xref: /openbsd-src/sys/dev/usb/if_athn_usb.c (revision ae3cb403620ab940fbaabb3055fac045a63d56b7)
1 /*	$OpenBSD: if_athn_usb.c,v 1.48 2017/10/26 15:00:28 mpi Exp $	*/
2 
3 /*-
4  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 /*
20  * USB front-end for Atheros AR9271 and AR7010 chipsets.
21  */
22 
23 #include "bpfilter.h"
24 
25 #include <sys/param.h>
26 #include <sys/sockio.h>
27 #include <sys/mbuf.h>
28 #include <sys/kernel.h>
29 #include <sys/socket.h>
30 #include <sys/systm.h>
31 #include <sys/timeout.h>
32 #include <sys/conf.h>
33 #include <sys/device.h>
34 #include <sys/endian.h>
35 
36 #include <machine/bus.h>
37 #include <machine/intr.h>
38 
39 #if NBPFILTER > 0
40 #include <net/bpf.h>
41 #endif
42 #include <net/if.h>
43 #include <net/if_dl.h>
44 #include <net/if_media.h>
45 
46 #include <netinet/in.h>
47 #include <netinet/if_ether.h>
48 
49 #include <net80211/ieee80211_var.h>
50 #include <net80211/ieee80211_amrr.h>
51 #include <net80211/ieee80211_mira.h>
52 #include <net80211/ieee80211_radiotap.h>
53 
54 #include <dev/ic/athnreg.h>
55 #include <dev/ic/athnvar.h>
56 
57 #include <dev/usb/usb.h>
58 #include <dev/usb/usbdi.h>
59 #include <dev/usb/usbdi_util.h>
60 #include <dev/usb/usbdevs.h>
61 
62 #include <dev/usb/if_athn_usb.h>
63 
64 static const struct athn_usb_type {
65 	struct usb_devno	devno;
66 	u_int			flags;
67 } athn_usb_devs[] = {
68 	{{ USB_VENDOR_ACCTON, USB_PRODUCT_ACCTON_AR9280 },
69 	   ATHN_USB_FLAG_AR7010 },
70 	{{ USB_VENDOR_ACTIONTEC, USB_PRODUCT_ACTIONTEC_AR9287 },
71 	   ATHN_USB_FLAG_AR7010 },
72 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_1 }},
73 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_2 }},
74 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9271_3 }},
75 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9280 },
76 	   ATHN_USB_FLAG_AR7010 },
77 	{{ USB_VENDOR_ATHEROS2, USB_PRODUCT_ATHEROS2_AR9287 },
78 	   ATHN_USB_FLAG_AR7010 },
79 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_1 }},
80 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_2 }},
81 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_3 }},
82 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_4 }},
83 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_5 }},
84 	{{ USB_VENDOR_AZUREWAVE, USB_PRODUCT_AZUREWAVE_AR9271_6 }},
85 	{{ USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_AR9271 }},
86 	{{ USB_VENDOR_LITEON, USB_PRODUCT_LITEON_AR9271 }},
87 	{{ USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_WNA1100 }},
88 	{{ USB_VENDOR_NETGEAR, USB_PRODUCT_NETGEAR_WNDA3200 },
89 	   ATHN_USB_FLAG_AR7010 },
90 	{{ USB_VENDOR_PANASONIC, USB_PRODUCT_PANASONIC_N5HBZ0000055 },
91 	   ATHN_USB_FLAG_AR7010 },
92 	{{ USB_VENDOR_VIA, USB_PRODUCT_VIA_AR9271 }}
93 };
94 #define athn_usb_lookup(v, p)	\
95 	((const struct athn_usb_type *)usb_lookup(athn_usb_devs, v, p))
96 
97 int		athn_usb_match(struct device *, void *, void *);
98 void		athn_usb_attach(struct device *, struct device *, void *);
99 int		athn_usb_detach(struct device *, int);
100 void		athn_usb_attachhook(struct device *);
101 int		athn_usb_open_pipes(struct athn_usb_softc *);
102 void		athn_usb_close_pipes(struct athn_usb_softc *);
103 int		athn_usb_alloc_rx_list(struct athn_usb_softc *);
104 void		athn_usb_free_rx_list(struct athn_usb_softc *);
105 int		athn_usb_alloc_tx_list(struct athn_usb_softc *);
106 void		athn_usb_free_tx_list(struct athn_usb_softc *);
107 int		athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
108 void		athn_usb_free_tx_cmd(struct athn_usb_softc *);
109 void		athn_usb_task(void *);
110 void		athn_usb_do_async(struct athn_usb_softc *,
111 		    void (*)(struct athn_usb_softc *, void *), void *, int);
112 void		athn_usb_wait_async(struct athn_usb_softc *);
113 int		athn_usb_load_firmware(struct athn_usb_softc *);
114 int		athn_usb_htc_msg(struct athn_usb_softc *, uint16_t, void *,
115 		    int);
116 int		athn_usb_htc_setup(struct athn_usb_softc *);
117 int		athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
118 		    uint8_t, uint8_t, uint8_t *);
119 int		athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
120 		    int, void *);
121 int		athn_usb_read_rom(struct athn_softc *);
122 uint32_t	athn_usb_read(struct athn_softc *, uint32_t);
123 void		athn_usb_write(struct athn_softc *, uint32_t, uint32_t);
124 void		athn_usb_write_barrier(struct athn_softc *);
125 int		athn_usb_media_change(struct ifnet *);
126 void		athn_usb_next_scan(void *);
127 int		athn_usb_newstate(struct ieee80211com *, enum ieee80211_state,
128 		    int);
129 void		athn_usb_newstate_cb(struct athn_usb_softc *, void *);
130 void		athn_usb_newassoc(struct ieee80211com *,
131 		    struct ieee80211_node *, int);
132 void		athn_usb_newassoc_cb(struct athn_usb_softc *, void *);
133 void		athn_usb_node_leave(struct ieee80211com *,
134 		    struct ieee80211_node *);
135 void		athn_usb_node_leave_cb(struct athn_usb_softc *, void *);
136 int		athn_usb_ampdu_tx_start(struct ieee80211com *,
137 		    struct ieee80211_node *, uint8_t);
138 void		athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *, void *);
139 void		athn_usb_ampdu_tx_stop(struct ieee80211com *,
140 		    struct ieee80211_node *, uint8_t);
141 void		athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *, void *);
142 int		athn_usb_create_node(struct athn_usb_softc *,
143 		    struct ieee80211_node *);
144 void		athn_usb_rx_enable(struct athn_softc *);
145 int		athn_set_chan(struct athn_softc *, struct ieee80211_channel *,
146 		    struct ieee80211_channel *);
147 int		athn_usb_switch_chan(struct athn_softc *,
148 		    struct ieee80211_channel *, struct ieee80211_channel *);
149 void		athn_usb_updateedca(struct ieee80211com *);
150 void		athn_usb_updateedca_cb(struct athn_usb_softc *, void *);
151 void		athn_usb_updateslot(struct ieee80211com *);
152 void		athn_usb_updateslot_cb(struct athn_usb_softc *, void *);
153 int		athn_usb_set_key(struct ieee80211com *,
154 		    struct ieee80211_node *, struct ieee80211_key *);
155 void		athn_usb_set_key_cb(struct athn_usb_softc *, void *);
156 void		athn_usb_delete_key(struct ieee80211com *,
157 		    struct ieee80211_node *, struct ieee80211_key *);
158 void		athn_usb_delete_key_cb(struct athn_usb_softc *, void *);
159 void		athn_usb_bcneof(struct usbd_xfer *, void *,
160 		    usbd_status);
161 void		athn_usb_swba(struct athn_usb_softc *);
162 void		athn_usb_rx_wmi_ctrl(struct athn_usb_softc *, uint8_t *, int);
163 void		athn_usb_intr(struct usbd_xfer *, void *,
164 		    usbd_status);
165 void		athn_usb_rx_radiotap(struct athn_softc *, struct mbuf *,
166 		    struct ar_rx_status *);
167 void		athn_usb_rx_frame(struct athn_usb_softc *, struct mbuf *);
168 void		athn_usb_rxeof(struct usbd_xfer *, void *,
169 		    usbd_status);
170 void		athn_usb_txeof(struct usbd_xfer *, void *,
171 		    usbd_status);
172 int		athn_usb_tx(struct athn_softc *, struct mbuf *,
173 		    struct ieee80211_node *);
174 void		athn_usb_start(struct ifnet *);
175 void		athn_usb_watchdog(struct ifnet *);
176 int		athn_usb_ioctl(struct ifnet *, u_long, caddr_t);
177 int		athn_usb_init(struct ifnet *);
178 void		athn_usb_stop(struct ifnet *);
179 void		ar9271_load_ani(struct athn_softc *);
180 
181 /* Shortcut. */
182 #define athn_usb_wmi_cmd(sc, cmd_id)	\
183 	athn_usb_wmi_xcmd(sc, cmd_id, NULL, 0, NULL)
184 
185 /* Extern functions. */
186 void		athn_led_init(struct athn_softc *);
187 void		athn_set_led(struct athn_softc *, int);
188 void		athn_btcoex_init(struct athn_softc *);
189 void		athn_set_rxfilter(struct athn_softc *, uint32_t);
190 int		athn_reset(struct athn_softc *, int);
191 void		athn_init_pll(struct athn_softc *,
192 		    const struct ieee80211_channel *);
193 int		athn_set_power_awake(struct athn_softc *);
194 void		athn_set_power_sleep(struct athn_softc *);
195 void		athn_reset_key(struct athn_softc *, int);
196 int		athn_set_key(struct ieee80211com *, struct ieee80211_node *,
197 		    struct ieee80211_key *);
198 void		athn_delete_key(struct ieee80211com *, struct ieee80211_node *,
199 		    struct ieee80211_key *);
200 void		athn_rx_start(struct athn_softc *);
201 void		athn_set_sta_timers(struct athn_softc *);
202 void		athn_set_hostap_timers(struct athn_softc *);
203 void		athn_set_opmode(struct athn_softc *);
204 void		athn_set_bss(struct athn_softc *, struct ieee80211_node *);
205 int		athn_hw_reset(struct athn_softc *, struct ieee80211_channel *,
206 		    struct ieee80211_channel *, int);
207 void		athn_updateedca(struct ieee80211com *);
208 void		athn_updateslot(struct ieee80211com *);
209 
210 const struct cfattach athn_usb_ca = {
211 	sizeof(struct athn_usb_softc),
212 	athn_usb_match,
213 	athn_usb_attach,
214 	athn_usb_detach
215 };
216 
217 int
218 athn_usb_match(struct device *parent, void *match, void *aux)
219 {
220 	struct usb_attach_arg *uaa = aux;
221 
222 	if (uaa->iface == NULL || uaa->configno != 1)
223 		return (UMATCH_NONE);
224 
225 	return ((athn_usb_lookup(uaa->vendor, uaa->product) != NULL) ?
226 	    UMATCH_VENDOR_PRODUCT_CONF_IFACE : UMATCH_NONE);
227 }
228 
229 void
230 athn_usb_attach(struct device *parent, struct device *self, void *aux)
231 {
232 	struct athn_usb_softc *usc = (struct athn_usb_softc *)self;
233 	struct athn_softc *sc = &usc->sc_sc;
234 	struct usb_attach_arg *uaa = aux;
235 
236 	usc->sc_udev = uaa->device;
237 	usc->sc_iface = uaa->iface;
238 
239 	usc->flags = athn_usb_lookup(uaa->vendor, uaa->product)->flags;
240 	sc->flags |= ATHN_FLAG_USB;
241 #ifdef notyet
242 	/* Check if it is a combo WiFi+Bluetooth (WB193) device. */
243 	if (strncmp(product, "wb193", 5) == 0)
244 		sc->flags |= ATHN_FLAG_BTCOEX3WIRE;
245 #endif
246 
247 	sc->ops.read = athn_usb_read;
248 	sc->ops.write = athn_usb_write;
249 	sc->ops.write_barrier = athn_usb_write_barrier;
250 
251 	usb_init_task(&usc->sc_task, athn_usb_task, sc, USB_TASK_TYPE_GENERIC);
252 
253 	if (athn_usb_open_pipes(usc) != 0)
254 		return;
255 
256 	/* Allocate xfer for firmware commands. */
257 	if (athn_usb_alloc_tx_cmd(usc) != 0)
258 		return;
259 
260 	config_mountroot(self, athn_usb_attachhook);
261 }
262 
263 int
264 athn_usb_detach(struct device *self, int flags)
265 {
266 	struct athn_usb_softc *usc = (struct athn_usb_softc *)self;
267 	struct athn_softc *sc = &usc->sc_sc;
268 
269 	if (usc->sc_athn_attached)
270 		athn_detach(sc);
271 
272 	/* Wait for all async commands to complete. */
273 	athn_usb_wait_async(usc);
274 
275 	usbd_ref_wait(usc->sc_udev);
276 
277 	/* Abort and close Tx/Rx pipes. */
278 	athn_usb_close_pipes(usc);
279 
280 	/* Free Tx/Rx buffers. */
281 	athn_usb_free_tx_cmd(usc);
282 	athn_usb_free_tx_list(usc);
283 	athn_usb_free_rx_list(usc);
284 
285 	return (0);
286 }
287 
288 void
289 athn_usb_attachhook(struct device *self)
290 {
291 	struct athn_usb_softc *usc = (struct athn_usb_softc *)self;
292 	struct athn_softc *sc = &usc->sc_sc;
293 	struct athn_ops *ops = &sc->ops;
294 	struct ieee80211com *ic = &sc->sc_ic;
295 	struct ifnet *ifp = &ic->ic_if;
296 	int s, i, error;
297 
298 	/* Load firmware. */
299 	error = athn_usb_load_firmware(usc);
300 	if (error != 0) {
301 		printf("%s: could not load firmware\n", sc->sc_dev.dv_xname);
302 		return;
303 	}
304 
305 	/* Setup the host transport communication interface. */
306 	error = athn_usb_htc_setup(usc);
307 	if (error != 0)
308 		return;
309 
310 	/* We're now ready to attach the bus agnostic driver. */
311 	s = splnet();
312 	error = athn_attach(sc);
313 	if (error != 0) {
314 		splx(s);
315 		return;
316 	}
317 	usc->sc_athn_attached = 1;
318 	/* Override some operations for USB. */
319 	ifp->if_ioctl = athn_usb_ioctl;
320 	ifp->if_start = athn_usb_start;
321 	ifp->if_watchdog = athn_usb_watchdog;
322 	ic->ic_newassoc = athn_usb_newassoc;
323 	ic->ic_node_leave = athn_usb_node_leave;
324 	ic->ic_updateslot = athn_usb_updateslot;
325 	ic->ic_updateedca = athn_usb_updateedca;
326 #ifdef notyet
327 	ic->ic_set_key = athn_usb_set_key;
328 	ic->ic_delete_key = athn_usb_delete_key;
329 	ic->ic_ampdu_tx_start = athn_usb_ampdu_tx_start;
330 	ic->ic_ampdu_tx_stop = athn_usb_ampdu_tx_stop;
331 #endif
332 	ic->ic_newstate = athn_usb_newstate;
333 	ic->ic_media.ifm_change = athn_usb_media_change;
334 	timeout_set(&sc->scan_to, athn_usb_next_scan, usc);
335 
336 	ops->rx_enable = athn_usb_rx_enable;
337 	splx(s);
338 
339 	/* Reset HW key cache entries. */
340 	for (i = 0; i < sc->kc_entries; i++)
341 		athn_reset_key(sc, i);
342 
343 	ops->enable_antenna_diversity(sc);
344 
345 #ifdef ATHN_BT_COEXISTENCE
346 	/* Configure bluetooth coexistence for combo chips. */
347 	if (sc->flags & ATHN_FLAG_BTCOEX)
348 		athn_btcoex_init(sc);
349 #endif
350 	/* Configure LED. */
351 	athn_led_init(sc);
352 }
353 
354 int
355 athn_usb_open_pipes(struct athn_usb_softc *usc)
356 {
357 	usb_endpoint_descriptor_t *ed;
358 	int isize, error;
359 
360 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_TX_DATA, 0,
361 	    &usc->tx_data_pipe);
362 	if (error != 0) {
363 		printf("%s: could not open Tx bulk pipe\n",
364 		    usc->usb_dev.dv_xname);
365 		goto fail;
366 	}
367 
368 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_RX_DATA, 0,
369 	    &usc->rx_data_pipe);
370 	if (error != 0) {
371 		printf("%s: could not open Rx bulk pipe\n",
372 		    usc->usb_dev.dv_xname);
373 		goto fail;
374 	}
375 
376 	ed = usbd_get_endpoint_descriptor(usc->sc_iface, AR_PIPE_RX_INTR);
377 	if (ed == NULL) {
378 		printf("%s: could not retrieve Rx intr pipe descriptor\n",
379 		    usc->usb_dev.dv_xname);
380 		goto fail;
381 	}
382 	isize = UGETW(ed->wMaxPacketSize);
383 	if (isize == 0) {
384 		printf("%s: invalid Rx intr pipe descriptor\n",
385 		    usc->usb_dev.dv_xname);
386 		goto fail;
387 	}
388 	usc->ibuf = malloc(isize, M_USBDEV, M_NOWAIT);
389 	if (usc->ibuf == NULL) {
390 		printf("%s: could not allocate Rx intr buffer\n",
391 		    usc->usb_dev.dv_xname);
392 		goto fail;
393 	}
394 	usc->ibuflen = isize;
395 	error = usbd_open_pipe_intr(usc->sc_iface, AR_PIPE_RX_INTR,
396 	    USBD_SHORT_XFER_OK, &usc->rx_intr_pipe, usc, usc->ibuf, isize,
397 	    athn_usb_intr, USBD_DEFAULT_INTERVAL);
398 	if (error != 0) {
399 		printf("%s: could not open Rx intr pipe\n",
400 		    usc->usb_dev.dv_xname);
401 		goto fail;
402 	}
403 
404 	error = usbd_open_pipe(usc->sc_iface, AR_PIPE_TX_INTR, 0,
405 	    &usc->tx_intr_pipe);
406 	if (error != 0) {
407 		printf("%s: could not open Tx intr pipe\n",
408 		    usc->usb_dev.dv_xname);
409 		goto fail;
410 	}
411  fail:
412 	if (error != 0)
413 		athn_usb_close_pipes(usc);
414 	return (error);
415 }
416 
417 void
418 athn_usb_close_pipes(struct athn_usb_softc *usc)
419 {
420 	if (usc->tx_data_pipe != NULL) {
421 		usbd_close_pipe(usc->tx_data_pipe);
422 		usc->tx_data_pipe = NULL;
423 	}
424 	if (usc->rx_data_pipe != NULL) {
425 		usbd_close_pipe(usc->rx_data_pipe);
426 		usc->rx_data_pipe = NULL;
427 	}
428 	if (usc->tx_intr_pipe != NULL) {
429 		usbd_close_pipe(usc->tx_intr_pipe);
430 		usc->tx_intr_pipe = NULL;
431 	}
432 	if (usc->rx_intr_pipe != NULL) {
433 		usbd_close_pipe(usc->rx_intr_pipe);
434 		usc->rx_intr_pipe = NULL;
435 	}
436 	if (usc->ibuf != NULL) {
437 		free(usc->ibuf, M_USBDEV, usc->ibuflen);
438 		usc->ibuf = NULL;
439 	}
440 }
441 
442 int
443 athn_usb_alloc_rx_list(struct athn_usb_softc *usc)
444 {
445 	struct athn_usb_rx_data *data;
446 	int i, error = 0;
447 
448 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
449 		data = &usc->rx_data[i];
450 
451 		data->sc = usc;	/* Backpointer for callbacks. */
452 
453 		data->xfer = usbd_alloc_xfer(usc->sc_udev);
454 		if (data->xfer == NULL) {
455 			printf("%s: could not allocate xfer\n",
456 			    usc->usb_dev.dv_xname);
457 			error = ENOMEM;
458 			break;
459 		}
460 		data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_RXBUFSZ);
461 		if (data->buf == NULL) {
462 			printf("%s: could not allocate xfer buffer\n",
463 			    usc->usb_dev.dv_xname);
464 			error = ENOMEM;
465 			break;
466 		}
467 	}
468 	if (error != 0)
469 		athn_usb_free_rx_list(usc);
470 	return (error);
471 }
472 
473 void
474 athn_usb_free_rx_list(struct athn_usb_softc *usc)
475 {
476 	int i;
477 
478 	/* NB: Caller must abort pipe first. */
479 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
480 		if (usc->rx_data[i].xfer != NULL)
481 			usbd_free_xfer(usc->rx_data[i].xfer);
482 		usc->rx_data[i].xfer = NULL;
483 	}
484 }
485 
486 int
487 athn_usb_alloc_tx_list(struct athn_usb_softc *usc)
488 {
489 	struct athn_usb_tx_data *data;
490 	int i, error = 0;
491 
492 	TAILQ_INIT(&usc->tx_free_list);
493 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
494 		data = &usc->tx_data[i];
495 
496 		data->sc = usc;	/* Backpointer for callbacks. */
497 
498 		data->xfer = usbd_alloc_xfer(usc->sc_udev);
499 		if (data->xfer == NULL) {
500 			printf("%s: could not allocate xfer\n",
501 			    usc->usb_dev.dv_xname);
502 			error = ENOMEM;
503 			break;
504 		}
505 		data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_TXBUFSZ);
506 		if (data->buf == NULL) {
507 			printf("%s: could not allocate xfer buffer\n",
508 			    usc->usb_dev.dv_xname);
509 			error = ENOMEM;
510 			break;
511 		}
512 		/* Append this Tx buffer to our free list. */
513 		TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
514 	}
515 	if (error != 0)
516 		athn_usb_free_tx_list(usc);
517 	return (error);
518 }
519 
520 void
521 athn_usb_free_tx_list(struct athn_usb_softc *usc)
522 {
523 	int i;
524 
525 	/* NB: Caller must abort pipe first. */
526 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
527 		if (usc->tx_data[i].xfer != NULL)
528 			usbd_free_xfer(usc->tx_data[i].xfer);
529 		usc->tx_data[i].xfer = NULL;
530 	}
531 }
532 
533 int
534 athn_usb_alloc_tx_cmd(struct athn_usb_softc *usc)
535 {
536 	struct athn_usb_tx_data *data = &usc->tx_cmd;
537 
538 	data->sc = usc;	/* Backpointer for callbacks. */
539 
540 	data->xfer = usbd_alloc_xfer(usc->sc_udev);
541 	if (data->xfer == NULL) {
542 		printf("%s: could not allocate xfer\n",
543 		    usc->usb_dev.dv_xname);
544 		return (ENOMEM);
545 	}
546 	data->buf = usbd_alloc_buffer(data->xfer, ATHN_USB_TXCMDSZ);
547 	if (data->buf == NULL) {
548 		printf("%s: could not allocate xfer buffer\n",
549 		    usc->usb_dev.dv_xname);
550 		return (ENOMEM);
551 	}
552 	return (0);
553 }
554 
555 void
556 athn_usb_free_tx_cmd(struct athn_usb_softc *usc)
557 {
558 	if (usc->tx_cmd.xfer != NULL)
559 		usbd_free_xfer(usc->tx_cmd.xfer);
560 	usc->tx_cmd.xfer = NULL;
561 }
562 
563 void
564 athn_usb_task(void *arg)
565 {
566 	struct athn_usb_softc *usc = arg;
567 	struct athn_usb_host_cmd_ring *ring = &usc->cmdq;
568 	struct athn_usb_host_cmd *cmd;
569 	int s;
570 
571 	/* Process host commands. */
572 	s = splusb();
573 	while (ring->next != ring->cur) {
574 		cmd = &ring->cmd[ring->next];
575 		splx(s);
576 		/* Invoke callback. */
577 		cmd->cb(usc, cmd->data);
578 		s = splusb();
579 		ring->queued--;
580 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
581 	}
582 	splx(s);
583 }
584 
585 void
586 athn_usb_do_async(struct athn_usb_softc *usc,
587     void (*cb)(struct athn_usb_softc *, void *), void *arg, int len)
588 {
589 	struct athn_usb_host_cmd_ring *ring = &usc->cmdq;
590 	struct athn_usb_host_cmd *cmd;
591 	int s;
592 
593 	if (ring->queued == ATHN_USB_HOST_CMD_RING_COUNT) {
594 		printf("%s: host cmd queue overrun\n", usc->usb_dev.dv_xname);
595 		return;	/* XXX */
596 	}
597 
598 	s = splusb();
599 	cmd = &ring->cmd[ring->cur];
600 	cmd->cb = cb;
601 	KASSERT(len <= sizeof(cmd->data));
602 	memcpy(cmd->data, arg, len);
603 	ring->cur = (ring->cur + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
604 
605 	/* If there is no pending command already, schedule a task. */
606 	if (++ring->queued == 1)
607 		usb_add_task(usc->sc_udev, &usc->sc_task);
608 	splx(s);
609 }
610 
611 void
612 athn_usb_wait_async(struct athn_usb_softc *usc)
613 {
614 	/* Wait for all queued asynchronous commands to complete. */
615 	usb_wait_task(usc->sc_udev, &usc->sc_task);
616 }
617 
618 int
619 athn_usb_load_firmware(struct athn_usb_softc *usc)
620 {
621 	usb_device_descriptor_t *dd;
622 	usb_device_request_t req;
623 	const char *name;
624 	u_char *fw, *ptr;
625 	size_t fwsize, size;
626 	uint32_t addr;
627 	int s, mlen, error;
628 
629 	/* Determine which firmware image to load. */
630 	if (usc->flags & ATHN_USB_FLAG_AR7010) {
631 		dd = usbd_get_device_descriptor(usc->sc_udev);
632 		if (UGETW(dd->bcdDevice) == 0x0202)
633 			name = "athn-ar7010-11";
634 		else
635 			name = "athn-ar7010";
636 	} else
637 		name = "athn-ar9271";
638 	/* Read firmware image from the filesystem. */
639 	if ((error = loadfirmware(name, &fw, &fwsize)) != 0) {
640 		printf("%s: failed loadfirmware of file %s (error %d)\n",
641 		    usc->usb_dev.dv_xname, name, error);
642 		return (error);
643 	}
644 	/* Load firmware image. */
645 	ptr = fw;
646 	addr = AR9271_FIRMWARE >> 8;
647 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
648 	req.bRequest = AR_FW_DOWNLOAD;
649 	USETW(req.wIndex, 0);
650 	size = fwsize;
651 	while (size > 0) {
652 		mlen = MIN(size, 4096);
653 
654 		USETW(req.wValue, addr);
655 		USETW(req.wLength, mlen);
656 		error = usbd_do_request(usc->sc_udev, &req, ptr);
657 		if (error != 0) {
658 			free(fw, M_DEVBUF, fwsize);
659 			return (error);
660 		}
661 		addr += mlen >> 8;
662 		ptr  += mlen;
663 		size -= mlen;
664 	}
665 	free(fw, M_DEVBUF, fwsize);
666 
667 	/* Start firmware. */
668 	if (usc->flags & ATHN_USB_FLAG_AR7010)
669 		addr = AR7010_FIRMWARE_TEXT >> 8;
670 	else
671 		addr = AR9271_FIRMWARE_TEXT >> 8;
672 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
673 	req.bRequest = AR_FW_DOWNLOAD_COMP;
674 	USETW(req.wIndex, 0);
675 	USETW(req.wValue, addr);
676 	USETW(req.wLength, 0);
677 	s = splusb();
678 	usc->wait_msg_id = AR_HTC_MSG_READY;
679 	error = usbd_do_request(usc->sc_udev, &req, NULL);
680 	/* Wait at most 1 second for firmware to boot. */
681 	if (error == 0 && usc->wait_msg_id != 0)
682 		error = tsleep(&usc->wait_msg_id, 0, "athnfw", hz);
683 	usc->wait_msg_id = 0;
684 	splx(s);
685 	return (error);
686 }
687 
688 int
689 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
690     int len)
691 {
692 	struct athn_usb_tx_data *data = &usc->tx_cmd;
693 	struct ar_htc_frame_hdr *htc;
694 	struct ar_htc_msg_hdr *msg;
695 
696 	htc = (struct ar_htc_frame_hdr *)data->buf;
697 	memset(htc, 0, sizeof(*htc));
698 	htc->endpoint_id = 0;
699 	htc->payload_len = htobe16(sizeof(*msg) + len);
700 
701 	msg = (struct ar_htc_msg_hdr *)&htc[1];
702 	msg->msg_id = htobe16(msg_id);
703 
704 	memcpy(&msg[1], buf, len);
705 
706 	usbd_setup_xfer(data->xfer, usc->tx_intr_pipe, NULL, data->buf,
707 	    sizeof(*htc) + sizeof(*msg) + len,
708 	    USBD_SHORT_XFER_OK | USBD_NO_COPY | USBD_SYNCHRONOUS,
709 	    ATHN_USB_CMD_TIMEOUT, NULL);
710 	return (usbd_transfer(data->xfer));
711 }
712 
713 int
714 athn_usb_htc_setup(struct athn_usb_softc *usc)
715 {
716 	struct ar_htc_msg_config_pipe cfg;
717 	int s, error;
718 
719 	/*
720 	 * Connect WMI services to USB pipes.
721 	 */
722 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CONTROL,
723 	    AR_PIPE_TX_INTR, AR_PIPE_RX_INTR, &usc->ep_ctrl);
724 	if (error != 0)
725 		return (error);
726 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_BEACON,
727 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_bcn);
728 	if (error != 0)
729 		return (error);
730 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CAB,
731 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_cab);
732 	if (error != 0)
733 		return (error);
734 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_UAPSD,
735 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_uapsd);
736 	if (error != 0)
737 		return (error);
738 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_MGMT,
739 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_mgmt);
740 	if (error != 0)
741 		return (error);
742 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BE,
743 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_BE]);
744 	if (error != 0)
745 		return (error);
746 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BK,
747 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_BK]);
748 	if (error != 0)
749 		return (error);
750 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VI,
751 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_VI]);
752 	if (error != 0)
753 		return (error);
754 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VO,
755 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->ep_data[EDCA_AC_VO]);
756 	if (error != 0)
757 		return (error);
758 
759 	/* Set credits for WLAN Tx pipe. */
760 	memset(&cfg, 0, sizeof(cfg));
761 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
762 	cfg.credits = (usc->flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
763 	s = splusb();
764 	usc->wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
765 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
766 	if (error == 0 && usc->wait_msg_id != 0)
767 		error = tsleep(&usc->wait_msg_id, 0, "athnhtc", hz);
768 	usc->wait_msg_id = 0;
769 	splx(s);
770 	if (error != 0) {
771 		printf("%s: could not configure pipe\n",
772 		    usc->usb_dev.dv_xname);
773 		return (error);
774 	}
775 
776 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
777 	if (error != 0) {
778 		printf("%s: could not complete setup\n",
779 		    usc->usb_dev.dv_xname);
780 		return (error);
781 	}
782 	return (0);
783 }
784 
785 int
786 athn_usb_htc_connect_svc(struct athn_usb_softc *usc, uint16_t svc_id,
787     uint8_t ul_pipe, uint8_t dl_pipe, uint8_t *endpoint_id)
788 {
789 	struct ar_htc_msg_conn_svc msg;
790 	struct ar_htc_msg_conn_svc_rsp rsp;
791 	int s, error;
792 
793 	memset(&msg, 0, sizeof(msg));
794 	msg.svc_id = htobe16(svc_id);
795 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
796 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
797 	s = splusb();
798 	usc->msg_conn_svc_rsp = &rsp;
799 	usc->wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
800 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
801 	/* Wait at most 1 second for response. */
802 	if (error == 0 && usc->wait_msg_id != 0)
803 		error = tsleep(&usc->wait_msg_id, 0, "athnhtc", hz);
804 	usc->wait_msg_id = 0;
805 	splx(s);
806 	if (error != 0) {
807 		printf("%s: error waiting for service %d connection\n",
808 		    usc->usb_dev.dv_xname, svc_id);
809 		return (error);
810 	}
811 	if (rsp.status != AR_HTC_SVC_SUCCESS) {
812 		printf("%s: service %d connection failed, error %d\n",
813 		    usc->usb_dev.dv_xname, svc_id, rsp.status);
814 		return (EIO);
815 	}
816 	DPRINTF(("service %d successfully connected to endpoint %d\n",
817 	    svc_id, rsp.endpoint_id));
818 
819 	/* Return endpoint id. */
820 	*endpoint_id = rsp.endpoint_id;
821 	return (0);
822 }
823 
824 int
825 athn_usb_wmi_xcmd(struct athn_usb_softc *usc, uint16_t cmd_id, void *ibuf,
826     int ilen, void *obuf)
827 {
828 	struct athn_usb_tx_data *data = &usc->tx_cmd;
829 	struct ar_htc_frame_hdr *htc;
830 	struct ar_wmi_cmd_hdr *wmi;
831 	int s, error;
832 
833 	if (usbd_is_dying(usc->sc_udev))
834 		return ENXIO;
835 
836 	s = splusb();
837 	while (usc->wait_cmd_id) {
838 		/*
839 		 * The previous USB transfer is not done yet. We can't use
840 		 * data->xfer until it is done or we'll cause major confusion
841 		 * in the USB stack.
842 		 */
843 		tsleep(&usc->wait_cmd_id, 0, "athnwmx", ATHN_USB_CMD_TIMEOUT);
844 		if (usbd_is_dying(usc->sc_udev)) {
845 			splx(s);
846 			return ENXIO;
847 		}
848 	}
849 	splx(s);
850 
851 	htc = (struct ar_htc_frame_hdr *)data->buf;
852 	memset(htc, 0, sizeof(*htc));
853 	htc->endpoint_id = usc->ep_ctrl;
854 	htc->payload_len = htobe16(sizeof(*wmi) + ilen);
855 
856 	wmi = (struct ar_wmi_cmd_hdr *)&htc[1];
857 	wmi->cmd_id = htobe16(cmd_id);
858 	usc->wmi_seq_no++;
859 	wmi->seq_no = htobe16(usc->wmi_seq_no);
860 
861 	memcpy(&wmi[1], ibuf, ilen);
862 
863 	usbd_setup_xfer(data->xfer, usc->tx_intr_pipe, NULL, data->buf,
864 	    sizeof(*htc) + sizeof(*wmi) + ilen,
865 	    USBD_SHORT_XFER_OK | USBD_NO_COPY, ATHN_USB_CMD_TIMEOUT,
866 	    NULL);
867 	s = splusb();
868 	error = usbd_transfer(data->xfer);
869 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
870 		splx(s);
871 		return (error);
872 	}
873 	usc->obuf = obuf;
874 	usc->wait_cmd_id = cmd_id;
875 	/*
876 	 * Wait for WMI command complete interrupt. In case it does not fire
877 	 * wait until the USB transfer times out to avoid racing the transfer.
878 	 */
879 	error = tsleep(&usc->wait_cmd_id, 0, "athnwmi", ATHN_USB_CMD_TIMEOUT);
880 	if (error) {
881 		if (error == EWOULDBLOCK) {
882 			printf("%s: firmware command 0x%x timed out\n",
883 			    usc->usb_dev.dv_xname, cmd_id);
884 			error = ETIMEDOUT;
885 		}
886 	}
887 
888 	/*
889 	 * Both the WMI command and transfer are done or have timed out.
890 	 * Allow other threads to enter this function and use data->xfer.
891 	 */
892 	usc->wait_cmd_id = 0;
893 	wakeup(&usc->wait_cmd_id);
894 
895 	splx(s);
896 	return (error);
897 }
898 
899 int
900 athn_usb_read_rom(struct athn_softc *sc)
901 {
902 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
903 	uint32_t addrs[8], vals[8], addr;
904 	uint16_t *eep;
905 	int i, j, error;
906 
907 	/* Read EEPROM by blocks of 16 bytes. */
908 	eep = sc->eep;
909 	addr = AR_EEPROM_OFFSET(sc->eep_base);
910 	for (i = 0; i < sc->eep_size / 16; i++) {
911 		for (j = 0; j < 8; j++, addr += 4)
912 			addrs[j] = htobe32(addr);
913 		error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
914 		    addrs, sizeof(addrs), vals);
915 		if (error != 0)
916 			break;
917 		for (j = 0; j < 8; j++)
918 			*eep++ = betoh32(vals[j]);
919 	}
920 	return (error);
921 }
922 
923 uint32_t
924 athn_usb_read(struct athn_softc *sc, uint32_t addr)
925 {
926 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
927 	uint32_t val;
928 	int error;
929 
930 	/* Flush pending writes for strict consistency. */
931 	athn_usb_write_barrier(sc);
932 
933 	addr = htobe32(addr);
934 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
935 	    &addr, sizeof(addr), &val);
936 	if (error != 0)
937 		return (0xdeadbeef);
938 	return (betoh32(val));
939 }
940 
941 void
942 athn_usb_write(struct athn_softc *sc, uint32_t addr, uint32_t val)
943 {
944 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
945 
946 	usc->wbuf[usc->wcount].addr = htobe32(addr);
947 	usc->wbuf[usc->wcount].val  = htobe32(val);
948 	if (++usc->wcount == AR_MAX_WRITE_COUNT)
949 		athn_usb_write_barrier(sc);
950 }
951 
952 void
953 athn_usb_write_barrier(struct athn_softc *sc)
954 {
955 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
956 
957 	if (usc->wcount == 0)
958 		return;	/* Nothing to write. */
959 
960 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_WRITE,
961 	    usc->wbuf, usc->wcount * sizeof(usc->wbuf[0]), NULL);
962 	usc->wcount = 0;	/* Always flush buffer. */
963 }
964 
965 int
966 athn_usb_media_change(struct ifnet *ifp)
967 {
968 	struct athn_usb_softc *usc = (struct athn_usb_softc *)ifp->if_softc;
969 	int error;
970 
971 	if (usbd_is_dying(usc->sc_udev))
972 		return ENXIO;
973 
974 	error = ieee80211_media_change(ifp);
975 	if (error != ENETRESET)
976 		return (error);
977 
978 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
979 	    (IFF_UP | IFF_RUNNING)) {
980 		athn_usb_stop(ifp);
981 		error = athn_usb_init(ifp);
982 	}
983 	return (error);
984 }
985 
986 void
987 athn_usb_next_scan(void *arg)
988 {
989 	struct athn_usb_softc *usc = arg;
990 	struct athn_softc *sc = &usc->sc_sc;
991 	struct ieee80211com *ic = &sc->sc_ic;
992 	int s;
993 
994 	if (usbd_is_dying(usc->sc_udev))
995 		return;
996 
997 	usbd_ref_incr(usc->sc_udev);
998 
999 	s = splnet();
1000 	if (ic->ic_state == IEEE80211_S_SCAN)
1001 		ieee80211_next_scan(&ic->ic_if);
1002 	splx(s);
1003 
1004 	usbd_ref_decr(usc->sc_udev);
1005 }
1006 
1007 int
1008 athn_usb_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
1009     int arg)
1010 {
1011 	struct athn_usb_softc *usc = ic->ic_softc;
1012 	struct athn_usb_cmd_newstate cmd;
1013 
1014 	/* Do it in a process context. */
1015 	cmd.state = nstate;
1016 	cmd.arg = arg;
1017 	athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, sizeof(cmd));
1018 	return (0);
1019 }
1020 
1021 void
1022 athn_usb_newstate_cb(struct athn_usb_softc *usc, void *arg)
1023 {
1024 	struct athn_usb_cmd_newstate *cmd = arg;
1025 	struct athn_softc *sc = &usc->sc_sc;
1026 	struct ieee80211com *ic = &sc->sc_ic;
1027 	enum ieee80211_state ostate;
1028 	uint32_t reg, imask;
1029 	uint8_t sta_index;
1030 	int s, error;
1031 
1032 	timeout_del(&sc->calib_to);
1033 
1034 	s = splnet();
1035 	ostate = ic->ic_state;
1036 	DPRINTF(("newstate %d -> %d\n", ostate, cmd->state));
1037 
1038 	if (ostate == IEEE80211_S_RUN) {
1039 		sta_index = ((struct athn_node *)ic->ic_bss)->sta_index;
1040 		(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1041 		    &sta_index, sizeof(sta_index), NULL);
1042 		usc->nnodes--;
1043 		reg = AR_READ(sc, AR_RX_FILTER);
1044 		reg = (reg & ~AR_RX_FILTER_MYBEACON) |
1045 		    AR_RX_FILTER_BEACON;
1046 		AR_WRITE(sc, AR_RX_FILTER, reg);
1047 		AR_WRITE_BARRIER(sc);
1048 	}
1049 	switch (cmd->state) {
1050 	case IEEE80211_S_INIT:
1051 		athn_set_led(sc, 0);
1052 		break;
1053 	case IEEE80211_S_SCAN:
1054 		/* Make the LED blink while scanning. */
1055 		athn_set_led(sc, !sc->led_state);
1056 		(void)athn_usb_switch_chan(sc, ic->ic_bss->ni_chan, NULL);
1057 		if (!usbd_is_dying(usc->sc_udev))
1058 			timeout_add_msec(&sc->scan_to, 200);
1059 		break;
1060 	case IEEE80211_S_AUTH:
1061 		athn_set_led(sc, 0);
1062 		error = athn_usb_switch_chan(sc, ic->ic_bss->ni_chan, NULL);
1063 		break;
1064 	case IEEE80211_S_ASSOC:
1065 		break;
1066 	case IEEE80211_S_RUN:
1067 		athn_set_led(sc, 1);
1068 
1069 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
1070 			break;
1071 
1072 		/* Create node entry for our BSS */
1073 		error = athn_usb_create_node(usc, ic->ic_bss);
1074 
1075 		athn_set_bss(sc, ic->ic_bss);
1076 		athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1077 #ifndef IEEE80211_STA_ONLY
1078 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1079 			athn_set_hostap_timers(sc);
1080 			/* Enable software beacon alert interrupts. */
1081 			imask = htobe32(AR_IMR_SWBA);
1082 		} else
1083 #endif
1084 		{
1085 			athn_set_sta_timers(sc);
1086 			/* Enable beacon miss interrupts. */
1087 			imask = htobe32(AR_IMR_BMISS);
1088 
1089 			/* Stop receiving beacons from other BSS. */
1090 			reg = AR_READ(sc, AR_RX_FILTER);
1091 			reg = (reg & ~AR_RX_FILTER_BEACON) |
1092 			    AR_RX_FILTER_MYBEACON;
1093 			AR_WRITE(sc, AR_RX_FILTER, reg);
1094 			AR_WRITE_BARRIER(sc);
1095 		}
1096 		athn_usb_wmi_xcmd(usc, AR_WMI_CMD_ENABLE_INTR,
1097 		    &imask, sizeof(imask), NULL);
1098 		break;
1099 	}
1100 	(void)sc->sc_newstate(ic, cmd->state, cmd->arg);
1101 	splx(s);
1102 }
1103 
1104 void
1105 athn_usb_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
1106     int isnew)
1107 {
1108 #ifndef IEEE80211_STA_ONLY
1109 	struct athn_usb_softc *usc = ic->ic_softc;
1110 
1111 	if (ic->ic_opmode != IEEE80211_M_HOSTAP || !isnew)
1112 		return;
1113 	/* Do it in a process context. */
1114 	ieee80211_ref_node(ni);
1115 	athn_usb_do_async(usc, athn_usb_newassoc_cb, &ni, sizeof(ni));
1116 }
1117 
1118 void
1119 athn_usb_newassoc_cb(struct athn_usb_softc *usc, void *arg)
1120 {
1121 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1122 	struct ieee80211_node *ni = *(void **)arg;
1123 	int s;
1124 
1125 	s = splnet();
1126 	/* NB: Node may have left before we got scheduled. */
1127 	if (ni->ni_associd != 0 && ni->ni_state == IEEE80211_STA_ASSOC)
1128 		(void)athn_usb_create_node(usc, ni);
1129 	ieee80211_release_node(ic, ni);
1130 	splx(s);
1131 #endif
1132 }
1133 
1134 void
1135 athn_usb_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
1136 {
1137 	struct athn_usb_softc *usc = ic->ic_softc;
1138 	uint8_t sta_index;
1139 
1140 	/* Do it in a process context. */
1141 	sta_index = ((struct athn_node *)ni)->sta_index;
1142 	athn_usb_do_async(usc, athn_usb_node_leave_cb,
1143 	    &sta_index, sizeof(sta_index));
1144 }
1145 
1146 void
1147 athn_usb_node_leave_cb(struct athn_usb_softc *usc, void *arg)
1148 {
1149 	uint8_t sta_index = *(uint8_t *)arg;
1150 
1151 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1152 	    &sta_index, sizeof(sta_index), NULL);
1153 	usc->nnodes--;
1154 }
1155 
1156 int
1157 athn_usb_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
1158     uint8_t tid)
1159 {
1160 	struct athn_usb_softc *usc = ic->ic_softc;
1161 	struct athn_node *an = (struct athn_node *)ni;
1162 	struct athn_usb_aggr_cmd cmd;
1163 
1164 	/* Do it in a process context. */
1165 	cmd.sta_index = an->sta_index;
1166 	cmd.tid = tid;
1167 	athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, sizeof(cmd));
1168 	return (0);
1169 }
1170 
1171 void
1172 athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *usc, void *arg)
1173 {
1174 	struct athn_usb_aggr_cmd *cmd = arg;
1175 	struct ar_htc_target_aggr aggr;
1176 
1177 	memset(&aggr, 0, sizeof(aggr));
1178 	aggr.sta_index = cmd->sta_index;
1179 	aggr.tidno = cmd->tid;
1180 	aggr.aggr_enable = 1;
1181 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1182 	    &aggr, sizeof(aggr), NULL);
1183 }
1184 
1185 void
1186 athn_usb_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
1187     uint8_t tid)
1188 {
1189 	struct athn_usb_softc *usc = ic->ic_softc;
1190 	struct athn_node *an = (struct athn_node *)ni;
1191 	struct athn_usb_aggr_cmd cmd;
1192 
1193 	/* Do it in a process context. */
1194 	cmd.sta_index = an->sta_index;
1195 	cmd.tid = tid;
1196 	athn_usb_do_async(usc, athn_usb_ampdu_tx_stop_cb, &cmd, sizeof(cmd));
1197 }
1198 
1199 void
1200 athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *usc, void *arg)
1201 {
1202 	struct athn_usb_aggr_cmd *cmd = arg;
1203 	struct ar_htc_target_aggr aggr;
1204 
1205 	memset(&aggr, 0, sizeof(aggr));
1206 	aggr.sta_index = cmd->sta_index;
1207 	aggr.tidno = cmd->tid;
1208 	aggr.aggr_enable = 0;
1209 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1210 	    &aggr, sizeof(aggr), NULL);
1211 }
1212 
1213 int
1214 athn_usb_create_node(struct athn_usb_softc *usc, struct ieee80211_node *ni)
1215 {
1216 	struct athn_node *an = (struct athn_node *)ni;
1217 	struct ar_htc_target_sta sta;
1218 	struct ar_htc_target_rate rate;
1219 	int error, i, j;
1220 
1221 	/* Firmware cannot handle more than 8 STAs. */
1222 	if (usc->nnodes > AR_USB_MAX_STA)
1223 		return ENOBUFS;
1224 
1225 	an->sta_index = IEEE80211_AID(ni->ni_associd);
1226 
1227 	/* Create node entry on target. */
1228 	memset(&sta, 0, sizeof(sta));
1229 	IEEE80211_ADDR_COPY(sta.macaddr, ni->ni_macaddr);
1230 	IEEE80211_ADDR_COPY(sta.bssid, ni->ni_bssid);
1231 	sta.associd = htobe16(ni->ni_associd);
1232 	sta.valid = 1;
1233 	sta.sta_index = an->sta_index;
1234 	sta.maxampdu = 0xffff;
1235 	if (ni->ni_flags & IEEE80211_NODE_HT)
1236 		sta.flags |= htobe16(AR_HTC_STA_HT);
1237 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
1238 	    &sta, sizeof(sta), NULL);
1239 	if (error != 0)
1240 		return (error);
1241 	usc->nnodes++;
1242 
1243 	/* Setup supported rates. */
1244 	memset(&rate, 0, sizeof(rate));
1245 	rate.sta_index = sta.sta_index;
1246 	rate.isnew = 1;
1247 	rate.lg_rates.rs_nrates = ni->ni_rates.rs_nrates;
1248 	memcpy(rate.lg_rates.rs_rates, ni->ni_rates.rs_rates,
1249 	    ni->ni_rates.rs_nrates);
1250 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1251 		rate.capflags |= htobe32(AR_RC_HT_FLAG);
1252 		/* Setup HT rates. */
1253 		for (i = 0, j = 0; i < IEEE80211_HT_NUM_MCS; i++) {
1254 			if (!isset(ni->ni_rxmcs, i))
1255 				continue;
1256 			if (j >= AR_HTC_RATE_MAX)
1257 				break;
1258 			rate.ht_rates.rs_rates[j++] = i;
1259 		}
1260 		rate.ht_rates.rs_nrates = j;
1261 
1262 		if (ni->ni_rxmcs[1]) /* dual-stream MIMO rates */
1263 			rate.capflags |= htobe32(AR_RC_DS_FLAG);
1264 #ifdef notyet
1265 		if (ni->ni_htcaps & IEEE80211_HTCAP_CBW20_40)
1266 			rate.capflags |= htobe32(AR_RC_40_FLAG);
1267 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI40)
1268 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1269 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI20)
1270 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1271 #endif
1272 	}
1273 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_RC_RATE_UPDATE,
1274 	    &rate, sizeof(rate), NULL);
1275 	return (error);
1276 }
1277 
1278 void
1279 athn_usb_rx_enable(struct athn_softc *sc)
1280 {
1281 	AR_WRITE(sc, AR_CR, AR_CR_RXE);
1282 	AR_WRITE_BARRIER(sc);
1283 }
1284 
1285 int
1286 athn_usb_switch_chan(struct athn_softc *sc, struct ieee80211_channel *c,
1287     struct ieee80211_channel *extc)
1288 {
1289 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
1290 	uint16_t mode;
1291 	int error;
1292 
1293 	/* Disable interrupts. */
1294 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1295 	if (error != 0)
1296 		goto reset;
1297 	/* Stop all Tx queues. */
1298 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
1299 	if (error != 0)
1300 		goto reset;
1301 	/* Stop Rx. */
1302 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
1303 	if (error != 0)
1304 		goto reset;
1305 
1306 	/* If band or bandwidth changes, we need to do a full reset. */
1307 	if (c->ic_flags != sc->curchan->ic_flags ||
1308 	    ((extc != NULL) ^ (sc->curchanext != NULL))) {
1309 		DPRINTFN(2, ("channel band switch\n"));
1310 		goto reset;
1311 	}
1312 
1313 	error = athn_set_chan(sc, c, extc);
1314 	if (AR_SREV_9271(sc) && error == 0)
1315 		ar9271_load_ani(sc);
1316 	if (error != 0) {
1317  reset:		/* Error found, try a full reset. */
1318 		DPRINTFN(3, ("needs a full reset\n"));
1319 		error = athn_hw_reset(sc, c, extc, 0);
1320 		if (error != 0)	/* Hopeless case. */
1321 			return (error);
1322 	}
1323 
1324 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
1325 	if (error != 0)
1326 		return (error);
1327 	athn_rx_start(sc);
1328 
1329 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(c) ?
1330 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
1331 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
1332 	    &mode, sizeof(mode), NULL);
1333 	if (error != 0)
1334 		return (error);
1335 
1336 	/* Re-enable interrupts. */
1337 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ENABLE_INTR);
1338 	return (error);
1339 }
1340 
1341 void
1342 athn_usb_updateedca(struct ieee80211com *ic)
1343 {
1344 	struct athn_usb_softc *usc = ic->ic_softc;
1345 
1346 	/* Do it in a process context. */
1347 	athn_usb_do_async(usc, athn_usb_updateedca_cb, NULL, 0);
1348 }
1349 
1350 void
1351 athn_usb_updateedca_cb(struct athn_usb_softc *usc, void *arg)
1352 {
1353 	int s;
1354 
1355 	s = splnet();
1356 	athn_updateedca(&usc->sc_sc.sc_ic);
1357 	splx(s);
1358 }
1359 
1360 void
1361 athn_usb_updateslot(struct ieee80211com *ic)
1362 {
1363 	struct athn_usb_softc *usc = ic->ic_softc;
1364 
1365 	return;	/* XXX */
1366 	/* Do it in a process context. */
1367 	athn_usb_do_async(usc, athn_usb_updateslot_cb, NULL, 0);
1368 }
1369 
1370 void
1371 athn_usb_updateslot_cb(struct athn_usb_softc *usc, void *arg)
1372 {
1373 	int s;
1374 
1375 	s = splnet();
1376 	athn_updateslot(&usc->sc_sc.sc_ic);
1377 	splx(s);
1378 }
1379 
1380 int
1381 athn_usb_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1382     struct ieee80211_key *k)
1383 {
1384 	struct athn_usb_softc *usc = ic->ic_softc;
1385 	struct athn_usb_cmd_key cmd;
1386 
1387 	/* Defer setting of WEP keys until interface is brought up. */
1388 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
1389 	    (IFF_UP | IFF_RUNNING))
1390 		return (0);
1391 
1392 	/* Do it in a process context. */
1393 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1394 	cmd.key = k;
1395 	athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, sizeof(cmd));
1396 	return (0);
1397 }
1398 
1399 void
1400 athn_usb_set_key_cb(struct athn_usb_softc *usc, void *arg)
1401 {
1402 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1403 	struct athn_usb_cmd_key *cmd = arg;
1404 	int s;
1405 
1406 	s = splnet();
1407 	athn_set_key(ic, cmd->ni, cmd->key);
1408 	if (cmd->ni != NULL)
1409 		ieee80211_release_node(ic, cmd->ni);
1410 	splx(s);
1411 }
1412 
1413 void
1414 athn_usb_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1415     struct ieee80211_key *k)
1416 {
1417 	struct athn_usb_softc *usc = ic->ic_softc;
1418 	struct athn_usb_cmd_key cmd;
1419 
1420 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
1421 	    ic->ic_state != IEEE80211_S_RUN)
1422 		return;	/* Nothing to do. */
1423 
1424 	/* Do it in a process context. */
1425 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1426 	cmd.key = k;
1427 	athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, sizeof(cmd));
1428 }
1429 
1430 void
1431 athn_usb_delete_key_cb(struct athn_usb_softc *usc, void *arg)
1432 {
1433 	struct ieee80211com *ic = &usc->sc_sc.sc_ic;
1434 	struct athn_usb_cmd_key *cmd = arg;
1435 	int s;
1436 
1437 	s = splnet();
1438 	athn_delete_key(ic, cmd->ni, cmd->key);
1439 	if (cmd->ni != NULL)
1440 		ieee80211_release_node(ic, cmd->ni);
1441 	splx(s);
1442 }
1443 
1444 #ifndef IEEE80211_STA_ONLY
1445 void
1446 athn_usb_bcneof(struct usbd_xfer *xfer, void *priv,
1447     usbd_status status)
1448 {
1449 	struct athn_usb_tx_data *data = priv;
1450 	struct athn_usb_softc *usc = data->sc;
1451 
1452 	if (__predict_false(status == USBD_STALLED))
1453 		usbd_clear_endpoint_stall_async(usc->tx_data_pipe);
1454 	usc->tx_bcn = data;
1455 }
1456 
1457 /*
1458  * Process Software Beacon Alert interrupts.
1459  */
1460 void
1461 athn_usb_swba(struct athn_usb_softc *usc)
1462 {
1463 	struct athn_softc *sc = &usc->sc_sc;
1464 	struct ieee80211com *ic = &sc->sc_ic;
1465 	struct athn_usb_tx_data *data;
1466 	struct ieee80211_frame *wh;
1467 	struct ar_stream_hdr *hdr;
1468 	struct ar_htc_frame_hdr *htc;
1469 	struct ar_tx_bcn *bcn;
1470 	struct mbuf *m;
1471 	int error;
1472 
1473 	if (ic->ic_dtim_count == 0)
1474 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1475 	else
1476 		ic->ic_dtim_count--;
1477 
1478 	/* Make sure previous beacon has been sent. */
1479 	if (usc->tx_bcn == NULL)
1480 		return;
1481 	data = usc->tx_bcn;
1482 
1483 	/* Get new beacon. */
1484 	m = ieee80211_beacon_alloc(ic, ic->ic_bss);
1485 	if (__predict_false(m == NULL))
1486 		return;
1487 	/* Assign sequence number. */
1488 	wh = mtod(m, struct ieee80211_frame *);
1489 	*(uint16_t *)&wh->i_seq[0] =
1490 	    htole16(ic->ic_bss->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
1491 	ic->ic_bss->ni_txseq++;
1492 
1493 	hdr = (struct ar_stream_hdr *)data->buf;
1494 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1495 	hdr->len = htole16(sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len);
1496 
1497 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1498 	memset(htc, 0, sizeof(*htc));
1499 	htc->endpoint_id = usc->ep_bcn;
1500 	htc->payload_len = htobe16(sizeof(*bcn) + m->m_pkthdr.len);
1501 
1502 	bcn = (struct ar_tx_bcn *)&htc[1];
1503 	memset(bcn, 0, sizeof(*bcn));
1504 	bcn->vif_idx = 0;
1505 
1506 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&bcn[1]);
1507 
1508 	usbd_setup_xfer(data->xfer, usc->tx_data_pipe, data, data->buf,
1509 	    sizeof(*hdr) + sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len,
1510 	    USBD_SHORT_XFER_OK | USBD_NO_COPY, ATHN_USB_TX_TIMEOUT,
1511 	    athn_usb_bcneof);
1512 
1513 	m_freem(m);
1514 	usc->tx_bcn = NULL;
1515 	error = usbd_transfer(data->xfer);
1516 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
1517 		usc->tx_bcn = data;
1518 }
1519 #endif
1520 
1521 void
1522 athn_usb_rx_wmi_ctrl(struct athn_usb_softc *usc, uint8_t *buf, int len)
1523 {
1524 	struct ar_wmi_cmd_hdr *wmi;
1525 	struct ar_wmi_evt_txrate *txrate;
1526 	uint16_t cmd_id;
1527 
1528 	if (__predict_false(len < sizeof(*wmi)))
1529 		return;
1530 	wmi = (struct ar_wmi_cmd_hdr *)buf;
1531 	cmd_id = betoh16(wmi->cmd_id);
1532 
1533 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
1534 		if (usc->wait_cmd_id != cmd_id)
1535 			return;	/* Unexpected reply. */
1536 		if (usc->obuf != NULL) {
1537 			/* Copy answer into caller supplied buffer. */
1538 			memcpy(usc->obuf, &wmi[1], len - sizeof(*wmi));
1539 		}
1540 		/* Notify caller of completion. */
1541 		wakeup(&usc->wait_cmd_id);
1542 		return;
1543 	}
1544 	switch (cmd_id & 0xfff) {
1545 #ifndef IEEE80211_STA_ONLY
1546 	case AR_WMI_EVT_SWBA:
1547 		athn_usb_swba(usc);
1548 		break;
1549 #endif
1550 	case AR_WMI_EVT_TXRATE:
1551 		txrate = (struct ar_wmi_evt_txrate *)&wmi[1];
1552 		DPRINTF(("txrate=%d\n", betoh32(txrate->txrate)));
1553 		break;
1554 	case AR_WMI_EVT_FATAL:
1555 		printf("%s: fatal firmware error\n", usc->usb_dev.dv_xname);
1556 		break;
1557 	default:
1558 		DPRINTF(("WMI event %d ignored\n", cmd_id));
1559 		break;
1560 	}
1561 }
1562 
1563 void
1564 athn_usb_intr(struct usbd_xfer *xfer, void *priv,
1565     usbd_status status)
1566 {
1567 	struct athn_usb_softc *usc = priv;
1568 	struct ar_htc_frame_hdr *htc;
1569 	struct ar_htc_msg_hdr *msg;
1570 	uint8_t *buf = usc->ibuf;
1571 	uint16_t msg_id;
1572 	int len;
1573 
1574 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1575 		DPRINTF(("intr status=%d\n", status));
1576 		if (status == USBD_STALLED)
1577 			usbd_clear_endpoint_stall_async(usc->rx_intr_pipe);
1578 		else if (status == USBD_IOERROR) {
1579 			/*
1580 			 * The device has gone away. If async commands are
1581 			 * pending or running ensure the device dies ASAP
1582 			 * and any blocked processes are woken up.
1583 			 */
1584 			if (usc->cmdq.queued > 0)
1585 				usbd_deactivate(usc->sc_udev);
1586 		}
1587 		return;
1588 	}
1589 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1590 
1591 	/* Skip watchdog pattern if present. */
1592 	if (len >= 4 && *(uint32_t *)buf == htobe32(0x00c60000)) {
1593 		buf += 4;
1594 		len -= 4;
1595 	}
1596 	if (__predict_false(len < sizeof(*htc)))
1597 		return;
1598 	htc = (struct ar_htc_frame_hdr *)buf;
1599 	/* Skip HTC header. */
1600 	buf += sizeof(*htc);
1601 	len -= sizeof(*htc);
1602 
1603 	if (htc->endpoint_id != 0) {
1604 		if (__predict_false(htc->endpoint_id != usc->ep_ctrl))
1605 			return;
1606 		/* Remove trailer if present. */
1607 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
1608 			if (__predict_false(len < htc->control[0]))
1609 				return;
1610 			len -= htc->control[0];
1611 		}
1612 		athn_usb_rx_wmi_ctrl(usc, buf, len);
1613 		return;
1614 	}
1615 	/* Endpoint 0 carries HTC messages. */
1616 	if (__predict_false(len < sizeof(*msg)))
1617 		return;
1618 	msg = (struct ar_htc_msg_hdr *)buf;
1619 	msg_id = betoh16(msg->msg_id);
1620 	DPRINTF(("Rx HTC message %d\n", msg_id));
1621 	switch (msg_id) {
1622 	case AR_HTC_MSG_READY:
1623 		if (usc->wait_msg_id != msg_id)
1624 			break;
1625 		usc->wait_msg_id = 0;
1626 		wakeup(&usc->wait_msg_id);
1627 		break;
1628 	case AR_HTC_MSG_CONN_SVC_RSP:
1629 		if (usc->wait_msg_id != msg_id)
1630 			break;
1631 		if (usc->msg_conn_svc_rsp != NULL) {
1632 			memcpy(usc->msg_conn_svc_rsp, &msg[1],
1633 			    sizeof(struct ar_htc_msg_conn_svc_rsp));
1634 		}
1635 		usc->wait_msg_id = 0;
1636 		wakeup(&usc->wait_msg_id);
1637 		break;
1638 	case AR_HTC_MSG_CONF_PIPE_RSP:
1639 		if (usc->wait_msg_id != msg_id)
1640 			break;
1641 		usc->wait_msg_id = 0;
1642 		wakeup(&usc->wait_msg_id);
1643 		break;
1644 	default:
1645 		DPRINTF(("HTC message %d ignored\n", msg_id));
1646 		break;
1647 	}
1648 }
1649 
1650 #if NBPFILTER > 0
1651 void
1652 athn_usb_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
1653     struct ar_rx_status *rs)
1654 {
1655 #define IEEE80211_RADIOTAP_F_SHORTGI	0x80	/* XXX from FBSD */
1656 
1657 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
1658 	struct ieee80211com *ic = &sc->sc_ic;
1659 	struct mbuf mb;
1660 	uint8_t rate;
1661 
1662 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1663 	tap->wr_tsft = htole64(betoh64(rs->rs_tstamp));
1664 	tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1665 	tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1666 	tap->wr_dbm_antsignal = rs->rs_rssi;
1667 	/* XXX noise. */
1668 	tap->wr_antenna = rs->rs_antenna;
1669 	tap->wr_rate = 0;	/* In case it can't be found below. */
1670 	rate = rs->rs_rate;
1671 	if (rate & 0x80) {		/* HT. */
1672 		/* Bit 7 set means HT MCS instead of rate. */
1673 		tap->wr_rate = rate;
1674 		if (!(rs->rs_flags & AR_RXS_FLAG_GI))
1675 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
1676 
1677 	} else if (rate & 0x10) {	/* CCK. */
1678 		if (rate & 0x04)
1679 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1680 		switch (rate & ~0x14) {
1681 		case 0xb: tap->wr_rate =   2; break;
1682 		case 0xa: tap->wr_rate =   4; break;
1683 		case 0x9: tap->wr_rate =  11; break;
1684 		case 0x8: tap->wr_rate =  22; break;
1685 		}
1686 	} else {			/* OFDM. */
1687 		switch (rate) {
1688 		case 0xb: tap->wr_rate =  12; break;
1689 		case 0xf: tap->wr_rate =  18; break;
1690 		case 0xa: tap->wr_rate =  24; break;
1691 		case 0xe: tap->wr_rate =  36; break;
1692 		case 0x9: tap->wr_rate =  48; break;
1693 		case 0xd: tap->wr_rate =  72; break;
1694 		case 0x8: tap->wr_rate =  96; break;
1695 		case 0xc: tap->wr_rate = 108; break;
1696 		}
1697 	}
1698 	mb.m_data = (caddr_t)tap;
1699 	mb.m_len = sc->sc_rxtap_len;
1700 	mb.m_next = m;
1701 	mb.m_nextpkt = NULL;
1702 	mb.m_type = 0;
1703 	mb.m_flags = 0;
1704 	bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1705 }
1706 #endif
1707 
1708 void
1709 athn_usb_rx_frame(struct athn_usb_softc *usc, struct mbuf *m)
1710 {
1711 	struct athn_softc *sc = &usc->sc_sc;
1712 	struct ieee80211com *ic = &sc->sc_ic;
1713 	struct ifnet *ifp = &ic->ic_if;
1714 	struct ieee80211_frame *wh;
1715 	struct ieee80211_node *ni;
1716 	struct ieee80211_rxinfo rxi;
1717 	struct ar_htc_frame_hdr *htc;
1718 	struct ar_rx_status *rs;
1719 	uint16_t datalen;
1720 	int s;
1721 
1722 	if (__predict_false(m->m_len < sizeof(*htc)))
1723 		goto skip;
1724 	htc = mtod(m, struct ar_htc_frame_hdr *);
1725 	if (__predict_false(htc->endpoint_id == 0)) {
1726 		DPRINTF(("bad endpoint %d\n", htc->endpoint_id));
1727 		goto skip;
1728 	}
1729 	if (htc->flags & AR_HTC_FLAG_TRAILER) {
1730 		if (m->m_len < htc->control[0])
1731 			goto skip;
1732 		m_adj(m, -(int)htc->control[0]);
1733 	}
1734 	m_adj(m, sizeof(*htc));	/* Strip HTC header. */
1735 
1736 	if (__predict_false(m->m_len < sizeof(*rs)))
1737 		goto skip;
1738 	rs = mtod(m, struct ar_rx_status *);
1739 
1740 	/* Make sure that payload fits. */
1741 	datalen = betoh16(rs->rs_datalen);
1742 	if (__predict_false(m->m_len < sizeof(*rs) + datalen))
1743 		goto skip;
1744 
1745 	if (__predict_false(datalen < sizeof(*wh) + IEEE80211_CRC_LEN))
1746 		goto skip;
1747 
1748 	m_adj(m, sizeof(*rs));	/* Strip Rx status. */
1749 
1750 	s = splnet();
1751 
1752 	/* Grab a reference to the source node. */
1753 	wh = mtod(m, struct ieee80211_frame *);
1754 	ni = ieee80211_find_rxnode(ic, wh);
1755 
1756 	/* Remove any HW padding after the 802.11 header. */
1757 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
1758 		u_int hdrlen = ieee80211_get_hdrlen(wh);
1759 		if (hdrlen & 3) {
1760 			memmove((caddr_t)wh + 2, wh, hdrlen);
1761 			m_adj(m, 2);
1762 		}
1763 	}
1764 #if NBPFILTER > 0
1765 	if (__predict_false(sc->sc_drvbpf != NULL))
1766 		athn_usb_rx_radiotap(sc, m, rs);
1767 #endif
1768 	/* Trim 802.11 FCS after radiotap. */
1769 	m_adj(m, -IEEE80211_CRC_LEN);
1770 
1771 	/* Send the frame to the 802.11 layer. */
1772 	rxi.rxi_flags = 0;
1773 	rxi.rxi_rssi = rs->rs_rssi + AR_USB_DEFAULT_NF;
1774 	rxi.rxi_tstamp = betoh64(rs->rs_tstamp);
1775 	ieee80211_input(ifp, m, ni, &rxi);
1776 
1777 	/* Node is no longer needed. */
1778 	ieee80211_release_node(ic, ni);
1779 	splx(s);
1780 	return;
1781  skip:
1782 	m_freem(m);
1783 }
1784 
1785 void
1786 athn_usb_rxeof(struct usbd_xfer *xfer, void *priv,
1787     usbd_status status)
1788 {
1789 	struct athn_usb_rx_data *data = priv;
1790 	struct athn_usb_softc *usc = data->sc;
1791 	struct athn_softc *sc = &usc->sc_sc;
1792 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1793 	struct athn_usb_rx_stream *stream = &usc->rx_stream;
1794 	uint8_t *buf = data->buf;
1795 	struct ar_stream_hdr *hdr;
1796 	struct mbuf *m;
1797 	uint16_t pktlen;
1798 	int off, len;
1799 
1800 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1801 		DPRINTF(("RX status=%d\n", status));
1802 		if (status == USBD_STALLED)
1803 			usbd_clear_endpoint_stall_async(usc->rx_data_pipe);
1804 		if (status != USBD_CANCELLED)
1805 			goto resubmit;
1806 		return;
1807 	}
1808 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1809 
1810 	if (stream->left > 0) {
1811 		if (len >= stream->left) {
1812 			/* We have all our pktlen bytes now. */
1813 			if (__predict_true(stream->m != NULL)) {
1814 				memcpy(mtod(stream->m, uint8_t *) +
1815 				    stream->moff, buf, stream->left);
1816 				athn_usb_rx_frame(usc, stream->m);
1817 				stream->m = NULL;
1818 			}
1819 			/* Next header is 32-bit aligned. */
1820 			off = (stream->left + 3) & ~3;
1821 			buf += off;
1822 			len -= off;
1823 			stream->left = 0;
1824 		} else {
1825 			/* Still need more bytes, save what we have. */
1826 			if (__predict_true(stream->m != NULL)) {
1827 				memcpy(mtod(stream->m, uint8_t *) +
1828 				    stream->moff, buf, len);
1829 				stream->moff += len;
1830 			}
1831 			stream->left -= len;
1832 			goto resubmit;
1833 		}
1834 	}
1835 	KASSERT(stream->left == 0);
1836 	while (len >= sizeof(*hdr)) {
1837 		hdr = (struct ar_stream_hdr *)buf;
1838 		if (hdr->tag != htole16(AR_USB_RX_STREAM_TAG)) {
1839 			DPRINTF(("invalid tag 0x%x\n", hdr->tag));
1840 			break;
1841 		}
1842 		pktlen = letoh16(hdr->len);
1843 		buf += sizeof(*hdr);
1844 		len -= sizeof(*hdr);
1845 
1846 		if (__predict_true(pktlen <= MCLBYTES)) {
1847 			/* Allocate an mbuf to store the next pktlen bytes. */
1848 			MGETHDR(m, M_DONTWAIT, MT_DATA);
1849 			if (__predict_true(m != NULL)) {
1850 				m->m_pkthdr.len = m->m_len = pktlen;
1851 				if (pktlen > MHLEN) {
1852 					MCLGET(m, M_DONTWAIT);
1853 					if (!(m->m_flags & M_EXT)) {
1854 						m_free(m);
1855 						m = NULL;
1856 					}
1857 				}
1858 			}
1859 		} else	/* Drop frames larger than MCLBYTES. */
1860 			m = NULL;
1861 
1862 		if (m == NULL)
1863 			ifp->if_ierrors++;
1864 
1865 		/*
1866 		 * NB: m can be NULL, in which case the next pktlen bytes
1867 		 * will be discarded from the Rx stream.
1868 		 */
1869 		if (pktlen > len) {
1870 			/* Need more bytes, save what we have. */
1871 			stream->m = m;	/* NB: m can be NULL. */
1872 			if (__predict_true(stream->m != NULL)) {
1873 				memcpy(mtod(stream->m, uint8_t *), buf, len);
1874 				stream->moff = len;
1875 			}
1876 			stream->left = pktlen - len;
1877 			goto resubmit;
1878 		}
1879 		if (__predict_true(m != NULL)) {
1880 			/* We have all the pktlen bytes in this xfer. */
1881 			memcpy(mtod(m, uint8_t *), buf, pktlen);
1882 			athn_usb_rx_frame(usc, m);
1883 		}
1884 
1885 		/* Next header is 32-bit aligned. */
1886 		off = (pktlen + 3) & ~3;
1887 		buf += off;
1888 		len -= off;
1889 	}
1890 
1891  resubmit:
1892 	/* Setup a new transfer. */
1893 	usbd_setup_xfer(xfer, usc->rx_data_pipe, data, data->buf,
1894 	    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
1895 	    USBD_NO_TIMEOUT, athn_usb_rxeof);
1896 	(void)usbd_transfer(xfer);
1897 }
1898 
1899 void
1900 athn_usb_txeof(struct usbd_xfer *xfer, void *priv,
1901     usbd_status status)
1902 {
1903 	struct athn_usb_tx_data *data = priv;
1904 	struct athn_usb_softc *usc = data->sc;
1905 	struct athn_softc *sc = &usc->sc_sc;
1906 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1907 	int s;
1908 
1909 	s = splnet();
1910 	/* Put this Tx buffer back to our free list. */
1911 	TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
1912 
1913 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
1914 		DPRINTF(("TX status=%d\n", status));
1915 		if (status == USBD_STALLED)
1916 			usbd_clear_endpoint_stall_async(usc->tx_data_pipe);
1917 		ifp->if_oerrors++;
1918 		splx(s);
1919 		/* XXX Why return? */
1920 		return;
1921 	}
1922 	sc->sc_tx_timer = 0;
1923 
1924 	/* We just released a Tx buffer, notify Tx. */
1925 	if (ifq_is_oactive(&ifp->if_snd)) {
1926 		ifq_clr_oactive(&ifp->if_snd);
1927 		ifp->if_start(ifp);
1928 	}
1929 	splx(s);
1930 }
1931 
1932 int
1933 athn_usb_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1934 {
1935 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
1936 	struct athn_node *an = (struct athn_node *)ni;
1937 	struct ieee80211com *ic = &sc->sc_ic;
1938 	struct ieee80211_frame *wh;
1939 	struct ieee80211_key *k = NULL;
1940 	struct athn_usb_tx_data *data;
1941 	struct ar_stream_hdr *hdr;
1942 	struct ar_htc_frame_hdr *htc;
1943 	struct ar_tx_frame *txf;
1944 	struct ar_tx_mgmt *txm;
1945 	uint8_t *frm;
1946 	uint16_t qos;
1947 	uint8_t sta_index, qid, tid = 0;
1948 	int hasqos, xferlen, error;
1949 
1950 	wh = mtod(m, struct ieee80211_frame *);
1951 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1952 		k = ieee80211_get_txkey(ic, wh, ni);
1953 		if ((m = ieee80211_encrypt(ic, m, k)) == NULL)
1954 			return (ENOBUFS);
1955 		wh = mtod(m, struct ieee80211_frame *);
1956 	}
1957 	if ((hasqos = ieee80211_has_qos(wh))) {
1958 		qos = ieee80211_get_qos(wh);
1959 		tid = qos & IEEE80211_QOS_TID;
1960 		qid = ieee80211_up_to_ac(ic, tid);
1961 	} else
1962 		qid = EDCA_AC_BE;
1963 
1964 	/* Grab a Tx buffer from our free list. */
1965 	data = TAILQ_FIRST(&usc->tx_free_list);
1966 	TAILQ_REMOVE(&usc->tx_free_list, data, next);
1967 
1968 #if NBPFILTER > 0
1969 	/* XXX Change radiotap Tx header for USB (no txrate). */
1970 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1971 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
1972 		struct mbuf mb;
1973 
1974 		tap->wt_flags = 0;
1975 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1976 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1977 		mb.m_data = (caddr_t)tap;
1978 		mb.m_len = sc->sc_txtap_len;
1979 		mb.m_next = m;
1980 		mb.m_nextpkt = NULL;
1981 		mb.m_type = 0;
1982 		mb.m_flags = 0;
1983 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1984 	}
1985 #endif
1986 	sta_index = an->sta_index;
1987 
1988 	/* NB: We don't take advantage of USB Tx stream mode for now. */
1989 	hdr = (struct ar_stream_hdr *)data->buf;
1990 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1991 
1992 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1993 	memset(htc, 0, sizeof(*htc));
1994 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1995 	    IEEE80211_FC0_TYPE_DATA) {
1996 		htc->endpoint_id = usc->ep_data[qid];
1997 
1998 		txf = (struct ar_tx_frame *)&htc[1];
1999 		memset(txf, 0, sizeof(*txf));
2000 		txf->data_type = AR_HTC_NORMAL;
2001 		txf->node_idx = sta_index;
2002 		txf->vif_idx = 0;
2003 		txf->tid = tid;
2004 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
2005 			txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2006 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2007 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2008 				txf->flags |= htobe32(AR_HTC_TX_CTSONLY);
2009 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2010 				txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2011 		}
2012 		txf->key_idx = 0xff;
2013 		frm = (uint8_t *)&txf[1];
2014 	} else {
2015 		htc->endpoint_id = usc->ep_mgmt;
2016 
2017 		txm = (struct ar_tx_mgmt *)&htc[1];
2018 		memset(txm, 0, sizeof(*txm));
2019 		txm->node_idx = sta_index;
2020 		txm->vif_idx = 0;
2021 		txm->key_idx = 0xff;
2022 		frm = (uint8_t *)&txm[1];
2023 	}
2024 	/* Copy payload. */
2025 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)frm);
2026 	frm += m->m_pkthdr.len;
2027 	m_freem(m);
2028 
2029 	/* Finalize headers. */
2030 	htc->payload_len = htobe16(frm - (uint8_t *)&htc[1]);
2031 	hdr->len = htole16(frm - (uint8_t *)&hdr[1]);
2032 	xferlen = frm - data->buf;
2033 
2034 	usbd_setup_xfer(data->xfer, usc->tx_data_pipe, data, data->buf,
2035 	    xferlen, USBD_FORCE_SHORT_XFER | USBD_NO_COPY, ATHN_USB_TX_TIMEOUT,
2036 	    athn_usb_txeof);
2037 	error = usbd_transfer(data->xfer);
2038 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
2039 		/* Put this Tx buffer back to our free list. */
2040 		TAILQ_INSERT_TAIL(&usc->tx_free_list, data, next);
2041 		return (error);
2042 	}
2043 	ieee80211_release_node(ic, ni);
2044 	return (0);
2045 }
2046 
2047 void
2048 athn_usb_start(struct ifnet *ifp)
2049 {
2050 	struct athn_softc *sc = ifp->if_softc;
2051 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2052 	struct ieee80211com *ic = &sc->sc_ic;
2053 	struct ieee80211_node *ni;
2054 	struct mbuf *m;
2055 
2056 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
2057 		return;
2058 
2059 	for (;;) {
2060 		if (TAILQ_EMPTY(&usc->tx_free_list)) {
2061 			ifq_set_oactive(&ifp->if_snd);
2062 			break;
2063 		}
2064 		/* Send pending management frames first. */
2065 		m = mq_dequeue(&ic->ic_mgtq);
2066 		if (m != NULL) {
2067 			ni = m->m_pkthdr.ph_cookie;
2068 			goto sendit;
2069 		}
2070 		if (ic->ic_state != IEEE80211_S_RUN)
2071 			break;
2072 
2073 		/* Encapsulate and send data frames. */
2074 		IFQ_DEQUEUE(&ifp->if_snd, m);
2075 		if (m == NULL)
2076 			break;
2077 #if NBPFILTER > 0
2078 		if (ifp->if_bpf != NULL)
2079 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
2080 #endif
2081 		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
2082 			continue;
2083  sendit:
2084 #if NBPFILTER > 0
2085 		if (ic->ic_rawbpf != NULL)
2086 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
2087 #endif
2088 		if (athn_usb_tx(sc, m, ni) != 0) {
2089 			ieee80211_release_node(ic, ni);
2090 			ifp->if_oerrors++;
2091 			continue;
2092 		}
2093 
2094 		sc->sc_tx_timer = 5;
2095 		ifp->if_timer = 1;
2096 	}
2097 }
2098 
2099 void
2100 athn_usb_watchdog(struct ifnet *ifp)
2101 {
2102 	struct athn_softc *sc = ifp->if_softc;
2103 
2104 	ifp->if_timer = 0;
2105 
2106 	if (sc->sc_tx_timer > 0) {
2107 		if (--sc->sc_tx_timer == 0) {
2108 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2109 			/* athn_usb_init(ifp); XXX needs a process context! */
2110 			ifp->if_oerrors++;
2111 			return;
2112 		}
2113 		ifp->if_timer = 1;
2114 	}
2115 	ieee80211_watchdog(ifp);
2116 }
2117 
2118 int
2119 athn_usb_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2120 {
2121 	struct athn_softc *sc = ifp->if_softc;
2122 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2123 	struct ieee80211com *ic = &sc->sc_ic;
2124 	int s, error = 0;
2125 
2126 	if (usbd_is_dying(usc->sc_udev))
2127 		return ENXIO;
2128 
2129 	usbd_ref_incr(usc->sc_udev);
2130 
2131 	s = splnet();
2132 
2133 	switch (cmd) {
2134 	case SIOCSIFADDR:
2135 		ifp->if_flags |= IFF_UP;
2136 		/* FALLTHROUGH */
2137 	case SIOCSIFFLAGS:
2138 		if (ifp->if_flags & IFF_UP) {
2139 			if (!(ifp->if_flags & IFF_RUNNING))
2140 				error = athn_usb_init(ifp);
2141 		} else {
2142 			if (ifp->if_flags & IFF_RUNNING)
2143 				athn_usb_stop(ifp);
2144 		}
2145 		break;
2146 	case SIOCS80211CHANNEL:
2147 		error = ieee80211_ioctl(ifp, cmd, data);
2148 		if (error == ENETRESET &&
2149 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2150 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2151 			    (IFF_UP | IFF_RUNNING)) {
2152 				athn_usb_switch_chan(sc, ic->ic_ibss_chan,
2153 				    NULL);
2154 			}
2155 			error = 0;
2156 		}
2157 		break;
2158 	default:
2159 		error = ieee80211_ioctl(ifp, cmd, data);
2160 	}
2161 
2162 	if (error == ENETRESET) {
2163 		error = 0;
2164 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2165 		    (IFF_UP | IFF_RUNNING)) {
2166 			athn_usb_stop(ifp);
2167 			error = athn_usb_init(ifp);
2168 		}
2169 	}
2170 	splx(s);
2171 
2172 	usbd_ref_decr(usc->sc_udev);
2173 
2174 	return (error);
2175 }
2176 
2177 int
2178 athn_usb_init(struct ifnet *ifp)
2179 {
2180 	struct athn_softc *sc = ifp->if_softc;
2181 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2182 	struct athn_ops *ops = &sc->ops;
2183 	struct ieee80211com *ic = &sc->sc_ic;
2184 	struct ieee80211_channel *c, *extc;
2185 	struct athn_usb_rx_data *data;
2186 	struct ar_htc_target_vif hvif;
2187 	struct ar_htc_target_sta sta;
2188 	struct ar_htc_cap_target hic;
2189 	uint16_t mode;
2190 	int i, error;
2191 
2192 	/* Init host async commands ring. */
2193 	usc->cmdq.cur = usc->cmdq.next = usc->cmdq.queued = 0;
2194 
2195 	/* Allocate Tx/Rx buffers. */
2196 	error = athn_usb_alloc_rx_list(usc);
2197 	if (error != 0)
2198 		goto fail;
2199 	error = athn_usb_alloc_tx_list(usc);
2200 	if (error != 0)
2201 		goto fail;
2202 	/* Steal one buffer for beacons. */
2203 	usc->tx_bcn = TAILQ_FIRST(&usc->tx_free_list);
2204 	TAILQ_REMOVE(&usc->tx_free_list, usc->tx_bcn, next);
2205 
2206 	c = ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2207 	extc = NULL;
2208 
2209 	/* In case a new MAC address has been configured. */
2210 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2211 
2212 	error = athn_set_power_awake(sc);
2213 	if (error != 0)
2214 		goto fail;
2215 
2216 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_FLUSH_RECV);
2217 	if (error != 0)
2218 		goto fail;
2219 
2220 	error = athn_hw_reset(sc, c, extc, 1);
2221 	if (error != 0)
2222 		goto fail;
2223 
2224 	ops->set_txpower(sc, c, extc);
2225 
2226 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(c) ?
2227 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
2228 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
2229 	    &mode, sizeof(mode), NULL);
2230 	if (error != 0)
2231 		goto fail;
2232 
2233 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ATH_INIT);
2234 	if (error != 0)
2235 		goto fail;
2236 
2237 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
2238 	if (error != 0)
2239 		goto fail;
2240 
2241 	athn_rx_start(sc);
2242 
2243 	/* Create main interface on target. */
2244 	memset(&hvif, 0, sizeof(hvif));
2245 	hvif.index = 0;
2246 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2247 	switch (ic->ic_opmode) {
2248 	case IEEE80211_M_STA:
2249 		hvif.opmode = htobe32(AR_HTC_M_STA);
2250 		break;
2251 	case IEEE80211_M_MONITOR:
2252 		hvif.opmode = htobe32(AR_HTC_M_MONITOR);
2253 		break;
2254 #ifndef IEEE80211_STA_ONLY
2255 	case IEEE80211_M_IBSS:
2256 		hvif.opmode = htobe32(AR_HTC_M_IBSS);
2257 		break;
2258 	case IEEE80211_M_AHDEMO:
2259 		hvif.opmode = htobe32(AR_HTC_M_AHDEMO);
2260 		break;
2261 	case IEEE80211_M_HOSTAP:
2262 		hvif.opmode = htobe32(AR_HTC_M_HOSTAP);
2263 		break;
2264 #endif
2265 	}
2266 	hvif.rtsthreshold = htobe16(ic->ic_rtsthreshold);
2267 	DPRINTF(("creating VAP\n"));
2268 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_CREATE,
2269 	    &hvif, sizeof(hvif), NULL);
2270 	if (error != 0)
2271 		goto fail;
2272 
2273 	/* Create a fake node to send management frames before assoc. */
2274 	memset(&sta, 0, sizeof(sta));
2275 	IEEE80211_ADDR_COPY(sta.macaddr, ic->ic_myaddr);
2276 	sta.sta_index = 0;
2277 	sta.is_vif_sta = 1;
2278 	sta.vif_index = hvif.index;
2279 	sta.maxampdu = 0xffff;
2280 	DPRINTF(("creating default node\n"));
2281 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
2282 	    &sta, sizeof(sta), NULL);
2283 	if (error != 0)
2284 		goto fail;
2285 	usc->nnodes++;
2286 
2287 	/* Update target capabilities. */
2288 	memset(&hic, 0, sizeof(hic));
2289 	hic.flags = htobe32(0x400c2400);
2290 	hic.flags_ext = htobe32(0x00106080);
2291 	hic.ampdu_limit = htobe32(0x0000ffff);
2292 	hic.ampdu_subframes = 20;
2293 	hic.protmode = 1;	/* XXX */
2294 	hic.lg_txchainmask = sc->txchainmask;
2295 	hic.ht_txchainmask = sc->txchainmask;
2296 	DPRINTF(("updating target configuration\n"));
2297 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TARGET_IC_UPDATE,
2298 	    &hic, sizeof(hic), NULL);
2299 	if (error != 0)
2300 		goto fail;
2301 
2302 	/* Queue Rx xfers. */
2303 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
2304 		data = &usc->rx_data[i];
2305 
2306 		usbd_setup_xfer(data->xfer, usc->rx_data_pipe, data, data->buf,
2307 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
2308 		    USBD_NO_TIMEOUT, athn_usb_rxeof);
2309 		error = usbd_transfer(data->xfer);
2310 		if (error != 0 && error != USBD_IN_PROGRESS)
2311 			goto fail;
2312 	}
2313 	/* We're ready to go. */
2314 	ifp->if_flags |= IFF_RUNNING;
2315 	ifq_clr_oactive(&ifp->if_snd);
2316 
2317 #ifdef notyet
2318 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2319 		/* Install WEP keys. */
2320 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2321 			athn_usb_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2322 	}
2323 #endif
2324 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2325 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2326 	else
2327 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2328 	athn_usb_wait_async(usc);
2329 	return (0);
2330  fail:
2331 	athn_usb_stop(ifp);
2332 	return (error);
2333 }
2334 
2335 void
2336 athn_usb_stop(struct ifnet *ifp)
2337 {
2338 	struct athn_softc *sc = ifp->if_softc;
2339 	struct athn_usb_softc *usc = (struct athn_usb_softc *)sc;
2340 	struct ieee80211com *ic = &sc->sc_ic;
2341 	struct ar_htc_target_vif hvif;
2342 	uint8_t sta_index;
2343 	int s;
2344 
2345 	sc->sc_tx_timer = 0;
2346 	ifp->if_timer = 0;
2347 	ifp->if_flags &= ~IFF_RUNNING;
2348 	ifq_clr_oactive(&ifp->if_snd);
2349 
2350 	s = splusb();
2351 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2352 
2353 	/* Wait for all async commands to complete. */
2354 	athn_usb_wait_async(usc);
2355 
2356 	timeout_del(&sc->scan_to);
2357 	timeout_del(&sc->calib_to);
2358 
2359 	/* Remove main interface. */
2360 	memset(&hvif, 0, sizeof(hvif));
2361 	hvif.index = 0;
2362 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2363 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_REMOVE,
2364 	    &hvif, sizeof(hvif), NULL);
2365 	/* Remove default node. */
2366 	sta_index = 0;
2367 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
2368 	    &sta_index, sizeof(sta_index), NULL);
2369 	usc->nnodes--;
2370 
2371 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
2372 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
2373 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
2374 
2375 	athn_reset(sc, 0);
2376 	athn_init_pll(sc, NULL);
2377 	athn_set_power_awake(sc);
2378 	athn_reset(sc, 1);
2379 	athn_init_pll(sc, NULL);
2380 	athn_set_power_sleep(sc);
2381 
2382 	/* Abort Tx/Rx. */
2383 	usbd_abort_pipe(usc->tx_data_pipe);
2384 	usbd_abort_pipe(usc->rx_data_pipe);
2385 
2386 	/* Free Tx/Rx buffers. */
2387 	athn_usb_free_tx_list(usc);
2388 	athn_usb_free_rx_list(usc);
2389 	splx(s);
2390 
2391 	/* Flush Rx stream. */
2392 	m_freem(usc->rx_stream.m);
2393 	usc->rx_stream.m = NULL;
2394 	usc->rx_stream.left = 0;
2395 }
2396