Index: sys/dev/usb/if_athn_usb.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/if_athn_usb.c,v
retrieving revision 1.6.8.13
diff -u -p -r1.6.8.13 if_athn_usb.c
--- sys/dev/usb/if_athn_usb.c	5 Dec 2016 10:55:18 -0000	1.6.8.13
+++ sys/dev/usb/if_athn_usb.c	10 Dec 2016 16:15:55 -0000
@@ -94,6 +94,7 @@ CFATTACH_DECL_NEW(athn_usb, sizeof(struc
 
 Static int	athn_usb_alloc_rx_list(struct athn_usb_softc *);
 Static int	athn_usb_alloc_tx_cmd(struct athn_usb_softc *);
+Static int	athn_usb_alloc_tx_msg(struct athn_usb_softc *);
 Static int	athn_usb_alloc_tx_list(struct athn_usb_softc *);
 Static void	athn_usb_attachhook(device_t);
 Static void	athn_usb_bcneof(struct usbd_xfer *, void *,
@@ -108,6 +109,7 @@ Static void	athn_usb_do_async(struct ath
 		    void (*)(struct athn_usb_softc *, void *), void *, int);
 Static void	athn_usb_free_rx_list(struct athn_usb_softc *);
 Static void	athn_usb_free_tx_cmd(struct athn_usb_softc *);
+Static void	athn_usb_free_tx_msg(struct athn_usb_softc *);
 Static void	athn_usb_free_tx_list(struct athn_usb_softc *);
 Static int	athn_usb_htc_connect_svc(struct athn_usb_softc *, uint16_t,
 		    uint8_t, uint8_t, uint8_t *);
@@ -154,7 +156,6 @@ Static void	athn_usb_updateslot_cb(struc
 Static void	athn_usb_wait_async(struct athn_usb_softc *);
 Static void	athn_usb_wait_cmd(struct athn_usb_softc *);
 Static void	athn_usb_wait_msg(struct athn_usb_softc *);
-Static void	athn_usb_wait_wmi(struct athn_usb_softc *);
 Static void	athn_usb_watchdog(struct ifnet *);
 Static int	athn_usb_wmi_xcmd(struct athn_usb_softc *, uint16_t, void *,
 		    int, void *);
@@ -250,6 +251,7 @@ athn_usb_attach(device_t parent, device_
 	sc->sc_dev = self;
 	usc->usc_udev = uaa->uaa_device;
 
+// printf("%s: usc %p sc %p sc_dev %p\n", __func__, usc, sc, self);
 	aprint_naive("\n");
 	aprint_normal("\n");
 
@@ -268,6 +270,11 @@ athn_usb_attach(device_t parent, device_
 	sc->sc_ops.write = athn_usb_write;
 	sc->sc_ops.write_barrier = athn_usb_write_barrier;
 
+	cv_init(&usc->usc_cmd_cv, "athncmd");
+	mutex_init(&usc->usc_cmd_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
+	cv_init(&usc->usc_msg_cv, "athnmsg");
+	mutex_init(&usc->usc_msg_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
+
 	cv_init(&usc->usc_task_cv, "athntsk");
 	mutex_init(&usc->usc_task_mtx, MUTEX_DEFAULT, IPL_NET);
 	mutex_init(&usc->usc_tx_mtx, MUTEX_DEFAULT, IPL_NONE);
@@ -295,6 +302,10 @@ athn_usb_attach(device_t parent, device_
 	if (athn_usb_alloc_tx_cmd(usc) != 0)
 		goto fail;
 
+	/* Allocate xfer for firmware commands. */
+	if (athn_usb_alloc_tx_msg(usc) != 0)
+		goto fail;
+
 	/* Allocate Tx/Rx buffers. */
 	error = athn_usb_alloc_rx_list(usc);
 	if (error != 0)
@@ -314,8 +325,15 @@ athn_usb_attach(device_t parent, device_
 	athn_usb_free_tx_list(usc);
 	athn_usb_free_rx_list(usc);
 	athn_usb_free_tx_cmd(usc);
+	athn_usb_free_tx_msg(usc);
 	athn_usb_close_pipes(usc);
 	usb_rem_task(usc->usc_udev, &usc->usc_task);
+
+	cv_destroy(&usc->usc_cmd_cv);
+	cv_destroy(&usc->usc_msg_cv);
+
+	mutex_destroy(&usc->usc_cmd_mtx);
+	mutex_destroy(&usc->usc_msg_mtx);
 	mutex_destroy(&usc->usc_tx_mtx);
 	mutex_destroy(&usc->usc_task_mtx);
 }
@@ -386,6 +404,7 @@ athn_usb_attachhook(device_t arg)
 	ic->ic_updateslot = athn_usb_updateslot;
 	sc->sc_max_aid = AR_USB_MAX_STA;  /* Firmware is limited to 8 STA */
 	sc->sc_media_change = athn_usb_media_change;
+// printf("%s: sc %p\n", __func__, sc);
 	error = athn_attach(sc);
 	if (error != 0) {
 		splx(s);
@@ -447,9 +466,12 @@ athn_usb_detach(device_t self, int flags
 	s = splusb();
 	usc->usc_dying = 1;
 
-	athn_usb_wait_wmi(usc);
+	mutex_enter(&usc->usc_cmd_mtx);
 	athn_usb_wait_cmd(usc);
+	mutex_exit(&usc->usc_cmd_mtx);
+	mutex_enter(&usc->usc_msg_mtx);
 	athn_usb_wait_msg(usc);
+	mutex_exit(&usc->usc_msg_mtx);
 	athn_usb_wait_async(usc);
 
 	usb_rem_task(usc->usc_udev, &usc->usc_task);
@@ -734,36 +756,65 @@ athn_usb_free_tx_cmd(struct athn_usb_sof
 		usbd_destroy_xfer(xfer);
 }
 
+Static int
+athn_usb_alloc_tx_msg(struct athn_usb_softc *usc)
+{
+	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
+
+	DPRINTFN(DBG_FN, usc, "\n");
+
+	data->sc = usc;	/* Backpointer for callbacks. */
+
+	int err = usbd_create_xfer(usc->usc_tx_intr_pipe, ATHN_USB_TXCMDSZ,
+	    0, 0, &data->xfer);
+	if (err) {
+		aprint_error_dev(usc->usc_dev,
+		    "could not allocate command xfer\n");
+		return err;
+	}
+	data->buf = usbd_get_buffer(data->xfer);
+
+	return 0;
+}
+
+Static void
+athn_usb_free_tx_msg(struct athn_usb_softc *usc)
+{
+	struct usbd_xfer *xfer;
+
+	DPRINTFN(DBG_FN, usc, "\n");
+
+	CTASSERT(sizeof(xfer) == sizeof(void *));
+	xfer = atomic_swap_ptr(&usc->usc_tx_msg.xfer, NULL);
+	if (xfer != NULL)
+		usbd_destroy_xfer(xfer);
+}
+
 Static void
 athn_usb_task(void *arg)
 {
 	struct athn_usb_softc *usc = arg;
 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
 	struct athn_usb_host_cmd *cmd;
-	int s;
 
 	DPRINTFN(DBG_FN, usc, "\n");
 
 	/* Process host commands. */
-	s = splusb();
 	mutex_spin_enter(&usc->usc_task_mtx);
 	while (ring->next != ring->cur) {
 		cmd = &ring->cmd[ring->next];
 		mutex_spin_exit(&usc->usc_task_mtx);
-		splx(s);
 
 		/* Invoke callback. */
 		if (!usc->usc_dying)
 			cmd->cb(usc, cmd->data);
 
-		s = splusb();
 		mutex_spin_enter(&usc->usc_task_mtx);
 		ring->queued--;
 		ring->next = (ring->next + 1) % ATHN_USB_HOST_CMD_RING_COUNT;
 	}
 	mutex_spin_exit(&usc->usc_task_mtx);
-	wakeup(ring);
-	splx(s);
+	cv_broadcast(&usc->usc_task_cv);
 }
 
 Static void
@@ -772,14 +823,12 @@ athn_usb_do_async(struct athn_usb_softc 
 {
 	struct athn_usb_host_cmd_ring *ring = &usc->usc_cmdq;
 	struct athn_usb_host_cmd *cmd;
-	int s;
 
 	if (usc->usc_dying)
 		return;
 
 	DPRINTFN(DBG_FN, usc, "\n");
 
-	s = splusb();
 	mutex_spin_enter(&usc->usc_task_mtx);
 	cmd = &ring->cmd[ring->cur];
 	cmd->cb = cb;
@@ -789,12 +838,9 @@ athn_usb_do_async(struct athn_usb_softc 
 
 	/* If there is no pending command already, schedule a task. */
 	if (++ring->queued == 1) {
-		mutex_spin_exit(&usc->usc_task_mtx);
 		usb_add_task(usc->usc_udev, &usc->usc_task, USB_TASKQ_DRIVER);
 	}
-	else
-		mutex_spin_exit(&usc->usc_task_mtx);
-	splx(s);
+	mutex_spin_exit(&usc->usc_task_mtx);
 }
 
 Static void
@@ -821,7 +867,7 @@ athn_usb_load_firmware(struct athn_usb_s
 	u_char *fw, *ptr;
 	size_t size, remain;
 	uint32_t addr;
-	int s, mlen, error;
+	int mlen, error;
 
 	DPRINTFN(DBG_FN, sc, "\n");
 
@@ -832,8 +878,7 @@ athn_usb_load_firmware(struct athn_usb_s
 			name = "athn-ar7010-11";
 		else
 			name = "athn-ar7010";
-	}
-	else
+	} else
 		name = "athn-ar9271";
 
 	/* Read firmware image from the filesystem. */
@@ -893,14 +938,21 @@ athn_usb_load_firmware(struct athn_usb_s
 	USETW(req.wValue, addr);
 	USETW(req.wLength, 0);
 
-	s = splusb();
+	mutex_enter(&usc->usc_msg_mtx);
+	athn_usb_wait_msg(usc);
+
 	usc->usc_wait_msg_id = AR_HTC_MSG_READY;
 	error = usbd_do_request(usc->usc_udev, &req, NULL);
+
+	/* XXXNH timeout on athn_usb_wait_msg */
 	/* Wait at most 1 second for firmware to boot. */
-	if (error == 0 && usc->usc_wait_msg_id != 0)
-		error = tsleep(&usc->usc_wait_msg_id, 0, "athnfw", hz);
-	usc->usc_wait_msg_id = 0;
-	splx(s);
+	if (error == 0)
+		athn_usb_wait_msg(usc);
+
+	mutex_exit(&usc->usc_msg_mtx);
+
+	DPRINTFN(DBG_FN, sc, "return %d\n", error);
+
 	return error;
 }
 
@@ -908,7 +960,7 @@ Static int
 athn_usb_htc_msg(struct athn_usb_softc *usc, uint16_t msg_id, void *buf,
     int len)
 {
-	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
+	struct athn_usb_tx_data *data = &usc->usc_tx_msg;
 	struct ar_htc_frame_hdr *htc;
 	struct ar_htc_msg_hdr *msg;
 
@@ -917,6 +969,8 @@ athn_usb_htc_msg(struct athn_usb_softc *
 
 	DPRINTFN(DBG_FN, usc, "\n");
 
+	KASSERT(mutex_owned(&usc->usc_msg_mtx));
+
 	htc = (struct ar_htc_frame_hdr *)data->buf;
 	memset(htc, 0, sizeof(*htc));
 	htc->endpoint_id = 0;
@@ -930,14 +984,16 @@ athn_usb_htc_msg(struct athn_usb_softc *
 	usbd_setup_xfer(data->xfer, NULL, data->buf,
 	    sizeof(*htc) + sizeof(*msg) + len,
 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT, NULL);
-	return usbd_sync_transfer(data->xfer);
+	int ret = usbd_sync_transfer(data->xfer);
+
+	return ret;
 }
 
 Static int
 athn_usb_htc_setup(struct athn_usb_softc *usc)
 {
 	struct ar_htc_msg_config_pipe cfg;
-	int s, error;
+	int error;
 
 	/*
 	 * Connect WMI services to USB pipes.
@@ -984,26 +1040,30 @@ athn_usb_htc_setup(struct athn_usb_softc
 	cfg.pipe_id = UE_GET_ADDR(AR_PIPE_TX_DATA);
 	cfg.credits = (usc->usc_flags & ATHN_USB_FLAG_AR7010) ? 45 : 33;
 
-	s = splusb();
+	mutex_enter(&usc->usc_msg_mtx);
+	athn_usb_wait_msg(usc);
 
 	usc->usc_wait_msg_id = AR_HTC_MSG_CONF_PIPE_RSP;
 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONF_PIPE, &cfg, sizeof(cfg));
-	if (error == 0 && usc->usc_wait_msg_id != 0)
-		error = tsleep(&usc->usc_wait_msg_id, 0, "athnhtc", hz);
-	usc->usc_wait_msg_id = 0;
-
-	splx(s);
 
 	if (error != 0) {
-		aprint_error_dev(usc->usc_dev, "could not configure pipe\n");
+		aprint_error_dev(usc->usc_dev, "could not request pipe configurations\n");
+		mutex_exit(&usc->usc_msg_mtx);
 		return error;
 	}
+	athn_usb_wait_msg(usc);
 
 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_SETUP_COMPLETE, NULL, 0);
 	if (error != 0) {
-		aprint_error_dev(usc->usc_dev, "could not complete setup\n");
+		aprint_error_dev(usc->usc_dev, "could not request complete setup\n");
+		mutex_exit(&usc->usc_msg_mtx);
 		return error;
 	}
+	athn_usb_wait_msg(usc);
+
+	mutex_exit(&usc->usc_msg_mtx);
+
+
 	return 0;
 }
 
@@ -1013,7 +1073,7 @@ athn_usb_htc_connect_svc(struct athn_usb
 {
 	struct ar_htc_msg_conn_svc msg;
 	struct ar_htc_msg_conn_svc_rsp rsp;
-	int s, error;
+	int error;
 
 	DPRINTFN(DBG_FN, usc, "\n");
 
@@ -1021,17 +1081,21 @@ athn_usb_htc_connect_svc(struct athn_usb
 	msg.svc_id = htobe16(svc_id);
 	msg.dl_pipeid = UE_GET_ADDR(dl_pipe);
 	msg.ul_pipeid = UE_GET_ADDR(ul_pipe);
-	s = splusb();
+
+	mutex_enter(&usc->usc_msg_mtx);
+	athn_usb_wait_msg(usc);
 
 	usc->usc_msg_conn_svc_rsp = &rsp;
 
 	usc->usc_wait_msg_id = AR_HTC_MSG_CONN_SVC_RSP;
 	error = athn_usb_htc_msg(usc, AR_HTC_MSG_CONN_SVC, &msg, sizeof(msg));
-	if (error == 0 && usc->usc_wait_msg_id != 0)
-		error = tsleep(&usc->usc_wait_msg_id, 0, "athnhtc", hz);
-	usc->usc_wait_msg_id = 0;
+	if (error == 0/* && usc->usc_wait_msg_id != 0*/)
+		athn_usb_wait_msg(usc);
+// 	usc->usc_wait_msg_id = 0;
+// 
+// 	cv_broadcast(&usc->usc_msg_cv);
+	mutex_exit(&usc->usc_msg_mtx);
 
-	splx(s);
 	if (error != 0) {
 		aprint_error_dev(usc->usc_dev,
 		    "error waiting for service %d connection\n", svc_id);
@@ -1056,20 +1120,23 @@ Static void
 athn_usb_wait_msg(struct athn_usb_softc *usc)
 {
 
-	DPRINTFN(DBG_FN, usc, "\n");
+// 	DPRINTFN(DBG_FN, usc, "\n");
 
-	while (__predict_false(usc->usc_wait_msg_id))
-		tsleep(&usc->usc_wait_msg_id, 0, "athnmsg", hz);
+	KASSERT(mutex_owned(&usc->usc_msg_mtx));
+	while (usc->usc_wait_msg_id)
+		cv_wait(&usc->usc_msg_cv, &usc->usc_msg_mtx);
 }
 
 Static void
 athn_usb_wait_cmd(struct athn_usb_softc *usc)
 {
 
-	DPRINTFN(DBG_FN, usc, "\n");
+// 	DPRINTFN(DBG_FN, usc, "\n");
+
+	KASSERT(mutex_owned(&usc->usc_cmd_mtx));
+	while (usc->usc_wait_cmd_id)
+		cv_wait(&usc->usc_cmd_cv, &usc->usc_cmd_mtx);
 
-	while (__predict_false(usc->usc_wait_cmd_id))
-		tsleep(&usc->usc_wait_cmd_id, 0, "athncmd", hz);
 }
 
 Static void
@@ -1078,13 +1145,10 @@ athn_usb_wmieof(struct usbd_xfer *xfer, 
 {
 	struct athn_usb_softc *usc = priv;
 
-	DPRINTFN(DBG_FN, usc, "\n");
+// 	DPRINTFN(DBG_FN, usc, "\n");
 
 	if (__predict_false(status == USBD_STALLED))
 		usbd_clear_endpoint_stall_async(usc->usc_tx_intr_pipe);
-
-	usc->usc_wmi_done = 1;
-	wakeup(&usc->usc_wmi_done);
 }
 
 Static int
@@ -1094,12 +1158,15 @@ athn_usb_wmi_xcmd(struct athn_usb_softc 
 	struct athn_usb_tx_data *data = &usc->usc_tx_cmd;
 	struct ar_htc_frame_hdr *htc;
 	struct ar_wmi_cmd_hdr *wmi;
-	int s, error;
+	int error;
 
 	if (usc->usc_dying)
 		return EIO;
 
-	DPRINTFN(DBG_FN, usc, "\n");
+// 	DPRINTFN(DBG_FN, usc, "cmd_id %#x\n", cmd_id);
+
+	mutex_enter(&usc->usc_cmd_mtx);
+	athn_usb_wait_cmd(usc);
 
 	htc = (struct ar_htc_frame_hdr *)data->buf;
 	memset(htc, 0, sizeof(*htc));
@@ -1118,30 +1185,37 @@ athn_usb_wmi_xcmd(struct athn_usb_softc 
 	    USBD_SHORT_XFER_OK, ATHN_USB_CMD_TIMEOUT,
 	    athn_usb_wmieof);
 
-	s = splusb();
-	usc->usc_wmi_done = 0;
+// 	usc->usc_wmi_done = 0;
 	usc->usc_wait_cmd_id = cmd_id;
-	error = usbd_transfer(data->xfer);
-	if (__predict_true(error == 0 || error == USBD_IN_PROGRESS)) {
-		usc->usc_obuf = obuf;
+	usc->usc_obuf = obuf;
+
+	mutex_exit(&usc->usc_cmd_mtx);
+
+	error = usbd_sync_transfer(data->xfer);
+	if (error) {
+	    	DPRINTFN(DBG_FN, usc, "transfer error %d\n", error);
 
-		/* Wait for WMI command to complete. */
-		error = tsleep(&usc->usc_wait_cmd_id, 0, "athnwmi", hz);
-		usc->usc_wait_cmd_id = 0;
-		athn_usb_wait_wmi(usc);
+		return error;
 	}
-	splx(s);
-	return error;
-}
 
-Static void
-athn_usb_wait_wmi(struct athn_usb_softc *usc)
-{
+#if 0
+	mutex_enter(&usc->usc_cmd_mtx);
 
-	DPRINTFN(DBG_FN, usc, "\n");
+	DPRINTFN(DBG_FN, usc, "transfer done\n");
+
+	usc->usc_obuf = NULL;
+	usc->usc_wait_cmd_id = 0;
+	cv_broadcast(&usc->usc_cmd_cv);
 
-	while (__predict_false(!usc->usc_wmi_done))
-		tsleep(&usc->usc_wmi_done, 0, "athnwmi", 0);
+	mutex_exit(&usc->usc_cmd_mtx);
+#endif
+	mutex_enter(&usc->usc_cmd_mtx);
+
+	athn_usb_wait_cmd(usc);
+
+	mutex_exit(&usc->usc_cmd_mtx);
+
+	return 0;
 }
 
 #ifdef unused
@@ -1183,7 +1257,7 @@ athn_usb_read(struct athn_softc *sc, uin
 	if (usc->usc_dying)
 		return 0;
 
-	DPRINTFN(DBG_FN, sc, "\n");
+// 	DPRINTFN(DBG_FN, sc, "addr %#x\n", htobe32(addr));
 
 	/* Flush pending writes for strict consistency. */
 	athn_usb_write_barrier(sc);
@@ -1191,8 +1265,12 @@ athn_usb_read(struct athn_softc *sc, uin
 	addr = htobe32(addr);
 	error = athn_usb_wmi_xcmd(usc, AR_WMI_CMD_REG_READ,
 	    &addr, sizeof(addr), &val);
-	if (error != 0)
+	if (error != 0) {
+		DPRINTFN(DBG_FN, sc, "error %d\n", addr);
 		return 0xdeadbeef;
+	}
+// 	DPRINTFN(DBG_FN, sc, "addr %#x return %#x\n", addr, be32toh(val));
+
 	return be32toh(val);
 }
 
@@ -1204,7 +1282,7 @@ athn_usb_write(struct athn_softc *sc, ui
 	if (usc->usc_dying)
 		return;
 
-	DPRINTFN(DBG_FN, sc, "\n");
+// 	DPRINTFN(DBG_FN, sc, "addr %#x val %#x\n", addr, val);
 
 	usc->usc_wbuf[usc->usc_wcount].addr = htobe32(addr);
 	usc->usc_wbuf[usc->usc_wcount].val  = htobe32(val);
@@ -1220,7 +1298,7 @@ athn_usb_write_barrier(struct athn_softc
 	if (usc->usc_dying)
 		goto done;
 
-	DPRINTFN(DBG_FN, sc, "\n");
+// 	DPRINTFN(DBG_FN, sc, "usc_wcount %d\n", usc->usc_wcount);
 
 	if (usc->usc_wcount == 0)
 		return;
@@ -1877,15 +1955,18 @@ athn_usb_rx_wmi_ctrl(struct athn_usb_sof
 	cmd_id = be16toh(wmi->cmd_id);
 
 	if (!(cmd_id & AR_WMI_EVT_FLAG)) {
-		if (usc->usc_wait_cmd_id != cmd_id)
-			return;	/* Unexpected reply. */
-		if (usc->usc_obuf != NULL) {
-			/* Copy answer into caller supplied buffer. */
-			memcpy(usc->usc_obuf, &wmi[1], len - sizeof(*wmi));
-		}
-		/* Notify caller of completion. */
-		usc->usc_wait_cmd_id = 0;
-		wakeup(&usc->usc_wait_cmd_id);
+		mutex_enter(&usc->usc_cmd_mtx);
+		if (usc->usc_wait_cmd_id == cmd_id) {
+
+			if (usc->usc_obuf != NULL) {
+				/* Copy answer into caller supplied buffer. */
+				memcpy(usc->usc_obuf, &wmi[1], len - sizeof(*wmi));
+			}
+			/* Notify caller of completion. */
+			usc->usc_wait_cmd_id = 0;
+			cv_broadcast(&usc->usc_cmd_cv);
+		}
+		mutex_exit(&usc->usc_cmd_mtx);
 		return;
 	}
 	/*
@@ -1950,12 +2031,18 @@ athn_usb_intr(struct usbd_xfer *xfer, vo
 	len -= sizeof(*htc);
 
 	if (htc->endpoint_id != 0) {
-		if (__predict_false(htc->endpoint_id != usc->usc_ep_ctrl))
+		if (__predict_false(htc->endpoint_id != usc->usc_ep_ctrl)) {
+			DPRINTFN(DBG_RX, usc, "Rx %d != %d\n",
+			    htc->endpoint_id, usc->usc_ep_ctrl);
 			return;
+		}
 		/* Remove trailer if present. */
 		if (htc->flags & AR_HTC_FLAG_TRAILER) {
-			if (__predict_false(len < htc->control[0]))
+			if (__predict_false(len < htc->control[0])) {
+				DPRINTFN(DBG_RX, usc, "Rx trailer %d < %d\n",
+				    len,  htc->control[0]);
 				return;
+			}
 			len -= htc->control[0];
 		}
 		athn_usb_rx_wmi_ctrl(usc, buf, len);
@@ -1973,20 +2060,28 @@ athn_usb_intr(struct usbd_xfer *xfer, vo
 	switch (msg_id) {
 	case AR_HTC_MSG_READY:
 	case AR_HTC_MSG_CONF_PIPE_RSP:
-		if (usc->usc_wait_msg_id != msg_id)
-			break;
-		usc->usc_wait_msg_id = 0;
-		wakeup(&usc->usc_wait_msg_id);
+		mutex_enter(&usc->usc_msg_mtx);
+		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_READY: %d vs %d\n",
+		    usc->usc_wait_msg_id, msg_id);
+		if (usc->usc_wait_msg_id == msg_id) {
+			usc->usc_wait_msg_id = 0;
+			cv_broadcast(&usc->usc_msg_cv);
+		}
+		mutex_exit(&usc->usc_msg_mtx);
 		break;
 	case AR_HTC_MSG_CONN_SVC_RSP:
-		if (usc->usc_wait_msg_id != msg_id)
-			break;
-		if (usc->usc_msg_conn_svc_rsp != NULL) {
-			memcpy(usc->usc_msg_conn_svc_rsp, &msg[1],
-			    sizeof(*usc->usc_msg_conn_svc_rsp));
+		mutex_enter(&usc->usc_msg_mtx);
+		DPRINTFN(DBG_RX, usc, "AR_HTC_MSG_CONN_SVC_RSP: %d vs %d\n",
+		    usc->usc_wait_msg_id, msg_id);
+		if (usc->usc_wait_msg_id == msg_id) {
+			if (usc->usc_msg_conn_svc_rsp != NULL) {
+				memcpy(usc->usc_msg_conn_svc_rsp, &msg[1],
+				    sizeof(*usc->usc_msg_conn_svc_rsp));
+			}
+			usc->usc_wait_msg_id = 0;
+			cv_broadcast(&usc->usc_msg_cv);
 		}
-		usc->usc_wait_msg_id = 0;
-		wakeup(&usc->usc_wait_msg_id);
+		mutex_exit(&usc->usc_msg_mtx);
 		break;
 	default:
 		DPRINTFN(DBG_RX, usc, "HTC message %d ignored\n", msg_id);
Index: sys/dev/usb/if_athn_usb.h
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/if_athn_usb.h,v
retrieving revision 1.2.16.3
diff -u -p -r1.2.16.3 if_athn_usb.h
--- sys/dev/usb/if_athn_usb.h	17 Oct 2015 10:24:59 -0000	1.2.16.3
+++ sys/dev/usb/if_athn_usb.h	10 Dec 2016 16:15:55 -0000
@@ -443,6 +443,11 @@ struct athn_usb_softc {
 
 	int				usc_athn_attached;
 
+	kmutex_t			usc_msg_mtx;
+	kcondvar_t			usc_msg_cv;
+	kmutex_t			usc_cmd_mtx;
+	kcondvar_t			usc_cmd_cv;
+
 	kcondvar_t			usc_task_cv;
 	kmutex_t			usc_task_mtx;
 	kmutex_t			usc_tx_mtx;
@@ -469,7 +474,7 @@ struct athn_usb_softc {
 	struct ar_wmi_cmd_reg_write	usc_wbuf[AR_MAX_WRITE_COUNT];
 	int				usc_wcount;
 
-	int				usc_wmi_done;
+// 	int				usc_wmi_done;
 	uint16_t			usc_wmi_seq_no;
 	uint16_t			usc_wait_cmd_id;
 	uint16_t			usc_wait_msg_id;
@@ -481,6 +486,7 @@ struct athn_usb_softc {
 	struct athn_usb_tx_data		usc_tx_data[ATHN_USB_TX_LIST_COUNT];
 	TAILQ_HEAD(, athn_usb_tx_data)	usc_tx_free_list;
 	struct athn_usb_tx_data		usc_tx_cmd;
+	struct athn_usb_tx_data		usc_tx_msg;
 	struct athn_usb_tx_data		*usc_tx_bcn;
 
 	uint8_t				usc_ep_ctrl;