xref: /openbsd-src/sys/dev/usb/if_uath.c (revision f79ee556e9e46e9a5a856c2be90b8430b83b910c)
1 /*	$OpenBSD: if_uath.c,v 1.65 2014/12/22 02:28:52 tedu Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*-
21  * Driver for Atheros AR5005UG/AR5005UX chipsets.
22  *
23  * IMPORTANT NOTICE:
24  * This driver was written without any documentation or support from Atheros
25  * Communications. It is based on a black-box analysis of the Windows binary
26  * driver. It handles both pre and post-firmware devices.
27  */
28 
29 #include "bpfilter.h"
30 
31 #include <sys/param.h>
32 #include <sys/sockio.h>
33 #include <sys/mbuf.h>
34 #include <sys/kernel.h>
35 #include <sys/socket.h>
36 #include <sys/systm.h>
37 #include <sys/timeout.h>
38 #include <sys/conf.h>
39 #include <sys/device.h>
40 #include <sys/endian.h>
41 
42 #include <machine/bus.h>
43 #include <machine/intr.h>
44 
45 #if NBPFILTER > 0
46 #include <net/bpf.h>
47 #endif
48 #include <net/if.h>
49 #include <net/if_arp.h>
50 #include <net/if_dl.h>
51 #include <net/if_media.h>
52 #include <net/if_types.h>
53 
54 #include <netinet/in.h>
55 #include <netinet/if_ether.h>
56 
57 #include <net80211/ieee80211_var.h>
58 #include <net80211/ieee80211_radiotap.h>
59 
60 #include <crypto/arc4.h>
61 
62 #include <dev/usb/usb.h>
63 #include <dev/usb/usbdi.h>
64 #include <dev/usb/usbdivar.h>	/* needs_reattach() */
65 #include <dev/usb/usbdi_util.h>
66 #include <dev/usb/usbdevs.h>
67 
68 #include <dev/usb/if_uathreg.h>
69 #include <dev/usb/if_uathvar.h>
70 
71 #ifdef UATH_DEBUG
72 #define DPRINTF(x)	do { if (uath_debug) printf x; } while (0)
73 #define DPRINTFN(n, x)	do { if (uath_debug >= (n)) printf x; } while (0)
74 int uath_debug = 1;
75 #else
76 #define DPRINTF(x)
77 #define DPRINTFN(n, x)
78 #endif
79 
80 /*-
81  * Various supported device vendors/products.
82  * UB51: AR5005UG 802.11b/g, UB52: AR5005UX 802.11a/b/g
83  */
84 #define UATH_DEV(v, p, f)						\
85 	{ { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, (f) },		\
86 	{ { USB_VENDOR_##v, USB_PRODUCT_##v##_##p##_NF },		\
87 	    (f) | UATH_FLAG_PRE_FIRMWARE }
88 #define UATH_DEV_UG(v, p)	UATH_DEV(v, p, 0)
89 #define UATH_DEV_UX(v, p)	UATH_DEV(v, p, UATH_FLAG_ABG)
90 static const struct uath_type {
91 	struct usb_devno	dev;
92 	unsigned int		flags;
93 #define UATH_FLAG_PRE_FIRMWARE	(1 << 0)
94 #define UATH_FLAG_ABG		(1 << 1)
95 } uath_devs[] = {
96 	UATH_DEV_UG(ACCTON,		SMCWUSBTG2),
97 	UATH_DEV_UG(ATHEROS,		AR5523),
98 	UATH_DEV_UG(ATHEROS2,		AR5523_1),
99 	UATH_DEV_UG(ATHEROS2,		AR5523_2),
100 	UATH_DEV_UX(ATHEROS2,		AR5523_3),
101 	UATH_DEV_UG(CONCEPTRONIC,	AR5523_1),
102 	UATH_DEV_UX(CONCEPTRONIC,	AR5523_2),
103 	UATH_DEV_UX(DLINK,		DWLAG122),
104 	UATH_DEV_UX(DLINK,		DWLAG132),
105 	UATH_DEV_UG(DLINK,		DWLG132),
106 	UATH_DEV_UG(DLINK2,		WUA2340),
107 	UATH_DEV_UG(GIGASET,		AR5523),
108 	UATH_DEV_UG(GIGASET,		SMCWUSBTG),
109 	UATH_DEV_UG(GLOBALSUN,		AR5523_1),
110 	UATH_DEV_UX(GLOBALSUN,		AR5523_2),
111 	UATH_DEV_UG(IODATA,		USBWNG54US),
112 	UATH_DEV_UG(MELCO,		WLIU2KAMG54),
113 	UATH_DEV_UX(NETGEAR,		WG111U),
114 	UATH_DEV_UG(NETGEAR3,		WG111T),
115 	UATH_DEV_UG(NETGEAR3,		WPN111),
116 	UATH_DEV_UG(PHILIPS,		SNU6500),
117 	UATH_DEV_UX(UMEDIA,		AR5523_2),
118 	UATH_DEV_UG(UMEDIA,		TEW444UBEU),
119 	UATH_DEV_UG(WISTRONNEWEB,	AR5523_1),
120 	UATH_DEV_UX(WISTRONNEWEB,	AR5523_2),
121 	UATH_DEV_UG(ZCOM,		AR5523)
122 };
123 #define uath_lookup(v, p)	\
124 	((const struct uath_type *)usb_lookup(uath_devs, v, p))
125 
126 void	uath_attachhook(void *);
127 int	uath_open_pipes(struct uath_softc *);
128 void	uath_close_pipes(struct uath_softc *);
129 int	uath_alloc_tx_data_list(struct uath_softc *);
130 void	uath_free_tx_data_list(struct uath_softc *);
131 int	uath_alloc_rx_data_list(struct uath_softc *);
132 void	uath_free_rx_data_list(struct uath_softc *);
133 int	uath_alloc_tx_cmd_list(struct uath_softc *);
134 void	uath_free_tx_cmd_list(struct uath_softc *);
135 int	uath_alloc_rx_cmd_list(struct uath_softc *);
136 void	uath_free_rx_cmd_list(struct uath_softc *);
137 int	uath_media_change(struct ifnet *);
138 void	uath_stat(void *);
139 void	uath_next_scan(void *);
140 void	uath_task(void *);
141 int	uath_newstate(struct ieee80211com *, enum ieee80211_state, int);
142 #ifdef UATH_DEBUG
143 void	uath_dump_cmd(const uint8_t *, int, char);
144 #endif
145 int	uath_cmd(struct uath_softc *, uint32_t, const void *, int, void *,
146 	    int);
147 int	uath_cmd_write(struct uath_softc *, uint32_t, const void *, int, int);
148 int	uath_cmd_read(struct uath_softc *, uint32_t, const void *, int, void *,
149 	    int);
150 int	uath_write_reg(struct uath_softc *, uint32_t, uint32_t);
151 int	uath_write_multi(struct uath_softc *, uint32_t, const void *, int);
152 int	uath_read_reg(struct uath_softc *, uint32_t, uint32_t *);
153 int	uath_read_eeprom(struct uath_softc *, uint32_t, void *);
154 void	uath_cmd_rxeof(struct usbd_xfer *, void *, usbd_status);
155 void	uath_data_rxeof(struct usbd_xfer *, void *, usbd_status);
156 void	uath_data_txeof(struct usbd_xfer *, void *, usbd_status);
157 int	uath_tx_null(struct uath_softc *);
158 int	uath_tx_data(struct uath_softc *, struct mbuf *,
159 	    struct ieee80211_node *);
160 void	uath_start(struct ifnet *);
161 void	uath_watchdog(struct ifnet *);
162 int	uath_ioctl(struct ifnet *, u_long, caddr_t);
163 int	uath_query_eeprom(struct uath_softc *);
164 int	uath_reset(struct uath_softc *);
165 int	uath_reset_tx_queues(struct uath_softc *);
166 int	uath_wme_init(struct uath_softc *);
167 int	uath_set_chan(struct uath_softc *, struct ieee80211_channel *);
168 int	uath_set_key(struct uath_softc *, const struct ieee80211_key *, int);
169 int	uath_set_keys(struct uath_softc *);
170 int	uath_set_rates(struct uath_softc *, const struct ieee80211_rateset *);
171 int	uath_set_rxfilter(struct uath_softc *, uint32_t, uint32_t);
172 int	uath_set_led(struct uath_softc *, int, int);
173 int	uath_switch_channel(struct uath_softc *, struct ieee80211_channel *);
174 int	uath_init(struct ifnet *);
175 void	uath_stop(struct ifnet *, int);
176 int	uath_loadfirmware(struct uath_softc *, const u_char *, int);
177 
178 int uath_match(struct device *, void *, void *);
179 void uath_attach(struct device *, struct device *, void *);
180 int uath_detach(struct device *, int);
181 
182 struct cfdriver uath_cd = {
183 	NULL, "uath", DV_IFNET
184 };
185 
186 const struct cfattach uath_ca = {
187 	sizeof(struct uath_softc), uath_match, uath_attach, uath_detach
188 };
189 
190 int
191 uath_match(struct device *parent, void *match, void *aux)
192 {
193 	struct usb_attach_arg *uaa = aux;
194 
195 	if (uaa->iface != NULL)
196 		return UMATCH_NONE;
197 
198 	return (uath_lookup(uaa->vendor, uaa->product) != NULL) ?
199 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
200 }
201 
202 void
203 uath_attachhook(void *xsc)
204 {
205 	struct uath_softc *sc = xsc;
206 	u_char *fw;
207 	size_t size;
208 	int error;
209 
210 	if ((error = loadfirmware("uath-ar5523", &fw, &size)) != 0) {
211 		printf("%s: error %d, could not read firmware %s\n",
212 		    sc->sc_dev.dv_xname, error, "uath-ar5523");
213 		return;
214 	}
215 
216 	error = uath_loadfirmware(sc, fw, size);
217 	free(fw, M_DEVBUF, 0);
218 
219 	if (error == 0) {
220 		/*
221 		 * Hack alert: the device doesn't always gracefully detach
222 		 * from the bus after a firmware upload.  We need to force
223 		 * a port reset and a re-exploration on the parent hub.
224 		 */
225 		usbd_reset_port(sc->sc_uhub, sc->sc_port);
226 		usb_needs_reattach(sc->sc_udev);
227 	} else {
228 		printf("%s: could not load firmware (error=%s)\n",
229 		    sc->sc_dev.dv_xname, usbd_errstr(error));
230 	}
231 }
232 
233 void
234 uath_attach(struct device *parent, struct device *self, void *aux)
235 {
236 	struct uath_softc *sc = (struct uath_softc *)self;
237 	struct usb_attach_arg *uaa = aux;
238 	struct ieee80211com *ic = &sc->sc_ic;
239 	struct ifnet *ifp = &ic->ic_if;
240 	usbd_status error;
241 	int i;
242 
243 	sc->sc_udev = uaa->device;
244 	sc->sc_uhub = uaa->device->myhub;
245 	sc->sc_port = uaa->port;
246 
247 	sc->sc_flags = uath_lookup(uaa->vendor, uaa->product)->flags;
248 
249 	if (usbd_set_config_no(sc->sc_udev, UATH_CONFIG_NO, 0) != 0) {
250 		printf("%s: could not set configuration no\n",
251 		    sc->sc_dev.dv_xname);
252 		return;
253 	}
254 
255 	/* get the first interface handle */
256 	error = usbd_device2interface_handle(sc->sc_udev, UATH_IFACE_INDEX,
257 	    &sc->sc_iface);
258 	if (error != 0) {
259 		printf("%s: could not get interface handle\n",
260 		    sc->sc_dev.dv_xname);
261 		return;
262 	}
263 
264 	/*
265 	 * We must open the pipes early because they're used to upload the
266 	 * firmware (pre-firmware devices) or to send firmware commands.
267 	 */
268 	if (uath_open_pipes(sc) != 0) {
269 		printf("%s: could not open pipes\n", sc->sc_dev.dv_xname);
270 		return;
271 	}
272 
273 	if (sc->sc_flags & UATH_FLAG_PRE_FIRMWARE) {
274 		if (rootvp == NULL)
275 			mountroothook_establish(uath_attachhook, sc);
276 		else
277 			uath_attachhook(sc);
278 		return;
279 	}
280 
281 	/*
282 	 * Only post-firmware devices here.
283 	 */
284 	usb_init_task(&sc->sc_task, uath_task, sc, USB_TASK_TYPE_GENERIC);
285 	timeout_set(&sc->scan_to, uath_next_scan, sc);
286 	timeout_set(&sc->stat_to, uath_stat, sc);
287 
288 	/*
289 	 * Allocate xfers for firmware commands.
290 	 */
291 	if (uath_alloc_tx_cmd_list(sc) != 0) {
292 		printf("%s: could not allocate Tx command list\n",
293 		    sc->sc_dev.dv_xname);
294 		goto fail1;
295 	}
296 	if (uath_alloc_rx_cmd_list(sc) != 0) {
297 		printf("%s: could not allocate Rx command list\n",
298 		    sc->sc_dev.dv_xname);
299 		goto fail2;
300 	}
301 
302 	/*
303 	 * Queue Rx command xfers.
304 	 */
305 	for (i = 0; i < UATH_RX_CMD_LIST_COUNT; i++) {
306 		struct uath_rx_cmd *cmd = &sc->rx_cmd[i];
307 
308 		usbd_setup_xfer(cmd->xfer, sc->cmd_rx_pipe, cmd, cmd->buf,
309 		    UATH_MAX_RXCMDSZ, USBD_SHORT_XFER_OK | USBD_NO_COPY,
310 		    USBD_NO_TIMEOUT, uath_cmd_rxeof);
311 		error = usbd_transfer(cmd->xfer);
312 		if (error != USBD_IN_PROGRESS && error != 0) {
313 			printf("%s: could not queue Rx command xfer\n",
314 			    sc->sc_dev.dv_xname);
315 			goto fail3;
316 		}
317 	}
318 
319 	/*
320 	 * We're now ready to send/receive firmware commands.
321 	 */
322 	if (uath_reset(sc) != 0) {
323 		printf("%s: could not initialize adapter\n",
324 		    sc->sc_dev.dv_xname);
325 		goto fail3;
326 	}
327 	if (uath_query_eeprom(sc) != 0) {
328 		printf("%s: could not read EEPROM\n", sc->sc_dev.dv_xname);
329 		goto fail3;
330 	}
331 
332 	printf("%s: MAC/BBP AR5523, RF AR%c112, address %s\n",
333 	    sc->sc_dev.dv_xname, (sc->sc_flags & UATH_FLAG_ABG) ? '5': '2',
334 	    ether_sprintf(ic->ic_myaddr));
335 
336 	/*
337 	 * Allocate xfers for Tx/Rx data pipes.
338 	 */
339 	if (uath_alloc_tx_data_list(sc) != 0) {
340 		printf("%s: could not allocate Tx data list\n",
341 		    sc->sc_dev.dv_xname);
342 		goto fail3;
343 	}
344 	if (uath_alloc_rx_data_list(sc) != 0) {
345 		printf("%s: could not allocate Rx data list\n",
346 		    sc->sc_dev.dv_xname);
347 		goto fail4;
348 	}
349 
350 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
351 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
352 	ic->ic_state = IEEE80211_S_INIT;
353 
354 	/* set device capabilities */
355 	ic->ic_caps =
356 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
357 	    IEEE80211_C_TXPMGT |	/* tx power management */
358 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
359 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
360 	    IEEE80211_C_WEP;		/* h/w WEP */
361 
362 	/* set supported .11b and .11g rates */
363 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
364 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
365 
366 	/* set supported .11b and .11g channels (1 through 14) */
367 	for (i = 1; i <= 14; i++) {
368 		ic->ic_channels[i].ic_freq =
369 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
370 		ic->ic_channels[i].ic_flags =
371 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
372 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
373 	}
374 
375 	ifp->if_softc = sc;
376 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
377 	ifp->if_ioctl = uath_ioctl;
378 	ifp->if_start = uath_start;
379 	ifp->if_watchdog = uath_watchdog;
380 	IFQ_SET_READY(&ifp->if_snd);
381 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
382 
383 	if_attach(ifp);
384 	ieee80211_ifattach(ifp);
385 
386 	/* override state transition machine */
387 	sc->sc_newstate = ic->ic_newstate;
388 	ic->ic_newstate = uath_newstate;
389 	ieee80211_media_init(ifp, uath_media_change, ieee80211_media_status);
390 
391 #if NBPFILTER > 0
392 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
393 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
394 
395 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
396 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
397 	sc->sc_rxtap.wr_ihdr.it_present = htole32(UATH_RX_RADIOTAP_PRESENT);
398 
399 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
400 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
401 	sc->sc_txtap.wt_ihdr.it_present = htole32(UATH_TX_RADIOTAP_PRESENT);
402 #endif
403 
404 	return;
405 
406 fail4:	uath_free_tx_data_list(sc);
407 fail3:	uath_free_rx_cmd_list(sc);
408 fail2:	uath_free_tx_cmd_list(sc);
409 fail1:	uath_close_pipes(sc);
410 	usbd_deactivate(sc->sc_udev);
411 }
412 
413 int
414 uath_detach(struct device *self, int flags)
415 {
416 	struct uath_softc *sc = (struct uath_softc *)self;
417 	struct ifnet *ifp = &sc->sc_ic.ic_if;
418 	int s;
419 
420 	s = splnet();
421 
422 	if (sc->sc_flags & UATH_FLAG_PRE_FIRMWARE) {
423 		uath_close_pipes(sc);
424 		splx(s);
425 		return 0;
426 	}
427 
428 	/* post-firmware device */
429 
430 	usb_rem_task(sc->sc_udev, &sc->sc_task);
431 	if (timeout_initialized(&sc->scan_to))
432 		timeout_del(&sc->scan_to);
433 	if (timeout_initialized(&sc->stat_to))
434 		timeout_del(&sc->stat_to);
435 
436 	/* abort and free xfers */
437 	uath_free_tx_data_list(sc);
438 	uath_free_rx_data_list(sc);
439 	uath_free_tx_cmd_list(sc);
440 	uath_free_rx_cmd_list(sc);
441 
442 	/* close Tx/Rx pipes */
443 	uath_close_pipes(sc);
444 
445 	if (ifp->if_softc != NULL) {
446 		ieee80211_ifdetach(ifp);	/* free all nodes */
447 		if_detach(ifp);
448 	}
449 
450 	splx(s);
451 
452 	return 0;
453 }
454 
455 int
456 uath_open_pipes(struct uath_softc *sc)
457 {
458 	int error;
459 
460 	/*
461 	 * XXX pipes numbers are hardcoded because we don't have any way
462 	 * to distinguish the data pipes from the firmware command pipes
463 	 * (both are bulk pipes) using the endpoints descriptors.
464 	 */
465 	error = usbd_open_pipe(sc->sc_iface, 0x01, USBD_EXCLUSIVE_USE,
466 	    &sc->cmd_tx_pipe);
467 	if (error != 0) {
468 		printf("%s: could not open Tx command pipe: %s\n",
469 		    sc->sc_dev.dv_xname, usbd_errstr(error));
470 		goto fail;
471 	}
472 
473 	error = usbd_open_pipe(sc->sc_iface, 0x02, USBD_EXCLUSIVE_USE,
474 	    &sc->data_tx_pipe);
475 	if (error != 0) {
476 		printf("%s: could not open Tx data pipe: %s\n",
477 		    sc->sc_dev.dv_xname, usbd_errstr(error));
478 		goto fail;
479 	}
480 
481 	error = usbd_open_pipe(sc->sc_iface, 0x81, USBD_EXCLUSIVE_USE,
482 	    &sc->cmd_rx_pipe);
483 	if (error != 0) {
484 		printf("%s: could not open Rx command pipe: %s\n",
485 		    sc->sc_dev.dv_xname, usbd_errstr(error));
486 		goto fail;
487 	}
488 
489 	error = usbd_open_pipe(sc->sc_iface, 0x82, USBD_EXCLUSIVE_USE,
490 	    &sc->data_rx_pipe);
491 	if (error != 0) {
492 		printf("%s: could not open Rx data pipe: %s\n",
493 		    sc->sc_dev.dv_xname, usbd_errstr(error));
494 		goto fail;
495 	}
496 
497 	return 0;
498 
499 fail:	uath_close_pipes(sc);
500 	return error;
501 }
502 
503 void
504 uath_close_pipes(struct uath_softc *sc)
505 {
506 	/* assumes no transfers are pending on the pipes */
507 
508 	if (sc->data_tx_pipe != NULL)
509 		usbd_close_pipe(sc->data_tx_pipe);
510 
511 	if (sc->data_rx_pipe != NULL)
512 		usbd_close_pipe(sc->data_rx_pipe);
513 
514 	if (sc->cmd_tx_pipe != NULL)
515 		usbd_close_pipe(sc->cmd_tx_pipe);
516 
517 	if (sc->cmd_rx_pipe != NULL)
518 		usbd_close_pipe(sc->cmd_rx_pipe);
519 }
520 
521 int
522 uath_alloc_tx_data_list(struct uath_softc *sc)
523 {
524 	int i, error;
525 
526 	for (i = 0; i < UATH_TX_DATA_LIST_COUNT; i++) {
527 		struct uath_tx_data *data = &sc->tx_data[i];
528 
529 		data->sc = sc;	/* backpointer for callbacks */
530 
531 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
532 		if (data->xfer == NULL) {
533 			printf("%s: could not allocate xfer\n",
534 			    sc->sc_dev.dv_xname);
535 			error = ENOMEM;
536 			goto fail;
537 		}
538 		data->buf = usbd_alloc_buffer(data->xfer, UATH_MAX_TXBUFSZ);
539 		if (data->buf == NULL) {
540 			printf("%s: could not allocate xfer buffer\n",
541 			    sc->sc_dev.dv_xname);
542 			error = ENOMEM;
543 			goto fail;
544 		}
545 	}
546 	return 0;
547 
548 fail:	uath_free_tx_data_list(sc);
549 	return error;
550 }
551 
552 void
553 uath_free_tx_data_list(struct uath_softc *sc)
554 {
555 	int i;
556 
557 	/* make sure no transfers are pending */
558 	usbd_abort_pipe(sc->data_tx_pipe);
559 
560 	for (i = 0; i < UATH_TX_DATA_LIST_COUNT; i++)
561 		if (sc->tx_data[i].xfer != NULL)
562 			usbd_free_xfer(sc->tx_data[i].xfer);
563 }
564 
565 int
566 uath_alloc_rx_data_list(struct uath_softc *sc)
567 {
568 	int i, error;
569 
570 	for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
571 		struct uath_rx_data *data = &sc->rx_data[i];
572 
573 		data->sc = sc;	/* backpointer for callbacks */
574 
575 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
576 		if (data->xfer == NULL) {
577 			printf("%s: could not allocate xfer\n",
578 			    sc->sc_dev.dv_xname);
579 			error = ENOMEM;
580 			goto fail;
581 		}
582 		if (usbd_alloc_buffer(data->xfer, sc->rxbufsz) == NULL) {
583 			printf("%s: could not allocate xfer buffer\n",
584 			    sc->sc_dev.dv_xname);
585 			error = ENOMEM;
586 			goto fail;
587 		}
588 
589 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
590 		if (data->m == NULL) {
591 			printf("%s: could not allocate rx mbuf\n",
592 			    sc->sc_dev.dv_xname);
593 			error = ENOMEM;
594 			goto fail;
595 		}
596 		MCLGET(data->m, M_DONTWAIT);
597 		if (!(data->m->m_flags & M_EXT)) {
598 			printf("%s: could not allocate rx mbuf cluster\n",
599 			    sc->sc_dev.dv_xname);
600 			error = ENOMEM;
601 			goto fail;
602 		}
603 
604 		data->buf = mtod(data->m, uint8_t *);
605 	}
606 	return 0;
607 
608 fail:	uath_free_rx_data_list(sc);
609 	return error;
610 }
611 
612 void
613 uath_free_rx_data_list(struct uath_softc *sc)
614 {
615 	int i;
616 
617 	/* make sure no transfers are pending */
618 	usbd_abort_pipe(sc->data_rx_pipe);
619 
620 	for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
621 		struct uath_rx_data *data = &sc->rx_data[i];
622 
623 		if (data->xfer != NULL)
624 			usbd_free_xfer(data->xfer);
625 
626 		if (data->m != NULL)
627 			m_freem(data->m);
628 	}
629 }
630 
631 int
632 uath_alloc_tx_cmd_list(struct uath_softc *sc)
633 {
634 	int i, error;
635 
636 	for (i = 0; i < UATH_TX_CMD_LIST_COUNT; i++) {
637 		struct uath_tx_cmd *cmd = &sc->tx_cmd[i];
638 
639 		cmd->sc = sc;	/* backpointer for callbacks */
640 
641 		cmd->xfer = usbd_alloc_xfer(sc->sc_udev);
642 		if (cmd->xfer == NULL) {
643 			printf("%s: could not allocate xfer\n",
644 			    sc->sc_dev.dv_xname);
645 			error = ENOMEM;
646 			goto fail;
647 		}
648 		cmd->buf = usbd_alloc_buffer(cmd->xfer, UATH_MAX_TXCMDSZ);
649 		if (cmd->buf == NULL) {
650 			printf("%s: could not allocate xfer buffer\n",
651 			    sc->sc_dev.dv_xname);
652 			error = ENOMEM;
653 			goto fail;
654 		}
655 	}
656 	return 0;
657 
658 fail:	uath_free_tx_cmd_list(sc);
659 	return error;
660 }
661 
662 void
663 uath_free_tx_cmd_list(struct uath_softc *sc)
664 {
665 	int i;
666 
667 	/* make sure no transfers are pending */
668 	usbd_abort_pipe(sc->cmd_tx_pipe);
669 
670 	for (i = 0; i < UATH_TX_CMD_LIST_COUNT; i++)
671 		if (sc->tx_cmd[i].xfer != NULL)
672 			usbd_free_xfer(sc->tx_cmd[i].xfer);
673 }
674 
675 int
676 uath_alloc_rx_cmd_list(struct uath_softc *sc)
677 {
678 	int i, error;
679 
680 	for (i = 0; i < UATH_RX_CMD_LIST_COUNT; i++) {
681 		struct uath_rx_cmd *cmd = &sc->rx_cmd[i];
682 
683 		cmd->sc = sc;	/* backpointer for callbacks */
684 
685 		cmd->xfer = usbd_alloc_xfer(sc->sc_udev);
686 		if (cmd->xfer == NULL) {
687 			printf("%s: could not allocate xfer\n",
688 			    sc->sc_dev.dv_xname);
689 			error = ENOMEM;
690 			goto fail;
691 		}
692 		cmd->buf = usbd_alloc_buffer(cmd->xfer, UATH_MAX_RXCMDSZ);
693 		if (cmd->buf == NULL) {
694 			printf("%s: could not allocate xfer buffer\n",
695 			    sc->sc_dev.dv_xname);
696 			error = ENOMEM;
697 			goto fail;
698 		}
699 	}
700 	return 0;
701 
702 fail:	uath_free_rx_cmd_list(sc);
703 	return error;
704 }
705 
706 void
707 uath_free_rx_cmd_list(struct uath_softc *sc)
708 {
709 	int i;
710 
711 	/* make sure no transfers are pending */
712 	usbd_abort_pipe(sc->cmd_rx_pipe);
713 
714 	for (i = 0; i < UATH_RX_CMD_LIST_COUNT; i++)
715 		if (sc->rx_cmd[i].xfer != NULL)
716 			usbd_free_xfer(sc->rx_cmd[i].xfer);
717 }
718 
719 int
720 uath_media_change(struct ifnet *ifp)
721 {
722 	int error;
723 
724 	error = ieee80211_media_change(ifp);
725 	if (error != ENETRESET)
726 		return error;
727 
728 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
729 		uath_init(ifp);
730 
731 	return 0;
732 }
733 
734 /*
735  * This function is called periodically (every second) when associated to
736  * query device statistics.
737  */
738 void
739 uath_stat(void *arg)
740 {
741 	struct uath_softc *sc = arg;
742 	int error;
743 
744 	/*
745 	 * Send request for statistics asynchronously. The timer will be
746 	 * restarted when we'll get the stats notification.
747 	 */
748 	error = uath_cmd_write(sc, UATH_CMD_STATS, NULL, 0,
749 	    UATH_CMD_FLAG_ASYNC);
750 	if (error != 0) {
751 		printf("%s: could not query statistics (error=%d)\n",
752 		    sc->sc_dev.dv_xname, error);
753 	}
754 }
755 
756 /*
757  * This function is called periodically (every 250ms) during scanning to
758  * switch from one channel to another.
759  */
760 void
761 uath_next_scan(void *arg)
762 {
763 	struct uath_softc *sc = arg;
764 	struct ieee80211com *ic = &sc->sc_ic;
765 	struct ifnet *ifp = &ic->ic_if;
766 
767 	if (ic->ic_state == IEEE80211_S_SCAN)
768 		ieee80211_next_scan(ifp);
769 }
770 
771 void
772 uath_task(void *arg)
773 {
774 	struct uath_softc *sc = arg;
775 	struct ieee80211com *ic = &sc->sc_ic;
776 	enum ieee80211_state ostate;
777 
778 	ostate = ic->ic_state;
779 
780 	switch (sc->sc_state) {
781 	case IEEE80211_S_INIT:
782 		if (ostate == IEEE80211_S_RUN) {
783 			/* turn link and activity LEDs off */
784 			(void)uath_set_led(sc, UATH_LED_LINK, 0);
785 			(void)uath_set_led(sc, UATH_LED_ACTIVITY, 0);
786 		}
787 		break;
788 
789 	case IEEE80211_S_SCAN:
790 		if (uath_switch_channel(sc, ic->ic_bss->ni_chan) != 0) {
791 			printf("%s: could not switch channel\n",
792 			    sc->sc_dev.dv_xname);
793 			break;
794 		}
795 		timeout_add_msec(&sc->scan_to, 250);
796 		break;
797 
798 	case IEEE80211_S_AUTH:
799 	{
800 		struct ieee80211_node *ni = ic->ic_bss;
801 		struct uath_cmd_bssid bssid;
802 		struct uath_cmd_0b cmd0b;
803 		struct uath_cmd_0c cmd0c;
804 
805 		if (uath_switch_channel(sc, ni->ni_chan) != 0) {
806 			printf("%s: could not switch channel\n",
807 			    sc->sc_dev.dv_xname);
808 			break;
809 		}
810 
811 		(void)uath_cmd_write(sc, UATH_CMD_24, NULL, 0, 0);
812 
813 		bzero(&bssid, sizeof bssid);
814 		bssid.len = htobe32(IEEE80211_ADDR_LEN);
815 		IEEE80211_ADDR_COPY(bssid.bssid, ni->ni_bssid);
816 		(void)uath_cmd_write(sc, UATH_CMD_SET_BSSID, &bssid,
817 		    sizeof bssid, 0);
818 
819 		bzero(&cmd0b, sizeof cmd0b);
820 		cmd0b.code = htobe32(2);
821 		cmd0b.size = htobe32(sizeof (cmd0b.data));
822 		(void)uath_cmd_write(sc, UATH_CMD_0B, &cmd0b, sizeof cmd0b, 0);
823 
824 		bzero(&cmd0c, sizeof cmd0c);
825 		cmd0c.magic1 = htobe32(2);
826 		cmd0c.magic2 = htobe32(7);
827 		cmd0c.magic3 = htobe32(1);
828 		(void)uath_cmd_write(sc, UATH_CMD_0C, &cmd0c, sizeof cmd0c, 0);
829 
830 		if (uath_set_rates(sc, &ni->ni_rates) != 0) {
831 			printf("%s: could not set negotiated rate set\n",
832 			    sc->sc_dev.dv_xname);
833 			break;
834 		}
835 		break;
836 	}
837 
838 	case IEEE80211_S_ASSOC:
839 		break;
840 
841 	case IEEE80211_S_RUN:
842 	{
843 		struct ieee80211_node *ni = ic->ic_bss;
844 		struct uath_cmd_bssid bssid;
845 		struct uath_cmd_xled xled;
846 		uint32_t val;
847 
848 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
849 			/* make both LEDs blink while monitoring */
850 			bzero(&xled, sizeof xled);
851 			xled.which = htobe32(0);
852 			xled.rate = htobe32(1);
853 			xled.mode = htobe32(2);
854 			(void)uath_cmd_write(sc, UATH_CMD_SET_XLED, &xled,
855 			    sizeof xled, 0);
856 			break;
857 		}
858 
859 		/*
860 		 * Tx rate is controlled by firmware, report the maximum
861 		 * negotiated rate in ifconfig output.
862 		 */
863 		ni->ni_txrate = ni->ni_rates.rs_nrates - 1;
864 
865 		val = htobe32(1);
866 		(void)uath_cmd_write(sc, UATH_CMD_2E, &val, sizeof val, 0);
867 
868 		bzero(&bssid, sizeof bssid);
869 		bssid.flags1 = htobe32(0xc004);
870 		bssid.flags2 = htobe32(0x003b);
871 		bssid.len = htobe32(IEEE80211_ADDR_LEN);
872 		IEEE80211_ADDR_COPY(bssid.bssid, ni->ni_bssid);
873 		(void)uath_cmd_write(sc, UATH_CMD_SET_BSSID, &bssid,
874 		    sizeof bssid, 0);
875 
876 		/* turn link LED on */
877 		(void)uath_set_led(sc, UATH_LED_LINK, 1);
878 
879 		/* make activity LED blink */
880 		bzero(&xled, sizeof xled);
881 		xled.which = htobe32(1);
882 		xled.rate = htobe32(1);
883 		xled.mode = htobe32(2);
884 		(void)uath_cmd_write(sc, UATH_CMD_SET_XLED, &xled, sizeof xled,
885 		    0);
886 
887 		/* set state to associated */
888 		val = htobe32(1);
889 		(void)uath_cmd_write(sc, UATH_CMD_SET_STATE, &val, sizeof val,
890 		    0);
891 
892 		/* start statistics timer */
893 		timeout_add_sec(&sc->stat_to, 1);
894 		break;
895 	}
896 	}
897 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
898 }
899 
900 int
901 uath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
902 {
903 	struct uath_softc *sc = ic->ic_softc;
904 
905 	usb_rem_task(sc->sc_udev, &sc->sc_task);
906 	timeout_del(&sc->scan_to);
907 	timeout_del(&sc->stat_to);
908 
909 	/* do it in a process context */
910 	sc->sc_state = nstate;
911 	sc->sc_arg = arg;
912 	usb_add_task(sc->sc_udev, &sc->sc_task);
913 	return 0;
914 }
915 
916 #ifdef UATH_DEBUG
917 void
918 uath_dump_cmd(const uint8_t *buf, int len, char prefix)
919 {
920 	int i;
921 
922 	for (i = 0; i < len; i++) {
923 		if ((i % 16) == 0)
924 			printf("\n%c ", prefix);
925 		else if ((i % 4) == 0)
926 			printf(" ");
927 		printf("%02x", buf[i]);
928 	}
929 	printf("\n");
930 }
931 #endif
932 
933 /*
934  * Low-level function to send read or write commands to the firmware.
935  */
936 int
937 uath_cmd(struct uath_softc *sc, uint32_t code, const void *idata, int ilen,
938     void *odata, int flags)
939 {
940 	struct uath_cmd_hdr *hdr;
941 	struct uath_tx_cmd *cmd;
942 	uint16_t xferflags;
943 	int s, xferlen, error;
944 
945 	/* grab a xfer */
946 	cmd = &sc->tx_cmd[sc->cmd_idx];
947 
948 	/* always bulk-out a multiple of 4 bytes */
949 	xferlen = (sizeof (struct uath_cmd_hdr) + ilen + 3) & ~3;
950 
951 	hdr = (struct uath_cmd_hdr *)cmd->buf;
952 	bzero(hdr, sizeof (struct uath_cmd_hdr));
953 	hdr->len   = htobe32(xferlen);
954 	hdr->code  = htobe32(code);
955 	hdr->priv  = sc->cmd_idx;	/* don't care about endianness */
956 	hdr->magic = htobe32((flags & UATH_CMD_FLAG_MAGIC) ? 1 << 24 : 0);
957 	bcopy(idata, (uint8_t *)(hdr + 1), ilen);
958 
959 #ifdef UATH_DEBUG
960 	if (uath_debug >= 5) {
961 		printf("sending command code=0x%02x flags=0x%x index=%u",
962 		    code, flags, sc->cmd_idx);
963 		uath_dump_cmd(cmd->buf, xferlen, '+');
964 	}
965 #endif
966 	xferflags = USBD_FORCE_SHORT_XFER | USBD_NO_COPY;
967 	if (!(flags & UATH_CMD_FLAG_READ)) {
968 		if (!(flags & UATH_CMD_FLAG_ASYNC))
969 			xferflags |= USBD_SYNCHRONOUS;
970 	} else
971 		s = splusb();
972 
973 	cmd->odata = odata;
974 
975 	usbd_setup_xfer(cmd->xfer, sc->cmd_tx_pipe, cmd, cmd->buf, xferlen,
976 	    xferflags, UATH_CMD_TIMEOUT, NULL);
977 	error = usbd_transfer(cmd->xfer);
978 	if (error != USBD_IN_PROGRESS && error != 0) {
979 		if (flags & UATH_CMD_FLAG_READ)
980 			splx(s);
981 		printf("%s: could not send command 0x%x (error=%s)\n",
982 		    sc->sc_dev.dv_xname, code, usbd_errstr(error));
983 		return error;
984 	}
985 	sc->cmd_idx = (sc->cmd_idx + 1) % UATH_TX_CMD_LIST_COUNT;
986 
987 	if (!(flags & UATH_CMD_FLAG_READ))
988 		return 0;	/* write: don't wait for reply */
989 
990 	/* wait at most two seconds for command reply */
991 	error = tsleep(cmd, PCATCH, "uathcmd", 2 * hz);
992 	cmd->odata = NULL;	/* in case answer is received too late */
993 	splx(s);
994 	if (error != 0) {
995 		printf("%s: timeout waiting for command reply\n",
996 		    sc->sc_dev.dv_xname);
997 	}
998 	return error;
999 }
1000 
1001 int
1002 uath_cmd_write(struct uath_softc *sc, uint32_t code, const void *data, int len,
1003     int flags)
1004 {
1005 	flags &= ~UATH_CMD_FLAG_READ;
1006 	return uath_cmd(sc, code, data, len, NULL, flags);
1007 }
1008 
1009 int
1010 uath_cmd_read(struct uath_softc *sc, uint32_t code, const void *idata,
1011     int ilen, void *odata, int flags)
1012 {
1013 	flags |= UATH_CMD_FLAG_READ;
1014 	return uath_cmd(sc, code, idata, ilen, odata, flags);
1015 }
1016 
1017 int
1018 uath_write_reg(struct uath_softc *sc, uint32_t reg, uint32_t val)
1019 {
1020 	struct uath_write_mac write;
1021 	int error;
1022 
1023 	write.reg = htobe32(reg);
1024 	write.len = htobe32(0);	/* 0 = single write */
1025 	*(uint32_t *)write.data = htobe32(val);
1026 
1027 	error = uath_cmd_write(sc, UATH_CMD_WRITE_MAC, &write,
1028 	    3 * sizeof (uint32_t), 0);
1029 	if (error != 0) {
1030 		printf("%s: could not write register 0x%02x\n",
1031 		    sc->sc_dev.dv_xname, reg);
1032 	}
1033 	return error;
1034 }
1035 
1036 int
1037 uath_write_multi(struct uath_softc *sc, uint32_t reg, const void *data,
1038     int len)
1039 {
1040 	struct uath_write_mac write;
1041 	int error;
1042 
1043 	write.reg = htobe32(reg);
1044 	write.len = htobe32(len);
1045 	bcopy(data, write.data, len);
1046 
1047 	/* properly handle the case where len is zero (reset) */
1048 	error = uath_cmd_write(sc, UATH_CMD_WRITE_MAC, &write,
1049 	    (len == 0) ? sizeof (uint32_t) : 2 * sizeof (uint32_t) + len, 0);
1050 	if (error != 0) {
1051 		printf("%s: could not write %d bytes to register 0x%02x\n",
1052 		    sc->sc_dev.dv_xname, len, reg);
1053 	}
1054 	return error;
1055 }
1056 
1057 int
1058 uath_read_reg(struct uath_softc *sc, uint32_t reg, uint32_t *val)
1059 {
1060 	struct uath_read_mac read;
1061 	int error;
1062 
1063 	reg = htobe32(reg);
1064 	error = uath_cmd_read(sc, UATH_CMD_READ_MAC, &reg, sizeof reg, &read,
1065 	    0);
1066 	if (error != 0) {
1067 		printf("%s: could not read register 0x%02x\n",
1068 		    sc->sc_dev.dv_xname, betoh32(reg));
1069 		return error;
1070 	}
1071 	*val = betoh32(*(uint32_t *)read.data);
1072 	return error;
1073 }
1074 
1075 int
1076 uath_read_eeprom(struct uath_softc *sc, uint32_t reg, void *odata)
1077 {
1078 	struct uath_read_mac read;
1079 	int len, error;
1080 
1081 	reg = htobe32(reg);
1082 	error = uath_cmd_read(sc, UATH_CMD_READ_EEPROM, &reg, sizeof reg,
1083 	    &read, 0);
1084 	if (error != 0) {
1085 		printf("%s: could not read EEPROM offset 0x%02x\n",
1086 		    sc->sc_dev.dv_xname, betoh32(reg));
1087 		return error;
1088 	}
1089 	len = betoh32(read.len);
1090 	bcopy(read.data, odata, (len == 0) ? sizeof (uint32_t) : len);
1091 	return error;
1092 }
1093 
1094 void
1095 uath_cmd_rxeof(struct usbd_xfer *xfer, void *priv,
1096     usbd_status status)
1097 {
1098 	struct uath_rx_cmd *cmd = priv;
1099 	struct uath_softc *sc = cmd->sc;
1100 	struct uath_cmd_hdr *hdr;
1101 
1102 	if (status != USBD_NORMAL_COMPLETION) {
1103 		if (status == USBD_STALLED)
1104 			usbd_clear_endpoint_stall_async(sc->cmd_rx_pipe);
1105 		return;
1106 	}
1107 
1108 	hdr = (struct uath_cmd_hdr *)cmd->buf;
1109 
1110 #ifdef UATH_DEBUG
1111 	if (uath_debug >= 5) {
1112 		printf("received command code=0x%x index=%u len=%u",
1113 		    betoh32(hdr->code), hdr->priv, betoh32(hdr->len));
1114 		uath_dump_cmd(cmd->buf, betoh32(hdr->len), '-');
1115 	}
1116 #endif
1117 
1118 	switch (betoh32(hdr->code) & 0xff) {
1119 	/* reply to a read command */
1120 	default:
1121 	{
1122 		struct uath_tx_cmd *txcmd = &sc->tx_cmd[hdr->priv];
1123 
1124 		if (txcmd->odata != NULL) {
1125 			/* copy answer into caller's supplied buffer */
1126 			bcopy((uint8_t *)(hdr + 1), txcmd->odata,
1127 			    betoh32(hdr->len) - sizeof (struct uath_cmd_hdr));
1128 		}
1129 		wakeup(txcmd);	/* wake up caller */
1130 		break;
1131 	}
1132 	/* spontaneous firmware notifications */
1133 	case UATH_NOTIF_READY:
1134 		DPRINTF(("received device ready notification\n"));
1135 		wakeup(UATH_COND_INIT(sc));
1136 		break;
1137 
1138 	case UATH_NOTIF_TX:
1139 		/* this notification is sent when UATH_TX_NOTIFY is set */
1140 		DPRINTF(("received Tx notification\n"));
1141 		break;
1142 
1143 	case UATH_NOTIF_STATS:
1144 		DPRINTFN(2, ("received device statistics\n"));
1145 		timeout_add_sec(&sc->stat_to, 1);
1146 		break;
1147 	}
1148 
1149 	/* setup a new transfer */
1150 	usbd_setup_xfer(xfer, sc->cmd_rx_pipe, cmd, cmd->buf, UATH_MAX_RXCMDSZ,
1151 	    USBD_SHORT_XFER_OK | USBD_NO_COPY, USBD_NO_TIMEOUT,
1152 	    uath_cmd_rxeof);
1153 	(void)usbd_transfer(xfer);
1154 }
1155 
1156 void
1157 uath_data_rxeof(struct usbd_xfer *xfer, void *priv,
1158     usbd_status status)
1159 {
1160 	struct uath_rx_data *data = priv;
1161 	struct uath_softc *sc = data->sc;
1162 	struct ieee80211com *ic = &sc->sc_ic;
1163 	struct ifnet *ifp = &ic->ic_if;
1164 	struct ieee80211_frame *wh;
1165 	struct ieee80211_rxinfo rxi;
1166 	struct ieee80211_node *ni;
1167 	struct uath_rx_desc *desc;
1168 	struct mbuf *mnew, *m;
1169 	uint32_t hdr;
1170 	int s, len;
1171 
1172 	if (status != USBD_NORMAL_COMPLETION) {
1173 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
1174 			return;
1175 
1176 		if (status == USBD_STALLED)
1177 			usbd_clear_endpoint_stall_async(sc->data_rx_pipe);
1178 
1179 		ifp->if_ierrors++;
1180 		return;
1181 	}
1182 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
1183 
1184 	if (len < UATH_MIN_RXBUFSZ) {
1185 		DPRINTF(("wrong xfer size (len=%d)\n", len));
1186 		ifp->if_ierrors++;
1187 		goto skip;
1188 	}
1189 
1190 	hdr = betoh32(*(uint32_t *)data->buf);
1191 
1192 	/* Rx descriptor is located at the end, 32-bit aligned */
1193 	desc = (struct uath_rx_desc *)
1194 	    (data->buf + len - sizeof (struct uath_rx_desc));
1195 
1196 	if (betoh32(desc->len) > sc->rxbufsz) {
1197 		DPRINTF(("bad descriptor (len=%d)\n", betoh32(desc->len)));
1198 		ifp->if_ierrors++;
1199 		goto skip;
1200 	}
1201 
1202 	/* there's probably a "bad CRC" flag somewhere in the descriptor.. */
1203 
1204 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1205 	if (mnew == NULL) {
1206 		printf("%s: could not allocate rx mbuf\n",
1207 		    sc->sc_dev.dv_xname);
1208 		ifp->if_ierrors++;
1209 		goto skip;
1210 	}
1211 	MCLGET(mnew, M_DONTWAIT);
1212 	if (!(mnew->m_flags & M_EXT)) {
1213 		printf("%s: could not allocate rx mbuf cluster\n",
1214 		    sc->sc_dev.dv_xname);
1215 		m_freem(mnew);
1216 		ifp->if_ierrors++;
1217 		goto skip;
1218 	}
1219 
1220 	m = data->m;
1221 	data->m = mnew;
1222 
1223 	/* finalize mbuf */
1224 	m->m_pkthdr.rcvif = ifp;
1225 	m->m_data = data->buf + sizeof (uint32_t);
1226 	m->m_pkthdr.len = m->m_len = betoh32(desc->len) -
1227 	    sizeof (struct uath_rx_desc) - IEEE80211_CRC_LEN;
1228 
1229 	data->buf = mtod(data->m, uint8_t *);
1230 
1231 	wh = mtod(m, struct ieee80211_frame *);
1232 	rxi.rxi_flags = 0;
1233 	if ((wh->i_fc[1] & IEEE80211_FC1_WEP) &&
1234 	    ic->ic_opmode != IEEE80211_M_MONITOR) {
1235 		/*
1236 		 * Hardware decrypts the frame itself but leaves the WEP bit
1237 		 * set in the 802.11 header and doesn't remove the IV and CRC
1238 		 * fields.
1239 		 */
1240 		wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
1241 		memmove((caddr_t)wh + IEEE80211_WEP_IVLEN +
1242 		    IEEE80211_WEP_KIDLEN, wh, sizeof (struct ieee80211_frame));
1243 		m_adj(m, IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN);
1244 		m_adj(m, -IEEE80211_WEP_CRCLEN);
1245 		wh = mtod(m, struct ieee80211_frame *);
1246 
1247 		rxi.rxi_flags |= IEEE80211_RXI_HWDEC;
1248 	}
1249 
1250 #if NBPFILTER > 0
1251 	/* there are a lot more fields in the Rx descriptor */
1252 	if (sc->sc_drvbpf != NULL) {
1253 		struct mbuf mb;
1254 		struct uath_rx_radiotap_header *tap = &sc->sc_rxtap;
1255 
1256 		tap->wr_flags = 0;
1257 		tap->wr_chan_freq = htole16(betoh32(desc->freq));
1258 		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1259 		tap->wr_dbm_antsignal = (int8_t)betoh32(desc->rssi);
1260 
1261 		mb.m_data = (caddr_t)tap;
1262 		mb.m_len = sc->sc_rxtap_len;
1263 		mb.m_next = m;
1264 		mb.m_nextpkt = NULL;
1265 		mb.m_type = 0;
1266 		mb.m_flags = 0;
1267 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1268 	}
1269 #endif
1270 
1271 	s = splnet();
1272 	ni = ieee80211_find_rxnode(ic, wh);
1273 	rxi.rxi_rssi = (int)betoh32(desc->rssi);
1274 	rxi.rxi_tstamp = 0;	/* unused */
1275 	ieee80211_input(ifp, m, ni, &rxi);
1276 
1277 	/* node is no longer needed */
1278 	ieee80211_release_node(ic, ni);
1279 	splx(s);
1280 
1281 skip:	/* setup a new transfer */
1282 	usbd_setup_xfer(xfer, sc->data_rx_pipe, data, data->buf, sc->rxbufsz,
1283 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, uath_data_rxeof);
1284 	(void)usbd_transfer(data->xfer);
1285 }
1286 
1287 int
1288 uath_tx_null(struct uath_softc *sc)
1289 {
1290 	struct uath_tx_data *data;
1291 	struct uath_tx_desc *desc;
1292 
1293 	data = &sc->tx_data[sc->data_idx];
1294 
1295 	data->ni = NULL;
1296 
1297 	*(uint32_t *)data->buf = UATH_MAKECTL(1, sizeof (struct uath_tx_desc));
1298 	desc = (struct uath_tx_desc *)(data->buf + sizeof (uint32_t));
1299 
1300 	bzero(desc, sizeof (struct uath_tx_desc));
1301 	desc->len  = htobe32(sizeof (struct uath_tx_desc));
1302 	desc->type = htobe32(UATH_TX_NULL);
1303 
1304 	usbd_setup_xfer(data->xfer, sc->data_tx_pipe, data, data->buf,
1305 	    sizeof (uint32_t) + sizeof (struct uath_tx_desc), USBD_NO_COPY |
1306 	    USBD_FORCE_SHORT_XFER | USBD_SYNCHRONOUS, UATH_DATA_TIMEOUT, NULL);
1307 	if (usbd_transfer(data->xfer) != 0)
1308 		return EIO;
1309 
1310 	sc->data_idx = (sc->data_idx + 1) % UATH_TX_DATA_LIST_COUNT;
1311 
1312 	return uath_cmd_write(sc, UATH_CMD_0F, NULL, 0, UATH_CMD_FLAG_ASYNC);
1313 }
1314 
1315 void
1316 uath_data_txeof(struct usbd_xfer *xfer, void *priv,
1317     usbd_status status)
1318 {
1319 	struct uath_tx_data *data = priv;
1320 	struct uath_softc *sc = data->sc;
1321 	struct ieee80211com *ic = &sc->sc_ic;
1322 	struct ifnet *ifp = &ic->ic_if;
1323 	int s;
1324 
1325 	if (status != USBD_NORMAL_COMPLETION) {
1326 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
1327 			return;
1328 
1329 		printf("%s: could not transmit buffer: %s\n",
1330 		    sc->sc_dev.dv_xname, usbd_errstr(status));
1331 
1332 		if (status == USBD_STALLED)
1333 			usbd_clear_endpoint_stall_async(sc->data_tx_pipe);
1334 
1335 		ifp->if_oerrors++;
1336 		return;
1337 	}
1338 
1339 	s = splnet();
1340 
1341 	ieee80211_release_node(ic, data->ni);
1342 	data->ni = NULL;
1343 
1344 	sc->tx_queued--;
1345 	ifp->if_opackets++;
1346 
1347 	sc->sc_tx_timer = 0;
1348 	ifp->if_flags &= ~IFF_OACTIVE;
1349 	uath_start(ifp);
1350 
1351 	splx(s);
1352 }
1353 
1354 int
1355 uath_tx_data(struct uath_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1356 {
1357 	struct ieee80211com *ic = &sc->sc_ic;
1358 	struct uath_tx_data *data;
1359 	struct uath_tx_desc *desc;
1360 	const struct ieee80211_frame *wh;
1361 	int paylen, totlen, xferlen, error;
1362 
1363 	data = &sc->tx_data[sc->data_idx];
1364 	desc = (struct uath_tx_desc *)(data->buf + sizeof (uint32_t));
1365 
1366 	data->ni = ni;
1367 
1368 #if NBPFILTER > 0
1369 	if (sc->sc_drvbpf != NULL) {
1370 		struct mbuf mb;
1371 		struct uath_tx_radiotap_header *tap = &sc->sc_txtap;
1372 
1373 		tap->wt_flags = 0;
1374 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1375 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1376 
1377 		mb.m_data = (caddr_t)tap;
1378 		mb.m_len = sc->sc_txtap_len;
1379 		mb.m_next = m0;
1380 		mb.m_nextpkt = NULL;
1381 		mb.m_type = 0;
1382 		mb.m_flags = 0;
1383 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1384 	}
1385 #endif
1386 
1387 	paylen = m0->m_pkthdr.len;
1388 	xferlen = sizeof (uint32_t) + sizeof (struct uath_tx_desc) + paylen;
1389 
1390 	wh = mtod(m0, struct ieee80211_frame *);
1391 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1392 		uint8_t *frm = (uint8_t *)(desc + 1);
1393 		uint32_t iv;
1394 
1395 		/* h/w WEP: it's up to the host to fill the IV field */
1396 		bcopy(wh, frm, sizeof (struct ieee80211_frame));
1397 		frm += sizeof (struct ieee80211_frame);
1398 
1399 		/* insert IV: code copied from net80211 */
1400 		iv = (ic->ic_iv != 0) ? ic->ic_iv : arc4random();
1401 		if (iv >= 0x03ff00 && (iv & 0xf8ff00) == 0x00ff00)
1402 			iv += 0x000100;
1403 		ic->ic_iv = iv + 1;
1404 
1405 		*frm++ = iv & 0xff;
1406 		*frm++ = (iv >>  8) & 0xff;
1407 		*frm++ = (iv >> 16) & 0xff;
1408 		*frm++ = ic->ic_wep_txkey << 6;
1409 
1410 		m_copydata(m0, sizeof (struct ieee80211_frame),
1411 		    m0->m_pkthdr.len - sizeof (struct ieee80211_frame), frm);
1412 
1413 		paylen  += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
1414 		xferlen += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
1415 		totlen = xferlen + IEEE80211_WEP_CRCLEN;
1416 	} else {
1417 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(desc + 1));
1418 		totlen = xferlen;
1419 	}
1420 
1421 	/* fill Tx descriptor */
1422 	*(uint32_t *)data->buf = UATH_MAKECTL(1, xferlen - sizeof (uint32_t));
1423 
1424 	desc->len    = htobe32(totlen);
1425 	desc->priv   = sc->data_idx;	/* don't care about endianness */
1426 	desc->paylen = htobe32(paylen);
1427 	desc->type   = htobe32(UATH_TX_DATA);
1428 	desc->flags  = htobe32(0);
1429 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1430 		desc->dest  = htobe32(UATH_ID_BROADCAST);
1431 		desc->magic = htobe32(3);
1432 	} else {
1433 		desc->dest  = htobe32(UATH_ID_BSS);
1434 		desc->magic = htobe32(1);
1435 	}
1436 
1437 	m_freem(m0);	/* mbuf is no longer needed */
1438 
1439 #ifdef UATH_DEBUG
1440 	if (uath_debug >= 6) {
1441 		printf("sending frame index=%u len=%d xferlen=%d",
1442 		    sc->data_idx, paylen, xferlen);
1443 		uath_dump_cmd(data->buf, xferlen, '+');
1444 	}
1445 #endif
1446 	usbd_setup_xfer(data->xfer, sc->data_tx_pipe, data, data->buf, xferlen,
1447 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, UATH_DATA_TIMEOUT,
1448 	    uath_data_txeof);
1449 	error = usbd_transfer(data->xfer);
1450 	if (error != USBD_IN_PROGRESS && error != 0) {
1451 		ic->ic_if.if_oerrors++;
1452 		return error;
1453 	}
1454 	sc->data_idx = (sc->data_idx + 1) % UATH_TX_DATA_LIST_COUNT;
1455 	sc->tx_queued++;
1456 
1457 	return 0;
1458 }
1459 
1460 void
1461 uath_start(struct ifnet *ifp)
1462 {
1463 	struct uath_softc *sc = ifp->if_softc;
1464 	struct ieee80211com *ic = &sc->sc_ic;
1465 	struct ieee80211_node *ni;
1466 	struct mbuf *m0;
1467 
1468 	/*
1469 	 * net80211 may still try to send management frames even if the
1470 	 * IFF_RUNNING flag is not set...
1471 	 */
1472 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1473 		return;
1474 
1475 	for (;;) {
1476 		IF_POLL(&ic->ic_mgtq, m0);
1477 		if (m0 != NULL) {
1478 			if (sc->tx_queued >= UATH_TX_DATA_LIST_COUNT) {
1479 				ifp->if_flags |= IFF_OACTIVE;
1480 				break;
1481 			}
1482 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1483 
1484 			ni = m0->m_pkthdr.ph_cookie;
1485 #if NBPFILTER > 0
1486 			if (ic->ic_rawbpf != NULL)
1487 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1488 #endif
1489 			if (uath_tx_data(sc, m0, ni) != 0)
1490 				break;
1491 		} else {
1492 			if (ic->ic_state != IEEE80211_S_RUN)
1493 				break;
1494 			IFQ_POLL(&ifp->if_snd, m0);
1495 			if (m0 == NULL)
1496 				break;
1497 			if (sc->tx_queued >= UATH_TX_DATA_LIST_COUNT) {
1498 				ifp->if_flags |= IFF_OACTIVE;
1499 				break;
1500 			}
1501 			IFQ_DEQUEUE(&ifp->if_snd, m0);
1502 #if NBPFILTER > 0
1503 			if (ifp->if_bpf != NULL)
1504 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1505 #endif
1506 			m0 = ieee80211_encap(ifp, m0, &ni);
1507 			if (m0 == NULL)
1508 				continue;
1509 #if NBPFILTER > 0
1510 			if (ic->ic_rawbpf != NULL)
1511 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1512 #endif
1513 			if (uath_tx_data(sc, m0, ni) != 0) {
1514 				if (ni != NULL)
1515 					ieee80211_release_node(ic, ni);
1516 				ifp->if_oerrors++;
1517 				break;
1518 			}
1519 		}
1520 
1521 		sc->sc_tx_timer = 5;
1522 		ifp->if_timer = 1;
1523 	}
1524 }
1525 
1526 void
1527 uath_watchdog(struct ifnet *ifp)
1528 {
1529 	struct uath_softc *sc = ifp->if_softc;
1530 
1531 	ifp->if_timer = 0;
1532 
1533 	if (sc->sc_tx_timer > 0) {
1534 		if (--sc->sc_tx_timer == 0) {
1535 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1536 			/*uath_init(ifp); XXX needs a process context! */
1537 			ifp->if_oerrors++;
1538 			return;
1539 		}
1540 		ifp->if_timer = 1;
1541 	}
1542 
1543 	ieee80211_watchdog(ifp);
1544 }
1545 
1546 int
1547 uath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1548 {
1549 	struct uath_softc *sc = ifp->if_softc;
1550 	struct ieee80211com *ic = &sc->sc_ic;
1551 	struct ifaddr *ifa;
1552 	struct ifreq *ifr;
1553 	int s, error = 0;
1554 
1555 	s = splnet();
1556 
1557 	switch (cmd) {
1558 	case SIOCSIFADDR:
1559 		ifa = (struct ifaddr *)data;
1560 		ifp->if_flags |= IFF_UP;
1561 		if (ifa->ifa_addr->sa_family == AF_INET)
1562 			arp_ifinit(&ic->ic_ac, ifa);
1563 		/* FALLTHROUGH */
1564 	case SIOCSIFFLAGS:
1565 		if (ifp->if_flags & IFF_UP) {
1566 			if (!(ifp->if_flags & IFF_RUNNING))
1567 				uath_init(ifp);
1568 		} else {
1569 			if (ifp->if_flags & IFF_RUNNING)
1570 				uath_stop(ifp, 1);
1571 		}
1572 		break;
1573 
1574 	case SIOCADDMULTI:
1575 	case SIOCDELMULTI:
1576 		ifr = (struct ifreq *)data;
1577 		error = (cmd == SIOCADDMULTI) ?
1578 		    ether_addmulti(ifr, &ic->ic_ac) :
1579 		    ether_delmulti(ifr, &ic->ic_ac);
1580 		if (error == ENETRESET)
1581 			error = 0;
1582 		break;
1583 
1584 	default:
1585 		error = ieee80211_ioctl(ifp, cmd, data);
1586 	}
1587 
1588 	if (error == ENETRESET) {
1589 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1590 		    (IFF_UP | IFF_RUNNING))
1591 			uath_init(ifp);
1592 		error = 0;
1593 	}
1594 
1595 	splx(s);
1596 
1597 	return error;
1598 }
1599 
1600 int
1601 uath_query_eeprom(struct uath_softc *sc)
1602 {
1603 	uint32_t tmp;
1604 	int error;
1605 
1606 	/* retrieve MAC address */
1607 	error = uath_read_eeprom(sc, UATH_EEPROM_MACADDR, sc->sc_ic.ic_myaddr);
1608 	if (error != 0) {
1609 		printf("%s: could not read MAC address\n",
1610 		    sc->sc_dev.dv_xname);
1611 		return error;
1612 	}
1613 
1614 	/* retrieve the maximum frame size that the hardware can receive */
1615 	error = uath_read_eeprom(sc, UATH_EEPROM_RXBUFSZ, &tmp);
1616 	if (error != 0) {
1617 		printf("%s: could not read maximum Rx buffer size\n",
1618 		    sc->sc_dev.dv_xname);
1619 		return error;
1620 	}
1621 	sc->rxbufsz = betoh32(tmp) & 0xfff;
1622 	DPRINTF(("maximum Rx buffer size %d\n", sc->rxbufsz));
1623 	return 0;
1624 }
1625 
1626 int
1627 uath_reset(struct uath_softc *sc)
1628 {
1629 	struct uath_cmd_setup setup;
1630 	uint32_t reg, val;
1631 	int s, error;
1632 
1633 	/* init device with some voodoo incantations.. */
1634 	setup.magic1 = htobe32(1);
1635 	setup.magic2 = htobe32(5);
1636 	setup.magic3 = htobe32(200);
1637 	setup.magic4 = htobe32(27);
1638 	s = splusb();
1639 	error = uath_cmd_write(sc, UATH_CMD_SETUP, &setup, sizeof setup,
1640 	    UATH_CMD_FLAG_ASYNC);
1641 	/* ..and wait until firmware notifies us that it is ready */
1642 	if (error == 0)
1643 		error = tsleep(UATH_COND_INIT(sc), PCATCH, "uathinit", 5 * hz);
1644 	splx(s);
1645 	if (error != 0)
1646 		return error;
1647 
1648 	/* read PHY registers */
1649 	for (reg = 0x09; reg <= 0x24; reg++) {
1650 		if (reg == 0x0b || reg == 0x0c)
1651 			continue;
1652 		DELAY(100);
1653 		if ((error = uath_read_reg(sc, reg, &val)) != 0)
1654 			return error;
1655 		DPRINTFN(2, ("reg 0x%02x=0x%08x\n", reg, val));
1656 	}
1657 	return error;
1658 }
1659 
1660 int
1661 uath_reset_tx_queues(struct uath_softc *sc)
1662 {
1663 	int ac, error;
1664 
1665 	for (ac = 0; ac < 4; ac++) {
1666 		const uint32_t qid = htobe32(UATH_AC_TO_QID(ac));
1667 
1668 		DPRINTF(("resetting Tx queue %d\n", UATH_AC_TO_QID(ac)));
1669 		error = uath_cmd_write(sc, UATH_CMD_RESET_QUEUE, &qid,
1670 		    sizeof qid, 0);
1671 		if (error != 0)
1672 			break;
1673 	}
1674 	return error;
1675 }
1676 
1677 int
1678 uath_wme_init(struct uath_softc *sc)
1679 {
1680 	struct uath_qinfo qinfo;
1681 	int ac, error;
1682 	static const struct uath_wme_settings uath_wme_11g[4] = {
1683 		{ 7, 4, 10,  0, 0 },	/* Background */
1684 		{ 3, 4, 10,  0, 0 },	/* Best-Effort */
1685 		{ 3, 3,  4, 26, 0 },	/* Video */
1686 		{ 2, 2,  3, 47, 0 }	/* Voice */
1687 	};
1688 
1689 	bzero(&qinfo, sizeof qinfo);
1690 	qinfo.size   = htobe32(32);
1691 	qinfo.magic1 = htobe32(1);	/* XXX ack policy? */
1692 	qinfo.magic2 = htobe32(1);
1693 	for (ac = 0; ac < 4; ac++) {
1694 		qinfo.qid      = htobe32(UATH_AC_TO_QID(ac));
1695 		qinfo.ac       = htobe32(ac);
1696 		qinfo.aifsn    = htobe32(uath_wme_11g[ac].aifsn);
1697 		qinfo.logcwmin = htobe32(uath_wme_11g[ac].logcwmin);
1698 		qinfo.logcwmax = htobe32(uath_wme_11g[ac].logcwmax);
1699 		qinfo.txop     = htobe32(UATH_TXOP_TO_US(
1700 				     uath_wme_11g[ac].txop));
1701 		qinfo.acm      = htobe32(uath_wme_11g[ac].acm);
1702 
1703 		DPRINTF(("setting up Tx queue %d\n", UATH_AC_TO_QID(ac)));
1704 		error = uath_cmd_write(sc, UATH_CMD_SET_QUEUE, &qinfo,
1705 		    sizeof qinfo, 0);
1706 		if (error != 0)
1707 			break;
1708 	}
1709 	return error;
1710 }
1711 
1712 int
1713 uath_set_chan(struct uath_softc *sc, struct ieee80211_channel *c)
1714 {
1715 	struct uath_set_chan chan;
1716 
1717 	bzero(&chan, sizeof chan);
1718 	chan.flags  = htobe32(0x1400);
1719 	chan.freq   = htobe32(c->ic_freq);
1720 	chan.magic1 = htobe32(20);
1721 	chan.magic2 = htobe32(50);
1722 	chan.magic3 = htobe32(1);
1723 
1724 	DPRINTF(("switching to channel %d\n",
1725 	    ieee80211_chan2ieee(&sc->sc_ic, c)));
1726 	return uath_cmd_write(sc, UATH_CMD_SET_CHAN, &chan, sizeof chan, 0);
1727 }
1728 
1729 int
1730 uath_set_key(struct uath_softc *sc, const struct ieee80211_key *k, int index)
1731 {
1732 	struct uath_cmd_crypto crypto;
1733 	int i;
1734 
1735 	bzero(&crypto, sizeof crypto);
1736 	crypto.keyidx = htobe32(index);
1737 	crypto.magic1 = htobe32(1);
1738 	crypto.size   = htobe32(368);
1739 	crypto.mask   = htobe32(0xffff);
1740 	crypto.flags  = htobe32(0x80000068);
1741 	if (index != UATH_DEFAULT_KEY)
1742 		crypto.flags |= htobe32(index << 16);
1743 	memset(crypto.magic2, 0xff, sizeof crypto.magic2);
1744 
1745 	/*
1746 	 * Each byte of the key must be XOR'ed with 10101010 before being
1747 	 * transmitted to the firmware.
1748 	 */
1749 	for (i = 0; i < k->k_len; i++)
1750 		crypto.key[i] = k->k_key[i] ^ 0xaa;
1751 
1752 	DPRINTF(("setting crypto key index=%d len=%d\n", index, k->k_len));
1753 	return uath_cmd_write(sc, UATH_CMD_CRYPTO, &crypto, sizeof crypto, 0);
1754 }
1755 
1756 int
1757 uath_set_keys(struct uath_softc *sc)
1758 {
1759 	const struct ieee80211com *ic = &sc->sc_ic;
1760 	int i, error;
1761 
1762 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
1763 		const struct ieee80211_key *k = &ic->ic_nw_keys[i];
1764 
1765 		if (k->k_len > 0 && (error = uath_set_key(sc, k, i)) != 0)
1766 			return error;
1767 	}
1768 	return uath_set_key(sc, &ic->ic_nw_keys[ic->ic_wep_txkey],
1769 	    UATH_DEFAULT_KEY);
1770 }
1771 
1772 int
1773 uath_set_rates(struct uath_softc *sc, const struct ieee80211_rateset *rs)
1774 {
1775 	struct uath_cmd_rates rates;
1776 
1777 	bzero(&rates, sizeof rates);
1778 	rates.magic1 = htobe32(0x02);
1779 	rates.size   = htobe32(1 + sizeof rates.rates);
1780 	rates.nrates = rs->rs_nrates;
1781 	bcopy(rs->rs_rates, rates.rates, rs->rs_nrates);
1782 
1783 	DPRINTF(("setting supported rates nrates=%d\n", rs->rs_nrates));
1784 	return uath_cmd_write(sc, UATH_CMD_SET_RATES, &rates, sizeof rates, 0);
1785 }
1786 
1787 int
1788 uath_set_rxfilter(struct uath_softc *sc, uint32_t filter, uint32_t flags)
1789 {
1790 	struct uath_cmd_filter rxfilter;
1791 
1792 	rxfilter.filter = htobe32(filter);
1793 	rxfilter.flags  = htobe32(flags);
1794 
1795 	DPRINTF(("setting Rx filter=0x%x flags=0x%x\n", filter, flags));
1796 	return uath_cmd_write(sc, UATH_CMD_SET_FILTER, &rxfilter,
1797 	    sizeof rxfilter, 0);
1798 }
1799 
1800 int
1801 uath_set_led(struct uath_softc *sc, int which, int on)
1802 {
1803 	struct uath_cmd_led led;
1804 
1805 	led.which = htobe32(which);
1806 	led.state = htobe32(on ? UATH_LED_ON : UATH_LED_OFF);
1807 
1808 	DPRINTFN(2, ("switching %s led %s\n",
1809 	    (which == UATH_LED_LINK) ? "link" : "activity",
1810 	    on ? "on" : "off"));
1811 	return uath_cmd_write(sc, UATH_CMD_SET_LED, &led, sizeof led, 0);
1812 }
1813 
1814 int
1815 uath_switch_channel(struct uath_softc *sc, struct ieee80211_channel *c)
1816 {
1817 	uint32_t val;
1818 	int error;
1819 
1820 	/* set radio frequency */
1821 	if ((error = uath_set_chan(sc, c)) != 0) {
1822 		printf("%s: could not set channel\n", sc->sc_dev.dv_xname);
1823 		return error;
1824 	}
1825 
1826 	/* reset Tx rings */
1827 	if ((error = uath_reset_tx_queues(sc)) != 0) {
1828 		printf("%s: could not reset Tx queues\n",
1829 		    sc->sc_dev.dv_xname);
1830 		return error;
1831 	}
1832 
1833 	/* set Tx rings WME properties */
1834 	if ((error = uath_wme_init(sc)) != 0) {
1835 		printf("%s: could not init Tx queues\n",
1836 		    sc->sc_dev.dv_xname);
1837 		return error;
1838 	}
1839 
1840 	val = htobe32(0);
1841 	error = uath_cmd_write(sc, UATH_CMD_SET_STATE, &val, sizeof val, 0);
1842 	if (error != 0) {
1843 		printf("%s: could not set state\n", sc->sc_dev.dv_xname);
1844 		return error;
1845 	}
1846 
1847 	return uath_tx_null(sc);
1848 }
1849 
1850 int
1851 uath_init(struct ifnet *ifp)
1852 {
1853 	struct uath_softc *sc = ifp->if_softc;
1854 	struct ieee80211com *ic = &sc->sc_ic;
1855 	struct uath_cmd_31 cmd31;
1856 	uint32_t val;
1857 	int i, error;
1858 
1859 	/* reset data and command rings */
1860 	sc->tx_queued = sc->data_idx = sc->cmd_idx = 0;
1861 
1862 	val = htobe32(0);
1863 	(void)uath_cmd_write(sc, UATH_CMD_02, &val, sizeof val, 0);
1864 
1865 	/* set MAC address */
1866 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
1867 	(void)uath_write_multi(sc, 0x13, ic->ic_myaddr, IEEE80211_ADDR_LEN);
1868 
1869 	(void)uath_write_reg(sc, 0x02, 0x00000001);
1870 	(void)uath_write_reg(sc, 0x0e, 0x0000003f);
1871 	(void)uath_write_reg(sc, 0x10, 0x00000001);
1872 	(void)uath_write_reg(sc, 0x06, 0x0000001e);
1873 
1874 	/*
1875 	 * Queue Rx data xfers.
1876 	 */
1877 	for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
1878 		struct uath_rx_data *data = &sc->rx_data[i];
1879 
1880 		usbd_setup_xfer(data->xfer, sc->data_rx_pipe, data, data->buf,
1881 		    sc->rxbufsz, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT,
1882 		    uath_data_rxeof);
1883 		error = usbd_transfer(data->xfer);
1884 		if (error != USBD_IN_PROGRESS && error != 0) {
1885 			printf("%s: could not queue Rx transfer\n",
1886 			    sc->sc_dev.dv_xname);
1887 			goto fail;
1888 		}
1889 	}
1890 
1891 	error = uath_cmd_read(sc, UATH_CMD_07, NULL, 0, &val,
1892 	    UATH_CMD_FLAG_MAGIC);
1893 	if (error != 0) {
1894 		printf("%s: could not send read command 07h\n",
1895 		    sc->sc_dev.dv_xname);
1896 		goto fail;
1897 	}
1898 	DPRINTF(("command 07h return code: %x\n", betoh32(val)));
1899 
1900 	/* set default channel */
1901 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
1902 	if ((error = uath_set_chan(sc, ic->ic_bss->ni_chan)) != 0) {
1903 		printf("%s: could not set channel\n", sc->sc_dev.dv_xname);
1904 		goto fail;
1905 	}
1906 
1907 	if ((error = uath_wme_init(sc)) != 0) {
1908 		printf("%s: could not setup WME parameters\n",
1909 		    sc->sc_dev.dv_xname);
1910 		goto fail;
1911 	}
1912 
1913 	/* init MAC registers */
1914 	(void)uath_write_reg(sc, 0x19, 0x00000000);
1915 	(void)uath_write_reg(sc, 0x1a, 0x0000003c);
1916 	(void)uath_write_reg(sc, 0x1b, 0x0000003c);
1917 	(void)uath_write_reg(sc, 0x1c, 0x00000000);
1918 	(void)uath_write_reg(sc, 0x1e, 0x00000000);
1919 	(void)uath_write_reg(sc, 0x1f, 0x00000003);
1920 	(void)uath_write_reg(sc, 0x0c, 0x00000000);
1921 	(void)uath_write_reg(sc, 0x0f, 0x00000002);
1922 	(void)uath_write_reg(sc, 0x0a, 0x00000007);	/* XXX retry? */
1923 	(void)uath_write_reg(sc, 0x09, ic->ic_rtsthreshold);
1924 
1925 	val = htobe32(4);
1926 	(void)uath_cmd_write(sc, UATH_CMD_27, &val, sizeof val, 0);
1927 	(void)uath_cmd_write(sc, UATH_CMD_27, &val, sizeof val, 0);
1928 	(void)uath_cmd_write(sc, UATH_CMD_1B, NULL, 0, 0);
1929 
1930 	if ((error = uath_set_keys(sc)) != 0) {
1931 		printf("%s: could not set crypto keys\n",
1932 		    sc->sc_dev.dv_xname);
1933 		goto fail;
1934 	}
1935 
1936 	/* enable Rx */
1937 	(void)uath_set_rxfilter(sc, 0x0000, 4);
1938 	(void)uath_set_rxfilter(sc, 0x0817, 1);
1939 
1940 	cmd31.magic1 = htobe32(0xffffffff);
1941 	cmd31.magic2 = htobe32(0xffffffff);
1942 	(void)uath_cmd_write(sc, UATH_CMD_31, &cmd31, sizeof cmd31, 0);
1943 
1944 	ifp->if_flags &= ~IFF_OACTIVE;
1945 	ifp->if_flags |= IFF_RUNNING;
1946 
1947 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
1948 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1949 	else
1950 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1951 
1952 	return 0;
1953 
1954 fail:	uath_stop(ifp, 1);
1955 	return error;
1956 }
1957 
1958 void
1959 uath_stop(struct ifnet *ifp, int disable)
1960 {
1961 	struct uath_softc *sc = ifp->if_softc;
1962 	struct ieee80211com *ic = &sc->sc_ic;
1963 	uint32_t val;
1964 	int s;
1965 
1966 	s = splusb();
1967 
1968 	sc->sc_tx_timer = 0;
1969 	ifp->if_timer = 0;
1970 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
1971 
1972 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
1973 
1974 	val = htobe32(0);
1975 	(void)uath_cmd_write(sc, UATH_CMD_SET_STATE, &val, sizeof val, 0);
1976 	(void)uath_cmd_write(sc, UATH_CMD_RESET, NULL, 0, 0);
1977 
1978 	val = htobe32(0);
1979 	(void)uath_cmd_write(sc, UATH_CMD_15, &val, sizeof val, 0);
1980 
1981 #if 0
1982 	(void)uath_cmd_read(sc, UATH_CMD_SHUTDOWN, NULL, 0, NULL,
1983 	    UATH_CMD_FLAG_MAGIC);
1984 #endif
1985 
1986 	/* abort any pending transfers */
1987 	usbd_abort_pipe(sc->data_tx_pipe);
1988 	usbd_abort_pipe(sc->data_rx_pipe);
1989 	usbd_abort_pipe(sc->cmd_tx_pipe);
1990 
1991 	splx(s);
1992 }
1993 
1994 /*
1995  * Load the MIPS R4000 microcode into the device.  Once the image is loaded,
1996  * the device will detach itself from the bus and reattach later with a new
1997  * product Id (a la ezusb).  XXX this could also be implemented in userland
1998  * through /dev/ugen.
1999  */
2000 int
2001 uath_loadfirmware(struct uath_softc *sc, const u_char *fw, int len)
2002 {
2003 	struct usbd_xfer *ctlxfer, *txxfer, *rxxfer;
2004 	struct uath_fwblock *txblock, *rxblock;
2005 	uint8_t *txdata;
2006 	int error = 0;
2007 
2008 	if ((ctlxfer = usbd_alloc_xfer(sc->sc_udev)) == NULL) {
2009 		printf("%s: could not allocate Tx control xfer\n",
2010 		    sc->sc_dev.dv_xname);
2011 		error = USBD_NOMEM;
2012 		goto fail1;
2013 	}
2014 	txblock = usbd_alloc_buffer(ctlxfer, sizeof (struct uath_fwblock));
2015 	if (txblock == NULL) {
2016 		printf("%s: could not allocate Tx control block\n",
2017 		    sc->sc_dev.dv_xname);
2018 		error = USBD_NOMEM;
2019 		goto fail2;
2020 	}
2021 
2022 	if ((txxfer = usbd_alloc_xfer(sc->sc_udev)) == NULL) {
2023 		printf("%s: could not allocate Tx xfer\n",
2024 		    sc->sc_dev.dv_xname);
2025 		error = USBD_NOMEM;
2026 		goto fail2;
2027 	}
2028 	txdata = usbd_alloc_buffer(txxfer, UATH_MAX_FWBLOCK_SIZE);
2029 	if (txdata == NULL) {
2030 		printf("%s: could not allocate Tx buffer\n",
2031 		    sc->sc_dev.dv_xname);
2032 		error = USBD_NOMEM;
2033 		goto fail3;
2034 	}
2035 
2036 	if ((rxxfer = usbd_alloc_xfer(sc->sc_udev)) == NULL) {
2037 		printf("%s: could not allocate Rx control xfer\n",
2038 		    sc->sc_dev.dv_xname);
2039 		error = USBD_NOMEM;
2040 		goto fail3;
2041 	}
2042 	rxblock = usbd_alloc_buffer(rxxfer, sizeof (struct uath_fwblock));
2043 	if (rxblock == NULL) {
2044 		printf("%s: could not allocate Rx control block\n",
2045 		    sc->sc_dev.dv_xname);
2046 		error = USBD_NOMEM;
2047 		goto fail4;
2048 	}
2049 
2050 	bzero(txblock, sizeof (struct uath_fwblock));
2051 	txblock->flags = htobe32(UATH_WRITE_BLOCK);
2052 	txblock->total = htobe32(len);
2053 
2054 	while (len > 0) {
2055 		int mlen = min(len, UATH_MAX_FWBLOCK_SIZE);
2056 
2057 		txblock->remain = htobe32(len - mlen);
2058 		txblock->len = htobe32(mlen);
2059 
2060 		DPRINTF(("sending firmware block: %d bytes remaining\n",
2061 		    len - mlen));
2062 
2063 		/* send firmware block meta-data */
2064 		usbd_setup_xfer(ctlxfer, sc->cmd_tx_pipe, sc, txblock,
2065 		    sizeof (struct uath_fwblock),
2066 		    USBD_NO_COPY | USBD_SYNCHRONOUS,
2067 		    UATH_CMD_TIMEOUT, NULL);
2068 		if ((error = usbd_transfer(ctlxfer)) != 0) {
2069 			printf("%s: could not send firmware block info\n",
2070 			    sc->sc_dev.dv_xname);
2071 			break;
2072 		}
2073 
2074 		/* send firmware block data */
2075 		bcopy(fw, txdata, mlen);
2076 		usbd_setup_xfer(txxfer, sc->data_tx_pipe, sc, txdata, mlen,
2077 		    USBD_NO_COPY | USBD_SYNCHRONOUS, UATH_DATA_TIMEOUT, NULL);
2078 		if ((error = usbd_transfer(txxfer)) != 0) {
2079 			printf("%s: could not send firmware block data\n",
2080 			    sc->sc_dev.dv_xname);
2081 			break;
2082 		}
2083 
2084 		/* wait for ack from firmware */
2085 		usbd_setup_xfer(rxxfer, sc->cmd_rx_pipe, sc, rxblock,
2086 		    sizeof (struct uath_fwblock), USBD_SHORT_XFER_OK |
2087 		    USBD_NO_COPY | USBD_SYNCHRONOUS, UATH_CMD_TIMEOUT, NULL);
2088 		if ((error = usbd_transfer(rxxfer)) != 0) {
2089 			printf("%s: could not read firmware answer\n",
2090 			    sc->sc_dev.dv_xname);
2091 			break;
2092 		}
2093 
2094 		DPRINTFN(2, ("rxblock flags=0x%x total=%d\n",
2095 		    betoh32(rxblock->flags), betoh32(rxblock->rxtotal)));
2096 		fw += mlen;
2097 		len -= mlen;
2098 	}
2099 
2100 fail4:	usbd_free_xfer(rxxfer);
2101 fail3:	usbd_free_xfer(txxfer);
2102 fail2:	usbd_free_xfer(ctlxfer);
2103 fail1:	return error;
2104 }
2105