1/*-
2 * Copyright (c) 2006 Sam Leffler, Errno Consulting
3 * Copyright (c) 2008-2009 Weongyo Jeong <weongyo@freebsd.org>
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 *    notice, this list of conditions and the following disclaimer,
11 *    without modification.
12 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
13 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
14 *    redistribution must be conditioned upon including a substantially
15 *    similar Disclaimer requirement for further binary redistribution.
16 *
17 * NO WARRANTY
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
21 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
22 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
23 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
26 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28 * THE POSSIBILITY OF SUCH DAMAGES.
29 */
30
31/*
32 * This driver is distantly derived from a driver of the same name
33 * by Damien Bergamini.  The original copyright is included below:
34 *
35 * Copyright (c) 2006
36 *	Damien Bergamini <damien.bergamini@free.fr>
37 *
38 * Permission to use, copy, modify, and distribute this software for any
39 * purpose with or without fee is hereby granted, provided that the above
40 * copyright notice and this permission notice appear in all copies.
41 *
42 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
43 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
44 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
45 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
46 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
47 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
48 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
49 */
50
51#include <sys/cdefs.h>
52__FBSDID("$FreeBSD: stable/10/sys/dev/usb/wlan/if_uath.c 343760 2019-02-05 03:01:10Z avos $");
53
54/*-
55 * Driver for Atheros AR5523 USB parts.
56 *
57 * The driver requires firmware to be loaded into the device.  This
58 * is done on device discovery from a user application (uathload)
59 * that is launched by devd when a device with suitable product ID
60 * is recognized.  Once firmware has been loaded the device will
61 * reset the USB port and re-attach with the original product ID+1
62 * and this driver will be attached.  The firmware is licensed for
63 * general use (royalty free) and may be incorporated in products.
64 * Note that the firmware normally packaged with the NDIS drivers
65 * for these devices does not work in this way and so does not work
66 * with this driver.
67 */
68#include <sys/param.h>
69#include <sys/sockio.h>
70#include <sys/sysctl.h>
71#include <sys/lock.h>
72#include <sys/mutex.h>
73#include <sys/mbuf.h>
74#include <sys/kernel.h>
75#include <sys/socket.h>
76#include <sys/systm.h>
77#include <sys/malloc.h>
78#include <sys/module.h>
79#include <sys/bus.h>
80#include <sys/endian.h>
81#include <sys/kdb.h>
82
83#include <net/bpf.h>
84#include <net/if.h>
85#include <net/if_arp.h>
86#include <net/ethernet.h>
87#include <net/if_dl.h>
88#include <net/if_media.h>
89#include <net/if_types.h>
90
91#ifdef INET
92#include <netinet/in.h>
93#include <netinet/in_systm.h>
94#include <netinet/in_var.h>
95#include <netinet/if_ether.h>
96#include <netinet/ip.h>
97#endif
98
99#include <net80211/ieee80211_var.h>
100#include <net80211/ieee80211_regdomain.h>
101#include <net80211/ieee80211_radiotap.h>
102
103#include <dev/usb/usb.h>
104#include <dev/usb/usbdi.h>
105#include "usbdevs.h"
106
107#include <dev/usb/wlan/if_uathreg.h>
108#include <dev/usb/wlan/if_uathvar.h>
109
110static SYSCTL_NODE(_hw_usb, OID_AUTO, uath, CTLFLAG_RW, 0, "USB Atheros");
111
112static	int uath_countrycode = CTRY_DEFAULT;	/* country code */
113SYSCTL_INT(_hw_usb_uath, OID_AUTO, countrycode, CTLFLAG_RW | CTLFLAG_TUN, &uath_countrycode,
114    0, "country code");
115TUNABLE_INT("hw.usb.uath.countrycode", &uath_countrycode);
116static	int uath_regdomain = 0;			/* regulatory domain */
117SYSCTL_INT(_hw_usb_uath, OID_AUTO, regdomain, CTLFLAG_RD, &uath_regdomain,
118    0, "regulatory domain");
119
120#ifdef UATH_DEBUG
121int uath_debug = 0;
122SYSCTL_INT(_hw_usb_uath, OID_AUTO, debug, CTLFLAG_RW | CTLFLAG_TUN, &uath_debug, 0,
123    "uath debug level");
124TUNABLE_INT("hw.usb.uath.debug", &uath_debug);
125enum {
126	UATH_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
127	UATH_DEBUG_XMIT_DUMP	= 0x00000002,	/* xmit dump */
128	UATH_DEBUG_RECV		= 0x00000004,	/* basic recv operation */
129	UATH_DEBUG_TX_PROC	= 0x00000008,	/* tx ISR proc */
130	UATH_DEBUG_RX_PROC	= 0x00000010,	/* rx ISR proc */
131	UATH_DEBUG_RECV_ALL	= 0x00000020,	/* trace all frames (beacons) */
132	UATH_DEBUG_INIT		= 0x00000040,	/* initialization of dev */
133	UATH_DEBUG_DEVCAP	= 0x00000080,	/* dev caps */
134	UATH_DEBUG_CMDS		= 0x00000100,	/* commands */
135	UATH_DEBUG_CMDS_DUMP	= 0x00000200,	/* command buffer dump */
136	UATH_DEBUG_RESET	= 0x00000400,	/* reset processing */
137	UATH_DEBUG_STATE	= 0x00000800,	/* 802.11 state transitions */
138	UATH_DEBUG_MULTICAST	= 0x00001000,	/* multicast */
139	UATH_DEBUG_WME		= 0x00002000,	/* WME */
140	UATH_DEBUG_CHANNEL	= 0x00004000,	/* channel */
141	UATH_DEBUG_RATES	= 0x00008000,	/* rates */
142	UATH_DEBUG_CRYPTO	= 0x00010000,	/* crypto */
143	UATH_DEBUG_LED		= 0x00020000,	/* LED */
144	UATH_DEBUG_ANY		= 0xffffffff
145};
146#define	DPRINTF(sc, m, fmt, ...) do {				\
147	if (sc->sc_debug & (m))					\
148		printf(fmt, __VA_ARGS__);			\
149} while (0)
150#else
151#define	DPRINTF(sc, m, fmt, ...) do {				\
152	(void) sc;						\
153} while (0)
154#endif
155
156/* unaligned little endian access */
157#define LE_READ_2(p)							\
158	((u_int16_t)							\
159	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8)))
160#define LE_READ_4(p)							\
161	((u_int32_t)							\
162	 ((((u_int8_t *)(p))[0]      ) | (((u_int8_t *)(p))[1] <<  8) |	\
163	  (((u_int8_t *)(p))[2] << 16) | (((u_int8_t *)(p))[3] << 24)))
164
165/* recognized device vendors/products */
166static const STRUCT_USB_HOST_ID uath_devs[] = {
167#define	UATH_DEV(v,p) { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
168	UATH_DEV(ACCTON,		SMCWUSBTG2),
169	UATH_DEV(ATHEROS,		AR5523),
170	UATH_DEV(ATHEROS2,		AR5523_1),
171	UATH_DEV(ATHEROS2,		AR5523_2),
172	UATH_DEV(ATHEROS2,		AR5523_3),
173	UATH_DEV(CONCEPTRONIC,		AR5523_1),
174	UATH_DEV(CONCEPTRONIC,		AR5523_2),
175	UATH_DEV(DLINK,			DWLAG122),
176	UATH_DEV(DLINK,			DWLAG132),
177	UATH_DEV(DLINK,			DWLG132),
178	UATH_DEV(DLINK2,		DWA120),
179	UATH_DEV(GIGASET,		AR5523),
180	UATH_DEV(GIGASET,		SMCWUSBTG),
181	UATH_DEV(GLOBALSUN,		AR5523_1),
182	UATH_DEV(GLOBALSUN,		AR5523_2),
183	UATH_DEV(NETGEAR,		WG111U),
184	UATH_DEV(NETGEAR3,		WG111T),
185	UATH_DEV(NETGEAR3,		WPN111),
186	UATH_DEV(NETGEAR3,		WPN111_2),
187	UATH_DEV(UMEDIA,		TEW444UBEU),
188	UATH_DEV(UMEDIA,		AR5523_2),
189	UATH_DEV(WISTRONNEWEB,		AR5523_1),
190	UATH_DEV(WISTRONNEWEB,		AR5523_2),
191	UATH_DEV(ZCOM,			AR5523)
192#undef UATH_DEV
193};
194
195static usb_callback_t uath_intr_rx_callback;
196static usb_callback_t uath_intr_tx_callback;
197static usb_callback_t uath_bulk_rx_callback;
198static usb_callback_t uath_bulk_tx_callback;
199
200static const struct usb_config uath_usbconfig[UATH_N_XFERS] = {
201	[UATH_INTR_RX] = {
202		.type = UE_BULK,
203		.endpoint = 0x1,
204		.direction = UE_DIR_IN,
205		.bufsize = UATH_MAX_CMDSZ,
206		.flags = {
207			.pipe_bof = 1,
208			.short_xfer_ok = 1
209		},
210		.callback = uath_intr_rx_callback
211	},
212	[UATH_INTR_TX] = {
213		.type = UE_BULK,
214		.endpoint = 0x1,
215		.direction = UE_DIR_OUT,
216		.bufsize = UATH_MAX_CMDSZ * UATH_CMD_LIST_COUNT,
217		.flags = {
218			.force_short_xfer = 1,
219			.pipe_bof = 1,
220		},
221		.callback = uath_intr_tx_callback,
222		.timeout = UATH_CMD_TIMEOUT
223	},
224	[UATH_BULK_RX] = {
225		.type = UE_BULK,
226		.endpoint = 0x2,
227		.direction = UE_DIR_IN,
228		.bufsize = MCLBYTES,
229		.flags = {
230			.ext_buffer = 1,
231			.pipe_bof = 1,
232			.short_xfer_ok = 1
233		},
234		.callback = uath_bulk_rx_callback
235	},
236	[UATH_BULK_TX] = {
237		.type = UE_BULK,
238		.endpoint = 0x2,
239		.direction = UE_DIR_OUT,
240		.bufsize = UATH_MAX_TXBUFSZ * UATH_TX_DATA_LIST_COUNT,
241		.flags = {
242			.force_short_xfer = 1,
243			.pipe_bof = 1
244		},
245		.callback = uath_bulk_tx_callback,
246		.timeout = UATH_DATA_TIMEOUT
247	}
248};
249
250static struct ieee80211vap *uath_vap_create(struct ieee80211com *,
251		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
252		    const uint8_t [IEEE80211_ADDR_LEN],
253		    const uint8_t [IEEE80211_ADDR_LEN]);
254static void	uath_vap_delete(struct ieee80211vap *);
255static int	uath_alloc_cmd_list(struct uath_softc *, struct uath_cmd []);
256static void	uath_free_cmd_list(struct uath_softc *, struct uath_cmd []);
257static int	uath_host_available(struct uath_softc *);
258static int	uath_get_capability(struct uath_softc *, uint32_t, uint32_t *);
259static int	uath_get_devcap(struct uath_softc *);
260static struct uath_cmd *
261		uath_get_cmdbuf(struct uath_softc *);
262static int	uath_cmd_read(struct uath_softc *, uint32_t, const void *,
263		    int, void *, int, int);
264static int	uath_cmd_write(struct uath_softc *, uint32_t, const void *,
265		    int, int);
266static void	uath_stat(void *);
267#ifdef UATH_DEBUG
268static void	uath_dump_cmd(const uint8_t *, int, char);
269static const char *
270		uath_codename(int);
271#endif
272static int	uath_get_devstatus(struct uath_softc *,
273		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
274static int	uath_get_status(struct uath_softc *, uint32_t, void *, int);
275static int	uath_alloc_rx_data_list(struct uath_softc *);
276static int	uath_alloc_tx_data_list(struct uath_softc *);
277static void	uath_free_rx_data_list(struct uath_softc *);
278static void	uath_free_tx_data_list(struct uath_softc *);
279static int	uath_init_locked(void *);
280static void	uath_init(void *);
281static void	uath_stop_locked(struct ifnet *);
282static void	uath_stop(struct ifnet *);
283static int	uath_ioctl(struct ifnet *, u_long, caddr_t);
284static void	uath_start(struct ifnet *);
285static int	uath_raw_xmit(struct ieee80211_node *, struct mbuf *,
286		    const struct ieee80211_bpf_params *);
287static void	uath_scan_start(struct ieee80211com *);
288static void	uath_scan_end(struct ieee80211com *);
289static void	uath_set_channel(struct ieee80211com *);
290static void	uath_update_mcast(struct ifnet *);
291static void	uath_update_promisc(struct ifnet *);
292static int	uath_config(struct uath_softc *, uint32_t, uint32_t);
293static int	uath_config_multi(struct uath_softc *, uint32_t, const void *,
294		    int);
295static int	uath_switch_channel(struct uath_softc *,
296		    struct ieee80211_channel *);
297static int	uath_set_rxfilter(struct uath_softc *, uint32_t, uint32_t);
298static void	uath_watchdog(void *);
299static void	uath_abort_xfers(struct uath_softc *);
300static int	uath_dataflush(struct uath_softc *);
301static int	uath_cmdflush(struct uath_softc *);
302static int	uath_flush(struct uath_softc *);
303static int	uath_set_ledstate(struct uath_softc *, int);
304static int	uath_set_chan(struct uath_softc *, struct ieee80211_channel *);
305static int	uath_reset_tx_queues(struct uath_softc *);
306static int	uath_wme_init(struct uath_softc *);
307static struct uath_data *
308		uath_getbuf(struct uath_softc *);
309static int	uath_newstate(struct ieee80211vap *, enum ieee80211_state,
310		    int);
311static int	uath_set_key(struct uath_softc *,
312		    const struct ieee80211_key *, int);
313static int	uath_set_keys(struct uath_softc *, struct ieee80211vap *);
314static void	uath_sysctl_node(struct uath_softc *);
315
316static int
317uath_match(device_t dev)
318{
319	struct usb_attach_arg *uaa = device_get_ivars(dev);
320
321	if (uaa->usb_mode != USB_MODE_HOST)
322		return (ENXIO);
323	if (uaa->info.bConfigIndex != UATH_CONFIG_INDEX)
324		return (ENXIO);
325	if (uaa->info.bIfaceIndex != UATH_IFACE_INDEX)
326		return (ENXIO);
327
328	return (usbd_lookup_id_by_uaa(uath_devs, sizeof(uath_devs), uaa));
329}
330
331static int
332uath_attach(device_t dev)
333{
334	struct uath_softc *sc = device_get_softc(dev);
335	struct usb_attach_arg *uaa = device_get_ivars(dev);
336	struct ieee80211com *ic;
337	struct ifnet *ifp;
338	uint8_t bands, iface_index = UATH_IFACE_INDEX;		/* XXX */
339	usb_error_t error;
340	uint8_t macaddr[IEEE80211_ADDR_LEN];
341
342	sc->sc_dev = dev;
343	sc->sc_udev = uaa->device;
344#ifdef UATH_DEBUG
345	sc->sc_debug = uath_debug;
346#endif
347	device_set_usb_desc(dev);
348
349	/*
350	 * Only post-firmware devices here.
351	 */
352	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
353	    MTX_DEF);
354	callout_init(&sc->stat_ch, 0);
355	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
356
357	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
358	    uath_usbconfig, UATH_N_XFERS, sc, &sc->sc_mtx);
359	if (error) {
360		device_printf(dev, "could not allocate USB transfers, "
361		    "err=%s\n", usbd_errstr(error));
362		goto fail;
363	}
364
365	sc->sc_cmd_dma_buf =
366	    usbd_xfer_get_frame_buffer(sc->sc_xfer[UATH_INTR_TX], 0);
367	sc->sc_tx_dma_buf =
368	    usbd_xfer_get_frame_buffer(sc->sc_xfer[UATH_BULK_TX], 0);
369
370	/*
371	 * Setup buffers for firmware commands.
372	 */
373	error = uath_alloc_cmd_list(sc, sc->sc_cmd);
374	if (error != 0) {
375		device_printf(sc->sc_dev,
376		    "could not allocate Tx command list\n");
377		goto fail1;
378	}
379
380	/*
381	 * We're now ready to send+receive firmware commands.
382	 */
383	UATH_LOCK(sc);
384	error = uath_host_available(sc);
385	if (error != 0) {
386		device_printf(sc->sc_dev, "could not initialize adapter\n");
387		goto fail3;
388	}
389	error = uath_get_devcap(sc);
390	if (error != 0) {
391		device_printf(sc->sc_dev,
392		    "could not get device capabilities\n");
393		goto fail3;
394	}
395	UATH_UNLOCK(sc);
396
397	/* Create device sysctl node. */
398	uath_sysctl_node(sc);
399
400	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
401	if (ifp == NULL) {
402		device_printf(sc->sc_dev, "can not allocate ifnet\n");
403		error = ENXIO;
404		goto fail2;
405	}
406
407	UATH_LOCK(sc);
408	error = uath_get_devstatus(sc, macaddr);
409	if (error != 0) {
410		device_printf(sc->sc_dev, "could not get device status\n");
411		goto fail4;
412	}
413
414	/*
415	 * Allocate xfers for Rx/Tx data pipes.
416	 */
417	error = uath_alloc_rx_data_list(sc);
418	if (error != 0) {
419		device_printf(sc->sc_dev, "could not allocate Rx data list\n");
420		goto fail4;
421	}
422	error = uath_alloc_tx_data_list(sc);
423	if (error != 0) {
424		device_printf(sc->sc_dev, "could not allocate Tx data list\n");
425		goto fail4;
426	}
427	UATH_UNLOCK(sc);
428
429	ifp->if_softc = sc;
430	if_initname(ifp, "uath", device_get_unit(sc->sc_dev));
431	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
432	ifp->if_init = uath_init;
433	ifp->if_ioctl = uath_ioctl;
434	ifp->if_start = uath_start;
435	/* XXX UATH_TX_DATA_LIST_COUNT */
436	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
437	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
438	IFQ_SET_READY(&ifp->if_snd);
439
440	ic = ifp->if_l2com;
441	ic->ic_ifp = ifp;
442	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
443	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
444
445	/* set device capabilities */
446	ic->ic_caps =
447	    IEEE80211_C_STA |		/* station mode */
448	    IEEE80211_C_MONITOR |	/* monitor mode supported */
449	    IEEE80211_C_TXPMGT |	/* tx power management */
450	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
451	    IEEE80211_C_SHSLOT |	/* short slot time supported */
452	    IEEE80211_C_WPA |		/* 802.11i */
453	    IEEE80211_C_BGSCAN |	/* capable of bg scanning */
454	    IEEE80211_C_TXFRAG;		/* handle tx frags */
455
456	/* put a regulatory domain to reveal informations.  */
457	uath_regdomain = sc->sc_devcap.regDomain;
458
459	bands = 0;
460	setbit(&bands, IEEE80211_MODE_11B);
461	setbit(&bands, IEEE80211_MODE_11G);
462	if ((sc->sc_devcap.analog5GhzRevision & 0xf0) == 0x30)
463		setbit(&bands, IEEE80211_MODE_11A);
464	/* XXX turbo */
465	ieee80211_init_channels(ic, NULL, &bands);
466
467	ieee80211_ifattach(ic, macaddr);
468	ic->ic_raw_xmit = uath_raw_xmit;
469	ic->ic_scan_start = uath_scan_start;
470	ic->ic_scan_end = uath_scan_end;
471	ic->ic_set_channel = uath_set_channel;
472
473	ic->ic_vap_create = uath_vap_create;
474	ic->ic_vap_delete = uath_vap_delete;
475	ic->ic_update_mcast = uath_update_mcast;
476	ic->ic_update_promisc = uath_update_promisc;
477
478	ieee80211_radiotap_attach(ic,
479	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
480		UATH_TX_RADIOTAP_PRESENT,
481	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
482		UATH_RX_RADIOTAP_PRESENT);
483
484	if (bootverbose)
485		ieee80211_announce(ic);
486
487	return (0);
488
489fail4:	if_free(ifp);
490fail3:	UATH_UNLOCK(sc);
491fail2:	uath_free_cmd_list(sc, sc->sc_cmd);
492fail1:	usbd_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
493fail:
494	return (error);
495}
496
497static int
498uath_detach(device_t dev)
499{
500	struct uath_softc *sc = device_get_softc(dev);
501	struct ifnet *ifp = sc->sc_ifp;
502	struct ieee80211com *ic = ifp->if_l2com;
503	unsigned int x;
504
505	/*
506	 * Prevent further allocations from RX/TX/CMD
507	 * data lists and ioctls
508	 */
509	UATH_LOCK(sc);
510	sc->sc_flags |= UATH_FLAG_INVALID;
511
512	STAILQ_INIT(&sc->sc_rx_active);
513	STAILQ_INIT(&sc->sc_rx_inactive);
514
515	STAILQ_INIT(&sc->sc_tx_active);
516	STAILQ_INIT(&sc->sc_tx_inactive);
517	STAILQ_INIT(&sc->sc_tx_pending);
518
519	STAILQ_INIT(&sc->sc_cmd_active);
520	STAILQ_INIT(&sc->sc_cmd_pending);
521	STAILQ_INIT(&sc->sc_cmd_waiting);
522	STAILQ_INIT(&sc->sc_cmd_inactive);
523	UATH_UNLOCK(sc);
524
525	uath_stop(ifp);
526
527	callout_drain(&sc->stat_ch);
528	callout_drain(&sc->watchdog_ch);
529
530	/* drain USB transfers */
531	for (x = 0; x != UATH_N_XFERS; x++)
532		usbd_transfer_drain(sc->sc_xfer[x]);
533
534	/* free data buffers */
535	UATH_LOCK(sc);
536	uath_free_rx_data_list(sc);
537	uath_free_tx_data_list(sc);
538	uath_free_cmd_list(sc, sc->sc_cmd);
539	UATH_UNLOCK(sc);
540
541	/* free USB transfers and some data buffers */
542	usbd_transfer_unsetup(sc->sc_xfer, UATH_N_XFERS);
543
544	ieee80211_ifdetach(ic);
545	if_free(ifp);
546	mtx_destroy(&sc->sc_mtx);
547	return (0);
548}
549
550static void
551uath_free_cmd_list(struct uath_softc *sc, struct uath_cmd cmds[])
552{
553	int i;
554
555	for (i = 0; i != UATH_CMD_LIST_COUNT; i++)
556		cmds[i].buf = NULL;
557}
558
559static int
560uath_alloc_cmd_list(struct uath_softc *sc, struct uath_cmd cmds[])
561{
562	int i;
563
564	STAILQ_INIT(&sc->sc_cmd_active);
565	STAILQ_INIT(&sc->sc_cmd_pending);
566	STAILQ_INIT(&sc->sc_cmd_waiting);
567	STAILQ_INIT(&sc->sc_cmd_inactive);
568
569	for (i = 0; i != UATH_CMD_LIST_COUNT; i++) {
570		struct uath_cmd *cmd = &cmds[i];
571
572		cmd->sc = sc;	/* backpointer for callbacks */
573		cmd->msgid = i;
574		cmd->buf = ((uint8_t *)sc->sc_cmd_dma_buf) +
575		    (i * UATH_MAX_CMDSZ);
576		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next);
577		UATH_STAT_INC(sc, st_cmd_inactive);
578	}
579	return (0);
580}
581
582static int
583uath_host_available(struct uath_softc *sc)
584{
585	struct uath_cmd_host_available setup;
586
587	UATH_ASSERT_LOCKED(sc);
588
589	/* inform target the host is available */
590	setup.sw_ver_major = htobe32(ATH_SW_VER_MAJOR);
591	setup.sw_ver_minor = htobe32(ATH_SW_VER_MINOR);
592	setup.sw_ver_patch = htobe32(ATH_SW_VER_PATCH);
593	setup.sw_ver_build = htobe32(ATH_SW_VER_BUILD);
594	return uath_cmd_read(sc, WDCMSG_HOST_AVAILABLE,
595		&setup, sizeof setup, NULL, 0, 0);
596}
597
598#ifdef UATH_DEBUG
599static void
600uath_dump_cmd(const uint8_t *buf, int len, char prefix)
601{
602	const char *sep = "";
603	int i;
604
605	for (i = 0; i < len; i++) {
606		if ((i % 16) == 0) {
607			printf("%s%c ", sep, prefix);
608			sep = "\n";
609		}
610		else if ((i % 4) == 0)
611			printf(" ");
612		printf("%02x", buf[i]);
613	}
614	printf("\n");
615}
616
617static const char *
618uath_codename(int code)
619{
620#define	N(a)	(sizeof(a)/sizeof(a[0]))
621	static const char *names[] = {
622	    "0x00",
623	    "HOST_AVAILABLE",
624	    "BIND",
625	    "TARGET_RESET",
626	    "TARGET_GET_CAPABILITY",
627	    "TARGET_SET_CONFIG",
628	    "TARGET_GET_STATUS",
629	    "TARGET_GET_STATS",
630	    "TARGET_START",
631	    "TARGET_STOP",
632	    "TARGET_ENABLE",
633	    "TARGET_DISABLE",
634	    "CREATE_CONNECTION",
635	    "UPDATE_CONNECT_ATTR",
636	    "DELETE_CONNECT",
637	    "SEND",
638	    "FLUSH",
639	    "STATS_UPDATE",
640	    "BMISS",
641	    "DEVICE_AVAIL",
642	    "SEND_COMPLETE",
643	    "DATA_AVAIL",
644	    "SET_PWR_MODE",
645	    "BMISS_ACK",
646	    "SET_LED_STEADY",
647	    "SET_LED_BLINK",
648	    "SETUP_BEACON_DESC",
649	    "BEACON_INIT",
650	    "RESET_KEY_CACHE",
651	    "RESET_KEY_CACHE_ENTRY",
652	    "SET_KEY_CACHE_ENTRY",
653	    "SET_DECOMP_MASK",
654	    "SET_REGULATORY_DOMAIN",
655	    "SET_LED_STATE",
656	    "WRITE_ASSOCID",
657	    "SET_STA_BEACON_TIMERS",
658	    "GET_TSF",
659	    "RESET_TSF",
660	    "SET_ADHOC_MODE",
661	    "SET_BASIC_RATE",
662	    "MIB_CONTROL",
663	    "GET_CHANNEL_DATA",
664	    "GET_CUR_RSSI",
665	    "SET_ANTENNA_SWITCH",
666	    "0x2c", "0x2d", "0x2e",
667	    "USE_SHORT_SLOT_TIME",
668	    "SET_POWER_MODE",
669	    "SETUP_PSPOLL_DESC",
670	    "SET_RX_MULTICAST_FILTER",
671	    "RX_FILTER",
672	    "PER_CALIBRATION",
673	    "RESET",
674	    "DISABLE",
675	    "PHY_DISABLE",
676	    "SET_TX_POWER_LIMIT",
677	    "SET_TX_QUEUE_PARAMS",
678	    "SETUP_TX_QUEUE",
679	    "RELEASE_TX_QUEUE",
680	};
681	static char buf[8];
682
683	if (code < N(names))
684		return names[code];
685	if (code == WDCMSG_SET_DEFAULT_KEY)
686		return "SET_DEFAULT_KEY";
687	snprintf(buf, sizeof(buf), "0x%02x", code);
688	return buf;
689#undef N
690}
691#endif
692
693/*
694 * Low-level function to send read or write commands to the firmware.
695 */
696static int
697uath_cmdsend(struct uath_softc *sc, uint32_t code, const void *idata, int ilen,
698    void *odata, int olen, int flags)
699{
700	struct uath_cmd_hdr *hdr;
701	struct uath_cmd *cmd;
702	int error;
703
704	UATH_ASSERT_LOCKED(sc);
705
706	/* grab a xfer */
707	cmd = uath_get_cmdbuf(sc);
708	if (cmd == NULL) {
709		device_printf(sc->sc_dev, "%s: empty inactive queue\n",
710		    __func__);
711		return (ENOBUFS);
712	}
713	cmd->flags = flags;
714	/* always bulk-out a multiple of 4 bytes */
715	cmd->buflen = roundup2(sizeof(struct uath_cmd_hdr) + ilen, 4);
716
717	hdr = (struct uath_cmd_hdr *)cmd->buf;
718	memset(hdr, 0, sizeof(struct uath_cmd_hdr));
719	hdr->len   = htobe32(cmd->buflen);
720	hdr->code  = htobe32(code);
721	hdr->msgid = cmd->msgid;	/* don't care about endianness */
722	hdr->magic = htobe32((cmd->flags & UATH_CMD_FLAG_MAGIC) ? 1 << 24 : 0);
723	memcpy((uint8_t *)(hdr + 1), idata, ilen);
724
725#ifdef UATH_DEBUG
726	if (sc->sc_debug & UATH_DEBUG_CMDS) {
727		printf("%s: send  %s [flags 0x%x] olen %d\n",
728		    __func__, uath_codename(code), cmd->flags, olen);
729		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
730			uath_dump_cmd(cmd->buf, cmd->buflen, '+');
731	}
732#endif
733	cmd->odata = odata;
734	KASSERT(odata == NULL ||
735	    olen < UATH_MAX_CMDSZ - sizeof(*hdr) + sizeof(uint32_t),
736	    ("odata %p olen %u", odata, olen));
737	cmd->olen = olen;
738
739	STAILQ_INSERT_TAIL(&sc->sc_cmd_pending, cmd, next);
740	UATH_STAT_INC(sc, st_cmd_pending);
741	usbd_transfer_start(sc->sc_xfer[UATH_INTR_TX]);
742
743	if (cmd->flags & UATH_CMD_FLAG_READ) {
744		usbd_transfer_start(sc->sc_xfer[UATH_INTR_RX]);
745
746		/* wait at most two seconds for command reply */
747		error = mtx_sleep(cmd, &sc->sc_mtx, 0, "uathcmd", 2 * hz);
748		cmd->odata = NULL;	/* in case reply comes too late */
749		if (error != 0) {
750			device_printf(sc->sc_dev, "timeout waiting for reply "
751			    "to cmd 0x%x (%u)\n", code, code);
752		} else if (cmd->olen != olen) {
753			device_printf(sc->sc_dev, "unexpected reply data count "
754			    "to cmd 0x%x (%u), got %u, expected %u\n",
755			    code, code, cmd->olen, olen);
756			error = EINVAL;
757		}
758		return (error);
759	}
760	return (0);
761}
762
763static int
764uath_cmd_read(struct uath_softc *sc, uint32_t code, const void *idata,
765    int ilen, void *odata, int olen, int flags)
766{
767
768	flags |= UATH_CMD_FLAG_READ;
769	return uath_cmdsend(sc, code, idata, ilen, odata, olen, flags);
770}
771
772static int
773uath_cmd_write(struct uath_softc *sc, uint32_t code, const void *data, int len,
774    int flags)
775{
776
777	flags &= ~UATH_CMD_FLAG_READ;
778	return uath_cmdsend(sc, code, data, len, NULL, 0, flags);
779}
780
781static struct uath_cmd *
782uath_get_cmdbuf(struct uath_softc *sc)
783{
784	struct uath_cmd *uc;
785
786	UATH_ASSERT_LOCKED(sc);
787
788	uc = STAILQ_FIRST(&sc->sc_cmd_inactive);
789	if (uc != NULL) {
790		STAILQ_REMOVE_HEAD(&sc->sc_cmd_inactive, next);
791		UATH_STAT_DEC(sc, st_cmd_inactive);
792	} else
793		uc = NULL;
794	if (uc == NULL)
795		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: %s\n", __func__,
796		    "out of command xmit buffers");
797	return (uc);
798}
799
800/*
801 * This function is called periodically (every second) when associated to
802 * query device statistics.
803 */
804static void
805uath_stat(void *arg)
806{
807	struct uath_softc *sc = arg;
808	int error;
809
810	UATH_LOCK(sc);
811	/*
812	 * Send request for statistics asynchronously. The timer will be
813	 * restarted when we'll get the stats notification.
814	 */
815	error = uath_cmd_write(sc, WDCMSG_TARGET_GET_STATS, NULL, 0,
816	    UATH_CMD_FLAG_ASYNC);
817	if (error != 0) {
818		device_printf(sc->sc_dev,
819		    "could not query stats, error %d\n", error);
820	}
821	UATH_UNLOCK(sc);
822}
823
824static int
825uath_get_capability(struct uath_softc *sc, uint32_t cap, uint32_t *val)
826{
827	int error;
828
829	cap = htobe32(cap);
830	error = uath_cmd_read(sc, WDCMSG_TARGET_GET_CAPABILITY,
831	    &cap, sizeof cap, val, sizeof(uint32_t), UATH_CMD_FLAG_MAGIC);
832	if (error != 0) {
833		device_printf(sc->sc_dev, "could not read capability %u\n",
834		    be32toh(cap));
835		return (error);
836	}
837	*val = be32toh(*val);
838	return (error);
839}
840
841static int
842uath_get_devcap(struct uath_softc *sc)
843{
844#define	GETCAP(x, v) do {				\
845	error = uath_get_capability(sc, x, &v);		\
846	if (error != 0)					\
847		return (error);				\
848	DPRINTF(sc, UATH_DEBUG_DEVCAP,			\
849	    "%s: %s=0x%08x\n", __func__, #x, v);	\
850} while (0)
851	struct uath_devcap *cap = &sc->sc_devcap;
852	int error;
853
854	/* collect device capabilities */
855	GETCAP(CAP_TARGET_VERSION, cap->targetVersion);
856	GETCAP(CAP_TARGET_REVISION, cap->targetRevision);
857	GETCAP(CAP_MAC_VERSION, cap->macVersion);
858	GETCAP(CAP_MAC_REVISION, cap->macRevision);
859	GETCAP(CAP_PHY_REVISION, cap->phyRevision);
860	GETCAP(CAP_ANALOG_5GHz_REVISION, cap->analog5GhzRevision);
861	GETCAP(CAP_ANALOG_2GHz_REVISION, cap->analog2GhzRevision);
862
863	GETCAP(CAP_REG_DOMAIN, cap->regDomain);
864	GETCAP(CAP_REG_CAP_BITS, cap->regCapBits);
865#if 0
866	/* NB: not supported in rev 1.5 */
867	GETCAP(CAP_COUNTRY_CODE, cap->countryCode);
868#endif
869	GETCAP(CAP_WIRELESS_MODES, cap->wirelessModes);
870	GETCAP(CAP_CHAN_SPREAD_SUPPORT, cap->chanSpreadSupport);
871	GETCAP(CAP_COMPRESS_SUPPORT, cap->compressSupport);
872	GETCAP(CAP_BURST_SUPPORT, cap->burstSupport);
873	GETCAP(CAP_FAST_FRAMES_SUPPORT, cap->fastFramesSupport);
874	GETCAP(CAP_CHAP_TUNING_SUPPORT, cap->chapTuningSupport);
875	GETCAP(CAP_TURBOG_SUPPORT, cap->turboGSupport);
876	GETCAP(CAP_TURBO_PRIME_SUPPORT, cap->turboPrimeSupport);
877	GETCAP(CAP_DEVICE_TYPE, cap->deviceType);
878	GETCAP(CAP_WME_SUPPORT, cap->wmeSupport);
879	GETCAP(CAP_TOTAL_QUEUES, cap->numTxQueues);
880	GETCAP(CAP_CONNECTION_ID_MAX, cap->connectionIdMax);
881
882	GETCAP(CAP_LOW_5GHZ_CHAN, cap->low5GhzChan);
883	GETCAP(CAP_HIGH_5GHZ_CHAN, cap->high5GhzChan);
884	GETCAP(CAP_LOW_2GHZ_CHAN, cap->low2GhzChan);
885	GETCAP(CAP_HIGH_2GHZ_CHAN, cap->high2GhzChan);
886	GETCAP(CAP_TWICE_ANTENNAGAIN_5G, cap->twiceAntennaGain5G);
887	GETCAP(CAP_TWICE_ANTENNAGAIN_2G, cap->twiceAntennaGain2G);
888
889	GETCAP(CAP_CIPHER_AES_CCM, cap->supportCipherAES_CCM);
890	GETCAP(CAP_CIPHER_TKIP, cap->supportCipherTKIP);
891	GETCAP(CAP_MIC_TKIP, cap->supportMicTKIP);
892
893	cap->supportCipherWEP = 1;	/* NB: always available */
894
895	return (0);
896}
897
898static int
899uath_get_devstatus(struct uath_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
900{
901	int error;
902
903	/* retrieve MAC address */
904	error = uath_get_status(sc, ST_MAC_ADDR, macaddr, IEEE80211_ADDR_LEN);
905	if (error != 0) {
906		device_printf(sc->sc_dev, "could not read MAC address\n");
907		return (error);
908	}
909
910	error = uath_get_status(sc, ST_SERIAL_NUMBER,
911	    &sc->sc_serial[0], sizeof(sc->sc_serial));
912	if (error != 0) {
913		device_printf(sc->sc_dev,
914		    "could not read device serial number\n");
915		return (error);
916	}
917	return (0);
918}
919
920static int
921uath_get_status(struct uath_softc *sc, uint32_t which, void *odata, int olen)
922{
923	int error;
924
925	which = htobe32(which);
926	error = uath_cmd_read(sc, WDCMSG_TARGET_GET_STATUS,
927	    &which, sizeof(which), odata, olen, UATH_CMD_FLAG_MAGIC);
928	if (error != 0)
929		device_printf(sc->sc_dev,
930		    "could not read EEPROM offset 0x%02x\n", be32toh(which));
931	return (error);
932}
933
934static void
935uath_free_data_list(struct uath_softc *sc, struct uath_data data[], int ndata,
936    int fillmbuf)
937{
938	int i;
939
940	for (i = 0; i < ndata; i++) {
941		struct uath_data *dp = &data[i];
942
943		if (fillmbuf == 1) {
944			if (dp->m != NULL) {
945				m_freem(dp->m);
946				dp->m = NULL;
947				dp->buf = NULL;
948			}
949		} else {
950			dp->buf = NULL;
951		}
952		if (dp->ni != NULL) {
953			ieee80211_free_node(dp->ni);
954			dp->ni = NULL;
955		}
956	}
957}
958
959static int
960uath_alloc_data_list(struct uath_softc *sc, struct uath_data data[],
961    int ndata, int maxsz, void *dma_buf)
962{
963	int i, error;
964
965	for (i = 0; i < ndata; i++) {
966		struct uath_data *dp = &data[i];
967
968		dp->sc = sc;
969		if (dma_buf == NULL) {
970			/* XXX check maxsz */
971			dp->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
972			if (dp->m == NULL) {
973				device_printf(sc->sc_dev,
974				    "could not allocate rx mbuf\n");
975				error = ENOMEM;
976				goto fail;
977			}
978			dp->buf = mtod(dp->m, uint8_t *);
979		} else {
980			dp->m = NULL;
981			dp->buf = ((uint8_t *)dma_buf) + (i * maxsz);
982		}
983		dp->ni = NULL;
984	}
985
986	return (0);
987
988fail:	uath_free_data_list(sc, data, ndata, 1 /* free mbufs */);
989	return (error);
990}
991
992static int
993uath_alloc_rx_data_list(struct uath_softc *sc)
994{
995	int error, i;
996
997	/* XXX is it enough to store the RX packet with MCLBYTES bytes?  */
998	error = uath_alloc_data_list(sc,
999	    sc->sc_rx, UATH_RX_DATA_LIST_COUNT, MCLBYTES,
1000	    NULL /* setup mbufs */);
1001	if (error != 0)
1002		return (error);
1003
1004	STAILQ_INIT(&sc->sc_rx_active);
1005	STAILQ_INIT(&sc->sc_rx_inactive);
1006
1007	for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
1008		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i],
1009		    next);
1010		UATH_STAT_INC(sc, st_rx_inactive);
1011	}
1012
1013	return (0);
1014}
1015
1016static int
1017uath_alloc_tx_data_list(struct uath_softc *sc)
1018{
1019	int error, i;
1020
1021	error = uath_alloc_data_list(sc,
1022	    sc->sc_tx, UATH_TX_DATA_LIST_COUNT, UATH_MAX_TXBUFSZ,
1023	    sc->sc_tx_dma_buf);
1024	if (error != 0)
1025		return (error);
1026
1027	STAILQ_INIT(&sc->sc_tx_active);
1028	STAILQ_INIT(&sc->sc_tx_inactive);
1029	STAILQ_INIT(&sc->sc_tx_pending);
1030
1031	for (i = 0; i < UATH_TX_DATA_LIST_COUNT; i++) {
1032		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i],
1033		    next);
1034		UATH_STAT_INC(sc, st_tx_inactive);
1035	}
1036
1037	return (0);
1038}
1039
1040static void
1041uath_free_rx_data_list(struct uath_softc *sc)
1042{
1043	uath_free_data_list(sc, sc->sc_rx, UATH_RX_DATA_LIST_COUNT,
1044	    1 /* free mbufs */);
1045}
1046
1047static void
1048uath_free_tx_data_list(struct uath_softc *sc)
1049{
1050	uath_free_data_list(sc, sc->sc_tx, UATH_TX_DATA_LIST_COUNT,
1051	    0 /* no mbufs */);
1052}
1053
1054static struct ieee80211vap *
1055uath_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1056    enum ieee80211_opmode opmode, int flags,
1057    const uint8_t bssid[IEEE80211_ADDR_LEN],
1058    const uint8_t mac[IEEE80211_ADDR_LEN])
1059{
1060	struct uath_vap *uvp;
1061	struct ieee80211vap *vap;
1062
1063	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
1064		return (NULL);
1065	uvp = (struct uath_vap *) malloc(sizeof(struct uath_vap),
1066	    M_80211_VAP, M_NOWAIT | M_ZERO);
1067	if (uvp == NULL)
1068		return (NULL);
1069	vap = &uvp->vap;
1070	/* enable s/w bmiss handling for sta mode */
1071
1072	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
1073	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
1074		/* out of memory */
1075		free(uvp, M_80211_VAP);
1076		return (NULL);
1077	}
1078
1079	/* override state transition machine */
1080	uvp->newstate = vap->iv_newstate;
1081	vap->iv_newstate = uath_newstate;
1082
1083	/* complete setup */
1084	ieee80211_vap_attach(vap, ieee80211_media_change,
1085	    ieee80211_media_status);
1086	ic->ic_opmode = opmode;
1087	return (vap);
1088}
1089
1090static void
1091uath_vap_delete(struct ieee80211vap *vap)
1092{
1093	struct uath_vap *uvp = UATH_VAP(vap);
1094
1095	ieee80211_vap_detach(vap);
1096	free(uvp, M_80211_VAP);
1097}
1098
1099static int
1100uath_init_locked(void *arg)
1101{
1102	struct uath_softc *sc = arg;
1103	struct ifnet *ifp = sc->sc_ifp;
1104	struct ieee80211com *ic = ifp->if_l2com;
1105	uint32_t val;
1106	int error;
1107
1108	UATH_ASSERT_LOCKED(sc);
1109
1110	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1111		uath_stop_locked(ifp);
1112
1113	/* reset variables */
1114	sc->sc_intrx_nextnum = sc->sc_msgid = 0;
1115
1116	val = htobe32(0);
1117	uath_cmd_write(sc, WDCMSG_BIND, &val, sizeof val, 0);
1118
1119	/* set MAC address */
1120	uath_config_multi(sc, CFG_MAC_ADDR, IF_LLADDR(ifp), IEEE80211_ADDR_LEN);
1121
1122	/* XXX honor net80211 state */
1123	uath_config(sc, CFG_RATE_CONTROL_ENABLE, 0x00000001);
1124	uath_config(sc, CFG_DIVERSITY_CTL, 0x00000001);
1125	uath_config(sc, CFG_ABOLT, 0x0000003f);
1126	uath_config(sc, CFG_WME_ENABLED, 0x00000001);
1127
1128	uath_config(sc, CFG_SERVICE_TYPE, 1);
1129	uath_config(sc, CFG_TP_SCALE, 0x00000000);
1130	uath_config(sc, CFG_TPC_HALF_DBM5, 0x0000003c);
1131	uath_config(sc, CFG_TPC_HALF_DBM2, 0x0000003c);
1132	uath_config(sc, CFG_OVERRD_TX_POWER, 0x00000000);
1133	uath_config(sc, CFG_GMODE_PROTECTION, 0x00000000);
1134	uath_config(sc, CFG_GMODE_PROTECT_RATE_INDEX, 0x00000003);
1135	uath_config(sc, CFG_PROTECTION_TYPE, 0x00000000);
1136	uath_config(sc, CFG_MODE_CTS, 0x00000002);
1137
1138	error = uath_cmd_read(sc, WDCMSG_TARGET_START, NULL, 0,
1139	    &val, sizeof(val), UATH_CMD_FLAG_MAGIC);
1140	if (error) {
1141		device_printf(sc->sc_dev,
1142		    "could not start target, error %d\n", error);
1143		goto fail;
1144	}
1145	DPRINTF(sc, UATH_DEBUG_INIT, "%s returns handle: 0x%x\n",
1146	    uath_codename(WDCMSG_TARGET_START), be32toh(val));
1147
1148	/* set default channel */
1149	error = uath_switch_channel(sc, ic->ic_curchan);
1150	if (error) {
1151		device_printf(sc->sc_dev,
1152		    "could not switch channel, error %d\n", error);
1153		goto fail;
1154	}
1155
1156	val = htobe32(TARGET_DEVICE_AWAKE);
1157	uath_cmd_write(sc, WDCMSG_SET_PWR_MODE, &val, sizeof val, 0);
1158	/* XXX? check */
1159	uath_cmd_write(sc, WDCMSG_RESET_KEY_CACHE, NULL, 0, 0);
1160
1161	usbd_transfer_start(sc->sc_xfer[UATH_BULK_RX]);
1162	/* enable Rx */
1163	uath_set_rxfilter(sc, 0x0, UATH_FILTER_OP_INIT);
1164	uath_set_rxfilter(sc,
1165	    UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1166	    UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON,
1167	    UATH_FILTER_OP_SET);
1168
1169	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1170	ifp->if_drv_flags |= IFF_DRV_RUNNING;
1171	sc->sc_flags |= UATH_FLAG_INITDONE;
1172
1173	callout_reset(&sc->watchdog_ch, hz, uath_watchdog, sc);
1174
1175	return (0);
1176
1177fail:
1178	uath_stop_locked(ifp);
1179	return (error);
1180}
1181
1182static void
1183uath_init(void *arg)
1184{
1185	struct uath_softc *sc = arg;
1186
1187	UATH_LOCK(sc);
1188	(void)uath_init_locked(sc);
1189	UATH_UNLOCK(sc);
1190}
1191
1192static void
1193uath_stop_locked(struct ifnet *ifp)
1194{
1195	struct uath_softc *sc = ifp->if_softc;
1196
1197	UATH_ASSERT_LOCKED(sc);
1198
1199	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1200	sc->sc_flags &= ~UATH_FLAG_INITDONE;
1201
1202	callout_stop(&sc->stat_ch);
1203	callout_stop(&sc->watchdog_ch);
1204	sc->sc_tx_timer = 0;
1205	/* abort pending transmits  */
1206	uath_abort_xfers(sc);
1207	/* flush data & control requests into the target  */
1208	(void)uath_flush(sc);
1209	/* set a LED status to the disconnected.  */
1210	uath_set_ledstate(sc, 0);
1211	/* stop the target  */
1212	uath_cmd_write(sc, WDCMSG_TARGET_STOP, NULL, 0, 0);
1213}
1214
1215static void
1216uath_stop(struct ifnet *ifp)
1217{
1218	struct uath_softc *sc = ifp->if_softc;
1219
1220	UATH_LOCK(sc);
1221	uath_stop_locked(ifp);
1222	UATH_UNLOCK(sc);
1223}
1224
1225static int
1226uath_config(struct uath_softc *sc, uint32_t reg, uint32_t val)
1227{
1228	struct uath_write_mac write;
1229	int error;
1230
1231	write.reg = htobe32(reg);
1232	write.len = htobe32(0);	/* 0 = single write */
1233	*(uint32_t *)write.data = htobe32(val);
1234
1235	error = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
1236	    3 * sizeof (uint32_t), 0);
1237	if (error != 0) {
1238		device_printf(sc->sc_dev, "could not write register 0x%02x\n",
1239		    reg);
1240	}
1241	return (error);
1242}
1243
1244static int
1245uath_config_multi(struct uath_softc *sc, uint32_t reg, const void *data,
1246    int len)
1247{
1248	struct uath_write_mac write;
1249	int error;
1250
1251	write.reg = htobe32(reg);
1252	write.len = htobe32(len);
1253	bcopy(data, write.data, len);
1254
1255	/* properly handle the case where len is zero (reset) */
1256	error = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
1257	    (len == 0) ? sizeof (uint32_t) : 2 * sizeof (uint32_t) + len, 0);
1258	if (error != 0) {
1259		device_printf(sc->sc_dev,
1260		    "could not write %d bytes to register 0x%02x\n", len, reg);
1261	}
1262	return (error);
1263}
1264
1265static int
1266uath_switch_channel(struct uath_softc *sc, struct ieee80211_channel *c)
1267{
1268	int error;
1269
1270	UATH_ASSERT_LOCKED(sc);
1271
1272	/* set radio frequency */
1273	error = uath_set_chan(sc, c);
1274	if (error) {
1275		device_printf(sc->sc_dev,
1276		    "could not set channel, error %d\n", error);
1277		goto failed;
1278	}
1279	/* reset Tx rings */
1280	error = uath_reset_tx_queues(sc);
1281	if (error) {
1282		device_printf(sc->sc_dev,
1283		    "could not reset Tx queues, error %d\n", error);
1284		goto failed;
1285	}
1286	/* set Tx rings WME properties */
1287	error = uath_wme_init(sc);
1288	if (error) {
1289		device_printf(sc->sc_dev,
1290		    "could not init Tx queues, error %d\n", error);
1291		goto failed;
1292	}
1293	error = uath_set_ledstate(sc, 0);
1294	if (error) {
1295		device_printf(sc->sc_dev,
1296		    "could not set led state, error %d\n", error);
1297		goto failed;
1298	}
1299	error = uath_flush(sc);
1300	if (error) {
1301		device_printf(sc->sc_dev,
1302		    "could not flush pipes, error %d\n", error);
1303		goto failed;
1304	}
1305failed:
1306	return (error);
1307}
1308
1309static int
1310uath_set_rxfilter(struct uath_softc *sc, uint32_t bits, uint32_t op)
1311{
1312	struct uath_cmd_rx_filter rxfilter;
1313
1314	rxfilter.bits = htobe32(bits);
1315	rxfilter.op = htobe32(op);
1316
1317	DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
1318	    "setting Rx filter=0x%x flags=0x%x\n", bits, op);
1319	return uath_cmd_write(sc, WDCMSG_RX_FILTER, &rxfilter,
1320	    sizeof rxfilter, 0);
1321}
1322
1323static void
1324uath_watchdog(void *arg)
1325{
1326	struct uath_softc *sc = arg;
1327	struct ifnet *ifp = sc->sc_ifp;
1328
1329	if (sc->sc_tx_timer > 0) {
1330		if (--sc->sc_tx_timer == 0) {
1331			device_printf(sc->sc_dev, "device timeout\n");
1332			/*uath_init(ifp); XXX needs a process context! */
1333			ifp->if_oerrors++;
1334			return;
1335		}
1336		callout_reset(&sc->watchdog_ch, hz, uath_watchdog, sc);
1337	}
1338}
1339
1340static void
1341uath_abort_xfers(struct uath_softc *sc)
1342{
1343	int i;
1344
1345	UATH_ASSERT_LOCKED(sc);
1346	/* abort any pending transfers */
1347	for (i = 0; i < UATH_N_XFERS; i++)
1348		usbd_transfer_stop(sc->sc_xfer[i]);
1349}
1350
1351static int
1352uath_flush(struct uath_softc *sc)
1353{
1354	int error;
1355
1356	error = uath_dataflush(sc);
1357	if (error != 0)
1358		goto failed;
1359
1360	error = uath_cmdflush(sc);
1361	if (error != 0)
1362		goto failed;
1363
1364failed:
1365	return (error);
1366}
1367
1368static int
1369uath_cmdflush(struct uath_softc *sc)
1370{
1371
1372	return uath_cmd_write(sc, WDCMSG_FLUSH, NULL, 0, 0);
1373}
1374
1375static int
1376uath_dataflush(struct uath_softc *sc)
1377{
1378	struct uath_data *data;
1379	struct uath_chunk *chunk;
1380	struct uath_tx_desc *desc;
1381
1382	UATH_ASSERT_LOCKED(sc);
1383
1384	data = uath_getbuf(sc);
1385	if (data == NULL)
1386		return (ENOBUFS);
1387	data->buflen = sizeof(struct uath_chunk) + sizeof(struct uath_tx_desc);
1388	data->m = NULL;
1389	data->ni = NULL;
1390	chunk = (struct uath_chunk *)data->buf;
1391	desc = (struct uath_tx_desc *)(chunk + 1);
1392
1393	/* one chunk only */
1394	chunk->seqnum = 0;
1395	chunk->flags = UATH_CFLAGS_FINAL;
1396	chunk->length = htobe16(sizeof (struct uath_tx_desc));
1397
1398	memset(desc, 0, sizeof(struct uath_tx_desc));
1399	desc->msglen = htobe32(sizeof(struct uath_tx_desc));
1400	desc->msgid  = (sc->sc_msgid++) + 1; /* don't care about endianness */
1401	desc->type   = htobe32(WDCMSG_FLUSH);
1402	desc->txqid  = htobe32(0);
1403	desc->connid = htobe32(0);
1404	desc->flags  = htobe32(0);
1405
1406#ifdef UATH_DEBUG
1407	if (sc->sc_debug & UATH_DEBUG_CMDS) {
1408		DPRINTF(sc, UATH_DEBUG_RESET, "send flush ix %d\n",
1409		    desc->msgid);
1410		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
1411			uath_dump_cmd(data->buf, data->buflen, '+');
1412	}
1413#endif
1414
1415	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1416	UATH_STAT_INC(sc, st_tx_pending);
1417	sc->sc_tx_timer = 5;
1418	usbd_transfer_start(sc->sc_xfer[UATH_BULK_TX]);
1419
1420	return (0);
1421}
1422
1423static struct uath_data *
1424_uath_getbuf(struct uath_softc *sc)
1425{
1426	struct uath_data *bf;
1427
1428	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1429	if (bf != NULL) {
1430		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1431		UATH_STAT_DEC(sc, st_tx_inactive);
1432	} else
1433		bf = NULL;
1434	if (bf == NULL)
1435		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: %s\n", __func__,
1436		    "out of xmit buffers");
1437	return (bf);
1438}
1439
1440static struct uath_data *
1441uath_getbuf(struct uath_softc *sc)
1442{
1443	struct uath_data *bf;
1444
1445	UATH_ASSERT_LOCKED(sc);
1446
1447	bf = _uath_getbuf(sc);
1448	if (bf == NULL) {
1449		struct ifnet *ifp = sc->sc_ifp;
1450
1451		DPRINTF(sc, UATH_DEBUG_XMIT, "%s: stop queue\n", __func__);
1452		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1453	}
1454	return (bf);
1455}
1456
1457static int
1458uath_set_ledstate(struct uath_softc *sc, int connected)
1459{
1460
1461	DPRINTF(sc, UATH_DEBUG_LED,
1462	    "set led state %sconnected\n", connected ? "" : "!");
1463	connected = htobe32(connected);
1464	return uath_cmd_write(sc, WDCMSG_SET_LED_STATE,
1465	     &connected, sizeof connected, 0);
1466}
1467
1468static int
1469uath_set_chan(struct uath_softc *sc, struct ieee80211_channel *c)
1470{
1471#ifdef UATH_DEBUG
1472	struct ifnet *ifp = sc->sc_ifp;
1473	struct ieee80211com *ic = ifp->if_l2com;
1474#endif
1475	struct uath_cmd_reset reset;
1476
1477	memset(&reset, 0, sizeof(reset));
1478	if (IEEE80211_IS_CHAN_2GHZ(c))
1479		reset.flags |= htobe32(UATH_CHAN_2GHZ);
1480	if (IEEE80211_IS_CHAN_5GHZ(c))
1481		reset.flags |= htobe32(UATH_CHAN_5GHZ);
1482	/* NB: 11g =>'s 11b so don't specify both OFDM and CCK */
1483	if (IEEE80211_IS_CHAN_OFDM(c))
1484		reset.flags |= htobe32(UATH_CHAN_OFDM);
1485	else if (IEEE80211_IS_CHAN_CCK(c))
1486		reset.flags |= htobe32(UATH_CHAN_CCK);
1487	/* turbo can be used in either 2GHz or 5GHz */
1488	if (c->ic_flags & IEEE80211_CHAN_TURBO)
1489		reset.flags |= htobe32(UATH_CHAN_TURBO);
1490	reset.freq = htobe32(c->ic_freq);
1491	reset.maxrdpower = htobe32(50);	/* XXX */
1492	reset.channelchange = htobe32(1);
1493	reset.keeprccontent = htobe32(0);
1494
1495	DPRINTF(sc, UATH_DEBUG_CHANNEL, "set channel %d, flags 0x%x freq %u\n",
1496	    ieee80211_chan2ieee(ic, c),
1497	    be32toh(reset.flags), be32toh(reset.freq));
1498	return uath_cmd_write(sc, WDCMSG_RESET, &reset, sizeof reset, 0);
1499}
1500
1501static int
1502uath_reset_tx_queues(struct uath_softc *sc)
1503{
1504	int ac, error;
1505
1506	DPRINTF(sc, UATH_DEBUG_RESET, "%s: reset Tx queues\n", __func__);
1507	for (ac = 0; ac < 4; ac++) {
1508		const uint32_t qid = htobe32(ac);
1509
1510		error = uath_cmd_write(sc, WDCMSG_RELEASE_TX_QUEUE, &qid,
1511		    sizeof qid, 0);
1512		if (error != 0)
1513			break;
1514	}
1515	return (error);
1516}
1517
1518static int
1519uath_wme_init(struct uath_softc *sc)
1520{
1521	/* XXX get from net80211 */
1522	static const struct uath_wme_settings uath_wme_11g[4] = {
1523		{ 7, 4, 10,  0, 0 },	/* Background */
1524		{ 3, 4, 10,  0, 0 },	/* Best-Effort */
1525		{ 3, 3,  4, 26, 0 },	/* Video */
1526		{ 2, 2,  3, 47, 0 }	/* Voice */
1527	};
1528	struct uath_cmd_txq_setup qinfo;
1529	int ac, error;
1530
1531	DPRINTF(sc, UATH_DEBUG_WME, "%s: setup Tx queues\n", __func__);
1532	for (ac = 0; ac < 4; ac++) {
1533		qinfo.qid		= htobe32(ac);
1534		qinfo.len		= htobe32(sizeof(qinfo.attr));
1535		qinfo.attr.priority	= htobe32(ac);	/* XXX */
1536		qinfo.attr.aifs		= htobe32(uath_wme_11g[ac].aifsn);
1537		qinfo.attr.logcwmin	= htobe32(uath_wme_11g[ac].logcwmin);
1538		qinfo.attr.logcwmax	= htobe32(uath_wme_11g[ac].logcwmax);
1539		qinfo.attr.bursttime	= htobe32(UATH_TXOP_TO_US(
1540					    uath_wme_11g[ac].txop));
1541		qinfo.attr.mode		= htobe32(uath_wme_11g[ac].acm);/*XXX? */
1542		qinfo.attr.qflags	= htobe32(1);	/* XXX? */
1543
1544		error = uath_cmd_write(sc, WDCMSG_SETUP_TX_QUEUE, &qinfo,
1545		    sizeof qinfo, 0);
1546		if (error != 0)
1547			break;
1548	}
1549	return (error);
1550}
1551
1552static int
1553uath_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1554{
1555	struct ieee80211com *ic = ifp->if_l2com;
1556	struct ifreq *ifr = (struct ifreq *) data;
1557	struct uath_softc *sc = ifp->if_softc;
1558	int error;
1559	int startall = 0;
1560
1561	UATH_LOCK(sc);
1562	error = (sc->sc_flags & UATH_FLAG_INVALID) ? ENXIO : 0;
1563	UATH_UNLOCK(sc);
1564	if (error)
1565		return (error);
1566
1567	switch (cmd) {
1568	case SIOCSIFFLAGS:
1569		if (ifp->if_flags & IFF_UP) {
1570			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1571				uath_init(ifp->if_softc);
1572				startall = 1;
1573			}
1574		} else {
1575			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1576				uath_stop(ifp);
1577		}
1578		if (startall)
1579			ieee80211_start_all(ic);
1580		break;
1581	case SIOCGIFMEDIA:
1582		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1583		break;
1584	case SIOCGIFADDR:
1585		error = ether_ioctl(ifp, cmd, data);
1586		break;
1587	default:
1588		error = EINVAL;
1589		break;
1590	}
1591
1592	return (error);
1593}
1594
1595static int
1596uath_tx_start(struct uath_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1597    struct uath_data *data)
1598{
1599	struct ieee80211vap *vap = ni->ni_vap;
1600	struct uath_chunk *chunk;
1601	struct uath_tx_desc *desc;
1602	const struct ieee80211_frame *wh;
1603	struct ieee80211_key *k;
1604	int framelen, msglen;
1605
1606	UATH_ASSERT_LOCKED(sc);
1607
1608	data->ni = ni;
1609	data->m = m0;
1610	chunk = (struct uath_chunk *)data->buf;
1611	desc = (struct uath_tx_desc *)(chunk + 1);
1612
1613	if (ieee80211_radiotap_active_vap(vap)) {
1614		struct uath_tx_radiotap_header *tap = &sc->sc_txtap;
1615
1616		tap->wt_flags = 0;
1617		if (m0->m_flags & M_FRAG)
1618			tap->wt_flags |= IEEE80211_RADIOTAP_F_FRAG;
1619
1620		ieee80211_radiotap_tx(vap, m0);
1621	}
1622
1623	wh = mtod(m0, struct ieee80211_frame *);
1624	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1625		k = ieee80211_crypto_encap(ni, m0);
1626		if (k == NULL) {
1627			m_freem(m0);
1628			return (ENOBUFS);
1629		}
1630
1631		/* packet header may have moved, reset our local pointer */
1632		wh = mtod(m0, struct ieee80211_frame *);
1633	}
1634	m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(desc + 1));
1635
1636	framelen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1637	msglen = framelen + sizeof (struct uath_tx_desc);
1638	data->buflen = msglen + sizeof (struct uath_chunk);
1639
1640	/* one chunk only for now */
1641	chunk->seqnum = sc->sc_seqnum++;
1642	chunk->flags = (m0->m_flags & M_FRAG) ? 0 : UATH_CFLAGS_FINAL;
1643	if (m0->m_flags & M_LASTFRAG)
1644		chunk->flags |= UATH_CFLAGS_FINAL;
1645	chunk->flags = UATH_CFLAGS_FINAL;
1646	chunk->length = htobe16(msglen);
1647
1648	/* fill Tx descriptor */
1649	desc->msglen = htobe32(msglen);
1650	/* NB: to get UATH_TX_NOTIFY reply, `msgid' must be larger than 0  */
1651	desc->msgid  = (sc->sc_msgid++) + 1; /* don't care about endianness */
1652	desc->type   = htobe32(WDCMSG_SEND);
1653	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1654	case IEEE80211_FC0_TYPE_CTL:
1655	case IEEE80211_FC0_TYPE_MGT:
1656		/* NB: force all management frames to highest queue */
1657		if (ni->ni_flags & IEEE80211_NODE_QOS) {
1658			/* NB: force all management frames to highest queue */
1659			desc->txqid = htobe32(WME_AC_VO | UATH_TXQID_MINRATE);
1660		} else
1661			desc->txqid = htobe32(WME_AC_BE | UATH_TXQID_MINRATE);
1662		break;
1663	case IEEE80211_FC0_TYPE_DATA:
1664		/* XXX multicast frames should honor mcastrate */
1665		desc->txqid = htobe32(M_WME_GETAC(m0));
1666		break;
1667	default:
1668		device_printf(sc->sc_dev, "bogus frame type 0x%x (%s)\n",
1669			wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, __func__);
1670		m_freem(m0);
1671		return (EIO);
1672	}
1673	if (vap->iv_state == IEEE80211_S_AUTH ||
1674	    vap->iv_state == IEEE80211_S_ASSOC ||
1675	    vap->iv_state == IEEE80211_S_RUN)
1676		desc->connid = htobe32(UATH_ID_BSS);
1677	else
1678		desc->connid = htobe32(UATH_ID_INVALID);
1679	desc->flags  = htobe32(0 /* no UATH_TX_NOTIFY */);
1680	desc->buflen = htobe32(m0->m_pkthdr.len);
1681
1682#ifdef UATH_DEBUG
1683	DPRINTF(sc, UATH_DEBUG_XMIT,
1684	    "send frame ix %u framelen %d msglen %d connid 0x%x txqid 0x%x\n",
1685	    desc->msgid, framelen, msglen, be32toh(desc->connid),
1686	    be32toh(desc->txqid));
1687	if (sc->sc_debug & UATH_DEBUG_XMIT_DUMP)
1688		uath_dump_cmd(data->buf, data->buflen, '+');
1689#endif
1690
1691	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1692	UATH_STAT_INC(sc, st_tx_pending);
1693	usbd_transfer_start(sc->sc_xfer[UATH_BULK_TX]);
1694
1695	return (0);
1696}
1697
1698/*
1699 * Cleanup driver resources when we run out of buffers while processing
1700 * fragments; return the tx buffers allocated and drop node references.
1701 */
1702static void
1703uath_txfrag_cleanup(struct uath_softc *sc,
1704    uath_datahead *frags, struct ieee80211_node *ni)
1705{
1706	struct uath_data *bf, *next;
1707
1708	UATH_ASSERT_LOCKED(sc);
1709
1710	STAILQ_FOREACH_SAFE(bf, frags, next, next) {
1711		/* NB: bf assumed clean */
1712		STAILQ_REMOVE_HEAD(frags, next);
1713		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1714		UATH_STAT_INC(sc, st_tx_inactive);
1715		ieee80211_node_decref(ni);
1716	}
1717}
1718
1719/*
1720 * Setup xmit of a fragmented frame.  Allocate a buffer for each frag and bump
1721 * the node reference count to reflect the held reference to be setup by
1722 * uath_tx_start.
1723 */
1724static int
1725uath_txfrag_setup(struct uath_softc *sc, uath_datahead *frags,
1726    struct mbuf *m0, struct ieee80211_node *ni)
1727{
1728	struct mbuf *m;
1729	struct uath_data *bf;
1730
1731	UATH_ASSERT_LOCKED(sc);
1732	for (m = m0->m_nextpkt; m != NULL; m = m->m_nextpkt) {
1733		bf = uath_getbuf(sc);
1734		if (bf == NULL) {       /* out of buffers, cleanup */
1735			uath_txfrag_cleanup(sc, frags, ni);
1736			break;
1737		}
1738		ieee80211_node_incref(ni);
1739		STAILQ_INSERT_TAIL(frags, bf, next);
1740	}
1741
1742	return !STAILQ_EMPTY(frags);
1743}
1744
1745/*
1746 * Reclaim mbuf resources.  For fragmented frames we need to claim each frag
1747 * chained with m_nextpkt.
1748 */
1749static void
1750uath_freetx(struct mbuf *m)
1751{
1752	struct mbuf *next;
1753
1754	do {
1755		next = m->m_nextpkt;
1756		m->m_nextpkt = NULL;
1757		m_freem(m);
1758	} while ((m = next) != NULL);
1759}
1760
1761static void
1762uath_start(struct ifnet *ifp)
1763{
1764	struct uath_data *bf;
1765	struct uath_softc *sc = ifp->if_softc;
1766	struct ieee80211_node *ni;
1767	struct mbuf *m, *next;
1768	uath_datahead frags;
1769
1770	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
1771	    (sc->sc_flags & UATH_FLAG_INVALID))
1772		return;
1773
1774	UATH_LOCK(sc);
1775	for (;;) {
1776		bf = uath_getbuf(sc);
1777		if (bf == NULL)
1778			break;
1779
1780		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1781		if (m == NULL) {
1782			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1783			UATH_STAT_INC(sc, st_tx_inactive);
1784			break;
1785		}
1786		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1787		m->m_pkthdr.rcvif = NULL;
1788
1789		/*
1790		 * Check for fragmentation.  If this frame has been broken up
1791		 * verify we have enough buffers to send all the fragments
1792		 * so all go out or none...
1793		 */
1794		STAILQ_INIT(&frags);
1795		if ((m->m_flags & M_FRAG) &&
1796		    !uath_txfrag_setup(sc, &frags, m, ni)) {
1797			DPRINTF(sc, UATH_DEBUG_XMIT,
1798			    "%s: out of txfrag buffers\n", __func__);
1799			uath_freetx(m);
1800			goto bad;
1801		}
1802		sc->sc_seqnum = 0;
1803	nextfrag:
1804		/*
1805		 * Pass the frame to the h/w for transmission.
1806		 * Fragmented frames have each frag chained together
1807		 * with m_nextpkt.  We know there are sufficient uath_data's
1808		 * to send all the frags because of work done by
1809		 * uath_txfrag_setup.
1810		 */
1811		next = m->m_nextpkt;
1812		if (uath_tx_start(sc, m, ni, bf) != 0) {
1813	bad:
1814			ifp->if_oerrors++;
1815	reclaim:
1816			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1817			UATH_STAT_INC(sc, st_tx_inactive);
1818			uath_txfrag_cleanup(sc, &frags, ni);
1819			ieee80211_free_node(ni);
1820			continue;
1821		}
1822
1823		if (next != NULL) {
1824			/*
1825			 * Beware of state changing between frags.
1826			 XXX check sta power-save state?
1827			*/
1828			if (ni->ni_vap->iv_state != IEEE80211_S_RUN) {
1829				DPRINTF(sc, UATH_DEBUG_XMIT,
1830				    "%s: flush fragmented packet, state %s\n",
1831				    __func__,
1832				    ieee80211_state_name[ni->ni_vap->iv_state]);
1833				uath_freetx(next);
1834				goto reclaim;
1835			}
1836			m = next;
1837			bf = STAILQ_FIRST(&frags);
1838			KASSERT(bf != NULL, ("no buf for txfrag"));
1839			STAILQ_REMOVE_HEAD(&frags, next);
1840			goto nextfrag;
1841		}
1842
1843		sc->sc_tx_timer = 5;
1844	}
1845	UATH_UNLOCK(sc);
1846}
1847
1848static int
1849uath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1850    const struct ieee80211_bpf_params *params)
1851{
1852	struct ieee80211com *ic = ni->ni_ic;
1853	struct ifnet *ifp = ic->ic_ifp;
1854	struct uath_data *bf;
1855	struct uath_softc *sc = ifp->if_softc;
1856
1857	/* prevent management frames from being sent if we're not ready */
1858	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1859	    !(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1860		m_freem(m);
1861		ieee80211_free_node(ni);
1862		return (ENETDOWN);
1863	}
1864
1865	UATH_LOCK(sc);
1866	/* grab a TX buffer  */
1867	bf = uath_getbuf(sc);
1868	if (bf == NULL) {
1869		ieee80211_free_node(ni);
1870		m_freem(m);
1871		UATH_UNLOCK(sc);
1872		return (ENOBUFS);
1873	}
1874
1875	sc->sc_seqnum = 0;
1876	if (uath_tx_start(sc, m, ni, bf) != 0) {
1877		ieee80211_free_node(ni);
1878		ifp->if_oerrors++;
1879		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1880		UATH_STAT_INC(sc, st_tx_inactive);
1881		UATH_UNLOCK(sc);
1882		return (EIO);
1883	}
1884	UATH_UNLOCK(sc);
1885
1886	sc->sc_tx_timer = 5;
1887	return (0);
1888}
1889
1890static void
1891uath_scan_start(struct ieee80211com *ic)
1892{
1893	/* do nothing  */
1894}
1895
1896static void
1897uath_scan_end(struct ieee80211com *ic)
1898{
1899	/* do nothing  */
1900}
1901
1902static void
1903uath_set_channel(struct ieee80211com *ic)
1904{
1905	struct ifnet *ifp = ic->ic_ifp;
1906	struct uath_softc *sc = ifp->if_softc;
1907
1908	UATH_LOCK(sc);
1909	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1910	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1911		UATH_UNLOCK(sc);
1912		return;
1913	}
1914	(void)uath_switch_channel(sc, ic->ic_curchan);
1915	UATH_UNLOCK(sc);
1916}
1917
1918static int
1919uath_set_rxmulti_filter(struct uath_softc *sc)
1920{
1921	/* XXX broken */
1922	return (0);
1923}
1924static void
1925uath_update_mcast(struct ifnet *ifp)
1926{
1927	struct uath_softc *sc = ifp->if_softc;
1928
1929	UATH_LOCK(sc);
1930	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1931	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1932		UATH_UNLOCK(sc);
1933		return;
1934	}
1935	/*
1936	 * this is for avoiding the race condition when we're try to
1937	 * connect to the AP with WPA.
1938	 */
1939	if (sc->sc_flags & UATH_FLAG_INITDONE)
1940		(void)uath_set_rxmulti_filter(sc);
1941	UATH_UNLOCK(sc);
1942}
1943
1944static void
1945uath_update_promisc(struct ifnet *ifp)
1946{
1947	struct uath_softc *sc = ifp->if_softc;
1948
1949	UATH_LOCK(sc);
1950	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
1951	    (ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1952		UATH_UNLOCK(sc);
1953		return;
1954	}
1955	if (sc->sc_flags & UATH_FLAG_INITDONE) {
1956		uath_set_rxfilter(sc,
1957		    UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
1958		    UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON |
1959		    UATH_FILTER_RX_PROM, UATH_FILTER_OP_SET);
1960	}
1961	UATH_UNLOCK(sc);
1962}
1963
1964static int
1965uath_create_connection(struct uath_softc *sc, uint32_t connid)
1966{
1967	const struct ieee80211_rateset *rs;
1968	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1969	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1970	struct ieee80211_node *ni;
1971	struct uath_cmd_create_connection create;
1972
1973	ni = ieee80211_ref_node(vap->iv_bss);
1974	memset(&create, 0, sizeof(create));
1975	create.connid = htobe32(connid);
1976	create.bssid = htobe32(0);
1977	/* XXX packed or not?  */
1978	create.size = htobe32(sizeof(struct uath_cmd_rateset));
1979
1980	rs = &ni->ni_rates;
1981	create.connattr.rateset.length = rs->rs_nrates;
1982	bcopy(rs->rs_rates, &create.connattr.rateset.set[0],
1983	    rs->rs_nrates);
1984
1985	/* XXX turbo */
1986	if (IEEE80211_IS_CHAN_A(ni->ni_chan))
1987		create.connattr.wlanmode = htobe32(WLAN_MODE_11a);
1988	else if (IEEE80211_IS_CHAN_ANYG(ni->ni_chan))
1989		create.connattr.wlanmode = htobe32(WLAN_MODE_11g);
1990	else
1991		create.connattr.wlanmode = htobe32(WLAN_MODE_11b);
1992	ieee80211_free_node(ni);
1993
1994	return uath_cmd_write(sc, WDCMSG_CREATE_CONNECTION, &create,
1995	    sizeof create, 0);
1996}
1997
1998static int
1999uath_set_rates(struct uath_softc *sc, const struct ieee80211_rateset *rs)
2000{
2001	struct uath_cmd_rates rates;
2002
2003	memset(&rates, 0, sizeof(rates));
2004	rates.connid = htobe32(UATH_ID_BSS);		/* XXX */
2005	rates.size   = htobe32(sizeof(struct uath_cmd_rateset));
2006	/* XXX bounds check rs->rs_nrates */
2007	rates.rateset.length = rs->rs_nrates;
2008	bcopy(rs->rs_rates, &rates.rateset.set[0], rs->rs_nrates);
2009
2010	DPRINTF(sc, UATH_DEBUG_RATES,
2011	    "setting supported rates nrates=%d\n", rs->rs_nrates);
2012	return uath_cmd_write(sc, WDCMSG_SET_BASIC_RATE,
2013	    &rates, sizeof rates, 0);
2014}
2015
2016static int
2017uath_write_associd(struct uath_softc *sc)
2018{
2019	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2020	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2021	struct ieee80211_node *ni;
2022	struct uath_cmd_set_associd associd;
2023
2024	ni = ieee80211_ref_node(vap->iv_bss);
2025	memset(&associd, 0, sizeof(associd));
2026	associd.defaultrateix = htobe32(1);	/* XXX */
2027	associd.associd = htobe32(ni->ni_associd);
2028	associd.timoffset = htobe32(0x3b);	/* XXX */
2029	IEEE80211_ADDR_COPY(associd.bssid, ni->ni_bssid);
2030	ieee80211_free_node(ni);
2031	return uath_cmd_write(sc, WDCMSG_WRITE_ASSOCID, &associd,
2032	    sizeof associd, 0);
2033}
2034
2035static int
2036uath_set_ledsteady(struct uath_softc *sc, int lednum, int ledmode)
2037{
2038	struct uath_cmd_ledsteady led;
2039
2040	led.lednum = htobe32(lednum);
2041	led.ledmode = htobe32(ledmode);
2042
2043	DPRINTF(sc, UATH_DEBUG_LED, "set %s led %s (steady)\n",
2044	    (lednum == UATH_LED_LINK) ? "link" : "activity",
2045	    ledmode ? "on" : "off");
2046	return uath_cmd_write(sc, WDCMSG_SET_LED_STEADY, &led, sizeof led, 0);
2047}
2048
2049static int
2050uath_set_ledblink(struct uath_softc *sc, int lednum, int ledmode,
2051	int blinkrate, int slowmode)
2052{
2053	struct uath_cmd_ledblink led;
2054
2055	led.lednum = htobe32(lednum);
2056	led.ledmode = htobe32(ledmode);
2057	led.blinkrate = htobe32(blinkrate);
2058	led.slowmode = htobe32(slowmode);
2059
2060	DPRINTF(sc, UATH_DEBUG_LED, "set %s led %s (blink)\n",
2061	    (lednum == UATH_LED_LINK) ? "link" : "activity",
2062	    ledmode ? "on" : "off");
2063	return uath_cmd_write(sc, WDCMSG_SET_LED_BLINK, &led, sizeof led, 0);
2064}
2065
2066static int
2067uath_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2068{
2069	enum ieee80211_state ostate = vap->iv_state;
2070	int error;
2071	struct ieee80211_node *ni;
2072	struct ieee80211com *ic = vap->iv_ic;
2073	struct uath_softc *sc = ic->ic_ifp->if_softc;
2074	struct uath_vap *uvp = UATH_VAP(vap);
2075
2076	DPRINTF(sc, UATH_DEBUG_STATE,
2077	    "%s: %s -> %s\n", __func__, ieee80211_state_name[vap->iv_state],
2078	    ieee80211_state_name[nstate]);
2079
2080	IEEE80211_UNLOCK(ic);
2081	UATH_LOCK(sc);
2082	callout_stop(&sc->stat_ch);
2083	callout_stop(&sc->watchdog_ch);
2084	ni = ieee80211_ref_node(vap->iv_bss);
2085
2086	switch (nstate) {
2087	case IEEE80211_S_INIT:
2088		if (ostate == IEEE80211_S_RUN) {
2089			/* turn link and activity LEDs off */
2090			uath_set_ledstate(sc, 0);
2091		}
2092		break;
2093
2094	case IEEE80211_S_SCAN:
2095		break;
2096
2097	case IEEE80211_S_AUTH:
2098		/* XXX good place?  set RTS threshold  */
2099		uath_config(sc, CFG_USER_RTS_THRESHOLD, vap->iv_rtsthreshold);
2100		/* XXX bad place  */
2101		error = uath_set_keys(sc, vap);
2102		if (error != 0) {
2103			device_printf(sc->sc_dev,
2104			    "could not set crypto keys, error %d\n", error);
2105			break;
2106		}
2107		if (uath_switch_channel(sc, ni->ni_chan) != 0) {
2108			device_printf(sc->sc_dev, "could not switch channel\n");
2109			break;
2110		}
2111		if (uath_create_connection(sc, UATH_ID_BSS) != 0) {
2112			device_printf(sc->sc_dev,
2113			    "could not create connection\n");
2114			break;
2115		}
2116		break;
2117
2118	case IEEE80211_S_ASSOC:
2119		if (uath_set_rates(sc, &ni->ni_rates) != 0) {
2120			device_printf(sc->sc_dev,
2121			    "could not set negotiated rate set\n");
2122			break;
2123		}
2124		break;
2125
2126	case IEEE80211_S_RUN:
2127		/* XXX monitor mode doesn't be tested  */
2128		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2129			uath_set_ledstate(sc, 1);
2130			break;
2131		}
2132
2133		/*
2134		 * Tx rate is controlled by firmware, report the maximum
2135		 * negotiated rate in ifconfig output.
2136		 */
2137		ni->ni_txrate = ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
2138
2139		if (uath_write_associd(sc) != 0) {
2140			device_printf(sc->sc_dev,
2141			    "could not write association id\n");
2142			break;
2143		}
2144		/* turn link LED on */
2145		uath_set_ledsteady(sc, UATH_LED_LINK, UATH_LED_ON);
2146		/* make activity LED blink */
2147		uath_set_ledblink(sc, UATH_LED_ACTIVITY, UATH_LED_ON, 1, 2);
2148		/* set state to associated */
2149		uath_set_ledstate(sc, 1);
2150
2151		/* start statistics timer */
2152		callout_reset(&sc->stat_ch, hz, uath_stat, sc);
2153		break;
2154	default:
2155		break;
2156	}
2157	ieee80211_free_node(ni);
2158	UATH_UNLOCK(sc);
2159	IEEE80211_LOCK(ic);
2160	return (uvp->newstate(vap, nstate, arg));
2161}
2162
2163static int
2164uath_set_key(struct uath_softc *sc, const struct ieee80211_key *wk,
2165    int index)
2166{
2167#if 0
2168	struct uath_cmd_crypto crypto;
2169	int i;
2170
2171	memset(&crypto, 0, sizeof(crypto));
2172	crypto.keyidx = htobe32(index);
2173	crypto.magic1 = htobe32(1);
2174	crypto.size   = htobe32(368);
2175	crypto.mask   = htobe32(0xffff);
2176	crypto.flags  = htobe32(0x80000068);
2177	if (index != UATH_DEFAULT_KEY)
2178		crypto.flags |= htobe32(index << 16);
2179	memset(crypto.magic2, 0xff, sizeof(crypto.magic2));
2180
2181	/*
2182	 * Each byte of the key must be XOR'ed with 10101010 before being
2183	 * transmitted to the firmware.
2184	 */
2185	for (i = 0; i < wk->wk_keylen; i++)
2186		crypto.key[i] = wk->wk_key[i] ^ 0xaa;
2187
2188	DPRINTF(sc, UATH_DEBUG_CRYPTO,
2189	    "setting crypto key index=%d len=%d\n", index, wk->wk_keylen);
2190	return uath_cmd_write(sc, WDCMSG_SET_KEY_CACHE_ENTRY, &crypto,
2191	    sizeof crypto, 0);
2192#else
2193	/* XXX support H/W cryto  */
2194	return (0);
2195#endif
2196}
2197
2198static int
2199uath_set_keys(struct uath_softc *sc, struct ieee80211vap *vap)
2200{
2201	int i, error;
2202
2203	error = 0;
2204	for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2205		const struct ieee80211_key *wk = &vap->iv_nw_keys[i];
2206
2207		if (wk->wk_flags & (IEEE80211_KEY_XMIT|IEEE80211_KEY_RECV)) {
2208			error = uath_set_key(sc, wk, i);
2209			if (error)
2210				return (error);
2211		}
2212	}
2213	if (vap->iv_def_txkey != IEEE80211_KEYIX_NONE) {
2214		error = uath_set_key(sc, &vap->iv_nw_keys[vap->iv_def_txkey],
2215			UATH_DEFAULT_KEY);
2216	}
2217	return (error);
2218}
2219
2220#define	UATH_SYSCTL_STAT_ADD32(c, h, n, p, d)	\
2221	    SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
2222
2223static void
2224uath_sysctl_node(struct uath_softc *sc)
2225{
2226	struct sysctl_ctx_list *ctx;
2227	struct sysctl_oid_list *child;
2228	struct sysctl_oid *tree;
2229	struct uath_stat *stats;
2230
2231	stats = &sc->sc_stat;
2232	ctx = device_get_sysctl_ctx(sc->sc_dev);
2233	child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
2234
2235	tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
2236	    NULL, "UATH statistics");
2237	child = SYSCTL_CHILDREN(tree);
2238	UATH_SYSCTL_STAT_ADD32(ctx, child, "badchunkseqnum",
2239	    &stats->st_badchunkseqnum, "Bad chunk sequence numbers");
2240	UATH_SYSCTL_STAT_ADD32(ctx, child, "invalidlen", &stats->st_invalidlen,
2241	    "Invalid length");
2242	UATH_SYSCTL_STAT_ADD32(ctx, child, "multichunk", &stats->st_multichunk,
2243	    "Multi chunks");
2244	UATH_SYSCTL_STAT_ADD32(ctx, child, "toobigrxpkt",
2245	    &stats->st_toobigrxpkt, "Too big rx packets");
2246	UATH_SYSCTL_STAT_ADD32(ctx, child, "stopinprogress",
2247	    &stats->st_stopinprogress, "Stop in progress");
2248	UATH_SYSCTL_STAT_ADD32(ctx, child, "crcerrs", &stats->st_crcerr,
2249	    "CRC errors");
2250	UATH_SYSCTL_STAT_ADD32(ctx, child, "phyerr", &stats->st_phyerr,
2251	    "PHY errors");
2252	UATH_SYSCTL_STAT_ADD32(ctx, child, "decrypt_crcerr",
2253	    &stats->st_decrypt_crcerr, "Decryption CRC errors");
2254	UATH_SYSCTL_STAT_ADD32(ctx, child, "decrypt_micerr",
2255	    &stats->st_decrypt_micerr, "Decryption Misc errors");
2256	UATH_SYSCTL_STAT_ADD32(ctx, child, "decomperr", &stats->st_decomperr,
2257	    "Decomp errors");
2258	UATH_SYSCTL_STAT_ADD32(ctx, child, "keyerr", &stats->st_keyerr,
2259	    "Key errors");
2260	UATH_SYSCTL_STAT_ADD32(ctx, child, "err", &stats->st_err,
2261	    "Unknown errors");
2262
2263	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_active",
2264	    &stats->st_cmd_active, "Active numbers in Command queue");
2265	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_inactive",
2266	    &stats->st_cmd_inactive, "Inactive numbers in Command queue");
2267	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_pending",
2268	    &stats->st_cmd_pending, "Pending numbers in Command queue");
2269	UATH_SYSCTL_STAT_ADD32(ctx, child, "cmd_waiting",
2270	    &stats->st_cmd_waiting, "Waiting numbers in Command queue");
2271	UATH_SYSCTL_STAT_ADD32(ctx, child, "rx_active",
2272	    &stats->st_rx_active, "Active numbers in RX queue");
2273	UATH_SYSCTL_STAT_ADD32(ctx, child, "rx_inactive",
2274	    &stats->st_rx_inactive, "Inactive numbers in RX queue");
2275	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_active",
2276	    &stats->st_tx_active, "Active numbers in TX queue");
2277	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_inactive",
2278	    &stats->st_tx_inactive, "Inactive numbers in TX queue");
2279	UATH_SYSCTL_STAT_ADD32(ctx, child, "tx_pending",
2280	    &stats->st_tx_pending, "Pending numbers in TX queue");
2281}
2282
2283#undef UATH_SYSCTL_STAT_ADD32
2284
2285static void
2286uath_cmdeof(struct uath_softc *sc, struct uath_cmd *cmd)
2287{
2288	struct uath_cmd_hdr *hdr;
2289	int dlen;
2290
2291	hdr = (struct uath_cmd_hdr *)cmd->buf;
2292	/* NB: msgid is passed thru w/o byte swapping */
2293#ifdef UATH_DEBUG
2294	if (sc->sc_debug & UATH_DEBUG_CMDS) {
2295		int len = be32toh(hdr->len);
2296		printf("%s: %s [ix %u] len %u status %u\n",
2297		    __func__, uath_codename(be32toh(hdr->code)),
2298		    hdr->msgid, len, be32toh(hdr->magic));
2299		if (sc->sc_debug & UATH_DEBUG_CMDS_DUMP)
2300			uath_dump_cmd(cmd->buf,
2301			    len > UATH_MAX_CMDSZ ? sizeof(*hdr) : len, '-');
2302	}
2303#endif
2304	hdr->code = be32toh(hdr->code);
2305	hdr->len = be32toh(hdr->len);
2306	hdr->magic = be32toh(hdr->magic);	/* target status on return */
2307
2308	switch (hdr->code & 0xff) {
2309	/* reply to a read command */
2310	default:
2311		dlen = hdr->len - sizeof(*hdr);
2312		if (dlen < 0) {
2313			device_printf(sc->sc_dev,
2314			    "Invalid header length %d\n", dlen);
2315			return;
2316		}
2317		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2318		    "%s: code %d data len %u\n",
2319		    __func__, hdr->code & 0xff, dlen);
2320		/*
2321		 * The first response from the target after the
2322		 * HOST_AVAILABLE has an invalid msgid so we must
2323		 * treat it specially.
2324		 */
2325		if (hdr->msgid < UATH_CMD_LIST_COUNT) {
2326			uint32_t *rp = (uint32_t *)(hdr+1);
2327			u_int olen;
2328
2329			if (!(sizeof(*hdr) <= hdr->len &&
2330			      hdr->len < UATH_MAX_CMDSZ)) {
2331				device_printf(sc->sc_dev,
2332				    "%s: invalid WDC msg length %u; "
2333				    "msg ignored\n", __func__, hdr->len);
2334				return;
2335			}
2336			/*
2337			 * Calculate return/receive payload size; the
2338			 * first word, if present, always gives the
2339			 * number of bytes--unless it's 0 in which
2340			 * case a single 32-bit word should be present.
2341			 */
2342			if (dlen >= (int)sizeof(uint32_t)) {
2343				olen = be32toh(rp[0]);
2344				dlen -= sizeof(uint32_t);
2345				if (olen == 0) {
2346					/* convention is 0 =>'s one word */
2347					olen = sizeof(uint32_t);
2348					/* XXX KASSERT(olen == dlen ) */
2349				}
2350			} else
2351				olen = 0;
2352			if (cmd->odata != NULL) {
2353				/* NB: cmd->olen validated in uath_cmd */
2354				if (olen > (u_int)cmd->olen) {
2355					/* XXX complain? */
2356					device_printf(sc->sc_dev,
2357					    "%s: cmd 0x%x olen %u cmd olen %u\n",
2358					    __func__, hdr->code, olen,
2359					    cmd->olen);
2360					olen = cmd->olen;
2361				}
2362				if (olen > (u_int)dlen) {
2363					/* XXX complain, shouldn't happen */
2364					device_printf(sc->sc_dev,
2365					    "%s: cmd 0x%x olen %u dlen %u\n",
2366					    __func__, hdr->code, olen, dlen);
2367					olen = dlen;
2368				}
2369				/* XXX have submitter do this */
2370				/* copy answer into caller's supplied buffer */
2371				bcopy(&rp[1], cmd->odata, olen);
2372				cmd->olen = olen;
2373			}
2374		}
2375		wakeup_one(cmd);		/* wake up caller */
2376		break;
2377
2378	case WDCMSG_TARGET_START:
2379		if (hdr->msgid >= UATH_CMD_LIST_COUNT) {
2380			/* XXX */
2381			return;
2382		}
2383		dlen = hdr->len - sizeof(*hdr);
2384		if (dlen != (int)sizeof(uint32_t)) {
2385			/* XXX something wrong */
2386			return;
2387		}
2388		/* XXX have submitter do this */
2389		/* copy answer into caller's supplied buffer */
2390		bcopy(hdr+1, cmd->odata, sizeof(uint32_t));
2391		cmd->olen = sizeof(uint32_t);
2392		wakeup_one(cmd);		/* wake up caller */
2393		break;
2394
2395	case WDCMSG_SEND_COMPLETE:
2396		/* this notification is sent when UATH_TX_NOTIFY is set */
2397		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2398		    "%s: received Tx notification\n", __func__);
2399		break;
2400
2401	case WDCMSG_TARGET_GET_STATS:
2402		DPRINTF(sc, UATH_DEBUG_RX_PROC | UATH_DEBUG_RECV_ALL,
2403		    "%s: received device statistics\n", __func__);
2404		callout_reset(&sc->stat_ch, hz, uath_stat, sc);
2405		break;
2406	}
2407}
2408
2409static void
2410uath_intr_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2411{
2412	struct uath_softc *sc = usbd_xfer_softc(xfer);
2413	struct uath_cmd *cmd;
2414	struct usb_page_cache *pc;
2415	int actlen;
2416
2417	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2418
2419	UATH_ASSERT_LOCKED(sc);
2420
2421	switch (USB_GET_STATE(xfer)) {
2422	case USB_ST_TRANSFERRED:
2423		cmd = STAILQ_FIRST(&sc->sc_cmd_waiting);
2424		if (cmd == NULL)
2425			goto setup;
2426		STAILQ_REMOVE_HEAD(&sc->sc_cmd_waiting, next);
2427		UATH_STAT_DEC(sc, st_cmd_waiting);
2428		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next);
2429		UATH_STAT_INC(sc, st_cmd_inactive);
2430
2431		KASSERT(actlen >= (int)sizeof(struct uath_cmd_hdr),
2432		    ("short xfer error"));
2433		pc = usbd_xfer_get_frame(xfer, 0);
2434		usbd_copy_out(pc, 0, cmd->buf, actlen);
2435		uath_cmdeof(sc, cmd);
2436	case USB_ST_SETUP:
2437setup:
2438		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2439		usbd_transfer_submit(xfer);
2440		break;
2441	default:
2442		if (error != USB_ERR_CANCELLED) {
2443			usbd_xfer_set_stall(xfer);
2444			goto setup;
2445		}
2446		break;
2447	}
2448}
2449
2450static void
2451uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error)
2452{
2453	struct uath_softc *sc = usbd_xfer_softc(xfer);
2454	struct uath_cmd *cmd;
2455
2456	UATH_ASSERT_LOCKED(sc);
2457
2458	cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2459	if (cmd != NULL && USB_GET_STATE(xfer) != USB_ST_SETUP) {
2460		STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next);
2461		UATH_STAT_DEC(sc, st_cmd_active);
2462		STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_READ) ?
2463		    &sc->sc_cmd_waiting : &sc->sc_cmd_inactive, cmd, next);
2464		if (cmd->flags & UATH_CMD_FLAG_READ)
2465			UATH_STAT_INC(sc, st_cmd_waiting);
2466		else
2467			UATH_STAT_INC(sc, st_cmd_inactive);
2468	}
2469
2470	switch (USB_GET_STATE(xfer)) {
2471	case USB_ST_TRANSFERRED:
2472	case USB_ST_SETUP:
2473setup:
2474		cmd = STAILQ_FIRST(&sc->sc_cmd_pending);
2475		if (cmd == NULL) {
2476			DPRINTF(sc, UATH_DEBUG_XMIT, "%s: empty pending queue\n",
2477			    __func__);
2478			return;
2479		}
2480		STAILQ_REMOVE_HEAD(&sc->sc_cmd_pending, next);
2481		UATH_STAT_DEC(sc, st_cmd_pending);
2482		STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_ASYNC) ?
2483		    &sc->sc_cmd_inactive : &sc->sc_cmd_active, cmd, next);
2484		if (cmd->flags & UATH_CMD_FLAG_ASYNC)
2485			UATH_STAT_INC(sc, st_cmd_inactive);
2486		else
2487			UATH_STAT_INC(sc, st_cmd_active);
2488
2489		usbd_xfer_set_frame_data(xfer, 0, cmd->buf, cmd->buflen);
2490		usbd_transfer_submit(xfer);
2491		break;
2492	default:
2493		if (error != USB_ERR_CANCELLED) {
2494			usbd_xfer_set_stall(xfer);
2495			goto setup;
2496		}
2497		break;
2498	}
2499}
2500
2501static void
2502uath_update_rxstat(struct uath_softc *sc, uint32_t status)
2503{
2504
2505	switch (status) {
2506	case UATH_STATUS_STOP_IN_PROGRESS:
2507		UATH_STAT_INC(sc, st_stopinprogress);
2508		break;
2509	case UATH_STATUS_CRC_ERR:
2510		UATH_STAT_INC(sc, st_crcerr);
2511		break;
2512	case UATH_STATUS_PHY_ERR:
2513		UATH_STAT_INC(sc, st_phyerr);
2514		break;
2515	case UATH_STATUS_DECRYPT_CRC_ERR:
2516		UATH_STAT_INC(sc, st_decrypt_crcerr);
2517		break;
2518	case UATH_STATUS_DECRYPT_MIC_ERR:
2519		UATH_STAT_INC(sc, st_decrypt_micerr);
2520		break;
2521	case UATH_STATUS_DECOMP_ERR:
2522		UATH_STAT_INC(sc, st_decomperr);
2523		break;
2524	case UATH_STATUS_KEY_ERR:
2525		UATH_STAT_INC(sc, st_keyerr);
2526		break;
2527	case UATH_STATUS_ERR:
2528		UATH_STAT_INC(sc, st_err);
2529		break;
2530	default:
2531		break;
2532	}
2533}
2534
2535static struct mbuf *
2536uath_data_rxeof(struct usb_xfer *xfer, struct uath_data *data,
2537    struct uath_rx_desc **pdesc)
2538{
2539	struct uath_softc *sc = usbd_xfer_softc(xfer);
2540	struct ifnet *ifp = sc->sc_ifp;
2541	struct ieee80211com *ic = ifp->if_l2com;
2542	struct uath_chunk *chunk;
2543	struct uath_rx_desc *desc;
2544	struct mbuf *m = data->m, *mnew, *mp;
2545	uint16_t chunklen;
2546	int actlen;
2547
2548	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2549
2550	if (actlen < (int)UATH_MIN_RXBUFSZ) {
2551		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2552		    "%s: wrong xfer size (len=%d)\n", __func__, actlen);
2553		ifp->if_ierrors++;
2554		return (NULL);
2555	}
2556
2557	chunk = (struct uath_chunk *)data->buf;
2558	if (chunk->seqnum == 0 && chunk->flags == 0 && chunk->length == 0) {
2559		device_printf(sc->sc_dev, "%s: strange response\n", __func__);
2560		ifp->if_ierrors++;
2561		UATH_RESET_INTRX(sc);
2562		return (NULL);
2563	}
2564
2565	if (chunk->seqnum != sc->sc_intrx_nextnum) {
2566		DPRINTF(sc, UATH_DEBUG_XMIT, "invalid seqnum %d, expected %d\n",
2567		    chunk->seqnum, sc->sc_intrx_nextnum);
2568		UATH_STAT_INC(sc, st_badchunkseqnum);
2569		if (sc->sc_intrx_head != NULL)
2570			m_freem(sc->sc_intrx_head);
2571		UATH_RESET_INTRX(sc);
2572		return (NULL);
2573	}
2574
2575	/* check multi-chunk frames  */
2576	if ((chunk->seqnum == 0 && !(chunk->flags & UATH_CFLAGS_FINAL)) ||
2577	    (chunk->seqnum != 0 && (chunk->flags & UATH_CFLAGS_FINAL)) ||
2578	    chunk->flags & UATH_CFLAGS_RXMSG)
2579		UATH_STAT_INC(sc, st_multichunk);
2580
2581	chunklen = be16toh(chunk->length);
2582	if (chunk->flags & UATH_CFLAGS_FINAL)
2583		chunklen -= sizeof(struct uath_rx_desc);
2584
2585	if (chunklen > 0 &&
2586	    (!(chunk->flags & UATH_CFLAGS_FINAL) || !(chunk->seqnum == 0))) {
2587		/* we should use intermediate RX buffer  */
2588		if (chunk->seqnum == 0)
2589			UATH_RESET_INTRX(sc);
2590		if ((sc->sc_intrx_len + sizeof(struct uath_rx_desc) +
2591		    chunklen) > UATH_MAX_INTRX_SIZE) {
2592			UATH_STAT_INC(sc, st_invalidlen);
2593			ifp->if_iqdrops++;
2594			if (sc->sc_intrx_head != NULL)
2595				m_freem(sc->sc_intrx_head);
2596			UATH_RESET_INTRX(sc);
2597			return (NULL);
2598		}
2599
2600		m->m_len = chunklen;
2601		m->m_data += sizeof(struct uath_chunk);
2602
2603		if (sc->sc_intrx_head == NULL) {
2604			sc->sc_intrx_head = m;
2605			sc->sc_intrx_tail = m;
2606		} else {
2607			m->m_flags &= ~M_PKTHDR;
2608			sc->sc_intrx_tail->m_next = m;
2609			sc->sc_intrx_tail = m;
2610		}
2611	}
2612	sc->sc_intrx_len += chunklen;
2613
2614	mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
2615	if (mnew == NULL) {
2616		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2617		    "%s: can't get new mbuf, drop frame\n", __func__);
2618		ifp->if_ierrors++;
2619		if (sc->sc_intrx_head != NULL)
2620			m_freem(sc->sc_intrx_head);
2621		UATH_RESET_INTRX(sc);
2622		return (NULL);
2623	}
2624
2625	data->m = mnew;
2626	data->buf = mtod(mnew, uint8_t *);
2627
2628	/* if the frame is not final continue the transfer  */
2629	if (!(chunk->flags & UATH_CFLAGS_FINAL)) {
2630		sc->sc_intrx_nextnum++;
2631		UATH_RESET_INTRX(sc);
2632		return (NULL);
2633	}
2634
2635	/*
2636	 * if the frame is not set UATH_CFLAGS_RXMSG, then rx descriptor is
2637	 * located at the end, 32-bit aligned
2638	 */
2639	desc = (chunk->flags & UATH_CFLAGS_RXMSG) ?
2640		(struct uath_rx_desc *)(chunk + 1) :
2641		(struct uath_rx_desc *)(((uint8_t *)chunk) +
2642		    sizeof(struct uath_chunk) + be16toh(chunk->length) -
2643		    sizeof(struct uath_rx_desc));
2644	*pdesc = desc;
2645
2646	DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2647	    "%s: frame len %u code %u status %u rate %u antenna %u "
2648	    "rssi %d channel %u phyerror %u connix %u decrypterror %u "
2649	    "keycachemiss %u\n", __func__, be32toh(desc->framelen)
2650	    , be32toh(desc->code), be32toh(desc->status), be32toh(desc->rate)
2651	    , be32toh(desc->antenna), be32toh(desc->rssi), be32toh(desc->channel)
2652	    , be32toh(desc->phyerror), be32toh(desc->connix)
2653	    , be32toh(desc->decrypterror), be32toh(desc->keycachemiss));
2654
2655	if (be32toh(desc->len) > MCLBYTES) {
2656		DPRINTF(sc, UATH_DEBUG_RECV | UATH_DEBUG_RECV_ALL,
2657		    "%s: bad descriptor (len=%d)\n", __func__,
2658		    be32toh(desc->len));
2659		ifp->if_iqdrops++;
2660		UATH_STAT_INC(sc, st_toobigrxpkt);
2661		if (sc->sc_intrx_head != NULL)
2662			m_freem(sc->sc_intrx_head);
2663		UATH_RESET_INTRX(sc);
2664		return (NULL);
2665	}
2666
2667	uath_update_rxstat(sc, be32toh(desc->status));
2668
2669	/* finalize mbuf */
2670	if (sc->sc_intrx_head == NULL) {
2671		m->m_pkthdr.rcvif = ifp;
2672		m->m_pkthdr.len = m->m_len =
2673			be32toh(desc->framelen) - UATH_RX_DUMMYSIZE;
2674		m->m_data += sizeof(struct uath_chunk);
2675	} else {
2676		mp = sc->sc_intrx_head;
2677		mp->m_pkthdr.rcvif = ifp;
2678		mp->m_flags |= M_PKTHDR;
2679		mp->m_pkthdr.len = sc->sc_intrx_len;
2680		m = mp;
2681	}
2682
2683	/* there are a lot more fields in the RX descriptor */
2684	if ((sc->sc_flags & UATH_FLAG_INVALID) == 0 &&
2685	    ieee80211_radiotap_active(ic)) {
2686		struct uath_rx_radiotap_header *tap = &sc->sc_rxtap;
2687		uint32_t tsf_hi = be32toh(desc->tstamp_high);
2688		uint32_t tsf_lo = be32toh(desc->tstamp_low);
2689
2690		/* XXX only get low order 24bits of tsf from h/w */
2691		tap->wr_tsf = htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
2692		tap->wr_flags = 0;
2693		if (be32toh(desc->status) == UATH_STATUS_CRC_ERR)
2694			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2695		/* XXX map other status to BADFCS? */
2696		/* XXX ath h/w rate code, need to map */
2697		tap->wr_rate = be32toh(desc->rate);
2698		tap->wr_antenna = be32toh(desc->antenna);
2699		tap->wr_antsignal = -95 + be32toh(desc->rssi);
2700		tap->wr_antnoise = -95;
2701	}
2702
2703	ifp->if_ipackets++;
2704	UATH_RESET_INTRX(sc);
2705
2706	return (m);
2707}
2708
2709static void
2710uath_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2711{
2712	struct uath_softc *sc = usbd_xfer_softc(xfer);
2713	struct ifnet *ifp = sc->sc_ifp;
2714	struct ieee80211com *ic = ifp->if_l2com;
2715	struct ieee80211_frame *wh;
2716	struct ieee80211_node *ni;
2717	struct mbuf *m = NULL;
2718	struct uath_data *data;
2719	struct uath_rx_desc *desc = NULL;
2720	int8_t nf;
2721
2722	UATH_ASSERT_LOCKED(sc);
2723
2724	switch (USB_GET_STATE(xfer)) {
2725	case USB_ST_TRANSFERRED:
2726		data = STAILQ_FIRST(&sc->sc_rx_active);
2727		if (data == NULL)
2728			goto setup;
2729		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2730		UATH_STAT_DEC(sc, st_rx_active);
2731		m = uath_data_rxeof(xfer, data, &desc);
2732		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2733		UATH_STAT_INC(sc, st_rx_inactive);
2734		/* FALLTHROUGH */
2735	case USB_ST_SETUP:
2736setup:
2737		data = STAILQ_FIRST(&sc->sc_rx_inactive);
2738		if (data == NULL)
2739			return;
2740		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
2741		UATH_STAT_DEC(sc, st_rx_inactive);
2742		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
2743		UATH_STAT_INC(sc, st_rx_active);
2744		usbd_xfer_set_frame_data(xfer, 0, data->buf, MCLBYTES);
2745		usbd_transfer_submit(xfer);
2746
2747		/*
2748		 * To avoid LOR we should unlock our private mutex here to call
2749		 * ieee80211_input() because here is at the end of a USB
2750		 * callback and safe to unlock.
2751		 */
2752		if (sc->sc_flags & UATH_FLAG_INVALID) {
2753			if (m != NULL)
2754				m_freem(m);
2755			return;
2756		}
2757		UATH_UNLOCK(sc);
2758		if (m != NULL && desc != NULL) {
2759			wh = mtod(m, struct ieee80211_frame *);
2760			ni = ieee80211_find_rxnode(ic,
2761			    (struct ieee80211_frame_min *)wh);
2762			nf = -95;	/* XXX */
2763			if (ni != NULL) {
2764				(void) ieee80211_input(ni, m,
2765				    (int)be32toh(desc->rssi), nf);
2766				/* node is no longer needed */
2767				ieee80211_free_node(ni);
2768			} else
2769				(void) ieee80211_input_all(ic, m,
2770				    (int)be32toh(desc->rssi), nf);
2771			m = NULL;
2772			desc = NULL;
2773		}
2774		if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2775		    !IFQ_IS_EMPTY(&ifp->if_snd))
2776			uath_start(ifp);
2777		UATH_LOCK(sc);
2778		break;
2779	default:
2780		/* needs it to the inactive queue due to a error.  */
2781		data = STAILQ_FIRST(&sc->sc_rx_active);
2782		if (data != NULL) {
2783			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2784			UATH_STAT_DEC(sc, st_rx_active);
2785			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2786			UATH_STAT_INC(sc, st_rx_inactive);
2787		}
2788		if (error != USB_ERR_CANCELLED) {
2789			usbd_xfer_set_stall(xfer);
2790			ifp->if_ierrors++;
2791			goto setup;
2792		}
2793		break;
2794	}
2795}
2796
2797static void
2798uath_data_txeof(struct usb_xfer *xfer, struct uath_data *data)
2799{
2800	struct uath_softc *sc = usbd_xfer_softc(xfer);
2801	struct ifnet *ifp = sc->sc_ifp;
2802	struct mbuf *m;
2803
2804	UATH_ASSERT_LOCKED(sc);
2805
2806	/*
2807	 * Do any tx complete callback.  Note this must be done before releasing
2808	 * the node reference.
2809	 */
2810	if (data->m) {
2811		m = data->m;
2812		if (m->m_flags & M_TXCB &&
2813		    (sc->sc_flags & UATH_FLAG_INVALID) == 0) {
2814			/* XXX status? */
2815			ieee80211_process_callback(data->ni, m, 0);
2816		}
2817		m_freem(m);
2818		data->m = NULL;
2819	}
2820	if (data->ni) {
2821		if ((sc->sc_flags & UATH_FLAG_INVALID) == 0)
2822			ieee80211_free_node(data->ni);
2823		data->ni = NULL;
2824	}
2825	sc->sc_tx_timer = 0;
2826	ifp->if_opackets++;
2827	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2828}
2829
2830static void
2831uath_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
2832{
2833	struct uath_softc *sc = usbd_xfer_softc(xfer);
2834	struct ifnet *ifp = sc->sc_ifp;
2835	struct uath_data *data;
2836
2837	UATH_ASSERT_LOCKED(sc);
2838
2839	switch (USB_GET_STATE(xfer)) {
2840	case USB_ST_TRANSFERRED:
2841		data = STAILQ_FIRST(&sc->sc_tx_active);
2842		if (data == NULL)
2843			goto setup;
2844		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
2845		UATH_STAT_DEC(sc, st_tx_active);
2846		uath_data_txeof(xfer, data);
2847		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
2848		UATH_STAT_INC(sc, st_tx_inactive);
2849		/* FALLTHROUGH */
2850	case USB_ST_SETUP:
2851setup:
2852		data = STAILQ_FIRST(&sc->sc_tx_pending);
2853		if (data == NULL) {
2854			DPRINTF(sc, UATH_DEBUG_XMIT, "%s: empty pending queue\n",
2855			    __func__);
2856			return;
2857		}
2858		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
2859		UATH_STAT_DEC(sc, st_tx_pending);
2860		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
2861		UATH_STAT_INC(sc, st_tx_active);
2862
2863		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
2864		usbd_transfer_submit(xfer);
2865
2866		UATH_UNLOCK(sc);
2867		uath_start(ifp);
2868		UATH_LOCK(sc);
2869		break;
2870	default:
2871		data = STAILQ_FIRST(&sc->sc_tx_active);
2872		if (data == NULL)
2873			goto setup;
2874		if (data->ni != NULL) {
2875			if ((sc->sc_flags & UATH_FLAG_INVALID) == 0)
2876				ieee80211_free_node(data->ni);
2877			data->ni = NULL;
2878			ifp->if_oerrors++;
2879		}
2880		if (error != USB_ERR_CANCELLED) {
2881			usbd_xfer_set_stall(xfer);
2882			goto setup;
2883		}
2884		break;
2885	}
2886}
2887
2888static device_method_t uath_methods[] = {
2889	DEVMETHOD(device_probe, uath_match),
2890	DEVMETHOD(device_attach, uath_attach),
2891	DEVMETHOD(device_detach, uath_detach),
2892	DEVMETHOD_END
2893};
2894static driver_t uath_driver = {
2895	.name = "uath",
2896	.methods = uath_methods,
2897	.size = sizeof(struct uath_softc)
2898};
2899static devclass_t uath_devclass;
2900
2901DRIVER_MODULE(uath, uhub, uath_driver, uath_devclass, NULL, 0);
2902MODULE_DEPEND(uath, wlan, 1, 1, 1);
2903MODULE_DEPEND(uath, usb, 1, 1, 1);
2904MODULE_VERSION(uath, 1);
2905