xref: /freebsd/sys/dev/usb/wlan/if_uath.c (revision ee24d3b8401985c99a4a1755765fe9332daee568)
1 /*-
2  * Copyright (c) 2006 Sam Leffler, Errno Consulting
3  * Copyright (c) 2008-2009 Weongyo Jeong <weongyo@freebsd.org>
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer,
11  *    without modification.
12  * 2. Redistributions in binary form must reproduce at minimum a disclaimer
13  *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
14  *    redistribution must be conditioned upon including a substantially
15  *    similar Disclaimer requirement for further binary redistribution.
16  *
17  * NO WARRANTY
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20  * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
21  * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
22  * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
23  * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
26  * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGES.
29  */
30 
31 /*
32  * This driver is distantly derived from a driver of the same name
33  * by Damien Bergamini.  The original copyright is included below:
34  *
35  * Copyright (c) 2006
36  *	Damien Bergamini <damien.bergamini@free.fr>
37  *
38  * Permission to use, copy, modify, and distribute this software for any
39  * purpose with or without fee is hereby granted, provided that the above
40  * copyright notice and this permission notice appear in all copies.
41  *
42  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
43  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
44  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
45  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
46  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
47  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
48  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
49  */
50 
51 #include <sys/cdefs.h>
52 __FBSDID("$FreeBSD$");
53 
54 /*-
55  * Driver for Atheros AR5523 USB parts.
56  *
57  * The driver requires firmware to be loaded into the device.  This
58  * is done on device discovery from a user application (uathload)
59  * that is launched by devd when a device with suitable product ID
60  * is recognized.  Once firmware has been loaded the device will
61  * reset the USB port and re-attach with the original product ID+1
62  * and this driver will be attached.  The firmware is licensed for
63  * general use (royalty free) and may be incorporated in products.
64  * Note that the firmware normally packaged with the NDIS drivers
65  * for these devices does not work in this way and so does not work
66  * with this driver.
67  */
68 #include <sys/param.h>
69 #include <sys/sockio.h>
70 #include <sys/sysctl.h>
71 #include <sys/lock.h>
72 #include <sys/mutex.h>
73 #include <sys/mbuf.h>
74 #include <sys/kernel.h>
75 #include <sys/socket.h>
76 #include <sys/systm.h>
77 #include <sys/malloc.h>
78 #include <sys/module.h>
79 #include <sys/bus.h>
80 #include <sys/endian.h>
81 #include <sys/kdb.h>
82 
83 #include <machine/bus.h>
84 #include <machine/resource.h>
85 #include <sys/rman.h>
86 
87 #include <net/bpf.h>
88 #include <net/if.h>
89 #include <net/if_arp.h>
90 #include <net/ethernet.h>
91 #include <net/if_dl.h>
92 #include <net/if_media.h>
93 #include <net/if_types.h>
94 
95 #ifdef INET
96 #include <netinet/in.h>
97 #include <netinet/in_systm.h>
98 #include <netinet/in_var.h>
99 #include <netinet/if_ether.h>
100 #include <netinet/ip.h>
101 #endif
102 
103 #include <net80211/ieee80211_var.h>
104 #include <net80211/ieee80211_regdomain.h>
105 #include <net80211/ieee80211_radiotap.h>
106 
107 #include <dev/usb/usb.h>
108 #include <dev/usb/usbdi.h>
109 #include "usbdevs.h"
110 
111 #include <dev/usb/wlan/if_uathreg.h>
112 #include <dev/usb/wlan/if_uathvar.h>
113 
114 static SYSCTL_NODE(_hw_usb, OID_AUTO, uath, CTLFLAG_RW, 0, "USB Atheros");
115 
116 static	int uath_countrycode = CTRY_DEFAULT;	/* country code */
117 SYSCTL_INT(_hw_usb_uath, OID_AUTO, countrycode, CTLFLAG_RW, &uath_countrycode,
118     0, "country code");
119 TUNABLE_INT("hw.usb.uath.countrycode", &uath_countrycode);
120 static	int uath_regdomain = 0;			/* regulatory domain */
121 SYSCTL_INT(_hw_usb_uath, OID_AUTO, regdomain, CTLFLAG_RD, &uath_regdomain,
122     0, "regulatory domain");
123 
124 #ifdef UATH_DEBUG
125 int uath_debug = 0;
126 SYSCTL_INT(_hw_usb_uath, OID_AUTO, debug, CTLFLAG_RW, &uath_debug, 0,
127     "uath debug level");
128 TUNABLE_INT("hw.usb.uath.debug", &uath_debug);
129 enum {
130 	UATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
131 	UATH_DEBUG_XMIT_DUMP	= 0x00000002,	/* xmit dump */
132 	UATH_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
133 	UATH_DEBUG_TX_PROC	= 0x00000008,	/* tx ISR proc */
134 	UATH_DEBUG_RX_PROC	= 0x00000010,	/* rx ISR proc */
135 	UATH_DEBUG_RECV_ALL	= 0x00000020,	/* trace all frames (beacons) */
136 	UATH_DEBUG_INIT		= 0x00000040,	/* initialization of dev */
137 	UATH_DEBUG_DEVCAP	= 0x00000080,	/* dev caps */
138 	UATH_DEBUG_CMDS		= 0x00000100,	/* commands */
139 	UATH_DEBUG_CMDS_DUMP	= 0x00000200,	/* command buffer dump */
140 	UATH_DEBUG_RESET	= 0x00000400,	/* reset processing */
141 	UATH_DEBUG_STATE	= 0x00000800,	/* 802.11 state transitions */
142 	UATH_DEBUG_MULTICAST	= 0x00001000,	/* multicast */
143 	UATH_DEBUG_WME		= 0x00002000,	/* WME */
144 	UATH_DEBUG_CHANNEL	= 0x00004000,	/* channel */
145 	UATH_DEBUG_RATES	= 0x00008000,	/* rates */
146 	UATH_DEBUG_CRYPTO	= 0x00010000,	/* crypto */
147 	UATH_DEBUG_LED		= 0x00020000,	/* LED */
148 	UATH_DEBUG_ANY		= 0xffffffff
149 };
150 #define	DPRINTF(sc, m, fmt, ...) do {				\
151 	if (sc->sc_debug & (m))					\
152 		printf(fmt, __VA_ARGS__);			\
153 } while (0)
154 #else
155 #define	DPRINTF(sc, m, fmt, ...) do {				\
156 	(void) sc;						\
157 } while (0)
158 #endif
159 
160 /* unaligned little endian access */
161 #define LE_READ_2(p)							\
162 	((u_int16_t)							\
163 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
164 #define LE_READ_4(p)							\
165 	((u_int32_t)							\
166 	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
167 	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
168 
169 /* recognized device vendors/products */
170 static const STRUCT_USB_HOST_ID uath_devs[] = {
171 #define	UATH_DEV(v,p) { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
172 	UATH_DEV(ACCTON,		SMCWUSBTG2),
173 	UATH_DEV(ATHEROS,		AR5523),
174 	UATH_DEV(ATHEROS2,		AR5523_1),
175 	UATH_DEV(ATHEROS2,		AR5523_2),
176 	UATH_DEV(ATHEROS2,		AR5523_3),
177 	UATH_DEV(CONCEPTRONIC,		AR5523_1),
178 	UATH_DEV(CONCEPTRONIC,		AR5523_2),
179 	UATH_DEV(DLINK,			DWLAG122),
180 	UATH_DEV(DLINK,			DWLAG132),
181 	UATH_DEV(DLINK,			DWLG132),
182 	UATH_DEV(DLINK2,		DWA120),
183 	UATH_DEV(GIGASET,		AR5523),
184 	UATH_DEV(GIGASET,		SMCWUSBTG),
185 	UATH_DEV(GLOBALSUN,		AR5523_1),
186 	UATH_DEV(GLOBALSUN,		AR5523_2),
187 	UATH_DEV(NETGEAR,		WG111U),
188 	UATH_DEV(NETGEAR3,		WG111T),
189 	UATH_DEV(NETGEAR3,		WPN111),
190 	UATH_DEV(NETGEAR3,		WPN111_2),
191 	UATH_DEV(UMEDIA,		TEW444UBEU),
192 	UATH_DEV(UMEDIA,		AR5523_2),
193 	UATH_DEV(WISTRONNEWEB,		AR5523_1),
194 	UATH_DEV(WISTRONNEWEB,		AR5523_2),
195 	UATH_DEV(ZCOM,			AR5523)
196 #undef UATH_DEV
197 };
198 
199 static usb_callback_t uath_intr_rx_callback;
200 static usb_callback_t uath_intr_tx_callback;
201 static usb_callback_t uath_bulk_rx_callback;
202 static usb_callback_t uath_bulk_tx_callback;
203 
204 static const struct usb_config uath_usbconfig[UATH_N_XFERS] = {
205 	[UATH_INTR_RX] = {
206 		.type = UE_BULK,
207 		.endpoint = 0x1,
208 		.direction = UE_DIR_IN,
209 		.bufsize = UATH_MAX_CMDSZ,
210 		.flags = {
211 			.pipe_bof = 1,
212 			.short_xfer_ok = 1
213 		},
214 		.callback = uath_intr_rx_callback
215 	},
216 	[UATH_INTR_TX] = {
217 		.type = UE_BULK,
218 		.endpoint = 0x1,
219 		.direction = UE_DIR_OUT,
220 		.bufsize = UATH_MAX_CMDSZ,
221 		.flags = {
222 			.ext_buffer = 1,
223 			.force_short_xfer = 1,
224 			.pipe_bof = 1,
225 		},
226 		.callback = uath_intr_tx_callback,
227 		.timeout = UATH_CMD_TIMEOUT
228 	},
229 	[UATH_BULK_RX] = {
230 		.type = UE_BULK,
231 		.endpoint = 0x2,
232 		.direction = UE_DIR_IN,
233 		.bufsize = MCLBYTES,
234 		.flags = {
235 			.ext_buffer = 1,
236 			.pipe_bof = 1,
237 			.short_xfer_ok = 1
238 		},
239 		.callback = uath_bulk_rx_callback
240 	},
241 	[UATH_BULK_TX] = {
242 		.type = UE_BULK,
243 		.endpoint = 0x2,
244 		.direction = UE_DIR_OUT,
245 		.bufsize = UATH_MAX_TXBUFSZ,
246 		.flags = {
247 			.ext_buffer = 1,
248 			.force_short_xfer = 1,
249 			.pipe_bof = 1
250 		},
251 		.callback = uath_bulk_tx_callback,
252 		.timeout = UATH_DATA_TIMEOUT
253 	}
254 };
255 
256 static struct ieee80211vap *uath_vap_create(struct ieee80211com *,
257 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
258 		    const uint8_t [IEEE80211_ADDR_LEN],
259 		    const uint8_t [IEEE80211_ADDR_LEN]);
260 static void	uath_vap_delete(struct ieee80211vap *);
261 static int	uath_alloc_cmd_list(struct uath_softc *, struct uath_cmd [],
262 		    int, int);
263 static void	uath_free_cmd_list(struct uath_softc *, struct uath_cmd [],
264 		    int);
265 static int	uath_host_available(struct uath_softc *);
266 static int	uath_get_capability(struct uath_softc *, uint32_t, uint32_t *);
267 static int	uath_get_devcap(struct uath_softc *);
268 static struct uath_cmd *
269 		uath_get_cmdbuf(struct uath_softc *);
270 static int	uath_cmd_read(struct uath_softc *, uint32_t, const void *,
271 		    int, void *, int, int);
272 static int	uath_cmd_write(struct uath_softc *, uint32_t, const void *,
273 		    int, int);
274 static void	uath_stat(void *);
275 #ifdef UATH_DEBUG
276 static void	uath_dump_cmd(const uint8_t *, int, char);
277 static const char *
278 		uath_codename(int);
279 #endif
280 static int	uath_get_devstatus(struct uath_softc *,
281 		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
282 static int	uath_get_status(struct uath_softc *, uint32_t, void *, int);
283 static int	uath_alloc_rx_data_list(struct uath_softc *);
284 static int	uath_alloc_tx_data_list(struct uath_softc *);
285 static void	uath_free_rx_data_list(struct uath_softc *);
286 static void	uath_free_tx_data_list(struct uath_softc *);
287 static int	uath_init_locked(void *);
288 static void	uath_init(void *);
289 static void	uath_stop_locked(struct ifnet *);
290 static void	uath_stop(struct ifnet *);
291 static int	uath_ioctl(struct ifnet *, u_long, caddr_t);
292 static void	uath_start(struct ifnet *);
293 static int	uath_raw_xmit(struct ieee80211_node *, struct mbuf *,
294 		    const struct ieee80211_bpf_params *);
295 static void	uath_scan_start(struct ieee80211com *);
296 static void	uath_scan_end(struct ieee80211com *);
297 static void	uath_set_channel(struct ieee80211com *);
298 static void	uath_update_mcast(struct ifnet *);
299 static void	uath_update_promisc(struct ifnet *);
300 static int	uath_config(struct uath_softc *, uint32_t, uint32_t);
301 static int	uath_config_multi(struct uath_softc *, uint32_t, const void *,
302 		    int);
303 static int	uath_switch_channel(struct uath_softc *,
304 		    struct ieee80211_channel *);
305 static int	uath_set_rxfilter(struct uath_softc *, uint32_t, uint32_t);
306 static void	uath_watchdog(void *);
307 static void	uath_abort_xfers(struct uath_softc *);
308 static int	uath_dataflush(struct uath_softc *);
309 static int	uath_cmdflush(struct uath_softc *);
310 static int	uath_flush(struct uath_softc *);
311 static int	uath_set_ledstate(struct uath_softc *, int);
312 static int	uath_set_chan(struct uath_softc *, struct ieee80211_channel *);
313 static int	uath_reset_tx_queues(struct uath_softc *);
314 static int	uath_wme_init(struct uath_softc *);
315 static struct uath_data *
316 		uath_getbuf(struct uath_softc *);
317 static int	uath_newstate(struct ieee80211vap *, enum ieee80211_state,
318 		    int);
319 static int	uath_set_key(struct uath_softc *,
320 		    const struct ieee80211_key *, int);
321 static int	uath_set_keys(struct uath_softc *, struct ieee80211vap *);
322 static void	uath_sysctl_node(struct uath_softc *);
323 
324 static int
325 uath_match(device_t dev)
326 {
327 	struct usb_attach_arg *uaa = device_get_ivars(dev);
328 
329 	if (uaa->usb_mode != USB_MODE_HOST)
330 		return (ENXIO);
331 	if (uaa->info.bConfigIndex != UATH_CONFIG_INDEX)
332 		return (ENXIO);
333 	if (uaa->info.bIfaceIndex != UATH_IFACE_INDEX)
334 		return (ENXIO);
335 
336 	return (usbd_lookup_id_by_uaa(uath_devs, sizeof(uath_devs), uaa));
337 }
338 
339 static int
340 uath_attach(device_t dev)
341 {
342 	struct uath_softc *sc = device_get_softc(dev);
343 	struct usb_attach_arg *uaa = device_get_ivars(dev);
344 	struct ieee80211com *ic;
345 	struct ifnet *ifp;
346 	uint8_t bands, iface_index = UATH_IFACE_INDEX;		/* XXX */
347 	usb_error_t error;
348 	uint8_t macaddr[IEEE80211_ADDR_LEN];
349 
350 	sc->sc_dev = dev;
351 	sc->sc_udev = uaa->device;
352 #ifdef UATH_DEBUG
353 	sc->sc_debug = uath_debug;
354 #endif
355 	device_set_usb_desc(dev);
356 
357 	/*
358 	 * Only post-firmware devices here.
359 	 */
360 	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
361 	    MTX_DEF);
362 	callout_init(&sc->stat_ch, 0);
363 	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
364 
365 	/*
366 	 * Allocate xfers for firmware commands.
367 	 */
368 	error = uath_alloc_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT,
369 	    UATH_MAX_CMDSZ);
370 	if (error != 0) {
371 		device_printf(sc->sc_dev,
372 		    "could not allocate Tx command list\n");
373 		goto fail;
374 	}
375 
376 	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
377 	    uath_usbconfig, UATH_N_XFERS, sc, &sc->sc_mtx);
378 	if (error) {
379 		device_printf(dev, "could not allocate USB transfers, "
380 		    "err=%s\n", usbd_errstr(error));
381 		goto fail1;
382 	}
383 
384 	/*
385 	 * We're now ready to send+receive firmware commands.
386 	 */
387 	UATH_LOCK(sc);
388 	error = uath_host_available(sc);
389 	if (error != 0) {
390 		device_printf(sc->sc_dev, "could not initialize adapter\n");
391 		goto fail3;
392 	}
393 	error = uath_get_devcap(sc);
394 	if (error != 0) {
395 		device_printf(sc->sc_dev,
396 		    "could not get device capabilities\n");
397 		goto fail3;
398 	}
399 	UATH_UNLOCK(sc);
400 
401 	/* Create device sysctl node. */
402 	uath_sysctl_node(sc);
403 
404 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
405 	if (ifp == NULL) {
406 		device_printf(sc->sc_dev, "can not allocate ifnet\n");
407 		error = ENXIO;
408 		goto fail2;
409 	}
410 
411 	UATH_LOCK(sc);
412 	error = uath_get_devstatus(sc, macaddr);
413 	if (error != 0) {
414 		device_printf(sc->sc_dev, "could not get device status\n");
415 		goto fail4;
416 	}
417 
418 	/*
419 	 * Allocate xfers for Rx/Tx data pipes.
420 	 */
421 	error = uath_alloc_rx_data_list(sc);
422 	if (error != 0) {
423 		device_printf(sc->sc_dev, "could not allocate Rx data list\n");
424 		goto fail4;
425 	}
426 	error = uath_alloc_tx_data_list(sc);
427 	if (error != 0) {
428 		device_printf(sc->sc_dev, "could not allocate Tx data list\n");
429 		goto fail4;
430 	}
431 	UATH_UNLOCK(sc);
432 
433 	ifp->if_softc = sc;
434 	if_initname(ifp, "uath", device_get_unit(sc->sc_dev));
435 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
436 	ifp->if_init = uath_init;
437 	ifp->if_ioctl = uath_ioctl;
438 	ifp->if_start = uath_start;
439 	/* XXX UATH_TX_DATA_LIST_COUNT */
440 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
441 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
442 	IFQ_SET_READY(&ifp->if_snd);
443 
444 	ic = ifp->if_l2com;
445 	ic->ic_ifp = ifp;
446 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
447 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
448 
449 	/* set device capabilities */
450 	ic->ic_caps =
451 	    IEEE80211_C_STA |		/* station mode */
452 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
453 	    IEEE80211_C_TXPMGT |	/* tx power management */
454 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
455 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
456 	    IEEE80211_C_WPA |		/* 802.11i */
457 	    IEEE80211_C_BGSCAN |	/* capable of bg scanning */
458 	    IEEE80211_C_TXFRAG;		/* handle tx frags */
459 
460 	/* put a regulatory domain to reveal informations.  */
461 	uath_regdomain = sc->sc_devcap.regDomain;
462 
463 	bands = 0;
464 	setbit(&bands, IEEE80211_MODE_11B);
465 	setbit(&bands, IEEE80211_MODE_11G);
466 	if ((sc->sc_devcap.analog5GhzRevision & 0xf0) == 0x30)
467 		setbit(&bands, IEEE80211_MODE_11A);
468 	/* XXX turbo */
469 	ieee80211_init_channels(ic, NULL, &bands);
470 
471 	ieee80211_ifattach(ic, macaddr);
472 	ic->ic_raw_xmit = uath_raw_xmit;
473 	ic->ic_scan_start = uath_scan_start;
474 	ic->ic_scan_end = uath_scan_end;
475 	ic->ic_set_channel = uath_set_channel;
476 
477 	ic->ic_vap_create = uath_vap_create;
478 	ic->ic_vap_delete = uath_vap_delete;
479 	ic->ic_update_mcast = uath_update_mcast;
480 	ic->ic_update_promisc = uath_update_promisc;
481 
482 	ieee80211_radiotap_attach(ic,
483 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
484 		UATH_TX_RADIOTAP_PRESENT,
485 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
486 		UATH_RX_RADIOTAP_PRESENT);
487 
488 	if (bootverbose)
489 		ieee80211_announce(ic);
490 
491 	return (0);
492 
493 fail4:	if_free(ifp);
494 fail3:	UATH_UNLOCK(sc);
495 fail2:	usbd_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
496 fail1:	uath_free_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT);
497 fail:
498 	return (error);
499 }
500 
501 static int
502 uath_detach(device_t dev)
503 {
504 	struct uath_softc *sc = device_get_softc(dev);
505 	struct ifnet *ifp = sc->sc_ifp;
506 	struct ieee80211com *ic = ifp->if_l2com;
507 
508 	if (!device_is_attached(dev))
509 		return (0);
510 
511 	UATH_LOCK(sc);
512 	sc->sc_flags |= UATH_FLAG_INVALID;
513 	UATH_UNLOCK(sc);
514 
515 	ieee80211_ifdetach(ic);
516 	uath_stop(ifp);
517 
518 	callout_drain(&sc->stat_ch);
519 	callout_drain(&sc->watchdog_ch);
520 
521 	usbd_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
522 
523 	/* free buffers */
524 	UATH_LOCK(sc);
525 	uath_free_rx_data_list(sc);
526 	uath_free_tx_data_list(sc);
527 	uath_free_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT);
528 	UATH_UNLOCK(sc);
529 
530 	if_free(ifp);
531 	mtx_destroy(&sc->sc_mtx);
532 	return (0);
533 }
534 
535 static void
536 uath_free_cmd_list(struct uath_softc *sc, struct uath_cmd cmds[], int ncmd)
537 {
538 	int i;
539 
540 	for (i = 0; i < ncmd; i++)
541 		if (cmds[i].buf != NULL)
542 			free(cmds[i].buf, M_USBDEV);
543 }
544 
545 static int
546 uath_alloc_cmd_list(struct uath_softc *sc, struct uath_cmd cmds[],
547 	int ncmd, int maxsz)
548 {
549 	int i, error;
550 
551 	STAILQ_INIT(&sc->sc_cmd_active);
552 	STAILQ_INIT(&sc->sc_cmd_pending);
553 	STAILQ_INIT(&sc->sc_cmd_waiting);
554 	STAILQ_INIT(&sc->sc_cmd_inactive);
555 
556 	for (i = 0; i < ncmd; i++) {
557 		struct uath_cmd *cmd = &cmds[i];
558 
559 		cmd->sc = sc;	/* backpointer for callbacks */
560 		cmd->msgid = i;
561 		cmd->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
562 		if (cmd->buf == NULL) {
563 			device_printf(sc->sc_dev,
564 			    "could not allocate xfer buffer\n");
565 			error = ENOMEM;
566 			goto fail;
567 		}
568 		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next);
569 		UATH_STAT_INC(sc, st_cmd_inactive);
570 	}
571 	return (0);
572 
573 fail:	uath_free_cmd_list(sc, cmds, ncmd);
574 	return (error);
575 }
576 
577 static int
578 uath_host_available(struct uath_softc *sc)
579 {
580 	struct uath_cmd_host_available setup;
581 
582 	UATH_ASSERT_LOCKED(sc);
583 
584 	/* inform target the host is available */
585 	setup.sw_ver_major = htobe32(ATH_SW_VER_MAJOR);
586 	setup.sw_ver_minor = htobe32(ATH_SW_VER_MINOR);
587 	setup.sw_ver_patch = htobe32(ATH_SW_VER_PATCH);
588 	setup.sw_ver_build = htobe32(ATH_SW_VER_BUILD);
589 	return uath_cmd_read(sc, WDCMSG_HOST_AVAILABLE,
590 		&setup, sizeof setup, NULL, 0, 0);
591 }
592 
593 #ifdef UATH_DEBUG
594 static void
595 uath_dump_cmd(const uint8_t *buf, int len, char prefix)
596 {
597 	const char *sep = "";
598 	int i;
599 
600 	for (i = 0; i < len; i++) {
601 		if ((i % 16) == 0) {
602 			printf("%s%c ", sep, prefix);
603 			sep = "\n";
604 		}
605 		else if ((i % 4) == 0)
606 			printf(" ");
607 		printf("%02x", buf[i]);
608 	}
609 	printf("\n");
610 }
611 
612 static const char *
613 uath_codename(int code)
614 {
615 #define	N(a)	(sizeof(a)/sizeof(a[0]))
616 	static const char *names[] = {
617 	    "0x00",
618 	    "HOST_AVAILABLE",
619 	    "BIND",
620 	    "TARGET_RESET",
621 	    "TARGET_GET_CAPABILITY",
622 	    "TARGET_SET_CONFIG",
623 	    "TARGET_GET_STATUS",
624 	    "TARGET_GET_STATS",
625 	    "TARGET_START",
626 	    "TARGET_STOP",
627 	    "TARGET_ENABLE",
628 	    "TARGET_DISABLE",
629 	    "CREATE_CONNECTION",
630 	    "UPDATE_CONNECT_ATTR",
631 	    "DELETE_CONNECT",
632 	    "SEND",
633 	    "FLUSH",
634 	    "STATS_UPDATE",
635 	    "BMISS",
636 	    "DEVICE_AVAIL",
637 	    "SEND_COMPLETE",
638 	    "DATA_AVAIL",
639 	    "SET_PWR_MODE",
640 	    "BMISS_ACK",
641 	    "SET_LED_STEADY",
642 	    "SET_LED_BLINK",
643 	    "SETUP_BEACON_DESC",
644 	    "BEACON_INIT",
645 	    "RESET_KEY_CACHE",
646 	    "RESET_KEY_CACHE_ENTRY",
647 	    "SET_KEY_CACHE_ENTRY",
648 	    "SET_DECOMP_MASK",
649 	    "SET_REGULATORY_DOMAIN",
650 	    "SET_LED_STATE",
651 	    "WRITE_ASSOCID",
652 	    "SET_STA_BEACON_TIMERS",
653 	    "GET_TSF",
654 	    "RESET_TSF",
655 	    "SET_ADHOC_MODE",
656 	    "SET_BASIC_RATE",
657 	    "MIB_CONTROL",
658 	    "GET_CHANNEL_DATA",
659 	    "GET_CUR_RSSI",
660 	    "SET_ANTENNA_SWITCH",
661 	    "0x2c", "0x2d", "0x2e",
662 	    "USE_SHORT_SLOT_TIME",
663 	    "SET_POWER_MODE",
664 	    "SETUP_PSPOLL_DESC",
665 	    "SET_RX_MULTICAST_FILTER",
666 	    "RX_FILTER",
667 	    "PER_CALIBRATION",
668 	    "RESET",
669 	    "DISABLE",
670 	    "PHY_DISABLE",
671 	    "SET_TX_POWER_LIMIT",
672 	    "SET_TX_QUEUE_PARAMS",
673 	    "SETUP_TX_QUEUE",
674 	    "RELEASE_TX_QUEUE",
675 	};
676 	static char buf[8];
677 
678 	if (code < N(names))
679 		return names[code];
680 	if (code == WDCMSG_SET_DEFAULT_KEY)
681 		return "SET_DEFAULT_KEY";
682 	snprintf(buf, sizeof(buf), "0x%02x", code);
683 	return buf;
684 #undef N
685 }
686 #endif
687 
688 /*
689  * Low-level function to send read or write commands to the firmware.
690  */
691 static int
692 uath_cmdsend(struct uath_softc *sc, uint32_t code, const void *idata, int ilen,
693     void *odata, int olen, int flags)
694 {
695 	struct uath_cmd_hdr *hdr;
696 	struct uath_cmd *cmd;
697 	int error;
698 
699 	UATH_ASSERT_LOCKED(sc);
700 
701 	/* grab a xfer */
702 	cmd = uath_get_cmdbuf(sc);
703 	if (cmd == NULL) {
704 		device_printf(sc->sc_dev, "%s: empty inactive queue\n",
705 		    __func__);
706 		return (ENOBUFS);
707 	}
708 	cmd->flags = flags;
709 	/* always bulk-out a multiple of 4 bytes */
710 	cmd->buflen = roundup2(sizeof(struct uath_cmd_hdr) + ilen, 4);
711 
712 	hdr = (struct uath_cmd_hdr *)cmd->buf;
713 	memset(hdr, 0, sizeof(struct uath_cmd_hdr));
714 	hdr->len   = htobe32(cmd->buflen);
715 	hdr->code  = htobe32(code);
716 	hdr->msgid = cmd->msgid;	/* don't care about endianness */
717 	hdr->magic = htobe32((cmd->flags & UATH_CMD_FLAG_MAGIC) ? 1 << 24 : 0);
718 	memcpy((uint8_t *)(hdr + 1), idata, ilen);
719 
720 #ifdef UATH_DEBUG
721 	if (sc->sc_debug & UATH_DEBUG_CMDS) {
722 		printf("%s: send  %s [flags 0x%x] olen %d\n",
723 		    __func__, uath_codename(code), cmd->flags, olen);
724 		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
725 			uath_dump_cmd(cmd->buf, cmd->buflen, '+');
726 	}
727 #endif
728 	cmd->odata = odata;
729 	KASSERT(odata == NULL ||
730 	    olen < UATH_MAX_CMDSZ - sizeof(*hdr) + sizeof(uint32_t),
731 	    ("odata %p olen %u", odata, olen));
732 	cmd->olen = olen;
733 
734 	STAILQ_INSERT_TAIL(&sc->sc_cmd_pending, cmd, next);
735 	UATH_STAT_INC(sc, st_cmd_pending);
736 	usbd_transfer_start(sc->sc_xfer[UATH_INTR_TX]);
737 
738 	if (cmd->flags & UATH_CMD_FLAG_READ) {
739 		usbd_transfer_start(sc->sc_xfer[UATH_INTR_RX]);
740 
741 		/* wait at most two seconds for command reply */
742 		error = mtx_sleep(cmd, &sc->sc_mtx, 0, "uathcmd", 2 * hz);
743 		cmd->odata = NULL;	/* in case reply comes too late */
744 		if (error != 0) {
745 			device_printf(sc->sc_dev, "timeout waiting for reply "
746 			    "to cmd 0x%x (%u)\n", code, code);
747 		} else if (cmd->olen != olen) {
748 			device_printf(sc->sc_dev, "unexpected reply data count "
749 			    "to cmd 0x%x (%u), got %u, expected %u\n",
750 			    code, code, cmd->olen, olen);
751 			error = EINVAL;
752 		}
753 		return (error);
754 	}
755 	return (0);
756 }
757 
758 static int
759 uath_cmd_read(struct uath_softc *sc, uint32_t code, const void *idata,
760     int ilen, void *odata, int olen, int flags)
761 {
762 
763 	flags |= UATH_CMD_FLAG_READ;
764 	return uath_cmdsend(sc, code, idata, ilen, odata, olen, flags);
765 }
766 
767 static int
768 uath_cmd_write(struct uath_softc *sc, uint32_t code, const void *data, int len,
769     int flags)
770 {
771 
772 	flags &= ~UATH_CMD_FLAG_READ;
773 	return uath_cmdsend(sc, code, data, len, NULL, 0, flags);
774 }
775 
776 static struct uath_cmd *
777 uath_get_cmdbuf(struct uath_softc *sc)
778 {
779 	struct uath_cmd *uc;
780 
781 	UATH_ASSERT_LOCKED(sc);
782 
783 	uc = STAILQ_FIRST(&sc->sc_cmd_inactive);
784 	if (uc != NULL) {
785 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_inactive, next);
786 		UATH_STAT_DEC(sc, st_cmd_inactive);
787 	} else
788 		uc = NULL;
789 	if (uc == NULL)
790 		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: %s\n", __func__,
791 		    "out of command xmit buffers");
792 	return (uc);
793 }
794 
795 /*
796  * This function is called periodically (every second) when associated to
797  * query device statistics.
798  */
799 static void
800 uath_stat(void *arg)
801 {
802 	struct uath_softc *sc = arg;
803 	int error;
804 
805 	UATH_LOCK(sc);
806 	/*
807 	 * Send request for statistics asynchronously. The timer will be
808 	 * restarted when we'll get the stats notification.
809 	 */
810 	error = uath_cmd_write(sc, WDCMSG_TARGET_GET_STATS, NULL, 0,
811 	    UATH_CMD_FLAG_ASYNC);
812 	if (error != 0) {
813 		device_printf(sc->sc_dev,
814 		    "could not query stats, error %d\n", error);
815 	}
816 	UATH_UNLOCK(sc);
817 }
818 
819 static int
820 uath_get_capability(struct uath_softc *sc, uint32_t cap, uint32_t *val)
821 {
822 	int error;
823 
824 	cap = htobe32(cap);
825 	error = uath_cmd_read(sc, WDCMSG_TARGET_GET_CAPABILITY,
826 	    &cap, sizeof cap, val, sizeof(uint32_t), UATH_CMD_FLAG_MAGIC);
827 	if (error != 0) {
828 		device_printf(sc->sc_dev, "could not read capability %u\n",
829 		    be32toh(cap));
830 		return (error);
831 	}
832 	*val = be32toh(*val);
833 	return (error);
834 }
835 
836 static int
837 uath_get_devcap(struct uath_softc *sc)
838 {
839 #define	GETCAP(x, v) do {				\
840 	error = uath_get_capability(sc, x, &v);		\
841 	if (error != 0)					\
842 		return (error);				\
843 	DPRINTF(sc, UATH_DEBUG_DEVCAP,			\
844 	    "%s: %s=0x%08x\n", __func__, #x, v);	\
845 } while (0)
846 	struct uath_devcap *cap = &sc->sc_devcap;
847 	int error;
848 
849 	/* collect device capabilities */
850 	GETCAP(CAP_TARGET_VERSION, cap->targetVersion);
851 	GETCAP(CAP_TARGET_REVISION, cap->targetRevision);
852 	GETCAP(CAP_MAC_VERSION, cap->macVersion);
853 	GETCAP(CAP_MAC_REVISION, cap->macRevision);
854 	GETCAP(CAP_PHY_REVISION, cap->phyRevision);
855 	GETCAP(CAP_ANALOG_5GHz_REVISION, cap->analog5GhzRevision);
856 	GETCAP(CAP_ANALOG_2GHz_REVISION, cap->analog2GhzRevision);
857 
858 	GETCAP(CAP_REG_DOMAIN, cap->regDomain);
859 	GETCAP(CAP_REG_CAP_BITS, cap->regCapBits);
860 #if 0
861 	/* NB: not supported in rev 1.5 */
862 	GETCAP(CAP_COUNTRY_CODE, cap->countryCode);
863 #endif
864 	GETCAP(CAP_WIRELESS_MODES, cap->wirelessModes);
865 	GETCAP(CAP_CHAN_SPREAD_SUPPORT, cap->chanSpreadSupport);
866 	GETCAP(CAP_COMPRESS_SUPPORT, cap->compressSupport);
867 	GETCAP(CAP_BURST_SUPPORT, cap->burstSupport);
868 	GETCAP(CAP_FAST_FRAMES_SUPPORT, cap->fastFramesSupport);
869 	GETCAP(CAP_CHAP_TUNING_SUPPORT, cap->chapTuningSupport);
870 	GETCAP(CAP_TURBOG_SUPPORT, cap->turboGSupport);
871 	GETCAP(CAP_TURBO_PRIME_SUPPORT, cap->turboPrimeSupport);
872 	GETCAP(CAP_DEVICE_TYPE, cap->deviceType);
873 	GETCAP(CAP_WME_SUPPORT, cap->wmeSupport);
874 	GETCAP(CAP_TOTAL_QUEUES, cap->numTxQueues);
875 	GETCAP(CAP_CONNECTION_ID_MAX, cap->connectionIdMax);
876 
877 	GETCAP(CAP_LOW_5GHZ_CHAN, cap->low5GhzChan);
878 	GETCAP(CAP_HIGH_5GHZ_CHAN, cap->high5GhzChan);
879 	GETCAP(CAP_LOW_2GHZ_CHAN, cap->low2GhzChan);
880 	GETCAP(CAP_HIGH_2GHZ_CHAN, cap->high2GhzChan);
881 	GETCAP(CAP_TWICE_ANTENNAGAIN_5G, cap->twiceAntennaGain5G);
882 	GETCAP(CAP_TWICE_ANTENNAGAIN_2G, cap->twiceAntennaGain2G);
883 
884 	GETCAP(CAP_CIPHER_AES_CCM, cap->supportCipherAES_CCM);
885 	GETCAP(CAP_CIPHER_TKIP, cap->supportCipherTKIP);
886 	GETCAP(CAP_MIC_TKIP, cap->supportMicTKIP);
887 
888 	cap->supportCipherWEP = 1;	/* NB: always available */
889 
890 	return (0);
891 }
892 
893 static int
894 uath_get_devstatus(struct uath_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
895 {
896 	int error;
897 
898 	/* retrieve MAC address */
899 	error = uath_get_status(sc, ST_MAC_ADDR, macaddr, IEEE80211_ADDR_LEN);
900 	if (error != 0) {
901 		device_printf(sc->sc_dev, "could not read MAC address\n");
902 		return (error);
903 	}
904 
905 	error = uath_get_status(sc, ST_SERIAL_NUMBER,
906 	    &sc->sc_serial[0], sizeof(sc->sc_serial));
907 	if (error != 0) {
908 		device_printf(sc->sc_dev,
909 		    "could not read device serial number\n");
910 		return (error);
911 	}
912 	return (0);
913 }
914 
915 static int
916 uath_get_status(struct uath_softc *sc, uint32_t which, void *odata, int olen)
917 {
918 	int error;
919 
920 	which = htobe32(which);
921 	error = uath_cmd_read(sc, WDCMSG_TARGET_GET_STATUS,
922 	    &which, sizeof(which), odata, olen, UATH_CMD_FLAG_MAGIC);
923 	if (error != 0)
924 		device_printf(sc->sc_dev,
925 		    "could not read EEPROM offset 0x%02x\n", be32toh(which));
926 	return (error);
927 }
928 
929 static void
930 uath_free_data_list(struct uath_softc *sc, struct uath_data data[], int ndata,
931     int fillmbuf)
932 {
933 	int i;
934 
935 	for (i = 0; i < ndata; i++) {
936 		struct uath_data *dp = &data[i];
937 
938 		if (fillmbuf == 1) {
939 			if (dp->m != NULL) {
940 				m_freem(dp->m);
941 				dp->m = NULL;
942 				dp->buf = NULL;
943 			}
944 		} else {
945 			if (dp->buf != NULL) {
946 				free(dp->buf, M_USBDEV);
947 				dp->buf = NULL;
948 			}
949 		}
950 #ifdef UATH_DEBUG
951 		if (dp->ni != NULL)
952 			device_printf(sc->sc_dev, "Node isn't NULL\n");
953 #endif
954 	}
955 }
956 
957 static int
958 uath_alloc_data_list(struct uath_softc *sc, struct uath_data data[],
959 	int ndata, int maxsz, int fillmbuf)
960 {
961 	int i, error;
962 
963 	for (i = 0; i < ndata; i++) {
964 		struct uath_data *dp = &data[i];
965 
966 		dp->sc = sc;
967 		if (fillmbuf) {
968 			/* XXX check maxsz */
969 			dp->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
970 			if (dp->m == NULL) {
971 				device_printf(sc->sc_dev,
972 				    "could not allocate rx mbuf\n");
973 				error = ENOMEM;
974 				goto fail;
975 			}
976 			dp->buf = mtod(dp->m, uint8_t *);
977 		} else {
978 			dp->m = NULL;
979 			dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
980 			if (dp->buf == NULL) {
981 				device_printf(sc->sc_dev,
982 				    "could not allocate buffer\n");
983 				error = ENOMEM;
984 				goto fail;
985 			}
986 		}
987 		dp->ni = NULL;
988 	}
989 
990 	return (0);
991 
992 fail:	uath_free_data_list(sc, data, ndata, fillmbuf);
993 	return (error);
994 }
995 
996 static int
997 uath_alloc_rx_data_list(struct uath_softc *sc)
998 {
999 	int error, i;
1000 
1001 	/* XXX is it enough to store the RX packet with MCLBYTES bytes?  */
1002 	error = uath_alloc_data_list(sc,
1003 	    sc->sc_rx, UATH_RX_DATA_LIST_COUNT, MCLBYTES,
1004 	    1 /* setup mbufs */);
1005 	if (error != 0)
1006 		return (error);
1007 
1008 	STAILQ_INIT(&sc->sc_rx_active);
1009 	STAILQ_INIT(&sc->sc_rx_inactive);
1010 
1011 	for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
1012 		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i],
1013 		    next);
1014 		UATH_STAT_INC(sc, st_rx_inactive);
1015 	}
1016 
1017 	return (0);
1018 }
1019 
1020 static int
1021 uath_alloc_tx_data_list(struct uath_softc *sc)
1022 {
1023 	int error, i;
1024 
1025 	error = uath_alloc_data_list(sc,
1026 	    sc->sc_tx, UATH_TX_DATA_LIST_COUNT, UATH_MAX_TXBUFSZ,
1027 	    0 /* no mbufs */);
1028 	if (error != 0)
1029 		return (error);
1030 
1031 	STAILQ_INIT(&sc->sc_tx_active);
1032 	STAILQ_INIT(&sc->sc_tx_inactive);
1033 	STAILQ_INIT(&sc->sc_tx_pending);
1034 
1035 	for (i = 0; i < UATH_TX_DATA_LIST_COUNT; i++) {
1036 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i],
1037 		    next);
1038 		UATH_STAT_INC(sc, st_tx_inactive);
1039 	}
1040 
1041 	return (0);
1042 }
1043 
1044 static void
1045 uath_free_rx_data_list(struct uath_softc *sc)
1046 {
1047 
1048 	STAILQ_INIT(&sc->sc_rx_active);
1049 	STAILQ_INIT(&sc->sc_rx_inactive);
1050 
1051 	uath_free_data_list(sc, sc->sc_rx, UATH_RX_DATA_LIST_COUNT,
1052 	    1 /* free mbufs */);
1053 }
1054 
1055 static void
1056 uath_free_tx_data_list(struct uath_softc *sc)
1057 {
1058 
1059 	STAILQ_INIT(&sc->sc_tx_active);
1060 	STAILQ_INIT(&sc->sc_tx_inactive);
1061 	STAILQ_INIT(&sc->sc_tx_pending);
1062 
1063 	uath_free_data_list(sc, sc->sc_tx, UATH_TX_DATA_LIST_COUNT,
1064 	    0 /* no mbufs */);
1065 }
1066 
1067 static struct ieee80211vap *
1068 uath_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1069     enum ieee80211_opmode opmode, int flags,
1070     const uint8_t bssid[IEEE80211_ADDR_LEN],
1071     const uint8_t mac[IEEE80211_ADDR_LEN])
1072 {
1073 	struct uath_vap *uvp;
1074 	struct ieee80211vap *vap;
1075 
1076 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
1077 		return (NULL);
1078 	uvp = (struct uath_vap *) malloc(sizeof(struct uath_vap),
1079 	    M_80211_VAP, M_NOWAIT | M_ZERO);
1080 	if (uvp == NULL)
1081 		return (NULL);
1082 	vap = &uvp->vap;
1083 	/* enable s/w bmiss handling for sta mode */
1084 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
1085 	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
1086 
1087 	/* override state transition machine */
1088 	uvp->newstate = vap->iv_newstate;
1089 	vap->iv_newstate = uath_newstate;
1090 
1091 	/* complete setup */
1092 	ieee80211_vap_attach(vap, ieee80211_media_change,
1093 	    ieee80211_media_status);
1094 	ic->ic_opmode = opmode;
1095 	return (vap);
1096 }
1097 
1098 static void
1099 uath_vap_delete(struct ieee80211vap *vap)
1100 {
1101 	struct uath_vap *uvp = UATH_VAP(vap);
1102 
1103 	ieee80211_vap_detach(vap);
1104 	free(uvp, M_80211_VAP);
1105 }
1106 
1107 static int
1108 uath_init_locked(void *arg)
1109 {
1110 	struct uath_softc *sc = arg;
1111 	struct ifnet *ifp = sc->sc_ifp;
1112 	struct ieee80211com *ic = ifp->if_l2com;
1113 	uint32_t val;
1114 	int error;
1115 
1116 	UATH_ASSERT_LOCKED(sc);
1117 
1118 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1119 		uath_stop_locked(ifp);
1120 
1121 	/* reset variables */
1122 	sc->sc_intrx_nextnum = sc->sc_msgid = 0;
1123 
1124 	val = htobe32(0);
1125 	uath_cmd_write(sc, WDCMSG_BIND, &val, sizeof val, 0);
1126 
1127 	/* set MAC address */
1128 	uath_config_multi(sc, CFG_MAC_ADDR, IF_LLADDR(ifp), IEEE80211_ADDR_LEN);
1129 
1130 	/* XXX honor net80211 state */
1131 	uath_config(sc, CFG_RATE_CONTROL_ENABLE, 0x00000001);
1132 	uath_config(sc, CFG_DIVERSITY_CTL, 0x00000001);
1133 	uath_config(sc, CFG_ABOLT, 0x0000003f);
1134 	uath_config(sc, CFG_WME_ENABLED, 0x00000001);
1135 
1136 	uath_config(sc, CFG_SERVICE_TYPE, 1);
1137 	uath_config(sc, CFG_TP_SCALE, 0x00000000);
1138 	uath_config(sc, CFG_TPC_HALF_DBM5, 0x0000003c);
1139 	uath_config(sc, CFG_TPC_HALF_DBM2, 0x0000003c);
1140 	uath_config(sc, CFG_OVERRD_TX_POWER, 0x00000000);
1141 	uath_config(sc, CFG_GMODE_PROTECTION, 0x00000000);
1142 	uath_config(sc, CFG_GMODE_PROTECT_RATE_INDEX, 0x00000003);
1143 	uath_config(sc, CFG_PROTECTION_TYPE, 0x00000000);
1144 	uath_config(sc, CFG_MODE_CTS, 0x00000002);
1145 
1146 	error = uath_cmd_read(sc, WDCMSG_TARGET_START, NULL, 0,
1147 	    &val, sizeof(val), UATH_CMD_FLAG_MAGIC);
1148 	if (error) {
1149 		device_printf(sc->sc_dev,
1150 		    "could not start target, error %d\n", error);
1151 		goto fail;
1152 	}
1153 	DPRINTF(sc, UATH_DEBUG_INIT, "%s returns handle: 0x%x\n",
1154 	    uath_codename(WDCMSG_TARGET_START), be32toh(val));
1155 
1156 	/* set default channel */
1157 	error = uath_switch_channel(sc, ic->ic_curchan);
1158 	if (error) {
1159 		device_printf(sc->sc_dev,
1160 		    "could not switch channel, error %d\n", error);
1161 		goto fail;
1162 	}
1163 
1164 	val = htobe32(TARGET_DEVICE_AWAKE);
1165 	uath_cmd_write(sc, WDCMSG_SET_PWR_MODE, &val, sizeof val, 0);
1166 	/* XXX? check */
1167 	uath_cmd_write(sc, WDCMSG_RESET_KEY_CACHE, NULL, 0, 0);
1168 
1169 	usbd_transfer_start(sc->sc_xfer[UATH_BULK_RX]);
1170 	/* enable Rx */
1171 	uath_set_rxfilter(sc, 0x0, UATH_FILTER_OP_INIT);
1172 	uath_set_rxfilter(sc,
1173 	    UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1174 	    UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON,
1175 	    UATH_FILTER_OP_SET);
1176 
1177 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1178 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1179 	sc->sc_flags |= UATH_FLAG_INITDONE;
1180 
1181 	callout_reset(&sc->watchdog_ch, hz, uath_watchdog, sc);
1182 
1183 	return (0);
1184 
1185 fail:
1186 	uath_stop_locked(ifp);
1187 	return (error);
1188 }
1189 
1190 static void
1191 uath_init(void *arg)
1192 {
1193 	struct uath_softc *sc = arg;
1194 
1195 	UATH_LOCK(sc);
1196 	(void)uath_init_locked(sc);
1197 	UATH_UNLOCK(sc);
1198 }
1199 
1200 static void
1201 uath_stop_locked(struct ifnet *ifp)
1202 {
1203 	struct uath_softc *sc = ifp->if_softc;
1204 
1205 	UATH_ASSERT_LOCKED(sc);
1206 
1207 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1208 	sc->sc_flags &= ~UATH_FLAG_INITDONE;
1209 
1210 	callout_stop(&sc->stat_ch);
1211 	callout_stop(&sc->watchdog_ch);
1212 	sc->sc_tx_timer = 0;
1213 	/* abort pending transmits  */
1214 	uath_abort_xfers(sc);
1215 	/* flush data & control requests into the target  */
1216 	(void)uath_flush(sc);
1217 	/* set a LED status to the disconnected.  */
1218 	uath_set_ledstate(sc, 0);
1219 	/* stop the target  */
1220 	uath_cmd_write(sc, WDCMSG_TARGET_STOP, NULL, 0, 0);
1221 }
1222 
1223 static void
1224 uath_stop(struct ifnet *ifp)
1225 {
1226 	struct uath_softc *sc = ifp->if_softc;
1227 
1228 	UATH_LOCK(sc);
1229 	uath_stop_locked(ifp);
1230 	UATH_UNLOCK(sc);
1231 }
1232 
1233 static int
1234 uath_config(struct uath_softc *sc, uint32_t reg, uint32_t val)
1235 {
1236 	struct uath_write_mac write;
1237 	int error;
1238 
1239 	write.reg = htobe32(reg);
1240 	write.len = htobe32(0);	/* 0 = single write */
1241 	*(uint32_t *)write.data = htobe32(val);
1242 
1243 	error = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
1244 	    3 * sizeof (uint32_t), 0);
1245 	if (error != 0) {
1246 		device_printf(sc->sc_dev, "could not write register 0x%02x\n",
1247 		    reg);
1248 	}
1249 	return (error);
1250 }
1251 
1252 static int
1253 uath_config_multi(struct uath_softc *sc, uint32_t reg, const void *data,
1254     int len)
1255 {
1256 	struct uath_write_mac write;
1257 	int error;
1258 
1259 	write.reg = htobe32(reg);
1260 	write.len = htobe32(len);
1261 	bcopy(data, write.data, len);
1262 
1263 	/* properly handle the case where len is zero (reset) */
1264 	error = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
1265 	    (len == 0) ? sizeof (uint32_t) : 2 * sizeof (uint32_t) + len, 0);
1266 	if (error != 0) {
1267 		device_printf(sc->sc_dev,
1268 		    "could not write %d bytes to register 0x%02x\n", len, reg);
1269 	}
1270 	return (error);
1271 }
1272 
1273 static int
1274 uath_switch_channel(struct uath_softc *sc, struct ieee80211_channel *c)
1275 {
1276 	int error;
1277 
1278 	UATH_ASSERT_LOCKED(sc);
1279 
1280 	/* set radio frequency */
1281 	error = uath_set_chan(sc, c);
1282 	if (error) {
1283 		device_printf(sc->sc_dev,
1284 		    "could not set channel, error %d\n", error);
1285 		goto failed;
1286 	}
1287 	/* reset Tx rings */
1288 	error = uath_reset_tx_queues(sc);
1289 	if (error) {
1290 		device_printf(sc->sc_dev,
1291 		    "could not reset Tx queues, error %d\n", error);
1292 		goto failed;
1293 	}
1294 	/* set Tx rings WME properties */
1295 	error = uath_wme_init(sc);
1296 	if (error) {
1297 		device_printf(sc->sc_dev,
1298 		    "could not init Tx queues, error %d\n", error);
1299 		goto failed;
1300 	}
1301 	error = uath_set_ledstate(sc, 0);
1302 	if (error) {
1303 		device_printf(sc->sc_dev,
1304 		    "could not set led state, error %d\n", error);
1305 		goto failed;
1306 	}
1307 	error = uath_flush(sc);
1308 	if (error) {
1309 		device_printf(sc->sc_dev,
1310 		    "could not flush pipes, error %d\n", error);
1311 		goto failed;
1312 	}
1313 failed:
1314 	return (error);
1315 }
1316 
1317 static int
1318 uath_set_rxfilter(struct uath_softc *sc, uint32_t bits, uint32_t op)
1319 {
1320 	struct uath_cmd_rx_filter rxfilter;
1321 
1322 	rxfilter.bits = htobe32(bits);
1323 	rxfilter.op = htobe32(op);
1324 
1325 	DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
1326 	    "setting Rx filter=0x%x flags=0x%x\n", bits, op);
1327 	return uath_cmd_write(sc, WDCMSG_RX_FILTER, &rxfilter,
1328 	    sizeof rxfilter, 0);
1329 }
1330 
1331 static void
1332 uath_watchdog(void *arg)
1333 {
1334 	struct uath_softc *sc = arg;
1335 	struct ifnet *ifp = sc->sc_ifp;
1336 
1337 	if (sc->sc_tx_timer > 0) {
1338 		if (--sc->sc_tx_timer == 0) {
1339 			device_printf(sc->sc_dev, "device timeout\n");
1340 			/*uath_init(ifp); XXX needs a process context! */
1341 			ifp->if_oerrors++;
1342 			return;
1343 		}
1344 		callout_reset(&sc->watchdog_ch, hz, uath_watchdog, sc);
1345 	}
1346 }
1347 
1348 static void
1349 uath_abort_xfers(struct uath_softc *sc)
1350 {
1351 	int i;
1352 
1353 	UATH_ASSERT_LOCKED(sc);
1354 	/* abort any pending transfers */
1355 	for (i = 0; i < UATH_N_XFERS; i++)
1356 		usbd_transfer_stop(sc->sc_xfer[i]);
1357 }
1358 
1359 static int
1360 uath_flush(struct uath_softc *sc)
1361 {
1362 	int error;
1363 
1364 	error = uath_dataflush(sc);
1365 	if (error != 0)
1366 		goto failed;
1367 
1368 	error = uath_cmdflush(sc);
1369 	if (error != 0)
1370 		goto failed;
1371 
1372 failed:
1373 	return (error);
1374 }
1375 
1376 static int
1377 uath_cmdflush(struct uath_softc *sc)
1378 {
1379 
1380 	return uath_cmd_write(sc, WDCMSG_FLUSH, NULL, 0, 0);
1381 }
1382 
1383 static int
1384 uath_dataflush(struct uath_softc *sc)
1385 {
1386 	struct uath_data *data;
1387 	struct uath_chunk *chunk;
1388 	struct uath_tx_desc *desc;
1389 
1390 	UATH_ASSERT_LOCKED(sc);
1391 
1392 	data = uath_getbuf(sc);
1393 	if (data == NULL)
1394 		return (ENOBUFS);
1395 	data->buflen = sizeof(struct uath_chunk) + sizeof(struct uath_tx_desc);
1396 	data->m = NULL;
1397 	data->ni = NULL;
1398 	chunk = (struct uath_chunk *)data->buf;
1399 	desc = (struct uath_tx_desc *)(chunk + 1);
1400 
1401 	/* one chunk only */
1402 	chunk->seqnum = 0;
1403 	chunk->flags = UATH_CFLAGS_FINAL;
1404 	chunk->length = htobe16(sizeof (struct uath_tx_desc));
1405 
1406 	memset(desc, 0, sizeof(struct uath_tx_desc));
1407 	desc->msglen = htobe32(sizeof(struct uath_tx_desc));
1408 	desc->msgid  = (sc->sc_msgid++) + 1; /* don't care about endianness */
1409 	desc->type   = htobe32(WDCMSG_FLUSH);
1410 	desc->txqid  = htobe32(0);
1411 	desc->connid = htobe32(0);
1412 	desc->flags  = htobe32(0);
1413 
1414 #ifdef UATH_DEBUG
1415 	if (sc->sc_debug & UATH_DEBUG_CMDS) {
1416 		DPRINTF(sc, UATH_DEBUG_RESET, "send flush ix %d\n",
1417 		    desc->msgid);
1418 		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
1419 			uath_dump_cmd(data->buf, data->buflen, '+');
1420 	}
1421 #endif
1422 
1423 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1424 	UATH_STAT_INC(sc, st_tx_pending);
1425 	sc->sc_tx_timer = 5;
1426 	usbd_transfer_start(sc->sc_xfer[UATH_BULK_TX]);
1427 
1428 	return (0);
1429 }
1430 
1431 static struct uath_data *
1432 _uath_getbuf(struct uath_softc *sc)
1433 {
1434 	struct uath_data *bf;
1435 
1436 	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1437 	if (bf != NULL) {
1438 		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1439 		UATH_STAT_DEC(sc, st_tx_inactive);
1440 	} else
1441 		bf = NULL;
1442 	if (bf == NULL)
1443 		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: %s\n", __func__,
1444 		    "out of xmit buffers");
1445 	return (bf);
1446 }
1447 
1448 static struct uath_data *
1449 uath_getbuf(struct uath_softc *sc)
1450 {
1451 	struct uath_data *bf;
1452 
1453 	UATH_ASSERT_LOCKED(sc);
1454 
1455 	bf = _uath_getbuf(sc);
1456 	if (bf == NULL) {
1457 		struct ifnet *ifp = sc->sc_ifp;
1458 
1459 		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: stop queue\n", __func__);
1460 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1461 	}
1462 	return (bf);
1463 }
1464 
1465 static int
1466 uath_set_ledstate(struct uath_softc *sc, int connected)
1467 {
1468 
1469 	DPRINTF(sc, UATH_DEBUG_LED,
1470 	    "set led state %sconnected\n", connected ? "" : "!");
1471 	connected = htobe32(connected);
1472 	return uath_cmd_write(sc, WDCMSG_SET_LED_STATE,
1473 	     &connected, sizeof connected, 0);
1474 }
1475 
1476 static int
1477 uath_set_chan(struct uath_softc *sc, struct ieee80211_channel *c)
1478 {
1479 #ifdef UATH_DEBUG
1480 	struct ifnet *ifp = sc->sc_ifp;
1481 	struct ieee80211com *ic = ifp->if_l2com;
1482 #endif
1483 	struct uath_cmd_reset reset;
1484 
1485 	memset(&reset, 0, sizeof(reset));
1486 	if (IEEE80211_IS_CHAN_2GHZ(c))
1487 		reset.flags |= htobe32(UATH_CHAN_2GHZ);
1488 	if (IEEE80211_IS_CHAN_5GHZ(c))
1489 		reset.flags |= htobe32(UATH_CHAN_5GHZ);
1490 	/* NB: 11g =>'s 11b so don't specify both OFDM and CCK */
1491 	if (IEEE80211_IS_CHAN_OFDM(c))
1492 		reset.flags |= htobe32(UATH_CHAN_OFDM);
1493 	else if (IEEE80211_IS_CHAN_CCK(c))
1494 		reset.flags |= htobe32(UATH_CHAN_CCK);
1495 	/* turbo can be used in either 2GHz or 5GHz */
1496 	if (c->ic_flags & IEEE80211_CHAN_TURBO)
1497 		reset.flags |= htobe32(UATH_CHAN_TURBO);
1498 	reset.freq = htobe32(c->ic_freq);
1499 	reset.maxrdpower = htobe32(50);	/* XXX */
1500 	reset.channelchange = htobe32(1);
1501 	reset.keeprccontent = htobe32(0);
1502 
1503 	DPRINTF(sc, UATH_DEBUG_CHANNEL, "set channel %d, flags 0x%x freq %u\n",
1504 	    ieee80211_chan2ieee(ic, c),
1505 	    be32toh(reset.flags), be32toh(reset.freq));
1506 	return uath_cmd_write(sc, WDCMSG_RESET, &reset, sizeof reset, 0);
1507 }
1508 
1509 static int
1510 uath_reset_tx_queues(struct uath_softc *sc)
1511 {
1512 	int ac, error;
1513 
1514 	DPRINTF(sc, UATH_DEBUG_RESET, "%s: reset Tx queues\n", __func__);
1515 	for (ac = 0; ac < 4; ac++) {
1516 		const uint32_t qid = htobe32(ac);
1517 
1518 		error = uath_cmd_write(sc, WDCMSG_RELEASE_TX_QUEUE, &qid,
1519 		    sizeof qid, 0);
1520 		if (error != 0)
1521 			break;
1522 	}
1523 	return (error);
1524 }
1525 
1526 static int
1527 uath_wme_init(struct uath_softc *sc)
1528 {
1529 	/* XXX get from net80211 */
1530 	static const struct uath_wme_settings uath_wme_11g[4] = {
1531 		{ 7, 4, 10,  0, 0 },	/* Background */
1532 		{ 3, 4, 10,  0, 0 },	/* Best-Effort */
1533 		{ 3, 3,  4, 26, 0 },	/* Video */
1534 		{ 2, 2,  3, 47, 0 }	/* Voice */
1535 	};
1536 	struct uath_cmd_txq_setup qinfo;
1537 	int ac, error;
1538 
1539 	DPRINTF(sc, UATH_DEBUG_WME, "%s: setup Tx queues\n", __func__);
1540 	for (ac = 0; ac < 4; ac++) {
1541 		qinfo.qid		= htobe32(ac);
1542 		qinfo.len		= htobe32(sizeof(qinfo.attr));
1543 		qinfo.attr.priority	= htobe32(ac);	/* XXX */
1544 		qinfo.attr.aifs		= htobe32(uath_wme_11g[ac].aifsn);
1545 		qinfo.attr.logcwmin	= htobe32(uath_wme_11g[ac].logcwmin);
1546 		qinfo.attr.logcwmax	= htobe32(uath_wme_11g[ac].logcwmax);
1547 		qinfo.attr.bursttime	= htobe32(UATH_TXOP_TO_US(
1548 					    uath_wme_11g[ac].txop));
1549 		qinfo.attr.mode		= htobe32(uath_wme_11g[ac].acm);/*XXX? */
1550 		qinfo.attr.qflags	= htobe32(1);	/* XXX? */
1551 
1552 		error = uath_cmd_write(sc, WDCMSG_SETUP_TX_QUEUE, &qinfo,
1553 		    sizeof qinfo, 0);
1554 		if (error != 0)
1555 			break;
1556 	}
1557 	return (error);
1558 }
1559 
1560 static int
1561 uath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1562 {
1563 	struct ieee80211com *ic = ifp->if_l2com;
1564 	struct ifreq *ifr = (struct ifreq *) data;
1565 	int error = 0, startall = 0;
1566 
1567 	switch (cmd) {
1568 	case SIOCSIFFLAGS:
1569 		if (ifp->if_flags & IFF_UP) {
1570 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1571 				uath_init(ifp->if_softc);
1572 				startall = 1;
1573 			}
1574 		} else {
1575 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1576 				uath_stop(ifp);
1577 		}
1578 		if (startall)
1579 			ieee80211_start_all(ic);
1580 		break;
1581 	case SIOCGIFMEDIA:
1582 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1583 		break;
1584 	case SIOCGIFADDR:
1585 		error = ether_ioctl(ifp, cmd, data);
1586 		break;
1587 	default:
1588 		error = EINVAL;
1589 		break;
1590 	}
1591 
1592 	return (error);
1593 }
1594 
1595 static int
1596 uath_tx_start(struct uath_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1597     struct uath_data *data)
1598 {
1599 	struct ieee80211vap *vap = ni->ni_vap;
1600 	struct uath_chunk *chunk;
1601 	struct uath_tx_desc *desc;
1602 	const struct ieee80211_frame *wh;
1603 	struct ieee80211_key *k;
1604 	int framelen, msglen;
1605 
1606 	UATH_ASSERT_LOCKED(sc);
1607 
1608 	data->ni = ni;
1609 	data->m = m0;
1610 	chunk = (struct uath_chunk *)data->buf;
1611 	desc = (struct uath_tx_desc *)(chunk + 1);
1612 
1613 	if (ieee80211_radiotap_active_vap(vap)) {
1614 		struct uath_tx_radiotap_header *tap = &sc->sc_txtap;
1615 
1616 		tap->wt_flags = 0;
1617 		if (m0->m_flags & M_FRAG)
1618 			tap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
1619 
1620 		ieee80211_radiotap_tx(vap, m0);
1621 	}
1622 
1623 	wh = mtod(m0, struct ieee80211_frame *);
1624 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1625 		k = ieee80211_crypto_encap(ni, m0);
1626 		if (k == NULL) {
1627 			m_freem(m0);
1628 			return (ENOBUFS);
1629 		}
1630 
1631 		/* packet header may have moved, reset our local pointer */
1632 		wh = mtod(m0, struct ieee80211_frame *);
1633 	}
1634 	m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(desc + 1));
1635 
1636 	framelen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1637 	msglen = framelen + sizeof (struct uath_tx_desc);
1638 	data->buflen = msglen + sizeof (struct uath_chunk);
1639 
1640 	/* one chunk only for now */
1641 	chunk->seqnum = sc->sc_seqnum++;
1642 	chunk->flags = (m0->m_flags & M_FRAG) ? 0 : UATH_CFLAGS_FINAL;
1643 	if (m0->m_flags & M_LASTFRAG)
1644 		chunk->flags |= UATH_CFLAGS_FINAL;
1645 	chunk->flags = UATH_CFLAGS_FINAL;
1646 	chunk->length = htobe16(msglen);
1647 
1648 	/* fill Tx descriptor */
1649 	desc->msglen = htobe32(msglen);
1650 	/* NB: to get UATH_TX_NOTIFY reply, `msgid' must be larger than 0  */
1651 	desc->msgid  = (sc->sc_msgid++) + 1; /* don't care about endianness */
1652 	desc->type   = htobe32(WDCMSG_SEND);
1653 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1654 	case IEEE80211_FC0_TYPE_CTL:
1655 	case IEEE80211_FC0_TYPE_MGT:
1656 		/* NB: force all management frames to highest queue */
1657 		if (ni->ni_flags & IEEE80211_NODE_QOS) {
1658 			/* NB: force all management frames to highest queue */
1659 			desc->txqid = htobe32(WME_AC_VO | UATH_TXQID_MINRATE);
1660 		} else
1661 			desc->txqid = htobe32(WME_AC_BE | UATH_TXQID_MINRATE);
1662 		break;
1663 	case IEEE80211_FC0_TYPE_DATA:
1664 		/* XXX multicast frames should honor mcastrate */
1665 		desc->txqid = htobe32(M_WME_GETAC(m0));
1666 		break;
1667 	default:
1668 		device_printf(sc->sc_dev, "bogus frame type 0x%x (%s)\n",
1669 			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1670 		m_freem(m0);
1671 		return (EIO);
1672 	}
1673 	if (vap->iv_state == IEEE80211_S_AUTH ||
1674 	    vap->iv_state == IEEE80211_S_ASSOC ||
1675 	    vap->iv_state == IEEE80211_S_RUN)
1676 		desc->connid = htobe32(UATH_ID_BSS);
1677 	else
1678 		desc->connid = htobe32(UATH_ID_INVALID);
1679 	desc->flags  = htobe32(0 /* no UATH_TX_NOTIFY */);
1680 	desc->buflen = htobe32(m0->m_pkthdr.len);
1681 
1682 #ifdef UATH_DEBUG
1683 	DPRINTF(sc, UATH_DEBUG_XMIT,
1684 	    "send frame ix %u framelen %d msglen %d connid 0x%x txqid 0x%x\n",
1685 	    desc->msgid, framelen, msglen, be32toh(desc->connid),
1686 	    be32toh(desc->txqid));
1687 	if (sc->sc_debug & UATH_DEBUG_XMIT_DUMP)
1688 		uath_dump_cmd(data->buf, data->buflen, '+');
1689 #endif
1690 
1691 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1692 	UATH_STAT_INC(sc, st_tx_pending);
1693 	usbd_transfer_start(sc->sc_xfer[UATH_BULK_TX]);
1694 
1695 	return (0);
1696 }
1697 
1698 /*
1699  * Cleanup driver resources when we run out of buffers while processing
1700  * fragments; return the tx buffers allocated and drop node references.
1701  */
1702 static void
1703 uath_txfrag_cleanup(struct uath_softc *sc,
1704     uath_datahead *frags, struct ieee80211_node *ni)
1705 {
1706 	struct uath_data *bf, *next;
1707 
1708 	UATH_ASSERT_LOCKED(sc);
1709 
1710 	STAILQ_FOREACH_SAFE(bf, frags, next, next) {
1711 		/* NB: bf assumed clean */
1712 		STAILQ_REMOVE_HEAD(frags, next);
1713 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1714 		UATH_STAT_INC(sc, st_tx_inactive);
1715 		ieee80211_node_decref(ni);
1716 	}
1717 }
1718 
1719 /*
1720  * Setup xmit of a fragmented frame.  Allocate a buffer for each frag and bump
1721  * the node reference count to reflect the held reference to be setup by
1722  * uath_tx_start.
1723  */
1724 static int
1725 uath_txfrag_setup(struct uath_softc *sc, uath_datahead *frags,
1726     struct mbuf *m0, struct ieee80211_node *ni)
1727 {
1728 	struct mbuf *m;
1729 	struct uath_data *bf;
1730 
1731 	UATH_ASSERT_LOCKED(sc);
1732 	for (m = m0->m_nextpkt; m != NULL; m = m->m_nextpkt) {
1733 		bf = uath_getbuf(sc);
1734 		if (bf == NULL) {       /* out of buffers, cleanup */
1735 			uath_txfrag_cleanup(sc, frags, ni);
1736 			break;
1737 		}
1738 		ieee80211_node_incref(ni);
1739 		STAILQ_INSERT_TAIL(frags, bf, next);
1740 	}
1741 
1742 	return !STAILQ_EMPTY(frags);
1743 }
1744 
1745 /*
1746  * Reclaim mbuf resources.  For fragmented frames we need to claim each frag
1747  * chained with m_nextpkt.
1748  */
1749 static void
1750 uath_freetx(struct mbuf *m)
1751 {
1752 	struct mbuf *next;
1753 
1754 	do {
1755 		next = m->m_nextpkt;
1756 		m->m_nextpkt = NULL;
1757 		m_freem(m);
1758 	} while ((m = next) != NULL);
1759 }
1760 
1761 static void
1762 uath_start(struct ifnet *ifp)
1763 {
1764 	struct uath_data *bf;
1765 	struct uath_softc *sc = ifp->if_softc;
1766 	struct ieee80211_node *ni;
1767 	struct mbuf *m, *next;
1768 	uath_datahead frags;
1769 
1770 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
1771 	    (sc->sc_flags & UATH_FLAG_INVALID))
1772 		return;
1773 
1774 	UATH_LOCK(sc);
1775 	for (;;) {
1776 		bf = uath_getbuf(sc);
1777 		if (bf == NULL)
1778 			break;
1779 
1780 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1781 		if (m == NULL) {
1782 			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1783 			UATH_STAT_INC(sc, st_tx_inactive);
1784 			break;
1785 		}
1786 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1787 		m->m_pkthdr.rcvif = NULL;
1788 
1789 		/*
1790 		 * Check for fragmentation.  If this frame has been broken up
1791 		 * verify we have enough buffers to send all the fragments
1792 		 * so all go out or none...
1793 		 */
1794 		STAILQ_INIT(&frags);
1795 		if ((m->m_flags & M_FRAG) &&
1796 		    !uath_txfrag_setup(sc, &frags, m, ni)) {
1797 			DPRINTF(sc, UATH_DEBUG_XMIT,
1798 			    "%s: out of txfrag buffers\n", __func__);
1799 			uath_freetx(m);
1800 			goto bad;
1801 		}
1802 		sc->sc_seqnum = 0;
1803 	nextfrag:
1804 		/*
1805 		 * Pass the frame to the h/w for transmission.
1806 		 * Fragmented frames have each frag chained together
1807 		 * with m_nextpkt.  We know there are sufficient uath_data's
1808 		 * to send all the frags because of work done by
1809 		 * uath_txfrag_setup.
1810 		 */
1811 		next = m->m_nextpkt;
1812 		if (uath_tx_start(sc, m, ni, bf) != 0) {
1813 	bad:
1814 			ifp->if_oerrors++;
1815 	reclaim:
1816 			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1817 			UATH_STAT_INC(sc, st_tx_inactive);
1818 			uath_txfrag_cleanup(sc, &frags, ni);
1819 			ieee80211_free_node(ni);
1820 			continue;
1821 		}
1822 
1823 		if (next != NULL) {
1824 			/*
1825 			 * Beware of state changing between frags.
1826 			 XXX check sta power-save state?
1827 			*/
1828 			if (ni->ni_vap->iv_state != IEEE80211_S_RUN) {
1829 				DPRINTF(sc, UATH_DEBUG_XMIT,
1830 				    "%s: flush fragmented packet, state %s\n",
1831 				    __func__,
1832 				    ieee80211_state_name[ni->ni_vap->iv_state]);
1833 				uath_freetx(next);
1834 				goto reclaim;
1835 			}
1836 			m = next;
1837 			bf = STAILQ_FIRST(&frags);
1838 			KASSERT(bf != NULL, ("no buf for txfrag"));
1839 			STAILQ_REMOVE_HEAD(&frags, next);
1840 			goto nextfrag;
1841 		}
1842 
1843 		sc->sc_tx_timer = 5;
1844 	}
1845 	UATH_UNLOCK(sc);
1846 }
1847 
1848 static int
1849 uath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1850     const struct ieee80211_bpf_params *params)
1851 {
1852 	struct ieee80211com *ic = ni->ni_ic;
1853 	struct ifnet *ifp = ic->ic_ifp;
1854 	struct uath_data *bf;
1855 	struct uath_softc *sc = ifp->if_softc;
1856 
1857 	/* prevent management frames from being sent if we're not ready */
1858 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1859 	    !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1860 		m_freem(m);
1861 		ieee80211_free_node(ni);
1862 		return (ENETDOWN);
1863 	}
1864 
1865 	UATH_LOCK(sc);
1866 	/* grab a TX buffer  */
1867 	bf = uath_getbuf(sc);
1868 	if (bf == NULL) {
1869 		ieee80211_free_node(ni);
1870 		m_freem(m);
1871 		UATH_UNLOCK(sc);
1872 		return (ENOBUFS);
1873 	}
1874 
1875 	sc->sc_seqnum = 0;
1876 	if (uath_tx_start(sc, m, ni, bf) != 0) {
1877 		ieee80211_free_node(ni);
1878 		ifp->if_oerrors++;
1879 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1880 		UATH_STAT_INC(sc, st_tx_inactive);
1881 		UATH_UNLOCK(sc);
1882 		return (EIO);
1883 	}
1884 	UATH_UNLOCK(sc);
1885 
1886 	sc->sc_tx_timer = 5;
1887 	return (0);
1888 }
1889 
1890 static void
1891 uath_scan_start(struct ieee80211com *ic)
1892 {
1893 	/* do nothing  */
1894 }
1895 
1896 static void
1897 uath_scan_end(struct ieee80211com *ic)
1898 {
1899 	/* do nothing  */
1900 }
1901 
1902 static void
1903 uath_set_channel(struct ieee80211com *ic)
1904 {
1905 	struct ifnet *ifp = ic->ic_ifp;
1906 	struct uath_softc *sc = ifp->if_softc;
1907 
1908 	UATH_LOCK(sc);
1909 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1910 	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1911 		UATH_UNLOCK(sc);
1912 		return;
1913 	}
1914 	(void)uath_switch_channel(sc, ic->ic_curchan);
1915 	UATH_UNLOCK(sc);
1916 }
1917 
1918 static int
1919 uath_set_rxmulti_filter(struct uath_softc *sc)
1920 {
1921 	/* XXX broken */
1922 	return (0);
1923 }
1924 static void
1925 uath_update_mcast(struct ifnet *ifp)
1926 {
1927 	struct uath_softc *sc = ifp->if_softc;
1928 
1929 	UATH_LOCK(sc);
1930 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1931 	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1932 		UATH_UNLOCK(sc);
1933 		return;
1934 	}
1935 	/*
1936 	 * this is for avoiding the race condition when we're try to
1937 	 * connect to the AP with WPA.
1938 	 */
1939 	if (sc->sc_flags & UATH_FLAG_INITDONE)
1940 		(void)uath_set_rxmulti_filter(sc);
1941 	UATH_UNLOCK(sc);
1942 }
1943 
1944 static void
1945 uath_update_promisc(struct ifnet *ifp)
1946 {
1947 	struct uath_softc *sc = ifp->if_softc;
1948 
1949 	UATH_LOCK(sc);
1950 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1951 	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1952 		UATH_UNLOCK(sc);
1953 		return;
1954 	}
1955 	if (sc->sc_flags & UATH_FLAG_INITDONE) {
1956 		uath_set_rxfilter(sc,
1957 		    UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1958 		    UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON |
1959 		    UATH_FILTER_RX_PROM, UATH_FILTER_OP_SET);
1960 	}
1961 	UATH_UNLOCK(sc);
1962 }
1963 
1964 static int
1965 uath_create_connection(struct uath_softc *sc, uint32_t connid)
1966 {
1967 	const struct ieee80211_rateset *rs;
1968 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1969 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1970 	struct ieee80211_node *ni;
1971 	struct uath_cmd_create_connection create;
1972 
1973 	ni = ieee80211_ref_node(vap->iv_bss);
1974 	memset(&create, 0, sizeof(create));
1975 	create.connid = htobe32(connid);
1976 	create.bssid = htobe32(0);
1977 	/* XXX packed or not?  */
1978 	create.size = htobe32(sizeof(struct uath_cmd_rateset));
1979 
1980 	rs = &ni->ni_rates;
1981 	create.connattr.rateset.length = rs->rs_nrates;
1982 	bcopy(rs->rs_rates, &create.connattr.rateset.set[0],
1983 	    rs->rs_nrates);
1984 
1985 	/* XXX turbo */
1986 	if (IEEE80211_IS_CHAN_A(ni->ni_chan))
1987 		create.connattr.wlanmode = htobe32(WLAN_MODE_11a);
1988 	else if (IEEE80211_IS_CHAN_ANYG(ni->ni_chan))
1989 		create.connattr.wlanmode = htobe32(WLAN_MODE_11g);
1990 	else
1991 		create.connattr.wlanmode = htobe32(WLAN_MODE_11b);
1992 	ieee80211_free_node(ni);
1993 
1994 	return uath_cmd_write(sc, WDCMSG_CREATE_CONNECTION, &create,
1995 	    sizeof create, 0);
1996 }
1997 
1998 static int
1999 uath_set_rates(struct uath_softc *sc, const struct ieee80211_rateset *rs)
2000 {
2001 	struct uath_cmd_rates rates;
2002 
2003 	memset(&rates, 0, sizeof(rates));
2004 	rates.connid = htobe32(UATH_ID_BSS);		/* XXX */
2005 	rates.size   = htobe32(sizeof(struct uath_cmd_rateset));
2006 	/* XXX bounds check rs->rs_nrates */
2007 	rates.rateset.length = rs->rs_nrates;
2008 	bcopy(rs->rs_rates, &rates.rateset.set[0], rs->rs_nrates);
2009 
2010 	DPRINTF(sc, UATH_DEBUG_RATES,
2011 	    "setting supported rates nrates=%d\n", rs->rs_nrates);
2012 	return uath_cmd_write(sc, WDCMSG_SET_BASIC_RATE,
2013 	    &rates, sizeof rates, 0);
2014 }
2015 
2016 static int
2017 uath_write_associd(struct uath_softc *sc)
2018 {
2019 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2020 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2021 	struct ieee80211_node *ni;
2022 	struct uath_cmd_set_associd associd;
2023 
2024 	ni = ieee80211_ref_node(vap->iv_bss);
2025 	memset(&associd, 0, sizeof(associd));
2026 	associd.defaultrateix = htobe32(1);	/* XXX */
2027 	associd.associd = htobe32(ni->ni_associd);
2028 	associd.timoffset = htobe32(0x3b);	/* XXX */
2029 	IEEE80211_ADDR_COPY(associd.bssid, ni->ni_bssid);
2030 	ieee80211_free_node(ni);
2031 	return uath_cmd_write(sc, WDCMSG_WRITE_ASSOCID, &associd,
2032 	    sizeof associd, 0);
2033 }
2034 
2035 static int
2036 uath_set_ledsteady(struct uath_softc *sc, int lednum, int ledmode)
2037 {
2038 	struct uath_cmd_ledsteady led;
2039 
2040 	led.lednum = htobe32(lednum);
2041 	led.ledmode = htobe32(ledmode);
2042 
2043 	DPRINTF(sc, UATH_DEBUG_LED, "set %s led %s (steady)\n",
2044 	    (lednum == UATH_LED_LINK) ? "link" : "activity",
2045 	    ledmode ? "on" : "off");
2046 	return uath_cmd_write(sc, WDCMSG_SET_LED_STEADY, &led, sizeof led, 0);
2047 }
2048 
2049 static int
2050 uath_set_ledblink(struct uath_softc *sc, int lednum, int ledmode,
2051 	int blinkrate, int slowmode)
2052 {
2053 	struct uath_cmd_ledblink led;
2054 
2055 	led.lednum = htobe32(lednum);
2056 	led.ledmode = htobe32(ledmode);
2057 	led.blinkrate = htobe32(blinkrate);
2058 	led.slowmode = htobe32(slowmode);
2059 
2060 	DPRINTF(sc, UATH_DEBUG_LED, "set %s led %s (blink)\n",
2061 	    (lednum == UATH_LED_LINK) ? "link" : "activity",
2062 	    ledmode ? "on" : "off");
2063 	return uath_cmd_write(sc, WDCMSG_SET_LED_BLINK, &led, sizeof led, 0);
2064 }
2065 
2066 static int
2067 uath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2068 {
2069 	enum ieee80211_state ostate = vap->iv_state;
2070 	int error;
2071 	struct ieee80211_node *ni;
2072 	struct ieee80211com *ic = vap->iv_ic;
2073 	struct uath_softc *sc = ic->ic_ifp->if_softc;
2074 	struct uath_vap *uvp = UATH_VAP(vap);
2075 
2076 	DPRINTF(sc, UATH_DEBUG_STATE,
2077 	    "%s: %s -> %s\n", __func__, ieee80211_state_name[vap->iv_state],
2078 	    ieee80211_state_name[nstate]);
2079 
2080 	IEEE80211_UNLOCK(ic);
2081 	UATH_LOCK(sc);
2082 	callout_stop(&sc->stat_ch);
2083 	callout_stop(&sc->watchdog_ch);
2084 	ni = ieee80211_ref_node(vap->iv_bss);
2085 
2086 	switch (nstate) {
2087 	case IEEE80211_S_INIT:
2088 		if (ostate == IEEE80211_S_RUN) {
2089 			/* turn link and activity LEDs off */
2090 			uath_set_ledstate(sc, 0);
2091 		}
2092 		break;
2093 
2094 	case IEEE80211_S_SCAN:
2095 		break;
2096 
2097 	case IEEE80211_S_AUTH:
2098 		/* XXX good place?  set RTS threshold  */
2099 		uath_config(sc, CFG_USER_RTS_THRESHOLD, vap->iv_rtsthreshold);
2100 		/* XXX bad place  */
2101 		error = uath_set_keys(sc, vap);
2102 		if (error != 0) {
2103 			device_printf(sc->sc_dev,
2104 			    "could not set crypto keys, error %d\n", error);
2105 			break;
2106 		}
2107 		if (uath_switch_channel(sc, ni->ni_chan) != 0) {
2108 			device_printf(sc->sc_dev, "could not switch channel\n");
2109 			break;
2110 		}
2111 		if (uath_create_connection(sc, UATH_ID_BSS) != 0) {
2112 			device_printf(sc->sc_dev,
2113 			    "could not create connection\n");
2114 			break;
2115 		}
2116 		break;
2117 
2118 	case IEEE80211_S_ASSOC:
2119 		if (uath_set_rates(sc, &ni->ni_rates) != 0) {
2120 			device_printf(sc->sc_dev,
2121 			    "could not set negotiated rate set\n");
2122 			break;
2123 		}
2124 		break;
2125 
2126 	case IEEE80211_S_RUN:
2127 		/* XXX monitor mode doesn't be tested  */
2128 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2129 			uath_set_ledstate(sc, 1);
2130 			break;
2131 		}
2132 
2133 		/*
2134 		 * Tx rate is controlled by firmware, report the maximum
2135 		 * negotiated rate in ifconfig output.
2136 		 */
2137 		ni->ni_txrate = ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
2138 
2139 		if (uath_write_associd(sc) != 0) {
2140 			device_printf(sc->sc_dev,
2141 			    "could not write association id\n");
2142 			break;
2143 		}
2144 		/* turn link LED on */
2145 		uath_set_ledsteady(sc, UATH_LED_LINK, UATH_LED_ON);
2146 		/* make activity LED blink */
2147 		uath_set_ledblink(sc, UATH_LED_ACTIVITY, UATH_LED_ON, 1, 2);
2148 		/* set state to associated */
2149 		uath_set_ledstate(sc, 1);
2150 
2151 		/* start statistics timer */
2152 		callout_reset(&sc->stat_ch, hz, uath_stat, sc);
2153 		break;
2154 	default:
2155 		break;
2156 	}
2157 	ieee80211_free_node(ni);
2158 	UATH_UNLOCK(sc);
2159 	IEEE80211_LOCK(ic);
2160 	return (uvp->newstate(vap, nstate, arg));
2161 }
2162 
2163 static int
2164 uath_set_key(struct uath_softc *sc, const struct ieee80211_key *wk,
2165     int index)
2166 {
2167 #if 0
2168 	struct uath_cmd_crypto crypto;
2169 	int i;
2170 
2171 	memset(&crypto, 0, sizeof(crypto));
2172 	crypto.keyidx = htobe32(index);
2173 	crypto.magic1 = htobe32(1);
2174 	crypto.size   = htobe32(368);
2175 	crypto.mask   = htobe32(0xffff);
2176 	crypto.flags  = htobe32(0x80000068);
2177 	if (index != UATH_DEFAULT_KEY)
2178 		crypto.flags |= htobe32(index << 16);
2179 	memset(crypto.magic2, 0xff, sizeof(crypto.magic2));
2180 
2181 	/*
2182 	 * Each byte of the key must be XOR'ed with 10101010 before being
2183 	 * transmitted to the firmware.
2184 	 */
2185 	for (i = 0; i < wk->wk_keylen; i++)
2186 		crypto.key[i] = wk->wk_key[i] ^ 0xaa;
2187 
2188 	DPRINTF(sc, UATH_DEBUG_CRYPTO,
2189 	    "setting crypto key index=%d len=%d\n", index, wk->wk_keylen);
2190 	return uath_cmd_write(sc, WDCMSG_SET_KEY_CACHE_ENTRY, &crypto,
2191 	    sizeof crypto, 0);
2192 #else
2193 	/* XXX support H/W cryto  */
2194 	return (0);
2195 #endif
2196 }
2197 
2198 static int
2199 uath_set_keys(struct uath_softc *sc, struct ieee80211vap *vap)
2200 {
2201 	int i, error;
2202 
2203 	error = 0;
2204 	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2205 		const struct ieee80211_key *wk = &vap->iv_nw_keys[i];
2206 
2207 		if (wk->wk_flags & (IEEE80211_KEY_XMIT|IEEE80211_KEY_RECV)) {
2208 			error = uath_set_key(sc, wk, i);
2209 			if (error)
2210 				return (error);
2211 		}
2212 	}
2213 	if (vap->iv_def_txkey != IEEE80211_KEYIX_NONE) {
2214 		error = uath_set_key(sc, &vap->iv_nw_keys[vap->iv_def_txkey],
2215 			UATH_DEFAULT_KEY);
2216 	}
2217 	return (error);
2218 }
2219 
2220 #define	UATH_SYSCTL_STAT_ADD32(c, h, n, p, d)	\
2221 	    SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
2222 
2223 static void
2224 uath_sysctl_node(struct uath_softc *sc)
2225 {
2226 	struct sysctl_ctx_list *ctx;
2227 	struct sysctl_oid_list *child;
2228 	struct sysctl_oid *tree;
2229 	struct uath_stat *stats;
2230 
2231 	stats = &sc->sc_stat;
2232 	ctx = device_get_sysctl_ctx(sc->sc_dev);
2233 	child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
2234 
2235 	tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
2236 	    NULL, "UATH statistics");
2237 	child = SYSCTL_CHILDREN(tree);
2238 	UATH_SYSCTL_STAT_ADD32(ctx, child, "badchunkseqnum",
2239 	    &stats->st_badchunkseqnum, "Bad chunk sequence numbers");
2240 	UATH_SYSCTL_STAT_ADD32(ctx, child, "invalidlen", &stats->st_invalidlen,
2241 	    "Invalid length");
2242 	UATH_SYSCTL_STAT_ADD32(ctx, child, "multichunk", &stats->st_multichunk,
2243 	    "Multi chunks");
2244 	UATH_SYSCTL_STAT_ADD32(ctx, child, "toobigrxpkt",
2245 	    &stats->st_toobigrxpkt, "Too big rx packets");
2246 	UATH_SYSCTL_STAT_ADD32(ctx, child, "stopinprogress",
2247 	    &stats->st_stopinprogress, "Stop in progress");
2248 	UATH_SYSCTL_STAT_ADD32(ctx, child, "crcerrs", &stats->st_crcerr,
2249 	    "CRC errors");
2250 	UATH_SYSCTL_STAT_ADD32(ctx, child, "phyerr", &stats->st_phyerr,
2251 	    "PHY errors");
2252 	UATH_SYSCTL_STAT_ADD32(ctx, child, "decrypt_crcerr",
2253 	    &stats->st_decrypt_crcerr, "Decryption CRC errors");
2254 	UATH_SYSCTL_STAT_ADD32(ctx, child, "decrypt_micerr",
2255 	    &stats->st_decrypt_micerr, "Decryption Misc errors");
2256 	UATH_SYSCTL_STAT_ADD32(ctx, child, "decomperr", &stats->st_decomperr,
2257 	    "Decomp errors");
2258 	UATH_SYSCTL_STAT_ADD32(ctx, child, "keyerr", &stats->st_keyerr,
2259 	    "Key errors");
2260 	UATH_SYSCTL_STAT_ADD32(ctx, child, "err", &stats->st_err,
2261 	    "Unknown errors");
2262 
2263 	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_active",
2264 	    &stats->st_cmd_active, "Active numbers in Command queue");
2265 	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_inactive",
2266 	    &stats->st_cmd_inactive, "Inactive numbers in Command queue");
2267 	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_pending",
2268 	    &stats->st_cmd_pending, "Pending numbers in Command queue");
2269 	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_waiting",
2270 	    &stats->st_cmd_waiting, "Waiting numbers in Command queue");
2271 	UATH_SYSCTL_STAT_ADD32(ctx, child, "rx_active",
2272 	    &stats->st_rx_active, "Active numbers in RX queue");
2273 	UATH_SYSCTL_STAT_ADD32(ctx, child, "rx_inactive",
2274 	    &stats->st_rx_inactive, "Inactive numbers in RX queue");
2275 	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_active",
2276 	    &stats->st_tx_active, "Active numbers in TX queue");
2277 	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_inactive",
2278 	    &stats->st_tx_inactive, "Inactive numbers in TX queue");
2279 	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_pending",
2280 	    &stats->st_tx_pending, "Pending numbers in TX queue");
2281 }
2282 
2283 #undef UATH_SYSCTL_STAT_ADD32
2284 
2285 static void
2286 uath_cmdeof(struct uath_softc *sc, struct uath_cmd *cmd)
2287 {
2288 	struct uath_cmd_hdr *hdr;
2289 	int dlen;
2290 
2291 	hdr = (struct uath_cmd_hdr *)cmd->buf;
2292 	/* NB: msgid is passed thru w/o byte swapping */
2293 #ifdef UATH_DEBUG
2294 	if (sc->sc_debug & UATH_DEBUG_CMDS) {
2295 		int len = be32toh(hdr->len);
2296 		printf("%s: %s [ix %u] len %u status %u\n",
2297 		    __func__, uath_codename(be32toh(hdr->code)),
2298 		    hdr->msgid, len, be32toh(hdr->magic));
2299 		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
2300 			uath_dump_cmd(cmd->buf,
2301 			    len > UATH_MAX_CMDSZ ? sizeof(*hdr) : len, '-');
2302 	}
2303 #endif
2304 	hdr->code = be32toh(hdr->code);
2305 	hdr->len = be32toh(hdr->len);
2306 	hdr->magic = be32toh(hdr->magic);	/* target status on return */
2307 
2308 	switch (hdr->code & 0xff) {
2309 	/* reply to a read command */
2310 	default:
2311 		dlen = hdr->len - sizeof(*hdr);
2312 		if (dlen < 0) {
2313 			device_printf(sc->sc_dev,
2314 			    "Invalid header length %d\n", dlen);
2315 			return;
2316 		}
2317 		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2318 		    "%s: code %d data len %u\n",
2319 		    __func__, hdr->code & 0xff, dlen);
2320 		/*
2321 		 * The first response from the target after the
2322 		 * HOST_AVAILABLE has an invalid msgid so we must
2323 		 * treat it specially.
2324 		 */
2325 		if (hdr->msgid < UATH_CMD_LIST_COUNT) {
2326 			uint32_t *rp = (uint32_t *)(hdr+1);
2327 			u_int olen;
2328 
2329 			if (!(sizeof(*hdr) <= hdr->len &&
2330 			      hdr->len < UATH_MAX_CMDSZ)) {
2331 				device_printf(sc->sc_dev,
2332 				    "%s: invalid WDC msg length %u; "
2333 				    "msg ignored\n", __func__, hdr->len);
2334 				return;
2335 			}
2336 			/*
2337 			 * Calculate return/receive payload size; the
2338 			 * first word, if present, always gives the
2339 			 * number of bytes--unless it's 0 in which
2340 			 * case a single 32-bit word should be present.
2341 			 */
2342 			if (dlen >= (int)sizeof(uint32_t)) {
2343 				olen = be32toh(rp[0]);
2344 				dlen -= sizeof(uint32_t);
2345 				if (olen == 0) {
2346 					/* convention is 0 =>'s one word */
2347 					olen = sizeof(uint32_t);
2348 					/* XXX KASSERT(olen == dlen ) */
2349 				}
2350 			} else
2351 				olen = 0;
2352 			if (cmd->odata != NULL) {
2353 				/* NB: cmd->olen validated in uath_cmd */
2354 				if (olen > (u_int)cmd->olen) {
2355 					/* XXX complain? */
2356 					device_printf(sc->sc_dev,
2357 					    "%s: cmd 0x%x olen %u cmd olen %u\n",
2358 					    __func__, hdr->code, olen,
2359 					    cmd->olen);
2360 					olen = cmd->olen;
2361 				}
2362 				if (olen > (u_int)dlen) {
2363 					/* XXX complain, shouldn't happen */
2364 					device_printf(sc->sc_dev,
2365 					    "%s: cmd 0x%x olen %u dlen %u\n",
2366 					    __func__, hdr->code, olen, dlen);
2367 					olen = dlen;
2368 				}
2369 				/* XXX have submitter do this */
2370 				/* copy answer into caller's supplied buffer */
2371 				bcopy(&rp[1], cmd->odata, olen);
2372 				cmd->olen = olen;
2373 			}
2374 		}
2375 		wakeup_one(cmd);		/* wake up caller */
2376 		break;
2377 
2378 	case WDCMSG_TARGET_START:
2379 		if (hdr->msgid >= UATH_CMD_LIST_COUNT) {
2380 			/* XXX */
2381 			return;
2382 		}
2383 		dlen = hdr->len - sizeof(*hdr);
2384 		if (dlen != (int)sizeof(uint32_t)) {
2385 			/* XXX something wrong */
2386 			return;
2387 		}
2388 		/* XXX have submitter do this */
2389 		/* copy answer into caller's supplied buffer */
2390 		bcopy(hdr+1, cmd->odata, sizeof(uint32_t));
2391 		cmd->olen = sizeof(uint32_t);
2392 		wakeup_one(cmd);		/* wake up caller */
2393 		break;
2394 
2395 	case WDCMSG_SEND_COMPLETE:
2396 		/* this notification is sent when UATH_TX_NOTIFY is set */
2397 		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2398 		    "%s: received Tx notification\n", __func__);
2399 		break;
2400 
2401 	case WDCMSG_TARGET_GET_STATS:
2402 		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2403 		    "%s: received device statistics\n", __func__);
2404 		callout_reset(&sc->stat_ch, hz, uath_stat, sc);
2405 		break;
2406 	}
2407 }
2408 
2409 static void
2410 uath_intr_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2411 {
2412 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2413 	struct uath_cmd *cmd;
2414 	struct usb_page_cache *pc;
2415 	int actlen;
2416 
2417 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2418 
2419 	UATH_ASSERT_LOCKED(sc);
2420 
2421 	switch (USB_GET_STATE(xfer)) {
2422 	case USB_ST_TRANSFERRED:
2423 		cmd = STAILQ_FIRST(&sc->sc_cmd_waiting);
2424 		if (cmd == NULL)
2425 			goto setup;
2426 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_waiting, next);
2427 		UATH_STAT_DEC(sc, st_cmd_waiting);
2428 		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next);
2429 		UATH_STAT_INC(sc, st_cmd_inactive);
2430 
2431 		KASSERT(actlen >= (int)sizeof(struct uath_cmd_hdr),
2432 		    ("short xfer error"));
2433 		pc = usbd_xfer_get_frame(xfer, 0);
2434 		usbd_copy_out(pc, 0, cmd->buf, actlen);
2435 		uath_cmdeof(sc, cmd);
2436 	case USB_ST_SETUP:
2437 setup:
2438 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2439 		usbd_transfer_submit(xfer);
2440 		break;
2441 	default:
2442 		if (error != USB_ERR_CANCELLED) {
2443 			usbd_xfer_set_stall(xfer);
2444 			goto setup;
2445 		}
2446 		break;
2447 	}
2448 }
2449 
2450 static void
2451 uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error)
2452 {
2453 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2454 	struct uath_cmd *cmd;
2455 
2456 	UATH_ASSERT_LOCKED(sc);
2457 
2458 	switch (USB_GET_STATE(xfer)) {
2459 	case USB_ST_TRANSFERRED:
2460 		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2461 		if (cmd == NULL)
2462 			goto setup;
2463 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next);
2464 		UATH_STAT_DEC(sc, st_cmd_active);
2465 		STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_READ) ?
2466 		    &sc->sc_cmd_waiting : &sc->sc_cmd_inactive, cmd, next);
2467 		if (cmd->flags & UATH_CMD_FLAG_READ)
2468 			UATH_STAT_INC(sc, st_cmd_waiting);
2469 		else
2470 			UATH_STAT_INC(sc, st_cmd_inactive);
2471 		/* FALLTHROUGH */
2472 	case USB_ST_SETUP:
2473 setup:
2474 		cmd = STAILQ_FIRST(&sc->sc_cmd_pending);
2475 		if (cmd == NULL) {
2476 			DPRINTF(sc, UATH_DEBUG_XMIT, "%s: empty pending queue\n",
2477 			    __func__);
2478 			return;
2479 		}
2480 		STAILQ_REMOVE_HEAD(&sc->sc_cmd_pending, next);
2481 		UATH_STAT_DEC(sc, st_cmd_pending);
2482 		STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_ASYNC) ?
2483 		    &sc->sc_cmd_inactive : &sc->sc_cmd_active, cmd, next);
2484 		if (cmd->flags & UATH_CMD_FLAG_ASYNC)
2485 			UATH_STAT_INC(sc, st_cmd_inactive);
2486 		else
2487 			UATH_STAT_INC(sc, st_cmd_active);
2488 
2489 		usbd_xfer_set_frame_data(xfer, 0, cmd->buf, cmd->buflen);
2490 		usbd_transfer_submit(xfer);
2491 		break;
2492 	default:
2493 		if (error != USB_ERR_CANCELLED) {
2494 			usbd_xfer_set_stall(xfer);
2495 			goto setup;
2496 		}
2497 		break;
2498 	}
2499 }
2500 
2501 static void
2502 uath_update_rxstat(struct uath_softc *sc, uint32_t status)
2503 {
2504 
2505 	switch (status) {
2506 	case UATH_STATUS_STOP_IN_PROGRESS:
2507 		UATH_STAT_INC(sc, st_stopinprogress);
2508 		break;
2509 	case UATH_STATUS_CRC_ERR:
2510 		UATH_STAT_INC(sc, st_crcerr);
2511 		break;
2512 	case UATH_STATUS_PHY_ERR:
2513 		UATH_STAT_INC(sc, st_phyerr);
2514 		break;
2515 	case UATH_STATUS_DECRYPT_CRC_ERR:
2516 		UATH_STAT_INC(sc, st_decrypt_crcerr);
2517 		break;
2518 	case UATH_STATUS_DECRYPT_MIC_ERR:
2519 		UATH_STAT_INC(sc, st_decrypt_micerr);
2520 		break;
2521 	case UATH_STATUS_DECOMP_ERR:
2522 		UATH_STAT_INC(sc, st_decomperr);
2523 		break;
2524 	case UATH_STATUS_KEY_ERR:
2525 		UATH_STAT_INC(sc, st_keyerr);
2526 		break;
2527 	case UATH_STATUS_ERR:
2528 		UATH_STAT_INC(sc, st_err);
2529 		break;
2530 	default:
2531 		break;
2532 	}
2533 }
2534 
2535 static struct mbuf *
2536 uath_data_rxeof(struct usb_xfer *xfer, struct uath_data *data,
2537     struct uath_rx_desc **pdesc)
2538 {
2539 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2540 	struct ifnet *ifp = sc->sc_ifp;
2541 	struct ieee80211com *ic = ifp->if_l2com;
2542 	struct uath_chunk *chunk;
2543 	struct uath_rx_desc *desc;
2544 	struct mbuf *m = data->m, *mnew, *mp;
2545 	uint16_t chunklen;
2546 	int actlen;
2547 
2548 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2549 
2550 	if (actlen < (int)UATH_MIN_RXBUFSZ) {
2551 		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2552 		    "%s: wrong xfer size (len=%d)\n", __func__, actlen);
2553 		ifp->if_ierrors++;
2554 		return (NULL);
2555 	}
2556 
2557 	chunk = (struct uath_chunk *)data->buf;
2558 	if (chunk->seqnum == 0 && chunk->flags == 0 && chunk->length == 0) {
2559 		device_printf(sc->sc_dev, "%s: strange response\n", __func__);
2560 		ifp->if_ierrors++;
2561 		UATH_RESET_INTRX(sc);
2562 		return (NULL);
2563 	}
2564 
2565 	if (chunk->seqnum != sc->sc_intrx_nextnum) {
2566 		DPRINTF(sc, UATH_DEBUG_XMIT, "invalid seqnum %d, expected %d\n",
2567 		    chunk->seqnum, sc->sc_intrx_nextnum);
2568 		UATH_STAT_INC(sc, st_badchunkseqnum);
2569 		if (sc->sc_intrx_head != NULL)
2570 			m_freem(sc->sc_intrx_head);
2571 		UATH_RESET_INTRX(sc);
2572 		return (NULL);
2573 	}
2574 
2575 	/* check multi-chunk frames  */
2576 	if ((chunk->seqnum == 0 && !(chunk->flags & UATH_CFLAGS_FINAL)) ||
2577 	    (chunk->seqnum != 0 && (chunk->flags & UATH_CFLAGS_FINAL)) ||
2578 	    chunk->flags & UATH_CFLAGS_RXMSG)
2579 		UATH_STAT_INC(sc, st_multichunk);
2580 
2581 	chunklen = be16toh(chunk->length);
2582 	if (chunk->flags & UATH_CFLAGS_FINAL)
2583 		chunklen -= sizeof(struct uath_rx_desc);
2584 
2585 	if (chunklen > 0 &&
2586 	    (!(chunk->flags & UATH_CFLAGS_FINAL) || !(chunk->seqnum == 0))) {
2587 		/* we should use intermediate RX buffer  */
2588 		if (chunk->seqnum == 0)
2589 			UATH_RESET_INTRX(sc);
2590 		if ((sc->sc_intrx_len + sizeof(struct uath_rx_desc) +
2591 		    chunklen) > UATH_MAX_INTRX_SIZE) {
2592 			UATH_STAT_INC(sc, st_invalidlen);
2593 			ifp->if_iqdrops++;
2594 			if (sc->sc_intrx_head != NULL)
2595 				m_freem(sc->sc_intrx_head);
2596 			UATH_RESET_INTRX(sc);
2597 			return (NULL);
2598 		}
2599 
2600 		m->m_len = chunklen;
2601 		m->m_data += sizeof(struct uath_chunk);
2602 
2603 		if (sc->sc_intrx_head == NULL) {
2604 			sc->sc_intrx_head = m;
2605 			sc->sc_intrx_tail = m;
2606 		} else {
2607 			m->m_flags &= ~M_PKTHDR;
2608 			sc->sc_intrx_tail->m_next = m;
2609 			sc->sc_intrx_tail = m;
2610 		}
2611 	}
2612 	sc->sc_intrx_len += chunklen;
2613 
2614 	mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
2615 	if (mnew == NULL) {
2616 		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2617 		    "%s: can't get new mbuf, drop frame\n", __func__);
2618 		ifp->if_ierrors++;
2619 		if (sc->sc_intrx_head != NULL)
2620 			m_freem(sc->sc_intrx_head);
2621 		UATH_RESET_INTRX(sc);
2622 		return (NULL);
2623 	}
2624 
2625 	data->m = mnew;
2626 	data->buf = mtod(mnew, uint8_t *);
2627 
2628 	/* if the frame is not final continue the transfer  */
2629 	if (!(chunk->flags & UATH_CFLAGS_FINAL)) {
2630 		sc->sc_intrx_nextnum++;
2631 		UATH_RESET_INTRX(sc);
2632 		return (NULL);
2633 	}
2634 
2635 	/*
2636 	 * if the frame is not set UATH_CFLAGS_RXMSG, then rx descriptor is
2637 	 * located at the end, 32-bit aligned
2638 	 */
2639 	desc = (chunk->flags & UATH_CFLAGS_RXMSG) ?
2640 		(struct uath_rx_desc *)(chunk + 1) :
2641 		(struct uath_rx_desc *)(((uint8_t *)chunk) +
2642 		    sizeof(struct uath_chunk) + be16toh(chunk->length) -
2643 		    sizeof(struct uath_rx_desc));
2644 	*pdesc = desc;
2645 
2646 	DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2647 	    "%s: frame len %u code %u status %u rate %u antenna %u "
2648 	    "rssi %d channel %u phyerror %u connix %u decrypterror %u "
2649 	    "keycachemiss %u\n", __func__, be32toh(desc->framelen)
2650 	    , be32toh(desc->code), be32toh(desc->status), be32toh(desc->rate)
2651 	    , be32toh(desc->antenna), be32toh(desc->rssi), be32toh(desc->channel)
2652 	    , be32toh(desc->phyerror), be32toh(desc->connix)
2653 	    , be32toh(desc->decrypterror), be32toh(desc->keycachemiss));
2654 
2655 	if (be32toh(desc->len) > MCLBYTES) {
2656 		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2657 		    "%s: bad descriptor (len=%d)\n", __func__,
2658 		    be32toh(desc->len));
2659 		ifp->if_iqdrops++;
2660 		UATH_STAT_INC(sc, st_toobigrxpkt);
2661 		if (sc->sc_intrx_head != NULL)
2662 			m_freem(sc->sc_intrx_head);
2663 		UATH_RESET_INTRX(sc);
2664 		return (NULL);
2665 	}
2666 
2667 	uath_update_rxstat(sc, be32toh(desc->status));
2668 
2669 	/* finalize mbuf */
2670 	if (sc->sc_intrx_head == NULL) {
2671 		m->m_pkthdr.rcvif = ifp;
2672 		m->m_pkthdr.len = m->m_len =
2673 			be32toh(desc->framelen) - UATH_RX_DUMMYSIZE;
2674 		m->m_data += sizeof(struct uath_chunk);
2675 	} else {
2676 		mp = sc->sc_intrx_head;
2677 		mp->m_pkthdr.rcvif = ifp;
2678 		mp->m_flags |= M_PKTHDR;
2679 		mp->m_pkthdr.len = sc->sc_intrx_len;
2680 		m = mp;
2681 	}
2682 
2683 	/* there are a lot more fields in the RX descriptor */
2684 	if ((sc->sc_flags & UATH_FLAG_INVALID) == 0 &&
2685 	    ieee80211_radiotap_active(ic)) {
2686 		struct uath_rx_radiotap_header *tap = &sc->sc_rxtap;
2687 		uint32_t tsf_hi = be32toh(desc->tstamp_high);
2688 		uint32_t tsf_lo = be32toh(desc->tstamp_low);
2689 
2690 		/* XXX only get low order 24bits of tsf from h/w */
2691 		tap->wr_tsf = htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
2692 		tap->wr_flags = 0;
2693 		if (be32toh(desc->status) == UATH_STATUS_CRC_ERR)
2694 			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2695 		/* XXX map other status to BADFCS? */
2696 		/* XXX ath h/w rate code, need to map */
2697 		tap->wr_rate = be32toh(desc->rate);
2698 		tap->wr_antenna = be32toh(desc->antenna);
2699 		tap->wr_antsignal = -95 + be32toh(desc->rssi);
2700 		tap->wr_antnoise = -95;
2701 	}
2702 
2703 	ifp->if_ipackets++;
2704 	UATH_RESET_INTRX(sc);
2705 
2706 	return (m);
2707 }
2708 
2709 static void
2710 uath_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2711 {
2712 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2713 	struct ifnet *ifp = sc->sc_ifp;
2714 	struct ieee80211com *ic = ifp->if_l2com;
2715 	struct ieee80211_frame *wh;
2716 	struct ieee80211_node *ni;
2717 	struct mbuf *m = NULL;
2718 	struct uath_data *data;
2719 	struct uath_rx_desc *desc = NULL;
2720 	int8_t nf;
2721 
2722 	UATH_ASSERT_LOCKED(sc);
2723 
2724 	switch (USB_GET_STATE(xfer)) {
2725 	case USB_ST_TRANSFERRED:
2726 		data = STAILQ_FIRST(&sc->sc_rx_active);
2727 		if (data == NULL)
2728 			goto setup;
2729 		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2730 		UATH_STAT_DEC(sc, st_rx_active);
2731 		m = uath_data_rxeof(xfer, data, &desc);
2732 		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2733 		UATH_STAT_INC(sc, st_rx_inactive);
2734 		/* FALLTHROUGH */
2735 	case USB_ST_SETUP:
2736 setup:
2737 		data = STAILQ_FIRST(&sc->sc_rx_inactive);
2738 		if (data == NULL)
2739 			return;
2740 		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
2741 		UATH_STAT_DEC(sc, st_rx_inactive);
2742 		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
2743 		UATH_STAT_INC(sc, st_rx_active);
2744 		usbd_xfer_set_frame_data(xfer, 0, data->buf,
2745 		    usbd_xfer_max_len(xfer));
2746 		usbd_transfer_submit(xfer);
2747 
2748 		/*
2749 		 * To avoid LOR we should unlock our private mutex here to call
2750 		 * ieee80211_input() because here is at the end of a USB
2751 		 * callback and safe to unlock.
2752 		 */
2753 		if (sc->sc_flags & UATH_FLAG_INVALID) {
2754 			if (m != NULL)
2755 				m_freem(m);
2756 			return;
2757 		}
2758 		UATH_UNLOCK(sc);
2759 		if (m != NULL && desc != NULL) {
2760 			wh = mtod(m, struct ieee80211_frame *);
2761 			ni = ieee80211_find_rxnode(ic,
2762 			    (struct ieee80211_frame_min *)wh);
2763 			nf = -95;	/* XXX */
2764 			if (ni != NULL) {
2765 				(void) ieee80211_input(ni, m,
2766 				    (int)be32toh(desc->rssi), nf);
2767 				/* node is no longer needed */
2768 				ieee80211_free_node(ni);
2769 			} else
2770 				(void) ieee80211_input_all(ic, m,
2771 				    (int)be32toh(desc->rssi), nf);
2772 			m = NULL;
2773 			desc = NULL;
2774 		}
2775 		if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2776 		    !IFQ_IS_EMPTY(&ifp->if_snd))
2777 			uath_start(ifp);
2778 		UATH_LOCK(sc);
2779 		break;
2780 	default:
2781 		/* needs it to the inactive queue due to a error.  */
2782 		data = STAILQ_FIRST(&sc->sc_rx_active);
2783 		if (data != NULL) {
2784 			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2785 			UATH_STAT_DEC(sc, st_rx_active);
2786 			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2787 			UATH_STAT_INC(sc, st_rx_inactive);
2788 		}
2789 		if (error != USB_ERR_CANCELLED) {
2790 			usbd_xfer_set_stall(xfer);
2791 			ifp->if_ierrors++;
2792 			goto setup;
2793 		}
2794 		break;
2795 	}
2796 }
2797 
2798 static void
2799 uath_data_txeof(struct usb_xfer *xfer, struct uath_data *data)
2800 {
2801 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2802 	struct ifnet *ifp = sc->sc_ifp;
2803 	struct mbuf *m;
2804 
2805 	UATH_ASSERT_LOCKED(sc);
2806 
2807 	/*
2808 	 * Do any tx complete callback.  Note this must be done before releasing
2809 	 * the node reference.
2810 	 */
2811 	if (data->m) {
2812 		m = data->m;
2813 		if (m->m_flags & M_TXCB &&
2814 		    (sc->sc_flags & UATH_FLAG_INVALID) == 0) {
2815 			/* XXX status? */
2816 			ieee80211_process_callback(data->ni, m, 0);
2817 		}
2818 		m_freem(m);
2819 		data->m = NULL;
2820 	}
2821 	if (data->ni) {
2822 		if ((sc->sc_flags & UATH_FLAG_INVALID) == 0)
2823 			ieee80211_free_node(data->ni);
2824 		data->ni = NULL;
2825 	}
2826 	sc->sc_tx_timer = 0;
2827 	ifp->if_opackets++;
2828 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2829 }
2830 
2831 static void
2832 uath_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
2833 {
2834 	struct uath_softc *sc = usbd_xfer_softc(xfer);
2835 	struct ifnet *ifp = sc->sc_ifp;
2836 	struct uath_data *data;
2837 
2838 	UATH_ASSERT_LOCKED(sc);
2839 
2840 	switch (USB_GET_STATE(xfer)) {
2841 	case USB_ST_TRANSFERRED:
2842 		data = STAILQ_FIRST(&sc->sc_tx_active);
2843 		if (data == NULL)
2844 			goto setup;
2845 		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
2846 		UATH_STAT_DEC(sc, st_tx_active);
2847 		uath_data_txeof(xfer, data);
2848 		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
2849 		UATH_STAT_INC(sc, st_tx_inactive);
2850 		/* FALLTHROUGH */
2851 	case USB_ST_SETUP:
2852 setup:
2853 		data = STAILQ_FIRST(&sc->sc_tx_pending);
2854 		if (data == NULL) {
2855 			DPRINTF(sc, UATH_DEBUG_XMIT, "%s: empty pending queue\n",
2856 			    __func__);
2857 			return;
2858 		}
2859 		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
2860 		UATH_STAT_DEC(sc, st_tx_pending);
2861 		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
2862 		UATH_STAT_INC(sc, st_tx_active);
2863 
2864 		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
2865 		usbd_transfer_submit(xfer);
2866 
2867 		UATH_UNLOCK(sc);
2868 		uath_start(ifp);
2869 		UATH_LOCK(sc);
2870 		break;
2871 	default:
2872 		data = STAILQ_FIRST(&sc->sc_tx_active);
2873 		if (data == NULL)
2874 			goto setup;
2875 		if (data->ni != NULL) {
2876 			if ((sc->sc_flags & UATH_FLAG_INVALID) == 0)
2877 				ieee80211_free_node(data->ni);
2878 			data->ni = NULL;
2879 			ifp->if_oerrors++;
2880 		}
2881 		if (error != USB_ERR_CANCELLED) {
2882 			usbd_xfer_set_stall(xfer);
2883 			goto setup;
2884 		}
2885 		break;
2886 	}
2887 }
2888 
2889 static device_method_t uath_methods[] = {
2890 	DEVMETHOD(device_probe, uath_match),
2891 	DEVMETHOD(device_attach, uath_attach),
2892 	DEVMETHOD(device_detach, uath_detach),
2893 	{ 0, 0 }
2894 };
2895 static driver_t uath_driver = {
2896 	.name = "uath",
2897 	.methods = uath_methods,
2898 	.size = sizeof(struct uath_softc)
2899 };
2900 static devclass_t uath_devclass;
2901 
2902 DRIVER_MODULE(uath, uhub, uath_driver, uath_devclass, NULL, 0);
2903 MODULE_DEPEND(uath, wlan, 1, 1, 1);
2904 MODULE_DEPEND(uath, usb, 1, 1, 1);
2905 MODULE_VERSION(uath, 1);
2906