xref: /freebsd/sys/dev/otus/if_otus.c (revision 65b71c48d226f3ef3eb1c4452dccc678a7d2ac96)
1 /*	$OpenBSD: if_otus.c,v 1.46 2015/03/14 03:38:49 jsg Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Adrian Chadd <adrian@FreeBSD.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Atheros AR9001U chipset.
22  */
23 
24 #include <sys/cdefs.h>
25 __FBSDID("$FreeBSD$");
26 
27 #include "opt_wlan.h"
28 
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/sockio.h>
32 #include <sys/mbuf.h>
33 #include <sys/kernel.h>
34 #include <sys/socket.h>
35 #include <sys/systm.h>
36 #include <sys/conf.h>
37 #include <sys/bus.h>
38 #include <sys/rman.h>
39 #include <sys/firmware.h>
40 #include <sys/module.h>
41 #include <sys/taskqueue.h>
42 
43 #include <machine/bus.h>
44 #include <machine/resource.h>
45 
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <net/if_var.h>
49 #include <net/if_arp.h>
50 #include <net/if_dl.h>
51 #include <net/if_media.h>
52 #include <net/if_types.h>
53 
54 #include <netinet/in.h>
55 #include <netinet/in_systm.h>
56 #include <netinet/in_var.h>
57 #include <netinet/if_ether.h>
58 #include <netinet/ip.h>
59 
60 #include <net80211/ieee80211_var.h>
61 #include <net80211/ieee80211_regdomain.h>
62 #include <net80211/ieee80211_radiotap.h>
63 #include <net80211/ieee80211_ratectl.h>
64 #include <net80211/ieee80211_input.h>
65 #ifdef	IEEE80211_SUPPORT_SUPERG
66 #include <net80211/ieee80211_superg.h>
67 #endif
68 
69 #include <dev/usb/usb.h>
70 #include <dev/usb/usbdi.h>
71 #include "usbdevs.h"
72 
73 #define USB_DEBUG_VAR otus_debug
74 #include <dev/usb/usb_debug.h>
75 
76 #include "if_otusreg.h"
77 
78 static int otus_debug = 0;
79 static SYSCTL_NODE(_hw_usb, OID_AUTO, otus, CTLFLAG_RW, 0, "USB otus");
80 SYSCTL_INT(_hw_usb_otus, OID_AUTO, debug, CTLFLAG_RWTUN, &otus_debug, 0,
81     "Debug level");
82 #define	OTUS_DEBUG_XMIT		0x00000001
83 #define	OTUS_DEBUG_RECV		0x00000002
84 #define	OTUS_DEBUG_TXDONE	0x00000004
85 #define	OTUS_DEBUG_RXDONE	0x00000008
86 #define	OTUS_DEBUG_CMD		0x00000010
87 #define	OTUS_DEBUG_CMDDONE	0x00000020
88 #define	OTUS_DEBUG_RESET	0x00000040
89 #define	OTUS_DEBUG_STATE	0x00000080
90 #define	OTUS_DEBUG_CMDNOTIFY	0x00000100
91 #define	OTUS_DEBUG_REGIO	0x00000200
92 #define	OTUS_DEBUG_IRQ		0x00000400
93 #define	OTUS_DEBUG_TXCOMP	0x00000800
94 #define	OTUS_DEBUG_ANY		0xffffffff
95 
96 #define	OTUS_DPRINTF(sc, dm, ...) \
97 	do { \
98 		if ((dm == OTUS_DEBUG_ANY) || (dm & otus_debug)) \
99 			device_printf(sc->sc_dev, __VA_ARGS__); \
100 	} while (0)
101 
102 #define	OTUS_DEV(v, p) { USB_VPI(v, p, 0) }
103 static const STRUCT_USB_HOST_ID otus_devs[] = {
104 	OTUS_DEV(USB_VENDOR_ACCTON,		USB_PRODUCT_ACCTON_WN7512),
105 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_3CRUSBN275),
106 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_TG121N),
107 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_AR9170),
108 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN612),
109 	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN821NV2),
110 	OTUS_DEV(USB_VENDOR_AVM,		USB_PRODUCT_AVM_FRITZWLAN),
111 	OTUS_DEV(USB_VENDOR_CACE,		USB_PRODUCT_CACE_AIRPCAPNX),
112 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA130D1),
113 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A1),
114 	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A2),
115 	OTUS_DEV(USB_VENDOR_IODATA,		USB_PRODUCT_IODATA_WNGDNUS2),
116 	OTUS_DEV(USB_VENDOR_NEC,		USB_PRODUCT_NEC_WL300NUG),
117 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WN111V2),
118 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNA1000),
119 	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNDA3100),
120 	OTUS_DEV(USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GW_US300),
121 	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_O8494),
122 	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_WNC0600),
123 	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB81),
124 	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB82),
125 	OTUS_DEV(USB_VENDOR_ZYDAS,		USB_PRODUCT_ZYDAS_ZD1221),
126 	OTUS_DEV(USB_VENDOR_ZYXEL,		USB_PRODUCT_ZYXEL_NWD271N),
127 };
128 
129 static device_probe_t otus_match;
130 static device_attach_t otus_attach;
131 static device_detach_t otus_detach;
132 
133 static int	otus_attachhook(struct otus_softc *);
134 void		otus_get_chanlist(struct otus_softc *);
135 int		otus_load_firmware(struct otus_softc *, const char *,
136 		    uint32_t);
137 int		otus_open_pipes(struct otus_softc *);
138 void		otus_close_pipes(struct otus_softc *);
139 
140 static int	otus_alloc_tx_cmd_list(struct otus_softc *);
141 static void	otus_free_tx_cmd_list(struct otus_softc *);
142 
143 static int	otus_alloc_rx_list(struct otus_softc *);
144 static void	otus_free_rx_list(struct otus_softc *);
145 static int	otus_alloc_tx_list(struct otus_softc *);
146 static void	otus_free_tx_list(struct otus_softc *);
147 static void	otus_free_list(struct otus_softc *, struct otus_data [], int);
148 static struct otus_data *_otus_getbuf(struct otus_softc *);
149 static struct otus_data *otus_getbuf(struct otus_softc *);
150 static void	otus_freebuf(struct otus_softc *, struct otus_data *);
151 
152 static struct otus_tx_cmd *_otus_get_txcmd(struct otus_softc *);
153 static struct otus_tx_cmd *otus_get_txcmd(struct otus_softc *);
154 static void	otus_free_txcmd(struct otus_softc *, struct otus_tx_cmd *);
155 
156 void		otus_next_scan(void *, int);
157 static void	otus_tx_task(void *, int pending);
158 static void	otus_wme_update_task(void *, int pending);
159 void		otus_do_async(struct otus_softc *,
160 		    void (*)(struct otus_softc *, void *), void *, int);
161 int		otus_newstate(struct ieee80211vap *, enum ieee80211_state,
162 		    int);
163 int		otus_cmd(struct otus_softc *, uint8_t, const void *, int,
164 		    void *, int);
165 void		otus_write(struct otus_softc *, uint32_t, uint32_t);
166 int		otus_write_barrier(struct otus_softc *);
167 struct		ieee80211_node *otus_node_alloc(struct ieee80211com *);
168 int		otus_media_change(struct ifnet *);
169 int		otus_read_eeprom(struct otus_softc *);
170 void		otus_newassoc(struct ieee80211_node *, int);
171 void		otus_cmd_rxeof(struct otus_softc *, uint8_t *, int);
172 void		otus_sub_rxeof(struct otus_softc *, uint8_t *, int,
173 		    struct mbufq *);
174 static int	otus_tx(struct otus_softc *, struct ieee80211_node *,
175 		    struct mbuf *, struct otus_data *);
176 int		otus_ioctl(struct ifnet *, u_long, caddr_t);
177 int		otus_set_multi(struct otus_softc *);
178 static void	otus_updateedca(struct otus_softc *sc);
179 static void	otus_updateslot(struct otus_softc *sc);
180 int		otus_init_mac(struct otus_softc *);
181 uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
182 int		otus_set_board_values(struct otus_softc *,
183 		    struct ieee80211_channel *);
184 int		otus_program_phy(struct otus_softc *,
185 		    struct ieee80211_channel *);
186 int		otus_set_rf_bank4(struct otus_softc *,
187 		    struct ieee80211_channel *);
188 void		otus_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
189 static int	otus_set_chan(struct otus_softc *, struct ieee80211_channel *,
190 		    int);
191 int		otus_set_key(struct ieee80211com *, struct ieee80211_node *,
192 		    struct ieee80211_key *);
193 void		otus_set_key_cb(struct otus_softc *, void *);
194 void		otus_delete_key(struct ieee80211com *, struct ieee80211_node *,
195 		    struct ieee80211_key *);
196 void		otus_delete_key_cb(struct otus_softc *, void *);
197 void		otus_calibrate_to(void *, int);
198 int		otus_set_bssid(struct otus_softc *, const uint8_t *);
199 int		otus_set_macaddr(struct otus_softc *, const uint8_t *);
200 void		otus_led_newstate_type1(struct otus_softc *);
201 void		otus_led_newstate_type2(struct otus_softc *);
202 void		otus_led_newstate_type3(struct otus_softc *);
203 int		otus_init(struct otus_softc *sc);
204 void		otus_stop(struct otus_softc *sc);
205 
206 static device_method_t otus_methods[] = {
207 	DEVMETHOD(device_probe,		otus_match),
208 	DEVMETHOD(device_attach,	otus_attach),
209 	DEVMETHOD(device_detach,	otus_detach),
210 
211 	DEVMETHOD_END
212 };
213 
214 static driver_t otus_driver = {
215 	.name = "otus",
216 	.methods = otus_methods,
217 	.size = sizeof(struct otus_softc)
218 };
219 
220 static devclass_t otus_devclass;
221 
222 DRIVER_MODULE(otus, uhub, otus_driver, otus_devclass, NULL, 0);
223 MODULE_DEPEND(otus, wlan, 1, 1, 1);
224 MODULE_DEPEND(otus, usb, 1, 1, 1);
225 MODULE_DEPEND(otus, firmware, 1, 1, 1);
226 MODULE_VERSION(otus, 1);
227 
228 static usb_callback_t	otus_bulk_tx_callback;
229 static usb_callback_t	otus_bulk_rx_callback;
230 static usb_callback_t	otus_bulk_irq_callback;
231 static usb_callback_t	otus_bulk_cmd_callback;
232 
233 static const struct usb_config otus_config[OTUS_N_XFER] = {
234 	[OTUS_BULK_TX] = {
235 	.type = UE_BULK,
236 	.endpoint = UE_ADDR_ANY,
237 	.direction = UE_DIR_OUT,
238 	.bufsize = 0x200,
239 	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
240 	.callback = otus_bulk_tx_callback,
241 	.timeout = 5000,	/* ms */
242 	},
243 	[OTUS_BULK_RX] = {
244 	.type = UE_BULK,
245 	.endpoint = UE_ADDR_ANY,
246 	.direction = UE_DIR_IN,
247 	.bufsize = OTUS_RXBUFSZ,
248 	.flags = { .ext_buffer = 1, .pipe_bof = 1,.short_xfer_ok = 1,},
249 	.callback = otus_bulk_rx_callback,
250 	},
251 	[OTUS_BULK_IRQ] = {
252 	.type = UE_INTERRUPT,
253 	.endpoint = UE_ADDR_ANY,
254 	.direction = UE_DIR_IN,
255 	.bufsize = OTUS_MAX_CTRLSZ,
256 	.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
257 	.callback = otus_bulk_irq_callback,
258 	},
259 	[OTUS_BULK_CMD] = {
260 	.type = UE_INTERRUPT,
261 	.endpoint = UE_ADDR_ANY,
262 	.direction = UE_DIR_OUT,
263 	.bufsize = OTUS_MAX_CTRLSZ,
264 	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
265 	.callback = otus_bulk_cmd_callback,
266 	.timeout = 5000,	/* ms */
267 	},
268 };
269 
270 static int
271 otus_match(device_t self)
272 {
273 	struct usb_attach_arg *uaa = device_get_ivars(self);
274 
275 	if (uaa->usb_mode != USB_MODE_HOST ||
276 	    uaa->info.bIfaceIndex != 0 ||
277 	    uaa->info.bConfigIndex != 0)
278 	return (ENXIO);
279 
280 	return (usbd_lookup_id_by_uaa(otus_devs, sizeof(otus_devs), uaa));
281 }
282 
283 static int
284 otus_attach(device_t self)
285 {
286 	struct usb_attach_arg *uaa = device_get_ivars(self);
287 	struct otus_softc *sc = device_get_softc(self);
288 	int error;
289 	uint8_t iface_index;
290 
291 	device_set_usb_desc(self);
292 	sc->sc_udev = uaa->device;
293 	sc->sc_dev = self;
294 
295 	mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
296 	    MTX_DEF);
297 
298 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->scan_to, 0, otus_next_scan, sc);
299 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_to, 0, otus_calibrate_to, sc);
300 	TASK_INIT(&sc->tx_task, 0, otus_tx_task, sc);
301 	TASK_INIT(&sc->wme_update_task, 0, otus_wme_update_task, sc);
302 	mbufq_init(&sc->sc_snd, ifqmaxlen);
303 
304 	iface_index = 0;
305 	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
306 	    otus_config, OTUS_N_XFER, sc, &sc->sc_mtx);
307 	if (error) {
308 		device_printf(sc->sc_dev,
309 		    "could not allocate USB transfers, err=%s\n",
310 		    usbd_errstr(error));
311 		goto fail_usb;
312 	}
313 
314 	if ((error = otus_open_pipes(sc)) != 0) {
315 		device_printf(sc->sc_dev, "%s: could not open pipes\n",
316 		    __func__);
317 		goto fail;
318 	}
319 
320 	/* XXX check return status; fail out if appropriate */
321 	if (otus_attachhook(sc) != 0)
322 		goto fail;
323 
324 	return (0);
325 
326 fail:
327 	otus_close_pipes(sc);
328 fail_usb:
329 	mtx_destroy(&sc->sc_mtx);
330 	return (ENXIO);
331 }
332 
333 static int
334 otus_detach(device_t self)
335 {
336 	struct otus_softc *sc = device_get_softc(self);
337 	struct ieee80211com *ic = &sc->sc_ic;
338 
339 	otus_stop(sc);
340 
341 	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
342 
343 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
344 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
345 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
346 	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
347 
348 	otus_close_pipes(sc);
349 #if 0
350 	/* Wait for all queued asynchronous commands to complete. */
351 	usb_rem_wait_task(sc->sc_udev, &sc->sc_task);
352 
353 	usbd_ref_wait(sc->sc_udev);
354 #endif
355 
356 	ieee80211_ifdetach(ic);
357 	mtx_destroy(&sc->sc_mtx);
358 	return 0;
359 }
360 
361 static void
362 otus_delay_ms(struct otus_softc *sc, int ms)
363 {
364 
365 	DELAY(1000 * ms);
366 }
367 
368 static struct ieee80211vap *
369 otus_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
370     enum ieee80211_opmode opmode, int flags,
371     const uint8_t bssid[IEEE80211_ADDR_LEN],
372     const uint8_t mac[IEEE80211_ADDR_LEN])
373 {
374 	struct otus_vap *uvp;
375 	struct ieee80211vap *vap;
376 
377 	if (!TAILQ_EMPTY(&ic->ic_vaps))	 /* only one at a time */
378 		return (NULL);
379 
380 	uvp =  malloc(sizeof(struct otus_vap), M_80211_VAP, M_WAITOK | M_ZERO);
381 	vap = &uvp->vap;
382 
383 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
384 	    flags, bssid) != 0) {
385 		/* out of memory */
386 		free(uvp, M_80211_VAP);
387 		return (NULL);
388 	}
389 
390 	/* override state transition machine */
391 	uvp->newstate = vap->iv_newstate;
392 	vap->iv_newstate = otus_newstate;
393 
394 	/* XXX TODO: double-check */
395 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
396 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
397 
398 	ieee80211_ratectl_init(vap);
399 
400 	/* complete setup */
401 	ieee80211_vap_attach(vap, ieee80211_media_change,
402 	    ieee80211_media_status, mac);
403 	ic->ic_opmode = opmode;
404 
405 	return (vap);
406 }
407 
408 static void
409 otus_vap_delete(struct ieee80211vap *vap)
410 {
411 	struct otus_vap *uvp = OTUS_VAP(vap);
412 
413 	ieee80211_ratectl_deinit(vap);
414 	ieee80211_vap_detach(vap);
415 	free(uvp, M_80211_VAP);
416 }
417 
418 static void
419 otus_parent(struct ieee80211com *ic)
420 {
421 	struct otus_softc *sc = ic->ic_softc;
422 	int startall = 0;
423 
424 	if (ic->ic_nrunning > 0) {
425 		if (!sc->sc_running) {
426 			otus_init(sc);
427 			startall = 1;
428 		} else {
429 			(void) otus_set_multi(sc);
430 		}
431 	} else if (sc->sc_running)
432 		otus_stop(sc);
433 
434 	if (startall)
435 		ieee80211_start_all(ic);
436 }
437 
438 static void
439 otus_drain_mbufq(struct otus_softc *sc)
440 {
441 	struct mbuf *m;
442 	struct ieee80211_node *ni;
443 
444 	OTUS_LOCK_ASSERT(sc);
445 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
446 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
447 		m->m_pkthdr.rcvif = NULL;
448 		ieee80211_free_node(ni);
449 		m_freem(m);
450 	}
451 }
452 
453 static void
454 otus_tx_start(struct otus_softc *sc)
455 {
456 
457 	taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
458 }
459 
460 static int
461 otus_transmit(struct ieee80211com *ic, struct mbuf *m)
462 {
463 	struct otus_softc *sc = ic->ic_softc;
464 	int error;
465 
466 	OTUS_LOCK(sc);
467 	if (! sc->sc_running) {
468 		OTUS_UNLOCK(sc);
469 		return (ENXIO);
470 	}
471 
472 	/* XXX TODO: handle fragments */
473 	error = mbufq_enqueue(&sc->sc_snd, m);
474 	if (error) {
475 		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
476 		    "%s: mbufq_enqueue failed: %d\n",
477 		    __func__,
478 		    error);
479 		OTUS_UNLOCK(sc);
480 		return (error);
481 	}
482 	OTUS_UNLOCK(sc);
483 
484 	/* Kick TX */
485 	otus_tx_start(sc);
486 
487 	return (0);
488 }
489 
490 static void
491 _otus_start(struct otus_softc *sc)
492 {
493 	struct ieee80211_node *ni;
494 	struct otus_data *bf;
495 	struct mbuf *m;
496 
497 	OTUS_LOCK_ASSERT(sc);
498 
499 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
500 		bf = otus_getbuf(sc);
501 		if (bf == NULL) {
502 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
503 			    "%s: failed to get buffer\n", __func__);
504 			mbufq_prepend(&sc->sc_snd, m);
505 			break;
506 		}
507 
508 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
509 		m->m_pkthdr.rcvif = NULL;
510 
511 		if (otus_tx(sc, ni, m, bf) != 0) {
512 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
513 			    "%s: failed to transmit\n", __func__);
514 			if_inc_counter(ni->ni_vap->iv_ifp,
515 			    IFCOUNTER_OERRORS, 1);
516 			otus_freebuf(sc, bf);
517 			ieee80211_free_node(ni);
518 			m_freem(m);
519 			break;
520 		}
521 	}
522 }
523 
524 static void
525 otus_tx_task(void *arg, int pending)
526 {
527 	struct otus_softc *sc = arg;
528 
529 	OTUS_LOCK(sc);
530 	_otus_start(sc);
531 	OTUS_UNLOCK(sc);
532 }
533 
534 static int
535 otus_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
536     const struct ieee80211_bpf_params *params)
537 {
538 	struct ieee80211com *ic= ni->ni_ic;
539 	struct otus_softc *sc = ic->ic_softc;
540 	struct otus_data *bf = NULL;
541 	int error = 0;
542 
543 	/* Don't transmit if we're not running */
544 	OTUS_LOCK(sc);
545 	if (! sc->sc_running) {
546 		error = ENETDOWN;
547 		goto error;
548 	}
549 
550 	bf = otus_getbuf(sc);
551 	if (bf == NULL) {
552 		error = ENOBUFS;
553 		goto error;
554 	}
555 
556 	/*
557 	 * XXX TODO: support TX bpf params
558 	 */
559 	if (otus_tx(sc, ni, m, bf) != 0) {
560 		error = EIO;
561 		goto error;
562 	}
563 
564 	OTUS_UNLOCK(sc);
565 	return (0);
566 error:
567 	if (bf)
568 		otus_freebuf(sc, bf);
569 	OTUS_UNLOCK(sc);
570 	ieee80211_free_node(ni);
571 	m_freem(m);
572 	return (ENXIO);
573 }
574 
575 static void
576 otus_update_chw(struct ieee80211com *ic)
577 {
578 
579 	printf("%s: TODO\n", __func__);
580 }
581 
582 static void
583 otus_set_channel(struct ieee80211com *ic)
584 {
585 	struct otus_softc *sc = ic->ic_softc;
586 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "%s: set channel: %d\n",
587 	    __func__,
588 	    ic->ic_curchan->ic_freq);
589 
590 	OTUS_LOCK(sc);
591 	(void) otus_set_chan(sc, ic->ic_curchan, 0);
592 	OTUS_UNLOCK(sc);
593 }
594 
595 static void
596 otus_wme_update_task(void *arg, int pending)
597 {
598 	struct otus_softc *sc = arg;
599 
600 	OTUS_LOCK(sc);
601 	/*
602 	 * XXX TODO: take temporary copy of EDCA information
603 	 * when scheduling this so we have a more time-correct view
604 	 * of things.
605 	 */
606 	otus_updateedca(sc);
607 	OTUS_UNLOCK(sc);
608 }
609 
610 static void
611 otus_wme_schedule_update(struct otus_softc *sc)
612 {
613 
614 	taskqueue_enqueue(taskqueue_thread, &sc->wme_update_task);
615 }
616 
617 /*
618  * This is called by net80211 in RX packet context, so we
619  * can't sleep here.
620  *
621  * TODO: have net80211 schedule an update itself for its
622  * own internal taskqueue.
623  */
624 static int
625 otus_wme_update(struct ieee80211com *ic)
626 {
627 	struct otus_softc *sc = ic->ic_softc;
628 
629 	otus_wme_schedule_update(sc);
630 	return (0);
631 }
632 
633 static int
634 otus_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
635 {
636 
637 	/* For now, no A-MPDU TX support in the driver */
638 	return (0);
639 }
640 
641 static void
642 otus_scan_start(struct ieee80211com *ic)
643 {
644 
645 //	printf("%s: TODO\n", __func__);
646 }
647 
648 static void
649 otus_scan_end(struct ieee80211com *ic)
650 {
651 
652 //	printf("%s: TODO\n", __func__);
653 }
654 
655 static void
656 otus_update_mcast(struct ieee80211com *ic)
657 {
658 	struct otus_softc *sc = ic->ic_softc;
659 
660 	(void) otus_set_multi(sc);
661 }
662 
663 static int
664 otus_attachhook(struct otus_softc *sc)
665 {
666 	struct ieee80211com *ic = &sc->sc_ic;
667 	usb_device_request_t req;
668 	uint32_t in, out;
669 	int error;
670 	uint8_t bands;
671 
672 	/* Not locked */
673 	error = otus_load_firmware(sc, "otusfw_init", AR_FW_INIT_ADDR);
674 	if (error != 0) {
675 		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
676 		    __func__, "init");
677 		return (ENXIO);
678 	}
679 
680 	/* XXX not locked? */
681 	otus_delay_ms(sc, 1000);
682 
683 	/* Not locked */
684 	error = otus_load_firmware(sc, "otusfw_main", AR_FW_MAIN_ADDR);
685 	if (error != 0) {
686 		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
687 		    __func__, "main");
688 		return (ENXIO);
689 	}
690 
691 	OTUS_LOCK(sc);
692 
693 	/* Tell device that firmware transfer is complete. */
694 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
695 	req.bRequest = AR_FW_DOWNLOAD_COMPLETE;
696 	USETW(req.wValue, 0);
697 	USETW(req.wIndex, 0);
698 	USETW(req.wLength, 0);
699 	if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx, &req, NULL,
700 	    0, NULL, 250) != 0) {
701 		OTUS_UNLOCK(sc);
702 		device_printf(sc->sc_dev,
703 		    "%s: firmware initialization failed\n",
704 		    __func__);
705 		return (ENXIO);
706 	}
707 
708 	/* Send an ECHO command to check that everything is settled. */
709 	in = 0xbadc0ffe;
710 	if (otus_cmd(sc, AR_CMD_ECHO, &in, sizeof in, &out, sizeof(out)) != 0) {
711 		OTUS_UNLOCK(sc);
712 		device_printf(sc->sc_dev,
713 		    "%s: echo command failed\n", __func__);
714 		return (ENXIO);
715 	}
716 	if (in != out) {
717 		OTUS_UNLOCK(sc);
718 		device_printf(sc->sc_dev,
719 		    "%s: echo reply mismatch: 0x%08x!=0x%08x\n",
720 		    __func__, in, out);
721 		return (ENXIO);
722 	}
723 
724 	/* Read entire EEPROM. */
725 	if (otus_read_eeprom(sc) != 0) {
726 		OTUS_UNLOCK(sc);
727 		device_printf(sc->sc_dev,
728 		    "%s: could not read EEPROM\n",
729 		    __func__);
730 		return (ENXIO);
731 	}
732 
733 	OTUS_UNLOCK(sc);
734 
735 	sc->txmask = sc->eeprom.baseEepHeader.txMask;
736 	sc->rxmask = sc->eeprom.baseEepHeader.rxMask;
737 	sc->capflags = sc->eeprom.baseEepHeader.opCapFlags;
738 	IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->eeprom.baseEepHeader.macAddr);
739 	sc->sc_led_newstate = otus_led_newstate_type3;	/* XXX */
740 
741 	device_printf(sc->sc_dev,
742 	    "MAC/BBP AR9170, RF AR%X, MIMO %dT%dR, address %s\n",
743 	    (sc->capflags & AR5416_OPFLAGS_11A) ?
744 		0x9104 : ((sc->txmask == 0x5) ? 0x9102 : 0x9101),
745 	    (sc->txmask == 0x5) ? 2 : 1, (sc->rxmask == 0x5) ? 2 : 1,
746 	    ether_sprintf(ic->ic_macaddr));
747 
748 	ic->ic_softc = sc;
749 	ic->ic_name = device_get_nameunit(sc->sc_dev);
750 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
751 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
752 
753 	/* Set device capabilities. */
754 	ic->ic_caps =
755 	    IEEE80211_C_STA |		/* station mode */
756 #if 0
757 	    IEEE80211_C_BGSCAN |	/* Background scan. */
758 #endif
759 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
760 	    IEEE80211_C_WME |		/* WME/QoS */
761 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
762 	    IEEE80211_C_FF |		/* Atheros fast-frames supported. */
763 	    IEEE80211_C_WPA;		/* WPA/RSN. */
764 
765 	/* XXX TODO: 11n */
766 
767 #if 0
768 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
769 		/* Set supported .11b and .11g rates. */
770 		ic->ic_sup_rates[IEEE80211_MODE_11B] =
771 		    ieee80211_std_rateset_11b;
772 		ic->ic_sup_rates[IEEE80211_MODE_11G] =
773 		    ieee80211_std_rateset_11g;
774 	}
775 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
776 		/* Set supported .11a rates. */
777 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
778 		    ieee80211_std_rateset_11a;
779 	}
780 #endif
781 
782 #if 0
783 	/* Build the list of supported channels. */
784 	otus_get_chanlist(sc);
785 #else
786 	/* Set supported .11b and .11g rates. */
787 	bands = 0;
788 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
789 		setbit(&bands, IEEE80211_MODE_11B);
790 		setbit(&bands, IEEE80211_MODE_11G);
791 	}
792 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
793 		setbit(&bands, IEEE80211_MODE_11A);
794 	}
795 #if 0
796 	if (sc->sc_ht)
797 		setbit(&bands, IEEE80211_MODE_11NG);
798 #endif
799 	ieee80211_init_channels(ic, NULL, &bands);
800 #endif
801 
802 	ieee80211_ifattach(ic);
803 	ic->ic_raw_xmit = otus_raw_xmit;
804 	ic->ic_scan_start = otus_scan_start;
805 	ic->ic_scan_end = otus_scan_end;
806 	ic->ic_set_channel = otus_set_channel;
807 	ic->ic_vap_create = otus_vap_create;
808 	ic->ic_vap_delete = otus_vap_delete;
809 	ic->ic_update_mcast = otus_update_mcast;
810 	ic->ic_update_promisc = otus_update_mcast;
811 	ic->ic_parent = otus_parent;
812 	ic->ic_transmit = otus_transmit;
813 	ic->ic_update_chw = otus_update_chw;
814 	ic->ic_ampdu_enable = otus_ampdu_enable;
815 	ic->ic_wme.wme_update = otus_wme_update;
816 	ic->ic_newassoc = otus_newassoc;
817 
818 #ifdef notyet
819 	ic->ic_set_key = otus_set_key;
820 	ic->ic_delete_key = otus_delete_key;
821 #endif
822 
823 	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
824 	    sizeof(sc->sc_txtap), OTUS_TX_RADIOTAP_PRESENT,
825 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
826 	    OTUS_RX_RADIOTAP_PRESENT);
827 
828 	return (0);
829 }
830 
831 void
832 otus_get_chanlist(struct otus_softc *sc)
833 {
834 	struct ieee80211com *ic = &sc->sc_ic;
835 	uint16_t domain;
836 	uint8_t chan;
837 	int i;
838 
839 	/* XXX regulatory domain. */
840 	domain = le16toh(sc->eeprom.baseEepHeader.regDmn[0]);
841 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "regdomain=0x%04x\n", domain);
842 
843 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
844 		for (i = 0; i < 14; i++) {
845 			chan = ar_chans[i];
846 			ic->ic_channels[chan].ic_freq =
847 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
848 			ic->ic_channels[chan].ic_flags =
849 			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
850 			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
851 		}
852 	}
853 	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
854 		for (i = 14; i < nitems(ar_chans); i++) {
855 			chan = ar_chans[i];
856 			ic->ic_channels[chan].ic_freq =
857 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
858 			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
859 		}
860 	}
861 }
862 
863 int
864 otus_load_firmware(struct otus_softc *sc, const char *name, uint32_t addr)
865 {
866 	usb_device_request_t req;
867 	char *ptr;
868 	const struct firmware *fw;
869 	int mlen, error, size;
870 
871 	error = 0;
872 
873 	/* Read firmware image from the filesystem. */
874 	if ((fw = firmware_get(name)) == NULL) {
875 		device_printf(sc->sc_dev,
876 		    "%s: failed loadfirmware of file %s\n", __func__, name);
877 		return (ENXIO);
878 	}
879 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
880 	req.bRequest = AR_FW_DOWNLOAD;
881 	USETW(req.wIndex, 0);
882 
883 	OTUS_LOCK(sc);
884 
885 	/* XXX const */
886 	ptr = __DECONST(char *, fw->data);
887 	size = fw->datasize;
888 	addr >>= 8;
889 	while (size > 0) {
890 		mlen = MIN(size, 4096);
891 
892 		USETW(req.wValue, addr);
893 		USETW(req.wLength, mlen);
894 		if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
895 		    &req, ptr, 0, NULL, 250) != 0) {
896 			error = EIO;
897 			break;
898 		}
899 		addr += mlen >> 8;
900 		ptr  += mlen;
901 		size -= mlen;
902 	}
903 
904 	OTUS_UNLOCK(sc);
905 
906 	firmware_put(fw, FIRMWARE_UNLOAD);
907 	if (error != 0)
908 		device_printf(sc->sc_dev,
909 		    "%s: %s: error=%d\n", __func__, name, error);
910 	return error;
911 }
912 
913 int
914 otus_open_pipes(struct otus_softc *sc)
915 {
916 #if 0
917 	int isize, error;
918 	int i;
919 #endif
920 	int error;
921 
922 	OTUS_UNLOCK_ASSERT(sc);
923 
924 	if ((error = otus_alloc_tx_cmd_list(sc)) != 0) {
925 		device_printf(sc->sc_dev,
926 		    "%s: could not allocate command xfer\n",
927 		    __func__);
928 		goto fail;
929 	}
930 
931 	if ((error = otus_alloc_tx_list(sc)) != 0) {
932 		device_printf(sc->sc_dev, "%s: could not allocate Tx xfers\n",
933 		    __func__);
934 		goto fail;
935 	}
936 
937 	if ((error = otus_alloc_rx_list(sc)) != 0) {
938 		device_printf(sc->sc_dev, "%s: could not allocate Rx xfers\n",
939 		    __func__);
940 		goto fail;
941 	}
942 
943 	/* Enable RX transfers; needed for initial firmware messages */
944 	OTUS_LOCK(sc);
945 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_RX]);
946 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_IRQ]);
947 	OTUS_UNLOCK(sc);
948 	return 0;
949 
950 fail:	otus_close_pipes(sc);
951 	return error;
952 }
953 
954 void
955 otus_close_pipes(struct otus_softc *sc)
956 {
957 
958 	OTUS_LOCK(sc);
959 	otus_free_tx_cmd_list(sc);
960 	otus_free_tx_list(sc);
961 	otus_free_rx_list(sc);
962 	OTUS_UNLOCK(sc);
963 
964 	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
965 }
966 
967 static void
968 otus_free_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[], int ndata)
969 {
970 	int i;
971 
972 	/* XXX TODO: someone has to have waken up waiters! */
973 	for (i = 0; i < ndata; i++) {
974 		struct otus_tx_cmd *dp = &cmd[i];
975 
976 		if (dp->buf != NULL) {
977 			free(dp->buf, M_USBDEV);
978 			dp->buf = NULL;
979 		}
980 	}
981 }
982 
983 static int
984 otus_alloc_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[],
985     int ndata, int maxsz)
986 {
987 	int i, error;
988 
989 	for (i = 0; i < ndata; i++) {
990 		struct otus_tx_cmd *dp = &cmd[i];
991 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
992 		dp->odata = NULL;
993 		if (dp->buf == NULL) {
994 			device_printf(sc->sc_dev,
995 			    "could not allocate buffer\n");
996 			error = ENOMEM;
997 			goto fail;
998 		}
999 	}
1000 
1001 	return (0);
1002 fail:
1003 	otus_free_cmd_list(sc, cmd, ndata);
1004 	return (error);
1005 }
1006 
1007 static int
1008 otus_alloc_tx_cmd_list(struct otus_softc *sc)
1009 {
1010 	int error, i;
1011 
1012 	error = otus_alloc_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT,
1013 	    OTUS_MAX_TXCMDSZ);
1014 	if (error != 0)
1015 		return (error);
1016 
1017 	STAILQ_INIT(&sc->sc_cmd_active);
1018 	STAILQ_INIT(&sc->sc_cmd_inactive);
1019 	STAILQ_INIT(&sc->sc_cmd_pending);
1020 	STAILQ_INIT(&sc->sc_cmd_waiting);
1021 
1022 	for (i = 0; i < OTUS_CMD_LIST_COUNT; i++)
1023 		STAILQ_INSERT_HEAD(&sc->sc_cmd_inactive, &sc->sc_cmd[i],
1024 		    next_cmd);
1025 
1026 	return (0);
1027 }
1028 
1029 static void
1030 otus_free_tx_cmd_list(struct otus_softc *sc)
1031 {
1032 
1033 	/*
1034 	 * XXX TODO: something needs to wake up any pending/sleeping
1035 	 * waiters!
1036 	 */
1037 	STAILQ_INIT(&sc->sc_cmd_active);
1038 	STAILQ_INIT(&sc->sc_cmd_inactive);
1039 	STAILQ_INIT(&sc->sc_cmd_pending);
1040 	STAILQ_INIT(&sc->sc_cmd_waiting);
1041 
1042 	otus_free_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT);
1043 }
1044 
1045 static int
1046 otus_alloc_list(struct otus_softc *sc, struct otus_data data[],
1047     int ndata, int maxsz)
1048 {
1049 	int i, error;
1050 
1051 	for (i = 0; i < ndata; i++) {
1052 		struct otus_data *dp = &data[i];
1053 		dp->sc = sc;
1054 		dp->m = NULL;
1055 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1056 		if (dp->buf == NULL) {
1057 			device_printf(sc->sc_dev,
1058 			    "could not allocate buffer\n");
1059 			error = ENOMEM;
1060 			goto fail;
1061 		}
1062 		dp->ni = NULL;
1063 	}
1064 
1065 	return (0);
1066 fail:
1067 	otus_free_list(sc, data, ndata);
1068 	return (error);
1069 }
1070 
1071 static int
1072 otus_alloc_rx_list(struct otus_softc *sc)
1073 {
1074 	int error, i;
1075 
1076 	error = otus_alloc_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT,
1077 	    OTUS_RXBUFSZ);
1078 	if (error != 0)
1079 		return (error);
1080 
1081 	STAILQ_INIT(&sc->sc_rx_active);
1082 	STAILQ_INIT(&sc->sc_rx_inactive);
1083 
1084 	for (i = 0; i < OTUS_RX_LIST_COUNT; i++)
1085 		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1086 
1087 	return (0);
1088 }
1089 
1090 static int
1091 otus_alloc_tx_list(struct otus_softc *sc)
1092 {
1093 	int error, i;
1094 
1095 	error = otus_alloc_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT,
1096 	    OTUS_TXBUFSZ);
1097 	if (error != 0)
1098 		return (error);
1099 
1100 	STAILQ_INIT(&sc->sc_tx_inactive);
1101 
1102 	for (i = 0; i != OTUS_N_XFER; i++) {
1103 		STAILQ_INIT(&sc->sc_tx_active[i]);
1104 		STAILQ_INIT(&sc->sc_tx_pending[i]);
1105 	}
1106 
1107 	for (i = 0; i < OTUS_TX_LIST_COUNT; i++) {
1108 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1109 	}
1110 
1111 	return (0);
1112 }
1113 
1114 static void
1115 otus_free_tx_list(struct otus_softc *sc)
1116 {
1117 	int i;
1118 
1119 	/* prevent further allocations from TX list(s) */
1120 	STAILQ_INIT(&sc->sc_tx_inactive);
1121 
1122 	for (i = 0; i != OTUS_N_XFER; i++) {
1123 		STAILQ_INIT(&sc->sc_tx_active[i]);
1124 		STAILQ_INIT(&sc->sc_tx_pending[i]);
1125 	}
1126 
1127 	otus_free_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT);
1128 }
1129 
1130 static void
1131 otus_free_rx_list(struct otus_softc *sc)
1132 {
1133 	/* prevent further allocations from RX list(s) */
1134 	STAILQ_INIT(&sc->sc_rx_inactive);
1135 	STAILQ_INIT(&sc->sc_rx_active);
1136 
1137 	otus_free_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT);
1138 }
1139 
1140 static void
1141 otus_free_list(struct otus_softc *sc, struct otus_data data[], int ndata)
1142 {
1143 	int i;
1144 
1145 	for (i = 0; i < ndata; i++) {
1146 		struct otus_data *dp = &data[i];
1147 
1148 		if (dp->buf != NULL) {
1149 			free(dp->buf, M_USBDEV);
1150 			dp->buf = NULL;
1151 		}
1152 		if (dp->ni != NULL) {
1153 			ieee80211_free_node(dp->ni);
1154 			dp->ni = NULL;
1155 		}
1156 	}
1157 }
1158 
1159 static struct otus_data *
1160 _otus_getbuf(struct otus_softc *sc)
1161 {
1162 	struct otus_data *bf;
1163 
1164 	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1165 	if (bf != NULL)
1166 		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1167 	else
1168 		bf = NULL;
1169 	return (bf);
1170 }
1171 
1172 static struct otus_data *
1173 otus_getbuf(struct otus_softc *sc)
1174 {
1175 	struct otus_data *bf;
1176 
1177 	OTUS_LOCK_ASSERT(sc);
1178 
1179 	bf = _otus_getbuf(sc);
1180 	return (bf);
1181 }
1182 
1183 static void
1184 otus_freebuf(struct otus_softc *sc, struct otus_data *bf)
1185 {
1186 
1187 	OTUS_LOCK_ASSERT(sc);
1188 	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
1189 }
1190 
1191 static struct otus_tx_cmd *
1192 _otus_get_txcmd(struct otus_softc *sc)
1193 {
1194 	struct otus_tx_cmd *bf;
1195 
1196 	bf = STAILQ_FIRST(&sc->sc_cmd_inactive);
1197 	if (bf != NULL)
1198 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_inactive, next_cmd);
1199 	else
1200 		bf = NULL;
1201 	return (bf);
1202 }
1203 
1204 static struct otus_tx_cmd *
1205 otus_get_txcmd(struct otus_softc *sc)
1206 {
1207 	struct otus_tx_cmd *bf;
1208 
1209 	OTUS_LOCK_ASSERT(sc);
1210 
1211 	bf = _otus_get_txcmd(sc);
1212 	if (bf == NULL) {
1213 		device_printf(sc->sc_dev, "%s: no tx cmd buffers\n",
1214 		    __func__);
1215 	}
1216 	return (bf);
1217 }
1218 
1219 static void
1220 otus_free_txcmd(struct otus_softc *sc, struct otus_tx_cmd *bf)
1221 {
1222 
1223 	OTUS_LOCK_ASSERT(sc);
1224 	STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, bf, next_cmd);
1225 }
1226 
1227 void
1228 otus_next_scan(void *arg, int pending)
1229 {
1230 #if 0
1231 	struct otus_softc *sc = arg;
1232 
1233 	if (usbd_is_dying(sc->sc_udev))
1234 		return;
1235 
1236 	usbd_ref_incr(sc->sc_udev);
1237 
1238 	if (sc->sc_ic.ic_state == IEEE80211_S_SCAN)
1239 		ieee80211_next_scan(&sc->sc_ic.ic_if);
1240 
1241 	usbd_ref_decr(sc->sc_udev);
1242 #endif
1243 }
1244 
1245 int
1246 otus_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1247 {
1248 	struct otus_vap *uvp = OTUS_VAP(vap);
1249 	struct ieee80211com *ic = vap->iv_ic;
1250 	struct otus_softc *sc = ic->ic_softc;
1251 	struct ieee80211_node *ni;
1252 	enum ieee80211_state ostate;
1253 
1254 	ostate = vap->iv_state;
1255 	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1256 	    ieee80211_state_name[ostate],
1257 	    ieee80211_state_name[nstate]);
1258 
1259 	IEEE80211_UNLOCK(ic);
1260 
1261 	OTUS_LOCK(sc);
1262 
1263 	/* XXX TODO: more fleshing out! */
1264 
1265 	switch (nstate) {
1266 	case IEEE80211_S_RUN:
1267 		ni = ieee80211_ref_node(vap->iv_bss);
1268 
1269 		if (ic->ic_opmode == IEEE80211_M_STA) {
1270 			otus_updateslot(sc);
1271 			otus_set_bssid(sc, ni->ni_bssid);
1272 
1273 			/* Start calibration timer. */
1274 			taskqueue_enqueue_timeout(taskqueue_thread,
1275 			    &sc->calib_to, hz);
1276 		}
1277 		break;
1278 	default:
1279 		break;
1280 	}
1281 
1282 	/* XXX TODO: calibration? */
1283 
1284 	sc->sc_led_newstate(sc);
1285 
1286 	OTUS_UNLOCK(sc);
1287 	IEEE80211_LOCK(ic);
1288 	return (uvp->newstate(vap, nstate, arg));
1289 }
1290 
1291 int
1292 otus_cmd(struct otus_softc *sc, uint8_t code, const void *idata, int ilen,
1293     void *odata, int odatalen)
1294 {
1295 	struct otus_tx_cmd *cmd;
1296 	struct ar_cmd_hdr *hdr;
1297 	int xferlen, error;
1298 
1299 	OTUS_LOCK_ASSERT(sc);
1300 
1301 	/* Always bulk-out a multiple of 4 bytes. */
1302 	xferlen = (sizeof (*hdr) + ilen + 3) & ~3;
1303 	if (xferlen > OTUS_MAX_TXCMDSZ) {
1304 		device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n",
1305 		    __func__,
1306 		    code,
1307 		    xferlen,
1308 		    OTUS_MAX_TXCMDSZ);
1309 		return (EIO);
1310 	}
1311 
1312 	cmd = otus_get_txcmd(sc);
1313 	if (cmd == NULL) {
1314 		device_printf(sc->sc_dev, "%s: failed to get buf\n",
1315 		    __func__);
1316 		return (EIO);
1317 	}
1318 
1319 	hdr = (struct ar_cmd_hdr *)cmd->buf;
1320 	hdr->code  = code;
1321 	hdr->len   = ilen;
1322 	hdr->token = ++sc->token;	/* Don't care about endianness. */
1323 	cmd->token = hdr->token;
1324 	/* XXX TODO: check max cmd length? */
1325 	memcpy((uint8_t *)&hdr[1], idata, ilen);
1326 
1327 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
1328 	    "%s: sending command code=0x%02x len=%d token=%d\n",
1329 	    __func__, code, ilen, hdr->token);
1330 
1331 	cmd->odata = odata;
1332 	cmd->odatalen = odatalen;
1333 	cmd->buflen = xferlen;
1334 
1335 	/* Queue the command to the endpoint */
1336 	STAILQ_INSERT_TAIL(&sc->sc_cmd_pending, cmd, next_cmd);
1337 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_CMD]);
1338 
1339 	/* Sleep on the command; wait for it to complete */
1340 	error = msleep(cmd, &sc->sc_mtx, PCATCH, "otuscmd", hz);
1341 
1342 	/*
1343 	 * At this point we don't own cmd any longer; it'll be
1344 	 * freed by the cmd bulk path or the RX notification
1345 	 * path.  If the data is made available then it'll be copied
1346 	 * to the caller.  All that is left to do is communicate
1347 	 * status back to the caller.
1348 	 */
1349 	if (error != 0) {
1350 		device_printf(sc->sc_dev,
1351 		    "%s: timeout waiting for command 0x%02x reply\n",
1352 		    __func__, code);
1353 	}
1354 	return error;
1355 }
1356 
1357 void
1358 otus_write(struct otus_softc *sc, uint32_t reg, uint32_t val)
1359 {
1360 
1361 	OTUS_LOCK_ASSERT(sc);
1362 
1363 	sc->write_buf[sc->write_idx].reg = htole32(reg);
1364 	sc->write_buf[sc->write_idx].val = htole32(val);
1365 
1366 	if (++sc->write_idx > (AR_MAX_WRITE_IDX-1))
1367 		(void)otus_write_barrier(sc);
1368 }
1369 
1370 int
1371 otus_write_barrier(struct otus_softc *sc)
1372 {
1373 	int error;
1374 
1375 	OTUS_LOCK_ASSERT(sc);
1376 
1377 	if (sc->write_idx == 0)
1378 		return 0;	/* Nothing to flush. */
1379 
1380 	OTUS_DPRINTF(sc, OTUS_DEBUG_REGIO, "%s: called; %d updates\n",
1381 	    __func__,
1382 	    sc->write_idx);
1383 
1384 	error = otus_cmd(sc, AR_CMD_WREG, sc->write_buf,
1385 	    sizeof (sc->write_buf[0]) * sc->write_idx, NULL, 0);
1386 	sc->write_idx = 0;
1387 	return error;
1388 }
1389 
1390 struct ieee80211_node *
1391 otus_node_alloc(struct ieee80211com *ic)
1392 {
1393 	return malloc(sizeof (struct otus_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1394 }
1395 
1396 #if 0
1397 int
1398 otus_media_change(struct ifnet *ifp)
1399 {
1400 	struct otus_softc *sc = ifp->if_softc;
1401 	struct ieee80211com *ic = &sc->sc_ic;
1402 	uint8_t rate, ridx;
1403 	int error;
1404 
1405 	error = ieee80211_media_change(ifp);
1406 	if (error != ENETRESET)
1407 		return error;
1408 
1409 	if (ic->ic_fixed_rate != -1) {
1410 		rate = ic->ic_sup_rates[ic->ic_curmode].
1411 		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
1412 		for (ridx = 0; ridx <= OTUS_RIDX_MAX; ridx++)
1413 			if (otus_rates[ridx].rate == rate)
1414 				break;
1415 		sc->fixed_ridx = ridx;
1416 	}
1417 
1418 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
1419 		error = otus_init(sc);
1420 
1421 	return error;
1422 }
1423 #endif
1424 
1425 int
1426 otus_read_eeprom(struct otus_softc *sc)
1427 {
1428 	uint32_t regs[8], reg;
1429 	uint8_t *eep;
1430 	int i, j, error;
1431 
1432 	OTUS_LOCK_ASSERT(sc);
1433 
1434 	/* Read EEPROM by blocks of 32 bytes. */
1435 	eep = (uint8_t *)&sc->eeprom;
1436 	reg = AR_EEPROM_OFFSET;
1437 	for (i = 0; i < sizeof (sc->eeprom) / 32; i++) {
1438 		for (j = 0; j < 8; j++, reg += 4)
1439 			regs[j] = htole32(reg);
1440 		error = otus_cmd(sc, AR_CMD_RREG, regs, sizeof regs, eep, 32);
1441 		if (error != 0)
1442 			break;
1443 		eep += 32;
1444 	}
1445 	return error;
1446 }
1447 
1448 void
1449 otus_newassoc(struct ieee80211_node *ni, int isnew)
1450 {
1451 	struct ieee80211com *ic = ni->ni_ic;
1452 	struct otus_softc *sc = ic->ic_softc;
1453 	struct otus_node *on = OTUS_NODE(ni);
1454 
1455 	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "new assoc isnew=%d addr=%s\n",
1456 	    isnew, ether_sprintf(ni->ni_macaddr));
1457 
1458 	on->tx_done = 0;
1459 	on->tx_err = 0;
1460 	on->tx_retries = 0;
1461 }
1462 
1463 static void
1464 otus_cmd_handle_response(struct otus_softc *sc, struct ar_cmd_hdr *hdr)
1465 {
1466 	struct otus_tx_cmd *cmd;
1467 
1468 	OTUS_LOCK_ASSERT(sc);
1469 
1470 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1471 	    "%s: received reply code=0x%02x len=%d token=%d\n",
1472 	    __func__,
1473 	    hdr->code, hdr->len, hdr->token);
1474 
1475 	/*
1476 	 * Walk the list, freeing items that aren't ours,
1477 	 * stopping when we hit our token.
1478 	 */
1479 	while ((cmd = STAILQ_FIRST(&sc->sc_cmd_waiting)) != NULL) {
1480 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_waiting, next_cmd);
1481 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1482 		    "%s: cmd=%p; hdr.token=%d, cmd.token=%d\n",
1483 		    __func__,
1484 		    cmd,
1485 		    (int) hdr->token,
1486 		    (int) cmd->token);
1487 		if (hdr->token == cmd->token) {
1488 			/* Copy answer into caller's supplied buffer. */
1489 			if (cmd->odata != NULL) {
1490 				if (hdr->len != cmd->odatalen) {
1491 					device_printf(sc->sc_dev,
1492 					    "%s: code 0x%02x, len=%d, olen=%d\n",
1493 					    __func__,
1494 					    (int) hdr->code,
1495 					    (int) hdr->len,
1496 					    (int) cmd->odatalen);
1497 				}
1498 				memcpy(cmd->odata, &hdr[1],
1499 				    MIN(cmd->odatalen, hdr->len));
1500 			}
1501 			wakeup(cmd);
1502 		}
1503 
1504 		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next_cmd);
1505 	}
1506 }
1507 
1508 void
1509 otus_cmd_rxeof(struct otus_softc *sc, uint8_t *buf, int len)
1510 {
1511 	struct ieee80211com *ic = &sc->sc_ic;
1512 	struct ar_cmd_hdr *hdr;
1513 
1514 	OTUS_LOCK_ASSERT(sc);
1515 
1516 	if (__predict_false(len < sizeof (*hdr))) {
1517 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1518 		    "cmd too small %d\n", len);
1519 		return;
1520 	}
1521 	hdr = (struct ar_cmd_hdr *)buf;
1522 	if (__predict_false(sizeof (*hdr) + hdr->len > len ||
1523 	    sizeof (*hdr) + hdr->len > 64)) {
1524 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1525 		    "cmd too large %d\n", hdr->len);
1526 		return;
1527 	}
1528 
1529 	OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1530 	    "%s: code=%.02x\n",
1531 	    __func__,
1532 	    hdr->code);
1533 
1534 	/*
1535 	 * This has to reach into the cmd queue "waiting for
1536 	 * an RX response" list, grab the head entry and check
1537 	 * if we need to wake anyone up.
1538 	 */
1539 	if ((hdr->code & 0xc0) != 0xc0) {
1540 		otus_cmd_handle_response(sc, hdr);
1541 		return;
1542 	}
1543 
1544 	/* Received unsolicited notification. */
1545 	switch (hdr->code & 0x3f) {
1546 	case AR_EVT_BEACON:
1547 		break;
1548 	case AR_EVT_TX_COMP:
1549 	{
1550 		struct ar_evt_tx_comp *tx = (struct ar_evt_tx_comp *)&hdr[1];
1551 		struct ieee80211_node *ni;
1552 
1553 		ni = ieee80211_find_node(&ic->ic_sta, tx->macaddr);
1554 		if (ni == NULL) {
1555 			device_printf(sc->sc_dev,
1556 			    "%s: txcomp on unknown node (%s)\n",
1557 			    __func__,
1558 			    ether_sprintf(tx->macaddr));
1559 			break;
1560 		}
1561 
1562 		OTUS_DPRINTF(sc, OTUS_DEBUG_TXCOMP,
1563 		    "tx completed %s status=%d phy=0x%x\n",
1564 		    ether_sprintf(tx->macaddr), le16toh(tx->status),
1565 		    le32toh(tx->phy));
1566 
1567 		switch (le16toh(tx->status)) {
1568 		case AR_TX_STATUS_COMP:
1569 #if 0
1570 			ackfailcnt = 0;
1571 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1572 			    IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
1573 #endif
1574 			/*
1575 			 * We don't get the above; only error notifications.
1576 			 * Sigh.  So, don't worry about this.
1577 			 */
1578 			break;
1579 		case AR_TX_STATUS_RETRY_COMP:
1580 			OTUS_NODE(ni)->tx_retries++;
1581 			break;
1582 		case AR_TX_STATUS_FAILED:
1583 			OTUS_NODE(ni)->tx_err++;
1584 			break;
1585 		}
1586 		ieee80211_free_node(ni);
1587 		break;
1588 	}
1589 	case AR_EVT_TBTT:
1590 		break;
1591 	case AR_EVT_DO_BB_RESET:
1592 		/*
1593 		 * This is "tell driver to reset baseband" from ar9170-fw.
1594 		 *
1595 		 * I'm not sure what we should do here, so I'm going to
1596 		 * fall through; it gets generated when RTSRetryCnt internally
1597 		 * reaches '5' - I guess the firmware authors thought that
1598 		 * meant that the BB may have gone deaf or something.
1599 		 */
1600 	default:
1601 		device_printf(sc->sc_dev,
1602 		    "%s: received notification code=0x%02x len=%d\n",
1603 		    __func__,
1604 		    hdr->code, hdr->len);
1605 	}
1606 }
1607 
1608 void
1609 otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len, struct mbufq *rxq)
1610 {
1611 	struct ieee80211com *ic = &sc->sc_ic;
1612 	struct ieee80211_rx_stats rxs;
1613 #if 0
1614 	struct ieee80211_node *ni;
1615 #endif
1616 	struct ar_rx_tail *tail;
1617 	struct ieee80211_frame *wh;
1618 	struct mbuf *m;
1619 	uint8_t *plcp;
1620 //	int s;
1621 	int mlen;
1622 
1623 	if (__predict_false(len < AR_PLCP_HDR_LEN)) {
1624 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1625 		    "sub-xfer too short %d\n", len);
1626 		return;
1627 	}
1628 	plcp = buf;
1629 
1630 	/* All bits in the PLCP header are set to 1 for non-MPDU. */
1631 	if (memcmp(plcp, AR_PLCP_HDR_INTR, AR_PLCP_HDR_LEN) == 0) {
1632 		otus_cmd_rxeof(sc, plcp + AR_PLCP_HDR_LEN,
1633 		    len - AR_PLCP_HDR_LEN);
1634 		return;
1635 	}
1636 
1637 	/* Received MPDU. */
1638 	if (__predict_false(len < AR_PLCP_HDR_LEN + sizeof (*tail))) {
1639 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "MPDU too short %d\n", len);
1640 		counter_u64_add(ic->ic_ierrors, 1);
1641 		return;
1642 	}
1643 	tail = (struct ar_rx_tail *)(plcp + len - sizeof (*tail));
1644 
1645 	/* Discard error frames. */
1646 	if (__predict_false(tail->error != 0)) {
1647 		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "error frame 0x%02x\n", tail->error);
1648 		if (tail->error & AR_RX_ERROR_FCS) {
1649 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "bad FCS\n");
1650 		} else if (tail->error & AR_RX_ERROR_MMIC) {
1651 			/* Report Michael MIC failures to net80211. */
1652 #if 0
1653 			ieee80211_notify_michael_failure(ni->ni_vap, wh, keyidx);
1654 #endif
1655 			device_printf(sc->sc_dev, "%s: MIC failure\n", __func__);
1656 		}
1657 		counter_u64_add(ic->ic_ierrors, 1);
1658 		return;
1659 	}
1660 	/* Compute MPDU's length. */
1661 	mlen = len - AR_PLCP_HDR_LEN - sizeof (*tail);
1662 	/* Make sure there's room for an 802.11 header + FCS. */
1663 	if (__predict_false(mlen < IEEE80211_MIN_LEN)) {
1664 		counter_u64_add(ic->ic_ierrors, 1);
1665 		return;
1666 	}
1667 	mlen -= IEEE80211_CRC_LEN;	/* strip 802.11 FCS */
1668 
1669 	wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN);
1670 
1671 	m = m_get2(mlen, M_NOWAIT, MT_DATA, M_PKTHDR);
1672 	if (m == NULL) {
1673 		device_printf(sc->sc_dev, "%s: failed m_get2()\n", __func__);
1674 		counter_u64_add(ic->ic_ierrors, 1);
1675 	}
1676 
1677 	/* Finalize mbuf. */
1678 	memcpy(mtod(m, uint8_t *), wh, mlen);
1679 	m->m_pkthdr.len = m->m_len = mlen;
1680 
1681 #if 0
1682 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1683 		struct otus_rx_radiotap_header *tap = &sc->sc_rxtap;
1684 		struct mbuf mb;
1685 
1686 		tap->wr_flags = 0;
1687 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1688 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1689 		tap->wr_antsignal = tail->rssi;
1690 		tap->wr_rate = 2;	/* In case it can't be found below. */
1691 		switch (tail->status & AR_RX_STATUS_MT_MASK) {
1692 		case AR_RX_STATUS_MT_CCK:
1693 			switch (plcp[0]) {
1694 			case  10: tap->wr_rate =   2; break;
1695 			case  20: tap->wr_rate =   4; break;
1696 			case  55: tap->wr_rate =  11; break;
1697 			case 110: tap->wr_rate =  22; break;
1698 			}
1699 			if (tail->status & AR_RX_STATUS_SHPREAMBLE)
1700 				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1701 			break;
1702 		case AR_RX_STATUS_MT_OFDM:
1703 			switch (plcp[0] & 0xf) {
1704 			case 0xb: tap->wr_rate =  12; break;
1705 			case 0xf: tap->wr_rate =  18; break;
1706 			case 0xa: tap->wr_rate =  24; break;
1707 			case 0xe: tap->wr_rate =  36; break;
1708 			case 0x9: tap->wr_rate =  48; break;
1709 			case 0xd: tap->wr_rate =  72; break;
1710 			case 0x8: tap->wr_rate =  96; break;
1711 			case 0xc: tap->wr_rate = 108; break;
1712 			}
1713 			break;
1714 		}
1715 		mb.m_data = (caddr_t)tap;
1716 		mb.m_len = sc->sc_rxtap_len;
1717 		mb.m_next = m;
1718 		mb.m_nextpkt = NULL;
1719 		mb.m_type = 0;
1720 		mb.m_flags = 0;
1721 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1722 	}
1723 #endif
1724 
1725 	/* Add RSSI/NF to this mbuf */
1726 	bzero(&rxs, sizeof(rxs));
1727 	rxs.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
1728 	rxs.nf = sc->sc_nf[0];	/* XXX chain 0 != combined rssi/nf */
1729 	rxs.rssi = tail->rssi;
1730 	/* XXX TODO: add MIMO RSSI/NF as well */
1731 	ieee80211_add_rx_params(m, &rxs);
1732 
1733 	/* XXX make a method */
1734 	STAILQ_INSERT_TAIL(&rxq->mq_head, m, m_stailqpkt);
1735 
1736 #if 0
1737 	OTUS_UNLOCK(sc);
1738 	ni = ieee80211_find_rxnode(ic, wh);
1739 	rxi.rxi_flags = 0;
1740 	rxi.rxi_rssi = tail->rssi;
1741 	rxi.rxi_tstamp = 0;	/* unused */
1742 	ieee80211_input(ifp, m, ni, &rxi);
1743 
1744 	/* Node is no longer needed. */
1745 	ieee80211_release_node(ic, ni);
1746 	OTUS_LOCK(sc);
1747 #endif
1748 }
1749 
1750 static void
1751 otus_rxeof(struct usb_xfer *xfer, struct otus_data *data, struct mbufq *rxq)
1752 {
1753 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1754 	caddr_t buf = data->buf;
1755 	struct ar_rx_head *head;
1756 	uint16_t hlen;
1757 	int len;
1758 
1759 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
1760 
1761 	while (len >= sizeof (*head)) {
1762 		head = (struct ar_rx_head *)buf;
1763 		if (__predict_false(head->tag != htole16(AR_RX_HEAD_TAG))) {
1764 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1765 			    "tag not valid 0x%x\n", le16toh(head->tag));
1766 			break;
1767 		}
1768 		hlen = le16toh(head->len);
1769 		if (__predict_false(sizeof (*head) + hlen > len)) {
1770 			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1771 			    "xfer too short %d/%d\n", len, hlen);
1772 			break;
1773 		}
1774 		/* Process sub-xfer. */
1775 		otus_sub_rxeof(sc, (uint8_t *)&head[1], hlen, rxq);
1776 
1777 		/* Next sub-xfer is aligned on a 32-bit boundary. */
1778 		hlen = (sizeof (*head) + hlen + 3) & ~3;
1779 		buf += hlen;
1780 		len -= hlen;
1781 	}
1782 }
1783 
1784 static void
1785 otus_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1786 {
1787 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1788 	struct ieee80211com *ic = &sc->sc_ic;
1789 	struct ieee80211_frame *wh;
1790 	struct ieee80211_node *ni;
1791 	struct mbuf *m;
1792 	struct mbufq scrx;
1793 	struct otus_data *data;
1794 
1795 	OTUS_LOCK_ASSERT(sc);
1796 
1797 	mbufq_init(&scrx, 1024);
1798 
1799 #if 0
1800 	device_printf(sc->sc_dev, "%s: called; state=%d; error=%d\n",
1801 	    __func__,
1802 	    USB_GET_STATE(xfer),
1803 	    error);
1804 #endif
1805 
1806 	switch (USB_GET_STATE(xfer)) {
1807 	case USB_ST_TRANSFERRED:
1808 		data = STAILQ_FIRST(&sc->sc_rx_active);
1809 		if (data == NULL)
1810 			goto tr_setup;
1811 		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1812 		otus_rxeof(xfer, data, &scrx);
1813 		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1814 		/* FALLTHROUGH */
1815 	case USB_ST_SETUP:
1816 tr_setup:
1817 		/*
1818 		 * XXX TODO: what if sc_rx isn't empty, but data
1819 		 * is empty?  Then we leak mbufs.
1820 		 */
1821 		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1822 		if (data == NULL) {
1823 			//KASSERT(m == NULL, ("mbuf isn't NULL"));
1824 			return;
1825 		}
1826 		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1827 		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1828 		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1829 		    usbd_xfer_max_len(xfer));
1830 		usbd_transfer_submit(xfer);
1831 		/*
1832 		 * To avoid LOR we should unlock our private mutex here to call
1833 		 * ieee80211_input() because here is at the end of a USB
1834 		 * callback and safe to unlock.
1835 		 */
1836 		OTUS_UNLOCK(sc);
1837 		while ((m = mbufq_dequeue(&scrx)) != NULL) {
1838 			wh = mtod(m, struct ieee80211_frame *);
1839 			ni = ieee80211_find_rxnode(ic,
1840 			    (struct ieee80211_frame_min *)wh);
1841 			if (ni != NULL) {
1842 				if (ni->ni_flags & IEEE80211_NODE_HT)
1843 					m->m_flags |= M_AMPDU;
1844 				(void)ieee80211_input_mimo(ni, m, NULL);
1845 				ieee80211_free_node(ni);
1846 			} else
1847 				(void)ieee80211_input_mimo_all(ic, m, NULL);
1848 		}
1849 #ifdef	IEEE80211_SUPPORT_SUPERG
1850 		ieee80211_ff_age_all(ic, 100);
1851 #endif
1852 		OTUS_LOCK(sc);
1853 		break;
1854 	default:
1855 		/* needs it to the inactive queue due to a error. */
1856 		data = STAILQ_FIRST(&sc->sc_rx_active);
1857 		if (data != NULL) {
1858 			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1859 			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1860 		}
1861 		if (error != USB_ERR_CANCELLED) {
1862 			usbd_xfer_set_stall(xfer);
1863 			counter_u64_add(ic->ic_ierrors, 1);
1864 			goto tr_setup;
1865 		}
1866 		break;
1867 	}
1868 }
1869 
1870 static void
1871 otus_txeof(struct usb_xfer *xfer, struct otus_data *data)
1872 {
1873 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1874 
1875 	OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1876 	    "%s: called; data=%p\n", __func__, data);
1877 
1878 	OTUS_LOCK_ASSERT(sc);
1879 
1880 	if (sc->sc_tx_n_active == 0) {
1881 		device_printf(sc->sc_dev,
1882 		    "%s: completed but tx_active=0\n",
1883 		    __func__);
1884 	} else {
1885 		sc->sc_tx_n_active--;
1886 	}
1887 
1888 	if (data->m) {
1889 		/* XXX status? */
1890 		/* XXX we get TX status via the RX path.. */
1891 		ieee80211_tx_complete(data->ni, data->m, 0);
1892 		data->m = NULL;
1893 		data->ni = NULL;
1894 	}
1895 }
1896 
1897 static void
1898 otus_txcmdeof(struct usb_xfer *xfer, struct otus_tx_cmd *cmd)
1899 {
1900 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1901 
1902 	OTUS_LOCK_ASSERT(sc);
1903 
1904 	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1905 	    "%s: called; data=%p; odata=%p\n",
1906 	    __func__, cmd, cmd->odata);
1907 
1908 	/*
1909 	 * Non-response commands still need wakeup so the caller
1910 	 * knows it was submitted and completed OK; response commands should
1911 	 * wait until they're ACKed by the firmware with a response.
1912 	 */
1913 	if (cmd->odata) {
1914 		STAILQ_INSERT_TAIL(&sc->sc_cmd_waiting, cmd, next_cmd);
1915 	} else {
1916 		wakeup(cmd);
1917 		otus_free_txcmd(sc, cmd);
1918 	}
1919 }
1920 
1921 static void
1922 otus_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1923 {
1924 	uint8_t which = OTUS_BULK_TX;
1925 	struct otus_softc *sc = usbd_xfer_softc(xfer);
1926 	struct ieee80211com *ic = &sc->sc_ic;
1927 	struct otus_data *data;
1928 
1929 	OTUS_LOCK_ASSERT(sc);
1930 
1931 	switch (USB_GET_STATE(xfer)) {
1932 	case USB_ST_TRANSFERRED:
1933 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1934 		if (data == NULL)
1935 			goto tr_setup;
1936 		OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1937 		    "%s: transfer done %p\n", __func__, data);
1938 		STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1939 		otus_txeof(xfer, data);
1940 		otus_freebuf(sc, data);
1941 		/* FALLTHROUGH */
1942 	case USB_ST_SETUP:
1943 tr_setup:
1944 		data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
1945 		if (data == NULL) {
1946 			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1947 			    "%s: empty pending queue sc %p\n", __func__, sc);
1948 			sc->sc_tx_n_active = 0;
1949 			goto finish;
1950 		}
1951 		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
1952 		STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
1953 		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1954 		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1955 		    "%s: submitting transfer %p\n", __func__, data);
1956 		usbd_transfer_submit(xfer);
1957 		sc->sc_tx_n_active++;
1958 		break;
1959 	default:
1960 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1961 		if (data != NULL) {
1962 			STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1963 			otus_txeof(xfer, data);
1964 			otus_freebuf(sc, data);
1965 		}
1966 		counter_u64_add(ic->ic_oerrors, 1);
1967 
1968 		if (error != USB_ERR_CANCELLED) {
1969 			usbd_xfer_set_stall(xfer);
1970 			goto tr_setup;
1971 		}
1972 		break;
1973 	}
1974 
1975 finish:
1976 #ifdef	IEEE80211_SUPPORT_SUPERG
1977 	/*
1978 	 * If the TX active queue drops below a certain
1979 	 * threshold, ensure we age fast-frames out so they're
1980 	 * transmitted.
1981 	 */
1982 	if (sc->sc_tx_n_active < 2) {
1983 		/* XXX ew - net80211 should defer this for us! */
1984 		OTUS_UNLOCK(sc);
1985 		ieee80211_ff_flush(ic, WME_AC_VO);
1986 		ieee80211_ff_flush(ic, WME_AC_VI);
1987 		ieee80211_ff_flush(ic, WME_AC_BE);
1988 		ieee80211_ff_flush(ic, WME_AC_BK);
1989 		OTUS_LOCK(sc);
1990 	}
1991 #endif
1992 	/* Kick TX */
1993 	otus_tx_start(sc);
1994 }
1995 
1996 static void
1997 otus_bulk_cmd_callback(struct usb_xfer *xfer, usb_error_t error)
1998 {
1999 	struct otus_softc *sc = usbd_xfer_softc(xfer);
2000 #if 0
2001 	struct ieee80211com *ic = &sc->sc_ic;
2002 #endif
2003 	struct otus_tx_cmd *cmd;
2004 
2005 	OTUS_LOCK_ASSERT(sc);
2006 
2007 	switch (USB_GET_STATE(xfer)) {
2008 	case USB_ST_TRANSFERRED:
2009 		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2010 		if (cmd == NULL)
2011 			goto tr_setup;
2012 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
2013 		    "%s: transfer done %p\n", __func__, cmd);
2014 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2015 		otus_txcmdeof(xfer, cmd);
2016 		/* FALLTHROUGH */
2017 	case USB_ST_SETUP:
2018 tr_setup:
2019 		cmd = STAILQ_FIRST(&sc->sc_cmd_pending);
2020 		if (cmd == NULL) {
2021 			OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2022 			    "%s: empty pending queue sc %p\n", __func__, sc);
2023 			return;
2024 		}
2025 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_pending, next_cmd);
2026 		STAILQ_INSERT_TAIL(&sc->sc_cmd_active, cmd, next_cmd);
2027 		usbd_xfer_set_frame_data(xfer, 0, cmd->buf, cmd->buflen);
2028 		OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2029 		    "%s: submitting transfer %p; buf=%p, buflen=%d\n", __func__, cmd, cmd->buf, cmd->buflen);
2030 		usbd_transfer_submit(xfer);
2031 		break;
2032 	default:
2033 		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2034 		if (cmd != NULL) {
2035 			STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2036 			otus_txcmdeof(xfer, cmd);
2037 		}
2038 
2039 		if (error != USB_ERR_CANCELLED) {
2040 			usbd_xfer_set_stall(xfer);
2041 			goto tr_setup;
2042 		}
2043 		break;
2044 	}
2045 }
2046 
2047 /*
2048  * This isn't used by carl9170; it however may be used by the
2049  * initial bootloader.
2050  */
2051 static void
2052 otus_bulk_irq_callback(struct usb_xfer *xfer, usb_error_t error)
2053 {
2054 	struct otus_softc *sc = usbd_xfer_softc(xfer);
2055 	int actlen;
2056 	int sumlen;
2057 
2058 	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
2059 	OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2060 	    "%s: called; state=%d\n", __func__, USB_GET_STATE(xfer));
2061 
2062 	switch (USB_GET_STATE(xfer)) {
2063 	case USB_ST_TRANSFERRED:
2064 		/*
2065 		 * Read usb frame data, if any.
2066 		 * "actlen" has the total length for all frames
2067 		 * transferred.
2068 		 */
2069 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2070 		    "%s: comp; %d bytes\n",
2071 		    __func__,
2072 		    actlen);
2073 #if 0
2074 		pc = usbd_xfer_get_frame(xfer, 0);
2075 		otus_dump_usb_rx_page(sc, pc, actlen);
2076 #endif
2077 		/* XXX fallthrough */
2078 	case USB_ST_SETUP:
2079 		/*
2080 		 * Setup xfer frame lengths/count and data
2081 		 */
2082 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: setup\n", __func__);
2083 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2084 		usbd_transfer_submit(xfer);
2085 		break;
2086 
2087 	default: /* Error */
2088 		/*
2089 		 * Print error message and clear stall
2090 		 * for example.
2091 		 */
2092 		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: ERROR?\n", __func__);
2093 		break;
2094 	}
2095 }
2096 
2097 /*
2098  * Map net80211 rate to hw rate for otus MAC/PHY.
2099  */
2100 static uint8_t
2101 otus_rate_to_hw_rate(struct otus_softc *sc, uint8_t rate)
2102 {
2103 	int is_2ghz;
2104 
2105 	is_2ghz = !! (IEEE80211_IS_CHAN_2GHZ(sc->sc_ic.ic_curchan));
2106 
2107 	switch (rate) {
2108 	/* CCK */
2109 	case 2:
2110 		return (0x0);
2111 	case 4:
2112 		return (0x1);
2113 	case 11:
2114 		return (0x2);
2115 	case 22:
2116 		return (0x3);
2117 	/* OFDM */
2118 	case 12:
2119 		return (0xb);
2120 	case 18:
2121 		return (0xf);
2122 	case 24:
2123 		return (0xa);
2124 	case 36:
2125 		return (0xe);
2126 	case 48:
2127 		return (0x9);
2128 	case 72:
2129 		return (0xd);
2130 	case 96:
2131 		return (0x8);
2132 	case 108:
2133 		return (0xc);
2134 	default:
2135 		device_printf(sc->sc_dev, "%s: unknown rate '%d'\n",
2136 		    __func__, (int) rate);
2137 	case 0:
2138 		if (is_2ghz)
2139 			return (0x0);	/* 1MB CCK */
2140 		else
2141 			return (0xb);	/* 6MB OFDM */
2142 
2143 	/* XXX TODO: HT */
2144 	}
2145 }
2146 
2147 static int
2148 otus_hw_rate_is_ofdm(struct otus_softc *sc, uint8_t hw_rate)
2149 {
2150 
2151 	switch (hw_rate) {
2152 	case 0x0:
2153 	case 0x1:
2154 	case 0x2:
2155 	case 0x3:
2156 		return (0);
2157 	default:
2158 		return (1);
2159 	}
2160 }
2161 
2162 
2163 static void
2164 otus_tx_update_ratectl(struct otus_softc *sc, struct ieee80211_node *ni)
2165 {
2166 	int tx, tx_success, tx_retry;
2167 
2168 	tx = OTUS_NODE(ni)->tx_done;
2169 	tx_success = OTUS_NODE(ni)->tx_done - OTUS_NODE(ni)->tx_err;
2170 	tx_retry = OTUS_NODE(ni)->tx_retries;
2171 
2172 	ieee80211_ratectl_tx_update(ni->ni_vap, ni, &tx, &tx_success,
2173 	    &tx_retry);
2174 }
2175 
2176 /*
2177  * XXX TODO: support tx bpf parameters for configuration!
2178  */
2179 static int
2180 otus_tx(struct otus_softc *sc, struct ieee80211_node *ni, struct mbuf *m,
2181     struct otus_data *data)
2182 {
2183 	struct ieee80211com *ic = &sc->sc_ic;
2184 	struct ieee80211vap *vap = ni->ni_vap;
2185 	struct ieee80211_frame *wh;
2186 	struct ieee80211_key *k;
2187 	struct ar_tx_head *head;
2188 	uint32_t phyctl;
2189 	uint16_t macctl, qos;
2190 	uint8_t qid, rate;
2191 	int hasqos, xferlen;
2192 
2193 	wh = mtod(m, struct ieee80211_frame *);
2194 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2195 		k = ieee80211_crypto_encap(ni, m);
2196 		if (k == NULL) {
2197 			device_printf(sc->sc_dev,
2198 			    "%s: m=%p: ieee80211_crypto_encap returns NULL\n",
2199 			    __func__,
2200 			    m);
2201 			return (ENOBUFS);
2202 		}
2203 		wh = mtod(m, struct ieee80211_frame *);
2204 	}
2205 
2206 	/* Calculate transfer length; ensure data buffer is large enough */
2207 	xferlen = sizeof (*head) + m->m_pkthdr.len;
2208 	if (xferlen > OTUS_TXBUFSZ) {
2209 		device_printf(sc->sc_dev,
2210 		    "%s: 802.11 TX frame is %d bytes, max %d bytes\n",
2211 		    __func__,
2212 		    xferlen,
2213 		    OTUS_TXBUFSZ);
2214 		return (ENOBUFS);
2215 	}
2216 
2217 	hasqos = !! IEEE80211_QOS_HAS_SEQ(wh);
2218 
2219 	if (hasqos) {
2220 		uint8_t tid;
2221 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2222 		tid = qos & IEEE80211_QOS_TID;
2223 		qid = TID_TO_WME_AC(tid);
2224 	} else {
2225 		qos = 0;
2226 		qid = WME_AC_BE;
2227 	}
2228 
2229 	/* Pickup a rate index. */
2230 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2231 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA) {
2232 		/* Get lowest rate */
2233 		rate = otus_rate_to_hw_rate(sc, 0);
2234 	} else {
2235 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
2236 		rate = otus_rate_to_hw_rate(sc, ni->ni_txrate);
2237 	}
2238 
2239 	phyctl = 0;
2240 	macctl = AR_TX_MAC_BACKOFF | AR_TX_MAC_HW_DUR | AR_TX_MAC_QID(qid);
2241 
2242 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2243 	    (hasqos && ((qos & IEEE80211_QOS_ACKPOLICY) ==
2244 	     IEEE80211_QOS_ACKPOLICY_NOACK)))
2245 		macctl |= AR_TX_MAC_NOACK;
2246 
2247 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2248 		if (m->m_pkthdr.len + IEEE80211_CRC_LEN >= vap->iv_rtsthreshold)
2249 			macctl |= AR_TX_MAC_RTS;
2250 		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2251 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2252 				macctl |= AR_TX_MAC_CTS;
2253 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2254 				macctl |= AR_TX_MAC_RTS;
2255 		}
2256 	}
2257 
2258 	phyctl |= AR_TX_PHY_MCS(rate);
2259 	if (otus_hw_rate_is_ofdm(sc, rate)) {
2260 		phyctl |= AR_TX_PHY_MT_OFDM;
2261 		/* Always use all tx antennas for now, just to be safe */
2262 		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2263 	} else {	/* CCK */
2264 		phyctl |= AR_TX_PHY_MT_CCK;
2265 		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2266 	}
2267 
2268 	/* Update net80211 with the current counters */
2269 	otus_tx_update_ratectl(sc, ni);
2270 
2271 	/* Update rate control stats for frames that are ACK'ed. */
2272 	if (!(macctl & AR_TX_MAC_NOACK))
2273 		OTUS_NODE(ni)->tx_done++;
2274 
2275 
2276 	/* Fill Tx descriptor. */
2277 	head = (struct ar_tx_head *)data->buf;
2278 	head->len = htole16(m->m_pkthdr.len + IEEE80211_CRC_LEN);
2279 	head->macctl = htole16(macctl);
2280 	head->phyctl = htole32(phyctl);
2281 
2282 	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&head[1]);
2283 
2284 	data->buflen = xferlen;
2285 	data->ni = ni;
2286 	data->m = m;
2287 
2288 	OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
2289 	    "%s: tx: m=%p; data=%p; len=%d mac=0x%04x phy=0x%08x rate=0x%02x, ni_txrate=%d\n",
2290 	    __func__, m, data, head->len, head->macctl, head->phyctl,
2291 	    (int) rate, (int) ni->ni_txrate);
2292 
2293 	/* Submit transfer */
2294 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending[OTUS_BULK_TX], data, next);
2295 	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_TX]);
2296 
2297 	return 0;
2298 }
2299 
2300 int
2301 otus_set_multi(struct otus_softc *sc)
2302 {
2303 	uint32_t lo, hi;
2304 	struct ieee80211com *ic = &sc->sc_ic;
2305 	int r;
2306 
2307 	if (ic->ic_allmulti > 0 || ic->ic_promisc > 0 ||
2308 	    ic->ic_opmode == IEEE80211_M_MONITOR) {
2309 		lo = 0xffffffff;
2310 		hi = 0xffffffff;
2311 	} else {
2312 		struct ieee80211vap *vap;
2313 		struct ifnet *ifp;
2314 		struct ifmultiaddr *ifma;
2315 
2316 		lo = hi = 0;
2317 		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
2318 			ifp = vap->iv_ifp;
2319 			if_maddr_rlock(ifp);
2320 			TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2321 				caddr_t dl;
2322 				uint32_t val;
2323 
2324 				dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
2325 				val = LE_READ_4(dl + 4);
2326 				/* Get address byte 5 */
2327 				val = val & 0x0000ff00;
2328 				val = val >> 8;
2329 
2330 				/* As per below, shift it >> 2 to get only 6 bits */
2331 				val = val >> 2;
2332 				if (val < 32)
2333 					lo |= 1 << val;
2334 				else
2335 					hi |= 1 << (val - 32);
2336 			}
2337 			if_maddr_runlock(ifp);
2338 		}
2339 	}
2340 #if 0
2341 	/* XXX openbsd code */
2342 	while (enm != NULL) {
2343 		bit = enm->enm_addrlo[5] >> 2;
2344 		if (bit < 32)
2345 			lo |= 1 << bit;
2346 		else
2347 			hi |= 1 << (bit - 32);
2348 		ETHER_NEXT_MULTI(step, enm);
2349 	}
2350 #endif
2351 
2352 	hi |= 1U << 31;	/* Make sure the broadcast bit is set. */
2353 
2354 	OTUS_LOCK(sc);
2355 	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_L, lo);
2356 	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_H, hi);
2357 	r = otus_write_barrier(sc);
2358 	OTUS_UNLOCK(sc);
2359 	return (r);
2360 }
2361 
2362 static void
2363 otus_updateedca(struct otus_softc *sc)
2364 {
2365 #define EXP2(val)	((1 << (val)) - 1)
2366 #define AIFS(val)	((val) * 9 + 10)
2367 	struct ieee80211com *ic = &sc->sc_ic;
2368 	const struct wmeParams *edca;
2369 
2370 	OTUS_LOCK_ASSERT(sc);
2371 
2372 	edca = ic->ic_wme.wme_chanParams.cap_wmeParams;
2373 
2374 	/* Set CWmin/CWmax values. */
2375 	otus_write(sc, AR_MAC_REG_AC0_CW,
2376 	    EXP2(edca[WME_AC_BE].wmep_logcwmax) << 16 |
2377 	    EXP2(edca[WME_AC_BE].wmep_logcwmin));
2378 	otus_write(sc, AR_MAC_REG_AC1_CW,
2379 	    EXP2(edca[WME_AC_BK].wmep_logcwmax) << 16 |
2380 	    EXP2(edca[WME_AC_BK].wmep_logcwmin));
2381 	otus_write(sc, AR_MAC_REG_AC2_CW,
2382 	    EXP2(edca[WME_AC_VI].wmep_logcwmax) << 16 |
2383 	    EXP2(edca[WME_AC_VI].wmep_logcwmin));
2384 	otus_write(sc, AR_MAC_REG_AC3_CW,
2385 	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2386 	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2387 	otus_write(sc, AR_MAC_REG_AC4_CW,		/* Special TXQ. */
2388 	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2389 	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2390 
2391 	/* Set AIFSN values. */
2392 	otus_write(sc, AR_MAC_REG_AC1_AC0_AIFS,
2393 	    AIFS(edca[WME_AC_VI].wmep_aifsn) << 24 |
2394 	    AIFS(edca[WME_AC_BK].wmep_aifsn) << 12 |
2395 	    AIFS(edca[WME_AC_BE].wmep_aifsn));
2396 	otus_write(sc, AR_MAC_REG_AC3_AC2_AIFS,
2397 	    AIFS(edca[WME_AC_VO].wmep_aifsn) << 16 |	/* Special TXQ. */
2398 	    AIFS(edca[WME_AC_VO].wmep_aifsn) <<  4 |
2399 	    AIFS(edca[WME_AC_VI].wmep_aifsn) >>  8);
2400 
2401 	/* Set TXOP limit. */
2402 	otus_write(sc, AR_MAC_REG_AC1_AC0_TXOP,
2403 	    edca[WME_AC_BK].wmep_txopLimit << 16 |
2404 	    edca[WME_AC_BE].wmep_txopLimit);
2405 	otus_write(sc, AR_MAC_REG_AC3_AC2_TXOP,
2406 	    edca[WME_AC_VO].wmep_txopLimit << 16 |
2407 	    edca[WME_AC_VI].wmep_txopLimit);
2408 
2409 	/* XXX ACK policy? */
2410 
2411 	(void)otus_write_barrier(sc);
2412 
2413 #undef AIFS
2414 #undef EXP2
2415 }
2416 
2417 static void
2418 otus_updateslot(struct otus_softc *sc)
2419 {
2420 	struct ieee80211com *ic = &sc->sc_ic;
2421 	uint32_t slottime;
2422 
2423 	OTUS_LOCK_ASSERT(sc);
2424 
2425 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2426 	otus_write(sc, AR_MAC_REG_SLOT_TIME, slottime << 10);
2427 	(void)otus_write_barrier(sc);
2428 }
2429 
2430 int
2431 otus_init_mac(struct otus_softc *sc)
2432 {
2433 	int error;
2434 
2435 	OTUS_LOCK_ASSERT(sc);
2436 
2437 	otus_write(sc, AR_MAC_REG_ACK_EXTENSION, 0x40);
2438 	otus_write(sc, AR_MAC_REG_RETRY_MAX, 0);
2439 	otus_write(sc, AR_MAC_REG_SNIFFER, 0x2000000);
2440 	otus_write(sc, AR_MAC_REG_RX_THRESHOLD, 0xc1f80);
2441 	otus_write(sc, AR_MAC_REG_RX_PE_DELAY, 0x70);
2442 	otus_write(sc, AR_MAC_REG_EIFS_AND_SIFS, 0xa144000);
2443 	otus_write(sc, AR_MAC_REG_SLOT_TIME, 9 << 10);
2444 	otus_write(sc, 0x1c3b2c, 0x19000000);
2445 	/* NAV protects ACK only (in TXOP). */
2446 	otus_write(sc, 0x1c3b38, 0x201);
2447 	/* Set beacon Tx power to 0x7. */
2448 	otus_write(sc, AR_MAC_REG_BCN_HT1, 0x8000170);
2449 	otus_write(sc, AR_MAC_REG_BACKOFF_PROTECT, 0x105);
2450 	otus_write(sc, 0x1c3b9c, 0x10000a);
2451 	/* Filter any control frames, BAR is bit 24. */
2452 	otus_write(sc, 0x1c368c, 0x0500ffff);
2453 	otus_write(sc, 0x1c3c40, 0x1);
2454 	otus_write(sc, AR_MAC_REG_BASIC_RATE, 0x150f);
2455 	otus_write(sc, AR_MAC_REG_MANDATORY_RATE, 0x150f);
2456 	otus_write(sc, AR_MAC_REG_RTS_CTS_RATE, 0x10b01bb);
2457 	otus_write(sc, 0x1c3694, 0x4003c1e);
2458 	/* Enable LED0 and LED1. */
2459 	otus_write(sc, 0x1d0100, 0x3);
2460 	otus_write(sc, 0x1d0104, 0x3);
2461 	/* Switch MAC to OTUS interface. */
2462 	otus_write(sc, 0x1c3600, 0x3);
2463 	otus_write(sc, 0x1c3c50, 0xffff);
2464 	otus_write(sc, 0x1c3680, 0xf00008);
2465 	/* Disable Rx timeout (workaround). */
2466 	otus_write(sc, 0x1c362c, 0);
2467 
2468 	/* Set USB Rx stream mode maximum frame number to 2. */
2469 	otus_write(sc, 0x1e1110, 0x4);
2470 	/* Set USB Rx stream mode timeout to 10us. */
2471 	otus_write(sc, 0x1e1114, 0x80);
2472 
2473 	/* Set clock frequency to 88/80MHz. */
2474 	otus_write(sc, 0x1d4008, 0x73);
2475 	/* Set WLAN DMA interrupt mode: generate intr per packet. */
2476 	otus_write(sc, 0x1c3d7c, 0x110011);
2477 	otus_write(sc, 0x1c3bb0, 0x4);
2478 	otus_write(sc, AR_MAC_REG_TXOP_NOT_ENOUGH_INDICATION, 0x141e0f48);
2479 
2480 	/* Disable HW decryption for now. */
2481 	otus_write(sc, 0x1c3678, 0x78);
2482 
2483 	if ((error = otus_write_barrier(sc)) != 0)
2484 		return error;
2485 
2486 	/* Set default EDCA parameters. */
2487 	otus_updateedca(sc);
2488 
2489 	return 0;
2490 }
2491 
2492 /*
2493  * Return default value for PHY register based on current operating mode.
2494  */
2495 uint32_t
2496 otus_phy_get_def(struct otus_softc *sc, uint32_t reg)
2497 {
2498 	int i;
2499 
2500 	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2501 		if (AR_PHY(ar5416_phy_regs[i]) == reg)
2502 			return sc->phy_vals[i];
2503 	return 0;	/* Register not found. */
2504 }
2505 
2506 /*
2507  * Update PHY's programming based on vendor-specific data stored in EEPROM.
2508  * This is for FEM-type devices only.
2509  */
2510 int
2511 otus_set_board_values(struct otus_softc *sc, struct ieee80211_channel *c)
2512 {
2513 	const struct ModalEepHeader *eep;
2514 	uint32_t tmp, offset;
2515 
2516 	if (IEEE80211_IS_CHAN_5GHZ(c))
2517 		eep = &sc->eeprom.modalHeader[0];
2518 	else
2519 		eep = &sc->eeprom.modalHeader[1];
2520 
2521 	/* Offset of chain 2. */
2522 	offset = 2 * 0x1000;
2523 
2524 	tmp = le32toh(eep->antCtrlCommon);
2525 	otus_write(sc, AR_PHY_SWITCH_COM, tmp);
2526 
2527 	tmp = le32toh(eep->antCtrlChain[0]);
2528 	otus_write(sc, AR_PHY_SWITCH_CHAIN_0, tmp);
2529 
2530 	tmp = le32toh(eep->antCtrlChain[1]);
2531 	otus_write(sc, AR_PHY_SWITCH_CHAIN_0 + offset, tmp);
2532 
2533 	if (1 /* sc->sc_sco == AR_SCO_SCN */) {
2534 		tmp = otus_phy_get_def(sc, AR_PHY_SETTLING);
2535 		tmp &= ~(0x7f << 7);
2536 		tmp |= (eep->switchSettling & 0x7f) << 7;
2537 		otus_write(sc, AR_PHY_SETTLING, tmp);
2538 	}
2539 
2540 	tmp = otus_phy_get_def(sc, AR_PHY_DESIRED_SZ);
2541 	tmp &= ~0xffff;
2542 	tmp |= eep->pgaDesiredSize << 8 | eep->adcDesiredSize;
2543 	otus_write(sc, AR_PHY_DESIRED_SZ, tmp);
2544 
2545 	tmp = eep->txEndToXpaOff << 24 | eep->txEndToXpaOff << 16 |
2546 	      eep->txFrameToXpaOn << 8 | eep->txFrameToXpaOn;
2547 	otus_write(sc, AR_PHY_RF_CTL4, tmp);
2548 
2549 	tmp = otus_phy_get_def(sc, AR_PHY_RF_CTL3);
2550 	tmp &= ~(0xff << 16);
2551 	tmp |= eep->txEndToRxOn << 16;
2552 	otus_write(sc, AR_PHY_RF_CTL3, tmp);
2553 
2554 	tmp = otus_phy_get_def(sc, AR_PHY_CCA);
2555 	tmp &= ~(0x7f << 12);
2556 	tmp |= (eep->thresh62 & 0x7f) << 12;
2557 	otus_write(sc, AR_PHY_CCA, tmp);
2558 
2559 	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN);
2560 	tmp &= ~(0x3f << 12);
2561 	tmp |= (eep->txRxAttenCh[0] & 0x3f) << 12;
2562 	otus_write(sc, AR_PHY_RXGAIN, tmp);
2563 
2564 	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN + offset);
2565 	tmp &= ~(0x3f << 12);
2566 	tmp |= (eep->txRxAttenCh[1] & 0x3f) << 12;
2567 	otus_write(sc, AR_PHY_RXGAIN + offset, tmp);
2568 
2569 	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ);
2570 	tmp &= ~(0x3f << 18);
2571 	tmp |= (eep->rxTxMarginCh[0] & 0x3f) << 18;
2572 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2573 		tmp &= ~(0xf << 10);
2574 		tmp |= (eep->bswMargin[0] & 0xf) << 10;
2575 	}
2576 	otus_write(sc, AR_PHY_GAIN_2GHZ, tmp);
2577 
2578 	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ + offset);
2579 	tmp &= ~(0x3f << 18);
2580 	tmp |= (eep->rxTxMarginCh[1] & 0x3f) << 18;
2581 	otus_write(sc, AR_PHY_GAIN_2GHZ + offset, tmp);
2582 
2583 	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4);
2584 	tmp &= ~(0x3f << 5 | 0x1f);
2585 	tmp |= (eep->iqCalICh[0] & 0x3f) << 5 | (eep->iqCalQCh[0] & 0x1f);
2586 	otus_write(sc, AR_PHY_TIMING_CTRL4, tmp);
2587 
2588 	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4 + offset);
2589 	tmp &= ~(0x3f << 5 | 0x1f);
2590 	tmp |= (eep->iqCalICh[1] & 0x3f) << 5 | (eep->iqCalQCh[1] & 0x1f);
2591 	otus_write(sc, AR_PHY_TIMING_CTRL4 + offset, tmp);
2592 
2593 	tmp = otus_phy_get_def(sc, AR_PHY_TPCRG1);
2594 	tmp &= ~(0xf << 16);
2595 	tmp |= (eep->xpd & 0xf) << 16;
2596 	otus_write(sc, AR_PHY_TPCRG1, tmp);
2597 
2598 	return otus_write_barrier(sc);
2599 }
2600 
2601 int
2602 otus_program_phy(struct otus_softc *sc, struct ieee80211_channel *c)
2603 {
2604 	const uint32_t *vals;
2605 	int error, i;
2606 
2607 	/* Select PHY programming based on band and bandwidth. */
2608 	if (IEEE80211_IS_CHAN_2GHZ(c))
2609 		vals = ar5416_phy_vals_2ghz_20mhz;
2610 	else
2611 		vals = ar5416_phy_vals_5ghz_20mhz;
2612 	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2613 		otus_write(sc, AR_PHY(ar5416_phy_regs[i]), vals[i]);
2614 	sc->phy_vals = vals;
2615 
2616 	if (sc->eeprom.baseEepHeader.deviceType == 0x80)	/* FEM */
2617 		if ((error = otus_set_board_values(sc, c)) != 0)
2618 			return error;
2619 
2620 	/* Initial Tx power settings. */
2621 	otus_write(sc, AR_PHY_POWER_TX_RATE_MAX, 0x7f);
2622 	otus_write(sc, AR_PHY_POWER_TX_RATE1, 0x3f3f3f3f);
2623 	otus_write(sc, AR_PHY_POWER_TX_RATE2, 0x3f3f3f3f);
2624 	otus_write(sc, AR_PHY_POWER_TX_RATE3, 0x3f3f3f3f);
2625 	otus_write(sc, AR_PHY_POWER_TX_RATE4, 0x3f3f3f3f);
2626 	otus_write(sc, AR_PHY_POWER_TX_RATE5, 0x3f3f3f3f);
2627 	otus_write(sc, AR_PHY_POWER_TX_RATE6, 0x3f3f3f3f);
2628 	otus_write(sc, AR_PHY_POWER_TX_RATE7, 0x3f3f3f3f);
2629 	otus_write(sc, AR_PHY_POWER_TX_RATE8, 0x3f3f3f3f);
2630 	otus_write(sc, AR_PHY_POWER_TX_RATE9, 0x3f3f3f3f);
2631 
2632 	if (IEEE80211_IS_CHAN_2GHZ(c))
2633 		otus_write(sc, 0x1d4014, 0x5163);
2634 	else
2635 		otus_write(sc, 0x1d4014, 0x5143);
2636 
2637 	return otus_write_barrier(sc);
2638 }
2639 
2640 static __inline uint8_t
2641 otus_reverse_bits(uint8_t v)
2642 {
2643 	v = ((v >> 1) & 0x55) | ((v & 0x55) << 1);
2644 	v = ((v >> 2) & 0x33) | ((v & 0x33) << 2);
2645 	v = ((v >> 4) & 0x0f) | ((v & 0x0f) << 4);
2646 	return v;
2647 }
2648 
2649 int
2650 otus_set_rf_bank4(struct otus_softc *sc, struct ieee80211_channel *c)
2651 {
2652 	uint8_t chansel, d0, d1;
2653 	uint16_t data;
2654 	int error;
2655 
2656 	OTUS_LOCK_ASSERT(sc);
2657 
2658 	d0 = 0;
2659 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2660 		chansel = (c->ic_freq - 4800) / 5;
2661 		if (chansel & 1)
2662 			d0 |= AR_BANK4_AMODE_REFSEL(2);
2663 		else
2664 			d0 |= AR_BANK4_AMODE_REFSEL(1);
2665 	} else {
2666 		d0 |= AR_BANK4_AMODE_REFSEL(2);
2667 		if (c->ic_freq == 2484) {	/* CH 14 */
2668 			d0 |= AR_BANK4_BMODE_LF_SYNTH_FREQ;
2669 			chansel = 10 + (c->ic_freq - 2274) / 5;
2670 		} else
2671 			chansel = 16 + (c->ic_freq - 2272) / 5;
2672 		chansel <<= 2;
2673 	}
2674 	d0 |= AR_BANK4_ADDR(1) | AR_BANK4_CHUP;
2675 	d1 = otus_reverse_bits(chansel);
2676 
2677 	/* Write bits 0-4 of d0 and d1. */
2678 	data = (d1 & 0x1f) << 5 | (d0 & 0x1f);
2679 	otus_write(sc, AR_PHY(44), data);
2680 	/* Write bits 5-7 of d0 and d1. */
2681 	data = (d1 >> 5) << 5 | (d0 >> 5);
2682 	otus_write(sc, AR_PHY(58), data);
2683 
2684 	if ((error = otus_write_barrier(sc)) == 0)
2685 		otus_delay_ms(sc, 10);
2686 	return error;
2687 }
2688 
2689 void
2690 otus_get_delta_slope(uint32_t coeff, uint32_t *exponent, uint32_t *mantissa)
2691 {
2692 #define COEFF_SCALE_SHIFT	24
2693 	uint32_t exp, man;
2694 
2695 	/* exponent = 14 - floor(log2(coeff)) */
2696 	for (exp = 31; exp > 0; exp--)
2697 		if (coeff & (1 << exp))
2698 			break;
2699 	KASSERT(exp != 0, ("exp"));
2700 	exp = 14 - (exp - COEFF_SCALE_SHIFT);
2701 
2702 	/* mantissa = floor(coeff * 2^exponent + 0.5) */
2703 	man = coeff + (1 << (COEFF_SCALE_SHIFT - exp - 1));
2704 
2705 	*mantissa = man >> (COEFF_SCALE_SHIFT - exp);
2706 	*exponent = exp - 16;
2707 #undef COEFF_SCALE_SHIFT
2708 }
2709 
2710 static int
2711 otus_set_chan(struct otus_softc *sc, struct ieee80211_channel *c, int assoc)
2712 {
2713 	struct ieee80211com *ic = &sc->sc_ic;
2714 	struct ar_cmd_frequency cmd;
2715 	struct ar_rsp_frequency rsp;
2716 	const uint32_t *vals;
2717 	uint32_t coeff, exp, man, tmp;
2718 	uint8_t code;
2719 	int error, chan, i;
2720 
2721 	error = 0;
2722 	chan = ieee80211_chan2ieee(ic, c);
2723 
2724 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2725 	    "setting channel %d (%dMHz)\n", chan, c->ic_freq);
2726 
2727 	tmp = IEEE80211_IS_CHAN_2GHZ(c) ? 0x105 : 0x104;
2728 	otus_write(sc, AR_MAC_REG_DYNAMIC_SIFS_ACK, tmp);
2729 	if ((error = otus_write_barrier(sc)) != 0)
2730 		goto finish;
2731 
2732 	/* Disable BB Heavy Clip. */
2733 	otus_write(sc, AR_PHY_HEAVY_CLIP_ENABLE, 0x200);
2734 	if ((error = otus_write_barrier(sc)) != 0)
2735 		goto finish;
2736 
2737 	/* XXX Is that FREQ_START ? */
2738 	error = otus_cmd(sc, AR_CMD_FREQ_STRAT, NULL, 0, NULL, 0);
2739 	if (error != 0)
2740 		goto finish;
2741 
2742 	/* Reprogram PHY and RF on channel band or bandwidth changes. */
2743 	if (sc->bb_reset || c->ic_flags != sc->sc_curchan->ic_flags) {
2744 		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "band switch\n");
2745 
2746 		/* Cold/Warm reset BB/ADDA. */
2747 		otus_write(sc, 0x1d4004, sc->bb_reset ? 0x800 : 0x400);
2748 		if ((error = otus_write_barrier(sc)) != 0)
2749 			goto finish;
2750 		otus_write(sc, 0x1d4004, 0);
2751 		if ((error = otus_write_barrier(sc)) != 0)
2752 			goto finish;
2753 		sc->bb_reset = 0;
2754 
2755 		if ((error = otus_program_phy(sc, c)) != 0) {
2756 			device_printf(sc->sc_dev,
2757 			    "%s: could not program PHY\n",
2758 			    __func__);
2759 			goto finish;
2760 		}
2761 
2762 		/* Select RF programming based on band. */
2763 		if (IEEE80211_IS_CHAN_5GHZ(c))
2764 			vals = ar5416_banks_vals_5ghz;
2765 		else
2766 			vals = ar5416_banks_vals_2ghz;
2767 		for (i = 0; i < nitems(ar5416_banks_regs); i++)
2768 			otus_write(sc, AR_PHY(ar5416_banks_regs[i]), vals[i]);
2769 		if ((error = otus_write_barrier(sc)) != 0) {
2770 			device_printf(sc->sc_dev,
2771 			    "%s: could not program RF\n",
2772 			    __func__);
2773 			goto finish;
2774 		}
2775 		code = AR_CMD_RF_INIT;
2776 	} else {
2777 		code = AR_CMD_FREQUENCY;
2778 	}
2779 
2780 	if ((error = otus_set_rf_bank4(sc, c)) != 0)
2781 		goto finish;
2782 
2783 	tmp = (sc->txmask == 0x5) ? 0x340 : 0x240;
2784 	otus_write(sc, AR_PHY_TURBO, tmp);
2785 	if ((error = otus_write_barrier(sc)) != 0)
2786 		goto finish;
2787 
2788 	/* Send firmware command to set channel. */
2789 	cmd.freq = htole32((uint32_t)c->ic_freq * 1000);
2790 	cmd.dynht2040 = htole32(0);
2791 	cmd.htena = htole32(1);
2792 	/* Set Delta Slope (exponent and mantissa). */
2793 	coeff = (100 << 24) / c->ic_freq;
2794 	otus_get_delta_slope(coeff, &exp, &man);
2795 	cmd.dsc_exp = htole32(exp);
2796 	cmd.dsc_man = htole32(man);
2797 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2798 	    "ds coeff=%u exp=%u man=%u\n", coeff, exp, man);
2799 	/* For Short GI, coeff is 9/10 that of normal coeff. */
2800 	coeff = (9 * coeff) / 10;
2801 	otus_get_delta_slope(coeff, &exp, &man);
2802 	cmd.dsc_shgi_exp = htole32(exp);
2803 	cmd.dsc_shgi_man = htole32(man);
2804 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2805 	    "ds shgi coeff=%u exp=%u man=%u\n", coeff, exp, man);
2806 	/* Set wait time for AGC and noise calibration (100 or 200ms). */
2807 	cmd.check_loop_count = assoc ? htole32(2000) : htole32(1000);
2808 	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2809 	    "%s\n", (code == AR_CMD_RF_INIT) ? "RF_INIT" : "FREQUENCY");
2810 	error = otus_cmd(sc, code, &cmd, sizeof cmd, &rsp, sizeof(rsp));
2811 	if (error != 0)
2812 		goto finish;
2813 	if ((rsp.status & htole32(AR_CAL_ERR_AGC | AR_CAL_ERR_NF_VAL)) != 0) {
2814 		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2815 		    "status=0x%x\n", le32toh(rsp.status));
2816 		/* Force cold reset on next channel. */
2817 		sc->bb_reset = 1;
2818 	}
2819 #ifdef USB_DEBUG
2820 	if (otus_debug & OTUS_DEBUG_RESET) {
2821 		device_printf(sc->sc_dev, "calibration status=0x%x\n",
2822 		    le32toh(rsp.status));
2823 		for (i = 0; i < 2; i++) {	/* 2 Rx chains */
2824 			/* Sign-extend 9-bit NF values. */
2825 			device_printf(sc->sc_dev,
2826 			    "noisefloor chain %d=%d\n", i,
2827 			    (((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2828 			device_printf(sc->sc_dev,
2829 			    "noisefloor ext chain %d=%d\n", i,
2830 			    ((int32_t)le32toh(rsp.nf_ext[i])) >> 23);
2831 		}
2832 	}
2833 #endif
2834 	for (i = 0; i < OTUS_NUM_CHAINS; i++) {
2835 		sc->sc_nf[i] = ((((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2836 	}
2837 	sc->sc_curchan = c;
2838 finish:
2839 	return (error);
2840 }
2841 
2842 #ifdef notyet
2843 int
2844 otus_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2845     struct ieee80211_key *k)
2846 {
2847 	struct otus_softc *sc = ic->ic_softc;
2848 	struct otus_cmd_key cmd;
2849 
2850 	/* Defer setting of WEP keys until interface is brought up. */
2851 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
2852 	    (IFF_UP | IFF_RUNNING))
2853 		return 0;
2854 
2855 	/* Do it in a process context. */
2856 	cmd.key = *k;
2857 	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2858 	otus_do_async(sc, otus_set_key_cb, &cmd, sizeof cmd);
2859 	return 0;
2860 }
2861 
2862 void
2863 otus_set_key_cb(struct otus_softc *sc, void *arg)
2864 {
2865 	struct otus_cmd_key *cmd = arg;
2866 	struct ieee80211_key *k = &cmd->key;
2867 	struct ar_cmd_ekey key;
2868 	uint16_t cipher;
2869 	int error;
2870 
2871 	memset(&key, 0, sizeof key);
2872 	if (k->k_flags & IEEE80211_KEY_GROUP) {
2873 		key.uid = htole16(k->k_id);
2874 		IEEE80211_ADDR_COPY(key.macaddr, sc->sc_ic.ic_myaddr);
2875 		key.macaddr[0] |= 0x80;
2876 	} else {
2877 		key.uid = htole16(OTUS_UID(cmd->associd));
2878 		IEEE80211_ADDR_COPY(key.macaddr, ni->ni_macaddr);
2879 	}
2880 	key.kix = htole16(0);
2881 	/* Map net80211 cipher to hardware. */
2882 	switch (k->k_cipher) {
2883 	case IEEE80211_CIPHER_WEP40:
2884 		cipher = AR_CIPHER_WEP64;
2885 		break;
2886 	case IEEE80211_CIPHER_WEP104:
2887 		cipher = AR_CIPHER_WEP128;
2888 		break;
2889 	case IEEE80211_CIPHER_TKIP:
2890 		cipher = AR_CIPHER_TKIP;
2891 		break;
2892 	case IEEE80211_CIPHER_CCMP:
2893 		cipher = AR_CIPHER_AES;
2894 		break;
2895 	default:
2896 		return;
2897 	}
2898 	key.cipher = htole16(cipher);
2899 	memcpy(key.key, k->k_key, MIN(k->k_len, 16));
2900 	error = otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2901 	if (error != 0 || k->k_cipher != IEEE80211_CIPHER_TKIP)
2902 		return;
2903 
2904 	/* TKIP: set Tx/Rx MIC Key. */
2905 	key.kix = htole16(1);
2906 	memcpy(key.key, k->k_key + 16, 16);
2907 	(void)otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2908 }
2909 
2910 void
2911 otus_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2912     struct ieee80211_key *k)
2913 {
2914 	struct otus_softc *sc = ic->ic_softc;
2915 	struct otus_cmd_key cmd;
2916 
2917 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
2918 	    ic->ic_state != IEEE80211_S_RUN)
2919 		return;	/* Nothing to do. */
2920 
2921 	/* Do it in a process context. */
2922 	cmd.key = *k;
2923 	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2924 	otus_do_async(sc, otus_delete_key_cb, &cmd, sizeof cmd);
2925 }
2926 
2927 void
2928 otus_delete_key_cb(struct otus_softc *sc, void *arg)
2929 {
2930 	struct otus_cmd_key *cmd = arg;
2931 	struct ieee80211_key *k = &cmd->key;
2932 	uint32_t uid;
2933 
2934 	if (k->k_flags & IEEE80211_KEY_GROUP)
2935 		uid = htole32(k->k_id);
2936 	else
2937 		uid = htole32(OTUS_UID(cmd->associd));
2938 	(void)otus_cmd(sc, AR_CMD_DKEY, &uid, sizeof uid, NULL, 0);
2939 }
2940 #endif
2941 
2942 /*
2943  * XXX TODO: check if we have to be doing any calibration in the host
2944  * or whether it's purely a firmware thing.
2945  */
2946 void
2947 otus_calibrate_to(void *arg, int pending)
2948 {
2949 #if 0
2950 	struct otus_softc *sc = arg;
2951 
2952 	device_printf(sc->sc_dev, "%s: called\n", __func__);
2953 	struct ieee80211com *ic = &sc->sc_ic;
2954 	struct ieee80211_node *ni;
2955 	int s;
2956 
2957 	if (usbd_is_dying(sc->sc_udev))
2958 		return;
2959 
2960 	usbd_ref_incr(sc->sc_udev);
2961 
2962 	s = splnet();
2963 	ni = ic->ic_bss;
2964 	ieee80211_amrr_choose(&sc->amrr, ni, &((struct otus_node *)ni)->amn);
2965 	splx(s);
2966 
2967 	if (!usbd_is_dying(sc->sc_udev))
2968 		timeout_add_sec(&sc->calib_to, 1);
2969 
2970 	usbd_ref_decr(sc->sc_udev);
2971 #endif
2972 }
2973 
2974 int
2975 otus_set_bssid(struct otus_softc *sc, const uint8_t *bssid)
2976 {
2977 
2978 	OTUS_LOCK_ASSERT(sc);
2979 
2980 	otus_write(sc, AR_MAC_REG_BSSID_L,
2981 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
2982 	otus_write(sc, AR_MAC_REG_BSSID_H,
2983 	    bssid[4] | bssid[5] << 8);
2984 	return otus_write_barrier(sc);
2985 }
2986 
2987 int
2988 otus_set_macaddr(struct otus_softc *sc, const uint8_t *addr)
2989 {
2990 	OTUS_LOCK_ASSERT(sc);
2991 
2992 	otus_write(sc, AR_MAC_REG_MAC_ADDR_L,
2993 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
2994 	otus_write(sc, AR_MAC_REG_MAC_ADDR_H,
2995 	    addr[4] | addr[5] << 8);
2996 	return otus_write_barrier(sc);
2997 }
2998 
2999 /* Default single-LED. */
3000 void
3001 otus_led_newstate_type1(struct otus_softc *sc)
3002 {
3003 	/* TBD */
3004 	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3005 }
3006 
3007 /* NETGEAR, dual-LED. */
3008 void
3009 otus_led_newstate_type2(struct otus_softc *sc)
3010 {
3011 	/* TBD */
3012 	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3013 }
3014 
3015 /* NETGEAR, single-LED/3 colors (blue, red, purple.) */
3016 void
3017 otus_led_newstate_type3(struct otus_softc *sc)
3018 {
3019 #if 0
3020 	struct ieee80211com *ic = &sc->sc_ic;
3021 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3022 
3023 	uint32_t state = sc->led_state;
3024 
3025 	OTUS_LOCK_ASSERT(sc);
3026 
3027 	if (!vap) {
3028 		state = 0;	/* led off */
3029 	} else if (vap->iv_state == IEEE80211_S_INIT) {
3030 		state = 0;	/* LED off. */
3031 	} else if (vap->iv_state == IEEE80211_S_RUN) {
3032 		/* Associated, LED always on. */
3033 		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3034 			state = AR_LED0_ON;	/* 2GHz=>Red. */
3035 		else
3036 			state = AR_LED1_ON;	/* 5GHz=>Blue. */
3037 	} else {
3038 		/* Scanning, blink LED. */
3039 		state ^= AR_LED0_ON | AR_LED1_ON;
3040 		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3041 			state &= ~AR_LED1_ON;
3042 		else
3043 			state &= ~AR_LED0_ON;
3044 	}
3045 	if (state != sc->led_state) {
3046 		otus_write(sc, 0x1d0104, state);
3047 		if (otus_write_barrier(sc) == 0)
3048 			sc->led_state = state;
3049 	}
3050 #endif
3051 }
3052 
3053 int
3054 otus_init(struct otus_softc *sc)
3055 {
3056 	struct ieee80211com *ic = &sc->sc_ic;
3057 	int error;
3058 
3059 	OTUS_UNLOCK_ASSERT(sc);
3060 
3061 	OTUS_LOCK(sc);
3062 
3063 	/* Drain any pending TX frames */
3064 	otus_drain_mbufq(sc);
3065 
3066 	/* Init MAC */
3067 	if ((error = otus_init_mac(sc)) != 0) {
3068 		OTUS_UNLOCK(sc);
3069 		device_printf(sc->sc_dev,
3070 		    "%s: could not initialize MAC\n", __func__);
3071 		return error;
3072 	}
3073 
3074 	(void) otus_set_macaddr(sc, ic->ic_macaddr);
3075 
3076 #if 0
3077 	switch (ic->ic_opmode) {
3078 #ifdef notyet
3079 #ifndef IEEE80211_STA_ONLY
3080 	case IEEE80211_M_HOSTAP:
3081 		otus_write(sc, 0x1c3700, 0x0f0000a1);
3082 		otus_write(sc, 0x1c3c40, 0x1);
3083 		break;
3084 	case IEEE80211_M_IBSS:
3085 		otus_write(sc, 0x1c3700, 0x0f000000);
3086 		otus_write(sc, 0x1c3c40, 0x1);
3087 		break;
3088 #endif
3089 #endif
3090 	case IEEE80211_M_STA:
3091 		otus_write(sc, 0x1c3700, 0x0f000002);
3092 		otus_write(sc, 0x1c3c40, 0x1);
3093 		break;
3094 	default:
3095 		break;
3096 	}
3097 #endif
3098 
3099 	/* Expect STA operation */
3100 	otus_write(sc, 0x1c3700, 0x0f000002);
3101 	otus_write(sc, 0x1c3c40, 0x1);
3102 
3103 	/* XXX ic_opmode? */
3104 	otus_write(sc, AR_MAC_REG_SNIFFER,
3105 	    (ic->ic_opmode == IEEE80211_M_MONITOR) ? 0x2000001 : 0x2000000);
3106 	(void)otus_write_barrier(sc);
3107 
3108 	sc->bb_reset = 1;	/* Force cold reset. */
3109 
3110 	if ((error = otus_set_chan(sc, ic->ic_curchan, 0)) != 0) {
3111 		OTUS_UNLOCK(sc);
3112 		device_printf(sc->sc_dev,
3113 		    "%s: could not set channel\n", __func__);
3114 		return error;
3115 	}
3116 
3117 	/* Start Rx. */
3118 	otus_write(sc, 0x1c3d30, 0x100);
3119 	(void)otus_write_barrier(sc);
3120 
3121 	sc->sc_running = 1;
3122 
3123 	OTUS_UNLOCK(sc);
3124 	return 0;
3125 }
3126 
3127 void
3128 otus_stop(struct otus_softc *sc)
3129 {
3130 #if 0
3131 	int s;
3132 #endif
3133 
3134 	OTUS_UNLOCK_ASSERT(sc);
3135 
3136 	OTUS_LOCK(sc);
3137 	sc->sc_running = 0;
3138 	sc->sc_tx_timer = 0;
3139 	OTUS_UNLOCK(sc);
3140 
3141 	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
3142 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
3143 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
3144 	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
3145 
3146 	OTUS_LOCK(sc);
3147 	sc->sc_running = 0;
3148 	/* Stop Rx. */
3149 	otus_write(sc, 0x1c3d30, 0);
3150 	(void)otus_write_barrier(sc);
3151 
3152 	/* Drain any pending TX frames */
3153 	otus_drain_mbufq(sc);
3154 
3155 	OTUS_UNLOCK(sc);
3156 }
3157