xref: /freebsd/sys/dev/otus/if_otus.c (revision 56e766af41cd68310f5583bb893b13c006fcb44f)
1 /*	$OpenBSD: if_otus.c,v 1.49 2015/11/24 13:33:18 mpi Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Adrian Chadd <adrian@FreeBSD.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros AR9001U chipset.
22  */
23 
24 #include <sys/cdefs.h>
25 __FBSDID("$FreeBSD$");
26 
27 #include "opt_wlan.h"
28 
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/sockio.h>
32 #include <sys/mbuf.h>
33 #include <sys/kernel.h>
34 #include <sys/malloc.h>
35 #include <sys/socket.h>
36 #include <sys/systm.h>
37 #include <sys/conf.h>
38 #include <sys/bus.h>
39 #include <sys/rman.h>
40 #include <sys/firmware.h>
41 #include <sys/module.h>
42 #include <sys/taskqueue.h>
43 
44 #include <machine/bus.h>
45 #include <machine/resource.h>
46 
47 #include <net/bpf.h>
48 #include <net/if.h>
49 #include <net/if_var.h>
50 #include <net/if_arp.h>
51 #include <net/if_dl.h>
52 #include <net/if_media.h>
53 
54 #include <netinet/in.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/in_var.h>
57 #include <netinet/if_ether.h>
58 #include <netinet/ip.h>
59 
60 #include <net80211/ieee80211_var.h>
61 #include <net80211/ieee80211_regdomain.h>
62 #include <net80211/ieee80211_radiotap.h>
63 #include <net80211/ieee80211_ratectl.h>
64 #ifdef	IEEE80211_SUPPORT_SUPERG
65 #include <net80211/ieee80211_superg.h>
66 #endif
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdi.h>
70 #include "usbdevs.h"
71 
72 #define USB_DEBUG_VAR otus_debug
73 #include <dev/usb/usb_debug.h>
74 
75 #include "if_otusreg.h"
76 
77 static int otus_debug = 0;
78 static SYSCTL_NODE(_hw_usb, OID_AUTO, otus, CTLFLAG_RW, 0, "USB otus");
79 SYSCTL_INT(_hw_usb_otus, OID_AUTO, debug, CTLFLAG_RWTUN, &otus_debug, 0,
80     "Debug level");
81 #define	OTUS_DEBUG_XMIT		0x00000001
82 #define	OTUS_DEBUG_RECV		0x00000002
83 #define	OTUS_DEBUG_TXDONE	0x00000004
84 #define	OTUS_DEBUG_RXDONE	0x00000008
85 #define	OTUS_DEBUG_CMD		0x00000010
86 #define	OTUS_DEBUG_CMDDONE	0x00000020
87 #define	OTUS_DEBUG_RESET	0x00000040
88 #define	OTUS_DEBUG_STATE	0x00000080
89 #define	OTUS_DEBUG_CMDNOTIFY	0x00000100
90 #define	OTUS_DEBUG_REGIO	0x00000200
91 #define	OTUS_DEBUG_IRQ		0x00000400
92 #define	OTUS_DEBUG_TXCOMP	0x00000800
93 #define	OTUS_DEBUG_ANY		0xffffffff
94 
95 #define	OTUS_DPRINTF(sc, dm, ...) \
96 	do { \
97 		if ((dm == OTUS_DEBUG_ANY) || (dm & otus_debug)) \
98 			device_printf(sc->sc_dev, __VA_ARGS__); \
99 	} while (0)
100 
101 #define	OTUS_DEV(v, p) { USB_VPI(v, p, 0) }
102 static const STRUCT_USB_HOST_ID otus_devs[] = {
103 	OTUS_DEV(USB_VENDOR_ACCTON,		USB_PRODUCT_ACCTON_WN7512),
104 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_3CRUSBN275),
105 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_TG121N),
106 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_AR9170),
107 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN612),
108 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN821NV2),
109 	OTUS_DEV(USB_VENDOR_AVM,		USB_PRODUCT_AVM_FRITZWLAN),
110 	OTUS_DEV(USB_VENDOR_CACE,		USB_PRODUCT_CACE_AIRPCAPNX),
111 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA130D1),
112 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A1),
113 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A2),
114 	OTUS_DEV(USB_VENDOR_IODATA,		USB_PRODUCT_IODATA_WNGDNUS2),
115 	OTUS_DEV(USB_VENDOR_NEC,		USB_PRODUCT_NEC_WL300NUG),
116 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WN111V2),
117 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNA1000),
118 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNDA3100),
119 	OTUS_DEV(USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GW_US300),
120 	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_O8494),
121 	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_WNC0600),
122 	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB81),
123 	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB82),
124 	OTUS_DEV(USB_VENDOR_ZYDAS,		USB_PRODUCT_ZYDAS_ZD1221),
125 	OTUS_DEV(USB_VENDOR_ZYXEL,		USB_PRODUCT_ZYXEL_NWD271N),
126 };
127 
128 static device_probe_t otus_match;
129 static device_attach_t otus_attach;
130 static device_detach_t otus_detach;
131 
132 static int	otus_attachhook(struct otus_softc *);
133 void		otus_get_chanlist(struct otus_softc *);
134 static void	otus_getradiocaps(struct ieee80211com *, int, int *,
135 		    struct ieee80211_channel[]);
136 int		otus_load_firmware(struct otus_softc *, const char *,
137 		    uint32_t);
138 int		otus_open_pipes(struct otus_softc *);
139 void		otus_close_pipes(struct otus_softc *);
140 
141 static int	otus_alloc_tx_cmd_list(struct otus_softc *);
142 static void	otus_free_tx_cmd_list(struct otus_softc *);
143 
144 static int	otus_alloc_rx_list(struct otus_softc *);
145 static void	otus_free_rx_list(struct otus_softc *);
146 static int	otus_alloc_tx_list(struct otus_softc *);
147 static void	otus_free_tx_list(struct otus_softc *);
148 static void	otus_free_list(struct otus_softc *, struct otus_data [], int);
149 static struct otus_data *_otus_getbuf(struct otus_softc *);
150 static struct otus_data *otus_getbuf(struct otus_softc *);
151 static void	otus_freebuf(struct otus_softc *, struct otus_data *);
152 
153 static struct otus_tx_cmd *_otus_get_txcmd(struct otus_softc *);
154 static struct otus_tx_cmd *otus_get_txcmd(struct otus_softc *);
155 static void	otus_free_txcmd(struct otus_softc *, struct otus_tx_cmd *);
156 
157 void		otus_next_scan(void *, int);
158 static void	otus_tx_task(void *, int pending);
159 void		otus_do_async(struct otus_softc *,
160 		    void (*)(struct otus_softc *, void *), void *, int);
161 int		otus_newstate(struct ieee80211vap *, enum ieee80211_state,
162 		    int);
163 int		otus_cmd(struct otus_softc *, uint8_t, const void *, int,
164 		    void *, int);
165 void		otus_write(struct otus_softc *, uint32_t, uint32_t);
166 int		otus_write_barrier(struct otus_softc *);
167 static struct	ieee80211_node *otus_node_alloc(struct ieee80211vap *vap,
168 		    const uint8_t mac[IEEE80211_ADDR_LEN]);
169 int		otus_media_change(struct ifnet *);
170 int		otus_read_eeprom(struct otus_softc *);
171 void		otus_newassoc(struct ieee80211_node *, int);
172 void		otus_cmd_rxeof(struct otus_softc *, uint8_t *, int);
173 void		otus_sub_rxeof(struct otus_softc *, uint8_t *, int,
174 		    struct mbufq *);
175 static int	otus_tx(struct otus_softc *, struct ieee80211_node *,
176 		    struct mbuf *, struct otus_data *,
177 		    const struct ieee80211_bpf_params *);
178 int		otus_ioctl(struct ifnet *, u_long, caddr_t);
179 int		otus_set_multi(struct otus_softc *);
180 static int	otus_updateedca(struct ieee80211com *);
181 static void	otus_updateedca_locked(struct otus_softc *);
182 static void	otus_updateslot(struct otus_softc *);
183 static void	otus_set_operating_mode(struct otus_softc *sc);
184 static void	otus_set_rx_filter(struct otus_softc *sc);
185 int		otus_init_mac(struct otus_softc *);
186 uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
187 int		otus_set_board_values(struct otus_softc *,
188 		    struct ieee80211_channel *);
189 int		otus_program_phy(struct otus_softc *,
190 		    struct ieee80211_channel *);
191 int		otus_set_rf_bank4(struct otus_softc *,
192 		    struct ieee80211_channel *);
193 void		otus_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
194 static int	otus_set_chan(struct otus_softc *, struct ieee80211_channel *,
195 		    int);
196 int		otus_set_key(struct ieee80211com *, struct ieee80211_node *,
197 		    struct ieee80211_key *);
198 void		otus_set_key_cb(struct otus_softc *, void *);
199 void		otus_delete_key(struct ieee80211com *, struct ieee80211_node *,
200 		    struct ieee80211_key *);
201 void		otus_delete_key_cb(struct otus_softc *, void *);
202 void		otus_calibrate_to(void *, int);
203 int		otus_set_bssid(struct otus_softc *, const uint8_t *);
204 int		otus_set_macaddr(struct otus_softc *, const uint8_t *);
205 void		otus_led_newstate_type1(struct otus_softc *);
206 void		otus_led_newstate_type2(struct otus_softc *);
207 void		otus_led_newstate_type3(struct otus_softc *);
208 int		otus_init(struct otus_softc *sc);
209 void		otus_stop(struct otus_softc *sc);
210 
211 static device_method_t otus_methods[] = {
212 	DEVMETHOD(device_probe,		otus_match),
213 	DEVMETHOD(device_attach,	otus_attach),
214 	DEVMETHOD(device_detach,	otus_detach),
215 
216 	DEVMETHOD_END
217 };
218 
219 static driver_t otus_driver = {
220 	.name = "otus",
221 	.methods = otus_methods,
222 	.size = sizeof(struct otus_softc)
223 };
224 
225 static devclass_t otus_devclass;
226 
227 DRIVER_MODULE(otus, uhub, otus_driver, otus_devclass, NULL, 0);
228 MODULE_DEPEND(otus, wlan, 1, 1, 1);
229 MODULE_DEPEND(otus, usb, 1, 1, 1);
230 MODULE_DEPEND(otus, firmware, 1, 1, 1);
231 MODULE_VERSION(otus, 1);
232 
233 static usb_callback_t	otus_bulk_tx_callback;
234 static usb_callback_t	otus_bulk_rx_callback;
235 static usb_callback_t	otus_bulk_irq_callback;
236 static usb_callback_t	otus_bulk_cmd_callback;
237 
238 static const struct usb_config otus_config[OTUS_N_XFER] = {
239 	[OTUS_BULK_TX] = {
240 	.type = UE_BULK,
241 	.endpoint = UE_ADDR_ANY,
242 	.direction = UE_DIR_OUT,
243 	.bufsize = 0x200,
244 	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
245 	.callback = otus_bulk_tx_callback,
246 	.timeout = 5000,	/* ms */
247 	},
248 	[OTUS_BULK_RX] = {
249 	.type = UE_BULK,
250 	.endpoint = UE_ADDR_ANY,
251 	.direction = UE_DIR_IN,
252 	.bufsize = OTUS_RXBUFSZ,
253 	.flags = { .ext_buffer = 1, .pipe_bof = 1,.short_xfer_ok = 1,},
254 	.callback = otus_bulk_rx_callback,
255 	},
256 	[OTUS_BULK_IRQ] = {
257 	.type = UE_INTERRUPT,
258 	.endpoint = UE_ADDR_ANY,
259 	.direction = UE_DIR_IN,
260 	.bufsize = OTUS_MAX_CTRLSZ,
261 	.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
262 	.callback = otus_bulk_irq_callback,
263 	},
264 	[OTUS_BULK_CMD] = {
265 	.type = UE_INTERRUPT,
266 	.endpoint = UE_ADDR_ANY,
267 	.direction = UE_DIR_OUT,
268 	.bufsize = OTUS_MAX_CTRLSZ,
269 	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
270 	.callback = otus_bulk_cmd_callback,
271 	.timeout = 5000,	/* ms */
272 	},
273 };
274 
275 static int
276 otus_match(device_t self)
277 {
278 	struct usb_attach_arg *uaa = device_get_ivars(self);
279 
280 	if (uaa->usb_mode != USB_MODE_HOST ||
281 	    uaa->info.bIfaceIndex != 0 ||
282 	    uaa->info.bConfigIndex != 0)
283 	return (ENXIO);
284 
285 	return (usbd_lookup_id_by_uaa(otus_devs, sizeof(otus_devs), uaa));
286 }
287 
288 static int
289 otus_attach(device_t self)
290 {
291 	struct usb_attach_arg *uaa = device_get_ivars(self);
292 	struct otus_softc *sc = device_get_softc(self);
293 	int error;
294 	uint8_t iface_index;
295 
296 	device_set_usb_desc(self);
297 	sc->sc_udev = uaa->device;
298 	sc->sc_dev = self;
299 
300 	mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
301 	    MTX_DEF);
302 
303 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->scan_to, 0, otus_next_scan, sc);
304 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_to, 0, otus_calibrate_to, sc);
305 	TASK_INIT(&sc->tx_task, 0, otus_tx_task, sc);
306 	mbufq_init(&sc->sc_snd, ifqmaxlen);
307 
308 	iface_index = 0;
309 	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
310 	    otus_config, OTUS_N_XFER, sc, &sc->sc_mtx);
311 	if (error) {
312 		device_printf(sc->sc_dev,
313 		    "could not allocate USB transfers, err=%s\n",
314 		    usbd_errstr(error));
315 		goto fail_usb;
316 	}
317 
318 	if ((error = otus_open_pipes(sc)) != 0) {
319 		device_printf(sc->sc_dev, "%s: could not open pipes\n",
320 		    __func__);
321 		goto fail;
322 	}
323 
324 	/* XXX check return status; fail out if appropriate */
325 	if (otus_attachhook(sc) != 0)
326 		goto fail;
327 
328 	return (0);
329 
330 fail:
331 	otus_close_pipes(sc);
332 fail_usb:
333 	mtx_destroy(&sc->sc_mtx);
334 	return (ENXIO);
335 }
336 
337 static int
338 otus_detach(device_t self)
339 {
340 	struct otus_softc *sc = device_get_softc(self);
341 	struct ieee80211com *ic = &sc->sc_ic;
342 
343 	otus_stop(sc);
344 
345 	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
346 
347 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
348 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
349 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
350 
351 	otus_close_pipes(sc);
352 #if 0
353 	/* Wait for all queued asynchronous commands to complete. */
354 	usb_rem_wait_task(sc->sc_udev, &sc->sc_task);
355 
356 	usbd_ref_wait(sc->sc_udev);
357 #endif
358 
359 	ieee80211_ifdetach(ic);
360 	mtx_destroy(&sc->sc_mtx);
361 	return 0;
362 }
363 
364 static void
365 otus_delay_ms(struct otus_softc *sc, int ms)
366 {
367 
368 	DELAY(1000 * ms);
369 }
370 
371 static struct ieee80211vap *
372 otus_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
373     enum ieee80211_opmode opmode, int flags,
374     const uint8_t bssid[IEEE80211_ADDR_LEN],
375     const uint8_t mac[IEEE80211_ADDR_LEN])
376 {
377 	struct otus_vap *uvp;
378 	struct ieee80211vap *vap;
379 
380 	if (!TAILQ_EMPTY(&ic->ic_vaps))	 /* only one at a time */
381 		return (NULL);
382 
383 	uvp =  malloc(sizeof(struct otus_vap), M_80211_VAP, M_WAITOK | M_ZERO);
384 	vap = &uvp->vap;
385 
386 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
387 	    flags, bssid) != 0) {
388 		/* out of memory */
389 		free(uvp, M_80211_VAP);
390 		return (NULL);
391 	}
392 
393 	/* override state transition machine */
394 	uvp->newstate = vap->iv_newstate;
395 	vap->iv_newstate = otus_newstate;
396 
397 	/* XXX TODO: double-check */
398 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
399 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
400 
401 	ieee80211_ratectl_init(vap);
402 
403 	/* complete setup */
404 	ieee80211_vap_attach(vap, ieee80211_media_change,
405 	    ieee80211_media_status, mac);
406 	ic->ic_opmode = opmode;
407 
408 	return (vap);
409 }
410 
411 static void
412 otus_vap_delete(struct ieee80211vap *vap)
413 {
414 	struct otus_vap *uvp = OTUS_VAP(vap);
415 
416 	ieee80211_ratectl_deinit(vap);
417 	ieee80211_vap_detach(vap);
418 	free(uvp, M_80211_VAP);
419 }
420 
421 static void
422 otus_parent(struct ieee80211com *ic)
423 {
424 	struct otus_softc *sc = ic->ic_softc;
425 	int startall = 0;
426 
427 	if (ic->ic_nrunning > 0) {
428 		if (!sc->sc_running) {
429 			otus_init(sc);
430 			startall = 1;
431 		} else {
432 			(void) otus_set_multi(sc);
433 		}
434 	} else if (sc->sc_running)
435 		otus_stop(sc);
436 
437 	if (startall)
438 		ieee80211_start_all(ic);
439 }
440 
441 static void
442 otus_drain_mbufq(struct otus_softc *sc)
443 {
444 	struct mbuf *m;
445 	struct ieee80211_node *ni;
446 
447 	OTUS_LOCK_ASSERT(sc);
448 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
449 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
450 		m->m_pkthdr.rcvif = NULL;
451 		ieee80211_free_node(ni);
452 		m_freem(m);
453 	}
454 }
455 
456 static void
457 otus_tx_start(struct otus_softc *sc)
458 {
459 
460 	taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
461 }
462 
463 static int
464 otus_transmit(struct ieee80211com *ic, struct mbuf *m)
465 {
466 	struct otus_softc *sc = ic->ic_softc;
467 	int error;
468 
469 	OTUS_LOCK(sc);
470 	if (! sc->sc_running) {
471 		OTUS_UNLOCK(sc);
472 		return (ENXIO);
473 	}
474 
475 	/* XXX TODO: handle fragments */
476 	error = mbufq_enqueue(&sc->sc_snd, m);
477 	if (error) {
478 		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
479 		    "%s: mbufq_enqueue failed: %d\n",
480 		    __func__,
481 		    error);
482 		OTUS_UNLOCK(sc);
483 		return (error);
484 	}
485 	OTUS_UNLOCK(sc);
486 
487 	/* Kick TX */
488 	otus_tx_start(sc);
489 
490 	return (0);
491 }
492 
493 static void
494 _otus_start(struct otus_softc *sc)
495 {
496 	struct ieee80211_node *ni;
497 	struct otus_data *bf;
498 	struct mbuf *m;
499 
500 	OTUS_LOCK_ASSERT(sc);
501 
502 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
503 		bf = otus_getbuf(sc);
504 		if (bf == NULL) {
505 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
506 			    "%s: failed to get buffer\n", __func__);
507 			mbufq_prepend(&sc->sc_snd, m);
508 			break;
509 		}
510 
511 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
512 		m->m_pkthdr.rcvif = NULL;
513 
514 		if (otus_tx(sc, ni, m, bf, NULL) != 0) {
515 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
516 			    "%s: failed to transmit\n", __func__);
517 			if_inc_counter(ni->ni_vap->iv_ifp,
518 			    IFCOUNTER_OERRORS, 1);
519 			otus_freebuf(sc, bf);
520 			ieee80211_free_node(ni);
521 			m_freem(m);
522 			break;
523 		}
524 	}
525 }
526 
527 static void
528 otus_tx_task(void *arg, int pending)
529 {
530 	struct otus_softc *sc = arg;
531 
532 	OTUS_LOCK(sc);
533 	_otus_start(sc);
534 	OTUS_UNLOCK(sc);
535 }
536 
537 static int
538 otus_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
539     const struct ieee80211_bpf_params *params)
540 {
541 	struct ieee80211com *ic= ni->ni_ic;
542 	struct otus_softc *sc = ic->ic_softc;
543 	struct otus_data *bf = NULL;
544 	int error = 0;
545 
546 	/* Don't transmit if we're not running */
547 	OTUS_LOCK(sc);
548 	if (! sc->sc_running) {
549 		error = ENETDOWN;
550 		goto error;
551 	}
552 
553 	bf = otus_getbuf(sc);
554 	if (bf == NULL) {
555 		error = ENOBUFS;
556 		goto error;
557 	}
558 
559 	if (otus_tx(sc, ni, m, bf, params) != 0) {
560 		error = EIO;
561 		goto error;
562 	}
563 
564 	OTUS_UNLOCK(sc);
565 	return (0);
566 error:
567 	if (bf)
568 		otus_freebuf(sc, bf);
569 	OTUS_UNLOCK(sc);
570 	m_freem(m);
571 	return (ENXIO);
572 }
573 
574 static void
575 otus_update_chw(struct ieee80211com *ic)
576 {
577 
578 	printf("%s: TODO\n", __func__);
579 }
580 
581 static void
582 otus_set_channel(struct ieee80211com *ic)
583 {
584 	struct otus_softc *sc = ic->ic_softc;
585 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "%s: set channel: %d\n",
586 	    __func__,
587 	    ic->ic_curchan->ic_freq);
588 
589 	OTUS_LOCK(sc);
590 	(void) otus_set_chan(sc, ic->ic_curchan, 0);
591 	OTUS_UNLOCK(sc);
592 }
593 
594 static int
595 otus_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
596 {
597 
598 	/* For now, no A-MPDU TX support in the driver */
599 	return (0);
600 }
601 
602 static void
603 otus_scan_start(struct ieee80211com *ic)
604 {
605 
606 //	printf("%s: TODO\n", __func__);
607 }
608 
609 static void
610 otus_scan_end(struct ieee80211com *ic)
611 {
612 
613 //	printf("%s: TODO\n", __func__);
614 }
615 
616 static void
617 otus_update_mcast(struct ieee80211com *ic)
618 {
619 	struct otus_softc *sc = ic->ic_softc;
620 
621 	(void) otus_set_multi(sc);
622 }
623 
624 static int
625 otus_attachhook(struct otus_softc *sc)
626 {
627 	struct ieee80211com *ic = &sc->sc_ic;
628 	usb_device_request_t req;
629 	uint32_t in, out;
630 	int error;
631 
632 	/* Not locked */
633 	error = otus_load_firmware(sc, "otusfw_init", AR_FW_INIT_ADDR);
634 	if (error != 0) {
635 		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
636 		    __func__, "init");
637 		return (ENXIO);
638 	}
639 
640 	/* XXX not locked? */
641 	otus_delay_ms(sc, 1000);
642 
643 	/* Not locked */
644 	error = otus_load_firmware(sc, "otusfw_main", AR_FW_MAIN_ADDR);
645 	if (error != 0) {
646 		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
647 		    __func__, "main");
648 		return (ENXIO);
649 	}
650 
651 	OTUS_LOCK(sc);
652 
653 	/* Tell device that firmware transfer is complete. */
654 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
655 	req.bRequest = AR_FW_DOWNLOAD_COMPLETE;
656 	USETW(req.wValue, 0);
657 	USETW(req.wIndex, 0);
658 	USETW(req.wLength, 0);
659 	if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx, &req, NULL,
660 	    0, NULL, 250) != 0) {
661 		OTUS_UNLOCK(sc);
662 		device_printf(sc->sc_dev,
663 		    "%s: firmware initialization failed\n",
664 		    __func__);
665 		return (ENXIO);
666 	}
667 
668 	/* Send an ECHO command to check that everything is settled. */
669 	in = 0xbadc0ffe;
670 	if (otus_cmd(sc, AR_CMD_ECHO, &in, sizeof in, &out, sizeof(out)) != 0) {
671 		OTUS_UNLOCK(sc);
672 		device_printf(sc->sc_dev,
673 		    "%s: echo command failed\n", __func__);
674 		return (ENXIO);
675 	}
676 	if (in != out) {
677 		OTUS_UNLOCK(sc);
678 		device_printf(sc->sc_dev,
679 		    "%s: echo reply mismatch: 0x%08x!=0x%08x\n",
680 		    __func__, in, out);
681 		return (ENXIO);
682 	}
683 
684 	/* Read entire EEPROM. */
685 	if (otus_read_eeprom(sc) != 0) {
686 		OTUS_UNLOCK(sc);
687 		device_printf(sc->sc_dev,
688 		    "%s: could not read EEPROM\n",
689 		    __func__);
690 		return (ENXIO);
691 	}
692 
693 	OTUS_UNLOCK(sc);
694 
695 	sc->txmask = sc->eeprom.baseEepHeader.txMask;
696 	sc->rxmask = sc->eeprom.baseEepHeader.rxMask;
697 	sc->capflags = sc->eeprom.baseEepHeader.opCapFlags;
698 	IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->eeprom.baseEepHeader.macAddr);
699 	sc->sc_led_newstate = otus_led_newstate_type3;	/* XXX */
700 
701 	device_printf(sc->sc_dev,
702 	    "MAC/BBP AR9170, RF AR%X, MIMO %dT%dR, address %s\n",
703 	    (sc->capflags & AR5416_OPFLAGS_11A) ?
704 		0x9104 : ((sc->txmask == 0x5) ? 0x9102 : 0x9101),
705 	    (sc->txmask == 0x5) ? 2 : 1, (sc->rxmask == 0x5) ? 2 : 1,
706 	    ether_sprintf(ic->ic_macaddr));
707 
708 	ic->ic_softc = sc;
709 	ic->ic_name = device_get_nameunit(sc->sc_dev);
710 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
711 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
712 
713 	/* Set device capabilities. */
714 	ic->ic_caps =
715 	    IEEE80211_C_STA |		/* station mode */
716 #if 0
717 	    IEEE80211_C_BGSCAN |	/* Background scan. */
718 #endif
719 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
720 	    IEEE80211_C_WME |		/* WME/QoS */
721 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
722 	    IEEE80211_C_FF |		/* Atheros fast-frames supported. */
723 	    IEEE80211_C_MONITOR |
724 	    IEEE80211_C_WPA;		/* WPA/RSN. */
725 
726 	/* XXX TODO: 11n */
727 
728 #if 0
729 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
730 		/* Set supported .11b and .11g rates. */
731 		ic->ic_sup_rates[IEEE80211_MODE_11B] =
732 		    ieee80211_std_rateset_11b;
733 		ic->ic_sup_rates[IEEE80211_MODE_11G] =
734 		    ieee80211_std_rateset_11g;
735 	}
736 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
737 		/* Set supported .11a rates. */
738 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
739 		    ieee80211_std_rateset_11a;
740 	}
741 #endif
742 
743 #if 0
744 	/* Build the list of supported channels. */
745 	otus_get_chanlist(sc);
746 #else
747 	otus_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
748 	    ic->ic_channels);
749 #endif
750 
751 	ieee80211_ifattach(ic);
752 	ic->ic_raw_xmit = otus_raw_xmit;
753 	ic->ic_scan_start = otus_scan_start;
754 	ic->ic_scan_end = otus_scan_end;
755 	ic->ic_set_channel = otus_set_channel;
756 	ic->ic_getradiocaps = otus_getradiocaps;
757 	ic->ic_vap_create = otus_vap_create;
758 	ic->ic_vap_delete = otus_vap_delete;
759 	ic->ic_update_mcast = otus_update_mcast;
760 	ic->ic_update_promisc = otus_update_mcast;
761 	ic->ic_parent = otus_parent;
762 	ic->ic_transmit = otus_transmit;
763 	ic->ic_update_chw = otus_update_chw;
764 	ic->ic_ampdu_enable = otus_ampdu_enable;
765 	ic->ic_wme.wme_update = otus_updateedca;
766 	ic->ic_newassoc = otus_newassoc;
767 	ic->ic_node_alloc = otus_node_alloc;
768 
769 #ifdef notyet
770 	ic->ic_set_key = otus_set_key;
771 	ic->ic_delete_key = otus_delete_key;
772 #endif
773 
774 	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
775 	    sizeof(sc->sc_txtap), OTUS_TX_RADIOTAP_PRESENT,
776 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
777 	    OTUS_RX_RADIOTAP_PRESENT);
778 
779 	return (0);
780 }
781 
782 void
783 otus_get_chanlist(struct otus_softc *sc)
784 {
785 	struct ieee80211com *ic = &sc->sc_ic;
786 	uint16_t domain;
787 	uint8_t chan;
788 	int i;
789 
790 	/* XXX regulatory domain. */
791 	domain = le16toh(sc->eeprom.baseEepHeader.regDmn[0]);
792 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "regdomain=0x%04x\n", domain);
793 
794 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
795 		for (i = 0; i < 14; i++) {
796 			chan = ar_chans[i];
797 			ic->ic_channels[chan].ic_freq =
798 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
799 			ic->ic_channels[chan].ic_flags =
800 			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
801 			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
802 		}
803 	}
804 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
805 		for (i = 14; i < nitems(ar_chans); i++) {
806 			chan = ar_chans[i];
807 			ic->ic_channels[chan].ic_freq =
808 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
809 			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
810 		}
811 	}
812 }
813 
814 static void
815 otus_getradiocaps(struct ieee80211com *ic,
816     int maxchans, int *nchans, struct ieee80211_channel chans[])
817 {
818 	struct otus_softc *sc = ic->ic_softc;
819 	uint8_t bands[IEEE80211_MODE_BYTES];
820 
821 	/* Set supported .11b and .11g rates. */
822 	memset(bands, 0, sizeof(bands));
823 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
824 		setbit(bands, IEEE80211_MODE_11B);
825 		setbit(bands, IEEE80211_MODE_11G);
826 #if 0
827 		if (sc->sc_ht)
828 			setbit(bands, IEEE80211_MODE_11NG);
829 #endif
830 		ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
831 		    ar_chans, 14, bands, 0);
832 	}
833 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
834 		setbit(bands, IEEE80211_MODE_11A);
835 		ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
836                     &ar_chans[14], nitems(ar_chans) - 14, bands, 0);
837 	}
838 }
839 
840 int
841 otus_load_firmware(struct otus_softc *sc, const char *name, uint32_t addr)
842 {
843 	usb_device_request_t req;
844 	char *ptr;
845 	const struct firmware *fw;
846 	int mlen, error, size;
847 
848 	error = 0;
849 
850 	/* Read firmware image from the filesystem. */
851 	if ((fw = firmware_get(name)) == NULL) {
852 		device_printf(sc->sc_dev,
853 		    "%s: failed loadfirmware of file %s\n", __func__, name);
854 		return (ENXIO);
855 	}
856 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
857 	req.bRequest = AR_FW_DOWNLOAD;
858 	USETW(req.wIndex, 0);
859 
860 	OTUS_LOCK(sc);
861 
862 	/* XXX const */
863 	ptr = __DECONST(char *, fw->data);
864 	size = fw->datasize;
865 	addr >>= 8;
866 	while (size > 0) {
867 		mlen = MIN(size, 4096);
868 
869 		USETW(req.wValue, addr);
870 		USETW(req.wLength, mlen);
871 		if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
872 		    &req, ptr, 0, NULL, 250) != 0) {
873 			error = EIO;
874 			break;
875 		}
876 		addr += mlen >> 8;
877 		ptr  += mlen;
878 		size -= mlen;
879 	}
880 
881 	OTUS_UNLOCK(sc);
882 
883 	firmware_put(fw, FIRMWARE_UNLOAD);
884 	if (error != 0)
885 		device_printf(sc->sc_dev,
886 		    "%s: %s: error=%d\n", __func__, name, error);
887 	return error;
888 }
889 
890 int
891 otus_open_pipes(struct otus_softc *sc)
892 {
893 #if 0
894 	int isize, error;
895 	int i;
896 #endif
897 	int error;
898 
899 	OTUS_UNLOCK_ASSERT(sc);
900 
901 	if ((error = otus_alloc_tx_cmd_list(sc)) != 0) {
902 		device_printf(sc->sc_dev,
903 		    "%s: could not allocate command xfer\n",
904 		    __func__);
905 		goto fail;
906 	}
907 
908 	if ((error = otus_alloc_tx_list(sc)) != 0) {
909 		device_printf(sc->sc_dev, "%s: could not allocate Tx xfers\n",
910 		    __func__);
911 		goto fail;
912 	}
913 
914 	if ((error = otus_alloc_rx_list(sc)) != 0) {
915 		device_printf(sc->sc_dev, "%s: could not allocate Rx xfers\n",
916 		    __func__);
917 		goto fail;
918 	}
919 
920 	/* Enable RX transfers; needed for initial firmware messages */
921 	OTUS_LOCK(sc);
922 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_RX]);
923 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_IRQ]);
924 	OTUS_UNLOCK(sc);
925 	return 0;
926 
927 fail:	otus_close_pipes(sc);
928 	return error;
929 }
930 
931 void
932 otus_close_pipes(struct otus_softc *sc)
933 {
934 
935 	OTUS_LOCK(sc);
936 	otus_free_tx_cmd_list(sc);
937 	otus_free_tx_list(sc);
938 	otus_free_rx_list(sc);
939 	OTUS_UNLOCK(sc);
940 
941 	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
942 }
943 
944 static void
945 otus_free_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[], int ndata)
946 {
947 	int i;
948 
949 	/* XXX TODO: someone has to have waken up waiters! */
950 	for (i = 0; i < ndata; i++) {
951 		struct otus_tx_cmd *dp = &cmd[i];
952 
953 		if (dp->buf != NULL) {
954 			free(dp->buf, M_USBDEV);
955 			dp->buf = NULL;
956 		}
957 	}
958 }
959 
960 static int
961 otus_alloc_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[],
962     int ndata, int maxsz)
963 {
964 	int i, error;
965 
966 	for (i = 0; i < ndata; i++) {
967 		struct otus_tx_cmd *dp = &cmd[i];
968 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT | M_ZERO);
969 		dp->odata = NULL;
970 		if (dp->buf == NULL) {
971 			device_printf(sc->sc_dev,
972 			    "could not allocate buffer\n");
973 			error = ENOMEM;
974 			goto fail;
975 		}
976 	}
977 
978 	return (0);
979 fail:
980 	otus_free_cmd_list(sc, cmd, ndata);
981 	return (error);
982 }
983 
984 static int
985 otus_alloc_tx_cmd_list(struct otus_softc *sc)
986 {
987 	int error, i;
988 
989 	error = otus_alloc_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT,
990 	    OTUS_MAX_TXCMDSZ);
991 	if (error != 0)
992 		return (error);
993 
994 	STAILQ_INIT(&sc->sc_cmd_active);
995 	STAILQ_INIT(&sc->sc_cmd_inactive);
996 	STAILQ_INIT(&sc->sc_cmd_pending);
997 	STAILQ_INIT(&sc->sc_cmd_waiting);
998 
999 	for (i = 0; i < OTUS_CMD_LIST_COUNT; i++)
1000 		STAILQ_INSERT_HEAD(&sc->sc_cmd_inactive, &sc->sc_cmd[i],
1001 		    next_cmd);
1002 
1003 	return (0);
1004 }
1005 
1006 static void
1007 otus_free_tx_cmd_list(struct otus_softc *sc)
1008 {
1009 
1010 	/*
1011 	 * XXX TODO: something needs to wake up any pending/sleeping
1012 	 * waiters!
1013 	 */
1014 	STAILQ_INIT(&sc->sc_cmd_active);
1015 	STAILQ_INIT(&sc->sc_cmd_inactive);
1016 	STAILQ_INIT(&sc->sc_cmd_pending);
1017 	STAILQ_INIT(&sc->sc_cmd_waiting);
1018 
1019 	otus_free_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT);
1020 }
1021 
1022 static int
1023 otus_alloc_list(struct otus_softc *sc, struct otus_data data[],
1024     int ndata, int maxsz)
1025 {
1026 	int i, error;
1027 
1028 	for (i = 0; i < ndata; i++) {
1029 		struct otus_data *dp = &data[i];
1030 		dp->sc = sc;
1031 		dp->m = NULL;
1032 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT | M_ZERO);
1033 		if (dp->buf == NULL) {
1034 			device_printf(sc->sc_dev,
1035 			    "could not allocate buffer\n");
1036 			error = ENOMEM;
1037 			goto fail;
1038 		}
1039 		dp->ni = NULL;
1040 	}
1041 
1042 	return (0);
1043 fail:
1044 	otus_free_list(sc, data, ndata);
1045 	return (error);
1046 }
1047 
1048 static int
1049 otus_alloc_rx_list(struct otus_softc *sc)
1050 {
1051 	int error, i;
1052 
1053 	error = otus_alloc_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT,
1054 	    OTUS_RXBUFSZ);
1055 	if (error != 0)
1056 		return (error);
1057 
1058 	STAILQ_INIT(&sc->sc_rx_active);
1059 	STAILQ_INIT(&sc->sc_rx_inactive);
1060 
1061 	for (i = 0; i < OTUS_RX_LIST_COUNT; i++)
1062 		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1063 
1064 	return (0);
1065 }
1066 
1067 static int
1068 otus_alloc_tx_list(struct otus_softc *sc)
1069 {
1070 	int error, i;
1071 
1072 	error = otus_alloc_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT,
1073 	    OTUS_TXBUFSZ);
1074 	if (error != 0)
1075 		return (error);
1076 
1077 	STAILQ_INIT(&sc->sc_tx_inactive);
1078 
1079 	for (i = 0; i != OTUS_N_XFER; i++) {
1080 		STAILQ_INIT(&sc->sc_tx_active[i]);
1081 		STAILQ_INIT(&sc->sc_tx_pending[i]);
1082 	}
1083 
1084 	for (i = 0; i < OTUS_TX_LIST_COUNT; i++) {
1085 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1086 	}
1087 
1088 	return (0);
1089 }
1090 
1091 static void
1092 otus_free_tx_list(struct otus_softc *sc)
1093 {
1094 	int i;
1095 
1096 	/* prevent further allocations from TX list(s) */
1097 	STAILQ_INIT(&sc->sc_tx_inactive);
1098 
1099 	for (i = 0; i != OTUS_N_XFER; i++) {
1100 		STAILQ_INIT(&sc->sc_tx_active[i]);
1101 		STAILQ_INIT(&sc->sc_tx_pending[i]);
1102 	}
1103 
1104 	otus_free_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT);
1105 }
1106 
1107 static void
1108 otus_free_rx_list(struct otus_softc *sc)
1109 {
1110 	/* prevent further allocations from RX list(s) */
1111 	STAILQ_INIT(&sc->sc_rx_inactive);
1112 	STAILQ_INIT(&sc->sc_rx_active);
1113 
1114 	otus_free_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT);
1115 }
1116 
1117 static void
1118 otus_free_list(struct otus_softc *sc, struct otus_data data[], int ndata)
1119 {
1120 	int i;
1121 
1122 	for (i = 0; i < ndata; i++) {
1123 		struct otus_data *dp = &data[i];
1124 
1125 		if (dp->buf != NULL) {
1126 			free(dp->buf, M_USBDEV);
1127 			dp->buf = NULL;
1128 		}
1129 		if (dp->ni != NULL) {
1130 			ieee80211_free_node(dp->ni);
1131 			dp->ni = NULL;
1132 		}
1133 	}
1134 }
1135 
1136 static struct otus_data *
1137 _otus_getbuf(struct otus_softc *sc)
1138 {
1139 	struct otus_data *bf;
1140 
1141 	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1142 	if (bf != NULL)
1143 		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1144 	else
1145 		bf = NULL;
1146 	/* XXX bzero? */
1147 	return (bf);
1148 }
1149 
1150 static struct otus_data *
1151 otus_getbuf(struct otus_softc *sc)
1152 {
1153 	struct otus_data *bf;
1154 
1155 	OTUS_LOCK_ASSERT(sc);
1156 
1157 	bf = _otus_getbuf(sc);
1158 	return (bf);
1159 }
1160 
1161 static void
1162 otus_freebuf(struct otus_softc *sc, struct otus_data *bf)
1163 {
1164 
1165 	OTUS_LOCK_ASSERT(sc);
1166 	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
1167 }
1168 
1169 static struct otus_tx_cmd *
1170 _otus_get_txcmd(struct otus_softc *sc)
1171 {
1172 	struct otus_tx_cmd *bf;
1173 
1174 	bf = STAILQ_FIRST(&sc->sc_cmd_inactive);
1175 	if (bf != NULL)
1176 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_inactive, next_cmd);
1177 	else
1178 		bf = NULL;
1179 	return (bf);
1180 }
1181 
1182 static struct otus_tx_cmd *
1183 otus_get_txcmd(struct otus_softc *sc)
1184 {
1185 	struct otus_tx_cmd *bf;
1186 
1187 	OTUS_LOCK_ASSERT(sc);
1188 
1189 	bf = _otus_get_txcmd(sc);
1190 	if (bf == NULL) {
1191 		device_printf(sc->sc_dev, "%s: no tx cmd buffers\n",
1192 		    __func__);
1193 	}
1194 	return (bf);
1195 }
1196 
1197 static void
1198 otus_free_txcmd(struct otus_softc *sc, struct otus_tx_cmd *bf)
1199 {
1200 
1201 	OTUS_LOCK_ASSERT(sc);
1202 	STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, bf, next_cmd);
1203 }
1204 
1205 void
1206 otus_next_scan(void *arg, int pending)
1207 {
1208 #if 0
1209 	struct otus_softc *sc = arg;
1210 
1211 	if (usbd_is_dying(sc->sc_udev))
1212 		return;
1213 
1214 	usbd_ref_incr(sc->sc_udev);
1215 
1216 	if (sc->sc_ic.ic_state == IEEE80211_S_SCAN)
1217 		ieee80211_next_scan(&sc->sc_ic.ic_if);
1218 
1219 	usbd_ref_decr(sc->sc_udev);
1220 #endif
1221 }
1222 
1223 int
1224 otus_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1225 {
1226 	struct otus_vap *uvp = OTUS_VAP(vap);
1227 	struct ieee80211com *ic = vap->iv_ic;
1228 	struct otus_softc *sc = ic->ic_softc;
1229 	enum ieee80211_state ostate;
1230 
1231 	ostate = vap->iv_state;
1232 	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1233 	    ieee80211_state_name[ostate],
1234 	    ieee80211_state_name[nstate]);
1235 
1236 	IEEE80211_UNLOCK(ic);
1237 
1238 	OTUS_LOCK(sc);
1239 
1240 	/* XXX TODO: more fleshing out! */
1241 
1242 	switch (nstate) {
1243 	case IEEE80211_S_INIT:
1244 		otus_set_operating_mode(sc);
1245 		otus_set_rx_filter(sc);
1246 		break;
1247 	case IEEE80211_S_RUN:
1248 		if (ic->ic_opmode == IEEE80211_M_STA) {
1249 			otus_updateslot(sc);
1250 			otus_set_operating_mode(sc);
1251 			otus_set_rx_filter(sc);
1252 
1253 			/* Start calibration timer. */
1254 			taskqueue_enqueue_timeout(taskqueue_thread,
1255 			    &sc->calib_to, hz);
1256 		}
1257 		break;
1258 	default:
1259 		break;
1260 	}
1261 
1262 	/* XXX TODO: calibration? */
1263 
1264 	sc->sc_led_newstate(sc);
1265 
1266 	OTUS_UNLOCK(sc);
1267 	IEEE80211_LOCK(ic);
1268 	return (uvp->newstate(vap, nstate, arg));
1269 }
1270 
1271 int
1272 otus_cmd(struct otus_softc *sc, uint8_t code, const void *idata, int ilen,
1273     void *odata, int odatalen)
1274 {
1275 	struct otus_tx_cmd *cmd;
1276 	struct ar_cmd_hdr *hdr;
1277 	int xferlen, error;
1278 
1279 	OTUS_LOCK_ASSERT(sc);
1280 
1281 	/* Always bulk-out a multiple of 4 bytes. */
1282 	xferlen = (sizeof (*hdr) + ilen + 3) & ~3;
1283 	if (xferlen > OTUS_MAX_TXCMDSZ) {
1284 		device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n",
1285 		    __func__,
1286 		    code,
1287 		    xferlen,
1288 		    OTUS_MAX_TXCMDSZ);
1289 		return (EIO);
1290 	}
1291 
1292 	cmd = otus_get_txcmd(sc);
1293 	if (cmd == NULL) {
1294 		device_printf(sc->sc_dev, "%s: failed to get buf\n",
1295 		    __func__);
1296 		return (EIO);
1297 	}
1298 
1299 	hdr = (struct ar_cmd_hdr *)cmd->buf;
1300 	hdr->code  = code;
1301 	hdr->len   = ilen;
1302 	hdr->token = ++sc->token;	/* Don't care about endianness. */
1303 	cmd->token = hdr->token;
1304 	/* XXX TODO: check max cmd length? */
1305 	memcpy((uint8_t *)&hdr[1], idata, ilen);
1306 
1307 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
1308 	    "%s: sending command code=0x%02x len=%d token=%d\n",
1309 	    __func__, code, ilen, hdr->token);
1310 
1311 	cmd->odata = odata;
1312 	cmd->odatalen = odatalen;
1313 	cmd->buflen = xferlen;
1314 
1315 	/* Queue the command to the endpoint */
1316 	STAILQ_INSERT_TAIL(&sc->sc_cmd_pending, cmd, next_cmd);
1317 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_CMD]);
1318 
1319 	/* Sleep on the command; wait for it to complete */
1320 	error = msleep(cmd, &sc->sc_mtx, PCATCH, "otuscmd", hz);
1321 
1322 	/*
1323 	 * At this point we don't own cmd any longer; it'll be
1324 	 * freed by the cmd bulk path or the RX notification
1325 	 * path.  If the data is made available then it'll be copied
1326 	 * to the caller.  All that is left to do is communicate
1327 	 * status back to the caller.
1328 	 */
1329 	if (error != 0) {
1330 		device_printf(sc->sc_dev,
1331 		    "%s: timeout waiting for command 0x%02x reply\n",
1332 		    __func__, code);
1333 	}
1334 	return error;
1335 }
1336 
1337 void
1338 otus_write(struct otus_softc *sc, uint32_t reg, uint32_t val)
1339 {
1340 
1341 	OTUS_LOCK_ASSERT(sc);
1342 
1343 	sc->write_buf[sc->write_idx].reg = htole32(reg);
1344 	sc->write_buf[sc->write_idx].val = htole32(val);
1345 
1346 	if (++sc->write_idx > (AR_MAX_WRITE_IDX-1))
1347 		(void)otus_write_barrier(sc);
1348 }
1349 
1350 int
1351 otus_write_barrier(struct otus_softc *sc)
1352 {
1353 	int error;
1354 
1355 	OTUS_LOCK_ASSERT(sc);
1356 
1357 	if (sc->write_idx == 0)
1358 		return 0;	/* Nothing to flush. */
1359 
1360 	OTUS_DPRINTF(sc, OTUS_DEBUG_REGIO, "%s: called; %d updates\n",
1361 	    __func__,
1362 	    sc->write_idx);
1363 
1364 	error = otus_cmd(sc, AR_CMD_WREG, sc->write_buf,
1365 	    sizeof (sc->write_buf[0]) * sc->write_idx, NULL, 0);
1366 	sc->write_idx = 0;
1367 	return error;
1368 }
1369 
1370 static struct ieee80211_node *
1371 otus_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
1372 {
1373 
1374 	return malloc(sizeof (struct otus_node), M_80211_NODE,
1375 	    M_NOWAIT | M_ZERO);
1376 }
1377 
1378 #if 0
1379 int
1380 otus_media_change(struct ifnet *ifp)
1381 {
1382 	struct otus_softc *sc = ifp->if_softc;
1383 	struct ieee80211com *ic = &sc->sc_ic;
1384 	uint8_t rate, ridx;
1385 	int error;
1386 
1387 	error = ieee80211_media_change(ifp);
1388 	if (error != ENETRESET)
1389 		return error;
1390 
1391 	if (ic->ic_fixed_rate != -1) {
1392 		rate = ic->ic_sup_rates[ic->ic_curmode].
1393 		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
1394 		for (ridx = 0; ridx <= OTUS_RIDX_MAX; ridx++)
1395 			if (otus_rates[ridx].rate == rate)
1396 				break;
1397 		sc->fixed_ridx = ridx;
1398 	}
1399 
1400 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
1401 		error = otus_init(sc);
1402 
1403 	return error;
1404 }
1405 #endif
1406 
1407 int
1408 otus_read_eeprom(struct otus_softc *sc)
1409 {
1410 	uint32_t regs[8], reg;
1411 	uint8_t *eep;
1412 	int i, j, error;
1413 
1414 	OTUS_LOCK_ASSERT(sc);
1415 
1416 	/* Read EEPROM by blocks of 32 bytes. */
1417 	eep = (uint8_t *)&sc->eeprom;
1418 	reg = AR_EEPROM_OFFSET;
1419 	for (i = 0; i < sizeof (sc->eeprom) / 32; i++) {
1420 		for (j = 0; j < 8; j++, reg += 4)
1421 			regs[j] = htole32(reg);
1422 		error = otus_cmd(sc, AR_CMD_RREG, regs, sizeof regs, eep, 32);
1423 		if (error != 0)
1424 			break;
1425 		eep += 32;
1426 	}
1427 	return error;
1428 }
1429 
1430 void
1431 otus_newassoc(struct ieee80211_node *ni, int isnew)
1432 {
1433 	struct ieee80211com *ic = ni->ni_ic;
1434 	struct otus_softc *sc = ic->ic_softc;
1435 	struct otus_node *on = OTUS_NODE(ni);
1436 
1437 	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "new assoc isnew=%d addr=%s\n",
1438 	    isnew, ether_sprintf(ni->ni_macaddr));
1439 
1440 	on->tx_done = 0;
1441 	on->tx_err = 0;
1442 	on->tx_retries = 0;
1443 }
1444 
1445 static void
1446 otus_cmd_handle_response(struct otus_softc *sc, struct ar_cmd_hdr *hdr)
1447 {
1448 	struct otus_tx_cmd *cmd;
1449 
1450 	OTUS_LOCK_ASSERT(sc);
1451 
1452 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1453 	    "%s: received reply code=0x%02x len=%d token=%d\n",
1454 	    __func__,
1455 	    hdr->code, hdr->len, hdr->token);
1456 
1457 	/*
1458 	 * Walk the list, freeing items that aren't ours,
1459 	 * stopping when we hit our token.
1460 	 */
1461 	while ((cmd = STAILQ_FIRST(&sc->sc_cmd_waiting)) != NULL) {
1462 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_waiting, next_cmd);
1463 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1464 		    "%s: cmd=%p; hdr.token=%d, cmd.token=%d\n",
1465 		    __func__,
1466 		    cmd,
1467 		    (int) hdr->token,
1468 		    (int) cmd->token);
1469 		if (hdr->token == cmd->token) {
1470 			/* Copy answer into caller's supplied buffer. */
1471 			if (cmd->odata != NULL) {
1472 				if (hdr->len != cmd->odatalen) {
1473 					device_printf(sc->sc_dev,
1474 					    "%s: code 0x%02x, len=%d, olen=%d\n",
1475 					    __func__,
1476 					    (int) hdr->code,
1477 					    (int) hdr->len,
1478 					    (int) cmd->odatalen);
1479 				}
1480 				memcpy(cmd->odata, &hdr[1],
1481 				    MIN(cmd->odatalen, hdr->len));
1482 			}
1483 			wakeup(cmd);
1484 		}
1485 
1486 		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next_cmd);
1487 	}
1488 }
1489 
1490 void
1491 otus_cmd_rxeof(struct otus_softc *sc, uint8_t *buf, int len)
1492 {
1493 	struct ieee80211com *ic = &sc->sc_ic;
1494 	struct ar_cmd_hdr *hdr;
1495 
1496 	OTUS_LOCK_ASSERT(sc);
1497 
1498 	if (__predict_false(len < sizeof (*hdr))) {
1499 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1500 		    "cmd too small %d\n", len);
1501 		return;
1502 	}
1503 	hdr = (struct ar_cmd_hdr *)buf;
1504 	if (__predict_false(sizeof (*hdr) + hdr->len > len ||
1505 	    sizeof (*hdr) + hdr->len > 64)) {
1506 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1507 		    "cmd too large %d\n", hdr->len);
1508 		return;
1509 	}
1510 
1511 	OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1512 	    "%s: code=%.02x\n",
1513 	    __func__,
1514 	    hdr->code);
1515 
1516 	/*
1517 	 * This has to reach into the cmd queue "waiting for
1518 	 * an RX response" list, grab the head entry and check
1519 	 * if we need to wake anyone up.
1520 	 */
1521 	if ((hdr->code & 0xc0) != 0xc0) {
1522 		otus_cmd_handle_response(sc, hdr);
1523 		return;
1524 	}
1525 
1526 	/* Received unsolicited notification. */
1527 	switch (hdr->code & 0x3f) {
1528 	case AR_EVT_BEACON:
1529 		break;
1530 	case AR_EVT_TX_COMP:
1531 	{
1532 		struct ar_evt_tx_comp *tx = (struct ar_evt_tx_comp *)&hdr[1];
1533 		struct ieee80211_node *ni;
1534 
1535 		ni = ieee80211_find_node(&ic->ic_sta, tx->macaddr);
1536 		if (ni == NULL) {
1537 			device_printf(sc->sc_dev,
1538 			    "%s: txcomp on unknown node (%s)\n",
1539 			    __func__,
1540 			    ether_sprintf(tx->macaddr));
1541 			break;
1542 		}
1543 
1544 		OTUS_DPRINTF(sc, OTUS_DEBUG_TXCOMP,
1545 		    "tx completed %s status=%d phy=0x%x\n",
1546 		    ether_sprintf(tx->macaddr), le16toh(tx->status),
1547 		    le32toh(tx->phy));
1548 
1549 		switch (le16toh(tx->status)) {
1550 		case AR_TX_STATUS_COMP:
1551 #if 0
1552 			ackfailcnt = 0;
1553 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1554 			    IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
1555 #endif
1556 			/*
1557 			 * We don't get the above; only error notifications.
1558 			 * Sigh.  So, don't worry about this.
1559 			 */
1560 			break;
1561 		case AR_TX_STATUS_RETRY_COMP:
1562 			OTUS_NODE(ni)->tx_retries++;
1563 			break;
1564 		case AR_TX_STATUS_FAILED:
1565 			OTUS_NODE(ni)->tx_err++;
1566 			break;
1567 		}
1568 		ieee80211_free_node(ni);
1569 		break;
1570 	}
1571 	case AR_EVT_TBTT:
1572 		break;
1573 	case AR_EVT_DO_BB_RESET:
1574 		/*
1575 		 * This is "tell driver to reset baseband" from ar9170-fw.
1576 		 *
1577 		 * I'm not sure what we should do here, so I'm going to
1578 		 * fall through; it gets generated when RTSRetryCnt internally
1579 		 * reaches '5' - I guess the firmware authors thought that
1580 		 * meant that the BB may have gone deaf or something.
1581 		 */
1582 	default:
1583 		device_printf(sc->sc_dev,
1584 		    "%s: received notification code=0x%02x len=%d\n",
1585 		    __func__,
1586 		    hdr->code, hdr->len);
1587 	}
1588 }
1589 
1590 void
1591 otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len, struct mbufq *rxq)
1592 {
1593 	struct ieee80211com *ic = &sc->sc_ic;
1594 	struct ieee80211_rx_stats rxs;
1595 #if 0
1596 	struct ieee80211_node *ni;
1597 #endif
1598 	struct ar_rx_tail *tail;
1599 	struct ieee80211_frame *wh;
1600 	struct mbuf *m;
1601 	uint8_t *plcp;
1602 //	int s;
1603 	int mlen;
1604 
1605 	if (__predict_false(len < AR_PLCP_HDR_LEN)) {
1606 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1607 		    "sub-xfer too short %d\n", len);
1608 		return;
1609 	}
1610 	plcp = buf;
1611 
1612 	/* All bits in the PLCP header are set to 1 for non-MPDU. */
1613 	if (memcmp(plcp, AR_PLCP_HDR_INTR, AR_PLCP_HDR_LEN) == 0) {
1614 		otus_cmd_rxeof(sc, plcp + AR_PLCP_HDR_LEN,
1615 		    len - AR_PLCP_HDR_LEN);
1616 		return;
1617 	}
1618 
1619 	/* Received MPDU. */
1620 	if (__predict_false(len < AR_PLCP_HDR_LEN + sizeof (*tail))) {
1621 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "MPDU too short %d\n", len);
1622 		counter_u64_add(ic->ic_ierrors, 1);
1623 		return;
1624 	}
1625 	tail = (struct ar_rx_tail *)(plcp + len - sizeof (*tail));
1626 
1627 	/* Discard error frames; don't discard BAD_RA (eg monitor mode); let net80211 do that */
1628 	if (__predict_false((tail->error & ~AR_RX_ERROR_BAD_RA) != 0)) {
1629 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "error frame 0x%02x\n", tail->error);
1630 		if (tail->error & AR_RX_ERROR_FCS) {
1631 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "bad FCS\n");
1632 		} else if (tail->error & AR_RX_ERROR_MMIC) {
1633 			/* Report Michael MIC failures to net80211. */
1634 #if 0
1635 			ieee80211_notify_michael_failure(ni->ni_vap, wh, keyidx);
1636 #endif
1637 			device_printf(sc->sc_dev, "%s: MIC failure\n", __func__);
1638 		}
1639 		counter_u64_add(ic->ic_ierrors, 1);
1640 		return;
1641 	}
1642 	/* Compute MPDU's length. */
1643 	mlen = len - AR_PLCP_HDR_LEN - sizeof (*tail);
1644 	/* Make sure there's room for an 802.11 header + FCS. */
1645 	if (__predict_false(mlen < IEEE80211_MIN_LEN)) {
1646 		counter_u64_add(ic->ic_ierrors, 1);
1647 		return;
1648 	}
1649 	mlen -= IEEE80211_CRC_LEN;	/* strip 802.11 FCS */
1650 
1651 	wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN);
1652 
1653 	/*
1654 	 * TODO: I see > 2KiB buffers in this path; is it A-MSDU or something?
1655 	 */
1656 	m = m_get2(mlen, M_NOWAIT, MT_DATA, M_PKTHDR);
1657 	if (m == NULL) {
1658 		device_printf(sc->sc_dev, "%s: failed m_get2() (mlen=%d)\n", __func__, mlen);
1659 		counter_u64_add(ic->ic_ierrors, 1);
1660 		return;
1661 	}
1662 
1663 	/* Finalize mbuf. */
1664 	memcpy(mtod(m, uint8_t *), wh, mlen);
1665 	m->m_pkthdr.len = m->m_len = mlen;
1666 
1667 #if 0
1668 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1669 		struct otus_rx_radiotap_header *tap = &sc->sc_rxtap;
1670 		struct mbuf mb;
1671 
1672 		tap->wr_flags = 0;
1673 		tap->wr_antsignal = tail->rssi;
1674 		tap->wr_rate = 2;	/* In case it can't be found below. */
1675 		switch (tail->status & AR_RX_STATUS_MT_MASK) {
1676 		case AR_RX_STATUS_MT_CCK:
1677 			switch (plcp[0]) {
1678 			case  10: tap->wr_rate =   2; break;
1679 			case  20: tap->wr_rate =   4; break;
1680 			case  55: tap->wr_rate =  11; break;
1681 			case 110: tap->wr_rate =  22; break;
1682 			}
1683 			if (tail->status & AR_RX_STATUS_SHPREAMBLE)
1684 				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1685 			break;
1686 		case AR_RX_STATUS_MT_OFDM:
1687 			switch (plcp[0] & 0xf) {
1688 			case 0xb: tap->wr_rate =  12; break;
1689 			case 0xf: tap->wr_rate =  18; break;
1690 			case 0xa: tap->wr_rate =  24; break;
1691 			case 0xe: tap->wr_rate =  36; break;
1692 			case 0x9: tap->wr_rate =  48; break;
1693 			case 0xd: tap->wr_rate =  72; break;
1694 			case 0x8: tap->wr_rate =  96; break;
1695 			case 0xc: tap->wr_rate = 108; break;
1696 			}
1697 			break;
1698 		}
1699 		mb.m_data = (caddr_t)tap;
1700 		mb.m_next = m;
1701 		mb.m_nextpkt = NULL;
1702 		mb.m_type = 0;
1703 		mb.m_flags = 0;
1704 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1705 	}
1706 #endif
1707 
1708 	/* Add RSSI/NF to this mbuf */
1709 	bzero(&rxs, sizeof(rxs));
1710 	rxs.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
1711 	rxs.c_nf = sc->sc_nf[0];	/* XXX chain 0 != combined rssi/nf */
1712 	rxs.c_rssi = tail->rssi;
1713 	/* XXX TODO: add MIMO RSSI/NF as well */
1714 	if (ieee80211_add_rx_params(m, &rxs) == 0) {
1715 		counter_u64_add(ic->ic_ierrors, 1);
1716 		return;
1717 	}
1718 
1719 	/* XXX make a method */
1720 	STAILQ_INSERT_TAIL(&rxq->mq_head, m, m_stailqpkt);
1721 
1722 #if 0
1723 	OTUS_UNLOCK(sc);
1724 	ni = ieee80211_find_rxnode(ic, wh);
1725 	rxi.rxi_flags = 0;
1726 	rxi.rxi_rssi = tail->rssi;
1727 	rxi.rxi_tstamp = 0;	/* unused */
1728 	ieee80211_input(ifp, m, ni, &rxi);
1729 
1730 	/* Node is no longer needed. */
1731 	ieee80211_release_node(ic, ni);
1732 	OTUS_LOCK(sc);
1733 #endif
1734 }
1735 
1736 static void
1737 otus_rxeof(struct usb_xfer *xfer, struct otus_data *data, struct mbufq *rxq)
1738 {
1739 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1740 	caddr_t buf = data->buf;
1741 	struct ar_rx_head *head;
1742 	uint16_t hlen;
1743 	int len;
1744 
1745 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
1746 
1747 	while (len >= sizeof (*head)) {
1748 		head = (struct ar_rx_head *)buf;
1749 		if (__predict_false(head->tag != htole16(AR_RX_HEAD_TAG))) {
1750 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1751 			    "tag not valid 0x%x\n", le16toh(head->tag));
1752 			break;
1753 		}
1754 		hlen = le16toh(head->len);
1755 		if (__predict_false(sizeof (*head) + hlen > len)) {
1756 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1757 			    "xfer too short %d/%d\n", len, hlen);
1758 			break;
1759 		}
1760 		/* Process sub-xfer. */
1761 		otus_sub_rxeof(sc, (uint8_t *)&head[1], hlen, rxq);
1762 
1763 		/* Next sub-xfer is aligned on a 32-bit boundary. */
1764 		hlen = (sizeof (*head) + hlen + 3) & ~3;
1765 		buf += hlen;
1766 		len -= hlen;
1767 	}
1768 }
1769 
1770 static void
1771 otus_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1772 {
1773 	struct epoch_tracker et;
1774 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1775 	struct ieee80211com *ic = &sc->sc_ic;
1776 	struct ieee80211_frame *wh;
1777 	struct ieee80211_node *ni;
1778 	struct mbuf *m;
1779 	struct mbufq scrx;
1780 	struct otus_data *data;
1781 
1782 	OTUS_LOCK_ASSERT(sc);
1783 
1784 	mbufq_init(&scrx, 1024);
1785 
1786 #if 0
1787 	device_printf(sc->sc_dev, "%s: called; state=%d; error=%d\n",
1788 	    __func__,
1789 	    USB_GET_STATE(xfer),
1790 	    error);
1791 #endif
1792 
1793 	switch (USB_GET_STATE(xfer)) {
1794 	case USB_ST_TRANSFERRED:
1795 		data = STAILQ_FIRST(&sc->sc_rx_active);
1796 		if (data == NULL)
1797 			goto tr_setup;
1798 		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1799 		otus_rxeof(xfer, data, &scrx);
1800 		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1801 		/* FALLTHROUGH */
1802 	case USB_ST_SETUP:
1803 tr_setup:
1804 		/*
1805 		 * XXX TODO: what if sc_rx isn't empty, but data
1806 		 * is empty?  Then we leak mbufs.
1807 		 */
1808 		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1809 		if (data == NULL) {
1810 			//KASSERT(m == NULL, ("mbuf isn't NULL"));
1811 			return;
1812 		}
1813 		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1814 		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1815 		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1816 		    usbd_xfer_max_len(xfer));
1817 		usbd_transfer_submit(xfer);
1818 		/*
1819 		 * To avoid LOR we should unlock our private mutex here to call
1820 		 * ieee80211_input() because here is at the end of a USB
1821 		 * callback and safe to unlock.
1822 		 */
1823 		OTUS_UNLOCK(sc);
1824 		NET_EPOCH_ENTER(et);
1825 		while ((m = mbufq_dequeue(&scrx)) != NULL) {
1826 			wh = mtod(m, struct ieee80211_frame *);
1827 			ni = ieee80211_find_rxnode(ic,
1828 			    (struct ieee80211_frame_min *)wh);
1829 			if (ni != NULL) {
1830 				if (ni->ni_flags & IEEE80211_NODE_HT)
1831 					m->m_flags |= M_AMPDU;
1832 				(void)ieee80211_input_mimo(ni, m);
1833 				ieee80211_free_node(ni);
1834 			} else
1835 				(void)ieee80211_input_mimo_all(ic, m);
1836 		}
1837 		NET_EPOCH_EXIT(et);
1838 #ifdef	IEEE80211_SUPPORT_SUPERG
1839 		ieee80211_ff_age_all(ic, 100);
1840 #endif
1841 		OTUS_LOCK(sc);
1842 		break;
1843 	default:
1844 		/* needs it to the inactive queue due to a error. */
1845 		data = STAILQ_FIRST(&sc->sc_rx_active);
1846 		if (data != NULL) {
1847 			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1848 			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1849 		}
1850 		if (error != USB_ERR_CANCELLED) {
1851 			usbd_xfer_set_stall(xfer);
1852 			counter_u64_add(ic->ic_ierrors, 1);
1853 			goto tr_setup;
1854 		}
1855 		break;
1856 	}
1857 }
1858 
1859 static void
1860 otus_txeof(struct usb_xfer *xfer, struct otus_data *data)
1861 {
1862 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1863 
1864 	OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1865 	    "%s: called; data=%p\n", __func__, data);
1866 
1867 	OTUS_LOCK_ASSERT(sc);
1868 
1869 	if (sc->sc_tx_n_active == 0) {
1870 		device_printf(sc->sc_dev,
1871 		    "%s: completed but tx_active=0\n",
1872 		    __func__);
1873 	} else {
1874 		sc->sc_tx_n_active--;
1875 	}
1876 
1877 	if (data->m) {
1878 		/* XXX status? */
1879 		/* XXX we get TX status via the RX path.. */
1880 		ieee80211_tx_complete(data->ni, data->m, 0);
1881 		data->m = NULL;
1882 		data->ni = NULL;
1883 	}
1884 }
1885 
1886 static void
1887 otus_txcmdeof(struct usb_xfer *xfer, struct otus_tx_cmd *cmd)
1888 {
1889 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1890 
1891 	OTUS_LOCK_ASSERT(sc);
1892 
1893 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1894 	    "%s: called; data=%p; odata=%p\n",
1895 	    __func__, cmd, cmd->odata);
1896 
1897 	/*
1898 	 * Non-response commands still need wakeup so the caller
1899 	 * knows it was submitted and completed OK; response commands should
1900 	 * wait until they're ACKed by the firmware with a response.
1901 	 */
1902 	if (cmd->odata) {
1903 		STAILQ_INSERT_TAIL(&sc->sc_cmd_waiting, cmd, next_cmd);
1904 	} else {
1905 		wakeup(cmd);
1906 		otus_free_txcmd(sc, cmd);
1907 	}
1908 }
1909 
1910 static void
1911 otus_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1912 {
1913 	uint8_t which = OTUS_BULK_TX;
1914 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1915 	struct ieee80211com *ic = &sc->sc_ic;
1916 	struct otus_data *data;
1917 
1918 	OTUS_LOCK_ASSERT(sc);
1919 
1920 	switch (USB_GET_STATE(xfer)) {
1921 	case USB_ST_TRANSFERRED:
1922 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1923 		if (data == NULL)
1924 			goto tr_setup;
1925 		OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1926 		    "%s: transfer done %p\n", __func__, data);
1927 		STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1928 		otus_txeof(xfer, data);
1929 		otus_freebuf(sc, data);
1930 		/* FALLTHROUGH */
1931 	case USB_ST_SETUP:
1932 tr_setup:
1933 		data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
1934 		if (data == NULL) {
1935 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1936 			    "%s: empty pending queue sc %p\n", __func__, sc);
1937 			sc->sc_tx_n_active = 0;
1938 			goto finish;
1939 		}
1940 		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
1941 		STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
1942 		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1943 		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1944 		    "%s: submitting transfer %p\n", __func__, data);
1945 		usbd_transfer_submit(xfer);
1946 		sc->sc_tx_n_active++;
1947 		break;
1948 	default:
1949 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1950 		if (data != NULL) {
1951 			STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1952 			otus_txeof(xfer, data);
1953 			otus_freebuf(sc, data);
1954 		}
1955 		counter_u64_add(ic->ic_oerrors, 1);
1956 
1957 		if (error != USB_ERR_CANCELLED) {
1958 			usbd_xfer_set_stall(xfer);
1959 			goto tr_setup;
1960 		}
1961 		break;
1962 	}
1963 
1964 finish:
1965 #ifdef	IEEE80211_SUPPORT_SUPERG
1966 	/*
1967 	 * If the TX active queue drops below a certain
1968 	 * threshold, ensure we age fast-frames out so they're
1969 	 * transmitted.
1970 	 */
1971 	if (sc->sc_tx_n_active < 2) {
1972 		/* XXX ew - net80211 should defer this for us! */
1973 		OTUS_UNLOCK(sc);
1974 		ieee80211_ff_flush(ic, WME_AC_VO);
1975 		ieee80211_ff_flush(ic, WME_AC_VI);
1976 		ieee80211_ff_flush(ic, WME_AC_BE);
1977 		ieee80211_ff_flush(ic, WME_AC_BK);
1978 		OTUS_LOCK(sc);
1979 	}
1980 #endif
1981 	/* Kick TX */
1982 	otus_tx_start(sc);
1983 }
1984 
1985 static void
1986 otus_bulk_cmd_callback(struct usb_xfer *xfer, usb_error_t error)
1987 {
1988 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1989 #if 0
1990 	struct ieee80211com *ic = &sc->sc_ic;
1991 #endif
1992 	struct otus_tx_cmd *cmd;
1993 
1994 	OTUS_LOCK_ASSERT(sc);
1995 
1996 	switch (USB_GET_STATE(xfer)) {
1997 	case USB_ST_TRANSFERRED:
1998 		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
1999 		if (cmd == NULL)
2000 			goto tr_setup;
2001 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
2002 		    "%s: transfer done %p\n", __func__, cmd);
2003 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2004 		otus_txcmdeof(xfer, cmd);
2005 		/* FALLTHROUGH */
2006 	case USB_ST_SETUP:
2007 tr_setup:
2008 		cmd = STAILQ_FIRST(&sc->sc_cmd_pending);
2009 		if (cmd == NULL) {
2010 			OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2011 			    "%s: empty pending queue sc %p\n", __func__, sc);
2012 			return;
2013 		}
2014 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_pending, next_cmd);
2015 		STAILQ_INSERT_TAIL(&sc->sc_cmd_active, cmd, next_cmd);
2016 		usbd_xfer_set_frame_data(xfer, 0, cmd->buf, cmd->buflen);
2017 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2018 		    "%s: submitting transfer %p; buf=%p, buflen=%d\n", __func__, cmd, cmd->buf, cmd->buflen);
2019 		usbd_transfer_submit(xfer);
2020 		break;
2021 	default:
2022 		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2023 		if (cmd != NULL) {
2024 			STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2025 			otus_txcmdeof(xfer, cmd);
2026 		}
2027 
2028 		if (error != USB_ERR_CANCELLED) {
2029 			usbd_xfer_set_stall(xfer);
2030 			goto tr_setup;
2031 		}
2032 		break;
2033 	}
2034 }
2035 
2036 /*
2037  * This isn't used by carl9170; it however may be used by the
2038  * initial bootloader.
2039  */
2040 static void
2041 otus_bulk_irq_callback(struct usb_xfer *xfer, usb_error_t error)
2042 {
2043 	struct otus_softc *sc = usbd_xfer_softc(xfer);
2044 	int actlen;
2045 	int sumlen;
2046 
2047 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
2048 	OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2049 	    "%s: called; state=%d\n", __func__, USB_GET_STATE(xfer));
2050 
2051 	switch (USB_GET_STATE(xfer)) {
2052 	case USB_ST_TRANSFERRED:
2053 		/*
2054 		 * Read usb frame data, if any.
2055 		 * "actlen" has the total length for all frames
2056 		 * transferred.
2057 		 */
2058 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2059 		    "%s: comp; %d bytes\n",
2060 		    __func__,
2061 		    actlen);
2062 #if 0
2063 		pc = usbd_xfer_get_frame(xfer, 0);
2064 		otus_dump_usb_rx_page(sc, pc, actlen);
2065 #endif
2066 		/* XXX fallthrough */
2067 	case USB_ST_SETUP:
2068 		/*
2069 		 * Setup xfer frame lengths/count and data
2070 		 */
2071 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: setup\n", __func__);
2072 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2073 		usbd_transfer_submit(xfer);
2074 		break;
2075 
2076 	default: /* Error */
2077 		/*
2078 		 * Print error message and clear stall
2079 		 * for example.
2080 		 */
2081 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: ERROR?\n", __func__);
2082 		break;
2083 	}
2084 }
2085 
2086 /*
2087  * Map net80211 rate to hw rate for otus MAC/PHY.
2088  */
2089 static uint8_t
2090 otus_rate_to_hw_rate(struct otus_softc *sc, uint8_t rate)
2091 {
2092 	int is_2ghz;
2093 
2094 	is_2ghz = !! (IEEE80211_IS_CHAN_2GHZ(sc->sc_ic.ic_curchan));
2095 
2096 	switch (rate) {
2097 	/* CCK */
2098 	case 2:
2099 		return (0x0);
2100 	case 4:
2101 		return (0x1);
2102 	case 11:
2103 		return (0x2);
2104 	case 22:
2105 		return (0x3);
2106 	/* OFDM */
2107 	case 12:
2108 		return (0xb);
2109 	case 18:
2110 		return (0xf);
2111 	case 24:
2112 		return (0xa);
2113 	case 36:
2114 		return (0xe);
2115 	case 48:
2116 		return (0x9);
2117 	case 72:
2118 		return (0xd);
2119 	case 96:
2120 		return (0x8);
2121 	case 108:
2122 		return (0xc);
2123 	default:
2124 		device_printf(sc->sc_dev, "%s: unknown rate '%d'\n",
2125 		    __func__, (int) rate);
2126 	case 0:
2127 		if (is_2ghz)
2128 			return (0x0);	/* 1MB CCK */
2129 		else
2130 			return (0xb);	/* 6MB OFDM */
2131 
2132 	/* XXX TODO: HT */
2133 	}
2134 }
2135 
2136 static int
2137 otus_hw_rate_is_ofdm(struct otus_softc *sc, uint8_t hw_rate)
2138 {
2139 
2140 	switch (hw_rate) {
2141 	case 0x0:
2142 	case 0x1:
2143 	case 0x2:
2144 	case 0x3:
2145 		return (0);
2146 	default:
2147 		return (1);
2148 	}
2149 }
2150 
2151 
2152 static void
2153 otus_tx_update_ratectl(struct otus_softc *sc, struct ieee80211_node *ni)
2154 {
2155 	struct ieee80211_ratectl_tx_stats *txs = &sc->sc_txs;
2156 	struct otus_node *on = OTUS_NODE(ni);
2157 
2158 	txs->flags = IEEE80211_RATECTL_TX_STATS_NODE |
2159 		     IEEE80211_RATECTL_TX_STATS_RETRIES;
2160 	txs->ni = ni;
2161 	txs->nframes = on->tx_done;
2162 	txs->nsuccess = on->tx_done - on->tx_err;
2163 	txs->nretries = on->tx_retries;
2164 
2165 	ieee80211_ratectl_tx_update(ni->ni_vap, txs);
2166 	on->tx_done = on->tx_err = on->tx_retries = 0;
2167 }
2168 
2169 /*
2170  * XXX TODO: support tx bpf parameters for configuration!
2171  *
2172  * Relevant pieces:
2173  *
2174  * ac = params->ibp_pri & 3;
2175  * rate = params->ibp_rate0;
2176  * params->ibp_flags & IEEE80211_BPF_NOACK
2177  * params->ibp_flags & IEEE80211_BPF_RTS
2178  * params->ibp_flags & IEEE80211_BPF_CTS
2179  * tx->rts_ntries = params->ibp_try1;
2180  * tx->data_ntries = params->ibp_try0;
2181  */
2182 static int
2183 otus_tx(struct otus_softc *sc, struct ieee80211_node *ni, struct mbuf *m,
2184     struct otus_data *data, const struct ieee80211_bpf_params *params)
2185 {
2186 	const struct ieee80211_txparam *tp = ni->ni_txparms;
2187 	struct ieee80211com *ic = &sc->sc_ic;
2188 	struct ieee80211vap *vap = ni->ni_vap;
2189 	struct ieee80211_frame *wh;
2190 	struct ieee80211_key *k;
2191 	struct ar_tx_head *head;
2192 	uint32_t phyctl;
2193 	uint16_t macctl, qos;
2194 	uint8_t qid, rate;
2195 	int hasqos, xferlen, type, ismcast;
2196 
2197 	wh = mtod(m, struct ieee80211_frame *);
2198 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2199 		k = ieee80211_crypto_encap(ni, m);
2200 		if (k == NULL) {
2201 			device_printf(sc->sc_dev,
2202 			    "%s: m=%p: ieee80211_crypto_encap returns NULL\n",
2203 			    __func__,
2204 			    m);
2205 			return (ENOBUFS);
2206 		}
2207 		wh = mtod(m, struct ieee80211_frame *);
2208 	}
2209 
2210 	/* Calculate transfer length; ensure data buffer is large enough */
2211 	xferlen = sizeof (*head) + m->m_pkthdr.len;
2212 	if (xferlen > OTUS_TXBUFSZ) {
2213 		device_printf(sc->sc_dev,
2214 		    "%s: 802.11 TX frame is %d bytes, max %d bytes\n",
2215 		    __func__,
2216 		    xferlen,
2217 		    OTUS_TXBUFSZ);
2218 		return (ENOBUFS);
2219 	}
2220 
2221 	hasqos = !! IEEE80211_QOS_HAS_SEQ(wh);
2222 
2223 	if (hasqos) {
2224 		uint8_t tid;
2225 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2226 		tid = qos & IEEE80211_QOS_TID;
2227 		qid = TID_TO_WME_AC(tid);
2228 	} else {
2229 		qos = 0;
2230 		qid = WME_AC_BE;
2231 	}
2232 
2233 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2234 	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2235 
2236 	/* Pickup a rate index. */
2237 	if (params != NULL)
2238 		rate = otus_rate_to_hw_rate(sc, params->ibp_rate0);
2239 	else if (!!(m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
2240 		rate = otus_rate_to_hw_rate(sc, tp->mgmtrate);
2241 	else if (ismcast)
2242 		rate = otus_rate_to_hw_rate(sc, tp->mcastrate);
2243 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2244 		rate = otus_rate_to_hw_rate(sc, tp->ucastrate);
2245 	else {
2246 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
2247 		rate = otus_rate_to_hw_rate(sc, ni->ni_txrate);
2248 	}
2249 
2250 	phyctl = 0;
2251 	macctl = AR_TX_MAC_BACKOFF | AR_TX_MAC_HW_DUR | AR_TX_MAC_QID(qid);
2252 
2253 	/*
2254 	 * XXX TODO: params for NOACK, ACK, RTS, CTS, etc
2255 	 */
2256 	if (ismcast ||
2257 	    (hasqos && ((qos & IEEE80211_QOS_ACKPOLICY) ==
2258 	     IEEE80211_QOS_ACKPOLICY_NOACK)))
2259 		macctl |= AR_TX_MAC_NOACK;
2260 
2261 	if (!ismcast) {
2262 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN >= vap->iv_rtsthreshold)
2263 			macctl |= AR_TX_MAC_RTS;
2264 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2265 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2266 				macctl |= AR_TX_MAC_CTS;
2267 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2268 				macctl |= AR_TX_MAC_RTS;
2269 		}
2270 	}
2271 
2272 	phyctl |= AR_TX_PHY_MCS(rate);
2273 	if (otus_hw_rate_is_ofdm(sc, rate)) {
2274 		phyctl |= AR_TX_PHY_MT_OFDM;
2275 		/* Always use all tx antennas for now, just to be safe */
2276 		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2277 	} else {	/* CCK */
2278 		phyctl |= AR_TX_PHY_MT_CCK;
2279 		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2280 	}
2281 
2282 	/* Update net80211 with the current counters */
2283 	otus_tx_update_ratectl(sc, ni);
2284 
2285 	/* Update rate control stats for frames that are ACK'ed. */
2286 	if (!(macctl & AR_TX_MAC_NOACK))
2287 		OTUS_NODE(ni)->tx_done++;
2288 
2289 
2290 	/* Fill Tx descriptor. */
2291 	head = (struct ar_tx_head *)data->buf;
2292 	head->len = htole16(m->m_pkthdr.len + IEEE80211_CRC_LEN);
2293 	head->macctl = htole16(macctl);
2294 	head->phyctl = htole32(phyctl);
2295 
2296 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&head[1]);
2297 
2298 	data->buflen = xferlen;
2299 	data->ni = ni;
2300 	data->m = m;
2301 
2302 	OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
2303 	    "%s: tx: m=%p; data=%p; len=%d mac=0x%04x phy=0x%08x rate=0x%02x, ni_txrate=%d\n",
2304 	    __func__, m, data, le16toh(head->len), macctl, phyctl,
2305 	    (int) rate, (int) ni->ni_txrate);
2306 
2307 	/* Submit transfer */
2308 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending[OTUS_BULK_TX], data, next);
2309 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_TX]);
2310 
2311 	return 0;
2312 }
2313 
2314 static u_int
2315 otus_hash_maddr(void *arg, struct sockaddr_dl *sdl, u_int cnt)
2316 {
2317 	uint32_t val, *hashes = arg;
2318 
2319 	val = le32dec(LLADDR(sdl) + 4);
2320 	/* Get address byte 5 */
2321 	val = val & 0x0000ff00;
2322 	val = val >> 8;
2323 
2324 	/* As per below, shift it >> 2 to get only 6 bits */
2325 	val = val >> 2;
2326 	if (val < 32)
2327 		hashes[0] |= 1 << val;
2328 	else
2329 		hashes[1] |= 1 << (val - 32);
2330 
2331 	return (1);
2332 }
2333 
2334 
2335 int
2336 otus_set_multi(struct otus_softc *sc)
2337 {
2338 	struct ieee80211com *ic = &sc->sc_ic;
2339 	uint32_t hashes[2];
2340 	int r;
2341 
2342 	if (ic->ic_allmulti > 0 || ic->ic_promisc > 0 ||
2343 	    ic->ic_opmode == IEEE80211_M_MONITOR) {
2344 		hashes[0] = 0xffffffff;
2345 		hashes[1] = 0xffffffff;
2346 	} else {
2347 		struct ieee80211vap *vap;
2348 
2349 		hashes[0] = hashes[1] = 0;
2350 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
2351 			if_foreach_llmaddr(vap->iv_ifp, otus_hash_maddr,
2352 			    hashes);
2353 	}
2354 #if 0
2355 	/* XXX openbsd code */
2356 	while (enm != NULL) {
2357 		bit = enm->enm_addrlo[5] >> 2;
2358 		if (bit < 32)
2359 			hashes[0] |= 1 << bit;
2360 		else
2361 			hashes[1] |= 1 << (bit - 32);
2362 		ETHER_NEXT_MULTI(step, enm);
2363 	}
2364 #endif
2365 
2366 	hashes[1] |= 1U << 31;	/* Make sure the broadcast bit is set. */
2367 
2368 	OTUS_LOCK(sc);
2369 	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_L, hashes[0]);
2370 	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_H, hashes[1]);
2371 	r = otus_write_barrier(sc);
2372 	/* XXX operating mode? filter? */
2373 	OTUS_UNLOCK(sc);
2374 	return (r);
2375 }
2376 
2377 static int
2378 otus_updateedca(struct ieee80211com *ic)
2379 {
2380 	struct otus_softc *sc = ic->ic_softc;
2381 
2382 	OTUS_LOCK(sc);
2383 	/*
2384 	 * XXX TODO: take temporary copy of EDCA information
2385 	 * when scheduling this so we have a more time-correct view
2386 	 * of things.
2387 	 * XXX TODO: this can be done on the net80211 level
2388 	 */
2389 	otus_updateedca_locked(sc);
2390 	OTUS_UNLOCK(sc);
2391 	return (0);
2392 }
2393 
2394 static void
2395 otus_updateedca_locked(struct otus_softc *sc)
2396 {
2397 #define EXP2(val)	((1 << (val)) - 1)
2398 #define AIFS(val)	((val) * 9 + 10)
2399 	struct chanAccParams chp;
2400 	struct ieee80211com *ic = &sc->sc_ic;
2401 	const struct wmeParams *edca;
2402 
2403 	ieee80211_wme_ic_getparams(ic, &chp);
2404 
2405 	OTUS_LOCK_ASSERT(sc);
2406 
2407 	edca = chp.cap_wmeParams;
2408 
2409 	/* Set CWmin/CWmax values. */
2410 	otus_write(sc, AR_MAC_REG_AC0_CW,
2411 	    EXP2(edca[WME_AC_BE].wmep_logcwmax) << 16 |
2412 	    EXP2(edca[WME_AC_BE].wmep_logcwmin));
2413 	otus_write(sc, AR_MAC_REG_AC1_CW,
2414 	    EXP2(edca[WME_AC_BK].wmep_logcwmax) << 16 |
2415 	    EXP2(edca[WME_AC_BK].wmep_logcwmin));
2416 	otus_write(sc, AR_MAC_REG_AC2_CW,
2417 	    EXP2(edca[WME_AC_VI].wmep_logcwmax) << 16 |
2418 	    EXP2(edca[WME_AC_VI].wmep_logcwmin));
2419 	otus_write(sc, AR_MAC_REG_AC3_CW,
2420 	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2421 	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2422 	otus_write(sc, AR_MAC_REG_AC4_CW,		/* Special TXQ. */
2423 	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2424 	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2425 
2426 	/* Set AIFSN values. */
2427 	otus_write(sc, AR_MAC_REG_AC1_AC0_AIFS,
2428 	    AIFS(edca[WME_AC_VI].wmep_aifsn) << 24 |
2429 	    AIFS(edca[WME_AC_BK].wmep_aifsn) << 12 |
2430 	    AIFS(edca[WME_AC_BE].wmep_aifsn));
2431 	otus_write(sc, AR_MAC_REG_AC3_AC2_AIFS,
2432 	    AIFS(edca[WME_AC_VO].wmep_aifsn) << 16 |	/* Special TXQ. */
2433 	    AIFS(edca[WME_AC_VO].wmep_aifsn) <<  4 |
2434 	    AIFS(edca[WME_AC_VI].wmep_aifsn) >>  8);
2435 
2436 	/* Set TXOP limit. */
2437 	otus_write(sc, AR_MAC_REG_AC1_AC0_TXOP,
2438 	    edca[WME_AC_BK].wmep_txopLimit << 16 |
2439 	    edca[WME_AC_BE].wmep_txopLimit);
2440 	otus_write(sc, AR_MAC_REG_AC3_AC2_TXOP,
2441 	    edca[WME_AC_VO].wmep_txopLimit << 16 |
2442 	    edca[WME_AC_VI].wmep_txopLimit);
2443 
2444 	/* XXX ACK policy? */
2445 
2446 	(void)otus_write_barrier(sc);
2447 
2448 #undef AIFS
2449 #undef EXP2
2450 }
2451 
2452 static void
2453 otus_updateslot(struct otus_softc *sc)
2454 {
2455 	struct ieee80211com *ic = &sc->sc_ic;
2456 	uint32_t slottime;
2457 
2458 	OTUS_LOCK_ASSERT(sc);
2459 
2460 	slottime = IEEE80211_GET_SLOTTIME(ic);
2461 	otus_write(sc, AR_MAC_REG_SLOT_TIME, slottime << 10);
2462 	(void)otus_write_barrier(sc);
2463 }
2464 
2465 int
2466 otus_init_mac(struct otus_softc *sc)
2467 {
2468 	int error;
2469 
2470 	OTUS_LOCK_ASSERT(sc);
2471 
2472 	otus_write(sc, AR_MAC_REG_ACK_EXTENSION, 0x40);
2473 	otus_write(sc, AR_MAC_REG_RETRY_MAX, 0);
2474 	otus_write(sc, AR_MAC_REG_RX_THRESHOLD, 0xc1f80);
2475 	otus_write(sc, AR_MAC_REG_RX_PE_DELAY, 0x70);
2476 	otus_write(sc, AR_MAC_REG_EIFS_AND_SIFS, 0xa144000);
2477 	otus_write(sc, AR_MAC_REG_SLOT_TIME, 9 << 10);
2478 	otus_write(sc, AR_MAC_REG_TID_CFACK_CFEND_RATE, 0x19000000);
2479 	/* NAV protects ACK only (in TXOP). */
2480 	otus_write(sc, AR_MAC_REG_TXOP_DURATION, 0x201);
2481 	/* Set beacon Tx power to 0x7. */
2482 	otus_write(sc, AR_MAC_REG_BCN_HT1, 0x8000170);
2483 	otus_write(sc, AR_MAC_REG_BACKOFF_PROTECT, 0x105);
2484 	otus_write(sc, AR_MAC_REG_AMPDU_FACTOR, 0x10000a);
2485 
2486 	otus_set_rx_filter(sc);
2487 
2488 	otus_write(sc, AR_MAC_REG_BASIC_RATE, 0x150f);
2489 	otus_write(sc, AR_MAC_REG_MANDATORY_RATE, 0x150f);
2490 	otus_write(sc, AR_MAC_REG_RTS_CTS_RATE, 0x10b01bb);
2491 	otus_write(sc, AR_MAC_REG_ACK_TPC, 0x4003c1e);
2492 
2493 	/* Enable LED0 and LED1. */
2494 	otus_write(sc, AR_GPIO_REG_PORT_TYPE, 0x3);
2495 	otus_write(sc, AR_GPIO_REG_PORT_DATA, 0x3);
2496 	/* Switch MAC to OTUS interface. */
2497 	otus_write(sc, 0x1c3600, 0x3);
2498 	otus_write(sc, AR_MAC_REG_AMPDU_RX_THRESH, 0xffff);
2499 	otus_write(sc, AR_MAC_REG_MISC_680, 0xf00008);
2500 	/* Disable Rx timeout (workaround). */
2501 	otus_write(sc, AR_MAC_REG_RX_TIMEOUT, 0);
2502 
2503 	/* Set USB Rx stream mode maximum frame number to 2. */
2504 	otus_write(sc, 0x1e1110, 0x4);
2505 	/* Set USB Rx stream mode timeout to 10us. */
2506 	otus_write(sc, 0x1e1114, 0x80);
2507 
2508 	/* Set clock frequency to 88/80MHz. */
2509 	otus_write(sc, AR_PWR_REG_CLOCK_SEL, 0x73);
2510 	/* Set WLAN DMA interrupt mode: generate intr per packet. */
2511 	otus_write(sc, AR_MAC_REG_TXRX_MPI, 0x110011);
2512 	otus_write(sc, AR_MAC_REG_FCS_SELECT, 0x4);
2513 	otus_write(sc, AR_MAC_REG_TXOP_NOT_ENOUGH_INDICATION, 0x141e0f48);
2514 
2515 	/* Disable HW decryption for now. */
2516 	otus_write(sc, AR_MAC_REG_ENCRYPTION, 0x78);
2517 
2518 	if ((error = otus_write_barrier(sc)) != 0)
2519 		return error;
2520 
2521 	/* Set default EDCA parameters. */
2522 	otus_updateedca_locked(sc);
2523 
2524 	return 0;
2525 }
2526 
2527 /*
2528  * Return default value for PHY register based on current operating mode.
2529  */
2530 uint32_t
2531 otus_phy_get_def(struct otus_softc *sc, uint32_t reg)
2532 {
2533 	int i;
2534 
2535 	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2536 		if (AR_PHY(ar5416_phy_regs[i]) == reg)
2537 			return sc->phy_vals[i];
2538 	return 0;	/* Register not found. */
2539 }
2540 
2541 /*
2542  * Update PHY's programming based on vendor-specific data stored in EEPROM.
2543  * This is for FEM-type devices only.
2544  */
2545 int
2546 otus_set_board_values(struct otus_softc *sc, struct ieee80211_channel *c)
2547 {
2548 	const struct ModalEepHeader *eep;
2549 	uint32_t tmp, offset;
2550 
2551 	if (IEEE80211_IS_CHAN_5GHZ(c))
2552 		eep = &sc->eeprom.modalHeader[0];
2553 	else
2554 		eep = &sc->eeprom.modalHeader[1];
2555 
2556 	/* Offset of chain 2. */
2557 	offset = 2 * 0x1000;
2558 
2559 	tmp = le32toh(eep->antCtrlCommon);
2560 	otus_write(sc, AR_PHY_SWITCH_COM, tmp);
2561 
2562 	tmp = le32toh(eep->antCtrlChain[0]);
2563 	otus_write(sc, AR_PHY_SWITCH_CHAIN_0, tmp);
2564 
2565 	tmp = le32toh(eep->antCtrlChain[1]);
2566 	otus_write(sc, AR_PHY_SWITCH_CHAIN_0 + offset, tmp);
2567 
2568 	if (1 /* sc->sc_sco == AR_SCO_SCN */) {
2569 		tmp = otus_phy_get_def(sc, AR_PHY_SETTLING);
2570 		tmp &= ~(0x7f << 7);
2571 		tmp |= (eep->switchSettling & 0x7f) << 7;
2572 		otus_write(sc, AR_PHY_SETTLING, tmp);
2573 	}
2574 
2575 	tmp = otus_phy_get_def(sc, AR_PHY_DESIRED_SZ);
2576 	tmp &= ~0xffff;
2577 	tmp |= eep->pgaDesiredSize << 8 | eep->adcDesiredSize;
2578 	otus_write(sc, AR_PHY_DESIRED_SZ, tmp);
2579 
2580 	tmp = eep->txEndToXpaOff << 24 | eep->txEndToXpaOff << 16 |
2581 	      eep->txFrameToXpaOn << 8 | eep->txFrameToXpaOn;
2582 	otus_write(sc, AR_PHY_RF_CTL4, tmp);
2583 
2584 	tmp = otus_phy_get_def(sc, AR_PHY_RF_CTL3);
2585 	tmp &= ~(0xff << 16);
2586 	tmp |= eep->txEndToRxOn << 16;
2587 	otus_write(sc, AR_PHY_RF_CTL3, tmp);
2588 
2589 	tmp = otus_phy_get_def(sc, AR_PHY_CCA);
2590 	tmp &= ~(0x7f << 12);
2591 	tmp |= (eep->thresh62 & 0x7f) << 12;
2592 	otus_write(sc, AR_PHY_CCA, tmp);
2593 
2594 	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN);
2595 	tmp &= ~(0x3f << 12);
2596 	tmp |= (eep->txRxAttenCh[0] & 0x3f) << 12;
2597 	otus_write(sc, AR_PHY_RXGAIN, tmp);
2598 
2599 	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN + offset);
2600 	tmp &= ~(0x3f << 12);
2601 	tmp |= (eep->txRxAttenCh[1] & 0x3f) << 12;
2602 	otus_write(sc, AR_PHY_RXGAIN + offset, tmp);
2603 
2604 	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ);
2605 	tmp &= ~(0x3f << 18);
2606 	tmp |= (eep->rxTxMarginCh[0] & 0x3f) << 18;
2607 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2608 		tmp &= ~(0xf << 10);
2609 		tmp |= (eep->bswMargin[0] & 0xf) << 10;
2610 	}
2611 	otus_write(sc, AR_PHY_GAIN_2GHZ, tmp);
2612 
2613 	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ + offset);
2614 	tmp &= ~(0x3f << 18);
2615 	tmp |= (eep->rxTxMarginCh[1] & 0x3f) << 18;
2616 	otus_write(sc, AR_PHY_GAIN_2GHZ + offset, tmp);
2617 
2618 	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4);
2619 	tmp &= ~(0x3f << 5 | 0x1f);
2620 	tmp |= (eep->iqCalICh[0] & 0x3f) << 5 | (eep->iqCalQCh[0] & 0x1f);
2621 	otus_write(sc, AR_PHY_TIMING_CTRL4, tmp);
2622 
2623 	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4 + offset);
2624 	tmp &= ~(0x3f << 5 | 0x1f);
2625 	tmp |= (eep->iqCalICh[1] & 0x3f) << 5 | (eep->iqCalQCh[1] & 0x1f);
2626 	otus_write(sc, AR_PHY_TIMING_CTRL4 + offset, tmp);
2627 
2628 	tmp = otus_phy_get_def(sc, AR_PHY_TPCRG1);
2629 	tmp &= ~(0xf << 16);
2630 	tmp |= (eep->xpd & 0xf) << 16;
2631 	otus_write(sc, AR_PHY_TPCRG1, tmp);
2632 
2633 	return otus_write_barrier(sc);
2634 }
2635 
2636 int
2637 otus_program_phy(struct otus_softc *sc, struct ieee80211_channel *c)
2638 {
2639 	const uint32_t *vals;
2640 	int error, i;
2641 
2642 	/* Select PHY programming based on band and bandwidth. */
2643 	if (IEEE80211_IS_CHAN_2GHZ(c))
2644 		vals = ar5416_phy_vals_2ghz_20mhz;
2645 	else
2646 		vals = ar5416_phy_vals_5ghz_20mhz;
2647 	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2648 		otus_write(sc, AR_PHY(ar5416_phy_regs[i]), vals[i]);
2649 	sc->phy_vals = vals;
2650 
2651 	if (sc->eeprom.baseEepHeader.deviceType == 0x80)	/* FEM */
2652 		if ((error = otus_set_board_values(sc, c)) != 0)
2653 			return error;
2654 
2655 	/* Initial Tx power settings. */
2656 	otus_write(sc, AR_PHY_POWER_TX_RATE_MAX, 0x7f);
2657 	otus_write(sc, AR_PHY_POWER_TX_RATE1, 0x3f3f3f3f);
2658 	otus_write(sc, AR_PHY_POWER_TX_RATE2, 0x3f3f3f3f);
2659 	otus_write(sc, AR_PHY_POWER_TX_RATE3, 0x3f3f3f3f);
2660 	otus_write(sc, AR_PHY_POWER_TX_RATE4, 0x3f3f3f3f);
2661 	otus_write(sc, AR_PHY_POWER_TX_RATE5, 0x3f3f3f3f);
2662 	otus_write(sc, AR_PHY_POWER_TX_RATE6, 0x3f3f3f3f);
2663 	otus_write(sc, AR_PHY_POWER_TX_RATE7, 0x3f3f3f3f);
2664 	otus_write(sc, AR_PHY_POWER_TX_RATE8, 0x3f3f3f3f);
2665 	otus_write(sc, AR_PHY_POWER_TX_RATE9, 0x3f3f3f3f);
2666 
2667 	if (IEEE80211_IS_CHAN_2GHZ(c))
2668 		otus_write(sc, AR_PWR_REG_PLL_ADDAC, 0x5163);
2669 	else
2670 		otus_write(sc, AR_PWR_REG_PLL_ADDAC, 0x5143);
2671 
2672 	return otus_write_barrier(sc);
2673 }
2674 
2675 static __inline uint8_t
2676 otus_reverse_bits(uint8_t v)
2677 {
2678 	v = ((v >> 1) & 0x55) | ((v & 0x55) << 1);
2679 	v = ((v >> 2) & 0x33) | ((v & 0x33) << 2);
2680 	v = ((v >> 4) & 0x0f) | ((v & 0x0f) << 4);
2681 	return v;
2682 }
2683 
2684 int
2685 otus_set_rf_bank4(struct otus_softc *sc, struct ieee80211_channel *c)
2686 {
2687 	uint8_t chansel, d0, d1;
2688 	uint16_t data;
2689 	int error;
2690 
2691 	OTUS_LOCK_ASSERT(sc);
2692 
2693 	d0 = 0;
2694 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2695 		chansel = (c->ic_freq - 4800) / 5;
2696 		if (chansel & 1)
2697 			d0 |= AR_BANK4_AMODE_REFSEL(2);
2698 		else
2699 			d0 |= AR_BANK4_AMODE_REFSEL(1);
2700 	} else {
2701 		d0 |= AR_BANK4_AMODE_REFSEL(2);
2702 		if (c->ic_freq == 2484) {	/* CH 14 */
2703 			d0 |= AR_BANK4_BMODE_LF_SYNTH_FREQ;
2704 			chansel = 10 + (c->ic_freq - 2274) / 5;
2705 		} else
2706 			chansel = 16 + (c->ic_freq - 2272) / 5;
2707 		chansel <<= 2;
2708 	}
2709 	d0 |= AR_BANK4_ADDR(1) | AR_BANK4_CHUP;
2710 	d1 = otus_reverse_bits(chansel);
2711 
2712 	/* Write bits 0-4 of d0 and d1. */
2713 	data = (d1 & 0x1f) << 5 | (d0 & 0x1f);
2714 	otus_write(sc, AR_PHY(44), data);
2715 	/* Write bits 5-7 of d0 and d1. */
2716 	data = (d1 >> 5) << 5 | (d0 >> 5);
2717 	otus_write(sc, AR_PHY(58), data);
2718 
2719 	if ((error = otus_write_barrier(sc)) == 0)
2720 		otus_delay_ms(sc, 10);
2721 	return error;
2722 }
2723 
2724 void
2725 otus_get_delta_slope(uint32_t coeff, uint32_t *exponent, uint32_t *mantissa)
2726 {
2727 #define COEFF_SCALE_SHIFT	24
2728 	uint32_t exp, man;
2729 
2730 	/* exponent = 14 - floor(log2(coeff)) */
2731 	for (exp = 31; exp > 0; exp--)
2732 		if (coeff & (1 << exp))
2733 			break;
2734 	KASSERT(exp != 0, ("exp"));
2735 	exp = 14 - (exp - COEFF_SCALE_SHIFT);
2736 
2737 	/* mantissa = floor(coeff * 2^exponent + 0.5) */
2738 	man = coeff + (1 << (COEFF_SCALE_SHIFT - exp - 1));
2739 
2740 	*mantissa = man >> (COEFF_SCALE_SHIFT - exp);
2741 	*exponent = exp - 16;
2742 #undef COEFF_SCALE_SHIFT
2743 }
2744 
2745 static int
2746 otus_set_chan(struct otus_softc *sc, struct ieee80211_channel *c, int assoc)
2747 {
2748 	struct ieee80211com *ic = &sc->sc_ic;
2749 	struct ar_cmd_frequency cmd;
2750 	struct ar_rsp_frequency rsp;
2751 	const uint32_t *vals;
2752 	uint32_t coeff, exp, man, tmp;
2753 	uint8_t code;
2754 	int error, chan, i;
2755 
2756 	error = 0;
2757 	chan = ieee80211_chan2ieee(ic, c);
2758 
2759 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2760 	    "setting channel %d (%dMHz)\n", chan, c->ic_freq);
2761 
2762 	tmp = IEEE80211_IS_CHAN_2GHZ(c) ? 0x105 : 0x104;
2763 	otus_write(sc, AR_MAC_REG_DYNAMIC_SIFS_ACK, tmp);
2764 	if ((error = otus_write_barrier(sc)) != 0)
2765 		goto finish;
2766 
2767 	/* Disable BB Heavy Clip. */
2768 	otus_write(sc, AR_PHY_HEAVY_CLIP_ENABLE, 0x200);
2769 	if ((error = otus_write_barrier(sc)) != 0)
2770 		goto finish;
2771 
2772 	/* XXX Is that FREQ_START ? */
2773 	error = otus_cmd(sc, AR_CMD_FREQ_STRAT, NULL, 0, NULL, 0);
2774 	if (error != 0)
2775 		goto finish;
2776 
2777 	/* Reprogram PHY and RF on channel band or bandwidth changes. */
2778 	if (sc->bb_reset || c->ic_flags != sc->sc_curchan->ic_flags) {
2779 		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "band switch\n");
2780 
2781 		/* Cold/Warm reset BB/ADDA. */
2782 		otus_write(sc, AR_PWR_REG_RESET, sc->bb_reset ? 0x800 : 0x400);
2783 		if ((error = otus_write_barrier(sc)) != 0)
2784 			goto finish;
2785 		otus_write(sc, AR_PWR_REG_RESET, 0);
2786 		if ((error = otus_write_barrier(sc)) != 0)
2787 			goto finish;
2788 		sc->bb_reset = 0;
2789 
2790 		if ((error = otus_program_phy(sc, c)) != 0) {
2791 			device_printf(sc->sc_dev,
2792 			    "%s: could not program PHY\n",
2793 			    __func__);
2794 			goto finish;
2795 		}
2796 
2797 		/* Select RF programming based on band. */
2798 		if (IEEE80211_IS_CHAN_5GHZ(c))
2799 			vals = ar5416_banks_vals_5ghz;
2800 		else
2801 			vals = ar5416_banks_vals_2ghz;
2802 		for (i = 0; i < nitems(ar5416_banks_regs); i++)
2803 			otus_write(sc, AR_PHY(ar5416_banks_regs[i]), vals[i]);
2804 		if ((error = otus_write_barrier(sc)) != 0) {
2805 			device_printf(sc->sc_dev,
2806 			    "%s: could not program RF\n",
2807 			    __func__);
2808 			goto finish;
2809 		}
2810 		code = AR_CMD_RF_INIT;
2811 	} else {
2812 		code = AR_CMD_FREQUENCY;
2813 	}
2814 
2815 	if ((error = otus_set_rf_bank4(sc, c)) != 0)
2816 		goto finish;
2817 
2818 	tmp = (sc->txmask == 0x5) ? 0x340 : 0x240;
2819 	otus_write(sc, AR_PHY_TURBO, tmp);
2820 	if ((error = otus_write_barrier(sc)) != 0)
2821 		goto finish;
2822 
2823 	/* Send firmware command to set channel. */
2824 	cmd.freq = htole32((uint32_t)c->ic_freq * 1000);
2825 	cmd.dynht2040 = htole32(0);
2826 	cmd.htena = htole32(1);
2827 	/* Set Delta Slope (exponent and mantissa). */
2828 	coeff = (100 << 24) / c->ic_freq;
2829 	otus_get_delta_slope(coeff, &exp, &man);
2830 	cmd.dsc_exp = htole32(exp);
2831 	cmd.dsc_man = htole32(man);
2832 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2833 	    "ds coeff=%u exp=%u man=%u\n", coeff, exp, man);
2834 	/* For Short GI, coeff is 9/10 that of normal coeff. */
2835 	coeff = (9 * coeff) / 10;
2836 	otus_get_delta_slope(coeff, &exp, &man);
2837 	cmd.dsc_shgi_exp = htole32(exp);
2838 	cmd.dsc_shgi_man = htole32(man);
2839 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2840 	    "ds shgi coeff=%u exp=%u man=%u\n", coeff, exp, man);
2841 	/* Set wait time for AGC and noise calibration (100 or 200ms). */
2842 	cmd.check_loop_count = assoc ? htole32(2000) : htole32(1000);
2843 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2844 	    "%s\n", (code == AR_CMD_RF_INIT) ? "RF_INIT" : "FREQUENCY");
2845 	error = otus_cmd(sc, code, &cmd, sizeof cmd, &rsp, sizeof(rsp));
2846 	if (error != 0)
2847 		goto finish;
2848 	if ((rsp.status & htole32(AR_CAL_ERR_AGC | AR_CAL_ERR_NF_VAL)) != 0) {
2849 		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2850 		    "status=0x%x\n", le32toh(rsp.status));
2851 		/* Force cold reset on next channel. */
2852 		sc->bb_reset = 1;
2853 	}
2854 #ifdef USB_DEBUG
2855 	if (otus_debug & OTUS_DEBUG_RESET) {
2856 		device_printf(sc->sc_dev, "calibration status=0x%x\n",
2857 		    le32toh(rsp.status));
2858 		for (i = 0; i < 2; i++) {	/* 2 Rx chains */
2859 			/* Sign-extend 9-bit NF values. */
2860 			device_printf(sc->sc_dev,
2861 			    "noisefloor chain %d=%d\n", i,
2862 			    (((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2863 			device_printf(sc->sc_dev,
2864 			    "noisefloor ext chain %d=%d\n", i,
2865 			    ((int32_t)le32toh(rsp.nf_ext[i])) >> 23);
2866 		}
2867 	}
2868 #endif
2869 	for (i = 0; i < OTUS_NUM_CHAINS; i++) {
2870 		sc->sc_nf[i] = ((((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2871 	}
2872 	sc->sc_curchan = c;
2873 finish:
2874 	return (error);
2875 }
2876 
2877 #ifdef notyet
2878 int
2879 otus_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2880     struct ieee80211_key *k)
2881 {
2882 	struct otus_softc *sc = ic->ic_softc;
2883 	struct otus_cmd_key cmd;
2884 
2885 	/* Defer setting of WEP keys until interface is brought up. */
2886 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
2887 	    (IFF_UP | IFF_RUNNING))
2888 		return 0;
2889 
2890 	/* Do it in a process context. */
2891 	cmd.key = *k;
2892 	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2893 	otus_do_async(sc, otus_set_key_cb, &cmd, sizeof cmd);
2894 	return 0;
2895 }
2896 
2897 void
2898 otus_set_key_cb(struct otus_softc *sc, void *arg)
2899 {
2900 	struct otus_cmd_key *cmd = arg;
2901 	struct ieee80211_key *k = &cmd->key;
2902 	struct ar_cmd_ekey key;
2903 	uint16_t cipher;
2904 	int error;
2905 
2906 	memset(&key, 0, sizeof key);
2907 	if (k->k_flags & IEEE80211_KEY_GROUP) {
2908 		key.uid = htole16(k->k_id);
2909 		IEEE80211_ADDR_COPY(key.macaddr, sc->sc_ic.ic_myaddr);
2910 		key.macaddr[0] |= 0x80;
2911 	} else {
2912 		key.uid = htole16(OTUS_UID(cmd->associd));
2913 		IEEE80211_ADDR_COPY(key.macaddr, ni->ni_macaddr);
2914 	}
2915 	key.kix = htole16(0);
2916 	/* Map net80211 cipher to hardware. */
2917 	switch (k->k_cipher) {
2918 	case IEEE80211_CIPHER_WEP40:
2919 		cipher = AR_CIPHER_WEP64;
2920 		break;
2921 	case IEEE80211_CIPHER_WEP104:
2922 		cipher = AR_CIPHER_WEP128;
2923 		break;
2924 	case IEEE80211_CIPHER_TKIP:
2925 		cipher = AR_CIPHER_TKIP;
2926 		break;
2927 	case IEEE80211_CIPHER_CCMP:
2928 		cipher = AR_CIPHER_AES;
2929 		break;
2930 	default:
2931 		return;
2932 	}
2933 	key.cipher = htole16(cipher);
2934 	memcpy(key.key, k->k_key, MIN(k->k_len, 16));
2935 	error = otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2936 	if (error != 0 || k->k_cipher != IEEE80211_CIPHER_TKIP)
2937 		return;
2938 
2939 	/* TKIP: set Tx/Rx MIC Key. */
2940 	key.kix = htole16(1);
2941 	memcpy(key.key, k->k_key + 16, 16);
2942 	(void)otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2943 }
2944 
2945 void
2946 otus_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2947     struct ieee80211_key *k)
2948 {
2949 	struct otus_softc *sc = ic->ic_softc;
2950 	struct otus_cmd_key cmd;
2951 
2952 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
2953 	    ic->ic_state != IEEE80211_S_RUN)
2954 		return;	/* Nothing to do. */
2955 
2956 	/* Do it in a process context. */
2957 	cmd.key = *k;
2958 	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2959 	otus_do_async(sc, otus_delete_key_cb, &cmd, sizeof cmd);
2960 }
2961 
2962 void
2963 otus_delete_key_cb(struct otus_softc *sc, void *arg)
2964 {
2965 	struct otus_cmd_key *cmd = arg;
2966 	struct ieee80211_key *k = &cmd->key;
2967 	uint32_t uid;
2968 
2969 	if (k->k_flags & IEEE80211_KEY_GROUP)
2970 		uid = htole32(k->k_id);
2971 	else
2972 		uid = htole32(OTUS_UID(cmd->associd));
2973 	(void)otus_cmd(sc, AR_CMD_DKEY, &uid, sizeof uid, NULL, 0);
2974 }
2975 #endif
2976 
2977 /*
2978  * XXX TODO: check if we have to be doing any calibration in the host
2979  * or whether it's purely a firmware thing.
2980  */
2981 void
2982 otus_calibrate_to(void *arg, int pending)
2983 {
2984 #if 0
2985 	struct otus_softc *sc = arg;
2986 
2987 	device_printf(sc->sc_dev, "%s: called\n", __func__);
2988 	struct ieee80211com *ic = &sc->sc_ic;
2989 	struct ieee80211_node *ni;
2990 	int s;
2991 
2992 	if (usbd_is_dying(sc->sc_udev))
2993 		return;
2994 
2995 	usbd_ref_incr(sc->sc_udev);
2996 
2997 	s = splnet();
2998 	ni = ic->ic_bss;
2999 	ieee80211_amrr_choose(&sc->amrr, ni, &((struct otus_node *)ni)->amn);
3000 	splx(s);
3001 
3002 	if (!usbd_is_dying(sc->sc_udev))
3003 		timeout_add_sec(&sc->calib_to, 1);
3004 
3005 	usbd_ref_decr(sc->sc_udev);
3006 #endif
3007 }
3008 
3009 int
3010 otus_set_bssid(struct otus_softc *sc, const uint8_t *bssid)
3011 {
3012 
3013 	OTUS_LOCK_ASSERT(sc);
3014 
3015 	otus_write(sc, AR_MAC_REG_BSSID_L,
3016 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
3017 	otus_write(sc, AR_MAC_REG_BSSID_H,
3018 	    bssid[4] | bssid[5] << 8);
3019 	return otus_write_barrier(sc);
3020 }
3021 
3022 int
3023 otus_set_macaddr(struct otus_softc *sc, const uint8_t *addr)
3024 {
3025 	OTUS_LOCK_ASSERT(sc);
3026 
3027 	otus_write(sc, AR_MAC_REG_MAC_ADDR_L,
3028 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
3029 	otus_write(sc, AR_MAC_REG_MAC_ADDR_H,
3030 	    addr[4] | addr[5] << 8);
3031 	return otus_write_barrier(sc);
3032 }
3033 
3034 /* Default single-LED. */
3035 void
3036 otus_led_newstate_type1(struct otus_softc *sc)
3037 {
3038 	/* TBD */
3039 	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3040 }
3041 
3042 /* NETGEAR, dual-LED. */
3043 void
3044 otus_led_newstate_type2(struct otus_softc *sc)
3045 {
3046 	/* TBD */
3047 	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3048 }
3049 
3050 /* NETGEAR, single-LED/3 colors (blue, red, purple.) */
3051 void
3052 otus_led_newstate_type3(struct otus_softc *sc)
3053 {
3054 #if 0
3055 	struct ieee80211com *ic = &sc->sc_ic;
3056 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3057 
3058 	uint32_t state = sc->led_state;
3059 
3060 	OTUS_LOCK_ASSERT(sc);
3061 
3062 	if (!vap) {
3063 		state = 0;	/* led off */
3064 	} else if (vap->iv_state == IEEE80211_S_INIT) {
3065 		state = 0;	/* LED off. */
3066 	} else if (vap->iv_state == IEEE80211_S_RUN) {
3067 		/* Associated, LED always on. */
3068 		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3069 			state = AR_LED0_ON;	/* 2GHz=>Red. */
3070 		else
3071 			state = AR_LED1_ON;	/* 5GHz=>Blue. */
3072 	} else {
3073 		/* Scanning, blink LED. */
3074 		state ^= AR_LED0_ON | AR_LED1_ON;
3075 		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3076 			state &= ~AR_LED1_ON;
3077 		else
3078 			state &= ~AR_LED0_ON;
3079 	}
3080 	if (state != sc->led_state) {
3081 		otus_write(sc, AR_GPIO_REG_PORT_DATA, state);
3082 		if (otus_write_barrier(sc) == 0)
3083 			sc->led_state = state;
3084 	}
3085 #endif
3086 }
3087 
3088 static uint8_t zero_macaddr[IEEE80211_ADDR_LEN] = { 0,0,0,0,0,0 };
3089 
3090 /*
3091  * Set up operating mode, MAC/BSS address and RX filter.
3092  */
3093 static void
3094 otus_set_operating_mode(struct otus_softc *sc)
3095 {
3096 	struct ieee80211com *ic = &sc->sc_ic;
3097 	struct ieee80211vap *vap;
3098 	uint32_t cam_mode = AR_MAC_CAM_DEFAULTS;
3099 	uint32_t rx_ctrl = AR_MAC_RX_CTRL_DEAGG | AR_MAC_RX_CTRL_SHORT_FILTER;
3100 	uint32_t sniffer = AR_MAC_SNIFFER_DEFAULTS;
3101 	uint32_t enc_mode = 0x78; /* XXX */
3102 	const uint8_t *macaddr;
3103 	uint8_t bssid[IEEE80211_ADDR_LEN];
3104 	struct ieee80211_node *ni;
3105 
3106 	OTUS_LOCK_ASSERT(sc);
3107 
3108 	/*
3109 	 * If we're in sniffer mode or we don't have a MAC
3110 	 * address assigned, ensure it gets reset to all-zero.
3111 	 */
3112 	IEEE80211_ADDR_COPY(bssid, zero_macaddr);
3113 	vap = TAILQ_FIRST(&ic->ic_vaps);
3114 	macaddr = vap ? vap->iv_myaddr : ic->ic_macaddr;
3115 
3116 	switch (ic->ic_opmode) {
3117 	case IEEE80211_M_STA:
3118 		if (vap) {
3119 			ni = ieee80211_ref_node(vap->iv_bss);
3120 			IEEE80211_ADDR_COPY(bssid, ni->ni_bssid);
3121 			ieee80211_free_node(ni);
3122 		}
3123 		cam_mode |= AR_MAC_CAM_STA;
3124 		rx_ctrl |= AR_MAC_RX_CTRL_PASS_TO_HOST;
3125 		break;
3126 	case IEEE80211_M_MONITOR:
3127 		/*
3128 		 * Note: monitor mode ends up causing the MAC to
3129 		 * generate ACK frames for everything it sees.
3130 		 * So don't do that; instead just put it in STA mode
3131 		 * and disable RX filters.
3132 		 */
3133 	default:
3134 		cam_mode |= AR_MAC_CAM_STA;
3135 		rx_ctrl |= AR_MAC_RX_CTRL_PASS_TO_HOST;
3136 		break;
3137 	}
3138 
3139 	/*
3140 	 * TODO: if/when we do hardware encryption, ensure it's
3141 	 * disabled if the NIC is in monitor mode.
3142 	 */
3143 	otus_write(sc, AR_MAC_REG_SNIFFER, sniffer);
3144 	otus_write(sc, AR_MAC_REG_CAM_MODE, cam_mode);
3145 	otus_write(sc, AR_MAC_REG_ENCRYPTION, enc_mode);
3146 	otus_write(sc, AR_MAC_REG_RX_CONTROL, rx_ctrl);
3147 	otus_set_macaddr(sc, macaddr);
3148 	otus_set_bssid(sc, bssid);
3149 	/* XXX barrier? */
3150 }
3151 
3152 static void
3153 otus_set_rx_filter(struct otus_softc *sc)
3154 {
3155 //	struct ieee80211com *ic = &sc->sc_ic;
3156 
3157 	OTUS_LOCK_ASSERT(sc);
3158 
3159 #if 0
3160 	if (ic->ic_allmulti > 0 || ic->ic_promisc > 0 ||
3161 	    ic->ic_opmode == IEEE80211_M_MONITOR) {
3162 		otus_write(sc, AR_MAC_REG_FRAMETYPE_FILTER, 0xff00ffff);
3163 	} else {
3164 #endif
3165 		/* Filter any control frames, BAR is bit 24. */
3166 		otus_write(sc, AR_MAC_REG_FRAMETYPE_FILTER, 0x0500ffff);
3167 #if 0
3168 	}
3169 #endif
3170 }
3171 
3172 int
3173 otus_init(struct otus_softc *sc)
3174 {
3175 	struct ieee80211com *ic = &sc->sc_ic;
3176 	int error;
3177 
3178 	OTUS_UNLOCK_ASSERT(sc);
3179 
3180 	OTUS_LOCK(sc);
3181 
3182 	/* Drain any pending TX frames */
3183 	otus_drain_mbufq(sc);
3184 
3185 	/* Init MAC */
3186 	if ((error = otus_init_mac(sc)) != 0) {
3187 		OTUS_UNLOCK(sc);
3188 		device_printf(sc->sc_dev,
3189 		    "%s: could not initialize MAC\n", __func__);
3190 		return error;
3191 	}
3192 
3193 	otus_set_operating_mode(sc);
3194 	otus_set_rx_filter(sc);
3195 	(void) otus_set_operating_mode(sc);
3196 
3197 	sc->bb_reset = 1;	/* Force cold reset. */
3198 
3199 	if ((error = otus_set_chan(sc, ic->ic_curchan, 0)) != 0) {
3200 		OTUS_UNLOCK(sc);
3201 		device_printf(sc->sc_dev,
3202 		    "%s: could not set channel\n", __func__);
3203 		return error;
3204 	}
3205 
3206 	/* Start Rx. */
3207 	otus_write(sc, AR_MAC_REG_DMA_TRIGGER, 0x100);
3208 	(void)otus_write_barrier(sc);
3209 
3210 	sc->sc_running = 1;
3211 
3212 	OTUS_UNLOCK(sc);
3213 	return 0;
3214 }
3215 
3216 void
3217 otus_stop(struct otus_softc *sc)
3218 {
3219 #if 0
3220 	int s;
3221 #endif
3222 
3223 	OTUS_UNLOCK_ASSERT(sc);
3224 
3225 	OTUS_LOCK(sc);
3226 	sc->sc_running = 0;
3227 	sc->sc_tx_timer = 0;
3228 	OTUS_UNLOCK(sc);
3229 
3230 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
3231 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
3232 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
3233 
3234 	OTUS_LOCK(sc);
3235 	sc->sc_running = 0;
3236 	/* Stop Rx. */
3237 	otus_write(sc, AR_MAC_REG_DMA_TRIGGER, 0);
3238 	(void)otus_write_barrier(sc);
3239 
3240 	/* Drain any pending TX frames */
3241 	otus_drain_mbufq(sc);
3242 
3243 	OTUS_UNLOCK(sc);
3244 }
3245