 	/* Override some operations for USB. */
334 	ifp->if_ioctl = athn_usb_ioctl;
335 	ifp->if_start = athn_usb_start;
336 	ifp->if_watchdog = athn_usb_watchdog;
337 	ic->ic_newassoc = athn_usb_newassoc;
338 	ic->ic_node_leave = athn_usb_node_leave;
339 	ic->ic_updateslot = athn_usb_updateslot;
340 	ic->ic_updateedca = athn_usb_updateedca;
341 #ifdef notyet
342 	ic->ic_set_key = athn_usb_set_key;
343 	ic->ic_delete_key = athn_usb_delete_key;
344 	ic->ic_ampdu_tx_start = athn_usb_ampdu_tx_start;
345 	ic->ic_ampdu_tx_stop = athn_usb_ampdu_tx_stop;
346 #endif
347 	ic->ic_newstate = athn_usb_newstate;
348 	ic->ic_media.ifm_change = athn_usb_media_change;
349 
350 	/* Firmware cannot handle more than 8 STAs. */
351 	if (ic->ic_max_nnodes > AR_USB_MAX_STA)
352 		ic->ic_max_nnodes = AR_USB_MAX_STA;
353 
354 	ops->rx_enable = athn_usb_rx_enable;
355 	splx(s);
356 
357 	/* Reset HW key cache entries. */
358 	for (i = 0; i < sc->kc_entries; i++)
359 		athn_reset_key(sc, i);
360 
361 	ops->enable_antenna_diversity(sc);
362 
363 #ifdef ATHN_BT_COEXISTENCE
364 	/* Configure bluetooth coexistence for combo chips. */
365 	if (sc->flags & ATHN_FLAG_BTCOEX)
366 		athn_btcoex_init(sc);
367 #endif
368 	/* Configure LED. */
369 	athn_led_init(sc);
370 }
371 
372 int
373 athn_usb_open_pipes(struct athn_usb_softc *usc)
374 {
375 	usb_endpoint_descriptor_t *ed;
376 	int isize, error;
377 
378 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_TX_DATA, 0,
379 	    &usc->tx_data_pipe);
380 	if (error != 0) {
381 		printf("%s: could not open Tx bulk pipe\n",
382 		    usc->usb_dev.dv_xname);
383 		goto fail;
384 	}
385 
386 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_RX_DATA, 0,
387 	    &usc->rx_data_pipe);
388 	if (error != 0) {
389 		printf("%s: could not open Rx bulk pipe\n",
390 		    usc->usb_dev.dv_xname);
391 		goto fail;
392 	}
393 
394 	ed = usbd_get_endpoint_descriptor(usc->sc_iface, AR_PIPE_RX_INTR);
395 	if (ed == NULL) {
396 		printf("%s: could not retrieve Rx intr pipe descriptor\n",
397 		    usc->usb_dev.dv_xname);
398 		goto fail;
399 	}
400 	isize = UGETW(ed->wMaxPacketSize);
401 	if (isize == 0) {
402 		printf("%s: invalid Rx intr pipe descriptor\n",
403 		    usc->usb_dev.dv_xname);
404 		goto fail;
405 	}
406 	usc->ibuf = malloc(isize, M_USBDEV, M_NOWAIT);
407 	if (usc->ibuf == NULL) {
408 		printf("%s: could not allocate Rx intr buffer\n",
409 		    usc->usb_dev.dv_xname);
410 		goto fail;
411 	}
412 	error = usbd_open_pipe_intr(usc->sc_iface, AR_PIPE_RX_INTR,
413 	    USBD_SHORT_XFER_OK, &usc->rx_intr_pipe, usc, usc->ibuf, isize,
414 	    athn_usb_intr, USBD_DEFAULT_INTERVAL);
415 	if (error != 0) {
416 		printf("%s: could not open Rx intr pipe\n",
417 		    usc->usb_dev.dv_xname);
418 		goto fail;
419 	}
420 
421 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_TX_INTR, 0,
422 	    &usc->tx_intr_pipe);
423 	if (error != 0) {
424 		printf("%s: could not open Tx intr pipe\n",
425 		    usc->usb_dev.dv_xname);
426 		goto fail;
427 	}
428  fail:
429 	if (error != 0)
430 		athn_usb_close_pipes(usc);
431 	return (error);
432 }
433 
434 void
435 athn_usb_close_pipes(struct athn_usb_softc *usc)
436 {
437 	if (usc->tx_data_pipe != NULL)
438 		usbd_close_pipe(usc->tx_data_pipe);
439 	if (usc->rx_data_pipe != NULL)
440 		usbd_close_pipe(usc->rx_data_pipe);
441 	if (usc->tx_intr_pipe != NULL)
442 		usbd_close_pipe(usc->tx_intr_pipe);
443 	if (usc->rx_intr_pipe != NULL) {
444 		usbd_abort_pipe(usc->rx_intr_pipe);
445 		usbd_close_pipe(usc->rx_intr_pipe);
446 	}
447 	if (usc->ibuf != NULL)
448 		free(usc->ibuf, M_USBDEV, 0);
449 }
450 
451 int
452 athn_usb_alloc_rx_list(struct athn_usb_softc *usc)
453 {
454 	struct athn_usb_rx_data *data;
455 	int i, error = 0;
456 
457 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
458 		data = &usc->rx_data[i];
459 
460 		data->sc = usc;	/* Backpointer for callbacks. */
461 
462 		data->xfer = usbd_alloc_xfer(usc->sc_udev);
463 		if (data->xfer == NULL) {
464 			printf("%s: could not allocate xfer\n",
465 			    usc->usb_dev.dv_xname);
466 			error = ENOMEM;
467 			break;
468 		}
469 		data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_RXBUFSZ);
470 		if (data->buf == NULL) {
471 			printf("%s: could not allocate xfer buffer\n",
472 			    usc->usb_dev.dv_xname);
473 			error = ENOMEM;
474 			break;
475 		}
476 	}
477 	if (error != 0)
478 		athn_usb_free_rx_list(usc);
479 	return (error);
480 }
481 
482 void
483 athn_usb_free_rx_list(struct athn_usb_softc *usc)
484 {
485 	int i;
486 
487 	/* NB: Caller must abort pipe first. */
488 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
489 		if (usc->rx_data[i].xfer != NULL)
490 			usbd_free_xfer(usc->rx_data[i].xfer);
491 		usc->rx_data[i].xfer = NULL;
492 	}
493 }
494 
495 int
496 athn_usb_alloc_tx_list(struct athn_usb_softc *usc)
497 {
498 	struct athn_usb_tx_data *data;
499 	int i, error = 0;
500 
501 	TAILQ_INIT(&usc->tx_free_list);
502 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
503 		data = &usc->tx_data[i];
504 
505 		data->sc = usc;	/* Backpointer for callbacks. */
506 
507 		data->xfer = usbd_alloc_xfer(usc->sc_udev);
508 		if (data->xfer == NULL) {
509 			printf("%s: could not allocate xfer\n",
510 			    usc->usb_dev.dv_xname);
511 			error = ENOMEM;
512 			break;
513 		}
514 		data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_TXBUFSZ);
515 		if (data->buf == NULL) {
516 			printf("%s: could not allocate xfer buffer\n",
517 			    usc->usb_dev.dv_xname);
518 			error = ENOMEM;
519 			break;
520 		}
521 		/* Append this Tx buffer to our free list. */
522 		TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
523 	}
524 	if (error != 0)
525 		athn_usb_free_tx_list(usc);
526 	return (error);
527 }
528 
529 void
530 athn_usb_free_tx_list(struct athn_usb_softc *usc)
531 {
532 	int i;
533 
534 	/* NB: Caller must abort pipe first. */
535 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
536 		if (usc->tx_data[i].xfer != NULL)
537 			usbd_free_xfer(usc->tx_data[i].xfer);
538 		usc->tx_data[i].xfer = NULL;
539 	}
540 }
541 
542 int
543 athn_usb_alloc_tx_cmd(struct athn_usb_softc *usc)
544 {
545 	struct athn_usb_tx_data *data = &usc->tx_cmd;
546 
547 	data->sc = usc;	/* Backpointer for callbacks. */
548 
549 	data->xfer = usbd_alloc_xfer(usc->sc_udev);
550 	if (data->xfer == NULL) {
551 		printf("%s: could not allocate xfer\n",
552 		    usc->usb_dev.dv_xname);
553 		return (ENOMEM);
554 	}
555 	data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_TXCMDSZ);
556 	if (data->buf == NULL) {
557 		printf("%s: could not allocate xfer buffer\n",
558 		    usc->usb_dev.dv_xname);
559 		return (ENOMEM);
560 	}
561 	return (0);
562 }
563 
564 void
565 athn_usb_free_tx_cmd(struct athn_usb_softc *usc)
566 {
567 	if (usc->tx_cmd.xfer != NULL)
568 		usbd_free_xfer(usc->tx_cmd.xfer);
569 	usc->tx_cmd.xfer = NULL;
570 }
571 
572 void
573 athn_usb_task(void *arg)
574 {
575 	struct athn_usb_softc *usc = arg;
576 	struct athn_usb_host_cmd_ring *ring = &usc->cmdq;
577 	struct athn_usb_host_cmd *cmd;
578 	int s;
579 
580 	/* Process host commands. */
581 	s = splusb();
582 	while (ring->next != ring->cur) {
583 		cmd = &ring->cmd[ring->next];
584 		splx(s);
585 		/* Invoke callback. */
586 		cmd->cb(usc, cmd->data);
587 		s = splusb();
588 		ring->queued--;
589 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
590 	}
591 	wakeup(ring);
592 	splx(s);
593 }
594 
595 void
596 athn_usb_do_async(struct athn_usb_softc *usc,
597     void (*cb)(struct athn_usb_softc *, void *), void *arg, int len)
598 {
599 	struct athn_usb_host_cmd_ring *ring = &usc->cmdq;
600 	struct athn_usb_host_cmd *cmd;
601 	int s;
602 
603 	if (ring->queued)
604 		return;	/* XXX */
605 	s = splusb();
606 	cmd = &ring->cmd[ring->cur];
607 	cmd->cb = cb;
608 	KASSERT(len <= sizeof(cmd->data));
609 	memcpy(cmd->data, arg, len);
610 	ring->cur = (ring->cur + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
611 
612 	/* If there is no pending command already, schedule a task. */
613 	if (++ring->queued == 1)
614 		usb_add_task(usc->sc_udev, &usc->sc_task);
615 	splx(s);
616 }
617 
618 void
619 athn_usb_wait_async(struct athn_usb_softc *usc)
620 {
621 	/* Wait for all queued asynchronous commands to complete. */
622 	while (usc->cmdq.queued > 0)
623 		tsleep(&usc->cmdq, 0, "cmdq", 0);
624 }
625 
626 int
627 athn_usb_load_firmware(struct athn_usb_softc *usc)
628 {
629 	usb_device_descriptor_t *dd;
630 	usb_device_request_t req;
631 	const char *name;
632 	u_char *fw, *ptr;
633 	size_t size;
634 	uint32_t addr;
635 	int s, mlen, error;
636 
637 	/* Determine which firmware image to load. */
638 	if (usc->flags & ATHN_USB_FLAG_AR7010) {
639 		dd = usbd_get_device_descriptor(usc->sc_udev);
640 		if (UGETW(dd->bcdDevice) == 0x0202)
641 			name = "athn-ar7010-11";
642 		else
643 			name = "athn-ar7010";
644 	} else
645 		name = "athn-ar9271";
646 	/* Read firmware image from the filesystem. */
647 	if ((error = loadfirmware(name, &fw, &size)) != 0) {
648 		printf("%s: failed loadfirmware of file %s (error %d)\n",
649 		    usc->usb_dev.dv_xname, name, error);
650 		return (error);
651 	}
652 	/* Load firmware image. */
653 	ptr = fw;
654 	addr = AR9271_FIRMWARE >> 8;
655 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
656 	req.bRequest = AR_FW_DOWNLOAD;
657 	USETW(req.wIndex, 0);
658 	while (size > 0) {
659 		mlen = MIN(size, 4096);
660 
661 		USETW(req.wValue, addr);
662 		USETW(req.wLength, mlen);
663 		error = usbd_do_request(usc->sc_udev, &req, ptr);
664 		if (error != 0) {
665 			free(fw, M_DEVBUF, 0);
666 			return (error);
667 		}
668 		addr += mlen >> 8;
669 		ptr  += mlen;
670 		size -= mlen;
671 	}
672 	free(fw, M_DEVBUF, 0);
673 
674 	/* Start firmware. */
675 	if (usc->flags & ATHN_USB_FLAG_AR7010)
676 		addr = AR7010_FIRMWARE_TEXT >> 8;
677 	else
678 		addr = AR9271_FIRMWARE_TEXT >> 8;
679 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
680 	req.bRequest = AR_FW_DOWNLOAD_COMP;
681 	USETW(req.wIndex, 0);
682 	USETW(req.wValue, addr);
683 	USETW(req.wLength, 0);
684 	s = splusb();
685 	usc->wait_msg_id = AR_HTC_MSG_READY;
686 	error = usbd_do_request(usc->sc_udev, &req, NULL);
687 	/* Wait at most 1 second for firmware to boot. */
688 	if (error == 0 && usc->wait_msg_id != 0)
689 		error = tsleep(&usc->wait_msg_id, 0, "athnfw", hz);
690 	usc->wait_msg_id = 0;
691 	splx(s);
692 	return (error);
693 }
694 
695 int
696 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
697     int len)
698 {
699 	struct athn_usb_tx_data *data = &usc->tx_cmd;
700 	struct ar_htc_frame_hdr *htc;
701 	struct ar_htc_msg_hdr *msg;
702 
703 	htc = (struct ar_htc_frame_hdr *)data->buf;
704 	memset(htc, 0, sizeof(*htc));
705 	htc->endpoint_id = 0;
706 	htc->payload_len = htobe16(sizeof(*msg) + len);
707 
708 	msg = (struct ar_htc_msg_hdr *)&htc[1];
709 	msg->msg_id = htobe16(msg_id);
710 
711 	memcpy(&msg[1], buf, len);
712 
713 	usbd_setup_xfer(data->xfer, usc->tx_intr_pipe, NULL, data->buf,
714 	    sizeof(*htc) + sizeof(*msg) + len,
715 	    USBD_SHORT_XFER_OK | USBD_NO_COPY | USBD_SYNCHRONOUS,
716 	    ATHN_USB_CMD_TIMEOUT, NULL);
717 	return (usbd_transfer(data->xfer));
718 }
719 
720 int
721 athn_usb_htc_setup(struct athn_usb_softc *usc)
722 {
723 	struct ar_htc_msg_config_pipe cfg;
724 	int s, error;
725 
726 	/*
727 	 * Connect WMI services to USB pipes.
728 	 */
729 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CONTROL,
730 	    AR_PIPE_TX_INTR, AR_PIPE_RX_INTR, &usc->ep_ctrl);
731 	if (error != 0)
732 		return (error);
733 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_BEACON,
734 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_bcn);
735 	if (error != 0)
736 		return (error);
737 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CAB,
738 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_cab);
739 	if (error != 0)
740 		return (error);
741 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_UAPSD,
742 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_uapsd);
743 	if (error != 0)
744 		return (error);
745 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_MGMT,
746 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_mgmt);
747 	if (error != 0)
748 		return (error);
749 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BE,
750 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_BE]);
751 	if (error != 0)
752 		return (error);
753 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BK,
754 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_BK]);
755 	if (error != 0)
756 		return (error);
757 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VI,
758 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_VI]);
759 	if (error != 0)
760 		return (error);
761 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VO,
762 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_VO]);
763 	if (error != 0)
764 		return (error);
765 
766 	/* Set credits for WLAN Tx pipe. */
767 	memset(&cfg, 0, sizeof(cfg));
768 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
769 	cfg.credits = (usc->flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
770 	s = splusb();
771 	usc->wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
772 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
773 	if (error == 0 && usc->wait_msg_id != 0)
774 		error = tsleep(&usc->wait_msg_id, 0, "athnhtc", hz);
775 	usc->wait_msg_id = 0;
776 	splx(s);
777 	if (error != 0) {
778 		printf("%s: could not configure pipe\n",
779 		    usc->usb_dev.dv_xname);
780 		return (error);
781 	}
782 
783 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
784 	if (error != 0) {
785 		printf("%s: could not complete setup\n",
786 		    usc->usb_dev.dv_xname);
787 		return (error);
788 	}
789 	return (0);
790 }
791 
792 int
793 athn_usb_htc_connect_svc(struct athn_usb_softc *usc, uint16_t svc_id,
794     uint8_t ul_pipe, uint8_t dl_pipe, uint8_t *endpoint_id)
795 {
796 	struct ar_htc_msg_conn_svc msg;
797 	struct ar_htc_msg_conn_svc_rsp rsp;
798 	int s, error;
799 
800 	memset(&msg, 0, sizeof(msg));
801 	msg.svc_id = htobe16(svc_id);
802 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
803 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
804 	s = splusb();
805 	usc->msg_conn_svc_rsp = &rsp;
806 	usc->wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
807 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
808 	/* Wait at most 1 second for response. */
809 	if (error == 0 && usc->wait_msg_id != 0)
810 		error = tsleep(&usc->wait_msg_id, 0, "athnhtc", hz);
811 	usc->wait_msg_id = 0;
812 	splx(s);
813 	if (error != 0) {
814 		printf("%s: error waiting for service %d connection\n",
815 		    usc->usb_dev.dv_xname, svc_id);
816 		return (error);
817 	}
818 	if (rsp.status != AR_HTC_SVC_SUCCESS) {
819 		printf("%s: service %d connection failed, error %d\n",
820 		    usc->usb_dev.dv_xname, svc_id, rsp.status);
821 		return (EIO);
822 	}
823 	DPRINTF(("service %d successfully connected to endpoint %d\n",
824 	    svc_id, rsp.endpoint_id));
825 
826 	/* Return endpoint id. */
827 	*endpoint_id = rsp.endpoint_id;
828 	return (0);
829 }
830 
831 void
832 athn_usb_wmieof(struct usbd_xfer *xfer, void *priv,
833     usbd_status status)
834 {
835 	struct athn_usb_softc *usc = priv;
836 
837 	if (__predict_false(status == USBD_STALLED))
838 		usbd_clear_endpoint_stall_async(usc->tx_intr_pipe);
839 
840 	usc->wmi_done = 1;
841 	wakeup(&usc->wmi_done);
842 }
843 
844 int
845 athn_usb_wmi_xcmd(struct athn_usb_softc *usc, uint16_t cmd_id, void *ibuf,
846     int ilen, void *obuf)
847 {
848 	struct athn_usb_tx_data *data = &usc->tx_cmd;
849 	struct ar_htc_frame_hdr *htc;
850 	struct ar_wmi_cmd_hdr *wmi;
851 	int s, error;
852 
853 	htc = (struct ar_htc_frame_hdr *)data->buf;
854 	memset(htc, 0, sizeof(*htc));
855 	htc->endpoint_id = usc->ep_ctrl;
856 	htc->payload_len = htobe16(sizeof(*wmi) + ilen);
857 
858 	wmi = (struct ar_wmi_cmd_hdr *)&htc[1];
859 	wmi->cmd_id = htobe16(cmd_id);
860 	usc->wmi_seq_no++;
861 	wmi->seq_no = htobe16(usc->wmi_seq_no);
862 
863 	memcpy(&wmi[1], ibuf, ilen);
864 
865 	usbd_setup_xfer(data->xfer, usc->tx_intr_pipe, usc, data->buf,
866 	    sizeof(*htc) + sizeof(*wmi) + ilen,
867 	    USBD_SHORT_XFER_OK | USBD_NO_COPY, ATHN_USB_CMD_TIMEOUT,
868 	    athn_usb_wmieof);
869 	s = splusb();
870 	usc->wmi_done = 0;
871 	error = usbd_transfer(data->xfer);
872 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
873 		splx(s);
874 		return (error);
875 	}
876 	usc->obuf = obuf;
877 	usc->wait_cmd_id = cmd_id;
878 	/* Wait for WMI command to complete. */
879 	error = tsleep(&usc->wait_cmd_id, 0, "athnwmi", hz);
880 	usc->wait_cmd_id = 0;
881 	/* Most of the time this would have complete already. */
882 	while (__predict_false(!usc->wmi_done))
883 		tsleep(&usc->wmi_done, 0, "athnwmi", 0);
884 	splx(s);
885 	return (error);
886 }
887 
888 int
889 athn_usb_read_rom(struct athn_softc *sc)
890 {
891 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
892 	uint32_t addrs[8], vals[8], addr;
893 	uint16_t *eep;
894 	int i, j, error;
895 
896 	/* Read EEPROM by blocks of 16 bytes. */
897 	eep = sc->eep;
898 	addr = AR_EEPROM_OFFSET(sc->eep_base);
899 	for (i = 0; i < sc->eep_size / 16; i++) {
900 		for (j = 0; j < 8; j++, addr += 4)
901 			addrs[j] = htobe32(addr);
902 		error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
903 		    addrs, sizeof(addrs), vals);
904 		if (error != 0)
905 			break;
906 		for (j = 0; j < 8; j++)
907 			*eep++ = betoh32(vals[j]);
908 	}
909 	return (error);
910 }
911 
912 uint32_t
913 athn_usb_read(struct athn_softc *sc, uint32_t addr)
914 {
915 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
916 	uint32_t val;
917 	int error;
918 
919 	/* Flush pending writes for strict consistency. */
920 	athn_usb_write_barrier(sc);
921 
922 	addr = htobe32(addr);
923 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
924 	    &addr, sizeof(addr), &val);
925 	if (error != 0)
926 		return (0xdeadbeef);
927 	return (betoh32(val));
928 }
929 
930 void
931 athn_usb_write(struct athn_softc *sc, uint32_t addr, uint32_t val)
932 {
933 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
934 
935 	usc->wbuf[usc->wcount].addr = htobe32(addr);
936 	usc->wbuf[usc->wcount].val  = htobe32(val);
937 	if (++usc->wcount == AR_MAX_WRITE_COUNT)
938 		athn_usb_write_barrier(sc);
939 }
940 
941 void
942 athn_usb_write_barrier(struct athn_softc *sc)
943 {
944 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
945 
946 	if (usc->wcount == 0)
947 		return;	/* Nothing to write. */
948 
949 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_WRITE,
950 	    usc->wbuf, usc->wcount * sizeof(usc->wbuf[0]), NULL);
951 	usc->wcount = 0;	/* Always flush buffer. */
952 }
953 
954 int
955 athn_usb_media_change(struct ifnet *ifp)
956 {
957 	int error;
958 
959 	error = ieee80211_media_change(ifp);
960 	if (error != ENETRESET)
961 		return (error);
962 
963 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
964 	    (IFF_UP | IFF_RUNNING)) {
965 		athn_usb_stop(ifp);
966 		error = athn_usb_init(ifp);
967 	}
968 	return (error);
969 }
970 
971 int
972 athn_usb_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
973     int arg)
974 {
975 	struct athn_usb_softc *usc = ic->ic_softc;
976 	struct athn_usb_cmd_newstate cmd;
977 
978 	/* Do it in a process context. */
979 	cmd.state = nstate;
980 	cmd.arg = arg;
981 	athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, sizeof(cmd));
982 	return (0);
983 }
984 
985 void
986 athn_usb_newstate_cb(struct athn_usb_softc *usc, void *arg)
987 {
988 	struct athn_usb_cmd_newstate *cmd = arg;
989 	struct athn_softc *sc = &usc->sc_sc;
990 	struct ieee80211com *ic = &sc->sc_ic;
991 	enum ieee80211_state ostate;
992 	uint32_t reg, imask;
993 	uint8_t sta_index;
994 	int s, error;
995 
996 	timeout_del(&sc->calib_to);
997 
998 	s = splnet();
999 	ostate = ic->ic_state;
1000 	DPRINTF(("newstate %d -> %d\n", ostate, cmd->state));
1001 
1002 	if (ostate == IEEE80211_S_RUN) {
1003 		sta_index = ((struct athn_node *)ic->ic_bss)->sta_index;
1004 		(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1005 		    &sta_index, sizeof(sta_index), NULL);
1006 	}
1007 	switch (cmd->state) {
1008 	case IEEE80211_S_INIT:
1009 		athn_set_led(sc, 0);
1010 		break;
1011 	case IEEE80211_S_SCAN:
1012 		/* Make the LED blink while scanning. */
1013 		athn_set_led(sc, !sc->led_state);
1014 		(void)athn_usb_switch_chan(sc, ic->ic_bss->ni_chan, NULL);
1015 		timeout_add_msec(&sc->scan_to, 200);
1016 		break;
1017 	case IEEE80211_S_AUTH:
1018 		athn_set_led(sc, 0);
1019 		error = athn_usb_switch_chan(sc, ic->ic_bss->ni_chan, NULL);
1020 		break;
1021 	case IEEE80211_S_ASSOC:
1022 		break;
1023 	case IEEE80211_S_RUN:
1024 		athn_set_led(sc, 1);
1025 
1026 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
1027 			break;
1028 
1029 		/* Create node entry for our BSS. */
1030 		error = athn_usb_create_node(usc, ic->ic_bss);
1031 
1032 		athn_set_bss(sc, ic->ic_bss);
1033 		athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1034 #ifndef IEEE80211_STA_ONLY
1035 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1036 			athn_set_hostap_timers(sc);
1037 			/* Enable software beacon alert interrupts. */
1038 			imask = htobe32(AR_IMR_SWBA);
1039 		} else
1040 #endif
1041 		{
1042 			athn_set_sta_timers(sc);
1043 			/* Enable beacon miss interrupts. */
1044 			imask = htobe32(AR_IMR_BMISS);
1045 
1046 			/* Stop receiving beacons from other BSS. */
1047 			reg = AR_READ(sc, AR_RX_FILTER);
1048 			reg = (reg & ~AR_RX_FILTER_BEACON) |
1049 			    AR_RX_FILTER_MYBEACON;
1050 			AR_WRITE(sc, AR_RX_FILTER, reg);
1051 			AR_WRITE_BARRIER(sc);
1052 		}
1053 		athn_usb_wmi_xcmd(usc, AR_WMI_CMD_ENABLE_INTR,
1054 		    &imask, sizeof(imask), NULL);
1055 		break;
1056 	}
1057 	(void)sc->sc_newstate(ic, cmd->state, cmd->arg);
1058 	splx(s);
1059 }
1060 
1061 void
1062 athn_usb_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
1063     int isnew)
1064 {
1065 #ifndef IEEE80211_STA_ONLY
1066 	struct athn_usb_softc *usc = ic->ic_softc;
1067 
1068 	if (ic->ic_opmode != IEEE80211_M_HOSTAP || !isnew)
1069 		return;
1070 	/* Do it in a process context. */
1071 	ieee80211_ref_node(ni);
1072 	athn_usb_do_async(usc, athn_usb_newassoc_cb, &ni, sizeof(ni));
1073 }
1074 
1075 void
1076 athn_usb_newassoc_cb(struct athn_usb_softc *usc, void *arg)
1077 {
1078 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1079 	struct ieee80211_node *ni = *(void **)arg;
1080 	int s;
1081 
1082 	s = splnet();
1083 	/* NB: Node may have left before we got scheduled. */
1084 	if (ni->ni_associd != 0)
1085 		(void)athn_usb_create_node(usc, ni);
1086 	ieee80211_release_node(ic, ni);
1087 	splx(s);
1088 #endif
1089 }
1090 
1091 void
1092 athn_usb_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
1093 {
1094 	struct athn_usb_softc *usc = ic->ic_softc;
1095 	uint8_t sta_index;
1096 
1097 	/* Do it in a process context. */
1098 	sta_index = ((struct athn_node *)ni)->sta_index;
1099 	athn_usb_do_async(usc, athn_usb_node_leave_cb,
1100 	    &sta_index, sizeof(sta_index));
1101 }
1102 
1103 void
1104 athn_usb_node_leave_cb(struct athn_usb_softc *usc, void *arg)
1105 {
1106 	uint8_t sta_index = *(uint8_t *)arg;
1107 
1108 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1109 	    &sta_index, sizeof(sta_index), NULL);
1110 }
1111 
1112 int
1113 athn_usb_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
1114     uint8_t tid)
1115 {
1116 	struct athn_usb_softc *usc = ic->ic_softc;
1117 	struct athn_node *an = (struct athn_node *)ni;
1118 	struct athn_usb_aggr_cmd cmd;
1119 
1120 	/* Do it in a process context. */
1121 	cmd.sta_index = an->sta_index;
1122 	cmd.tid = tid;
1123 	athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, sizeof(cmd));
1124 	return (0);
1125 }
1126 
1127 void
1128 athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *usc, void *arg)
1129 {
1130 	struct athn_usb_aggr_cmd *cmd = arg;
1131 	struct ar_htc_target_aggr aggr;
1132 
1133 	memset(&aggr, 0, sizeof(aggr));
1134 	aggr.sta_index = cmd->sta_index;
1135 	aggr.tidno = cmd->tid;
1136 	aggr.aggr_enable = 1;
1137 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1138 	    &aggr, sizeof(aggr), NULL);
1139 }
1140 
1141 void
1142 athn_usb_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
1143     uint8_t tid)
1144 {
1145 	struct athn_usb_softc *usc = ic->ic_softc;
1146 	struct athn_node *an = (struct athn_node *)ni;
1147 	struct athn_usb_aggr_cmd cmd;
1148 
1149 	/* Do it in a process context. */
1150 	cmd.sta_index = an->sta_index;
1151 	cmd.tid = tid;
1152 	athn_usb_do_async(usc, athn_usb_ampdu_tx_stop_cb, &cmd, sizeof(cmd));
1153 }
1154 
1155 void
1156 athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *usc, void *arg)
1157 {
1158 	struct athn_usb_aggr_cmd *cmd = arg;
1159 	struct ar_htc_target_aggr aggr;
1160 
1161 	memset(&aggr, 0, sizeof(aggr));
1162 	aggr.sta_index = cmd->sta_index;
1163 	aggr.tidno = cmd->tid;
1164 	aggr.aggr_enable = 0;
1165 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1166 	    &aggr, sizeof(aggr), NULL);
1167 }
1168 
1169 int
1170 athn_usb_create_node(struct athn_usb_softc *usc, struct ieee80211_node *ni)
1171 {
1172 	struct athn_node *an = (struct athn_node *)ni;
1173 	struct ar_htc_target_sta sta;
1174 	struct ar_htc_target_rate rate;
1175 	int error;
1176 
1177 	an->sta_index = IEEE80211_AID(ni->ni_associd);
1178 
1179 	/* Create node entry on target. */
1180 	memset(&sta, 0, sizeof(sta));
1181 	IEEE80211_ADDR_COPY(sta.macaddr, ni->ni_macaddr);
1182 	IEEE80211_ADDR_COPY(sta.bssid, ni->ni_bssid);
1183 	sta.associd = htobe16(ni->ni_associd);
1184 	sta.valid = 1;
1185 	sta.sta_index = an->sta_index;
1186 	sta.maxampdu = 0xffff;
1187 	if (ni->ni_flags & IEEE80211_NODE_HT)
1188 		sta.flags |= htobe16(AR_HTC_STA_HT);
1189 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
1190 	    &sta, sizeof(sta), NULL);
1191 	if (error != 0)
1192 		return (error);
1193 
1194 	/* Setup supported rates. */
1195 	memset(&rate, 0, sizeof(rate));
1196 	rate.sta_index = sta.sta_index;
1197 	rate.isnew = 1;
1198 	rate.lg_rates.rs_nrates = ni->ni_rates.rs_nrates;
1199 	memcpy(rate.lg_rates.rs_rates, ni->ni_rates.rs_rates,
1200 	    ni->ni_rates.rs_nrates);
1201 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1202 		rate.capflags |= htobe32(AR_RC_HT_FLAG);
1203 #ifdef notyet
1204 		/* XXX setup HT rates */
1205 		if (ni->ni_htcaps & IEEE80211_HTCAP_CBW20_40)
1206 			rate.capflags |= htobe32(AR_RC_40_FLAG);
1207 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI40)
1208 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1209 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI20)
1210 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1211 #endif
1212 	}
1213 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_RC_RATE_UPDATE,
1214 	    &rate, sizeof(rate), NULL);
1215 	return (error);
1216 }
1217 
1218 void
1219 athn_usb_rx_enable(struct athn_softc *sc)
1220 {
1221 	AR_WRITE(sc, AR_CR, AR_CR_RXE);
1222 	AR_WRITE_BARRIER(sc);
1223 }
1224 
1225 int
1226 athn_usb_switch_chan(struct athn_softc *sc, struct ieee80211_channel *c,
1227     struct ieee80211_channel *extc)
1228 {
1229 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
1230 	uint16_t mode;
1231 	int error;
1232 
1233 	/* Disable interrupts. */
1234 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1235 	if (error != 0)
1236 		goto reset;
1237 	/* Stop all Tx queues. */
1238 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
1239 	if (error != 0)
1240 		goto reset;
1241 	/* Stop Rx. */
1242 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
1243 	if (error != 0)
1244 		goto reset;
1245 
1246 	/* If band or bandwidth changes, we need to do a full reset. */
1247 	if (c->ic_flags != sc->curchan->ic_flags ||
1248 	    ((extc != NULL) ^ (sc->curchanext != NULL))) {
1249 		DPRINTFN(2, ("channel band switch\n"));
1250 		goto reset;
1251 	}
1252 
1253 	error = athn_set_chan(sc, c, extc);
1254 	if (AR_SREV_9271(sc) && error == 0)
1255 		ar9271_load_ani(sc);
1256 	if (error != 0) {
1257  reset:		/* Error found, try a full reset. */
1258 		DPRINTFN(3, ("needs a full reset\n"));
1259 		error = athn_hw_reset(sc, c, extc, 0);
1260 		if (error != 0)	/* Hopeless case. */
1261 			return (error);
1262 	}
1263 
1264 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
1265 	if (error != 0)
1266 		return (error);
1267 	athn_rx_start(sc);
1268 
1269 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(c) ?
1270 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
1271 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
1272 	    &mode, sizeof(mode), NULL);
1273 	if (error != 0)
1274 		return (error);
1275 
1276 	/* Re-enable interrupts. */
1277 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ENABLE_INTR);
1278 	return (error);
1279 }
1280 
1281 void
1282 athn_usb_updateedca(struct ieee80211com *ic)
1283 {
1284 	struct athn_usb_softc *usc = ic->ic_softc;
1285 
1286 	/* Do it in a process context. */
1287 	athn_usb_do_async(usc, athn_usb_updateedca_cb, NULL, 0);
1288 }
1289 
1290 void
1291 athn_usb_updateedca_cb(struct athn_usb_softc *usc, void *arg)
1292 {
1293 	int s;
1294 
1295 	s = splnet();
1296 	athn_updateedca(&usc->sc_sc.sc_ic);
1297 	splx(s);
1298 }
1299 
1300 void
1301 athn_usb_updateslot(struct ieee80211com *ic)
1302 {
1303 	struct athn_usb_softc *usc = ic->ic_softc;
1304 
1305 	return;	/* XXX */
1306 	/* Do it in a process context. */
1307 	athn_usb_do_async(usc, athn_usb_updateslot_cb, NULL, 0);
1308 }
1309 
1310 void
1311 athn_usb_updateslot_cb(struct athn_usb_softc *usc, void *arg)
1312 {
1313 	int s;
1314 
1315 	s = splnet();
1316 	athn_updateslot(&usc->sc_sc.sc_ic);
1317 	splx(s);
1318 }
1319 
1320 int
1321 athn_usb_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1322     struct ieee80211_key *k)
1323 {
1324 	struct athn_usb_softc *usc = ic->ic_softc;
1325 	struct athn_usb_cmd_key cmd;
1326 
1327 	/* Defer setting of WEP keys until interface is brought up. */
1328 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
1329 	    (IFF_UP | IFF_RUNNING))
1330 		return (0);
1331 
1332 	/* Do it in a process context. */
1333 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1334 	cmd.key = k;
1335 	athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, sizeof(cmd));
1336 	return (0);
1337 }
1338 
1339 void
1340 athn_usb_set_key_cb(struct athn_usb_softc *usc, void *arg)
1341 {
1342 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1343 	struct athn_usb_cmd_key *cmd = arg;
1344 	int s;
1345 
1346 	s = splnet();
1347 	athn_set_key(ic, cmd->ni, cmd->key);
1348 	if (cmd->ni != NULL)
1349 		ieee80211_release_node(ic, cmd->ni);
1350 	splx(s);
1351 }
1352 
1353 void
1354 athn_usb_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1355     struct ieee80211_key *k)
1356 {
1357 	struct athn_usb_softc *usc = ic->ic_softc;
1358 	struct athn_usb_cmd_key cmd;
1359 
1360 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
1361 	    ic->ic_state != IEEE80211_S_RUN)
1362 		return;	/* Nothing to do. */
1363 
1364 	/* Do it in a process context. */
1365 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1366 	cmd.key = k;
1367 	athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, sizeof(cmd));
1368 }
1369 
1370 void
1371 athn_usb_delete_key_cb(struct athn_usb_softc *usc, void *arg)
1372 {
1373 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1374 	struct athn_usb_cmd_key *cmd = arg;
1375 	int s;
1376 
1377 	s = splnet();
1378 	athn_delete_key(ic, cmd->ni, cmd->key);
1379 	if (cmd->ni != NULL)
1380 		ieee80211_release_node(ic, cmd->ni);
1381 	splx(s);
1382 }
1383 
1384 #ifndef IEEE80211_STA_ONLY
1385 void
1386 athn_usb_bcneof(struct usbd_xfer *xfer, void *priv,
1387     usbd_status status)
1388 {
1389 	struct athn_usb_tx_data *data = priv;
1390 	struct athn_usb_softc *usc = data->sc;
1391 
1392 	if (__predict_false(status == USBD_STALLED))
1393 		usbd_clear_endpoint_stall_async(usc->tx_data_pipe);
1394 	usc->tx_bcn = data;
1395 }
1396 
1397 /*
1398  * Process Software Beacon Alert interrupts.
1399  */
1400 void
1401 athn_usb_swba(struct athn_usb_softc *usc)
1402 {
1403 	struct athn_softc *sc = &usc->sc_sc;
1404 	struct ieee80211com *ic = &sc->sc_ic;
1405 	struct athn_usb_tx_data *data;
1406 	struct ieee80211_frame *wh;
1407 	struct ar_stream_hdr *hdr;
1408 	struct ar_htc_frame_hdr *htc;
1409 	struct ar_tx_bcn *bcn;
1410 	struct mbuf *m;
1411 	int error;
1412 
1413 	if (ic->ic_dtim_count == 0)
1414 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1415 	else
1416 		ic->ic_dtim_count--;
1417 
1418 	/* Make sure previous beacon has been sent. */
1419 	if (usc->tx_bcn == NULL)
1420 		return;
1421 	data = usc->tx_bcn;
1422 
1423 	/* Get new beacon. */
1424 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1425 	if (__predict_false(m == NULL))
1426 		return;
1427 	/* Assign sequence number. */
1428 	wh = mtod(m, struct ieee80211_frame *);
1429 	*(uint16_t *)&wh->i_seq[0] =
1430 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1431 	ic->ic_bss->ni_txseq++;
1432 
1433 	hdr = (struct ar_stream_hdr *)data->buf;
1434 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1435 	hdr->len = htole16(sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len);
1436 
1437 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1438 	memset(htc, 0, sizeof(*htc));
1439 	htc->endpoint_id = usc->ep_bcn;
1440 	htc->payload_len = htobe16(sizeof(*bcn) + m->m_pkthdr.len);
1441 
1442 	bcn = (struct ar_tx_bcn *)&htc[1];
1443 	memset(bcn, 0, sizeof(*bcn));
1444 	bcn->vif_idx = 0;
1445 
1446 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&bcn[1]);
1447 
1448 	usbd_setup_xfer(data->xfer, usc->tx_data_pipe, data, data->buf,
1449 	    sizeof(*hdr) + sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len,
1450 	    USBD_SHORT_XFER_OK | USBD_NO_COPY, ATHN_USB_TX_TIMEOUT,
1451 	    athn_usb_bcneof);
1452 
1453 	m_freem(m);
1454 	usc->tx_bcn = NULL;
1455 	error = usbd_transfer(data->xfer);
1456 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
1457 		usc->tx_bcn = data;
1458 }
1459 #endif
1460 
1461 void
1462 athn_usb_rx_wmi_ctrl(struct athn_usb_softc *usc, uint8_t *buf, int len)
1463 {
1464 	struct ar_wmi_cmd_hdr *wmi;
1465 	struct ar_wmi_evt_txrate *txrate;
1466 	uint16_t cmd_id;
1467 
1468 	if (__predict_false(len < sizeof(*wmi)))
1469 		return;
1470 	wmi = (struct ar_wmi_cmd_hdr *)buf;
1471 	cmd_id = betoh16(wmi->cmd_id);
1472 
1473 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
1474 		if (usc->wait_cmd_id != cmd_id)
1475 			return;	/* Unexpected reply. */
1476 		if (usc->obuf != NULL) {
1477 			/* Copy answer into caller supplied buffer. */
1478 			memcpy(usc->obuf, &wmi[1], len - sizeof(*wmi));
1479 		}
1480 		/* Notify caller of completion. */
1481 		usc->wait_cmd_id = 0;
1482 		wakeup(&usc->wait_cmd_id);
1483 		return;
1484 	}
1485 	switch (cmd_id & 0xfff) {
1486 #ifndef IEEE80211_STA_ONLY
1487 	case AR_WMI_EVT_SWBA:
1488 		athn_usb_swba(usc);
1489 		break;
1490 #endif
1491 	case AR_WMI_EVT_TXRATE:
1492 		txrate = (struct ar_wmi_evt_txrate *)&wmi[1];
1493 		DPRINTF(("txrate=%d\n", betoh32(txrate->txrate)));
1494 		break;
1495 	case AR_WMI_EVT_FATAL:
1496 		printf("%s: fatal firmware error\n", usc->usb_dev.dv_xname);
1497 		break;
1498 	default:
1499 		DPRINTF(("WMI event %d ignored\n", cmd_id));
1500 		break;
1501 	}
1502 }
1503 
1504 void
1505 athn_usb_intr(struct usbd_xfer *xfer, void *priv,
1506     usbd_status status)
1507 {
1508 	struct athn_usb_softc *usc = priv;
1509 	struct ar_htc_frame_hdr *htc;
1510 	struct ar_htc_msg_hdr *msg;
1511 	uint8_t *buf = usc->ibuf;
1512 	uint16_t msg_id;
1513 	int len;
1514 
1515 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1516 		DPRINTF(("intr status=%d\n", status));
1517 		if (status == USBD_STALLED)
1518 			usbd_clear_endpoint_stall_async(usc->rx_intr_pipe);
1519 		return;
1520 	}
1521 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1522 
1523 	/* Skip watchdog pattern if present. */
1524 	if (len >= 4 && *(uint32_t *)buf == htobe32(0x00c60000)) {
1525 		buf += 4;
1526 		len -= 4;
1527 	}
1528 	if (__predict_false(len < sizeof(*htc)))
1529 		return;
1530 	htc = (struct ar_htc_frame_hdr *)buf;
1531 	/* Skip HTC header. */
1532 	buf += sizeof(*htc);
1533 	len -= sizeof(*htc);
1534 
1535 	if (htc->endpoint_id != 0) {
1536 		if (__predict_false(htc->endpoint_id != usc->ep_ctrl))
1537 			return;
1538 		/* Remove trailer if present. */
1539 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
1540 			if (__predict_false(len < htc->control[0]))
1541 				return;
1542 			len -= htc->control[0];
1543 		}
1544 		athn_usb_rx_wmi_ctrl(usc, buf, len);
1545 		return;
1546 	}
1547 	/* Endpoint 0 carries HTC messages. */
1548 	if (__predict_false(len < sizeof(*msg)))
1549 		return;
1550 	msg = (struct ar_htc_msg_hdr *)buf;
1551 	msg_id = betoh16(msg->msg_id);
1552 	DPRINTF(("Rx HTC message %d\n", msg_id));
1553 	switch (msg_id) {
1554 	case AR_HTC_MSG_READY:
1555 		if (usc->wait_msg_id != msg_id)
1556 			break;
1557 		usc->wait_msg_id = 0;
1558 		wakeup(&usc->wait_msg_id);
1559 		break;
1560 	case AR_HTC_MSG_CONN_SVC_RSP:
1561 		if (usc->wait_msg_id != msg_id)
1562 			break;
1563 		if (usc->msg_conn_svc_rsp != NULL) {
1564 			memcpy(usc->msg_conn_svc_rsp, &msg[1],
1565 			    sizeof(struct ar_htc_msg_conn_svc_rsp));
1566 		}
1567 		usc->wait_msg_id = 0;
1568 		wakeup(&usc->wait_msg_id);
1569 		break;
1570 	case AR_HTC_MSG_CONF_PIPE_RSP:
1571 		if (usc->wait_msg_id != msg_id)
1572 			break;
1573 		usc->wait_msg_id = 0;
1574 		wakeup(&usc->wait_msg_id);
1575 		break;
1576 	default:
1577 		DPRINTF(("HTC message %d ignored\n", msg_id));
1578 		break;
1579 	}
1580 }
1581 
1582 #if NBPFILTER > 0
1583 void
1584 athn_usb_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
1585     struct ar_rx_status *rs)
1586 {
1587 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
1588 
1589 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
1590 	struct ieee80211com *ic = &sc->sc_ic;
1591 	struct mbuf mb;
1592 	uint8_t rate;
1593 
1594 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1595 	tap->wr_tsft = htole64(betoh64(rs->rs_tstamp));
1596 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1597 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1598 	tap->wr_dbm_antsignal = rs->rs_rssi;
1599 	/* XXX noise. */
1600 	tap->wr_antenna = rs->rs_antenna;
1601 	tap->wr_rate = 0;	/* In case it can't be found below. */
1602 	rate = rs->rs_rate;
1603 	if (rate & 0x80) {		/* HT. */
1604 		/* Bit 7 set means HT MCS instead of rate. */
1605 		tap->wr_rate = rate;
1606 		if (!(rs->rs_flags & AR_RXS_FLAG_GI))
1607 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
1608 
1609 	} else if (rate & 0x10) {	/* CCK. */
1610 		if (rate & 0x04)
1611 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1612 		switch (rate & ~0x14) {
1613 		case 0xb: tap->wr_rate =   2; break;
1614 		case 0xa: tap->wr_rate =   4; break;
1615 		case 0x9: tap->wr_rate =  11; break;
1616 		case 0x8: tap->wr_rate =  22; break;
1617 		}
1618 	} else {			/* OFDM. */
1619 		switch (rate) {
1620 		case 0xb: tap->wr_rate =  12; break;
1621 		case 0xf: tap->wr_rate =  18; break;
1622 		case 0xa: tap->wr_rate =  24; break;
1623 		case 0xe: tap->wr_rate =  36; break;
1624 		case 0x9: tap->wr_rate =  48; break;
1625 		case 0xd: tap->wr_rate =  72; break;
1626 		case 0x8: tap->wr_rate =  96; break;
1627 		case 0xc: tap->wr_rate = 108; break;
1628 		}
1629 	}
1630 	mb.m_data = (caddr_t)tap;
1631 	mb.m_len = sc->sc_rxtap_len;
1632 	mb.m_next = m;
1633 	mb.m_nextpkt = NULL;
1634 	mb.m_type = 0;
1635 	mb.m_flags = 0;
1636 	bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1637 }
1638 #endif
1639 
1640 void
1641 athn_usb_rx_frame(struct athn_usb_softc *usc, struct mbuf *m)
1642 {
1643 	struct athn_softc *sc = &usc->sc_sc;
1644 	struct ieee80211com *ic = &sc->sc_ic;
1645 	struct ifnet *ifp = &ic->ic_if;
1646 	struct ieee80211_frame *wh;
1647 	struct ieee80211_node *ni;
1648 	struct ieee80211_rxinfo rxi;
1649 	struct ar_htc_frame_hdr *htc;
1650 	struct ar_rx_status *rs;
1651 	uint16_t datalen;
1652 	int s;
1653 
1654 	if (__predict_false(m->m_len < sizeof(*htc)))
1655 		goto skip;
1656 	htc = mtod(m, struct ar_htc_frame_hdr *);
1657 	if (__predict_false(htc->endpoint_id == 0)) {
1658 		DPRINTF(("bad endpoint %d\n", htc->endpoint_id));
1659 		goto skip;
1660 	}
1661 	if (htc->flags & AR_HTC_FLAG_TRAILER) {
1662 		if (m->m_len < htc->control[0])
1663 			goto skip;
1664 		m_adj(m, -(int)htc->control[0]);
1665 	}
1666 	m_adj(m, sizeof(*htc));	/* Strip HTC header. */
1667 
1668 	if (__predict_false(m->m_len < sizeof(*rs)))
1669 		goto skip;
1670 	rs = mtod(m, struct ar_rx_status *);
1671 
1672 	/* Make sure that payload fits. */
1673 	datalen = betoh16(rs->rs_datalen);
1674 	if (__predict_false(m->m_len < sizeof(*rs) + datalen))
1675 		goto skip;
1676 
1677 	if (__predict_false(datalen < sizeof(*wh) + IEEE80211_CRC_LEN))
1678 		goto skip;
1679 
1680 	m_adj(m, sizeof(*rs));	/* Strip Rx status. */
1681 	m->m_pkthdr.rcvif = ifp;
1682 
1683 	s = splnet();
1684 
1685 	/* Grab a reference to the source node. */
1686 	wh = mtod(m, struct ieee80211_frame *);
1687 	ni = ieee80211_find_rxnode(ic, wh);
1688 
1689 	/* Remove any HW padding after the 802.11 header. */
1690 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1691 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1692 		if (hdrlen & 3) {
1693 			memmove((caddr_t)wh + 2, wh, hdrlen);
1694 			m_adj(m, 2);
1695 		}
1696 	}
1697 #if NBPFILTER > 0
1698 	if (__predict_false(sc->sc_drvbpf != NULL))
1699 		athn_usb_rx_radiotap(sc, m, rs);
1700 #endif
1701 	/* Trim 802.11 FCS after radiotap. */
1702 	m_adj(m, -IEEE80211_CRC_LEN);
1703 
1704 	/* Send the frame to the 802.11 layer. */
1705 	rxi.rxi_flags = 0;
1706 	rxi.rxi_rssi = rs->rs_rssi + AR_USB_DEFAULT_NF;
1707 	rxi.rxi_tstamp = betoh64(rs->rs_tstamp);
1708 	ieee80211_input(ifp, m, ni, &rxi);
1709 
1710 	/* Node is no longer needed. */
1711 	ieee80211_release_node(ic, ni);
1712 	splx(s);
1713 	return;
1714  skip:
1715 	m_freem(m);
1716 }
1717 
1718 void
1719 athn_usb_rxeof(struct usbd_xfer *xfer, void *priv,
1720     usbd_status status)
1721 {
1722 	struct athn_usb_rx_data *data = priv;
1723 	struct athn_usb_softc *usc = data->sc;
1724 	struct athn_usb_rx_stream *stream = &usc->rx_stream;
1725 	uint8_t *buf = data->buf;
1726 	struct ar_stream_hdr *hdr;
1727 	struct mbuf *m;
1728 	uint16_t pktlen;
1729 	int off, len;
1730 
1731 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1732 		DPRINTF(("RX status=%d\n", status));
1733 		if (status == USBD_STALLED)
1734 			usbd_clear_endpoint_stall_async(usc->rx_data_pipe);
1735 		if (status != USBD_CANCELLED)
1736 			goto resubmit;
1737 		return;
1738 	}
1739 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1740 
1741 	if (stream->left > 0) {
1742 		if (len >= stream->left) {
1743 			/* We have all our pktlen bytes now. */
1744 			if (__predict_true(stream->m != NULL)) {
1745 				memcpy(mtod(stream->m, uint8_t *) +
1746 				    stream->moff, buf, stream->left);
1747 				athn_usb_rx_frame(usc, stream->m);
1748 				stream->m = NULL;
1749 			}
1750 			/* Next header is 32-bit aligned. */
1751 			off = (stream->left + 3) & ~3;
1752 			buf += off;
1753 			len -= off;
1754 			stream->left = 0;
1755 		} else {
1756 			/* Still need more bytes, save what we have. */
1757 			if (__predict_true(stream->m != NULL)) {
1758 				memcpy(mtod(stream->m, uint8_t *) +
1759 				    stream->moff, buf, len);
1760 				stream->moff += len;
1761 			}
1762 			stream->left -= len;
1763 			goto resubmit;
1764 		}
1765 	}
1766 	KASSERT(stream->left == 0);
1767 	while (len >= sizeof(*hdr)) {
1768 		hdr = (struct ar_stream_hdr *)buf;
1769 		if (hdr->tag != htole16(AR_USB_RX_STREAM_TAG)) {
1770 			DPRINTF(("invalid tag 0x%x\n", hdr->tag));
1771 			break;
1772 		}
1773 		pktlen = letoh16(hdr->len);
1774 		buf += sizeof(*hdr);
1775 		len -= sizeof(*hdr);
1776 
1777 		if (__predict_true(pktlen <= MCLBYTES)) {
1778 			/* Allocate an mbuf to store the next pktlen bytes. */
1779 			MGETHDR(m, M_DONTWAIT, MT_DATA);
1780 			if (__predict_true(m != NULL)) {
1781 				m->m_pkthdr.len = m->m_len = pktlen;
1782 				if (pktlen > MHLEN) {
1783 					MCLGET(m, M_DONTWAIT);
1784 					if (!(m->m_flags & M_EXT)) {
1785 						m_free(m);
1786 						m = NULL;
1787 					}
1788 				}
1789 			}
1790 		} else	/* Drop frames larger than MCLBYTES. */
1791 			m = NULL;
1792 		/*
1793 		 * NB: m can be NULL, in which case the next pktlen bytes
1794 		 * will be discarded from the Rx stream.
1795 		 */
1796 		if (pktlen > len) {
1797 			/* Need more bytes, save what we have. */
1798 			stream->m = m;	/* NB: m can be NULL. */
1799 			if (__predict_true(stream->m != NULL)) {
1800 				memcpy(mtod(stream->m, uint8_t *), buf, len);
1801 				stream->moff = len;
1802 			}
1803 			stream->left = pktlen - len;
1804 			goto resubmit;
1805 		}
1806 		if (__predict_true(m != NULL)) {
1807 			/* We have all the pktlen bytes in this xfer. */
1808 			memcpy(mtod(m, uint8_t *), buf, pktlen);
1809 			athn_usb_rx_frame(usc, m);
1810 		}
1811 
1812 		/* Next header is 32-bit aligned. */
1813 		off = (pktlen + 3) & ~3;
1814 		buf += off;
1815 		len -= off;
1816 	}
1817 
1818  resubmit:
1819 	/* Setup a new transfer. */
1820 	usbd_setup_xfer(xfer, usc->rx_data_pipe, data, data->buf,
1821 	    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
1822 	    USBD_NO_TIMEOUT, athn_usb_rxeof);
1823 	(void)usbd_transfer(xfer);
1824 }
1825 
1826 void
1827 athn_usb_txeof(struct usbd_xfer *xfer, void *priv,
1828     usbd_status status)
1829 {
1830 	struct athn_usb_tx_data *data = priv;
1831 	struct athn_usb_softc *usc = data->sc;
1832 	struct athn_softc *sc = &usc->sc_sc;
1833 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1834 	int s;
1835 
1836 	s = splnet();
1837 	/* Put this Tx buffer back to our free list. */
1838 	TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
1839 
1840 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1841 		DPRINTF(("TX status=%d\n", status));
1842 		if (status == USBD_STALLED)
1843 			usbd_clear_endpoint_stall_async(usc->tx_data_pipe);
1844 		ifp->if_oerrors++;
1845 		splx(s);
1846 		/* XXX Why return? */
1847 		return;
1848 	}
1849 	sc->sc_tx_timer = 0;
1850 	ifp->if_opackets++;
1851 
1852 	/* We just released a Tx buffer, notify Tx. */
1853 	if (ifp->if_flags & IFF_OACTIVE) {
1854 		ifp->if_flags &= ~IFF_OACTIVE;
1855 		ifp->if_start(ifp);
1856 	}
1857 	splx(s);
1858 }
1859 
1860 int
1861 athn_usb_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1862 {
1863 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
1864 	struct athn_node *an = (struct athn_node *)ni;
1865 	struct ieee80211com *ic = &sc->sc_ic;
1866 	struct ieee80211_frame *wh;
1867 	struct ieee80211_key *k = NULL;
1868 	struct athn_usb_tx_data *data;
1869 	struct ar_stream_hdr *hdr;
1870 	struct ar_htc_frame_hdr *htc;
1871 	struct ar_tx_frame *txf;
1872 	struct ar_tx_mgmt *txm;
1873 	uint8_t *frm;
1874 	uint16_t qos;
1875 	uint8_t sta_index, qid, tid = 0;
1876 	int hasqos, xferlen, error;
1877 
1878 	wh = mtod(m, struct ieee80211_frame *);
1879 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1880 		k = ieee80211_get_txkey(ic, wh, ni);
1881 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1882 			return (ENOBUFS);
1883 		wh = mtod(m, struct ieee80211_frame *);
1884 	}
1885 	if ((hasqos = ieee80211_has_qos(wh))) {
1886 		qos = ieee80211_get_qos(wh);
1887 		tid = qos & IEEE80211_QOS_TID;
1888 		qid = ieee80211_up_to_ac(ic, tid);
1889 	} else
1890 		qid = EDCA_AC_BE;
1891 
1892 	/* Grab a Tx buffer from our free list. */
1893 	data = TAILQ_FIRST(&usc->tx_free_list);
1894 	TAILQ_REMOVE(&usc->tx_free_list, data, next);
1895 
1896 #if NBPFILTER > 0
1897 	/* XXX Change radiotap Tx header for USB (no txrate). */
1898 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1899 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1900 		struct mbuf mb;
1901 
1902 		tap->wt_flags = 0;
1903 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1904 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1905 		mb.m_data = (caddr_t)tap;
1906 		mb.m_len = sc->sc_txtap_len;
1907 		mb.m_next = m;
1908 		mb.m_nextpkt = NULL;
1909 		mb.m_type = 0;
1910 		mb.m_flags = 0;
1911 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1912 	}
1913 #endif
1914 	sta_index = an->sta_index;
1915 
1916 	/* NB: We don't take advantage of USB Tx stream mode for now. */
1917 	hdr = (struct ar_stream_hdr *)data->buf;
1918 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1919 
1920 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1921 	memset(htc, 0, sizeof(*htc));
1922 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1923 	    IEEE80211_FC0_TYPE_DATA) {
1924 		htc->endpoint_id = usc->ep_data[qid];
1925 
1926 		txf = (struct ar_tx_frame *)&htc[1];
1927 		memset(txf, 0, sizeof(*txf));
1928 		txf->data_type = AR_HTC_NORMAL;
1929 		txf->node_idx = sta_index;
1930 		txf->vif_idx = 0;
1931 		txf->tid = tid;
1932 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
1933 			txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
1934 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
1935 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1936 				txf->flags |= htobe32(AR_HTC_TX_CTSONLY);
1937 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1938 				txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
1939 		}
1940 		txf->key_idx = 0xff;
1941 		frm = (uint8_t *)&txf[1];
1942 	} else {
1943 		htc->endpoint_id = usc->ep_mgmt;
1944 
1945 		txm = (struct ar_tx_mgmt *)&htc[1];
1946 		memset(txm, 0, sizeof(*txm));
1947 		txm->node_idx = sta_index;
1948 		txm->vif_idx = 0;
1949 		txm->key_idx = 0xff;
1950 		frm = (uint8_t *)&txm[1];
1951 	}
1952 	/* Copy payload. */
1953 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)frm);
1954 	frm += m->m_pkthdr.len;
1955 	m_freem(m);
1956 
1957 	/* Finalize headers. */
1958 	htc->payload_len = htobe16(frm - (uint8_t *)&htc[1]);
1959 	hdr->len = htole16(frm - (uint8_t *)&hdr[1]);
1960 	xferlen = frm - data->buf;
1961 
1962 	usbd_setup_xfer(data->xfer, usc->tx_data_pipe, data, data->buf,
1963 	    xferlen, USBD_FORCE_SHORT_XFER | USBD_NO_COPY, ATHN_USB_TX_TIMEOUT,
1964 	    athn_usb_txeof);
1965 	error = usbd_transfer(data->xfer);
1966 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
1967 		/* Put this Tx buffer back to our free list. */
1968 		TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
1969 		return (error);
1970 	}
1971 	ieee80211_release_node(ic, ni);
1972 	return (0);
1973 }
1974 
1975 void
1976 athn_usb_start(struct ifnet *ifp)
1977 {
1978 	struct athn_softc *sc = ifp->if_softc;
1979 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
1980 	struct ieee80211com *ic = &sc->sc_ic;
1981 	struct ieee80211_node *ni;
1982 	struct mbuf *m;
1983 
1984 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1985 		return;
1986 
1987 	for (;;) {
1988 		if (TAILQ_EMPTY(&usc->tx_free_list)) {
1989 			ifp->if_flags |= IFF_OACTIVE;
1990 			break;
1991 		}
1992 		/* Send pending management frames first. */
1993 		IF_DEQUEUE(&ic->ic_mgtq, m);
1994 		if (m != NULL) {
1995 			ni = m->m_pkthdr.ph_cookie;
1996 			goto sendit;
1997 		}
1998 		if (ic->ic_state != IEEE80211_S_RUN)
1999 			break;
2000 
2001 		/* Encapsulate and send data frames. */
2002 		IFQ_DEQUEUE(&ifp->if_snd, m);
2003 		if (m == NULL)
2004 			break;
2005 #if NBPFILTER > 0
2006 		if (ifp->if_bpf != NULL)
2007 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
2008 #endif
2009 		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
2010 			continue;
2011  sendit:
2012 #if NBPFILTER > 0
2013 		if (ic->ic_rawbpf != NULL)
2014 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
2015 #endif
2016 		if (athn_usb_tx(sc, m, ni) != 0) {
2017 			ieee80211_release_node(ic, ni);
2018 			ifp->if_oerrors++;
2019 			continue;
2020 		}
2021 
2022 		sc->sc_tx_timer = 5;
2023 		ifp->if_timer = 1;
2024 	}
2025 }
2026 
2027 void
2028 athn_usb_watchdog(struct ifnet *ifp)
2029 {
2030 	struct athn_softc *sc = ifp->if_softc;
2031 
2032 	ifp->if_timer = 0;
2033 
2034 	if (sc->sc_tx_timer > 0) {
2035 		if (--sc->sc_tx_timer == 0) {
2036 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2037 			/* athn_usb_init(ifp); XXX needs a process context! */
2038 			ifp->if_oerrors++;
2039 			return;
2040 		}
2041 		ifp->if_timer = 1;
2042 	}
2043 	ieee80211_watchdog(ifp);
2044 }
2045 
2046 int
2047 athn_usb_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2048 {
2049 	struct athn_softc *sc = ifp->if_softc;
2050 	struct ieee80211com *ic = &sc->sc_ic;
2051 	struct ifaddr *ifa;
2052 	struct ifreq *ifr;
2053 	int s, error = 0;
2054 
2055 	s = splnet();
2056 
2057 	switch (cmd) {
2058 	case SIOCSIFADDR:
2059 		ifa = (struct ifaddr *)data;
2060 		ifp->if_flags |= IFF_UP;
2061 #ifdef INET
2062 		if (ifa->ifa_addr->sa_family == AF_INET)
2063 			arp_ifinit(&ic->ic_ac, ifa);
2064 #endif
2065 		/* FALLTHROUGH */
2066 	case SIOCSIFFLAGS:
2067 		if (ifp->if_flags & IFF_UP) {
2068 			if (!(ifp->if_flags & IFF_RUNNING))
2069 				error = athn_usb_init(ifp);
2070 		} else {
2071 			if (ifp->if_flags & IFF_RUNNING)
2072 				athn_usb_stop(ifp);
2073 		}
2074 		break;
2075 	case SIOCADDMULTI:
2076 	case SIOCDELMULTI:
2077 		ifr = (struct ifreq *)data;
2078 		error = (cmd == SIOCADDMULTI) ?
2079 		    ether_addmulti(ifr, &ic->ic_ac) :
2080 		    ether_delmulti(ifr, &ic->ic_ac);
2081 		if (error == ENETRESET)
2082 			error = 0;
2083 		break;
2084 	case SIOCS80211CHANNEL:
2085 		error = ieee80211_ioctl(ifp, cmd, data);
2086 		if (error == ENETRESET &&
2087 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2088 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2089 			    (IFF_UP | IFF_RUNNING)) {
2090 				athn_usb_switch_chan(sc, ic->ic_ibss_chan,
2091 				    NULL);
2092 			}
2093 			error = 0;
2094 		}
2095 		break;
2096 	default:
2097 		error = ieee80211_ioctl(ifp, cmd, data);
2098 	}
2099 
2100 	if (error == ENETRESET) {
2101 		error = 0;
2102 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2103 		    (IFF_UP | IFF_RUNNING)) {
2104 			athn_usb_stop(ifp);
2105 			error = athn_usb_init(ifp);
2106 		}
2107 	}
2108 	splx(s);
2109 	return (error);
2110 }
2111 
2112 int
2113 athn_usb_init(struct ifnet *ifp)
2114 {
2115 	struct athn_softc *sc = ifp->if_softc;
2116 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2117 	struct athn_ops *ops = &sc->ops;
2118 	struct ieee80211com *ic = &sc->sc_ic;
2119 	struct ieee80211_channel *c, *extc;
2120 	struct athn_usb_rx_data *data;
2121 	struct ar_htc_target_vif hvif;
2122 	struct ar_htc_target_sta sta;
2123 	struct ar_htc_cap_target hic;
2124 	uint16_t mode;
2125 	int i, error;
2126 
2127 	/* Init host async commands ring. */
2128 	usc->cmdq.cur = usc->cmdq.next = usc->cmdq.queued = 0;
2129 
2130 	/* Allocate Tx/Rx buffers. */
2131 	error = athn_usb_alloc_rx_list(usc);
2132 	if (error != 0)
2133 		goto fail;
2134 	error = athn_usb_alloc_tx_list(usc);
2135 	if (error != 0)
2136 		goto fail;
2137 	/* Steal one buffer for beacons. */
2138 	usc->tx_bcn = TAILQ_FIRST(&usc->tx_free_list);
2139 	TAILQ_REMOVE(&usc->tx_free_list, usc->tx_bcn, next);
2140 
2141 	c = ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2142 	extc = NULL;
2143 
2144 	/* In case a new MAC address has been configured. */
2145 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2146 
2147 	error = athn_set_power_awake(sc);
2148 	if (error != 0)
2149 		goto fail;
2150 
2151 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_FLUSH_RECV);
2152 	if (error != 0)
2153 		goto fail;
2154 
2155 	error = athn_hw_reset(sc, c, extc, 1);
2156 	if (error != 0)
2157 		goto fail;
2158 
2159 	ops->set_txpower(sc, c, extc);
2160 
2161 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(c) ?
2162 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
2163 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
2164 	    &mode, sizeof(mode), NULL);
2165 	if (error != 0)
2166 		goto fail;
2167 
2168 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ATH_INIT);
2169 	if (error != 0)
2170 		goto fail;
2171 
2172 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
2173 	if (error != 0)
2174 		goto fail;
2175 
2176 	athn_rx_start(sc);
2177 
2178 	/* Create main interface on target. */
2179 	memset(&hvif, 0, sizeof(hvif));
2180 	hvif.index = 0;
2181 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2182 	switch (ic->ic_opmode) {
2183 	case IEEE80211_M_STA:
2184 		hvif.opmode = htobe32(AR_HTC_M_STA);
2185 		break;
2186 	case IEEE80211_M_MONITOR:
2187 		hvif.opmode = htobe32(AR_HTC_M_MONITOR);
2188 		break;
2189 #ifndef IEEE80211_STA_ONLY
2190 	case IEEE80211_M_IBSS:
2191 		hvif.opmode = htobe32(AR_HTC_M_IBSS);
2192 		break;
2193 	case IEEE80211_M_AHDEMO:
2194 		hvif.opmode = htobe32(AR_HTC_M_AHDEMO);
2195 		break;
2196 	case IEEE80211_M_HOSTAP:
2197 		hvif.opmode = htobe32(AR_HTC_M_HOSTAP);
2198 		break;
2199 #endif
2200 	}
2201 	hvif.rtsthreshold = htobe16(ic->ic_rtsthreshold);
2202 	DPRINTF(("creating VAP\n"));
2203 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_CREATE,
2204 	    &hvif, sizeof(hvif), NULL);
2205 	if (error != 0)
2206 		goto fail;
2207 
2208 	/* Create a fake node to send management frames before assoc. */
2209 	memset(&sta, 0, sizeof(sta));
2210 	IEEE80211_ADDR_COPY(sta.macaddr, ic->ic_myaddr);
2211 	sta.sta_index = 0;
2212 	sta.is_vif_sta = 1;
2213 	sta.vif_index = hvif.index;
2214 	sta.maxampdu = 0xffff;
2215 	DPRINTF(("creating default node\n"));
2216 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
2217 	    &sta, sizeof(sta), NULL);
2218 	if (error != 0)
2219 		goto fail;
2220 
2221 	/* Update target capabilities. */
2222 	memset(&hic, 0, sizeof(hic));
2223 	hic.flags = htobe32(0x400c2400);
2224 	hic.flags_ext = htobe32(0x00106080);
2225 	hic.ampdu_limit = htobe32(0x0000ffff);
2226 	hic.ampdu_subframes = 20;
2227 	hic.protmode = 1;	/* XXX */
2228 	hic.lg_txchainmask = sc->txchainmask;
2229 	hic.ht_txchainmask = sc->txchainmask;
2230 	DPRINTF(("updating target configuration\n"));
2231 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TARGET_IC_UPDATE,
2232 	    &hic, sizeof(hic), NULL);
2233 	if (error != 0)
2234 		goto fail;
2235 
2236 	/* Queue Rx xfers. */
2237 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
2238 		data = &usc->rx_data[i];
2239 
2240 		usbd_setup_xfer(data->xfer, usc->rx_data_pipe, data, data->buf,
2241 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
2242 		    USBD_NO_TIMEOUT, athn_usb_rxeof);
2243 		error = usbd_transfer(data->xfer);
2244 		if (error != 0 && error != USBD_IN_PROGRESS)
2245 			goto fail;
2246 	}
2247 	/* We're ready to go. */
2248 	ifp->if_flags &= ~IFF_OACTIVE;
2249 	ifp->if_flags |= IFF_RUNNING;
2250 
2251 #ifdef notyet
2252 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2253 		/* Install WEP keys. */
2254 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2255 			athn_usb_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2256 	}
2257 #endif
2258 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2259 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2260 	else
2261 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2262 	athn_usb_wait_async(usc);
2263 	return (0);
2264  fail:
2265 	athn_usb_stop(ifp);
2266 	return (error);
2267 }
2268 
2269 void
2270 athn_usb_stop(struct ifnet *ifp)
2271 {
2272 	struct athn_softc *sc = ifp->if_softc;
2273 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2274 	struct ieee80211com *ic = &sc->sc_ic;
2275 	struct ar_htc_target_vif hvif;
2276 	uint8_t sta_index;
2277 	int s;
2278 
2279 	sc->sc_tx_timer = 0;
2280 	ifp->if_timer = 0;
2281 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2282 
2283 	s = splusb();
2284 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2285 
2286 	/* Wait for all async commands to complete. */
2287 	athn_usb_wait_async(usc);
2288 
2289 	timeout_del(&sc->scan_to);
2290 	timeout_del(&sc->calib_to);
2291 
2292 	/* Remove main interface. */
2293 	memset(&hvif, 0, sizeof(hvif));
2294 	hvif.index = 0;
2295 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2296 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_REMOVE,
2297 	    &hvif, sizeof(hvif), NULL);
2298 	/* Remove default node. */
2299 	sta_index = 0;
2300 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
2301 	    &sta_index, sizeof(sta_index), NULL);
2302 
2303 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
2304 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
2305 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
2306 
2307 	athn_reset(sc, 0);
2308 	athn_init_pll(sc, NULL);
2309 	athn_set_power_awake(sc);
2310 	athn_reset(sc, 1);
2311 	athn_init_pll(sc, NULL);
2312 	athn_set_power_sleep(sc);
2313 
2314 	/* Abort Tx/Rx. */
2315 	usbd_abort_pipe(usc->tx_data_pipe);
2316 	usbd_abort_pipe(usc->rx_data_pipe);
2317 
2318 	/* Free Tx/Rx buffers. */
2319 	athn_usb_free_tx_list(usc);
2320 	athn_usb_free_rx_list(usc);
2321 	splx(s);
2322 
2323 	/* Flush Rx stream. */
2324 	if (usc->rx_stream.m != NULL)
2325 		m_freem(usc->rx_stream.m);
2326 	usc->rx_stream.m = NULL;
2327 	usc->rx_stream.left = 0;
2328 }
2329