if_otus.c revision 289781
1/*	$OpenBSD: if_otus.c,v 1.46 2015/03/14 03:38:49 jsg Exp $	*/
2
3/*-
4 * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2015 Adrian Chadd <adrian@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20/*
21 * Driver for Atheros AR9001U chipset.
22 */
23
24#include <sys/cdefs.h>
25__FBSDID("$FreeBSD: head/sys/dev/otus/if_otus.c 289781 2015-10-23 02:08:47Z adrian $");
26
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/endian.h>
31#include <sys/sockio.h>
32#include <sys/mbuf.h>
33#include <sys/kernel.h>
34#include <sys/socket.h>
35#include <sys/systm.h>
36#include <sys/conf.h>
37#include <sys/bus.h>
38#include <sys/rman.h>
39#include <sys/firmware.h>
40#include <sys/module.h>
41#include <sys/taskqueue.h>
42
43#include <machine/bus.h>
44#include <machine/resource.h>
45
46#include <net/bpf.h>
47#include <net/if.h>
48#include <net/if_var.h>
49#include <net/if_arp.h>
50#include <net/if_dl.h>
51#include <net/if_media.h>
52#include <net/if_types.h>
53
54#include <netinet/in.h>
55#include <netinet/in_systm.h>
56#include <netinet/in_var.h>
57#include <netinet/if_ether.h>
58#include <netinet/ip.h>
59
60#include <net80211/ieee80211_var.h>
61#include <net80211/ieee80211_regdomain.h>
62#include <net80211/ieee80211_radiotap.h>
63#include <net80211/ieee80211_ratectl.h>
64#include <net80211/ieee80211_input.h>
65#ifdef	IEEE80211_SUPPORT_SUPERG
66#include <net80211/ieee80211_superg.h>
67#endif
68
69#include <dev/usb/usb.h>
70#include <dev/usb/usbdi.h>
71#include "usbdevs.h"
72
73#define USB_DEBUG_VAR otus_debug
74#include <dev/usb/usb_debug.h>
75
76#include "if_otusreg.h"
77
78static int otus_debug = 0;
79static SYSCTL_NODE(_hw_usb, OID_AUTO, otus, CTLFLAG_RW, 0, "USB otus");
80SYSCTL_INT(_hw_usb_otus, OID_AUTO, debug, CTLFLAG_RWTUN, &otus_debug, 0,
81    "Debug level");
82#define	OTUS_DEBUG_XMIT		0x00000001
83#define	OTUS_DEBUG_RECV		0x00000002
84#define	OTUS_DEBUG_TXDONE	0x00000004
85#define	OTUS_DEBUG_RXDONE	0x00000008
86#define	OTUS_DEBUG_CMD		0x00000010
87#define	OTUS_DEBUG_CMDDONE	0x00000020
88#define	OTUS_DEBUG_RESET	0x00000040
89#define	OTUS_DEBUG_STATE	0x00000080
90#define	OTUS_DEBUG_CMDNOTIFY	0x00000100
91#define	OTUS_DEBUG_REGIO	0x00000200
92#define	OTUS_DEBUG_IRQ		0x00000400
93#define	OTUS_DEBUG_TXCOMP	0x00000800
94#define	OTUS_DEBUG_ANY		0xffffffff
95
96#define	OTUS_DPRINTF(sc, dm, ...) \
97	do { \
98		if ((dm == OTUS_DEBUG_ANY) || (dm & otus_debug)) \
99			device_printf(sc->sc_dev, __VA_ARGS__); \
100	} while (0)
101
102#define	OTUS_DEV(v, p) { USB_VPI(v, p, 0) }
103static const STRUCT_USB_HOST_ID otus_devs[] = {
104	OTUS_DEV(USB_VENDOR_ACCTON,		USB_PRODUCT_ACCTON_WN7512),
105	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_3CRUSBN275),
106	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_TG121N),
107	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_AR9170),
108	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN612),
109	OTUS_DEV(USB_VENDOR_ATHEROS2,		USB_PRODUCT_ATHEROS2_WN821NV2),
110	OTUS_DEV(USB_VENDOR_AVM,		USB_PRODUCT_AVM_FRITZWLAN),
111	OTUS_DEV(USB_VENDOR_CACE,		USB_PRODUCT_CACE_AIRPCAPNX),
112	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA130D1),
113	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A1),
114	OTUS_DEV(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA160A2),
115	OTUS_DEV(USB_VENDOR_IODATA,		USB_PRODUCT_IODATA_WNGDNUS2),
116	OTUS_DEV(USB_VENDOR_NEC,		USB_PRODUCT_NEC_WL300NUG),
117	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WN111V2),
118	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNA1000),
119	OTUS_DEV(USB_VENDOR_NETGEAR,		USB_PRODUCT_NETGEAR_WNDA3100),
120	OTUS_DEV(USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GW_US300),
121	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_O8494),
122	OTUS_DEV(USB_VENDOR_WISTRONNEWEB,	USB_PRODUCT_WISTRONNEWEB_WNC0600),
123	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB81),
124	OTUS_DEV(USB_VENDOR_ZCOM,		USB_PRODUCT_ZCOM_UB82),
125	OTUS_DEV(USB_VENDOR_ZYDAS,		USB_PRODUCT_ZYDAS_ZD1221),
126	OTUS_DEV(USB_VENDOR_ZYXEL,		USB_PRODUCT_ZYXEL_NWD271N),
127};
128
129static device_probe_t otus_match;
130static device_attach_t otus_attach;
131static device_detach_t otus_detach;
132
133static int	otus_attachhook(struct otus_softc *);
134void		otus_get_chanlist(struct otus_softc *);
135int		otus_load_firmware(struct otus_softc *, const char *,
136		    uint32_t);
137int		otus_open_pipes(struct otus_softc *);
138void		otus_close_pipes(struct otus_softc *);
139
140static int	otus_alloc_tx_cmd_list(struct otus_softc *);
141static void	otus_free_tx_cmd_list(struct otus_softc *);
142
143static int	otus_alloc_rx_list(struct otus_softc *);
144static void	otus_free_rx_list(struct otus_softc *);
145static int	otus_alloc_tx_list(struct otus_softc *);
146static void	otus_free_tx_list(struct otus_softc *);
147static void	otus_free_list(struct otus_softc *, struct otus_data [], int);
148static struct otus_data *_otus_getbuf(struct otus_softc *);
149static struct otus_data *otus_getbuf(struct otus_softc *);
150static void	otus_freebuf(struct otus_softc *, struct otus_data *);
151
152static struct otus_tx_cmd *_otus_get_txcmd(struct otus_softc *);
153static struct otus_tx_cmd *otus_get_txcmd(struct otus_softc *);
154static void	otus_free_txcmd(struct otus_softc *, struct otus_tx_cmd *);
155
156void		otus_next_scan(void *, int);
157static void	otus_tx_task(void *, int pending);
158static void	otus_wme_update_task(void *, int pending);
159void		otus_do_async(struct otus_softc *,
160		    void (*)(struct otus_softc *, void *), void *, int);
161int		otus_newstate(struct ieee80211vap *, enum ieee80211_state,
162		    int);
163int		otus_cmd(struct otus_softc *, uint8_t, const void *, int,
164		    void *, int);
165void		otus_write(struct otus_softc *, uint32_t, uint32_t);
166int		otus_write_barrier(struct otus_softc *);
167static struct	ieee80211_node *otus_node_alloc(struct ieee80211vap *vap,
168		    const uint8_t mac[IEEE80211_ADDR_LEN]);
169int		otus_media_change(struct ifnet *);
170int		otus_read_eeprom(struct otus_softc *);
171void		otus_newassoc(struct ieee80211_node *, int);
172void		otus_cmd_rxeof(struct otus_softc *, uint8_t *, int);
173void		otus_sub_rxeof(struct otus_softc *, uint8_t *, int,
174		    struct mbufq *);
175static int	otus_tx(struct otus_softc *, struct ieee80211_node *,
176		    struct mbuf *, struct otus_data *,
177		    const struct ieee80211_bpf_params *);
178int		otus_ioctl(struct ifnet *, u_long, caddr_t);
179int		otus_set_multi(struct otus_softc *);
180static void	otus_updateedca(struct otus_softc *sc);
181static void	otus_updateslot(struct otus_softc *sc);
182int		otus_init_mac(struct otus_softc *);
183uint32_t	otus_phy_get_def(struct otus_softc *, uint32_t);
184int		otus_set_board_values(struct otus_softc *,
185		    struct ieee80211_channel *);
186int		otus_program_phy(struct otus_softc *,
187		    struct ieee80211_channel *);
188int		otus_set_rf_bank4(struct otus_softc *,
189		    struct ieee80211_channel *);
190void		otus_get_delta_slope(uint32_t, uint32_t *, uint32_t *);
191static int	otus_set_chan(struct otus_softc *, struct ieee80211_channel *,
192		    int);
193int		otus_set_key(struct ieee80211com *, struct ieee80211_node *,
194		    struct ieee80211_key *);
195void		otus_set_key_cb(struct otus_softc *, void *);
196void		otus_delete_key(struct ieee80211com *, struct ieee80211_node *,
197		    struct ieee80211_key *);
198void		otus_delete_key_cb(struct otus_softc *, void *);
199void		otus_calibrate_to(void *, int);
200int		otus_set_bssid(struct otus_softc *, const uint8_t *);
201int		otus_set_macaddr(struct otus_softc *, const uint8_t *);
202void		otus_led_newstate_type1(struct otus_softc *);
203void		otus_led_newstate_type2(struct otus_softc *);
204void		otus_led_newstate_type3(struct otus_softc *);
205int		otus_init(struct otus_softc *sc);
206void		otus_stop(struct otus_softc *sc);
207
208static device_method_t otus_methods[] = {
209	DEVMETHOD(device_probe,		otus_match),
210	DEVMETHOD(device_attach,	otus_attach),
211	DEVMETHOD(device_detach,	otus_detach),
212
213	DEVMETHOD_END
214};
215
216static driver_t otus_driver = {
217	.name = "otus",
218	.methods = otus_methods,
219	.size = sizeof(struct otus_softc)
220};
221
222static devclass_t otus_devclass;
223
224DRIVER_MODULE(otus, uhub, otus_driver, otus_devclass, NULL, 0);
225MODULE_DEPEND(otus, wlan, 1, 1, 1);
226MODULE_DEPEND(otus, usb, 1, 1, 1);
227MODULE_DEPEND(otus, firmware, 1, 1, 1);
228MODULE_VERSION(otus, 1);
229
230static usb_callback_t	otus_bulk_tx_callback;
231static usb_callback_t	otus_bulk_rx_callback;
232static usb_callback_t	otus_bulk_irq_callback;
233static usb_callback_t	otus_bulk_cmd_callback;
234
235static const struct usb_config otus_config[OTUS_N_XFER] = {
236	[OTUS_BULK_TX] = {
237	.type = UE_BULK,
238	.endpoint = UE_ADDR_ANY,
239	.direction = UE_DIR_OUT,
240	.bufsize = 0x200,
241	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
242	.callback = otus_bulk_tx_callback,
243	.timeout = 5000,	/* ms */
244	},
245	[OTUS_BULK_RX] = {
246	.type = UE_BULK,
247	.endpoint = UE_ADDR_ANY,
248	.direction = UE_DIR_IN,
249	.bufsize = OTUS_RXBUFSZ,
250	.flags = { .ext_buffer = 1, .pipe_bof = 1,.short_xfer_ok = 1,},
251	.callback = otus_bulk_rx_callback,
252	},
253	[OTUS_BULK_IRQ] = {
254	.type = UE_INTERRUPT,
255	.endpoint = UE_ADDR_ANY,
256	.direction = UE_DIR_IN,
257	.bufsize = OTUS_MAX_CTRLSZ,
258	.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
259	.callback = otus_bulk_irq_callback,
260	},
261	[OTUS_BULK_CMD] = {
262	.type = UE_INTERRUPT,
263	.endpoint = UE_ADDR_ANY,
264	.direction = UE_DIR_OUT,
265	.bufsize = OTUS_MAX_CTRLSZ,
266	.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
267	.callback = otus_bulk_cmd_callback,
268	.timeout = 5000,	/* ms */
269	},
270};
271
272static int
273otus_match(device_t self)
274{
275	struct usb_attach_arg *uaa = device_get_ivars(self);
276
277	if (uaa->usb_mode != USB_MODE_HOST ||
278	    uaa->info.bIfaceIndex != 0 ||
279	    uaa->info.bConfigIndex != 0)
280	return (ENXIO);
281
282	return (usbd_lookup_id_by_uaa(otus_devs, sizeof(otus_devs), uaa));
283}
284
285static int
286otus_attach(device_t self)
287{
288	struct usb_attach_arg *uaa = device_get_ivars(self);
289	struct otus_softc *sc = device_get_softc(self);
290	int error;
291	uint8_t iface_index;
292
293	device_set_usb_desc(self);
294	sc->sc_udev = uaa->device;
295	sc->sc_dev = self;
296
297	mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
298	    MTX_DEF);
299
300	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->scan_to, 0, otus_next_scan, sc);
301	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_to, 0, otus_calibrate_to, sc);
302	TASK_INIT(&sc->tx_task, 0, otus_tx_task, sc);
303	TASK_INIT(&sc->wme_update_task, 0, otus_wme_update_task, sc);
304	mbufq_init(&sc->sc_snd, ifqmaxlen);
305
306	iface_index = 0;
307	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
308	    otus_config, OTUS_N_XFER, sc, &sc->sc_mtx);
309	if (error) {
310		device_printf(sc->sc_dev,
311		    "could not allocate USB transfers, err=%s\n",
312		    usbd_errstr(error));
313		goto fail_usb;
314	}
315
316	if ((error = otus_open_pipes(sc)) != 0) {
317		device_printf(sc->sc_dev, "%s: could not open pipes\n",
318		    __func__);
319		goto fail;
320	}
321
322	/* XXX check return status; fail out if appropriate */
323	if (otus_attachhook(sc) != 0)
324		goto fail;
325
326	return (0);
327
328fail:
329	otus_close_pipes(sc);
330fail_usb:
331	mtx_destroy(&sc->sc_mtx);
332	return (ENXIO);
333}
334
335static int
336otus_detach(device_t self)
337{
338	struct otus_softc *sc = device_get_softc(self);
339	struct ieee80211com *ic = &sc->sc_ic;
340
341	otus_stop(sc);
342
343	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
344
345	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
346	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
347	taskqueue_drain(taskqueue_thread, &sc->tx_task);
348	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
349
350	otus_close_pipes(sc);
351#if 0
352	/* Wait for all queued asynchronous commands to complete. */
353	usb_rem_wait_task(sc->sc_udev, &sc->sc_task);
354
355	usbd_ref_wait(sc->sc_udev);
356#endif
357
358	ieee80211_ifdetach(ic);
359	mtx_destroy(&sc->sc_mtx);
360	return 0;
361}
362
363static void
364otus_delay_ms(struct otus_softc *sc, int ms)
365{
366
367	DELAY(1000 * ms);
368}
369
370static struct ieee80211vap *
371otus_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
372    enum ieee80211_opmode opmode, int flags,
373    const uint8_t bssid[IEEE80211_ADDR_LEN],
374    const uint8_t mac[IEEE80211_ADDR_LEN])
375{
376	struct otus_vap *uvp;
377	struct ieee80211vap *vap;
378
379	if (!TAILQ_EMPTY(&ic->ic_vaps))	 /* only one at a time */
380		return (NULL);
381
382	uvp =  malloc(sizeof(struct otus_vap), M_80211_VAP, M_WAITOK | M_ZERO);
383	vap = &uvp->vap;
384
385	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
386	    flags, bssid) != 0) {
387		/* out of memory */
388		free(uvp, M_80211_VAP);
389		return (NULL);
390	}
391
392	/* override state transition machine */
393	uvp->newstate = vap->iv_newstate;
394	vap->iv_newstate = otus_newstate;
395
396	/* XXX TODO: double-check */
397	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
398	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
399
400	ieee80211_ratectl_init(vap);
401
402	/* complete setup */
403	ieee80211_vap_attach(vap, ieee80211_media_change,
404	    ieee80211_media_status, mac);
405	ic->ic_opmode = opmode;
406
407	return (vap);
408}
409
410static void
411otus_vap_delete(struct ieee80211vap *vap)
412{
413	struct otus_vap *uvp = OTUS_VAP(vap);
414
415	ieee80211_ratectl_deinit(vap);
416	ieee80211_vap_detach(vap);
417	free(uvp, M_80211_VAP);
418}
419
420static void
421otus_parent(struct ieee80211com *ic)
422{
423	struct otus_softc *sc = ic->ic_softc;
424	int startall = 0;
425
426	if (ic->ic_nrunning > 0) {
427		if (!sc->sc_running) {
428			otus_init(sc);
429			startall = 1;
430		} else {
431			(void) otus_set_multi(sc);
432		}
433	} else if (sc->sc_running)
434		otus_stop(sc);
435
436	if (startall)
437		ieee80211_start_all(ic);
438}
439
440static void
441otus_drain_mbufq(struct otus_softc *sc)
442{
443	struct mbuf *m;
444	struct ieee80211_node *ni;
445
446	OTUS_LOCK_ASSERT(sc);
447	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
448		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
449		m->m_pkthdr.rcvif = NULL;
450		ieee80211_free_node(ni);
451		m_freem(m);
452	}
453}
454
455static void
456otus_tx_start(struct otus_softc *sc)
457{
458
459	taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
460}
461
462static int
463otus_transmit(struct ieee80211com *ic, struct mbuf *m)
464{
465	struct otus_softc *sc = ic->ic_softc;
466	int error;
467
468	OTUS_LOCK(sc);
469	if (! sc->sc_running) {
470		OTUS_UNLOCK(sc);
471		return (ENXIO);
472	}
473
474	/* XXX TODO: handle fragments */
475	error = mbufq_enqueue(&sc->sc_snd, m);
476	if (error) {
477		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
478		    "%s: mbufq_enqueue failed: %d\n",
479		    __func__,
480		    error);
481		OTUS_UNLOCK(sc);
482		return (error);
483	}
484	OTUS_UNLOCK(sc);
485
486	/* Kick TX */
487	otus_tx_start(sc);
488
489	return (0);
490}
491
492static void
493_otus_start(struct otus_softc *sc)
494{
495	struct ieee80211_node *ni;
496	struct otus_data *bf;
497	struct mbuf *m;
498
499	OTUS_LOCK_ASSERT(sc);
500
501	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
502		bf = otus_getbuf(sc);
503		if (bf == NULL) {
504			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
505			    "%s: failed to get buffer\n", __func__);
506			mbufq_prepend(&sc->sc_snd, m);
507			break;
508		}
509
510		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
511		m->m_pkthdr.rcvif = NULL;
512
513		if (otus_tx(sc, ni, m, bf, NULL) != 0) {
514			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
515			    "%s: failed to transmit\n", __func__);
516			if_inc_counter(ni->ni_vap->iv_ifp,
517			    IFCOUNTER_OERRORS, 1);
518			otus_freebuf(sc, bf);
519			ieee80211_free_node(ni);
520			m_freem(m);
521			break;
522		}
523	}
524}
525
526static void
527otus_tx_task(void *arg, int pending)
528{
529	struct otus_softc *sc = arg;
530
531	OTUS_LOCK(sc);
532	_otus_start(sc);
533	OTUS_UNLOCK(sc);
534}
535
536static int
537otus_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
538    const struct ieee80211_bpf_params *params)
539{
540	struct ieee80211com *ic= ni->ni_ic;
541	struct otus_softc *sc = ic->ic_softc;
542	struct otus_data *bf = NULL;
543	int error = 0;
544
545	/* Don't transmit if we're not running */
546	OTUS_LOCK(sc);
547	if (! sc->sc_running) {
548		error = ENETDOWN;
549		goto error;
550	}
551
552	bf = otus_getbuf(sc);
553	if (bf == NULL) {
554		error = ENOBUFS;
555		goto error;
556	}
557
558	if (otus_tx(sc, ni, m, bf, params) != 0) {
559		error = EIO;
560		goto error;
561	}
562
563	OTUS_UNLOCK(sc);
564	return (0);
565error:
566	if (bf)
567		otus_freebuf(sc, bf);
568	OTUS_UNLOCK(sc);
569	m_freem(m);
570	return (ENXIO);
571}
572
573static void
574otus_update_chw(struct ieee80211com *ic)
575{
576
577	printf("%s: TODO\n", __func__);
578}
579
580static void
581otus_set_channel(struct ieee80211com *ic)
582{
583	struct otus_softc *sc = ic->ic_softc;
584	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "%s: set channel: %d\n",
585	    __func__,
586	    ic->ic_curchan->ic_freq);
587
588	OTUS_LOCK(sc);
589	(void) otus_set_chan(sc, ic->ic_curchan, 0);
590	OTUS_UNLOCK(sc);
591}
592
593static void
594otus_wme_update_task(void *arg, int pending)
595{
596	struct otus_softc *sc = arg;
597
598	OTUS_LOCK(sc);
599	/*
600	 * XXX TODO: take temporary copy of EDCA information
601	 * when scheduling this so we have a more time-correct view
602	 * of things.
603	 */
604	otus_updateedca(sc);
605	OTUS_UNLOCK(sc);
606}
607
608static void
609otus_wme_schedule_update(struct otus_softc *sc)
610{
611
612	taskqueue_enqueue(taskqueue_thread, &sc->wme_update_task);
613}
614
615/*
616 * This is called by net80211 in RX packet context, so we
617 * can't sleep here.
618 *
619 * TODO: have net80211 schedule an update itself for its
620 * own internal taskqueue.
621 */
622static int
623otus_wme_update(struct ieee80211com *ic)
624{
625	struct otus_softc *sc = ic->ic_softc;
626
627	otus_wme_schedule_update(sc);
628	return (0);
629}
630
631static int
632otus_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
633{
634
635	/* For now, no A-MPDU TX support in the driver */
636	return (0);
637}
638
639static void
640otus_scan_start(struct ieee80211com *ic)
641{
642
643//	printf("%s: TODO\n", __func__);
644}
645
646static void
647otus_scan_end(struct ieee80211com *ic)
648{
649
650//	printf("%s: TODO\n", __func__);
651}
652
653static void
654otus_update_mcast(struct ieee80211com *ic)
655{
656	struct otus_softc *sc = ic->ic_softc;
657
658	(void) otus_set_multi(sc);
659}
660
661static int
662otus_attachhook(struct otus_softc *sc)
663{
664	struct ieee80211com *ic = &sc->sc_ic;
665	usb_device_request_t req;
666	uint32_t in, out;
667	int error;
668	uint8_t bands;
669
670	/* Not locked */
671	error = otus_load_firmware(sc, "otusfw_init", AR_FW_INIT_ADDR);
672	if (error != 0) {
673		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
674		    __func__, "init");
675		return (ENXIO);
676	}
677
678	/* XXX not locked? */
679	otus_delay_ms(sc, 1000);
680
681	/* Not locked */
682	error = otus_load_firmware(sc, "otusfw_main", AR_FW_MAIN_ADDR);
683	if (error != 0) {
684		device_printf(sc->sc_dev, "%s: could not load %s firmware\n",
685		    __func__, "main");
686		return (ENXIO);
687	}
688
689	OTUS_LOCK(sc);
690
691	/* Tell device that firmware transfer is complete. */
692	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
693	req.bRequest = AR_FW_DOWNLOAD_COMPLETE;
694	USETW(req.wValue, 0);
695	USETW(req.wIndex, 0);
696	USETW(req.wLength, 0);
697	if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx, &req, NULL,
698	    0, NULL, 250) != 0) {
699		OTUS_UNLOCK(sc);
700		device_printf(sc->sc_dev,
701		    "%s: firmware initialization failed\n",
702		    __func__);
703		return (ENXIO);
704	}
705
706	/* Send an ECHO command to check that everything is settled. */
707	in = 0xbadc0ffe;
708	if (otus_cmd(sc, AR_CMD_ECHO, &in, sizeof in, &out, sizeof(out)) != 0) {
709		OTUS_UNLOCK(sc);
710		device_printf(sc->sc_dev,
711		    "%s: echo command failed\n", __func__);
712		return (ENXIO);
713	}
714	if (in != out) {
715		OTUS_UNLOCK(sc);
716		device_printf(sc->sc_dev,
717		    "%s: echo reply mismatch: 0x%08x!=0x%08x\n",
718		    __func__, in, out);
719		return (ENXIO);
720	}
721
722	/* Read entire EEPROM. */
723	if (otus_read_eeprom(sc) != 0) {
724		OTUS_UNLOCK(sc);
725		device_printf(sc->sc_dev,
726		    "%s: could not read EEPROM\n",
727		    __func__);
728		return (ENXIO);
729	}
730
731	OTUS_UNLOCK(sc);
732
733	sc->txmask = sc->eeprom.baseEepHeader.txMask;
734	sc->rxmask = sc->eeprom.baseEepHeader.rxMask;
735	sc->capflags = sc->eeprom.baseEepHeader.opCapFlags;
736	IEEE80211_ADDR_COPY(ic->ic_macaddr, sc->eeprom.baseEepHeader.macAddr);
737	sc->sc_led_newstate = otus_led_newstate_type3;	/* XXX */
738
739	device_printf(sc->sc_dev,
740	    "MAC/BBP AR9170, RF AR%X, MIMO %dT%dR, address %s\n",
741	    (sc->capflags & AR5416_OPFLAGS_11A) ?
742		0x9104 : ((sc->txmask == 0x5) ? 0x9102 : 0x9101),
743	    (sc->txmask == 0x5) ? 2 : 1, (sc->rxmask == 0x5) ? 2 : 1,
744	    ether_sprintf(ic->ic_macaddr));
745
746	ic->ic_softc = sc;
747	ic->ic_name = device_get_nameunit(sc->sc_dev);
748	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
749	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
750
751	/* Set device capabilities. */
752	ic->ic_caps =
753	    IEEE80211_C_STA |		/* station mode */
754#if 0
755	    IEEE80211_C_BGSCAN |	/* Background scan. */
756#endif
757	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
758	    IEEE80211_C_WME |		/* WME/QoS */
759	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
760	    IEEE80211_C_FF |		/* Atheros fast-frames supported. */
761	    IEEE80211_C_MONITOR |
762	    IEEE80211_C_WPA;		/* WPA/RSN. */
763
764	/* XXX TODO: 11n */
765
766#if 0
767	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
768		/* Set supported .11b and .11g rates. */
769		ic->ic_sup_rates[IEEE80211_MODE_11B] =
770		    ieee80211_std_rateset_11b;
771		ic->ic_sup_rates[IEEE80211_MODE_11G] =
772		    ieee80211_std_rateset_11g;
773	}
774	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
775		/* Set supported .11a rates. */
776		ic->ic_sup_rates[IEEE80211_MODE_11A] =
777		    ieee80211_std_rateset_11a;
778	}
779#endif
780
781#if 0
782	/* Build the list of supported channels. */
783	otus_get_chanlist(sc);
784#else
785	/* Set supported .11b and .11g rates. */
786	bands = 0;
787	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
788		setbit(&bands, IEEE80211_MODE_11B);
789		setbit(&bands, IEEE80211_MODE_11G);
790	}
791	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
792		setbit(&bands, IEEE80211_MODE_11A);
793	}
794#if 0
795	if (sc->sc_ht)
796		setbit(&bands, IEEE80211_MODE_11NG);
797#endif
798	ieee80211_init_channels(ic, NULL, &bands);
799#endif
800
801	ieee80211_ifattach(ic);
802	ic->ic_raw_xmit = otus_raw_xmit;
803	ic->ic_scan_start = otus_scan_start;
804	ic->ic_scan_end = otus_scan_end;
805	ic->ic_set_channel = otus_set_channel;
806	ic->ic_vap_create = otus_vap_create;
807	ic->ic_vap_delete = otus_vap_delete;
808	ic->ic_update_mcast = otus_update_mcast;
809	ic->ic_update_promisc = otus_update_mcast;
810	ic->ic_parent = otus_parent;
811	ic->ic_transmit = otus_transmit;
812	ic->ic_update_chw = otus_update_chw;
813	ic->ic_ampdu_enable = otus_ampdu_enable;
814	ic->ic_wme.wme_update = otus_wme_update;
815	ic->ic_newassoc = otus_newassoc;
816	ic->ic_node_alloc = otus_node_alloc;
817
818#ifdef notyet
819	ic->ic_set_key = otus_set_key;
820	ic->ic_delete_key = otus_delete_key;
821#endif
822
823	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
824	    sizeof(sc->sc_txtap), OTUS_TX_RADIOTAP_PRESENT,
825	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
826	    OTUS_RX_RADIOTAP_PRESENT);
827
828	return (0);
829}
830
831void
832otus_get_chanlist(struct otus_softc *sc)
833{
834	struct ieee80211com *ic = &sc->sc_ic;
835	uint16_t domain;
836	uint8_t chan;
837	int i;
838
839	/* XXX regulatory domain. */
840	domain = le16toh(sc->eeprom.baseEepHeader.regDmn[0]);
841	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "regdomain=0x%04x\n", domain);
842
843	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11G) {
844		for (i = 0; i < 14; i++) {
845			chan = ar_chans[i];
846			ic->ic_channels[chan].ic_freq =
847			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_2GHZ);
848			ic->ic_channels[chan].ic_flags =
849			    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
850			    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
851		}
852	}
853	if (sc->eeprom.baseEepHeader.opCapFlags & AR5416_OPFLAGS_11A) {
854		for (i = 14; i < nitems(ar_chans); i++) {
855			chan = ar_chans[i];
856			ic->ic_channels[chan].ic_freq =
857			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
858			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
859		}
860	}
861}
862
863int
864otus_load_firmware(struct otus_softc *sc, const char *name, uint32_t addr)
865{
866	usb_device_request_t req;
867	char *ptr;
868	const struct firmware *fw;
869	int mlen, error, size;
870
871	error = 0;
872
873	/* Read firmware image from the filesystem. */
874	if ((fw = firmware_get(name)) == NULL) {
875		device_printf(sc->sc_dev,
876		    "%s: failed loadfirmware of file %s\n", __func__, name);
877		return (ENXIO);
878	}
879	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
880	req.bRequest = AR_FW_DOWNLOAD;
881	USETW(req.wIndex, 0);
882
883	OTUS_LOCK(sc);
884
885	/* XXX const */
886	ptr = __DECONST(char *, fw->data);
887	size = fw->datasize;
888	addr >>= 8;
889	while (size > 0) {
890		mlen = MIN(size, 4096);
891
892		USETW(req.wValue, addr);
893		USETW(req.wLength, mlen);
894		if (usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
895		    &req, ptr, 0, NULL, 250) != 0) {
896			error = EIO;
897			break;
898		}
899		addr += mlen >> 8;
900		ptr  += mlen;
901		size -= mlen;
902	}
903
904	OTUS_UNLOCK(sc);
905
906	firmware_put(fw, FIRMWARE_UNLOAD);
907	if (error != 0)
908		device_printf(sc->sc_dev,
909		    "%s: %s: error=%d\n", __func__, name, error);
910	return error;
911}
912
913int
914otus_open_pipes(struct otus_softc *sc)
915{
916#if 0
917	int isize, error;
918	int i;
919#endif
920	int error;
921
922	OTUS_UNLOCK_ASSERT(sc);
923
924	if ((error = otus_alloc_tx_cmd_list(sc)) != 0) {
925		device_printf(sc->sc_dev,
926		    "%s: could not allocate command xfer\n",
927		    __func__);
928		goto fail;
929	}
930
931	if ((error = otus_alloc_tx_list(sc)) != 0) {
932		device_printf(sc->sc_dev, "%s: could not allocate Tx xfers\n",
933		    __func__);
934		goto fail;
935	}
936
937	if ((error = otus_alloc_rx_list(sc)) != 0) {
938		device_printf(sc->sc_dev, "%s: could not allocate Rx xfers\n",
939		    __func__);
940		goto fail;
941	}
942
943	/* Enable RX transfers; needed for initial firmware messages */
944	OTUS_LOCK(sc);
945	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_RX]);
946	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_IRQ]);
947	OTUS_UNLOCK(sc);
948	return 0;
949
950fail:	otus_close_pipes(sc);
951	return error;
952}
953
954void
955otus_close_pipes(struct otus_softc *sc)
956{
957
958	OTUS_LOCK(sc);
959	otus_free_tx_cmd_list(sc);
960	otus_free_tx_list(sc);
961	otus_free_rx_list(sc);
962	OTUS_UNLOCK(sc);
963
964	usbd_transfer_unsetup(sc->sc_xfer, OTUS_N_XFER);
965}
966
967static void
968otus_free_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[], int ndata)
969{
970	int i;
971
972	/* XXX TODO: someone has to have waken up waiters! */
973	for (i = 0; i < ndata; i++) {
974		struct otus_tx_cmd *dp = &cmd[i];
975
976		if (dp->buf != NULL) {
977			free(dp->buf, M_USBDEV);
978			dp->buf = NULL;
979		}
980	}
981}
982
983static int
984otus_alloc_cmd_list(struct otus_softc *sc, struct otus_tx_cmd cmd[],
985    int ndata, int maxsz)
986{
987	int i, error;
988
989	for (i = 0; i < ndata; i++) {
990		struct otus_tx_cmd *dp = &cmd[i];
991		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
992		dp->odata = NULL;
993		if (dp->buf == NULL) {
994			device_printf(sc->sc_dev,
995			    "could not allocate buffer\n");
996			error = ENOMEM;
997			goto fail;
998		}
999	}
1000
1001	return (0);
1002fail:
1003	otus_free_cmd_list(sc, cmd, ndata);
1004	return (error);
1005}
1006
1007static int
1008otus_alloc_tx_cmd_list(struct otus_softc *sc)
1009{
1010	int error, i;
1011
1012	error = otus_alloc_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT,
1013	    OTUS_MAX_TXCMDSZ);
1014	if (error != 0)
1015		return (error);
1016
1017	STAILQ_INIT(&sc->sc_cmd_active);
1018	STAILQ_INIT(&sc->sc_cmd_inactive);
1019	STAILQ_INIT(&sc->sc_cmd_pending);
1020	STAILQ_INIT(&sc->sc_cmd_waiting);
1021
1022	for (i = 0; i < OTUS_CMD_LIST_COUNT; i++)
1023		STAILQ_INSERT_HEAD(&sc->sc_cmd_inactive, &sc->sc_cmd[i],
1024		    next_cmd);
1025
1026	return (0);
1027}
1028
1029static void
1030otus_free_tx_cmd_list(struct otus_softc *sc)
1031{
1032
1033	/*
1034	 * XXX TODO: something needs to wake up any pending/sleeping
1035	 * waiters!
1036	 */
1037	STAILQ_INIT(&sc->sc_cmd_active);
1038	STAILQ_INIT(&sc->sc_cmd_inactive);
1039	STAILQ_INIT(&sc->sc_cmd_pending);
1040	STAILQ_INIT(&sc->sc_cmd_waiting);
1041
1042	otus_free_cmd_list(sc, sc->sc_cmd, OTUS_CMD_LIST_COUNT);
1043}
1044
1045static int
1046otus_alloc_list(struct otus_softc *sc, struct otus_data data[],
1047    int ndata, int maxsz)
1048{
1049	int i, error;
1050
1051	for (i = 0; i < ndata; i++) {
1052		struct otus_data *dp = &data[i];
1053		dp->sc = sc;
1054		dp->m = NULL;
1055		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1056		if (dp->buf == NULL) {
1057			device_printf(sc->sc_dev,
1058			    "could not allocate buffer\n");
1059			error = ENOMEM;
1060			goto fail;
1061		}
1062		dp->ni = NULL;
1063	}
1064
1065	return (0);
1066fail:
1067	otus_free_list(sc, data, ndata);
1068	return (error);
1069}
1070
1071static int
1072otus_alloc_rx_list(struct otus_softc *sc)
1073{
1074	int error, i;
1075
1076	error = otus_alloc_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT,
1077	    OTUS_RXBUFSZ);
1078	if (error != 0)
1079		return (error);
1080
1081	STAILQ_INIT(&sc->sc_rx_active);
1082	STAILQ_INIT(&sc->sc_rx_inactive);
1083
1084	for (i = 0; i < OTUS_RX_LIST_COUNT; i++)
1085		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1086
1087	return (0);
1088}
1089
1090static int
1091otus_alloc_tx_list(struct otus_softc *sc)
1092{
1093	int error, i;
1094
1095	error = otus_alloc_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT,
1096	    OTUS_TXBUFSZ);
1097	if (error != 0)
1098		return (error);
1099
1100	STAILQ_INIT(&sc->sc_tx_inactive);
1101
1102	for (i = 0; i != OTUS_N_XFER; i++) {
1103		STAILQ_INIT(&sc->sc_tx_active[i]);
1104		STAILQ_INIT(&sc->sc_tx_pending[i]);
1105	}
1106
1107	for (i = 0; i < OTUS_TX_LIST_COUNT; i++) {
1108		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1109	}
1110
1111	return (0);
1112}
1113
1114static void
1115otus_free_tx_list(struct otus_softc *sc)
1116{
1117	int i;
1118
1119	/* prevent further allocations from TX list(s) */
1120	STAILQ_INIT(&sc->sc_tx_inactive);
1121
1122	for (i = 0; i != OTUS_N_XFER; i++) {
1123		STAILQ_INIT(&sc->sc_tx_active[i]);
1124		STAILQ_INIT(&sc->sc_tx_pending[i]);
1125	}
1126
1127	otus_free_list(sc, sc->sc_tx, OTUS_TX_LIST_COUNT);
1128}
1129
1130static void
1131otus_free_rx_list(struct otus_softc *sc)
1132{
1133	/* prevent further allocations from RX list(s) */
1134	STAILQ_INIT(&sc->sc_rx_inactive);
1135	STAILQ_INIT(&sc->sc_rx_active);
1136
1137	otus_free_list(sc, sc->sc_rx, OTUS_RX_LIST_COUNT);
1138}
1139
1140static void
1141otus_free_list(struct otus_softc *sc, struct otus_data data[], int ndata)
1142{
1143	int i;
1144
1145	for (i = 0; i < ndata; i++) {
1146		struct otus_data *dp = &data[i];
1147
1148		if (dp->buf != NULL) {
1149			free(dp->buf, M_USBDEV);
1150			dp->buf = NULL;
1151		}
1152		if (dp->ni != NULL) {
1153			ieee80211_free_node(dp->ni);
1154			dp->ni = NULL;
1155		}
1156	}
1157}
1158
1159static struct otus_data *
1160_otus_getbuf(struct otus_softc *sc)
1161{
1162	struct otus_data *bf;
1163
1164	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1165	if (bf != NULL)
1166		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1167	else
1168		bf = NULL;
1169	return (bf);
1170}
1171
1172static struct otus_data *
1173otus_getbuf(struct otus_softc *sc)
1174{
1175	struct otus_data *bf;
1176
1177	OTUS_LOCK_ASSERT(sc);
1178
1179	bf = _otus_getbuf(sc);
1180	return (bf);
1181}
1182
1183static void
1184otus_freebuf(struct otus_softc *sc, struct otus_data *bf)
1185{
1186
1187	OTUS_LOCK_ASSERT(sc);
1188	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
1189}
1190
1191static struct otus_tx_cmd *
1192_otus_get_txcmd(struct otus_softc *sc)
1193{
1194	struct otus_tx_cmd *bf;
1195
1196	bf = STAILQ_FIRST(&sc->sc_cmd_inactive);
1197	if (bf != NULL)
1198		STAILQ_REMOVE_HEAD(&sc->sc_cmd_inactive, next_cmd);
1199	else
1200		bf = NULL;
1201	return (bf);
1202}
1203
1204static struct otus_tx_cmd *
1205otus_get_txcmd(struct otus_softc *sc)
1206{
1207	struct otus_tx_cmd *bf;
1208
1209	OTUS_LOCK_ASSERT(sc);
1210
1211	bf = _otus_get_txcmd(sc);
1212	if (bf == NULL) {
1213		device_printf(sc->sc_dev, "%s: no tx cmd buffers\n",
1214		    __func__);
1215	}
1216	return (bf);
1217}
1218
1219static void
1220otus_free_txcmd(struct otus_softc *sc, struct otus_tx_cmd *bf)
1221{
1222
1223	OTUS_LOCK_ASSERT(sc);
1224	STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, bf, next_cmd);
1225}
1226
1227void
1228otus_next_scan(void *arg, int pending)
1229{
1230#if 0
1231	struct otus_softc *sc = arg;
1232
1233	if (usbd_is_dying(sc->sc_udev))
1234		return;
1235
1236	usbd_ref_incr(sc->sc_udev);
1237
1238	if (sc->sc_ic.ic_state == IEEE80211_S_SCAN)
1239		ieee80211_next_scan(&sc->sc_ic.ic_if);
1240
1241	usbd_ref_decr(sc->sc_udev);
1242#endif
1243}
1244
1245int
1246otus_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1247{
1248	struct otus_vap *uvp = OTUS_VAP(vap);
1249	struct ieee80211com *ic = vap->iv_ic;
1250	struct otus_softc *sc = ic->ic_softc;
1251	struct ieee80211_node *ni;
1252	enum ieee80211_state ostate;
1253
1254	ostate = vap->iv_state;
1255	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1256	    ieee80211_state_name[ostate],
1257	    ieee80211_state_name[nstate]);
1258
1259	IEEE80211_UNLOCK(ic);
1260
1261	OTUS_LOCK(sc);
1262
1263	/* XXX TODO: more fleshing out! */
1264
1265	switch (nstate) {
1266	case IEEE80211_S_RUN:
1267		ni = ieee80211_ref_node(vap->iv_bss);
1268
1269		if (ic->ic_opmode == IEEE80211_M_STA) {
1270			otus_updateslot(sc);
1271			otus_set_bssid(sc, ni->ni_bssid);
1272
1273			/* Start calibration timer. */
1274			taskqueue_enqueue_timeout(taskqueue_thread,
1275			    &sc->calib_to, hz);
1276		}
1277		break;
1278	default:
1279		break;
1280	}
1281
1282	/* XXX TODO: calibration? */
1283
1284	sc->sc_led_newstate(sc);
1285
1286	OTUS_UNLOCK(sc);
1287	IEEE80211_LOCK(ic);
1288	return (uvp->newstate(vap, nstate, arg));
1289}
1290
1291int
1292otus_cmd(struct otus_softc *sc, uint8_t code, const void *idata, int ilen,
1293    void *odata, int odatalen)
1294{
1295	struct otus_tx_cmd *cmd;
1296	struct ar_cmd_hdr *hdr;
1297	int xferlen, error;
1298
1299	OTUS_LOCK_ASSERT(sc);
1300
1301	/* Always bulk-out a multiple of 4 bytes. */
1302	xferlen = (sizeof (*hdr) + ilen + 3) & ~3;
1303	if (xferlen > OTUS_MAX_TXCMDSZ) {
1304		device_printf(sc->sc_dev, "%s: command (0x%02x) size (%d) > %d\n",
1305		    __func__,
1306		    code,
1307		    xferlen,
1308		    OTUS_MAX_TXCMDSZ);
1309		return (EIO);
1310	}
1311
1312	cmd = otus_get_txcmd(sc);
1313	if (cmd == NULL) {
1314		device_printf(sc->sc_dev, "%s: failed to get buf\n",
1315		    __func__);
1316		return (EIO);
1317	}
1318
1319	hdr = (struct ar_cmd_hdr *)cmd->buf;
1320	hdr->code  = code;
1321	hdr->len   = ilen;
1322	hdr->token = ++sc->token;	/* Don't care about endianness. */
1323	cmd->token = hdr->token;
1324	/* XXX TODO: check max cmd length? */
1325	memcpy((uint8_t *)&hdr[1], idata, ilen);
1326
1327	OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
1328	    "%s: sending command code=0x%02x len=%d token=%d\n",
1329	    __func__, code, ilen, hdr->token);
1330
1331	cmd->odata = odata;
1332	cmd->odatalen = odatalen;
1333	cmd->buflen = xferlen;
1334
1335	/* Queue the command to the endpoint */
1336	STAILQ_INSERT_TAIL(&sc->sc_cmd_pending, cmd, next_cmd);
1337	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_CMD]);
1338
1339	/* Sleep on the command; wait for it to complete */
1340	error = msleep(cmd, &sc->sc_mtx, PCATCH, "otuscmd", hz);
1341
1342	/*
1343	 * At this point we don't own cmd any longer; it'll be
1344	 * freed by the cmd bulk path or the RX notification
1345	 * path.  If the data is made available then it'll be copied
1346	 * to the caller.  All that is left to do is communicate
1347	 * status back to the caller.
1348	 */
1349	if (error != 0) {
1350		device_printf(sc->sc_dev,
1351		    "%s: timeout waiting for command 0x%02x reply\n",
1352		    __func__, code);
1353	}
1354	return error;
1355}
1356
1357void
1358otus_write(struct otus_softc *sc, uint32_t reg, uint32_t val)
1359{
1360
1361	OTUS_LOCK_ASSERT(sc);
1362
1363	sc->write_buf[sc->write_idx].reg = htole32(reg);
1364	sc->write_buf[sc->write_idx].val = htole32(val);
1365
1366	if (++sc->write_idx > (AR_MAX_WRITE_IDX-1))
1367		(void)otus_write_barrier(sc);
1368}
1369
1370int
1371otus_write_barrier(struct otus_softc *sc)
1372{
1373	int error;
1374
1375	OTUS_LOCK_ASSERT(sc);
1376
1377	if (sc->write_idx == 0)
1378		return 0;	/* Nothing to flush. */
1379
1380	OTUS_DPRINTF(sc, OTUS_DEBUG_REGIO, "%s: called; %d updates\n",
1381	    __func__,
1382	    sc->write_idx);
1383
1384	error = otus_cmd(sc, AR_CMD_WREG, sc->write_buf,
1385	    sizeof (sc->write_buf[0]) * sc->write_idx, NULL, 0);
1386	sc->write_idx = 0;
1387	return error;
1388}
1389
1390static struct ieee80211_node *
1391otus_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
1392{
1393
1394	return malloc(sizeof (struct otus_node), M_80211_NODE,
1395	    M_NOWAIT | M_ZERO);
1396}
1397
1398#if 0
1399int
1400otus_media_change(struct ifnet *ifp)
1401{
1402	struct otus_softc *sc = ifp->if_softc;
1403	struct ieee80211com *ic = &sc->sc_ic;
1404	uint8_t rate, ridx;
1405	int error;
1406
1407	error = ieee80211_media_change(ifp);
1408	if (error != ENETRESET)
1409		return error;
1410
1411	if (ic->ic_fixed_rate != -1) {
1412		rate = ic->ic_sup_rates[ic->ic_curmode].
1413		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
1414		for (ridx = 0; ridx <= OTUS_RIDX_MAX; ridx++)
1415			if (otus_rates[ridx].rate == rate)
1416				break;
1417		sc->fixed_ridx = ridx;
1418	}
1419
1420	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
1421		error = otus_init(sc);
1422
1423	return error;
1424}
1425#endif
1426
1427int
1428otus_read_eeprom(struct otus_softc *sc)
1429{
1430	uint32_t regs[8], reg;
1431	uint8_t *eep;
1432	int i, j, error;
1433
1434	OTUS_LOCK_ASSERT(sc);
1435
1436	/* Read EEPROM by blocks of 32 bytes. */
1437	eep = (uint8_t *)&sc->eeprom;
1438	reg = AR_EEPROM_OFFSET;
1439	for (i = 0; i < sizeof (sc->eeprom) / 32; i++) {
1440		for (j = 0; j < 8; j++, reg += 4)
1441			regs[j] = htole32(reg);
1442		error = otus_cmd(sc, AR_CMD_RREG, regs, sizeof regs, eep, 32);
1443		if (error != 0)
1444			break;
1445		eep += 32;
1446	}
1447	return error;
1448}
1449
1450void
1451otus_newassoc(struct ieee80211_node *ni, int isnew)
1452{
1453	struct ieee80211com *ic = ni->ni_ic;
1454	struct otus_softc *sc = ic->ic_softc;
1455	struct otus_node *on = OTUS_NODE(ni);
1456
1457	OTUS_DPRINTF(sc, OTUS_DEBUG_STATE, "new assoc isnew=%d addr=%s\n",
1458	    isnew, ether_sprintf(ni->ni_macaddr));
1459
1460	on->tx_done = 0;
1461	on->tx_err = 0;
1462	on->tx_retries = 0;
1463}
1464
1465static void
1466otus_cmd_handle_response(struct otus_softc *sc, struct ar_cmd_hdr *hdr)
1467{
1468	struct otus_tx_cmd *cmd;
1469
1470	OTUS_LOCK_ASSERT(sc);
1471
1472	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1473	    "%s: received reply code=0x%02x len=%d token=%d\n",
1474	    __func__,
1475	    hdr->code, hdr->len, hdr->token);
1476
1477	/*
1478	 * Walk the list, freeing items that aren't ours,
1479	 * stopping when we hit our token.
1480	 */
1481	while ((cmd = STAILQ_FIRST(&sc->sc_cmd_waiting)) != NULL) {
1482		STAILQ_REMOVE_HEAD(&sc->sc_cmd_waiting, next_cmd);
1483		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1484		    "%s: cmd=%p; hdr.token=%d, cmd.token=%d\n",
1485		    __func__,
1486		    cmd,
1487		    (int) hdr->token,
1488		    (int) cmd->token);
1489		if (hdr->token == cmd->token) {
1490			/* Copy answer into caller's supplied buffer. */
1491			if (cmd->odata != NULL) {
1492				if (hdr->len != cmd->odatalen) {
1493					device_printf(sc->sc_dev,
1494					    "%s: code 0x%02x, len=%d, olen=%d\n",
1495					    __func__,
1496					    (int) hdr->code,
1497					    (int) hdr->len,
1498					    (int) cmd->odatalen);
1499				}
1500				memcpy(cmd->odata, &hdr[1],
1501				    MIN(cmd->odatalen, hdr->len));
1502			}
1503			wakeup(cmd);
1504		}
1505
1506		STAILQ_INSERT_TAIL(&sc->sc_cmd_inactive, cmd, next_cmd);
1507	}
1508}
1509
1510void
1511otus_cmd_rxeof(struct otus_softc *sc, uint8_t *buf, int len)
1512{
1513	struct ieee80211com *ic = &sc->sc_ic;
1514	struct ar_cmd_hdr *hdr;
1515
1516	OTUS_LOCK_ASSERT(sc);
1517
1518	if (__predict_false(len < sizeof (*hdr))) {
1519		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1520		    "cmd too small %d\n", len);
1521		return;
1522	}
1523	hdr = (struct ar_cmd_hdr *)buf;
1524	if (__predict_false(sizeof (*hdr) + hdr->len > len ||
1525	    sizeof (*hdr) + hdr->len > 64)) {
1526		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1527		    "cmd too large %d\n", hdr->len);
1528		return;
1529	}
1530
1531	OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1532	    "%s: code=%.02x\n",
1533	    __func__,
1534	    hdr->code);
1535
1536	/*
1537	 * This has to reach into the cmd queue "waiting for
1538	 * an RX response" list, grab the head entry and check
1539	 * if we need to wake anyone up.
1540	 */
1541	if ((hdr->code & 0xc0) != 0xc0) {
1542		otus_cmd_handle_response(sc, hdr);
1543		return;
1544	}
1545
1546	/* Received unsolicited notification. */
1547	switch (hdr->code & 0x3f) {
1548	case AR_EVT_BEACON:
1549		break;
1550	case AR_EVT_TX_COMP:
1551	{
1552		struct ar_evt_tx_comp *tx = (struct ar_evt_tx_comp *)&hdr[1];
1553		struct ieee80211_node *ni;
1554
1555		ni = ieee80211_find_node(&ic->ic_sta, tx->macaddr);
1556		if (ni == NULL) {
1557			device_printf(sc->sc_dev,
1558			    "%s: txcomp on unknown node (%s)\n",
1559			    __func__,
1560			    ether_sprintf(tx->macaddr));
1561			break;
1562		}
1563
1564		OTUS_DPRINTF(sc, OTUS_DEBUG_TXCOMP,
1565		    "tx completed %s status=%d phy=0x%x\n",
1566		    ether_sprintf(tx->macaddr), le16toh(tx->status),
1567		    le32toh(tx->phy));
1568
1569		switch (le16toh(tx->status)) {
1570		case AR_TX_STATUS_COMP:
1571#if 0
1572			ackfailcnt = 0;
1573			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1574			    IEEE80211_RATECTL_TX_SUCCESS, &ackfailcnt, NULL);
1575#endif
1576			/*
1577			 * We don't get the above; only error notifications.
1578			 * Sigh.  So, don't worry about this.
1579			 */
1580			break;
1581		case AR_TX_STATUS_RETRY_COMP:
1582			OTUS_NODE(ni)->tx_retries++;
1583			break;
1584		case AR_TX_STATUS_FAILED:
1585			OTUS_NODE(ni)->tx_err++;
1586			break;
1587		}
1588		ieee80211_free_node(ni);
1589		break;
1590	}
1591	case AR_EVT_TBTT:
1592		break;
1593	case AR_EVT_DO_BB_RESET:
1594		/*
1595		 * This is "tell driver to reset baseband" from ar9170-fw.
1596		 *
1597		 * I'm not sure what we should do here, so I'm going to
1598		 * fall through; it gets generated when RTSRetryCnt internally
1599		 * reaches '5' - I guess the firmware authors thought that
1600		 * meant that the BB may have gone deaf or something.
1601		 */
1602	default:
1603		device_printf(sc->sc_dev,
1604		    "%s: received notification code=0x%02x len=%d\n",
1605		    __func__,
1606		    hdr->code, hdr->len);
1607	}
1608}
1609
1610void
1611otus_sub_rxeof(struct otus_softc *sc, uint8_t *buf, int len, struct mbufq *rxq)
1612{
1613	struct ieee80211com *ic = &sc->sc_ic;
1614	struct ieee80211_rx_stats rxs;
1615#if 0
1616	struct ieee80211_node *ni;
1617#endif
1618	struct ar_rx_tail *tail;
1619	struct ieee80211_frame *wh;
1620	struct mbuf *m;
1621	uint8_t *plcp;
1622//	int s;
1623	int mlen;
1624
1625	if (__predict_false(len < AR_PLCP_HDR_LEN)) {
1626		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1627		    "sub-xfer too short %d\n", len);
1628		return;
1629	}
1630	plcp = buf;
1631
1632	/* All bits in the PLCP header are set to 1 for non-MPDU. */
1633	if (memcmp(plcp, AR_PLCP_HDR_INTR, AR_PLCP_HDR_LEN) == 0) {
1634		otus_cmd_rxeof(sc, plcp + AR_PLCP_HDR_LEN,
1635		    len - AR_PLCP_HDR_LEN);
1636		return;
1637	}
1638
1639	/* Received MPDU. */
1640	if (__predict_false(len < AR_PLCP_HDR_LEN + sizeof (*tail))) {
1641		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "MPDU too short %d\n", len);
1642		counter_u64_add(ic->ic_ierrors, 1);
1643		return;
1644	}
1645	tail = (struct ar_rx_tail *)(plcp + len - sizeof (*tail));
1646
1647	/* Discard error frames. */
1648	if (__predict_false(tail->error != 0)) {
1649		OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "error frame 0x%02x\n", tail->error);
1650		if (tail->error & AR_RX_ERROR_FCS) {
1651			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE, "bad FCS\n");
1652		} else if (tail->error & AR_RX_ERROR_MMIC) {
1653			/* Report Michael MIC failures to net80211. */
1654#if 0
1655			ieee80211_notify_michael_failure(ni->ni_vap, wh, keyidx);
1656#endif
1657			device_printf(sc->sc_dev, "%s: MIC failure\n", __func__);
1658		}
1659		counter_u64_add(ic->ic_ierrors, 1);
1660		return;
1661	}
1662	/* Compute MPDU's length. */
1663	mlen = len - AR_PLCP_HDR_LEN - sizeof (*tail);
1664	/* Make sure there's room for an 802.11 header + FCS. */
1665	if (__predict_false(mlen < IEEE80211_MIN_LEN)) {
1666		counter_u64_add(ic->ic_ierrors, 1);
1667		return;
1668	}
1669	mlen -= IEEE80211_CRC_LEN;	/* strip 802.11 FCS */
1670
1671	wh = (struct ieee80211_frame *)(plcp + AR_PLCP_HDR_LEN);
1672
1673	m = m_get2(mlen, M_NOWAIT, MT_DATA, M_PKTHDR);
1674	if (m == NULL) {
1675		device_printf(sc->sc_dev, "%s: failed m_get2()\n", __func__);
1676		counter_u64_add(ic->ic_ierrors, 1);
1677	}
1678
1679	/* Finalize mbuf. */
1680	memcpy(mtod(m, uint8_t *), wh, mlen);
1681	m->m_pkthdr.len = m->m_len = mlen;
1682
1683#if 0
1684	if (__predict_false(sc->sc_drvbpf != NULL)) {
1685		struct otus_rx_radiotap_header *tap = &sc->sc_rxtap;
1686		struct mbuf mb;
1687
1688		tap->wr_flags = 0;
1689		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1690		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1691		tap->wr_antsignal = tail->rssi;
1692		tap->wr_rate = 2;	/* In case it can't be found below. */
1693		switch (tail->status & AR_RX_STATUS_MT_MASK) {
1694		case AR_RX_STATUS_MT_CCK:
1695			switch (plcp[0]) {
1696			case  10: tap->wr_rate =   2; break;
1697			case  20: tap->wr_rate =   4; break;
1698			case  55: tap->wr_rate =  11; break;
1699			case 110: tap->wr_rate =  22; break;
1700			}
1701			if (tail->status & AR_RX_STATUS_SHPREAMBLE)
1702				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1703			break;
1704		case AR_RX_STATUS_MT_OFDM:
1705			switch (plcp[0] & 0xf) {
1706			case 0xb: tap->wr_rate =  12; break;
1707			case 0xf: tap->wr_rate =  18; break;
1708			case 0xa: tap->wr_rate =  24; break;
1709			case 0xe: tap->wr_rate =  36; break;
1710			case 0x9: tap->wr_rate =  48; break;
1711			case 0xd: tap->wr_rate =  72; break;
1712			case 0x8: tap->wr_rate =  96; break;
1713			case 0xc: tap->wr_rate = 108; break;
1714			}
1715			break;
1716		}
1717		mb.m_data = (caddr_t)tap;
1718		mb.m_next = m;
1719		mb.m_nextpkt = NULL;
1720		mb.m_type = 0;
1721		mb.m_flags = 0;
1722		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1723	}
1724#endif
1725
1726	/* Add RSSI/NF to this mbuf */
1727	bzero(&rxs, sizeof(rxs));
1728	rxs.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
1729	rxs.nf = sc->sc_nf[0];	/* XXX chain 0 != combined rssi/nf */
1730	rxs.rssi = tail->rssi;
1731	/* XXX TODO: add MIMO RSSI/NF as well */
1732	ieee80211_add_rx_params(m, &rxs);
1733
1734	/* XXX make a method */
1735	STAILQ_INSERT_TAIL(&rxq->mq_head, m, m_stailqpkt);
1736
1737#if 0
1738	OTUS_UNLOCK(sc);
1739	ni = ieee80211_find_rxnode(ic, wh);
1740	rxi.rxi_flags = 0;
1741	rxi.rxi_rssi = tail->rssi;
1742	rxi.rxi_tstamp = 0;	/* unused */
1743	ieee80211_input(ifp, m, ni, &rxi);
1744
1745	/* Node is no longer needed. */
1746	ieee80211_release_node(ic, ni);
1747	OTUS_LOCK(sc);
1748#endif
1749}
1750
1751static void
1752otus_rxeof(struct usb_xfer *xfer, struct otus_data *data, struct mbufq *rxq)
1753{
1754	struct otus_softc *sc = usbd_xfer_softc(xfer);
1755	caddr_t buf = data->buf;
1756	struct ar_rx_head *head;
1757	uint16_t hlen;
1758	int len;
1759
1760	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
1761
1762	while (len >= sizeof (*head)) {
1763		head = (struct ar_rx_head *)buf;
1764		if (__predict_false(head->tag != htole16(AR_RX_HEAD_TAG))) {
1765			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1766			    "tag not valid 0x%x\n", le16toh(head->tag));
1767			break;
1768		}
1769		hlen = le16toh(head->len);
1770		if (__predict_false(sizeof (*head) + hlen > len)) {
1771			OTUS_DPRINTF(sc, OTUS_DEBUG_RXDONE,
1772			    "xfer too short %d/%d\n", len, hlen);
1773			break;
1774		}
1775		/* Process sub-xfer. */
1776		otus_sub_rxeof(sc, (uint8_t *)&head[1], hlen, rxq);
1777
1778		/* Next sub-xfer is aligned on a 32-bit boundary. */
1779		hlen = (sizeof (*head) + hlen + 3) & ~3;
1780		buf += hlen;
1781		len -= hlen;
1782	}
1783}
1784
1785static void
1786otus_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1787{
1788	struct otus_softc *sc = usbd_xfer_softc(xfer);
1789	struct ieee80211com *ic = &sc->sc_ic;
1790	struct ieee80211_frame *wh;
1791	struct ieee80211_node *ni;
1792	struct mbuf *m;
1793	struct mbufq scrx;
1794	struct otus_data *data;
1795
1796	OTUS_LOCK_ASSERT(sc);
1797
1798	mbufq_init(&scrx, 1024);
1799
1800#if 0
1801	device_printf(sc->sc_dev, "%s: called; state=%d; error=%d\n",
1802	    __func__,
1803	    USB_GET_STATE(xfer),
1804	    error);
1805#endif
1806
1807	switch (USB_GET_STATE(xfer)) {
1808	case USB_ST_TRANSFERRED:
1809		data = STAILQ_FIRST(&sc->sc_rx_active);
1810		if (data == NULL)
1811			goto tr_setup;
1812		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1813		otus_rxeof(xfer, data, &scrx);
1814		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1815		/* FALLTHROUGH */
1816	case USB_ST_SETUP:
1817tr_setup:
1818		/*
1819		 * XXX TODO: what if sc_rx isn't empty, but data
1820		 * is empty?  Then we leak mbufs.
1821		 */
1822		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1823		if (data == NULL) {
1824			//KASSERT(m == NULL, ("mbuf isn't NULL"));
1825			return;
1826		}
1827		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1828		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1829		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1830		    usbd_xfer_max_len(xfer));
1831		usbd_transfer_submit(xfer);
1832		/*
1833		 * To avoid LOR we should unlock our private mutex here to call
1834		 * ieee80211_input() because here is at the end of a USB
1835		 * callback and safe to unlock.
1836		 */
1837		OTUS_UNLOCK(sc);
1838		while ((m = mbufq_dequeue(&scrx)) != NULL) {
1839			wh = mtod(m, struct ieee80211_frame *);
1840			ni = ieee80211_find_rxnode(ic,
1841			    (struct ieee80211_frame_min *)wh);
1842			if (ni != NULL) {
1843				if (ni->ni_flags & IEEE80211_NODE_HT)
1844					m->m_flags |= M_AMPDU;
1845				(void)ieee80211_input_mimo(ni, m, NULL);
1846				ieee80211_free_node(ni);
1847			} else
1848				(void)ieee80211_input_mimo_all(ic, m, NULL);
1849		}
1850#ifdef	IEEE80211_SUPPORT_SUPERG
1851		ieee80211_ff_age_all(ic, 100);
1852#endif
1853		OTUS_LOCK(sc);
1854		break;
1855	default:
1856		/* needs it to the inactive queue due to a error. */
1857		data = STAILQ_FIRST(&sc->sc_rx_active);
1858		if (data != NULL) {
1859			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1860			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1861		}
1862		if (error != USB_ERR_CANCELLED) {
1863			usbd_xfer_set_stall(xfer);
1864			counter_u64_add(ic->ic_ierrors, 1);
1865			goto tr_setup;
1866		}
1867		break;
1868	}
1869}
1870
1871static void
1872otus_txeof(struct usb_xfer *xfer, struct otus_data *data)
1873{
1874	struct otus_softc *sc = usbd_xfer_softc(xfer);
1875
1876	OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1877	    "%s: called; data=%p\n", __func__, data);
1878
1879	OTUS_LOCK_ASSERT(sc);
1880
1881	if (sc->sc_tx_n_active == 0) {
1882		device_printf(sc->sc_dev,
1883		    "%s: completed but tx_active=0\n",
1884		    __func__);
1885	} else {
1886		sc->sc_tx_n_active--;
1887	}
1888
1889	if (data->m) {
1890		/* XXX status? */
1891		/* XXX we get TX status via the RX path.. */
1892		ieee80211_tx_complete(data->ni, data->m, 0);
1893		data->m = NULL;
1894		data->ni = NULL;
1895	}
1896}
1897
1898static void
1899otus_txcmdeof(struct usb_xfer *xfer, struct otus_tx_cmd *cmd)
1900{
1901	struct otus_softc *sc = usbd_xfer_softc(xfer);
1902
1903	OTUS_LOCK_ASSERT(sc);
1904
1905	OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
1906	    "%s: called; data=%p; odata=%p\n",
1907	    __func__, cmd, cmd->odata);
1908
1909	/*
1910	 * Non-response commands still need wakeup so the caller
1911	 * knows it was submitted and completed OK; response commands should
1912	 * wait until they're ACKed by the firmware with a response.
1913	 */
1914	if (cmd->odata) {
1915		STAILQ_INSERT_TAIL(&sc->sc_cmd_waiting, cmd, next_cmd);
1916	} else {
1917		wakeup(cmd);
1918		otus_free_txcmd(sc, cmd);
1919	}
1920}
1921
1922static void
1923otus_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1924{
1925	uint8_t which = OTUS_BULK_TX;
1926	struct otus_softc *sc = usbd_xfer_softc(xfer);
1927	struct ieee80211com *ic = &sc->sc_ic;
1928	struct otus_data *data;
1929
1930	OTUS_LOCK_ASSERT(sc);
1931
1932	switch (USB_GET_STATE(xfer)) {
1933	case USB_ST_TRANSFERRED:
1934		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1935		if (data == NULL)
1936			goto tr_setup;
1937		OTUS_DPRINTF(sc, OTUS_DEBUG_TXDONE,
1938		    "%s: transfer done %p\n", __func__, data);
1939		STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1940		otus_txeof(xfer, data);
1941		otus_freebuf(sc, data);
1942		/* FALLTHROUGH */
1943	case USB_ST_SETUP:
1944tr_setup:
1945		data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
1946		if (data == NULL) {
1947			OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1948			    "%s: empty pending queue sc %p\n", __func__, sc);
1949			sc->sc_tx_n_active = 0;
1950			goto finish;
1951		}
1952		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
1953		STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
1954		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1955		OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
1956		    "%s: submitting transfer %p\n", __func__, data);
1957		usbd_transfer_submit(xfer);
1958		sc->sc_tx_n_active++;
1959		break;
1960	default:
1961		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
1962		if (data != NULL) {
1963			STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
1964			otus_txeof(xfer, data);
1965			otus_freebuf(sc, data);
1966		}
1967		counter_u64_add(ic->ic_oerrors, 1);
1968
1969		if (error != USB_ERR_CANCELLED) {
1970			usbd_xfer_set_stall(xfer);
1971			goto tr_setup;
1972		}
1973		break;
1974	}
1975
1976finish:
1977#ifdef	IEEE80211_SUPPORT_SUPERG
1978	/*
1979	 * If the TX active queue drops below a certain
1980	 * threshold, ensure we age fast-frames out so they're
1981	 * transmitted.
1982	 */
1983	if (sc->sc_tx_n_active < 2) {
1984		/* XXX ew - net80211 should defer this for us! */
1985		OTUS_UNLOCK(sc);
1986		ieee80211_ff_flush(ic, WME_AC_VO);
1987		ieee80211_ff_flush(ic, WME_AC_VI);
1988		ieee80211_ff_flush(ic, WME_AC_BE);
1989		ieee80211_ff_flush(ic, WME_AC_BK);
1990		OTUS_LOCK(sc);
1991	}
1992#endif
1993	/* Kick TX */
1994	otus_tx_start(sc);
1995}
1996
1997static void
1998otus_bulk_cmd_callback(struct usb_xfer *xfer, usb_error_t error)
1999{
2000	struct otus_softc *sc = usbd_xfer_softc(xfer);
2001#if 0
2002	struct ieee80211com *ic = &sc->sc_ic;
2003#endif
2004	struct otus_tx_cmd *cmd;
2005
2006	OTUS_LOCK_ASSERT(sc);
2007
2008	switch (USB_GET_STATE(xfer)) {
2009	case USB_ST_TRANSFERRED:
2010		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2011		if (cmd == NULL)
2012			goto tr_setup;
2013		OTUS_DPRINTF(sc, OTUS_DEBUG_CMDDONE,
2014		    "%s: transfer done %p\n", __func__, cmd);
2015		STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2016		otus_txcmdeof(xfer, cmd);
2017		/* FALLTHROUGH */
2018	case USB_ST_SETUP:
2019tr_setup:
2020		cmd = STAILQ_FIRST(&sc->sc_cmd_pending);
2021		if (cmd == NULL) {
2022			OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2023			    "%s: empty pending queue sc %p\n", __func__, sc);
2024			return;
2025		}
2026		STAILQ_REMOVE_HEAD(&sc->sc_cmd_pending, next_cmd);
2027		STAILQ_INSERT_TAIL(&sc->sc_cmd_active, cmd, next_cmd);
2028		usbd_xfer_set_frame_data(xfer, 0, cmd->buf, cmd->buflen);
2029		OTUS_DPRINTF(sc, OTUS_DEBUG_CMD,
2030		    "%s: submitting transfer %p; buf=%p, buflen=%d\n", __func__, cmd, cmd->buf, cmd->buflen);
2031		usbd_transfer_submit(xfer);
2032		break;
2033	default:
2034		cmd = STAILQ_FIRST(&sc->sc_cmd_active);
2035		if (cmd != NULL) {
2036			STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next_cmd);
2037			otus_txcmdeof(xfer, cmd);
2038		}
2039
2040		if (error != USB_ERR_CANCELLED) {
2041			usbd_xfer_set_stall(xfer);
2042			goto tr_setup;
2043		}
2044		break;
2045	}
2046}
2047
2048/*
2049 * This isn't used by carl9170; it however may be used by the
2050 * initial bootloader.
2051 */
2052static void
2053otus_bulk_irq_callback(struct usb_xfer *xfer, usb_error_t error)
2054{
2055	struct otus_softc *sc = usbd_xfer_softc(xfer);
2056	int actlen;
2057	int sumlen;
2058
2059	usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
2060	OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2061	    "%s: called; state=%d\n", __func__, USB_GET_STATE(xfer));
2062
2063	switch (USB_GET_STATE(xfer)) {
2064	case USB_ST_TRANSFERRED:
2065		/*
2066		 * Read usb frame data, if any.
2067		 * "actlen" has the total length for all frames
2068		 * transferred.
2069		 */
2070		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ,
2071		    "%s: comp; %d bytes\n",
2072		    __func__,
2073		    actlen);
2074#if 0
2075		pc = usbd_xfer_get_frame(xfer, 0);
2076		otus_dump_usb_rx_page(sc, pc, actlen);
2077#endif
2078		/* XXX fallthrough */
2079	case USB_ST_SETUP:
2080		/*
2081		 * Setup xfer frame lengths/count and data
2082		 */
2083		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: setup\n", __func__);
2084		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2085		usbd_transfer_submit(xfer);
2086		break;
2087
2088	default: /* Error */
2089		/*
2090		 * Print error message and clear stall
2091		 * for example.
2092		 */
2093		OTUS_DPRINTF(sc, OTUS_DEBUG_IRQ, "%s: ERROR?\n", __func__);
2094		break;
2095	}
2096}
2097
2098/*
2099 * Map net80211 rate to hw rate for otus MAC/PHY.
2100 */
2101static uint8_t
2102otus_rate_to_hw_rate(struct otus_softc *sc, uint8_t rate)
2103{
2104	int is_2ghz;
2105
2106	is_2ghz = !! (IEEE80211_IS_CHAN_2GHZ(sc->sc_ic.ic_curchan));
2107
2108	switch (rate) {
2109	/* CCK */
2110	case 2:
2111		return (0x0);
2112	case 4:
2113		return (0x1);
2114	case 11:
2115		return (0x2);
2116	case 22:
2117		return (0x3);
2118	/* OFDM */
2119	case 12:
2120		return (0xb);
2121	case 18:
2122		return (0xf);
2123	case 24:
2124		return (0xa);
2125	case 36:
2126		return (0xe);
2127	case 48:
2128		return (0x9);
2129	case 72:
2130		return (0xd);
2131	case 96:
2132		return (0x8);
2133	case 108:
2134		return (0xc);
2135	default:
2136		device_printf(sc->sc_dev, "%s: unknown rate '%d'\n",
2137		    __func__, (int) rate);
2138	case 0:
2139		if (is_2ghz)
2140			return (0x0);	/* 1MB CCK */
2141		else
2142			return (0xb);	/* 6MB OFDM */
2143
2144	/* XXX TODO: HT */
2145	}
2146}
2147
2148static int
2149otus_hw_rate_is_ofdm(struct otus_softc *sc, uint8_t hw_rate)
2150{
2151
2152	switch (hw_rate) {
2153	case 0x0:
2154	case 0x1:
2155	case 0x2:
2156	case 0x3:
2157		return (0);
2158	default:
2159		return (1);
2160	}
2161}
2162
2163
2164static void
2165otus_tx_update_ratectl(struct otus_softc *sc, struct ieee80211_node *ni)
2166{
2167	int tx, tx_success, tx_retry;
2168
2169	tx = OTUS_NODE(ni)->tx_done;
2170	tx_success = OTUS_NODE(ni)->tx_done - OTUS_NODE(ni)->tx_err;
2171	tx_retry = OTUS_NODE(ni)->tx_retries;
2172
2173	ieee80211_ratectl_tx_update(ni->ni_vap, ni, &tx, &tx_success,
2174	    &tx_retry);
2175}
2176
2177/*
2178 * XXX TODO: support tx bpf parameters for configuration!
2179 *
2180 * Relevant pieces:
2181 *
2182 * ac = params->ibp_pri & 3;
2183 * rate = params->ibp_rate0;
2184 * params->ibp_flags & IEEE80211_BPF_NOACK
2185 * params->ibp_flags & IEEE80211_BPF_RTS
2186 * params->ibp_flags & IEEE80211_BPF_CTS
2187 * tx->rts_ntries = params->ibp_try1;
2188 * tx->data_ntries = params->ibp_try0;
2189 */
2190static int
2191otus_tx(struct otus_softc *sc, struct ieee80211_node *ni, struct mbuf *m,
2192    struct otus_data *data, const struct ieee80211_bpf_params *params)
2193{
2194	struct ieee80211com *ic = &sc->sc_ic;
2195	struct ieee80211vap *vap = ni->ni_vap;
2196	struct ieee80211_frame *wh;
2197	struct ieee80211_key *k;
2198	struct ar_tx_head *head;
2199	uint32_t phyctl;
2200	uint16_t macctl, qos;
2201	uint8_t qid, rate;
2202	int hasqos, xferlen;
2203
2204	wh = mtod(m, struct ieee80211_frame *);
2205	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2206		k = ieee80211_crypto_encap(ni, m);
2207		if (k == NULL) {
2208			device_printf(sc->sc_dev,
2209			    "%s: m=%p: ieee80211_crypto_encap returns NULL\n",
2210			    __func__,
2211			    m);
2212			return (ENOBUFS);
2213		}
2214		wh = mtod(m, struct ieee80211_frame *);
2215	}
2216
2217	/* Calculate transfer length; ensure data buffer is large enough */
2218	xferlen = sizeof (*head) + m->m_pkthdr.len;
2219	if (xferlen > OTUS_TXBUFSZ) {
2220		device_printf(sc->sc_dev,
2221		    "%s: 802.11 TX frame is %d bytes, max %d bytes\n",
2222		    __func__,
2223		    xferlen,
2224		    OTUS_TXBUFSZ);
2225		return (ENOBUFS);
2226	}
2227
2228	hasqos = !! IEEE80211_QOS_HAS_SEQ(wh);
2229
2230	if (hasqos) {
2231		uint8_t tid;
2232		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2233		tid = qos & IEEE80211_QOS_TID;
2234		qid = TID_TO_WME_AC(tid);
2235	} else {
2236		qos = 0;
2237		qid = WME_AC_BE;
2238	}
2239
2240	/* Pickup a rate index. */
2241	if (params != NULL) {
2242		rate = otus_rate_to_hw_rate(sc, params->ibp_rate0);
2243	} else if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2244	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA) {
2245		/* Get lowest rate */
2246		rate = otus_rate_to_hw_rate(sc, 0);
2247	} else if (m->m_flags & M_EAPOL) {
2248		/* Get lowest rate */
2249		rate = otus_rate_to_hw_rate(sc, 0);
2250	} else {
2251		(void) ieee80211_ratectl_rate(ni, NULL, 0);
2252		rate = otus_rate_to_hw_rate(sc, ni->ni_txrate);
2253	}
2254
2255	phyctl = 0;
2256	macctl = AR_TX_MAC_BACKOFF | AR_TX_MAC_HW_DUR | AR_TX_MAC_QID(qid);
2257
2258	/*
2259	 * XXX TODO: params for NOACK, ACK, RTS, CTS, etc
2260	 */
2261	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2262	    (hasqos && ((qos & IEEE80211_QOS_ACKPOLICY) ==
2263	     IEEE80211_QOS_ACKPOLICY_NOACK)))
2264		macctl |= AR_TX_MAC_NOACK;
2265
2266	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2267		if (m->m_pkthdr.len + IEEE80211_CRC_LEN >= vap->iv_rtsthreshold)
2268			macctl |= AR_TX_MAC_RTS;
2269		else if (ic->ic_flags & IEEE80211_F_USEPROT) {
2270			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2271				macctl |= AR_TX_MAC_CTS;
2272			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2273				macctl |= AR_TX_MAC_RTS;
2274		}
2275	}
2276
2277	phyctl |= AR_TX_PHY_MCS(rate);
2278	if (otus_hw_rate_is_ofdm(sc, rate)) {
2279		phyctl |= AR_TX_PHY_MT_OFDM;
2280		/* Always use all tx antennas for now, just to be safe */
2281		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2282	} else {	/* CCK */
2283		phyctl |= AR_TX_PHY_MT_CCK;
2284		phyctl |= AR_TX_PHY_ANTMSK(sc->txmask);
2285	}
2286
2287	/* Update net80211 with the current counters */
2288	otus_tx_update_ratectl(sc, ni);
2289
2290	/* Update rate control stats for frames that are ACK'ed. */
2291	if (!(macctl & AR_TX_MAC_NOACK))
2292		OTUS_NODE(ni)->tx_done++;
2293
2294
2295	/* Fill Tx descriptor. */
2296	head = (struct ar_tx_head *)data->buf;
2297	head->len = htole16(m->m_pkthdr.len + IEEE80211_CRC_LEN);
2298	head->macctl = htole16(macctl);
2299	head->phyctl = htole32(phyctl);
2300
2301	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&head[1]);
2302
2303	data->buflen = xferlen;
2304	data->ni = ni;
2305	data->m = m;
2306
2307	OTUS_DPRINTF(sc, OTUS_DEBUG_XMIT,
2308	    "%s: tx: m=%p; data=%p; len=%d mac=0x%04x phy=0x%08x rate=0x%02x, ni_txrate=%d\n",
2309	    __func__, m, data, le16toh(head->len), macctl, phyctl,
2310	    (int) rate, (int) ni->ni_txrate);
2311
2312	/* Submit transfer */
2313	STAILQ_INSERT_TAIL(&sc->sc_tx_pending[OTUS_BULK_TX], data, next);
2314	usbd_transfer_start(sc->sc_xfer[OTUS_BULK_TX]);
2315
2316	return 0;
2317}
2318
2319int
2320otus_set_multi(struct otus_softc *sc)
2321{
2322	uint32_t lo, hi;
2323	struct ieee80211com *ic = &sc->sc_ic;
2324	int r;
2325
2326	if (ic->ic_allmulti > 0 || ic->ic_promisc > 0 ||
2327	    ic->ic_opmode == IEEE80211_M_MONITOR) {
2328		lo = 0xffffffff;
2329		hi = 0xffffffff;
2330	} else {
2331		struct ieee80211vap *vap;
2332		struct ifnet *ifp;
2333		struct ifmultiaddr *ifma;
2334
2335		lo = hi = 0;
2336		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
2337			ifp = vap->iv_ifp;
2338			if_maddr_rlock(ifp);
2339			TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2340				caddr_t dl;
2341				uint32_t val;
2342
2343				dl = LLADDR((struct sockaddr_dl *) ifma->ifma_addr);
2344				val = LE_READ_4(dl + 4);
2345				/* Get address byte 5 */
2346				val = val & 0x0000ff00;
2347				val = val >> 8;
2348
2349				/* As per below, shift it >> 2 to get only 6 bits */
2350				val = val >> 2;
2351				if (val < 32)
2352					lo |= 1 << val;
2353				else
2354					hi |= 1 << (val - 32);
2355			}
2356			if_maddr_runlock(ifp);
2357		}
2358	}
2359#if 0
2360	/* XXX openbsd code */
2361	while (enm != NULL) {
2362		bit = enm->enm_addrlo[5] >> 2;
2363		if (bit < 32)
2364			lo |= 1 << bit;
2365		else
2366			hi |= 1 << (bit - 32);
2367		ETHER_NEXT_MULTI(step, enm);
2368	}
2369#endif
2370
2371	hi |= 1U << 31;	/* Make sure the broadcast bit is set. */
2372
2373	OTUS_LOCK(sc);
2374	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_L, lo);
2375	otus_write(sc, AR_MAC_REG_GROUP_HASH_TBL_H, hi);
2376	r = otus_write_barrier(sc);
2377	OTUS_UNLOCK(sc);
2378	return (r);
2379}
2380
2381static void
2382otus_updateedca(struct otus_softc *sc)
2383{
2384#define EXP2(val)	((1 << (val)) - 1)
2385#define AIFS(val)	((val) * 9 + 10)
2386	struct ieee80211com *ic = &sc->sc_ic;
2387	const struct wmeParams *edca;
2388
2389	OTUS_LOCK_ASSERT(sc);
2390
2391	edca = ic->ic_wme.wme_chanParams.cap_wmeParams;
2392
2393	/* Set CWmin/CWmax values. */
2394	otus_write(sc, AR_MAC_REG_AC0_CW,
2395	    EXP2(edca[WME_AC_BE].wmep_logcwmax) << 16 |
2396	    EXP2(edca[WME_AC_BE].wmep_logcwmin));
2397	otus_write(sc, AR_MAC_REG_AC1_CW,
2398	    EXP2(edca[WME_AC_BK].wmep_logcwmax) << 16 |
2399	    EXP2(edca[WME_AC_BK].wmep_logcwmin));
2400	otus_write(sc, AR_MAC_REG_AC2_CW,
2401	    EXP2(edca[WME_AC_VI].wmep_logcwmax) << 16 |
2402	    EXP2(edca[WME_AC_VI].wmep_logcwmin));
2403	otus_write(sc, AR_MAC_REG_AC3_CW,
2404	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2405	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2406	otus_write(sc, AR_MAC_REG_AC4_CW,		/* Special TXQ. */
2407	    EXP2(edca[WME_AC_VO].wmep_logcwmax) << 16 |
2408	    EXP2(edca[WME_AC_VO].wmep_logcwmin));
2409
2410	/* Set AIFSN values. */
2411	otus_write(sc, AR_MAC_REG_AC1_AC0_AIFS,
2412	    AIFS(edca[WME_AC_VI].wmep_aifsn) << 24 |
2413	    AIFS(edca[WME_AC_BK].wmep_aifsn) << 12 |
2414	    AIFS(edca[WME_AC_BE].wmep_aifsn));
2415	otus_write(sc, AR_MAC_REG_AC3_AC2_AIFS,
2416	    AIFS(edca[WME_AC_VO].wmep_aifsn) << 16 |	/* Special TXQ. */
2417	    AIFS(edca[WME_AC_VO].wmep_aifsn) <<  4 |
2418	    AIFS(edca[WME_AC_VI].wmep_aifsn) >>  8);
2419
2420	/* Set TXOP limit. */
2421	otus_write(sc, AR_MAC_REG_AC1_AC0_TXOP,
2422	    edca[WME_AC_BK].wmep_txopLimit << 16 |
2423	    edca[WME_AC_BE].wmep_txopLimit);
2424	otus_write(sc, AR_MAC_REG_AC3_AC2_TXOP,
2425	    edca[WME_AC_VO].wmep_txopLimit << 16 |
2426	    edca[WME_AC_VI].wmep_txopLimit);
2427
2428	/* XXX ACK policy? */
2429
2430	(void)otus_write_barrier(sc);
2431
2432#undef AIFS
2433#undef EXP2
2434}
2435
2436static void
2437otus_updateslot(struct otus_softc *sc)
2438{
2439	struct ieee80211com *ic = &sc->sc_ic;
2440	uint32_t slottime;
2441
2442	OTUS_LOCK_ASSERT(sc);
2443
2444	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2445	otus_write(sc, AR_MAC_REG_SLOT_TIME, slottime << 10);
2446	(void)otus_write_barrier(sc);
2447}
2448
2449int
2450otus_init_mac(struct otus_softc *sc)
2451{
2452	int error;
2453
2454	OTUS_LOCK_ASSERT(sc);
2455
2456	otus_write(sc, AR_MAC_REG_ACK_EXTENSION, 0x40);
2457	otus_write(sc, AR_MAC_REG_RETRY_MAX, 0);
2458	otus_write(sc, AR_MAC_REG_SNIFFER, 0x2000000);
2459	otus_write(sc, AR_MAC_REG_RX_THRESHOLD, 0xc1f80);
2460	otus_write(sc, AR_MAC_REG_RX_PE_DELAY, 0x70);
2461	otus_write(sc, AR_MAC_REG_EIFS_AND_SIFS, 0xa144000);
2462	otus_write(sc, AR_MAC_REG_SLOT_TIME, 9 << 10);
2463	otus_write(sc, AR_MAC_REG_TID_CFACK_CFEND_RATE, 0x19000000);
2464	/* NAV protects ACK only (in TXOP). */
2465	otus_write(sc, AR_MAC_REG_TXOP_DURATION, 0x201);
2466	/* Set beacon Tx power to 0x7. */
2467	otus_write(sc, AR_MAC_REG_BCN_HT1, 0x8000170);
2468	otus_write(sc, AR_MAC_REG_BACKOFF_PROTECT, 0x105);
2469	otus_write(sc, AR_MAC_REG_AMPDU_FACTOR, 0x10000a);
2470	/* Filter any control frames, BAR is bit 24. */
2471	otus_write(sc, AR_MAC_REG_FRAMETYPE_FILTER, 0x0500ffff);
2472	otus_write(sc, AR_MAC_REG_RX_CONTROL, 0x1);
2473	otus_write(sc, AR_MAC_REG_BASIC_RATE, 0x150f);
2474	otus_write(sc, AR_MAC_REG_MANDATORY_RATE, 0x150f);
2475	otus_write(sc, AR_MAC_REG_RTS_CTS_RATE, 0x10b01bb);
2476	otus_write(sc, AR_MAC_REG_ACK_TPC, 0x4003c1e);
2477	/* Enable LED0 and LED1. */
2478	otus_write(sc, AR_GPIO_REG_PORT_TYPE, 0x3);
2479	otus_write(sc, AR_GPIO_REG_PORT_DATA, 0x3);
2480	/* Switch MAC to OTUS interface. */
2481	otus_write(sc, 0x1c3600, 0x3);
2482	otus_write(sc, AR_MAC_REG_AMPDU_RX_THRESH, 0xffff);
2483	otus_write(sc, AR_MAC_REG_MISC_680, 0xf00008);
2484	/* Disable Rx timeout (workaround). */
2485	otus_write(sc, AR_MAC_REG_RX_TIMEOUT, 0);
2486
2487	/* Set USB Rx stream mode maximum frame number to 2. */
2488	otus_write(sc, 0x1e1110, 0x4);
2489	/* Set USB Rx stream mode timeout to 10us. */
2490	otus_write(sc, 0x1e1114, 0x80);
2491
2492	/* Set clock frequency to 88/80MHz. */
2493	otus_write(sc, AR_PWR_REG_CLOCK_SEL, 0x73);
2494	/* Set WLAN DMA interrupt mode: generate intr per packet. */
2495	otus_write(sc, AR_MAC_REG_TXRX_MPI, 0x110011);
2496	otus_write(sc, AR_MAC_REG_FCS_SELECT, 0x4);
2497	otus_write(sc, AR_MAC_REG_TXOP_NOT_ENOUGH_INDICATION, 0x141e0f48);
2498
2499	/* Disable HW decryption for now. */
2500	otus_write(sc, AR_MAC_REG_ENCRYPTION, 0x78);
2501
2502	if ((error = otus_write_barrier(sc)) != 0)
2503		return error;
2504
2505	/* Set default EDCA parameters. */
2506	otus_updateedca(sc);
2507
2508	return 0;
2509}
2510
2511/*
2512 * Return default value for PHY register based on current operating mode.
2513 */
2514uint32_t
2515otus_phy_get_def(struct otus_softc *sc, uint32_t reg)
2516{
2517	int i;
2518
2519	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2520		if (AR_PHY(ar5416_phy_regs[i]) == reg)
2521			return sc->phy_vals[i];
2522	return 0;	/* Register not found. */
2523}
2524
2525/*
2526 * Update PHY's programming based on vendor-specific data stored in EEPROM.
2527 * This is for FEM-type devices only.
2528 */
2529int
2530otus_set_board_values(struct otus_softc *sc, struct ieee80211_channel *c)
2531{
2532	const struct ModalEepHeader *eep;
2533	uint32_t tmp, offset;
2534
2535	if (IEEE80211_IS_CHAN_5GHZ(c))
2536		eep = &sc->eeprom.modalHeader[0];
2537	else
2538		eep = &sc->eeprom.modalHeader[1];
2539
2540	/* Offset of chain 2. */
2541	offset = 2 * 0x1000;
2542
2543	tmp = le32toh(eep->antCtrlCommon);
2544	otus_write(sc, AR_PHY_SWITCH_COM, tmp);
2545
2546	tmp = le32toh(eep->antCtrlChain[0]);
2547	otus_write(sc, AR_PHY_SWITCH_CHAIN_0, tmp);
2548
2549	tmp = le32toh(eep->antCtrlChain[1]);
2550	otus_write(sc, AR_PHY_SWITCH_CHAIN_0 + offset, tmp);
2551
2552	if (1 /* sc->sc_sco == AR_SCO_SCN */) {
2553		tmp = otus_phy_get_def(sc, AR_PHY_SETTLING);
2554		tmp &= ~(0x7f << 7);
2555		tmp |= (eep->switchSettling & 0x7f) << 7;
2556		otus_write(sc, AR_PHY_SETTLING, tmp);
2557	}
2558
2559	tmp = otus_phy_get_def(sc, AR_PHY_DESIRED_SZ);
2560	tmp &= ~0xffff;
2561	tmp |= eep->pgaDesiredSize << 8 | eep->adcDesiredSize;
2562	otus_write(sc, AR_PHY_DESIRED_SZ, tmp);
2563
2564	tmp = eep->txEndToXpaOff << 24 | eep->txEndToXpaOff << 16 |
2565	      eep->txFrameToXpaOn << 8 | eep->txFrameToXpaOn;
2566	otus_write(sc, AR_PHY_RF_CTL4, tmp);
2567
2568	tmp = otus_phy_get_def(sc, AR_PHY_RF_CTL3);
2569	tmp &= ~(0xff << 16);
2570	tmp |= eep->txEndToRxOn << 16;
2571	otus_write(sc, AR_PHY_RF_CTL3, tmp);
2572
2573	tmp = otus_phy_get_def(sc, AR_PHY_CCA);
2574	tmp &= ~(0x7f << 12);
2575	tmp |= (eep->thresh62 & 0x7f) << 12;
2576	otus_write(sc, AR_PHY_CCA, tmp);
2577
2578	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN);
2579	tmp &= ~(0x3f << 12);
2580	tmp |= (eep->txRxAttenCh[0] & 0x3f) << 12;
2581	otus_write(sc, AR_PHY_RXGAIN, tmp);
2582
2583	tmp = otus_phy_get_def(sc, AR_PHY_RXGAIN + offset);
2584	tmp &= ~(0x3f << 12);
2585	tmp |= (eep->txRxAttenCh[1] & 0x3f) << 12;
2586	otus_write(sc, AR_PHY_RXGAIN + offset, tmp);
2587
2588	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ);
2589	tmp &= ~(0x3f << 18);
2590	tmp |= (eep->rxTxMarginCh[0] & 0x3f) << 18;
2591	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2592		tmp &= ~(0xf << 10);
2593		tmp |= (eep->bswMargin[0] & 0xf) << 10;
2594	}
2595	otus_write(sc, AR_PHY_GAIN_2GHZ, tmp);
2596
2597	tmp = otus_phy_get_def(sc, AR_PHY_GAIN_2GHZ + offset);
2598	tmp &= ~(0x3f << 18);
2599	tmp |= (eep->rxTxMarginCh[1] & 0x3f) << 18;
2600	otus_write(sc, AR_PHY_GAIN_2GHZ + offset, tmp);
2601
2602	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4);
2603	tmp &= ~(0x3f << 5 | 0x1f);
2604	tmp |= (eep->iqCalICh[0] & 0x3f) << 5 | (eep->iqCalQCh[0] & 0x1f);
2605	otus_write(sc, AR_PHY_TIMING_CTRL4, tmp);
2606
2607	tmp = otus_phy_get_def(sc, AR_PHY_TIMING_CTRL4 + offset);
2608	tmp &= ~(0x3f << 5 | 0x1f);
2609	tmp |= (eep->iqCalICh[1] & 0x3f) << 5 | (eep->iqCalQCh[1] & 0x1f);
2610	otus_write(sc, AR_PHY_TIMING_CTRL4 + offset, tmp);
2611
2612	tmp = otus_phy_get_def(sc, AR_PHY_TPCRG1);
2613	tmp &= ~(0xf << 16);
2614	tmp |= (eep->xpd & 0xf) << 16;
2615	otus_write(sc, AR_PHY_TPCRG1, tmp);
2616
2617	return otus_write_barrier(sc);
2618}
2619
2620int
2621otus_program_phy(struct otus_softc *sc, struct ieee80211_channel *c)
2622{
2623	const uint32_t *vals;
2624	int error, i;
2625
2626	/* Select PHY programming based on band and bandwidth. */
2627	if (IEEE80211_IS_CHAN_2GHZ(c))
2628		vals = ar5416_phy_vals_2ghz_20mhz;
2629	else
2630		vals = ar5416_phy_vals_5ghz_20mhz;
2631	for (i = 0; i < nitems(ar5416_phy_regs); i++)
2632		otus_write(sc, AR_PHY(ar5416_phy_regs[i]), vals[i]);
2633	sc->phy_vals = vals;
2634
2635	if (sc->eeprom.baseEepHeader.deviceType == 0x80)	/* FEM */
2636		if ((error = otus_set_board_values(sc, c)) != 0)
2637			return error;
2638
2639	/* Initial Tx power settings. */
2640	otus_write(sc, AR_PHY_POWER_TX_RATE_MAX, 0x7f);
2641	otus_write(sc, AR_PHY_POWER_TX_RATE1, 0x3f3f3f3f);
2642	otus_write(sc, AR_PHY_POWER_TX_RATE2, 0x3f3f3f3f);
2643	otus_write(sc, AR_PHY_POWER_TX_RATE3, 0x3f3f3f3f);
2644	otus_write(sc, AR_PHY_POWER_TX_RATE4, 0x3f3f3f3f);
2645	otus_write(sc, AR_PHY_POWER_TX_RATE5, 0x3f3f3f3f);
2646	otus_write(sc, AR_PHY_POWER_TX_RATE6, 0x3f3f3f3f);
2647	otus_write(sc, AR_PHY_POWER_TX_RATE7, 0x3f3f3f3f);
2648	otus_write(sc, AR_PHY_POWER_TX_RATE8, 0x3f3f3f3f);
2649	otus_write(sc, AR_PHY_POWER_TX_RATE9, 0x3f3f3f3f);
2650
2651	if (IEEE80211_IS_CHAN_2GHZ(c))
2652		otus_write(sc, AR_PWR_REG_PLL_ADDAC, 0x5163);
2653	else
2654		otus_write(sc, AR_PWR_REG_PLL_ADDAC, 0x5143);
2655
2656	return otus_write_barrier(sc);
2657}
2658
2659static __inline uint8_t
2660otus_reverse_bits(uint8_t v)
2661{
2662	v = ((v >> 1) & 0x55) | ((v & 0x55) << 1);
2663	v = ((v >> 2) & 0x33) | ((v & 0x33) << 2);
2664	v = ((v >> 4) & 0x0f) | ((v & 0x0f) << 4);
2665	return v;
2666}
2667
2668int
2669otus_set_rf_bank4(struct otus_softc *sc, struct ieee80211_channel *c)
2670{
2671	uint8_t chansel, d0, d1;
2672	uint16_t data;
2673	int error;
2674
2675	OTUS_LOCK_ASSERT(sc);
2676
2677	d0 = 0;
2678	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2679		chansel = (c->ic_freq - 4800) / 5;
2680		if (chansel & 1)
2681			d0 |= AR_BANK4_AMODE_REFSEL(2);
2682		else
2683			d0 |= AR_BANK4_AMODE_REFSEL(1);
2684	} else {
2685		d0 |= AR_BANK4_AMODE_REFSEL(2);
2686		if (c->ic_freq == 2484) {	/* CH 14 */
2687			d0 |= AR_BANK4_BMODE_LF_SYNTH_FREQ;
2688			chansel = 10 + (c->ic_freq - 2274) / 5;
2689		} else
2690			chansel = 16 + (c->ic_freq - 2272) / 5;
2691		chansel <<= 2;
2692	}
2693	d0 |= AR_BANK4_ADDR(1) | AR_BANK4_CHUP;
2694	d1 = otus_reverse_bits(chansel);
2695
2696	/* Write bits 0-4 of d0 and d1. */
2697	data = (d1 & 0x1f) << 5 | (d0 & 0x1f);
2698	otus_write(sc, AR_PHY(44), data);
2699	/* Write bits 5-7 of d0 and d1. */
2700	data = (d1 >> 5) << 5 | (d0 >> 5);
2701	otus_write(sc, AR_PHY(58), data);
2702
2703	if ((error = otus_write_barrier(sc)) == 0)
2704		otus_delay_ms(sc, 10);
2705	return error;
2706}
2707
2708void
2709otus_get_delta_slope(uint32_t coeff, uint32_t *exponent, uint32_t *mantissa)
2710{
2711#define COEFF_SCALE_SHIFT	24
2712	uint32_t exp, man;
2713
2714	/* exponent = 14 - floor(log2(coeff)) */
2715	for (exp = 31; exp > 0; exp--)
2716		if (coeff & (1 << exp))
2717			break;
2718	KASSERT(exp != 0, ("exp"));
2719	exp = 14 - (exp - COEFF_SCALE_SHIFT);
2720
2721	/* mantissa = floor(coeff * 2^exponent + 0.5) */
2722	man = coeff + (1 << (COEFF_SCALE_SHIFT - exp - 1));
2723
2724	*mantissa = man >> (COEFF_SCALE_SHIFT - exp);
2725	*exponent = exp - 16;
2726#undef COEFF_SCALE_SHIFT
2727}
2728
2729static int
2730otus_set_chan(struct otus_softc *sc, struct ieee80211_channel *c, int assoc)
2731{
2732	struct ieee80211com *ic = &sc->sc_ic;
2733	struct ar_cmd_frequency cmd;
2734	struct ar_rsp_frequency rsp;
2735	const uint32_t *vals;
2736	uint32_t coeff, exp, man, tmp;
2737	uint8_t code;
2738	int error, chan, i;
2739
2740	error = 0;
2741	chan = ieee80211_chan2ieee(ic, c);
2742
2743	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2744	    "setting channel %d (%dMHz)\n", chan, c->ic_freq);
2745
2746	tmp = IEEE80211_IS_CHAN_2GHZ(c) ? 0x105 : 0x104;
2747	otus_write(sc, AR_MAC_REG_DYNAMIC_SIFS_ACK, tmp);
2748	if ((error = otus_write_barrier(sc)) != 0)
2749		goto finish;
2750
2751	/* Disable BB Heavy Clip. */
2752	otus_write(sc, AR_PHY_HEAVY_CLIP_ENABLE, 0x200);
2753	if ((error = otus_write_barrier(sc)) != 0)
2754		goto finish;
2755
2756	/* XXX Is that FREQ_START ? */
2757	error = otus_cmd(sc, AR_CMD_FREQ_STRAT, NULL, 0, NULL, 0);
2758	if (error != 0)
2759		goto finish;
2760
2761	/* Reprogram PHY and RF on channel band or bandwidth changes. */
2762	if (sc->bb_reset || c->ic_flags != sc->sc_curchan->ic_flags) {
2763		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET, "band switch\n");
2764
2765		/* Cold/Warm reset BB/ADDA. */
2766		otus_write(sc, AR_PWR_REG_RESET, sc->bb_reset ? 0x800 : 0x400);
2767		if ((error = otus_write_barrier(sc)) != 0)
2768			goto finish;
2769		otus_write(sc, AR_PWR_REG_RESET, 0);
2770		if ((error = otus_write_barrier(sc)) != 0)
2771			goto finish;
2772		sc->bb_reset = 0;
2773
2774		if ((error = otus_program_phy(sc, c)) != 0) {
2775			device_printf(sc->sc_dev,
2776			    "%s: could not program PHY\n",
2777			    __func__);
2778			goto finish;
2779		}
2780
2781		/* Select RF programming based on band. */
2782		if (IEEE80211_IS_CHAN_5GHZ(c))
2783			vals = ar5416_banks_vals_5ghz;
2784		else
2785			vals = ar5416_banks_vals_2ghz;
2786		for (i = 0; i < nitems(ar5416_banks_regs); i++)
2787			otus_write(sc, AR_PHY(ar5416_banks_regs[i]), vals[i]);
2788		if ((error = otus_write_barrier(sc)) != 0) {
2789			device_printf(sc->sc_dev,
2790			    "%s: could not program RF\n",
2791			    __func__);
2792			goto finish;
2793		}
2794		code = AR_CMD_RF_INIT;
2795	} else {
2796		code = AR_CMD_FREQUENCY;
2797	}
2798
2799	if ((error = otus_set_rf_bank4(sc, c)) != 0)
2800		goto finish;
2801
2802	tmp = (sc->txmask == 0x5) ? 0x340 : 0x240;
2803	otus_write(sc, AR_PHY_TURBO, tmp);
2804	if ((error = otus_write_barrier(sc)) != 0)
2805		goto finish;
2806
2807	/* Send firmware command to set channel. */
2808	cmd.freq = htole32((uint32_t)c->ic_freq * 1000);
2809	cmd.dynht2040 = htole32(0);
2810	cmd.htena = htole32(1);
2811	/* Set Delta Slope (exponent and mantissa). */
2812	coeff = (100 << 24) / c->ic_freq;
2813	otus_get_delta_slope(coeff, &exp, &man);
2814	cmd.dsc_exp = htole32(exp);
2815	cmd.dsc_man = htole32(man);
2816	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2817	    "ds coeff=%u exp=%u man=%u\n", coeff, exp, man);
2818	/* For Short GI, coeff is 9/10 that of normal coeff. */
2819	coeff = (9 * coeff) / 10;
2820	otus_get_delta_slope(coeff, &exp, &man);
2821	cmd.dsc_shgi_exp = htole32(exp);
2822	cmd.dsc_shgi_man = htole32(man);
2823	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2824	    "ds shgi coeff=%u exp=%u man=%u\n", coeff, exp, man);
2825	/* Set wait time for AGC and noise calibration (100 or 200ms). */
2826	cmd.check_loop_count = assoc ? htole32(2000) : htole32(1000);
2827	OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2828	    "%s\n", (code == AR_CMD_RF_INIT) ? "RF_INIT" : "FREQUENCY");
2829	error = otus_cmd(sc, code, &cmd, sizeof cmd, &rsp, sizeof(rsp));
2830	if (error != 0)
2831		goto finish;
2832	if ((rsp.status & htole32(AR_CAL_ERR_AGC | AR_CAL_ERR_NF_VAL)) != 0) {
2833		OTUS_DPRINTF(sc, OTUS_DEBUG_RESET,
2834		    "status=0x%x\n", le32toh(rsp.status));
2835		/* Force cold reset on next channel. */
2836		sc->bb_reset = 1;
2837	}
2838#ifdef USB_DEBUG
2839	if (otus_debug & OTUS_DEBUG_RESET) {
2840		device_printf(sc->sc_dev, "calibration status=0x%x\n",
2841		    le32toh(rsp.status));
2842		for (i = 0; i < 2; i++) {	/* 2 Rx chains */
2843			/* Sign-extend 9-bit NF values. */
2844			device_printf(sc->sc_dev,
2845			    "noisefloor chain %d=%d\n", i,
2846			    (((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2847			device_printf(sc->sc_dev,
2848			    "noisefloor ext chain %d=%d\n", i,
2849			    ((int32_t)le32toh(rsp.nf_ext[i])) >> 23);
2850		}
2851	}
2852#endif
2853	for (i = 0; i < OTUS_NUM_CHAINS; i++) {
2854		sc->sc_nf[i] = ((((int32_t)le32toh(rsp.nf[i])) << 4) >> 23);
2855	}
2856	sc->sc_curchan = c;
2857finish:
2858	return (error);
2859}
2860
2861#ifdef notyet
2862int
2863otus_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2864    struct ieee80211_key *k)
2865{
2866	struct otus_softc *sc = ic->ic_softc;
2867	struct otus_cmd_key cmd;
2868
2869	/* Defer setting of WEP keys until interface is brought up. */
2870	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
2871	    (IFF_UP | IFF_RUNNING))
2872		return 0;
2873
2874	/* Do it in a process context. */
2875	cmd.key = *k;
2876	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2877	otus_do_async(sc, otus_set_key_cb, &cmd, sizeof cmd);
2878	return 0;
2879}
2880
2881void
2882otus_set_key_cb(struct otus_softc *sc, void *arg)
2883{
2884	struct otus_cmd_key *cmd = arg;
2885	struct ieee80211_key *k = &cmd->key;
2886	struct ar_cmd_ekey key;
2887	uint16_t cipher;
2888	int error;
2889
2890	memset(&key, 0, sizeof key);
2891	if (k->k_flags & IEEE80211_KEY_GROUP) {
2892		key.uid = htole16(k->k_id);
2893		IEEE80211_ADDR_COPY(key.macaddr, sc->sc_ic.ic_myaddr);
2894		key.macaddr[0] |= 0x80;
2895	} else {
2896		key.uid = htole16(OTUS_UID(cmd->associd));
2897		IEEE80211_ADDR_COPY(key.macaddr, ni->ni_macaddr);
2898	}
2899	key.kix = htole16(0);
2900	/* Map net80211 cipher to hardware. */
2901	switch (k->k_cipher) {
2902	case IEEE80211_CIPHER_WEP40:
2903		cipher = AR_CIPHER_WEP64;
2904		break;
2905	case IEEE80211_CIPHER_WEP104:
2906		cipher = AR_CIPHER_WEP128;
2907		break;
2908	case IEEE80211_CIPHER_TKIP:
2909		cipher = AR_CIPHER_TKIP;
2910		break;
2911	case IEEE80211_CIPHER_CCMP:
2912		cipher = AR_CIPHER_AES;
2913		break;
2914	default:
2915		return;
2916	}
2917	key.cipher = htole16(cipher);
2918	memcpy(key.key, k->k_key, MIN(k->k_len, 16));
2919	error = otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2920	if (error != 0 || k->k_cipher != IEEE80211_CIPHER_TKIP)
2921		return;
2922
2923	/* TKIP: set Tx/Rx MIC Key. */
2924	key.kix = htole16(1);
2925	memcpy(key.key, k->k_key + 16, 16);
2926	(void)otus_cmd(sc, AR_CMD_EKEY, &key, sizeof key, NULL, 0);
2927}
2928
2929void
2930otus_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2931    struct ieee80211_key *k)
2932{
2933	struct otus_softc *sc = ic->ic_softc;
2934	struct otus_cmd_key cmd;
2935
2936	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
2937	    ic->ic_state != IEEE80211_S_RUN)
2938		return;	/* Nothing to do. */
2939
2940	/* Do it in a process context. */
2941	cmd.key = *k;
2942	cmd.associd = (ni != NULL) ? ni->ni_associd : 0;
2943	otus_do_async(sc, otus_delete_key_cb, &cmd, sizeof cmd);
2944}
2945
2946void
2947otus_delete_key_cb(struct otus_softc *sc, void *arg)
2948{
2949	struct otus_cmd_key *cmd = arg;
2950	struct ieee80211_key *k = &cmd->key;
2951	uint32_t uid;
2952
2953	if (k->k_flags & IEEE80211_KEY_GROUP)
2954		uid = htole32(k->k_id);
2955	else
2956		uid = htole32(OTUS_UID(cmd->associd));
2957	(void)otus_cmd(sc, AR_CMD_DKEY, &uid, sizeof uid, NULL, 0);
2958}
2959#endif
2960
2961/*
2962 * XXX TODO: check if we have to be doing any calibration in the host
2963 * or whether it's purely a firmware thing.
2964 */
2965void
2966otus_calibrate_to(void *arg, int pending)
2967{
2968#if 0
2969	struct otus_softc *sc = arg;
2970
2971	device_printf(sc->sc_dev, "%s: called\n", __func__);
2972	struct ieee80211com *ic = &sc->sc_ic;
2973	struct ieee80211_node *ni;
2974	int s;
2975
2976	if (usbd_is_dying(sc->sc_udev))
2977		return;
2978
2979	usbd_ref_incr(sc->sc_udev);
2980
2981	s = splnet();
2982	ni = ic->ic_bss;
2983	ieee80211_amrr_choose(&sc->amrr, ni, &((struct otus_node *)ni)->amn);
2984	splx(s);
2985
2986	if (!usbd_is_dying(sc->sc_udev))
2987		timeout_add_sec(&sc->calib_to, 1);
2988
2989	usbd_ref_decr(sc->sc_udev);
2990#endif
2991}
2992
2993int
2994otus_set_bssid(struct otus_softc *sc, const uint8_t *bssid)
2995{
2996
2997	OTUS_LOCK_ASSERT(sc);
2998
2999	otus_write(sc, AR_MAC_REG_BSSID_L,
3000	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
3001	otus_write(sc, AR_MAC_REG_BSSID_H,
3002	    bssid[4] | bssid[5] << 8);
3003	return otus_write_barrier(sc);
3004}
3005
3006int
3007otus_set_macaddr(struct otus_softc *sc, const uint8_t *addr)
3008{
3009	OTUS_LOCK_ASSERT(sc);
3010
3011	otus_write(sc, AR_MAC_REG_MAC_ADDR_L,
3012	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
3013	otus_write(sc, AR_MAC_REG_MAC_ADDR_H,
3014	    addr[4] | addr[5] << 8);
3015	return otus_write_barrier(sc);
3016}
3017
3018/* Default single-LED. */
3019void
3020otus_led_newstate_type1(struct otus_softc *sc)
3021{
3022	/* TBD */
3023	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3024}
3025
3026/* NETGEAR, dual-LED. */
3027void
3028otus_led_newstate_type2(struct otus_softc *sc)
3029{
3030	/* TBD */
3031	device_printf(sc->sc_dev, "%s: TODO\n", __func__);
3032}
3033
3034/* NETGEAR, single-LED/3 colors (blue, red, purple.) */
3035void
3036otus_led_newstate_type3(struct otus_softc *sc)
3037{
3038#if 0
3039	struct ieee80211com *ic = &sc->sc_ic;
3040	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3041
3042	uint32_t state = sc->led_state;
3043
3044	OTUS_LOCK_ASSERT(sc);
3045
3046	if (!vap) {
3047		state = 0;	/* led off */
3048	} else if (vap->iv_state == IEEE80211_S_INIT) {
3049		state = 0;	/* LED off. */
3050	} else if (vap->iv_state == IEEE80211_S_RUN) {
3051		/* Associated, LED always on. */
3052		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3053			state = AR_LED0_ON;	/* 2GHz=>Red. */
3054		else
3055			state = AR_LED1_ON;	/* 5GHz=>Blue. */
3056	} else {
3057		/* Scanning, blink LED. */
3058		state ^= AR_LED0_ON | AR_LED1_ON;
3059		if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan))
3060			state &= ~AR_LED1_ON;
3061		else
3062			state &= ~AR_LED0_ON;
3063	}
3064	if (state != sc->led_state) {
3065		otus_write(sc, AR_GPIO_REG_PORT_DATA, state);
3066		if (otus_write_barrier(sc) == 0)
3067			sc->led_state = state;
3068	}
3069#endif
3070}
3071
3072int
3073otus_init(struct otus_softc *sc)
3074{
3075	struct ieee80211com *ic = &sc->sc_ic;
3076	int error;
3077
3078	OTUS_UNLOCK_ASSERT(sc);
3079
3080	OTUS_LOCK(sc);
3081
3082	/* Drain any pending TX frames */
3083	otus_drain_mbufq(sc);
3084
3085	/* Init MAC */
3086	if ((error = otus_init_mac(sc)) != 0) {
3087		OTUS_UNLOCK(sc);
3088		device_printf(sc->sc_dev,
3089		    "%s: could not initialize MAC\n", __func__);
3090		return error;
3091	}
3092
3093	(void) otus_set_macaddr(sc, ic->ic_macaddr);
3094
3095#if 0
3096	switch (ic->ic_opmode) {
3097#ifdef notyet
3098#ifndef IEEE80211_STA_ONLY
3099	case IEEE80211_M_HOSTAP:
3100		otus_write(sc, AR_MAC_REG_CAM_MODE, 0x0f0000a1);
3101		otus_write(sc, AR_MAC_REG_RX_CONTROL, 0x1);
3102		break;
3103	case IEEE80211_M_IBSS:
3104		otus_write(sc, AR_MAC_REG_CAM_MODE, 0x0f000000);
3105		otus_write(sc, AR_MAC_REG_RX_CONTROL, 0x1);
3106		break;
3107#endif
3108#endif
3109	case IEEE80211_M_STA:
3110		otus_write(sc, AR_MAC_REG_CAM_MODE, 0x0f000002);
3111		otus_write(sc, AR_MAC_REG_RX_CONTROL, 0x1);
3112		break;
3113	default:
3114		break;
3115	}
3116#endif
3117
3118	switch (ic->ic_opmode) {
3119	case IEEE80211_M_STA:
3120		otus_write(sc, AR_MAC_REG_CAM_MODE, 0x0f000002);
3121		otus_write(sc, AR_MAC_REG_RX_CONTROL, 0x1);
3122		/* XXX set frametype filter? */
3123		break;
3124	case IEEE80211_M_MONITOR:
3125		otus_write(sc, AR_MAC_REG_FRAMETYPE_FILTER, 0xffffffff);
3126		break;
3127	default:
3128		break;
3129	}
3130
3131	/* XXX ic_opmode? */
3132	otus_write(sc, AR_MAC_REG_SNIFFER,
3133	    (ic->ic_opmode == IEEE80211_M_MONITOR) ? 0x2000001 : 0x2000000);
3134
3135	(void)otus_write_barrier(sc);
3136
3137	sc->bb_reset = 1;	/* Force cold reset. */
3138
3139	if ((error = otus_set_chan(sc, ic->ic_curchan, 0)) != 0) {
3140		OTUS_UNLOCK(sc);
3141		device_printf(sc->sc_dev,
3142		    "%s: could not set channel\n", __func__);
3143		return error;
3144	}
3145
3146	/* Start Rx. */
3147	otus_write(sc, AR_MAC_REG_DMA_TRIGGER, 0x100);
3148	(void)otus_write_barrier(sc);
3149
3150	sc->sc_running = 1;
3151
3152	OTUS_UNLOCK(sc);
3153	return 0;
3154}
3155
3156void
3157otus_stop(struct otus_softc *sc)
3158{
3159#if 0
3160	int s;
3161#endif
3162
3163	OTUS_UNLOCK_ASSERT(sc);
3164
3165	OTUS_LOCK(sc);
3166	sc->sc_running = 0;
3167	sc->sc_tx_timer = 0;
3168	OTUS_UNLOCK(sc);
3169
3170	taskqueue_drain_timeout(taskqueue_thread, &sc->scan_to);
3171	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_to);
3172	taskqueue_drain(taskqueue_thread, &sc->tx_task);
3173	taskqueue_drain(taskqueue_thread, &sc->wme_update_task);
3174
3175	OTUS_LOCK(sc);
3176	sc->sc_running = 0;
3177	/* Stop Rx. */
3178	otus_write(sc, AR_MAC_REG_DMA_TRIGGER, 0);
3179	(void)otus_write_barrier(sc);
3180
3181	/* Drain any pending TX frames */
3182	otus_drain_mbufq(sc);
3183
3184	OTUS_UNLOCK(sc);
3185}
3186