xref: /netbsd/sys/dev/usb/if_athn_usb.c (revision d71f4570)
1 /*	$NetBSD: if_athn_usb.c,v 1.31 2018/10/03 10:02:08 martin Exp $	*/
2 /*	$OpenBSD: if_athn_usb.c,v 1.12 2013/01/14 09:50:31 jsing Exp $	*/
3 
4 /*-
5  * Copyright (c) 2011 Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * USB front-end for Atheros AR9271 and AR7010 chipsets.
22  */
23 
24 #include <sys/cdefs.h>
25 __KERNEL_RCSID(0, "$NetBSD: if_athn_usb.c,v 1.31 2018/10/03 10:02:08 martin Exp $");
26 
27 #ifdef	_KERNEL_OPT
28 #include "opt_inet.h"
29 #endif
30 
31 #include <sys/param.h>
32 #include <sys/callout.h>
33 #include <sys/conf.h>
34 #include <sys/device.h>
35 #include <sys/kernel.h>
36 #include <sys/mbuf.h>
37 #include <sys/module.h>
38 #include <sys/proc.h>
39 #include <sys/socket.h>
40 #include <sys/sockio.h>
41 #include <sys/systm.h>
42 #include <sys/kmem.h>
43 
44 #include <sys/bus.h>
45 #include <sys/endian.h>
46 #include <sys/intr.h>
47 
48 #include <net/bpf.h>
49 #include <net/if.h>
50 #include <net/if_arp.h>
51 #include <net/if_dl.h>
52 #include <net/if_ether.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 
56 #include <netinet/if_inarp.h>
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_amrr.h>
64 #include <net80211/ieee80211_radiotap.h>
65 
66 #include <dev/firmload.h>
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdevs.h>
70 #include <dev/usb/usbdi.h>
71 #include <dev/usb/usbdi_util.h>
72 
73 #include <dev/ic/athnreg.h>
74 #include <dev/ic/athnvar.h>
75 #include <dev/ic/arn9285.h>
76 #include <dev/usb/if_athn_usb.h>
77 
78 #define ATHN_USB_SOFTC(sc)	((struct athn_usb_softc *)(sc))
79 #define ATHN_USB_NODE(ni)	((struct athn_usb_node *)(ni))
80 
81 #define IS_UP_AND_RUNNING(ifp) \
82 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
83 
84 #define athn_usb_wmi_cmd(sc, cmd_id) \
85 	athn_usb_wmi_xcmd(sc, cmd_id, NULL, 0, NULL)
86 
87 Static int	athn_usb_activate(device_t, enum devact);
88 Static int	athn_usb_detach(device_t, int);
89 Static int	athn_usb_match(device_t, cfdata_t, void *);
90 Static void	athn_usb_attach(device_t, device_t, void *);
91 
92 CFATTACH_DECL_NEW(athn_usb, sizeof(struct athn_usb_softc), athn_usb_match,
93     athn_usb_attach, athn_usb_detach, athn_usb_activate);
94 
95 Static int	athn_usb_alloc_rx_list(struct athn_usb_softc *);
96 Static int	athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
97 Static int	athn_usb_alloc_tx_msg(struct athn_usb_softc *);
98 Static int	athn_usb_alloc_tx_list(struct athn_usb_softc *);
99 Static void	athn_usb_attachhook(device_t);
100 Static void	athn_usb_bcneof(struct usbd_xfer *, void *,
101 		    usbd_status);
102 Static void	athn_usb_abort_pipes(struct athn_usb_softc *);
103 Static void	athn_usb_close_pipes(struct athn_usb_softc *);
104 Static int	athn_usb_create_hw_node(struct athn_usb_softc *,
105 		    struct ar_htc_target_sta *);
106 Static int	athn_usb_create_node(struct athn_usb_softc *,
107 		    struct ieee80211_node *);
108 Static void	athn_usb_do_async(struct athn_usb_softc *,
109 		    void (*)(struct athn_usb_softc *, void *), void *, int);
110 Static void	athn_usb_free_rx_list(struct athn_usb_softc *);
111 Static void	athn_usb_free_tx_cmd(struct athn_usb_softc *);
112 Static void	athn_usb_free_tx_msg(struct athn_usb_softc *);
113 Static void	athn_usb_free_tx_list(struct athn_usb_softc *);
114 Static int	athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
115 		    uint8_t, uint8_t, uint8_t *);
116 Static int	athn_usb_htc_msg(struct athn_usb_softc *, uint16_t, void *,
117 		    int);
118 Static int	athn_usb_htc_setup(struct athn_usb_softc *);
119 Static int	athn_usb_init(struct ifnet *);
120 Static int	athn_usb_init_locked(struct ifnet *);
121 Static void	athn_usb_intr(struct usbd_xfer *, void *,
122 		    usbd_status);
123 Static int	athn_usb_ioctl(struct ifnet *, u_long, void *);
124 Static int	athn_usb_load_firmware(struct athn_usb_softc *);
125 Static const struct athn_usb_type *
126 		athn_usb_lookup(int, int);
127 Static int	athn_usb_media_change(struct ifnet *);
128 Static void	athn_usb_newassoc(struct ieee80211_node *, int);
129 Static void	athn_usb_newassoc_cb(struct athn_usb_softc *, void *);
130 Static int	athn_usb_newstate(struct ieee80211com *, enum ieee80211_state,
131 		    int);
132 Static void	athn_usb_newstate_cb(struct athn_usb_softc *, void *);
133 Static void	athn_usb_node_cleanup(struct ieee80211_node *);
134 Static void	athn_usb_node_cleanup_cb(struct athn_usb_softc *, void *);
135 Static int	athn_usb_open_pipes(struct athn_usb_softc *);
136 Static uint32_t	athn_usb_read(struct athn_softc *, uint32_t);
137 Static int	athn_usb_remove_hw_node(struct athn_usb_softc *, uint8_t *);
138 Static void	athn_usb_rx_enable(struct athn_softc *);
139 Static void	athn_usb_rx_frame(struct athn_usb_softc *, struct mbuf *);
140 Static void	athn_usb_rx_radiotap(struct athn_softc *, struct mbuf *,
141 		    struct ar_rx_status *);
142 Static void	athn_usb_rx_wmi_ctrl(struct athn_usb_softc *, uint8_t *, size_t);
143 Static void	athn_usb_rxeof(struct usbd_xfer *, void *,
144 		    usbd_status);
145 Static void	athn_usb_start(struct ifnet *);
146 //Static void	athn_usb_start_locked(struct ifnet *);
147 Static void	athn_usb_stop(struct ifnet *, int disable);
148 Static void	athn_usb_stop_locked(struct ifnet *);
149 Static void	athn_usb_swba(struct athn_usb_softc *);
150 Static int	athn_usb_switch_chan(struct athn_softc *,
151 		    struct ieee80211_channel *, struct ieee80211_channel *);
152 Static void	athn_usb_task(void *);
153 Static int	athn_usb_tx(struct athn_softc *, struct mbuf *,
154 		    struct ieee80211_node *, struct athn_usb_tx_data *);
155 Static void	athn_usb_txeof(struct usbd_xfer *, void *,
156 		    usbd_status);
157 Static void	athn_usb_updateslot(struct ifnet *);
158 Static void	athn_usb_updateslot_cb(struct athn_usb_softc *, void *);
159 Static void	athn_usb_wait_async(struct athn_usb_softc *);
160 Static int	athn_usb_wait_msg(struct athn_usb_softc *);
161 Static void	athn_usb_watchdog(struct ifnet *);
162 Static int	athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
163 		    int, void *);
164 Static void	athn_usb_wmieof(struct usbd_xfer *, void *,
165 		    usbd_status);
166 Static void	athn_usb_write(struct athn_softc *, uint32_t, uint32_t);
167 Static void	athn_usb_write_barrier(struct athn_softc *);
168 
169 /************************************************************************
170  * unused/notyet declarations
171  */
172 #ifdef unused
173 Static int	athn_usb_read_rom(struct athn_softc *);
174 #endif /* unused */
175 
176 #ifdef notyet_edca
177 Static void	athn_usb_updateedca(struct ieee80211com *);
178 Static void	athn_usb_updateedca_cb(struct athn_usb_softc *, void *);
179 #endif /* notyet_edca */
180 
181 #ifdef notyet
182 Static int	athn_usb_ampdu_tx_start(struct ieee80211com *,
183 		    struct ieee80211_node *, uint8_t);
184 Static void	athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *, void *);
185 Static void	athn_usb_ampdu_tx_stop(struct ieee80211com *,
186 		    struct ieee80211_node *, uint8_t);
187 Static void	athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *, void *);
188 Static void	athn_usb_delete_key(struct ieee80211com *,
189 		    struct ieee80211_node *, struct ieee80211_key *);
190 Static void	athn_usb_delete_key_cb(struct athn_usb_softc *, void *);
191 Static int	athn_usb_set_key(struct ieee80211com *,
192 		    struct ieee80211_node *, struct ieee80211_key *);
193 Static void	athn_usb_set_key_cb(struct athn_usb_softc *, void *);
194 #endif /* notyet */
195 /************************************************************************/
196 
197 struct athn_usb_type {
198 	struct usb_devno	devno;
199 	u_int			flags;
200 };
201 
202 Static const struct athn_usb_type *
203 athn_usb_lookup(int vendor, int product)
204 {
205 	static const struct athn_usb_type athn_usb_devs[] = {
206 #define _D(v,p,f) \
207 		{{ USB_VENDOR_##v, USB_PRODUCT_##p }, ATHN_USB_FLAG_##f }
208 
209 		_D( ACCTON,	ACCTON_AR9280,		AR7010 ),
210 		_D( ACTIONTEC,	ACTIONTEC_AR9287,	AR7010 ),
211 		_D( ATHEROS2,	ATHEROS2_AR9271_1,	NONE ),
212 		_D( ATHEROS2,	ATHEROS2_AR9271_2,	NONE ),
213 		_D( ATHEROS2,	ATHEROS2_AR9271_3,	NONE ),
214 		_D( ATHEROS2,	ATHEROS2_AR9280,	AR7010 ),
215 		_D( ATHEROS2,	ATHEROS2_AR9287,	AR7010 ),
216 		_D( AZUREWAVE,	AZUREWAVE_AR9271_1,	NONE ),
217 		_D( AZUREWAVE,	AZUREWAVE_AR9271_2,	NONE ),
218 		_D( AZUREWAVE,	AZUREWAVE_AR9271_3,	NONE ),
219 		_D( AZUREWAVE,	AZUREWAVE_AR9271_4,	NONE ),
220 		_D( AZUREWAVE,	AZUREWAVE_AR9271_5,	NONE ),
221 		_D( AZUREWAVE,	AZUREWAVE_AR9271_6,	NONE ),
222 		_D( DLINK2,	DLINK2_AR9271,	  	NONE ),
223 		_D( LITEON,	LITEON_AR9271,	  	NONE ),
224 		_D( NETGEAR,	NETGEAR_WNA1100,	NONE ),
225 		_D( NETGEAR,	NETGEAR_WNDA3200,	AR7010 ),
226 		_D( VIA,	VIA_AR9271,		NONE ),
227 		_D( MELCO,	MELCO_CEWL_1,		AR7010 ),
228 		_D( PANASONIC,	PANASONIC_N5HBZ0000055,	AR7010 ),
229 #undef _D
230 	};
231 
232 	return (const void *)usb_lookup(athn_usb_devs, vendor, product);
233 }
234 
235 Static int
236 athn_usb_match(device_t parent, cfdata_t match, void *aux)
237 {
238 	struct usb_attach_arg *uaa = aux;
239 
240 	return athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
241 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
242 }
243 
244 Static void
245 athn_usb_attach(device_t parent, device_t self, void *aux)
246 {
247 	struct athn_usb_softc *usc;
248 	struct athn_softc *sc;
249 	struct usb_attach_arg *uaa;
250 	int error;
251 
252 	usc = device_private(self);
253 	sc = &usc->usc_sc;
254 	uaa = aux;
255 	sc->sc_dev = self;
256 	usc->usc_udev = uaa->uaa_device;
257 
258 	aprint_naive("\n");
259 	aprint_normal("\n");
260 
261 	DPRINTFN(DBG_FN, sc, "\n");
262 
263 	usc->usc_athn_attached = 0;
264 	usc->usc_flags = athn_usb_lookup(uaa->uaa_vendor, uaa->uaa_product)->flags;
265 	sc->sc_flags |= ATHN_FLAG_USB;
266 #ifdef notyet
267 	/* Check if it is a combo WiFi+Bluetooth (WB193) device. */
268 	if (strncmp(product, "wb193", 5) == 0)
269 		sc->sc_flags |= ATHN_FLAG_BTCOEX3WIRE;
270 #endif
271 
272 	sc->sc_ops.read = athn_usb_read;
273 	sc->sc_ops.write = athn_usb_write;
274 	sc->sc_ops.write_barrier = athn_usb_write_barrier;
275 
276 	mutex_init(&usc->usc_lock, MUTEX_DEFAULT, IPL_NONE);
277 
278 	cv_init(&usc->usc_wmi_cv, "athnwmi");
279 	cv_init(&usc->usc_htc_cv, "athnhtc");
280 
281 	cv_init(&usc->usc_cmd_cv, "athncmd");
282 	mutex_init(&usc->usc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
283 	cv_init(&usc->usc_msg_cv, "athnmsg");
284 	mutex_init(&usc->usc_msg_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
285 
286 	cv_init(&usc->usc_task_cv, "athntsk");
287 	mutex_init(&usc->usc_task_mtx, MUTEX_DEFAULT, IPL_NET);
288 	mutex_init(&usc->usc_tx_mtx, MUTEX_DEFAULT, IPL_NONE);
289 
290 	usb_init_task(&usc->usc_task, athn_usb_task, usc, 0);
291 
292 	if (usbd_set_config_no(usc->usc_udev, 1, 0) != 0) {
293 		aprint_error_dev(sc->sc_dev,
294 		    "could not set configuration no\n");
295 		goto fail;
296 	}
297 
298 	/* Get the first interface handle. */
299 	error = usbd_device2interface_handle(usc->usc_udev, 0, &usc->usc_iface);
300 	if (error != 0) {
301 		aprint_error_dev(sc->sc_dev,
302 		    "could not get interface handle\n");
303 		goto fail;
304 	}
305 
306 	if (athn_usb_open_pipes(usc) != 0)
307 		goto fail;
308 
309 	/* Allocate xfer for firmware commands. */
310 	if (athn_usb_alloc_tx_cmd(usc) != 0)
311 		goto fail;
312 
313 	/* Allocate xfer for firmware commands. */
314 	if (athn_usb_alloc_tx_msg(usc) != 0)
315 		goto fail;
316 
317 	/* Allocate Tx/Rx buffers. */
318 	error = athn_usb_alloc_rx_list(usc);
319 	if (error != 0)
320 		goto fail;
321 	error = athn_usb_alloc_tx_list(usc);
322 	if (error != 0)
323 		goto fail;
324 
325 	config_mountroot(self, athn_usb_attachhook);
326 
327 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, usc->usc_udev, sc->sc_dev);
328 	return;
329 
330  fail:
331 
332 	/* Free Tx/Rx buffers. */
333 	athn_usb_abort_pipes(usc);
334 	athn_usb_free_tx_list(usc);
335 	athn_usb_free_rx_list(usc);
336 	athn_usb_free_tx_cmd(usc);
337 	athn_usb_free_tx_msg(usc);
338 	athn_usb_close_pipes(usc);
339 	usb_rem_task_wait(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER,
340 	    NULL);
341 
342 	cv_destroy(&usc->usc_cmd_cv);
343 	cv_destroy(&usc->usc_msg_cv);
344 
345 	cv_destroy(&usc->usc_wmi_cv);
346 	cv_destroy(&usc->usc_htc_cv);
347 	mutex_destroy(&usc->usc_lock);
348 
349 	mutex_destroy(&usc->usc_cmd_mtx);
350 	mutex_destroy(&usc->usc_msg_mtx);
351 	mutex_destroy(&usc->usc_tx_mtx);
352 	mutex_destroy(&usc->usc_task_mtx);
353 }
354 
355 Static void
356 athn_usb_node_cleanup_cb(struct athn_usb_softc *usc, void *arg)
357 {
358 	uint8_t sta_index = *(uint8_t *)arg;
359 
360 	DPRINTFN(DBG_FN, usc, "\n");
361 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
362 	athn_usb_remove_hw_node(usc, &sta_index);
363 }
364 
365 Static void
366 athn_usb_node_cleanup(struct ieee80211_node *ni)
367 {
368 	struct athn_usb_softc *usc;
369 	struct ieee80211com *ic;
370 	uint8_t sta_index;
371 
372 	usc = ATHN_USB_SOFTC(ni->ni_ic->ic_ifp->if_softc);
373 	ic = &ATHN_SOFTC(usc)->sc_ic;
374 
375 	DPRINTFN(DBG_FN, usc, "\n");
376 
377 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
378 		sta_index = ATHN_NODE(ni)->sta_index;
379 		if (sta_index != 0)
380 			athn_usb_do_async(usc, athn_usb_node_cleanup_cb,
381 			    &sta_index, sizeof(sta_index));
382 	}
383 	usc->usc_node_cleanup(ni);
384 }
385 
386 Static void
387 athn_usb_attachhook(device_t arg)
388 {
389 	struct athn_usb_softc *usc = device_private(arg);
390 	struct athn_softc *sc = &usc->usc_sc;
391 	struct athn_ops *ops = &sc->sc_ops;
392 	struct ieee80211com *ic = &sc->sc_ic;
393 	struct ifnet *ifp = &sc->sc_if;
394 	size_t i;
395 	int error;
396 
397 	if (usc->usc_dying)
398 		return;
399 
400 	DPRINTFN(DBG_FN, usc, "\n");
401 
402 	/* Load firmware. */
403 	error = athn_usb_load_firmware(usc);
404 	if (error != 0) {
405 		aprint_error_dev(sc->sc_dev,
406 		    "could not load firmware (%d)\n", error);
407 		return;
408 	}
409 
410 	/* Setup the host transport communication interface. */
411 	error = athn_usb_htc_setup(usc);
412 	if (error != 0)
413 		return;
414 
415 	/* We're now ready to attach the bus agnostic driver. */
416 	ic->ic_ifp = ifp;
417 	ic->ic_updateslot = athn_usb_updateslot;
418 	sc->sc_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
419 	sc->sc_media_change = athn_usb_media_change;
420 
421 	/* Override some operations for USB. */
422 	ifp->if_init = athn_usb_init;
423 	ifp->if_stop = athn_usb_stop;
424 	ifp->if_ioctl = athn_usb_ioctl;
425 	ifp->if_start = athn_usb_start;
426 	ifp->if_watchdog = athn_usb_watchdog;
427 
428 	error = athn_attach(sc);
429 	if (error != 0) {
430 		return;
431 	}
432 	usc->usc_athn_attached = 1;
433 
434 	/* hooks for HostAP association and disassociation */
435 	ic->ic_newassoc = athn_usb_newassoc;
436 	usc->usc_node_cleanup = ic->ic_node_cleanup;
437 	ic->ic_node_cleanup = athn_usb_node_cleanup;
438 
439 #ifdef notyet_edca
440 	ic->ic_updateedca = athn_usb_updateedca;
441 #endif
442 #ifdef notyet
443 	ic->ic_set_key = athn_usb_set_key;
444 	ic->ic_delete_key = athn_usb_delete_key;
445 	ic->ic_ampdu_tx_start = athn_usb_ampdu_tx_start;
446 	ic->ic_ampdu_tx_stop = athn_usb_ampdu_tx_stop;
447 #endif
448 	ic->ic_newstate = athn_usb_newstate;
449 
450 	ops->rx_enable = athn_usb_rx_enable;
451 
452 	/* Reset HW key cache entries. */
453 	for (i = 0; i < sc->sc_kc_entries; i++)
454 		athn_reset_key(sc, i);
455 
456 	ops->enable_antenna_diversity(sc);
457 
458 #ifdef ATHN_BT_COEXISTENCE
459 	/* Configure bluetooth coexistence for combo chips. */
460 	if (sc->sc_flags & ATHN_FLAG_BTCOEX)
461 		athn_btcoex_init(sc);
462 #endif
463 	/* Configure LED. */
464 	athn_led_init(sc);
465 
466 	ieee80211_announce(ic);
467 }
468 
469 Static int
470 athn_usb_detach(device_t self, int flags)
471 {
472 	struct athn_usb_softc *usc = device_private(self);
473 	struct athn_softc *sc = &usc->usc_sc;
474 	int error;
475 
476 	DPRINTFN(DBG_FN, usc, "\n");
477 
478 	mutex_enter(&usc->usc_lock);
479 	usc->usc_dying = 1;
480 	mutex_exit(&usc->usc_lock);
481 
482 	mutex_enter(&usc->usc_cmd_mtx);
483 	while (usc->usc_wmiactive) {
484 		error = cv_timedwait(&usc->usc_wmi_cv, &usc->usc_cmd_mtx, hz);
485 
486 		if (error) {
487 			mutex_exit(&usc->usc_cmd_mtx);
488 			return error;
489 		}
490 	}
491 	mutex_exit(&usc->usc_cmd_mtx);
492 
493 	mutex_enter(&usc->usc_msg_mtx);
494 	while (usc->usc_htcactive) {
495 		error = cv_timedwait(&usc->usc_htc_cv, &usc->usc_msg_mtx, hz);
496 
497 		if (error) {
498 			mutex_exit(&usc->usc_msg_mtx);
499 			return error;
500 		}
501 	}
502 	mutex_exit(&usc->usc_msg_mtx);
503 
504 	athn_usb_wait_async(usc);
505 
506 	usb_rem_task_wait(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER,
507 	    NULL);
508 
509 	/* Abort Tx/Rx pipes. */
510 	athn_usb_abort_pipes(usc);
511 
512 	if (usc->usc_athn_attached) {
513 		usc->usc_athn_attached = 0;
514 		athn_detach(sc);
515 	}
516 
517 	/* Free Tx/Rx buffers. */
518 	athn_usb_free_rx_list(usc);
519 	athn_usb_free_tx_list(usc);
520 	athn_usb_free_tx_cmd(usc);
521 
522 	/* Close Tx/Rx pipes. */
523 	athn_usb_close_pipes(usc);
524 
525 	mutex_destroy(&usc->usc_tx_mtx);
526 	cv_destroy(&usc->usc_task_cv);
527 	mutex_destroy(&usc->usc_task_mtx);
528 
529 	mutex_destroy(&usc->usc_cmd_mtx);
530 	cv_destroy(&usc->usc_cmd_cv);
531 	mutex_destroy(&usc->usc_msg_mtx);
532 	cv_destroy(&usc->usc_msg_cv);
533 
534 	cv_destroy(&usc->usc_wmi_cv);
535 	mutex_destroy(&usc->usc_lock);
536 
537 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, usc->usc_udev, sc->sc_dev);
538 	return 0;
539 }
540 
541 Static int
542 athn_usb_activate(device_t self, enum devact act)
543 {
544 	struct athn_usb_softc *usc = device_private(self);
545 	struct athn_softc *sc = &usc->usc_sc;
546 
547 	DPRINTFN(DBG_FN, usc, "\n");
548 
549 	switch (act) {
550 	case DVACT_DEACTIVATE:
551 		if_deactivate(sc->sc_ic.ic_ifp);
552 		usc->usc_dying = 1;
553 		return 0;
554 	default:
555 		return EOPNOTSUPP;
556 	}
557 }
558 
559 Static int
560 athn_usb_open_pipes(struct athn_usb_softc *usc)
561 {
562 	usb_endpoint_descriptor_t *ed;
563 	int error;
564 
565 	DPRINTFN(DBG_FN, usc, "\n");
566 
567 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_DATA, 0,
568 	    &usc->usc_tx_data_pipe);
569 	if (error != 0) {
570 		aprint_error_dev(usc->usc_dev,
571 		    "could not open Tx bulk pipe\n");
572 		goto fail;
573 	}
574 
575 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_RX_DATA, 0,
576 	    &usc->usc_rx_data_pipe);
577 	if (error != 0) {
578 		aprint_error_dev(usc->usc_dev,
579 		    "could not open Rx bulk pipe\n");
580 		goto fail;
581 	}
582 
583 	ed = usbd_get_endpoint_descriptor(usc->usc_iface, AR_PIPE_RX_INTR);
584 	if (ed == NULL) {
585 		aprint_error_dev(usc->usc_dev,
586 		    "could not retrieve Rx intr pipe descriptor\n");
587 		goto fail;
588 	}
589 	usc->usc_ibufsize = UGETW(ed->wMaxPacketSize);
590 	if (usc->usc_ibufsize == 0) {
591 		aprint_error_dev(usc->usc_dev,
592 		    "invalid Rx intr pipe descriptor\n");
593 		goto fail;
594 	}
595 	usc->usc_ibuf = kmem_alloc(usc->usc_ibufsize, KM_SLEEP);
596 
597 	error = usbd_open_pipe_intr(usc->usc_iface, AR_PIPE_RX_INTR,
598 	    USBD_SHORT_XFER_OK, &usc->usc_rx_intr_pipe, usc, usc->usc_ibuf,
599 	    usc->usc_ibufsize, athn_usb_intr, USBD_DEFAULT_INTERVAL);
600 	if (error != 0) {
601 		aprint_error_dev(usc->usc_dev,
602 		    "could not open Rx intr pipe\n");
603 		goto fail;
604 	}
605 	error = usbd_open_pipe(usc->usc_iface, AR_PIPE_TX_INTR, 0,
606 	    &usc->usc_tx_intr_pipe);
607 	if (error != 0) {
608 		aprint_error_dev(usc->usc_dev,
609 		    "could not open Tx intr pipe\n");
610 		goto fail;
611 	}
612 	return 0;
613  fail:
614 	athn_usb_abort_pipes(usc);
615 	athn_usb_close_pipes(usc);
616 	return error;
617 }
618 
619 static inline void
620 athn_usb_kill_pipe(struct usbd_pipe **pipeptr)
621 {
622 	struct usbd_pipe *pipe;
623 
624 	CTASSERT(sizeof(pipe) == sizeof(void *));
625 	pipe = atomic_swap_ptr(pipeptr, NULL);
626 	if (pipe != NULL) {
627 		usbd_close_pipe(pipe);
628 	}
629 }
630 
631 Static void
632 athn_usb_abort_pipes(struct athn_usb_softc *usc)
633 {
634 	DPRINTFN(DBG_FN, usc, "\n");
635 
636 	if (usc->usc_tx_data_pipe != NULL)
637 		usbd_abort_pipe(usc->usc_tx_data_pipe);
638 	if (usc->usc_rx_data_pipe != NULL)
639 		usbd_abort_pipe(usc->usc_rx_data_pipe);
640 	if (usc->usc_tx_intr_pipe != NULL)
641 		usbd_abort_pipe(usc->usc_tx_intr_pipe);
642 	if (usc->usc_rx_intr_pipe != NULL)
643 		usbd_abort_pipe(usc->usc_rx_intr_pipe);
644 }
645 
646 Static void
647 athn_usb_close_pipes(struct athn_usb_softc *usc)
648 {
649 	uint8_t *ibuf;
650 
651 	DPRINTFN(DBG_FN, usc, "\n");
652 
653 	athn_usb_kill_pipe(&usc->usc_tx_data_pipe);
654 	athn_usb_kill_pipe(&usc->usc_rx_data_pipe);
655 	athn_usb_kill_pipe(&usc->usc_tx_intr_pipe);
656 	athn_usb_kill_pipe(&usc->usc_rx_intr_pipe);
657 	ibuf = atomic_swap_ptr(&usc->usc_ibuf, NULL);
658 	if (ibuf != NULL)
659 		kmem_free(ibuf, usc->usc_ibufsize);
660 }
661 
662 Static int
663 athn_usb_alloc_rx_list(struct athn_usb_softc *usc)
664 {
665 	struct athn_usb_rx_data *data;
666 	size_t i;
667 	int error = 0;
668 
669 	DPRINTFN(DBG_FN, usc, "\n");
670 
671 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
672 		data = &usc->usc_rx_data[i];
673 
674 		data->sc = usc;	/* Backpointer for callbacks. */
675 
676 		error = usbd_create_xfer(usc->usc_rx_data_pipe,
677 		    ATHN_USB_RXBUFSZ, 0, 0, &data->xfer);
678 		if (error) {
679 			aprint_error_dev(usc->usc_dev,
680 			    "could not allocate xfer\n");
681 			break;
682 		}
683 		data->buf = usbd_get_buffer(data->xfer);
684 	}
685 	if (error != 0)
686 		athn_usb_free_rx_list(usc);
687 	return error;
688 }
689 
690 Static void
691 athn_usb_free_rx_list(struct athn_usb_softc *usc)
692 {
693 	struct usbd_xfer *xfer;
694 	size_t i;
695 
696 	DPRINTFN(DBG_FN, usc, "\n");
697 
698 	/* NB: Caller must abort pipe first. */
699 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
700 		CTASSERT(sizeof(xfer) == sizeof(void *));
701 		xfer = atomic_swap_ptr(&usc->usc_rx_data[i].xfer, NULL);
702 		if (xfer != NULL)
703 			usbd_destroy_xfer(xfer);
704 	}
705 }
706 
707 Static int
708 athn_usb_alloc_tx_list(struct athn_usb_softc *usc)
709 {
710 	struct athn_usb_tx_data *data;
711 	size_t i;
712 	int error = 0;
713 
714 	DPRINTFN(DBG_FN, usc, "\n");
715 
716 	mutex_enter(&usc->usc_tx_mtx);
717 	TAILQ_INIT(&usc->usc_tx_free_list);
718 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
719 		data = &usc->usc_tx_data[i];
720 
721 		data->sc = usc;	/* Backpointer for callbacks. */
722 
723 		error = usbd_create_xfer(usc->usc_tx_data_pipe,
724 		    ATHN_USB_TXBUFSZ, USBD_FORCE_SHORT_XFER, 0, &data->xfer);
725 		if (error) {
726 			aprint_error_dev(usc->usc_dev,
727 			    "could not create xfer on TX pipe\n");
728 			break;
729 		}
730 		data->buf = usbd_get_buffer(data->xfer);
731 
732 		/* Append this Tx buffer to our free list. */
733 		TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
734 	}
735 	if (error == 0) {
736 		/* Steal one buffer for beacons. */
737 		usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
738 		TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
739 	} else {
740 		athn_usb_free_tx_list(usc);
741 	}
742 	mutex_exit(&usc->usc_tx_mtx);
743 
744 	return error;
745 }
746 
747 Static void
748 athn_usb_free_tx_list(struct athn_usb_softc *usc)
749 {
750 	struct usbd_xfer *xfer;
751 	size_t i;
752 
753 	DPRINTFN(DBG_FN, usc, "\n");
754 
755 	/* NB: Caller must abort pipe first. */
756 	for (i = 0; i < ATHN_USB_TX_LIST_COUNT; i++) {
757 		CTASSERT(sizeof(xfer) == sizeof(void *));
758 		xfer = atomic_swap_ptr(&usc->usc_tx_data[i].xfer, NULL);
759 		if (xfer != NULL)
760 			usbd_destroy_xfer(xfer);
761 	}
762 	if (usc->usc_tx_bcn) {
763 		usbd_destroy_xfer(usc->usc_tx_bcn->xfer);
764 		usc->usc_tx_bcn = NULL;
765 	}
766 }
767 
768 Static int
769 athn_usb_alloc_tx_cmd(struct athn_usb_softc *usc)
770 {
771 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
772 
773 	DPRINTFN(DBG_FN, usc, "\n");
774 
775 	data->sc = usc;	/* Backpointer for callbacks. */
776 
777 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
778 	    0, 0, &data->xfer);
779 	if (err) {
780 		aprint_error_dev(usc->usc_dev,
781 		    "could not allocate command xfer\n");
782 		return err;
783 	}
784 	data->buf = usbd_get_buffer(data->xfer);
785 
786 	return 0;
787 }
788 
789 Static void
790 athn_usb_free_tx_cmd(struct athn_usb_softc *usc)
791 {
792 	struct usbd_xfer *xfer;
793 
794 	DPRINTFN(DBG_FN, usc, "\n");
795 
796 	CTASSERT(sizeof(xfer) == sizeof(void *));
797 	xfer = atomic_swap_ptr(&usc->usc_tx_cmd.xfer, NULL);
798 	if (xfer != NULL)
799 		usbd_destroy_xfer(xfer);
800 }
801 
802 Static int
803 athn_usb_alloc_tx_msg(struct athn_usb_softc *usc)
804 {
805 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
806 
807 	DPRINTFN(DBG_FN, usc, "\n");
808 
809 	data->sc = usc;	/* Backpointer for callbacks. */
810 
811 	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
812 	    0, 0, &data->xfer);
813 	if (err) {
814 		aprint_error_dev(usc->usc_dev,
815 		    "could not allocate command xfer\n");
816 		return err;
817 	}
818 	data->buf = usbd_get_buffer(data->xfer);
819 
820 	return 0;
821 }
822 
823 Static void
824 athn_usb_free_tx_msg(struct athn_usb_softc *usc)
825 {
826 	struct usbd_xfer *xfer;
827 
828 	DPRINTFN(DBG_FN, usc, "\n");
829 
830 	CTASSERT(sizeof(xfer) == sizeof(void *));
831 	xfer = atomic_swap_ptr(&usc->usc_tx_msg.xfer, NULL);
832 	if (xfer != NULL)
833 		usbd_destroy_xfer(xfer);
834 }
835 
836 Static void
837 athn_usb_task(void *arg)
838 {
839 	struct athn_usb_softc *usc = arg;
840 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
841 	struct athn_usb_host_cmd *cmd;
842 
843 	DPRINTFN(DBG_FN, usc, "\n");
844 
845 	/* Process host commands. */
846 	mutex_spin_enter(&usc->usc_task_mtx);
847 	while (ring->next != ring->cur) {
848 		cmd = &ring->cmd[ring->next];
849 		mutex_spin_exit(&usc->usc_task_mtx);
850 
851 		/* Invoke callback. */
852 		if (!usc->usc_dying)
853 			cmd->cb(usc, cmd->data);
854 
855 		mutex_spin_enter(&usc->usc_task_mtx);
856 		ring->queued--;
857 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
858 	}
859 	cv_broadcast(&usc->usc_task_cv);
860 	mutex_spin_exit(&usc->usc_task_mtx);
861 }
862 
863 Static void
864 athn_usb_do_async(struct athn_usb_softc *usc,
865     void (*cb)(struct athn_usb_softc *, void *), void *arg, int len)
866 {
867 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
868 	struct athn_usb_host_cmd *cmd;
869 
870 	if (usc->usc_dying)
871 		return;
872 
873 	DPRINTFN(DBG_FN, usc, "\n");
874 
875 	mutex_spin_enter(&usc->usc_task_mtx);
876 	cmd = &ring->cmd[ring->cur];
877 	cmd->cb = cb;
878 	KASSERT(len <= sizeof(cmd->data));
879 	memcpy(cmd->data, arg, len);
880 	ring->cur = (ring->cur + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
881 
882 	/* If there is no pending command already, schedule a task. */
883 	if (++ring->queued == 1) {
884 		usb_add_task(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER);
885 	}
886 	mutex_spin_exit(&usc->usc_task_mtx);
887 }
888 
889 Static void
890 athn_usb_wait_async(struct athn_usb_softc *usc)
891 {
892 
893 	DPRINTFN(DBG_FN, usc, "\n");
894 
895 	/* Wait for all queued asynchronous commands to complete. */
896 	mutex_spin_enter(&usc->usc_task_mtx);
897 	while (usc->usc_cmdq.queued > 0)
898 		cv_wait(&usc->usc_task_cv, &usc->usc_task_mtx);
899 	mutex_spin_exit(&usc->usc_task_mtx);
900 }
901 
902 Static int
903 athn_usb_load_firmware(struct athn_usb_softc *usc)
904 {
905 	struct athn_softc *sc = &usc->usc_sc;
906 	firmware_handle_t fwh;
907 	usb_device_descriptor_t *dd;
908 	usb_device_request_t req;
909 	const char *name;
910 	u_char *fw, *ptr;
911 	size_t size, remain;
912 	uint32_t addr;
913 	int mlen, error;
914 
915 	DPRINTFN(DBG_FN, sc, "\n");
916 
917 	/* Determine which firmware image to load. */
918 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010) {
919 		dd = usbd_get_device_descriptor(usc->usc_udev);
920 		if (UGETW(dd->bcdDevice) == 0x0202)
921 			name = "athn-ar7010-11";
922 		else
923 			name = "athn-ar7010";
924 	} else
925 		name = "athn-ar9271";
926 
927 	/* Read firmware image from the filesystem. */
928 	if ((error = firmware_open("if_athn", name, &fwh)) != 0) {
929 		aprint_error_dev(sc->sc_dev,
930 		    "failed to open firmware file %s (%d)\n", name, error);
931 		return error;
932 	}
933 	size = firmware_get_size(fwh);
934 	fw = firmware_malloc(size);
935 	if (fw == NULL) {
936 		aprint_error_dev(usc->usc_dev,
937 		    "failed to allocate firmware memory\n");
938 		firmware_close(fwh);
939 		return ENOMEM;
940 	}
941 	error = firmware_read(fwh, 0, fw, size);
942 	firmware_close(fwh);
943 	if (error != 0) {
944 		aprint_error_dev(usc->usc_dev,
945 		    "failed to read firmware (error %d)\n", error);
946 		firmware_free(fw, size);
947 		return error;
948 	}
949 
950 	/* Load firmware image. */
951 	ptr = fw;
952 	addr = AR9271_FIRMWARE >> 8;
953 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
954 	req.bRequest = AR_FW_DOWNLOAD;
955 	USETW(req.wIndex, 0);
956 	remain = size;
957 	while (remain > 0) {
958 		mlen = MIN(remain, 4096);
959 
960 		USETW(req.wValue, addr);
961 		USETW(req.wLength, mlen);
962 		error = usbd_do_request(usc->usc_udev, &req, ptr);
963 		if (error != 0) {
964 			firmware_free(fw, size);
965 			return error;
966 		}
967 		addr   += mlen >> 8;
968 		ptr    += mlen;
969 		remain -= mlen;
970 	}
971 	firmware_free(fw, size);
972 
973 	/* Start firmware. */
974 	if (usc->usc_flags & ATHN_USB_FLAG_AR7010)
975 		addr = AR7010_FIRMWARE_TEXT >> 8;
976 	else
977 		addr = AR9271_FIRMWARE_TEXT >> 8;
978 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
979 	req.bRequest = AR_FW_DOWNLOAD_COMP;
980 	USETW(req.wIndex, 0);
981 	USETW(req.wValue, addr);
982 	USETW(req.wLength, 0);
983 
984 	mutex_enter(&usc->usc_msg_mtx);
985 	while (usc->usc_htcactive) {
986 		error = cv_timedwait(&usc->usc_htc_cv, &usc->usc_msg_mtx, hz);
987 
988 		if (error) {
989 			mutex_exit(&usc->usc_msg_mtx);
990 			return error;
991 		}
992 	}
993 
994 	usc->usc_htcactive = true;
995 
996 	KASSERT(usc->usc_wait_msg_id == 0);
997 	usc->usc_wait_msg_id = AR_HTC_MSG_READY;
998 	mutex_exit(&usc->usc_msg_mtx);
999 
1000 	error = usbd_do_request(usc->usc_udev, &req, NULL);
1001 
1002 	mutex_enter(&usc->usc_msg_mtx);
1003 	/* Wait at most 1 second for firmware to boot. */
1004 	if (error == 0)
1005 		error = athn_usb_wait_msg(usc);
1006 
1007 	usc->usc_htcactive = false;
1008 	cv_broadcast(&usc->usc_htc_cv);
1009 	mutex_exit(&usc->usc_msg_mtx);
1010 
1011 	DPRINTFN(DBG_FN, sc, "return %d\n", error);
1012 
1013 	return error;
1014 }
1015 
1016 Static int
1017 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
1018     int len)
1019 {
1020 	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
1021 	struct ar_htc_frame_hdr *htc;
1022 	struct ar_htc_msg_hdr *msg;
1023 
1024 	if (usc->usc_dying)
1025 		return USBD_CANCELLED;
1026 
1027 	DPRINTFN(DBG_FN, usc, "\n");
1028 
1029 	htc = (struct ar_htc_frame_hdr *)data->buf;
1030 	memset(htc, 0, sizeof(*htc));
1031 	htc->endpoint_id = 0;
1032 	htc->payload_len = htobe16(sizeof(*msg) + len);
1033 
1034 	msg = (struct ar_htc_msg_hdr *)&htc[1];
1035 	msg->msg_id = htobe16(msg_id);
1036 
1037 	memcpy(&msg[1], buf, len);
1038 
1039 	usbd_setup_xfer(data->xfer, NULL, data->buf,
1040 	    sizeof(*htc) + sizeof(*msg) + len,
1041 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT, NULL);
1042 	return usbd_sync_transfer(data->xfer);
1043 
1044 
1045 }
1046 
1047 Static int
1048 athn_usb_htc_setup(struct athn_usb_softc *usc)
1049 {
1050 	struct ar_htc_msg_config_pipe cfg;
1051 	int error;
1052 
1053 	mutex_enter(&usc->usc_msg_mtx);
1054 	while (usc->usc_htcactive) {
1055 		error = cv_timedwait(&usc->usc_htc_cv, &usc->usc_msg_mtx, hz);
1056 
1057 		if (error) {
1058 			mutex_exit(&usc->usc_msg_mtx);
1059 			return error;
1060 		}
1061 	}
1062 	usc->usc_htcactive = true;
1063 	mutex_exit(&usc->usc_msg_mtx);
1064 
1065 	/*
1066 	 * Connect WMI services to USB pipes.
1067 	 */
1068 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CONTROL,
1069 	    AR_PIPE_TX_INTR, AR_PIPE_RX_INTR, &usc->usc_ep_ctrl);
1070 	if (error != 0)
1071 		return error;
1072 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_BEACON,
1073 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_bcn);
1074 	if (error != 0)
1075 		return error;
1076 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_CAB,
1077 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_cab);
1078 	if (error != 0)
1079 		return error;
1080 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_UAPSD,
1081 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_uapsd);
1082 	if (error != 0)
1083 		return error;
1084 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_MGMT,
1085 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_mgmt);
1086 	if (error != 0)
1087 		return error;
1088 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BE,
1089 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BE]);
1090 	if (error != 0)
1091 		return error;
1092 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_BK,
1093 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_BK]);
1094 	if (error != 0)
1095 		return error;
1096 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VI,
1097 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VI]);
1098 	if (error != 0)
1099 		return error;
1100 	error = athn_usb_htc_connect_svc(usc, AR_SVC_WMI_DATA_VO,
1101 	    AR_PIPE_TX_DATA, AR_PIPE_RX_DATA, &usc->usc_ep_data[WME_AC_VO]);
1102 	if (error != 0)
1103 		return error;
1104 
1105 	/* Set credits for WLAN Tx pipe. */
1106 	memset(&cfg, 0, sizeof(cfg));
1107 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
1108 	cfg.credits = (usc->usc_flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
1109 
1110 	mutex_enter(&usc->usc_msg_mtx);
1111 
1112 	KASSERT(usc->usc_wait_msg_id == 0);
1113 	usc->usc_wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
1114 	mutex_exit(&usc->usc_msg_mtx);
1115 
1116 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
1117 
1118 	if (error != 0) {
1119 		aprint_error_dev(usc->usc_dev, "could not request pipe configurations\n");
1120 		return error;
1121 	}
1122 
1123 	mutex_enter(&usc->usc_msg_mtx);
1124 	error = athn_usb_wait_msg(usc);
1125 	if (error) {
1126 		mutex_exit(&usc->usc_msg_mtx);
1127 		return error;
1128 	}
1129 
1130 	mutex_exit(&usc->usc_msg_mtx);
1131 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
1132 	if (error != 0) {
1133 		aprint_error_dev(usc->usc_dev, "could not request complete setup\n");
1134 		return error;
1135 	}
1136 	mutex_enter(&usc->usc_msg_mtx);
1137 	error = athn_usb_wait_msg(usc);
1138 	if (error) {
1139 		mutex_exit(&usc->usc_msg_mtx);
1140 		return error;
1141 	}
1142 
1143 	usc->usc_htcactive = false;
1144 	cv_broadcast(&usc->usc_htc_cv);
1145 	mutex_exit(&usc->usc_msg_mtx);
1146 
1147 	return 0;
1148 }
1149 
1150 Static int
1151 athn_usb_htc_connect_svc(struct athn_usb_softc *usc, uint16_t svc_id,
1152     uint8_t ul_pipe, uint8_t dl_pipe, uint8_t *endpoint_id)
1153 {
1154 	struct ar_htc_msg_conn_svc msg;
1155 	struct ar_htc_msg_conn_svc_rsp rsp;
1156 	int error;
1157 
1158 	DPRINTFN(DBG_FN, usc, "\n");
1159 
1160 	memset(&msg, 0, sizeof(msg));
1161 	msg.svc_id = htobe16(svc_id);
1162 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
1163 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
1164 
1165 	mutex_enter(&usc->usc_msg_mtx);
1166 	KASSERT(usc->usc_wait_msg_id == 0);
1167 	usc->usc_msg_conn_svc_rsp = &rsp;
1168 	usc->usc_wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
1169 	mutex_exit(&usc->usc_msg_mtx);
1170 
1171 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
1172 
1173 	mutex_enter(&usc->usc_msg_mtx);
1174 	if (error == 0)
1175 		error = athn_usb_wait_msg(usc);
1176 
1177 	mutex_exit(&usc->usc_msg_mtx);
1178 
1179 	if (error != 0) {
1180 		aprint_error_dev(usc->usc_dev,
1181 		    "error waiting for service %d connection\n", svc_id);
1182 		return error;
1183 	}
1184 	if (rsp.status != AR_HTC_SVC_SUCCESS) {
1185 		aprint_error_dev(usc->usc_dev,
1186 		    "service %d connection failed, error %d\n",
1187 		    svc_id, rsp.status);
1188 		return EIO;
1189 	}
1190 	DPRINTFN(DBG_INIT, usc,
1191 	    "service %d successfully connected to endpoint %d\n",
1192 	    svc_id, rsp.endpoint_id);
1193 
1194 	/* Return endpoint id. */
1195 	*endpoint_id = rsp.endpoint_id;
1196 	return 0;
1197 }
1198 
1199 Static int
1200 athn_usb_wait_msg(struct athn_usb_softc *usc)
1201 {
1202 	DPRINTFN(DBG_FN, usc, "\n");
1203 
1204 	KASSERT(mutex_owned(&usc->usc_msg_mtx));
1205 
1206 	int error = 0;
1207 	while (usc->usc_wait_msg_id)
1208 		error = cv_timedwait(&usc->usc_msg_cv, &usc->usc_msg_mtx, hz);
1209 
1210 	return error;
1211 }
1212 
1213 Static void
1214 athn_usb_wmieof(struct usbd_xfer *xfer, void * priv,
1215     usbd_status status)
1216 {
1217 	struct athn_usb_softc *usc = priv;
1218 
1219 	DPRINTFN(DBG_FN, usc, "\n");
1220 
1221 	if (__predict_false(status == USBD_STALLED))
1222 		usbd_clear_endpoint_stall_async(usc->usc_tx_intr_pipe);
1223 }
1224 
1225 Static int
1226 athn_usb_wmi_xcmd(struct athn_usb_softc *usc, uint16_t cmd_id, void *ibuf,
1227     int ilen, void *obuf)
1228 {
1229 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
1230 	struct ar_htc_frame_hdr *htc;
1231 	struct ar_wmi_cmd_hdr *wmi;
1232 	int error = 0;
1233 
1234 	if (usc->usc_dying)
1235 		return EIO;
1236 
1237  	DPRINTFN(DBG_FN, usc, "cmd_id %#x\n", cmd_id);
1238 
1239 	htc = (struct ar_htc_frame_hdr *)data->buf;
1240 	memset(htc, 0, sizeof(*htc));
1241 	htc->endpoint_id = usc->usc_ep_ctrl;
1242 	htc->payload_len = htobe16(sizeof(*wmi) + ilen);
1243 
1244 	wmi = (struct ar_wmi_cmd_hdr *)&htc[1];
1245 	wmi->cmd_id = htobe16(cmd_id);
1246 	usc->usc_wmi_seq_no++;
1247 	wmi->seq_no = htobe16(usc->usc_wmi_seq_no);
1248 
1249 	memcpy(&wmi[1], ibuf, ilen);
1250 
1251 	usbd_setup_xfer(data->xfer, usc, data->buf,
1252 	    sizeof(*htc) + sizeof(*wmi) + ilen,
1253 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT,
1254 	    athn_usb_wmieof);
1255 
1256 	mutex_enter(&usc->usc_cmd_mtx);
1257 	while (usc->usc_wmiactive) {
1258 		error = cv_timedwait(&usc->usc_wmi_cv, &usc->usc_cmd_mtx, hz);
1259 
1260 		if (error) {
1261 			mutex_exit(&usc->usc_cmd_mtx);
1262 			return error;
1263 		}
1264 	}
1265 	usc->usc_wmiactive = true;
1266 
1267 	KASSERT(usc->usc_wait_cmd_id == 0);
1268 	usc->usc_wait_cmd_id = cmd_id;
1269 	usc->usc_obuf = obuf;
1270 	mutex_exit(&usc->usc_cmd_mtx);
1271 
1272 	error = usbd_sync_transfer(data->xfer);
1273 	if (error) {
1274 	    	DPRINTFN(DBG_FN, usc, "transfer error %d\n", error);
1275 
1276 		return error;
1277 	}
1278 
1279 	mutex_enter(&usc->usc_cmd_mtx);
1280 	while (usc->usc_wait_cmd_id)
1281 		error = cv_timedwait(&usc->usc_cmd_cv, &usc->usc_cmd_mtx, hz);
1282 
1283 	usc->usc_wmiactive = false;
1284 	cv_broadcast(&usc->usc_wmi_cv);
1285 	mutex_exit(&usc->usc_cmd_mtx);
1286 
1287 	return 0;
1288 }
1289 
1290 #ifdef unused
1291 Static int
1292 athn_usb_read_rom(struct athn_softc *sc)
1293 {
1294 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1295 	uint32_t addrs[8], vals[8], addr;
1296 	uint16_t *eep;
1297 	size_t i, j;
1298 	int error = 0;
1299 
1300 	DPRINTFN(DBG_FN, sc, "\n");
1301 
1302 	/* Read EEPROM by blocks of 16 bytes. */
1303 	eep = sc->sc_eep;
1304 	addr = AR_EEPROM_OFFSET(sc->sc_eep_base);
1305 	for (i = 0; i < sc->sc_eep_size / 16; i++) {
1306 		for (j = 0; j < 8; j++, addr += 4)
1307 			addrs[j] = htobe32(addr);
1308 		error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1309 		    addrs, sizeof(addrs), vals);
1310 		if (error != 0)
1311 			break;
1312 		for (j = 0; j < 8; j++)
1313 			*eep++ = be32toh(vals[j]);
1314 	}
1315 	return error;
1316 }
1317 #endif /* unused */
1318 
1319 Static uint32_t
1320 athn_usb_read(struct athn_softc *sc, uint32_t addr)
1321 {
1322 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1323 	uint32_t val;
1324 	int error;
1325 
1326 	if (usc->usc_dying)
1327 		return 0;
1328 
1329  	DPRINTFN(DBG_FN, sc, "addr %#x\n", htobe32(addr));
1330 
1331 	/* Flush pending writes for strict consistency. */
1332 	athn_usb_write_barrier(sc);
1333 
1334 	addr = htobe32(addr);
1335 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
1336 	    &addr, sizeof(addr), &val);
1337 	if (error != 0) {
1338 		DPRINTFN(DBG_FN, sc, "error %d\n", addr);
1339 		return 0xdeadbeef;
1340 	}
1341  	DPRINTFN(DBG_FN, sc, "addr %#x return %#x\n", addr, be32toh(val));
1342 
1343 	return be32toh(val);
1344 }
1345 
1346 Static void
1347 athn_usb_write(struct athn_softc *sc, uint32_t addr, uint32_t val)
1348 {
1349 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1350 
1351 	if (usc->usc_dying)
1352 		return;
1353 
1354  	DPRINTFN(DBG_FN, sc, "addr %#x val %#x\n", addr, val);
1355 
1356 	usc->usc_wbuf[usc->usc_wcount].addr = htobe32(addr);
1357 	usc->usc_wbuf[usc->usc_wcount].val  = htobe32(val);
1358 	if (++usc->usc_wcount == AR_MAX_WRITE_COUNT)
1359 		athn_usb_write_barrier(sc);
1360 }
1361 
1362 Static void
1363 athn_usb_write_barrier(struct athn_softc *sc)
1364 {
1365 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1366 
1367 	if (usc->usc_dying)
1368 		goto done;
1369 
1370  	DPRINTFN(DBG_FN, sc, "usc_wcount %d\n", usc->usc_wcount);
1371 
1372 	if (usc->usc_wcount == 0)
1373 		return;
1374 
1375 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_WRITE,
1376 	    usc->usc_wbuf, usc->usc_wcount * sizeof(usc->usc_wbuf[0]), NULL);
1377  done:
1378 	usc->usc_wcount = 0;	/* Always flush buffer. */
1379 }
1380 
1381 Static int
1382 athn_usb_media_change(struct ifnet *ifp)
1383 {
1384 	struct athn_softc *sc = ifp->if_softc;
1385 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1386 	int error;
1387 
1388 	if (usc->usc_dying)
1389 		return EIO;
1390 
1391 	DPRINTFN(DBG_FN, sc, "\n");
1392 
1393 	error = ieee80211_media_change(ifp);
1394 	if (error == ENETRESET && IS_UP_AND_RUNNING(ifp)) {
1395 		athn_usb_stop(ifp, 0);
1396 		error = athn_usb_init(ifp);
1397 	}
1398 	return error;
1399 }
1400 
1401 Static int
1402 athn_usb_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
1403     int arg)
1404 {
1405 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1406 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1407 	struct athn_usb_cmd_newstate cmd;
1408 
1409 	DPRINTFN(DBG_FN, sc, "\n");
1410 
1411 	/* Do it in a process context. */
1412 	cmd.state = nstate;
1413 	cmd.arg = arg;
1414 	athn_usb_do_async(usc, athn_usb_newstate_cb, &cmd, sizeof(cmd));
1415 	return 0;
1416 }
1417 
1418 Static void
1419 athn_usb_newstate_cb(struct athn_usb_softc *usc, void *arg)
1420 {
1421 	struct athn_usb_cmd_newstate *cmd = arg;
1422 	struct athn_softc *sc = &usc->usc_sc;
1423 	struct ieee80211com *ic = &sc->sc_ic;
1424 	enum ieee80211_state ostate, nstate;
1425 	uint32_t reg, imask;
1426 	int s;
1427 
1428 	DPRINTFN(DBG_FN, sc, "\n");
1429 
1430 	callout_stop(&sc->sc_calib_to);
1431 
1432 	s = splnet();
1433 
1434 	ostate = ic->ic_state;
1435 	nstate = cmd->state;
1436 	DPRINTFN(DBG_STM, usc, "newstate %s(%d) -> %s(%d)\n",
1437 		    ieee80211_state_name[ostate], ostate,
1438 		    ieee80211_state_name[nstate], nstate);
1439 
1440 	if (ostate == IEEE80211_S_RUN) {
1441 		uint8_t sta_index;
1442 
1443 		sta_index = ATHN_NODE(ic->ic_bss)->sta_index;
1444 		DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
1445 		athn_usb_remove_hw_node(usc, &sta_index);
1446 	}
1447 
1448 	switch (nstate) {
1449 	case IEEE80211_S_INIT:
1450 		athn_set_led(sc, 0);
1451 		break;
1452 	case IEEE80211_S_SCAN:
1453 		/* Make the LED blink while scanning. */
1454 		athn_set_led(sc, !sc->sc_led_state);
1455 		(void)athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1456 		if (!usc->usc_dying)
1457 			callout_schedule(&sc->sc_scan_to, hz / 5);
1458 		break;
1459 	case IEEE80211_S_AUTH:
1460 		athn_set_led(sc, 0);
1461 		athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
1462 		break;
1463 	case IEEE80211_S_ASSOC:
1464 		break;
1465 	case IEEE80211_S_RUN:
1466 		athn_set_led(sc, 1);
1467 
1468 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
1469 			break;
1470 
1471 		/* Create node entry for our BSS. */
1472 		DPRINTFN(DBG_NODES, sc, "create node for AID=0x%x\n",
1473 		    ic->ic_bss->ni_associd);
1474 		athn_usb_create_node(usc, ic->ic_bss);	/* XXX: handle error? */
1475 
1476 		athn_set_bss(sc, ic->ic_bss);
1477 		athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1478 #ifndef IEEE80211_STA_ONLY
1479 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1480 			athn_set_hostap_timers(sc);
1481 			/* Enable software beacon alert interrupts. */
1482 			imask = htobe32(AR_IMR_SWBA);
1483 		} else
1484 #endif
1485 		{
1486 			athn_set_sta_timers(sc);
1487 			/* Enable beacon miss interrupts. */
1488 			imask = htobe32(AR_IMR_BMISS);
1489 
1490 			/* Stop receiving beacons from other BSS. */
1491 			reg = AR_READ(sc, AR_RX_FILTER);
1492 			reg = (reg & ~AR_RX_FILTER_BEACON) |
1493 			    AR_RX_FILTER_MYBEACON;
1494 			AR_WRITE(sc, AR_RX_FILTER, reg);
1495 			AR_WRITE_BARRIER(sc);
1496 		}
1497 		athn_usb_wmi_xcmd(usc, AR_WMI_CMD_ENABLE_INTR,
1498 		    &imask, sizeof(imask), NULL);
1499 		break;
1500 	}
1501 	if (!usc->usc_dying)
1502 		(void)sc->sc_newstate(ic, nstate, cmd->arg);
1503 	splx(s);
1504 }
1505 
1506 Static void
1507 athn_usb_newassoc(struct ieee80211_node *ni, int isnew)
1508 {
1509 	struct ieee80211com *ic = ni->ni_ic;
1510 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1511 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1512 
1513 	DPRINTFN(DBG_FN, sc, "\n");
1514 
1515 	if (ic->ic_opmode != IEEE80211_M_HOSTAP || !isnew)
1516 		return;
1517 
1518 	/* Do it in a process context. */
1519 	ieee80211_ref_node(ni);
1520 	athn_usb_do_async(usc, athn_usb_newassoc_cb, &ni, sizeof(ni));
1521 }
1522 
1523 Static void
1524 athn_usb_newassoc_cb(struct athn_usb_softc *usc, void *arg)
1525 {
1526 	struct ieee80211_node *ni = *(void **)arg;
1527 	int s;
1528 
1529 	DPRINTFN(DBG_FN, usc, "\n");
1530 
1531 	s = splnet();
1532 	/* NB: Node may have left before we got scheduled. */
1533 	if (ni->ni_associd != 0) {
1534 		DPRINTFN(DBG_NODES, usc, "creating node for AID=0x%x\n",
1535 		    ni->ni_associd);
1536 		(void)athn_usb_create_node(usc, ni);	/* XXX: handle error? */
1537 	}
1538 	ieee80211_free_node(ni);
1539 	splx(s);
1540 }
1541 
1542 #ifdef notyet
1543 Static int
1544 athn_usb_ampdu_tx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
1545     uint8_t tid)
1546 {
1547 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1548 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1549 	struct athn_node *an = ATHN_NODE(ni);
1550 	struct athn_usb_aggr_cmd cmd;
1551 
1552 	DPRINTFN(DBG_FN, sc, "\n");
1553 
1554 	/* Do it in a process context. */
1555 	cmd.sta_index = an->sta_index;
1556 	cmd.tid = tid;
1557 	athn_usb_do_async(usc, athn_usb_ampdu_tx_start_cb, &cmd, sizeof(cmd));
1558 	return 0;
1559 }
1560 
1561 Static void
1562 athn_usb_ampdu_tx_start_cb(struct athn_usb_softc *usc, void *arg)
1563 {
1564 	struct athn_usb_aggr_cmd *cmd = arg;
1565 	struct ar_htc_target_aggr aggr;
1566 
1567 	DPRINTFN(DBG_FN, usc, "\n");
1568 
1569 	memset(&aggr, 0, sizeof(aggr));
1570 	aggr.sta_index = cmd->sta_index;
1571 	aggr.tidno = cmd->tid;
1572 	aggr.aggr_enable = 1;
1573 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1574 	    &aggr, sizeof(aggr), NULL);
1575 }
1576 
1577 Static void
1578 athn_usb_ampdu_tx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
1579     uint8_t tid)
1580 {
1581 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1582 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1583 	struct athn_node *an = ATHN_NODE(ni);
1584 	struct athn_usb_aggr_cmd cmd;
1585 
1586 	DPRINTFN(DBG_FN, sc, "\n");
1587 
1588 	/* Do it in a process context. */
1589 	cmd.sta_index = an->sta_index;
1590 	cmd.tid = tid;
1591 	athn_usb_do_async(usc, athn_usb_ampdu_tx_stop_cb, &cmd, sizeof(cmd));
1592 }
1593 
1594 Static void
1595 athn_usb_ampdu_tx_stop_cb(struct athn_usb_softc *usc, void *arg)
1596 {
1597 	struct athn_usb_aggr_cmd *cmd = arg;
1598 	struct ar_htc_target_aggr aggr;
1599 
1600 	DPRINTFN(DBG_FN, usc, "\n");
1601 
1602 	memset(&aggr, 0, sizeof(aggr));
1603 	aggr.sta_index = cmd->sta_index;
1604 	aggr.tidno = cmd->tid;
1605 	aggr.aggr_enable = 0;
1606 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TX_AGGR_ENABLE,
1607 	    &aggr, sizeof(aggr), NULL);
1608 }
1609 #endif /* notyet */
1610 
1611 Static int
1612 athn_usb_remove_hw_node(struct athn_usb_softc *usc, uint8_t *sta_idx)
1613 {
1614 	int error;
1615 
1616 	DPRINTFN(DBG_FN, usc, "\n");
1617 
1618 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_REMOVE,
1619 	    sta_idx, sizeof(*sta_idx), NULL);
1620 
1621 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1622 	    *sta_idx, error);
1623 	return error;
1624 }
1625 
1626 Static int
1627 athn_usb_create_hw_node(struct athn_usb_softc *usc,
1628     struct ar_htc_target_sta *sta)
1629 {
1630 	int error;
1631 
1632 	DPRINTFN(DBG_FN, usc, "\n");
1633 
1634 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_NODE_CREATE,
1635 	    sta, sizeof(*sta), NULL);
1636 
1637 	DPRINTFN(DBG_NODES, usc, "node=%u error=%d\n",
1638 	    sta->sta_index, error);
1639 
1640 	return error;
1641 }
1642 
1643 Static int
1644 athn_usb_create_node(struct athn_usb_softc *usc, struct ieee80211_node *ni)
1645 {
1646 	struct athn_node *an = ATHN_NODE(ni);
1647 	struct ar_htc_target_sta sta;
1648 	struct ar_htc_target_rate rate;
1649 	int error;
1650 
1651 	DPRINTFN(DBG_FN | DBG_NODES, usc, "AID=0x%x\n", ni->ni_associd);
1652 
1653 	/*
1654 	 * NB: this is called by ic_newstate and (in HOSTAP mode by)
1655 	 * ic_newassoc.
1656 	 *
1657 	 * The firmware has a limit of 8 nodes.  In HOSTAP mode, we
1658 	 * limit the AID to < 8 and use that value to index the
1659 	 * firmware node table.  Node zero is used for the BSS.
1660 	 *
1661 	 * In STA mode, we simply use node 1 for the BSS.
1662 	 */
1663 	if (ATHN_SOFTC(usc)->sc_ic.ic_opmode == IEEE80211_M_HOSTAP)
1664 		an->sta_index = IEEE80211_NODE_AID(ni);
1665 	else
1666 		an->sta_index = 1;
1667 
1668 	/* Create node entry on target. */
1669 	memset(&sta, 0, sizeof(sta));
1670 	IEEE80211_ADDR_COPY(sta.macaddr, ni->ni_macaddr);
1671 	IEEE80211_ADDR_COPY(sta.bssid, ni->ni_bssid);
1672 
1673 	sta.associd = htobe16(ni->ni_associd);
1674 	sta.valid = 1;
1675 	sta.sta_index = an->sta_index;
1676 
1677 	sta.maxampdu = 0xffff;
1678 #ifndef IEEE80211_NO_HT
1679 	if (ni->ni_flags & IEEE80211_NODE_HT)
1680 		sta.flags |= htobe16(AR_HTC_STA_HT);
1681 #endif
1682 	error = athn_usb_create_hw_node(usc, &sta);
1683 	if (error)
1684 		return error;
1685 
1686 	/* Setup supported rates. */
1687 	memset(&rate, 0, sizeof(rate));
1688 	rate.sta_index = sta.sta_index;
1689 	rate.isnew = 1;
1690 	rate.lg_rates.rs_nrates = ni->ni_rates.rs_nrates;
1691 	memcpy(rate.lg_rates.rs_rates, ni->ni_rates.rs_rates,
1692 	    ni->ni_rates.rs_nrates);
1693 
1694 #ifndef IEEE80211_NO_HT
1695 	if (ni->ni_flags & IEEE80211_NODE_HT) {
1696 		rate.capflags |= htobe32(AR_RC_HT_FLAG);
1697 #ifdef notyet
1698 		/* XXX setup HT rates */
1699 		if (ni->ni_htcaps & IEEE80211_HTCAP_CBW20_40)
1700 			rate.capflags |= htobe32(AR_RC_40_FLAG);
1701 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI40)
1702 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1703 		if (ni->ni_htcaps & IEEE80211_HTCAP_SGI20)
1704 			rate.capflags |= htobe32(AR_RC_SGI_FLAG);
1705 #endif
1706 	}
1707 #endif
1708 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_RC_RATE_UPDATE,
1709 	    &rate, sizeof(rate), NULL);
1710 	return error;
1711 }
1712 
1713 Static void
1714 athn_usb_rx_enable(struct athn_softc *sc)
1715 {
1716 
1717 	DPRINTFN(DBG_FN, sc, "\n");
1718 
1719 	AR_WRITE(sc, AR_CR, AR_CR_RXE);
1720 	AR_WRITE_BARRIER(sc);
1721 }
1722 
1723 Static int
1724 athn_usb_switch_chan(struct athn_softc *sc, struct ieee80211_channel *curchan,
1725     struct ieee80211_channel *extchan)
1726 {
1727 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1728 	uint16_t mode;
1729 	int error;
1730 
1731 	DPRINTFN(DBG_FN, sc, "\n");
1732 
1733 	/* Disable interrupts. */
1734 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
1735 	if (error != 0)
1736 		goto reset;
1737 	/* Stop all Tx queues. */
1738 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
1739 	if (error != 0)
1740 		goto reset;
1741 	/* Stop Rx. */
1742 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
1743 	if (error != 0)
1744 		goto reset;
1745 
1746 	/* If band or bandwidth changes, we need to do a full reset. */
1747 	if (curchan->ic_flags != sc->sc_curchan->ic_flags ||
1748 	    ((extchan != NULL) ^ (sc->sc_curchanext != NULL))) {
1749 		DPRINTFN(DBG_RF, sc, "channel band switch\n");
1750 		goto reset;
1751 	}
1752 
1753 	error = athn_set_chan(sc, curchan, extchan);
1754 	if (AR_SREV_9271(sc) && error == 0)
1755 		ar9271_load_ani(sc);
1756 	if (error != 0) {
1757  reset:		/* Error found, try a full reset. */
1758 		DPRINTFN(DBG_RF, sc, "needs a full reset\n");
1759 		error = athn_hw_reset(sc, curchan, extchan, 0);
1760 		if (error != 0)	/* Hopeless case. */
1761 			return error;
1762 	}
1763 
1764 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
1765 	if (error != 0)
1766 		return error;
1767 	athn_rx_start(sc);
1768 
1769 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
1770 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
1771 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
1772 	    &mode, sizeof(mode), NULL);
1773 	if (error != 0)
1774 		return error;
1775 
1776 	/* Re-enable interrupts. */
1777 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ENABLE_INTR);
1778 	return error;
1779 }
1780 
1781 #ifdef notyet_edca
1782 Static void
1783 athn_usb_updateedca(struct ieee80211com *ic)
1784 {
1785 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1786 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1787 
1788 	DPRINTFN(DBG_FN, sc, "\n");
1789 
1790 	/* Do it in a process context. */
1791 	athn_usb_do_async(usc, athn_usb_updateedca_cb, NULL, 0);
1792 }
1793 
1794 Static void
1795 athn_usb_updateedca_cb(struct athn_usb_softc *usc, void *arg)
1796 {
1797 	int s;
1798 
1799 	DPRINTFN(DBG_FN, usc, "\n");
1800 
1801 	s = splnet();
1802 	athn_updateedca(&usc->usc_sc.sc_ic);
1803 	splx(s);
1804 }
1805 #endif /* notyet_edca */
1806 
1807 Static void
1808 athn_usb_updateslot(struct ifnet *ifp)
1809 {
1810 	struct athn_softc *sc = ifp->if_softc;
1811 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1812 
1813 	DPRINTFN(DBG_FN, sc, "\n");
1814 
1815 	/*
1816 	 * NB: athn_updateslog() needs to be done in a process context
1817 	 * to avoid being called by ieee80211_reset_erp() inside a
1818 	 * spinlock held by ieee80211_free_allnodes().
1819 	 *
1820 	 * XXX: calling this during the athn_attach() causes
1821 	 * usb_insert_transfer() to produce a bunch of "not busy"
1822 	 * messages.  Why?
1823 	 */
1824 	if (usc->usc_athn_attached)
1825 		athn_usb_do_async(usc, athn_usb_updateslot_cb, NULL, 0);
1826 }
1827 
1828 Static void
1829 athn_usb_updateslot_cb(struct athn_usb_softc *usc, void *arg)
1830 {
1831 	int s;
1832 
1833 	DPRINTFN(DBG_FN, usc, "\n");
1834 
1835 	s = splnet();
1836 	athn_updateslot(&usc->usc_sc.sc_if);
1837 	splx(s);
1838 }
1839 
1840 #ifdef notyet
1841 Static int
1842 athn_usb_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1843     struct ieee80211_key *k)
1844 {
1845 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1846 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1847 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1848 	struct athn_usb_cmd_key cmd;
1849 
1850 	DPRINTFN(DBG_FN, sc, "\n");
1851 
1852 	/* Defer setting of WEP keys until interface is brought up. */
1853 	if (!IS_UP_AND_RUNNING(ifp))
1854 		return 0;
1855 
1856 	/* Do it in a process context. */
1857 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1858 	cmd.key = k;
1859 	athn_usb_do_async(usc, athn_usb_set_key_cb, &cmd, sizeof(cmd));
1860 	return 0;
1861 }
1862 
1863 Static void
1864 athn_usb_set_key_cb(struct athn_usb_softc *usc, void *arg)
1865 {
1866 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1867 	struct athn_usb_cmd_key *cmd = arg;
1868 	int s;
1869 
1870 	DPRINTFN(DBG_FN, usc, "\n");
1871 
1872 	s = splnet();
1873 	athn_set_key(ic, cmd->ni, cmd->key);
1874 	if (cmd->ni != NULL)
1875 		ieee80211_free_node(cmd->ni);
1876 	splx(s);
1877 }
1878 
1879 Static void
1880 athn_usb_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1881     struct ieee80211_key *k)
1882 {
1883 	struct athn_softc *sc = ic->ic_ifp->if_softc;
1884 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
1885 	struct ifnet *ifp = &usc->usc_sc.sc_if;
1886 	struct athn_usb_cmd_key cmd;
1887 
1888 	DPRINTFN(DBG_FN, sc, "\n");
1889 
1890 	if (!(ifp->if_flags & IFF_RUNNING) ||
1891 	    ic->ic_state != IEEE80211_S_RUN)
1892 		return;	/* Nothing to do. */
1893 
1894 	/* Do it in a process context. */
1895 	cmd.ni = (ni != NULL) ? ieee80211_ref_node(ni) : NULL;
1896 	cmd.key = k;
1897 	athn_usb_do_async(usc, athn_usb_delete_key_cb, &cmd, sizeof(cmd));
1898 }
1899 
1900 Static void
1901 athn_usb_delete_key_cb(struct athn_usb_softc *usc, void *arg)
1902 {
1903 	struct ieee80211com *ic = &usc->usc_sc.sc_ic;
1904 	struct athn_usb_cmd_key *cmd = arg;
1905 	int s;
1906 
1907 	DPRINTFN(DBG_FN, usc, "\n");
1908 
1909 	s = splnet();
1910 	athn_delete_key(ic, cmd->ni, cmd->key);
1911 	if (cmd->ni != NULL)
1912 		ieee80211_free_node(cmd->ni);
1913 	splx(s);
1914 }
1915 #endif /* notyet */
1916 
1917 #ifndef IEEE80211_STA_ONLY
1918 Static void
1919 athn_usb_bcneof(struct usbd_xfer *xfer, void * priv,
1920     usbd_status status)
1921 {
1922 	struct athn_usb_tx_data *data = priv;
1923 	struct athn_usb_softc *usc = data->sc;
1924 
1925 	DPRINTFN(DBG_FN, usc, "\n");
1926 
1927 	if (__predict_false(status == USBD_STALLED))
1928 		usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
1929 	usc->usc_tx_bcn = data;
1930 }
1931 
1932 /*
1933  * Process Software Beacon Alert interrupts.
1934  */
1935 Static void
1936 athn_usb_swba(struct athn_usb_softc *usc)
1937 {
1938 	struct athn_softc *sc = &usc->usc_sc;
1939 	struct ieee80211com *ic = &sc->sc_ic;
1940 	struct athn_usb_tx_data *data;
1941 	struct ieee80211_frame *wh;
1942 	struct ieee80211_beacon_offsets bo;
1943 	struct ar_stream_hdr *hdr;
1944 	struct ar_htc_frame_hdr *htc;
1945 	struct ar_tx_bcn *bcn;
1946 	struct mbuf *m;
1947 	int error;
1948 
1949 	if (usc->usc_dying)
1950 		return;
1951 
1952 	DPRINTFN(DBG_FN, sc, "\n");
1953 
1954 	if (ic->ic_dtim_count == 0)
1955 		ic->ic_dtim_count = ic->ic_dtim_period - 1;
1956 	else
1957 		ic->ic_dtim_count--;
1958 
1959 	/* Make sure previous beacon has been sent. */
1960 	if (usc->usc_tx_bcn == NULL)
1961 		return;
1962 	data = usc->usc_tx_bcn;
1963 
1964 	/* Get new beacon. */
1965 #ifdef ATHN_DEBUG
1966 	memset(&bo, 0, sizeof(bo));
1967 #endif
1968 	m = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
1969 	if (__predict_false(m == NULL))
1970 		return;
1971 	/* Assign sequence number. */
1972 	/* XXX: use non-QoS tid? */
1973 	wh = mtod(m, struct ieee80211_frame *);
1974 	*(uint16_t *)&wh->i_seq[0] =
1975 	    htole16(ic->ic_bss->ni_txseqs[0] << IEEE80211_SEQ_SEQ_SHIFT);
1976 	ic->ic_bss->ni_txseqs[0]++;
1977 
1978 	hdr = (struct ar_stream_hdr *)data->buf;
1979 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
1980 	hdr->len = htole16(sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len);
1981 
1982 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
1983 	memset(htc, 0, sizeof(*htc));
1984 	htc->endpoint_id = usc->usc_ep_bcn;
1985 	htc->payload_len = htobe16(sizeof(*bcn) + m->m_pkthdr.len);
1986 
1987 	bcn = (struct ar_tx_bcn *)&htc[1];
1988 	memset(bcn, 0, sizeof(*bcn));
1989 	bcn->vif_idx = 0;
1990 
1991 	m_copydata(m, 0, m->m_pkthdr.len, (void *)&bcn[1]);
1992 
1993 	usbd_setup_xfer(data->xfer, data, data->buf,
1994 	    sizeof(*hdr) + sizeof(*htc) + sizeof(*bcn) + m->m_pkthdr.len,
1995 	    USBD_SHORT_XFER_OK, ATHN_USB_TX_TIMEOUT,
1996 	    athn_usb_bcneof);
1997 
1998 	m_freem(m);
1999 	usc->usc_tx_bcn = NULL;
2000 	error = usbd_transfer(data->xfer);
2001 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0))
2002 		usc->usc_tx_bcn = data;
2003 }
2004 #endif
2005 
2006 Static void
2007 athn_usb_rx_wmi_ctrl(struct athn_usb_softc *usc, uint8_t *buf, size_t len)
2008 {
2009 #ifdef ATHN_DEBUG
2010 	struct ar_wmi_evt_txrate *txrate;
2011 #endif
2012 	struct ar_wmi_cmd_hdr *wmi;
2013 	uint16_t cmd_id;
2014 
2015 	if (usc->usc_dying)
2016 		return;
2017 
2018 	DPRINTFN(DBG_FN, usc, "\n");
2019 
2020 	if (__predict_false(len < sizeof(*wmi)))
2021 		return;
2022 	wmi = (struct ar_wmi_cmd_hdr *)buf;
2023 	cmd_id = be16toh(wmi->cmd_id);
2024 
2025 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
2026 		mutex_enter(&usc->usc_cmd_mtx);
2027 		if (usc->usc_wait_cmd_id == cmd_id) {
2028 
2029 			if (usc->usc_obuf != NULL) {
2030 				/* Copy answer into caller supplied buffer. */
2031 				memcpy(usc->usc_obuf, &wmi[1], len - sizeof(*wmi));
2032 			}
2033 			/* Notify caller of completion. */
2034 			usc->usc_wait_cmd_id = 0;
2035 			cv_broadcast(&usc->usc_cmd_cv);
2036 		}
2037 		mutex_exit(&usc->usc_cmd_mtx);
2038 		return;
2039 	}
2040 	/*
2041 	 * XXX: the Linux 2.6 and 3.7.4 kernels differ on the event numbers!
2042 	 * See the alternate defines in if_athn_usb.h.
2043 	 */
2044 	switch (cmd_id & 0xfff) {
2045 #ifndef IEEE80211_STA_ONLY
2046 	case AR_WMI_EVT_SWBA:
2047 		athn_usb_swba(usc);
2048 		break;
2049 #endif
2050 	case AR_WMI_EVT_FATAL:
2051 		aprint_error_dev(usc->usc_dev, "fatal firmware error\n");
2052 		break;
2053 	case AR_WMI_EVT_TXRATE:
2054 #ifdef ATHN_DEBUG
2055 		txrate = (struct ar_wmi_evt_txrate *)&wmi[1];
2056 		DPRINTFN(DBG_TX, usc, "txrate=%d\n", be32toh(txrate->txrate));
2057 #endif
2058 		break;
2059 	default:
2060 		DPRINTFN(DBG_TX, usc, "WMI event 0x%x (%d) ignored\n", cmd_id, cmd_id);
2061 		break;
2062 	}
2063 }
2064 
2065 Static void
2066 athn_usb_intr(struct usbd_xfer *xfer, void * priv,
2067     usbd_status status)
2068 {
2069 	struct athn_usb_softc *usc = priv;
2070 	struct ar_htc_frame_hdr *htc;
2071 	struct ar_htc_msg_hdr *msg;
2072 	uint8_t *buf = usc->usc_ibuf;
2073 	uint16_t msg_id;
2074 	int len;
2075 
2076 	if (usc->usc_dying)
2077 		return;
2078 
2079 	DPRINTFN(DBG_FN, usc, "\n");
2080 
2081 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2082 		DPRINTFN(DBG_INTR, usc, "intr status=%d\n", status);
2083 		if (status == USBD_STALLED)
2084 			usbd_clear_endpoint_stall_async(usc->usc_rx_intr_pipe);
2085 		return;
2086 	}
2087 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2088 
2089 	/* Skip watchdog pattern if present. */
2090 	if (len >= 4 && *(uint32_t *)buf == htobe32(0x00c60000)) {
2091 		buf += 4;
2092 		len -= 4;
2093 	}
2094 	if (__predict_false(len < (int)sizeof(*htc)))
2095 		return;
2096 	htc = (struct ar_htc_frame_hdr *)buf;
2097 	/* Skip HTC header. */
2098 	buf += sizeof(*htc);
2099 	len -= sizeof(*htc);
2100 
2101 	if (htc->endpoint_id != 0) {
2102 		if (__predict_false(htc->endpoint_id != usc->usc_ep_ctrl)) {
2103 			DPRINTFN(DBG_RX, usc, "Rx %d != %d\n",
2104 			    htc->endpoint_id, usc->usc_ep_ctrl);
2105 			return;
2106 		}
2107 		/* Remove trailer if present. */
2108 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
2109 			if (__predict_false(len < htc->control[0])) {
2110 				DPRINTFN(DBG_RX, usc, "Rx trailer %d < %d\n",
2111 				    len,  htc->control[0]);
2112 				return;
2113 			}
2114 			len -= htc->control[0];
2115 		}
2116 		athn_usb_rx_wmi_ctrl(usc, buf, len);
2117 		return;
2118 	}
2119 
2120 	/*
2121 	 * Endpoint 0 carries HTC messages.
2122 	 */
2123 	if (__predict_false(len < (int)sizeof(*msg)))
2124 		return;
2125 	msg = (struct ar_htc_msg_hdr *)buf;
2126 	msg_id = be16toh(msg->msg_id);
2127 	DPRINTFN(DBG_RX, usc, "Rx HTC message %d\n", msg_id);
2128 	switch (msg_id) {
2129 	case AR_HTC_MSG_READY:
2130 	case AR_HTC_MSG_CONF_PIPE_RSP:
2131 		mutex_enter(&usc->usc_msg_mtx);
2132 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_READY: %d vs %d\n",
2133 		    usc->usc_wait_msg_id, msg_id);
2134 		if (usc->usc_wait_msg_id == msg_id) {
2135 			usc->usc_wait_msg_id = 0;
2136 			cv_broadcast(&usc->usc_msg_cv);
2137 		}
2138 		mutex_exit(&usc->usc_msg_mtx);
2139 		break;
2140 	case AR_HTC_MSG_CONN_SVC_RSP:
2141 		mutex_enter(&usc->usc_msg_mtx);
2142 		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_CONN_SVC_RSP: %d vs %d\n",
2143 		    usc->usc_wait_msg_id, msg_id);
2144 		if (usc->usc_wait_msg_id == msg_id) {
2145 			if (usc->usc_msg_conn_svc_rsp != NULL) {
2146 				memcpy(usc->usc_msg_conn_svc_rsp, &msg[1],
2147 				    sizeof(*usc->usc_msg_conn_svc_rsp));
2148 			}
2149 			usc->usc_wait_msg_id = 0;
2150 			cv_broadcast(&usc->usc_msg_cv);
2151 		}
2152 		mutex_exit(&usc->usc_msg_mtx);
2153 		break;
2154 	default:
2155 		DPRINTFN(DBG_RX, usc, "HTC message %d ignored\n", msg_id);
2156 		break;
2157 	}
2158 }
2159 
2160 Static void
2161 athn_usb_rx_radiotap(struct athn_softc *sc, struct mbuf *m,
2162     struct ar_rx_status *rs)
2163 {
2164 	struct athn_rx_radiotap_header *tap = &sc->sc_rxtap;
2165 	struct ieee80211com *ic = &sc->sc_ic;
2166 	uint8_t rate;
2167 
2168 	DPRINTFN(DBG_FN, sc, "\n");
2169 
2170 	tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
2171 	tap->wr_tsft = htole64(be64toh(rs->rs_tstamp));
2172 	tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2173 	tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2174 	tap->wr_dbm_antsignal = rs->rs_rssi;
2175 	/* XXX noise. */
2176 	tap->wr_antenna = rs->rs_antenna;
2177 	rate = rs->rs_rate;
2178 	if (rate & 0x80) {		/* HT. */
2179 		/* Bit 7 set means HT MCS instead of rate. */
2180 		tap->wr_rate = rate;
2181 		if (!(rs->rs_flags & AR_RXS_FLAG_GI))
2182 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTGI;
2183 	} else if (rate & 0x10) {	/* CCK. */
2184 		if (rate & 0x04)
2185 			tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2186 		switch (rate & ~0x14) {
2187 		case 0xb: tap->wr_rate =   2; break;
2188 		case 0xa: tap->wr_rate =   4; break;
2189 		case 0x9: tap->wr_rate =  11; break;
2190 		case 0x8: tap->wr_rate =  22; break;
2191 		default:  tap->wr_rate =   0; break;
2192 		}
2193 	} else {			/* OFDM. */
2194 		switch (rate) {
2195 		case 0xb: tap->wr_rate =  12; break;
2196 		case 0xf: tap->wr_rate =  18; break;
2197 		case 0xa: tap->wr_rate =  24; break;
2198 		case 0xe: tap->wr_rate =  36; break;
2199 		case 0x9: tap->wr_rate =  48; break;
2200 		case 0xd: tap->wr_rate =  72; break;
2201 		case 0x8: tap->wr_rate =  96; break;
2202 		case 0xc: tap->wr_rate = 108; break;
2203 		default:  tap->wr_rate =   0; break;
2204 		}
2205 	}
2206 	bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
2207 }
2208 
2209 Static void
2210 athn_usb_rx_frame(struct athn_usb_softc *usc, struct mbuf *m)
2211 {
2212 	struct athn_softc *sc = &usc->usc_sc;
2213 	struct ieee80211com *ic = &sc->sc_ic;
2214 	struct ifnet *ifp = &sc->sc_if;
2215 	struct ieee80211_frame *wh;
2216 	struct ieee80211_node *ni;
2217 	struct ar_htc_frame_hdr *htc;
2218 	struct ar_rx_status *rs;
2219 	uint16_t datalen;
2220 	int s;
2221 
2222 	DPRINTFN(DBG_FN, sc, "\n");
2223 
2224 	if (__predict_false(m->m_len < (int)sizeof(*htc)))
2225 		goto skip;
2226 	htc = mtod(m, struct ar_htc_frame_hdr *);
2227 	if (__predict_false(htc->endpoint_id == 0)) {
2228 		DPRINTFN(DBG_RX, sc, "bad endpoint %d\n", htc->endpoint_id);
2229 		goto skip;
2230 	}
2231 	if (htc->flags & AR_HTC_FLAG_TRAILER) {
2232 		if (m->m_len < htc->control[0])
2233 			goto skip;
2234 		m_adj(m, -(int)htc->control[0]);
2235 	}
2236 	m_adj(m, sizeof(*htc));	/* Strip HTC header. */
2237 
2238 	if (__predict_false(m->m_len < (int)sizeof(*rs)))
2239 		goto skip;
2240 	rs = mtod(m, struct ar_rx_status *);
2241 
2242 	/* Make sure that payload fits. */
2243 	datalen = be16toh(rs->rs_datalen);
2244 	if (__predict_false(m->m_len < (int)sizeof(*rs) + datalen))
2245 		goto skip;
2246 
2247 	/* Ignore runt frames.  Let ACKs be seen by bpf */
2248 	if (__predict_false(datalen <
2249 		sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN))
2250 		goto skip;
2251 
2252 	m_adj(m, sizeof(*rs));	/* Strip Rx status. */
2253 	m_set_rcvif(m, ifp);
2254 
2255 	s = splnet();
2256 
2257 	/* Grab a reference to the source node. */
2258 	wh = mtod(m, struct ieee80211_frame *);
2259 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
2260 
2261 	/* Remove any HW padding after the 802.11 header. */
2262 	if (!(wh->i_fc[0] & IEEE80211_FC0_TYPE_CTL)) {
2263 		u_int hdrlen = ieee80211_anyhdrsize(wh);
2264 		if (hdrlen & 3) {
2265 			memmove((uint8_t *)wh + 2, wh, hdrlen);
2266 			m_adj(m, 2);
2267 		}
2268 	}
2269 	if (__predict_false(sc->sc_drvbpf != NULL))
2270 		athn_usb_rx_radiotap(sc, m, rs);
2271 
2272 	/* Trim 802.11 FCS after radiotap. */
2273 	m_adj(m, -IEEE80211_CRC_LEN);
2274 
2275 	/* Send the frame to the 802.11 layer. */
2276 	ieee80211_input(ic, m, ni, rs->rs_rssi + AR_USB_DEFAULT_NF, 0);
2277 
2278 	/* Node is no longer needed. */
2279 	ieee80211_free_node(ni);
2280 	splx(s);
2281 	return;
2282  skip:
2283 	m_freem(m);
2284 }
2285 
2286 Static void
2287 athn_usb_rxeof(struct usbd_xfer *xfer, void * priv,
2288     usbd_status status)
2289 {
2290 	struct athn_usb_rx_data *data = priv;
2291 	struct athn_usb_softc *usc = data->sc;
2292 	struct athn_usb_rx_stream *stream = &usc->usc_rx_stream;
2293 	uint8_t *buf = data->buf;
2294 	struct ar_stream_hdr *hdr;
2295 	struct mbuf *m;
2296 	uint16_t pktlen;
2297 	int off, len;
2298 
2299 	if (usc->usc_dying)
2300 		return;
2301 
2302 	DPRINTFN(DBG_FN, usc, "\n");
2303 
2304 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2305 		DPRINTFN(DBG_RX, usc, "RX status=%d\n", status);
2306 		if (status == USBD_STALLED)
2307 			usbd_clear_endpoint_stall_async(usc->usc_rx_data_pipe);
2308 		if (status != USBD_CANCELLED)
2309 			goto resubmit;
2310 		return;
2311 	}
2312 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
2313 
2314 	if (stream->left > 0) {
2315 		if (len >= stream->left) {
2316 			/* We have all our pktlen bytes now. */
2317 			if (__predict_true(stream->m != NULL)) {
2318 				memcpy(mtod(stream->m, uint8_t *) +
2319 				    stream->moff, buf, stream->left);
2320 				athn_usb_rx_frame(usc, stream->m);
2321 				stream->m = NULL;
2322 			}
2323 			/* Next header is 32-bit aligned. */
2324 			off = (stream->left + 3) & ~3;
2325 			buf += off;
2326 			len -= off;
2327 			stream->left = 0;
2328 		} else {
2329 			/* Still need more bytes, save what we have. */
2330 			if (__predict_true(stream->m != NULL)) {
2331 				memcpy(mtod(stream->m, uint8_t *) +
2332 				    stream->moff, buf, len);
2333 				stream->moff += len;
2334 			}
2335 			stream->left -= len;
2336 			goto resubmit;
2337 		}
2338 	}
2339 	KASSERT(stream->left == 0);
2340 	while (len >= (int)sizeof(*hdr)) {
2341 		hdr = (struct ar_stream_hdr *)buf;
2342 		if (hdr->tag != htole16(AR_USB_RX_STREAM_TAG)) {
2343 			DPRINTFN(DBG_RX, usc, "invalid tag 0x%x\n", hdr->tag);
2344 			break;
2345 		}
2346 		pktlen = le16toh(hdr->len);
2347 		buf += sizeof(*hdr);
2348 		len -= sizeof(*hdr);
2349 
2350 		if (__predict_true(pktlen <= MCLBYTES)) {
2351 			/* Allocate an mbuf to store the next pktlen bytes. */
2352 			MGETHDR(m, M_DONTWAIT, MT_DATA);
2353 			if (__predict_true(m != NULL)) {
2354 				m->m_pkthdr.len = m->m_len = pktlen;
2355 				if (pktlen > MHLEN) {
2356 					MCLGET(m, M_DONTWAIT);
2357 					if (!(m->m_flags & M_EXT)) {
2358 						m_free(m);
2359 						m = NULL;
2360 					}
2361 				}
2362 			}
2363 		} else	/* Drop frames larger than MCLBYTES. */
2364 			m = NULL;
2365 		/*
2366 		 * NB: m can be NULL, in which case the next pktlen bytes
2367 		 * will be discarded from the Rx stream.
2368 		 */
2369 		if (pktlen > len) {
2370 			/* Need more bytes, save what we have. */
2371 			stream->m = m;	/* NB: m can be NULL. */
2372 			if (__predict_true(stream->m != NULL)) {
2373 				memcpy(mtod(stream->m, uint8_t *), buf, len);
2374 				stream->moff = len;
2375 			}
2376 			stream->left = pktlen - len;
2377 			goto resubmit;
2378 		}
2379 		if (__predict_true(m != NULL)) {
2380 			/* We have all the pktlen bytes in this xfer. */
2381 			memcpy(mtod(m, uint8_t *), buf, pktlen);
2382 			athn_usb_rx_frame(usc, m);
2383 		}
2384 
2385 		/* Next header is 32-bit aligned. */
2386 		off = (pktlen + 3) & ~3;
2387 		buf += off;
2388 		len -= off;
2389 	}
2390 
2391  resubmit:
2392 	/* Setup a new transfer. */
2393 	usbd_setup_xfer(xfer, data, data->buf, ATHN_USB_RXBUFSZ,
2394 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, athn_usb_rxeof);
2395 	(void)usbd_transfer(xfer);
2396 }
2397 
2398 Static void
2399 athn_usb_txeof(struct usbd_xfer *xfer, void * priv,
2400     usbd_status status)
2401 {
2402 	struct athn_usb_tx_data *data = priv;
2403 	struct athn_usb_softc *usc = data->sc;
2404 	struct athn_softc *sc = &usc->usc_sc;
2405 	struct ifnet *ifp = &sc->sc_if;
2406 	int s;
2407 
2408 	if (usc->usc_dying)
2409 		return;
2410 
2411 	DPRINTFN(DBG_FN, usc, "\n");
2412 
2413 	s = splnet();
2414 	/* Put this Tx buffer back to our free list. */
2415 	mutex_enter(&usc->usc_tx_mtx);
2416 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2417 	mutex_exit(&usc->usc_tx_mtx);
2418 
2419 	if (__predict_false(status != USBD_NORMAL_COMPLETION)) {
2420 		DPRINTFN(DBG_TX, sc, "TX status=%d\n", status);
2421 		if (status == USBD_STALLED)
2422 			usbd_clear_endpoint_stall_async(usc->usc_tx_data_pipe);
2423 		ifp->if_oerrors++;
2424 		splx(s);
2425 		/* XXX Why return? */
2426 		return;
2427 	}
2428 	sc->sc_tx_timer = 0;
2429 	ifp->if_opackets++;
2430 
2431 	/* We just released a Tx buffer, notify Tx. */
2432 	if (ifp->if_flags & IFF_OACTIVE) {
2433 		ifp->if_flags &= ~IFF_OACTIVE;
2434 		ifp->if_start(ifp);
2435 	}
2436 	splx(s);
2437 }
2438 
2439 Static int
2440 athn_usb_tx(struct athn_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2441     struct athn_usb_tx_data *data)
2442 {
2443 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2444 	struct athn_node *an = ATHN_NODE(ni);
2445 	struct ieee80211com *ic = &sc->sc_ic;
2446 	struct ieee80211_frame *wh;
2447 	struct ieee80211_key *k = NULL;
2448 	struct ar_stream_hdr *hdr;
2449 	struct ar_htc_frame_hdr *htc;
2450 	struct ar_tx_frame *txf;
2451 	struct ar_tx_mgmt *txm;
2452 	uint8_t *frm;
2453 	uint8_t sta_index, qid, tid;
2454 	int error, s, xferlen;
2455 
2456 	DPRINTFN(DBG_FN, sc, "\n");
2457 
2458 	wh = mtod(m, struct ieee80211_frame *);
2459 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2460 		k = ieee80211_crypto_encap(ic, ni, m);
2461 		if (k == NULL)
2462 			return ENOBUFS;
2463 
2464 		/* packet header may have moved, reset our local pointer */
2465 		wh = mtod(m, struct ieee80211_frame *);
2466 	}
2467 #ifdef notyet_edca
2468 	if (ieee80211_has_qos(wh)) {
2469 		uint16_t qos;
2470 
2471 		qos = ieee80211_get_qos(wh);
2472 		tid = qos & IEEE80211_QOS_TID;
2473 		qid = ieee80211_up_to_ac(ic, tid);
2474 	} else
2475 #endif /* notyet_edca */
2476 	{
2477 		tid = 0;
2478 		qid = WME_AC_BE;
2479 	}
2480 
2481 	/* XXX Change radiotap Tx header for USB (no txrate). */
2482 	if (__predict_false(sc->sc_drvbpf != NULL)) {
2483 		struct athn_tx_radiotap_header *tap = &sc->sc_txtap;
2484 
2485 		tap->wt_flags = 0;
2486 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2487 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2488 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED)
2489 			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2490 
2491 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m, BPF_D_OUT);
2492 	}
2493 	sta_index = an->sta_index;
2494 
2495 	/* NB: We don't take advantage of USB Tx stream mode for now. */
2496 	hdr = (struct ar_stream_hdr *)data->buf;
2497 	hdr->tag = htole16(AR_USB_TX_STREAM_TAG);
2498 
2499 	htc = (struct ar_htc_frame_hdr *)&hdr[1];
2500 	memset(htc, 0, sizeof(*htc));
2501 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2502 	    IEEE80211_FC0_TYPE_DATA) {
2503 		htc->endpoint_id = usc->usc_ep_data[qid];
2504 
2505 		txf = (struct ar_tx_frame *)&htc[1];
2506 		memset(txf, 0, sizeof(*txf));
2507 		txf->data_type = AR_HTC_NORMAL;
2508 		txf->node_idx = sta_index;
2509 		txf->vif_idx = 0;
2510 		txf->tid = tid;
2511 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold)
2512 			txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2513 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2514 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2515 				txf->flags |= htobe32(AR_HTC_TX_CTSONLY);
2516 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2517 				txf->flags |= htobe32(AR_HTC_TX_RTSCTS);
2518 		}
2519 		txf->key_idx = 0xff;
2520 		frm = (uint8_t *)&txf[1];
2521 	} else {
2522 		htc->endpoint_id = usc->usc_ep_mgmt;
2523 
2524 		txm = (struct ar_tx_mgmt *)&htc[1];
2525 		memset(txm, 0, sizeof(*txm));
2526 		txm->node_idx = sta_index;
2527 		txm->vif_idx = 0;
2528 		txm->key_idx = 0xff;
2529 		frm = (uint8_t *)&txm[1];
2530 	}
2531 	/* Copy payload. */
2532 	m_copydata(m, 0, m->m_pkthdr.len, (void *)frm);
2533 	frm += m->m_pkthdr.len;
2534 
2535 	/* Finalize headers. */
2536 	htc->payload_len = htobe16(frm - (uint8_t *)&htc[1]);
2537 	hdr->len = htole16(frm - (uint8_t *)&hdr[1]);
2538 	xferlen = frm - data->buf;
2539 
2540 	s = splnet();
2541 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2542 	    USBD_FORCE_SHORT_XFER, ATHN_USB_TX_TIMEOUT, athn_usb_txeof);
2543 	error = usbd_transfer(data->xfer);
2544 	if (__predict_false(error != USBD_IN_PROGRESS && error != 0)) {
2545 		splx(s);
2546 		return error;
2547 	}
2548 	splx(s);
2549 	return 0;
2550 }
2551 
2552 Static void
2553 athn_usb_start(struct ifnet *ifp)
2554 {
2555 	struct athn_softc *sc = ifp->if_softc;
2556 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2557 	struct ieee80211com *ic = &sc->sc_ic;
2558 	struct athn_usb_tx_data *data;
2559 	struct ether_header *eh;
2560 	struct ieee80211_node *ni;
2561 	struct mbuf *m;
2562 
2563 	if (usc->usc_dying)
2564 		return;
2565 
2566 	DPRINTFN(DBG_FN, sc, "\n");
2567 
2568 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2569 		return;
2570 
2571 	data = NULL;
2572 	for (;;) {
2573 		mutex_enter(&usc->usc_tx_mtx);
2574 		if (data == NULL && !TAILQ_EMPTY(&usc->usc_tx_free_list)) {
2575 			data = TAILQ_FIRST(&usc->usc_tx_free_list);
2576 			TAILQ_REMOVE(&usc->usc_tx_free_list, data, next);
2577 		}
2578 		mutex_exit(&usc->usc_tx_mtx);
2579 
2580 		if (data == NULL) {
2581 			ifp->if_flags |= IFF_OACTIVE;
2582 			return;
2583 		}
2584 
2585 		/* Send pending management frames first. */
2586 		IF_DEQUEUE(&ic->ic_mgtq, m);
2587 		if (m != NULL) {
2588 			ni = M_GETCTX(m, struct ieee80211_node *);
2589 			M_CLEARCTX(m);
2590 			goto sendit;
2591 		}
2592 		if (ic->ic_state != IEEE80211_S_RUN)
2593 			break;
2594 
2595 		/* Encapsulate and send data frames. */
2596 		IFQ_DEQUEUE(&ifp->if_snd, m);
2597 		if (m == NULL)
2598 			break;
2599 
2600 		if (m->m_len < (int)sizeof(*eh) &&
2601 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
2602 			ifp->if_oerrors++;
2603 			continue;
2604 		}
2605 		eh = mtod(m, struct ether_header *);
2606 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2607 		if (ni == NULL) {
2608 			m_freem(m);
2609 			ifp->if_oerrors++;
2610 			continue;
2611 		}
2612 
2613 		bpf_mtap(ifp, m, BPF_D_OUT);
2614 
2615 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
2616 			ieee80211_free_node(ni);
2617 			ifp->if_oerrors++;
2618 			continue;
2619 		}
2620  sendit:
2621 		bpf_mtap3(ic->ic_rawbpf, m, BPF_D_OUT);
2622 
2623 		if (athn_usb_tx(sc, m, ni, data) != 0) {
2624 			m_freem(m);
2625 			ieee80211_free_node(ni);
2626 			ifp->if_oerrors++;
2627 			continue;
2628 		}
2629 		data = NULL;
2630 		m_freem(m);
2631 		ieee80211_free_node(ni);
2632 		sc->sc_tx_timer = 5;
2633 		ifp->if_timer = 1;
2634 	}
2635 
2636 	/* Return the Tx buffer to the free list */
2637 	mutex_enter(&usc->usc_tx_mtx);
2638 	TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
2639 	mutex_exit(&usc->usc_tx_mtx);
2640 }
2641 
2642 Static void
2643 athn_usb_watchdog(struct ifnet *ifp)
2644 {
2645 	struct athn_softc *sc = ifp->if_softc;
2646 
2647 	DPRINTFN(DBG_FN, sc, "\n");
2648 
2649 	ifp->if_timer = 0;
2650 
2651 	if (sc->sc_tx_timer > 0) {
2652 		if (--sc->sc_tx_timer == 0) {
2653 			aprint_error_dev(sc->sc_dev, "device timeout\n");
2654 			/* athn_usb_init(ifp); XXX needs a process context! */
2655 			ifp->if_oerrors++;
2656 			return;
2657 		}
2658 		ifp->if_timer = 1;
2659 	}
2660 	ieee80211_watchdog(&sc->sc_ic);
2661 }
2662 
2663 Static int
2664 athn_usb_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2665 {
2666 	struct athn_softc *sc = ifp->if_softc;
2667 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2668 	struct ieee80211com *ic = &sc->sc_ic;
2669 	int s, error = 0;
2670 
2671 	if (usc->usc_dying)
2672 		return EIO;
2673 
2674 	DPRINTFN(DBG_FN, sc, "cmd=0x%08lx\n", cmd);
2675 
2676 	s = splnet();
2677 
2678 	switch (cmd) {
2679 	case SIOCSIFFLAGS:
2680 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2681 			break;
2682 
2683 		switch (ifp->if_flags & (IFF_UP | IFF_RUNNING)) {
2684 		case IFF_UP | IFF_RUNNING:
2685 			break;
2686 		case IFF_UP:
2687 			error = athn_usb_init(ifp);
2688 			break;
2689 		case IFF_RUNNING:
2690 			athn_usb_stop(ifp, 0);
2691 			break;
2692 		case 0:
2693 		default:
2694 			break;
2695 		}
2696 		break;
2697 
2698 	case SIOCADDMULTI:
2699 	case SIOCDELMULTI:
2700 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
2701 			/* setup multicast filter, etc */
2702 			error = 0;
2703 		}
2704 		break;
2705 
2706 	case SIOCS80211CHANNEL:
2707 		error = ieee80211_ioctl(ic, cmd, data);
2708 		if (error == ENETRESET &&
2709 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2710 			if (IS_UP_AND_RUNNING(ifp))
2711 				athn_usb_switch_chan(sc, ic->ic_curchan, NULL);
2712 			error = 0;
2713 		}
2714 		break;
2715 
2716 	default:
2717 		error = ieee80211_ioctl(ic, cmd, data);
2718 		break;
2719 	}
2720 	if (error == ENETRESET) {
2721 		error = 0;
2722 		if (IS_UP_AND_RUNNING(ifp) &&
2723 		    ic->ic_roaming != IEEE80211_ROAMING_MANUAL) {
2724 			mutex_enter(&usc->usc_lock);
2725 			athn_usb_stop_locked(ifp);
2726 			error = athn_usb_init_locked(ifp);
2727 			mutex_exit(&usc->usc_lock);
2728 		}
2729 	}
2730 	splx(s);
2731 	return error;
2732 }
2733 
2734 Static int
2735 athn_usb_init(struct ifnet *ifp)
2736 {
2737 	struct athn_softc *sc = ifp->if_softc;
2738 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2739 
2740 	mutex_enter(&usc->usc_lock);
2741 	int ret = athn_usb_init_locked(ifp);
2742 	mutex_exit(&usc->usc_lock);
2743 
2744 	return ret;
2745 }
2746 
2747 Static int
2748 athn_usb_init_locked(struct ifnet *ifp)
2749 {
2750 	struct athn_softc *sc = ifp->if_softc;
2751 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2752 	struct athn_ops *ops = &sc->sc_ops;
2753 	struct ieee80211com *ic = &sc->sc_ic;
2754 	struct ieee80211_channel *curchan, *extchan;
2755 	struct athn_usb_rx_data *data;
2756 	struct ar_htc_target_vif hvif;
2757 	struct ar_htc_target_sta sta;
2758 	struct ar_htc_cap_target hic;
2759 	uint16_t mode;
2760 	size_t i;
2761 	int error;
2762 
2763 	if (usc->usc_dying)
2764 		return USBD_CANCELLED;
2765 
2766 	DPRINTFN(DBG_FN, sc, "\n");
2767 
2768 	/* Init host async commands ring. */
2769 	mutex_spin_enter(&usc->usc_task_mtx);
2770 	usc->usc_cmdq.cur = usc->usc_cmdq.next = usc->usc_cmdq.queued = 0;
2771 	mutex_spin_exit(&usc->usc_task_mtx);
2772 
2773 	curchan = ic->ic_curchan;
2774 	extchan = NULL;
2775 
2776 	/* In case a new MAC address has been configured. */
2777 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2778 
2779 	error = athn_set_power_awake(sc);
2780 	if (error != 0)
2781 		goto fail;
2782 
2783 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_FLUSH_RECV);
2784 	if (error != 0)
2785 		goto fail;
2786 
2787 	error = athn_hw_reset(sc, curchan, extchan, 1);
2788 	if (error != 0)
2789 		goto fail;
2790 
2791 	ops->set_txpower(sc, curchan, extchan);
2792 
2793 	mode = htobe16(IEEE80211_IS_CHAN_2GHZ(curchan) ?
2794 	    AR_HTC_MODE_11NG : AR_HTC_MODE_11NA);
2795 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_SET_MODE,
2796 	    &mode, sizeof(mode), NULL);
2797 	if (error != 0)
2798 		goto fail;
2799 
2800 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_ATH_INIT);
2801 	if (error != 0)
2802 		goto fail;
2803 
2804 	error = athn_usb_wmi_cmd(usc, AR_WMI_CMD_START_RECV);
2805 	if (error != 0)
2806 		goto fail;
2807 
2808 	athn_rx_start(sc);
2809 
2810 	/* Create main interface on target. */
2811 	memset(&hvif, 0, sizeof(hvif));
2812 	hvif.index = 0;
2813 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2814 	switch (ic->ic_opmode) {
2815 	case IEEE80211_M_STA:
2816 		hvif.opmode = htobe32(AR_HTC_M_STA);
2817 		break;
2818 	case IEEE80211_M_MONITOR:
2819 		hvif.opmode = htobe32(AR_HTC_M_MONITOR);
2820 		break;
2821 #ifndef IEEE80211_STA_ONLY
2822 	case IEEE80211_M_IBSS:
2823 		hvif.opmode = htobe32(AR_HTC_M_IBSS);
2824 		break;
2825 	case IEEE80211_M_AHDEMO:
2826 		hvif.opmode = htobe32(AR_HTC_M_AHDEMO);
2827 		break;
2828 	case IEEE80211_M_HOSTAP:
2829 		hvif.opmode = htobe32(AR_HTC_M_HOSTAP);
2830 		break;
2831 #endif
2832 	}
2833 	hvif.rtsthreshold = htobe16(ic->ic_rtsthreshold);
2834 	DPRINTFN(DBG_INIT, sc, "creating VAP\n");
2835 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_CREATE,
2836 	    &hvif, sizeof(hvif), NULL);
2837 	if (error != 0)
2838 		goto fail;
2839 
2840 	/* Create a fake node to send management frames before assoc. */
2841 	memset(&sta, 0, sizeof(sta));
2842 	IEEE80211_ADDR_COPY(sta.macaddr, ic->ic_myaddr);
2843 	sta.sta_index = 0;
2844 	sta.is_vif_sta = 1;
2845 	sta.vif_index = hvif.index;
2846 	sta.maxampdu = 0xffff;
2847 
2848 	DPRINTFN(DBG_INIT | DBG_NODES, sc, "creating default node %u\n",
2849 	    sta.sta_index);
2850 	error = athn_usb_create_hw_node(usc, &sta);
2851 	if (error != 0)
2852 		goto fail;
2853 
2854 	/* Update target capabilities. */
2855 	memset(&hic, 0, sizeof(hic));
2856 	hic.flags = htobe32(0x400c2400);
2857 	hic.flags_ext = htobe32(0x00106080);
2858 	hic.ampdu_limit = htobe32(0x0000ffff);
2859 	hic.ampdu_subframes = 20;
2860 	hic.protmode = 1;	/* XXX */
2861 	hic.lg_txchainmask = sc->sc_txchainmask;
2862 	hic.ht_txchainmask = sc->sc_txchainmask;
2863 	DPRINTFN(DBG_INIT, sc, "updating target configuration\n");
2864 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_TARGET_IC_UPDATE,
2865 	    &hic, sizeof(hic), NULL);
2866 	if (error != 0)
2867 		goto fail;
2868 
2869 
2870 	/* Queue Rx xfers. */
2871 	for (i = 0; i < ATHN_USB_RX_LIST_COUNT; i++) {
2872 		data = &usc->usc_rx_data[i];
2873 
2874 		usbd_setup_xfer(data->xfer, data, data->buf,
2875 		    ATHN_USB_RXBUFSZ, USBD_SHORT_XFER_OK,
2876 		    USBD_NO_TIMEOUT, athn_usb_rxeof);
2877 		error = usbd_transfer(data->xfer);
2878 		if (error != 0 && error != USBD_IN_PROGRESS)
2879 			goto fail;
2880 	}
2881 	/* We're ready to go. */
2882 	ifp->if_flags &= ~IFF_OACTIVE;
2883 	ifp->if_flags |= IFF_RUNNING;
2884 
2885 #ifdef notyet
2886 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2887 		/* Install WEP keys. */
2888 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2889 			athn_usb_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2890 	}
2891 #endif
2892 	if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2893 		ic->ic_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
2894 	else
2895 		ic->ic_max_aid = sc->sc_max_aid;
2896 
2897 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2898 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2899 	else
2900 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2901 	athn_usb_wait_async(usc);
2902 	return 0;
2903  fail:
2904 	athn_usb_stop(ifp, 0);
2905 	return error;
2906 }
2907 
2908 Static void
2909 athn_usb_stop(struct ifnet *ifp, int disable)
2910 {
2911 	struct athn_softc *sc = ifp->if_softc;
2912 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2913 
2914 	mutex_enter(&usc->usc_lock);
2915 	athn_usb_stop_locked(ifp);
2916 	mutex_exit(&usc->usc_lock);
2917 }
2918 
2919 Static void
2920 athn_usb_stop_locked(struct ifnet *ifp)
2921 {
2922 	struct athn_softc *sc = ifp->if_softc;
2923 	struct athn_usb_softc *usc = ATHN_USB_SOFTC(sc);
2924 	struct ieee80211com *ic = &sc->sc_ic;
2925 	struct ar_htc_target_vif hvif;
2926 	struct mbuf *m;
2927 	uint8_t sta_index;
2928 	int s;
2929 
2930 	DPRINTFN(DBG_FN, sc, "\n");
2931 
2932 	s = splusb();
2933 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2934 	athn_usb_wait_async(usc);
2935 	splx(s);
2936 
2937 	sc->sc_tx_timer = 0;
2938 	ifp->if_timer = 0;
2939 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2940 
2941 	callout_stop(&sc->sc_scan_to);
2942 	callout_stop(&sc->sc_calib_to);
2943 
2944 	/* Abort Tx/Rx. */
2945 	usbd_abort_pipe(usc->usc_tx_data_pipe);
2946 	usbd_abort_pipe(usc->usc_rx_data_pipe);
2947 
2948 	/* Flush Rx stream. */
2949 	CTASSERT(sizeof(m) == sizeof(void *));
2950 	m = atomic_swap_ptr(&usc->usc_rx_stream.m, NULL);
2951 	m_freem(m);
2952 	usc->usc_rx_stream.left = 0;
2953 
2954 	/* Remove main interface. */
2955 	memset(&hvif, 0, sizeof(hvif));
2956 	hvif.index = 0;
2957 	IEEE80211_ADDR_COPY(hvif.myaddr, ic->ic_myaddr);
2958 	(void)athn_usb_wmi_xcmd(usc, AR_WMI_CMD_VAP_REMOVE,
2959 	    &hvif, sizeof(hvif), NULL);
2960 
2961 	/* Remove default node. */
2962 	sta_index = 0;
2963 	DPRINTFN(DBG_NODES, usc, "removing node %u\n", sta_index);
2964 	(void)athn_usb_remove_hw_node(usc, &sta_index);
2965 
2966 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DISABLE_INTR);
2967 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_DRAIN_TXQ_ALL);
2968 	(void)athn_usb_wmi_cmd(usc, AR_WMI_CMD_STOP_RECV);
2969 
2970 	athn_reset(sc, 0);
2971 	athn_init_pll(sc, NULL);
2972 	athn_set_power_awake(sc);
2973 	athn_reset(sc, 1);
2974 	athn_init_pll(sc, NULL);
2975 	athn_set_power_sleep(sc);
2976 }
2977 
2978 MODULE(MODULE_CLASS_DRIVER, if_athn_usb, NULL);
2979 
2980 #ifdef _MODULE
2981 #include "ioconf.c"
2982 #endif
2983 
2984 static int
2985 if_athn_usb_modcmd(modcmd_t cmd, void *aux)
2986 {
2987 	int error = 0;
2988 
2989 	switch (cmd) {
2990 	case MODULE_CMD_INIT:
2991 #ifdef _MODULE
2992 		error = config_init_component(cfdriver_ioconf_if_athn_usb,
2993 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
2994 #endif
2995 		return error;
2996 	case MODULE_CMD_FINI:
2997 #ifdef _MODULE
2998 		error = config_fini_component(cfdriver_ioconf_if_athn_usb,
2999 		    cfattach_ioconf_if_athn_usb, cfdata_ioconf_if_athn_usb);
3000 #endif
3001 		return error;
3002 	default:
3003 		return ENOTTY;
3004 	}
3005 }
3006