sys/dev/usb/wlan/if_rsu.c

   1 /*      $OpenBSD: if_rsu.c,v 1.17 2013/04/15 09:23:01 mglocker Exp $    */
   2
   3 /*-
   4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18 #include <sys/cdefs.h>
  19 __FBSDID("$FreeBSD$");
  20
  21 /*
  22  * Driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU.
  23  *
  24  * TODO:
  25  *   o tx a-mpdu
  26  *   o hostap / ibss / mesh
  27  *   o power-save operation
  28  */
  29
  30 #include "opt_wlan.h"
  31
  32 #include <sys/param.h>
  33 #include <sys/endian.h>
  34 #include <sys/sockio.h>
  35 #include <sys/malloc.h>
  36 #include <sys/mbuf.h>
  37 #include <sys/kernel.h>
  38 #include <sys/socket.h>
  39 #include <sys/systm.h>
  40 #include <sys/conf.h>
  41 #include <sys/bus.h>
  42 #include <sys/firmware.h>
  43 #include <sys/module.h>
  44
  45 #include <net/bpf.h>
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48 #include <net/if_arp.h>
  49 #include <net/if_dl.h>
  50 #include <net/if_media.h>
  51 #include <net/if_types.h>
  52
  53 #include <netinet/in.h>
  54 #include <netinet/in_systm.h>
  55 #include <netinet/in_var.h>
  56 #include <netinet/if_ether.h>
  57 #include <netinet/ip.h>
  58
  59 #include <net80211/ieee80211_var.h>
  60 #include <net80211/ieee80211_regdomain.h>
  61 #include <net80211/ieee80211_radiotap.h>
  62
  63 #include <dev/usb/usb.h>
  64 #include <dev/usb/usbdi.h>
  65 #include "usbdevs.h"
  66
  67 #include <dev/rtwn/if_rtwn_ridx.h>      /* XXX */
  68 #include <dev/usb/wlan/if_rsureg.h>
  69
  70 #define RSU_RATE_IS_CCK RTWN_RATE_IS_CCK
  71
  72 #ifdef USB_DEBUG
  73 static int rsu_debug = 0;
  74 SYSCTL_NODE(_hw_usb, OID_AUTO, rsu, CTLFLAG_RW, 0, "USB rsu");
  75 SYSCTL_INT(_hw_usb_rsu, OID_AUTO, debug, CTLFLAG_RWTUN, &rsu_debug, 0,
  76     "Debug level");
  77 #define RSU_DPRINTF(_sc, _flg, ...)                                     \
  78         do                                                              \
  79                 if (((_flg) == (RSU_DEBUG_ANY)) || (rsu_debug & (_flg))) \
  80                         device_printf((_sc)->sc_dev, __VA_ARGS__);      \
  81         while (0)
  82 #else
  83 #define RSU_DPRINTF(_sc, _flg, ...)
  84 #endif
  85
  86 static int rsu_enable_11n = 1;
  87 TUNABLE_INT("hw.usb.rsu.enable_11n", &rsu_enable_11n);
  88
  89 #define RSU_DEBUG_ANY           0xffffffff
  90 #define RSU_DEBUG_TX            0x00000001
  91 #define RSU_DEBUG_RX            0x00000002
  92 #define RSU_DEBUG_RESET         0x00000004
  93 #define RSU_DEBUG_CALIB         0x00000008
  94 #define RSU_DEBUG_STATE         0x00000010
  95 #define RSU_DEBUG_SCAN          0x00000020
  96 #define RSU_DEBUG_FWCMD         0x00000040
  97 #define RSU_DEBUG_TXDONE        0x00000080
  98 #define RSU_DEBUG_FW            0x00000100
  99 #define RSU_DEBUG_FWDBG         0x00000200
 100 #define RSU_DEBUG_AMPDU         0x00000400
 101 #define RSU_DEBUG_KEY           0x00000800
 102 #define RSU_DEBUG_USB           0x00001000
 103
 104 static const STRUCT_USB_HOST_ID rsu_devs[] = {
 105 #define RSU_HT_NOT_SUPPORTED 0
 106 #define RSU_HT_SUPPORTED 1
 107 #define RSU_DEV_HT(v,p)  { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
 108                                    RSU_HT_SUPPORTED) }
 109 #define RSU_DEV(v,p)     { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
 110                                    RSU_HT_NOT_SUPPORTED) }
 111         RSU_DEV(ASUS,                   RTL8192SU),
 112         RSU_DEV(AZUREWAVE,              RTL8192SU_4),
 113         RSU_DEV(SITECOMEU,              WLA1000),
 114         RSU_DEV_HT(ACCTON,              RTL8192SU),
 115         RSU_DEV_HT(ASUS,                USBN10),
 116         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_1),
 117         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_2),
 118         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_3),
 119         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_5),
 120         RSU_DEV_HT(BELKIN,              RTL8192SU_1),
 121         RSU_DEV_HT(BELKIN,              RTL8192SU_2),
 122         RSU_DEV_HT(BELKIN,              RTL8192SU_3),
 123         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_1),
 124         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_2),
 125         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_3),
 126         RSU_DEV_HT(COREGA,              RTL8192SU),
 127         RSU_DEV_HT(DLINK2,              DWA131A1),
 128         RSU_DEV_HT(DLINK2,              RTL8192SU_1),
 129         RSU_DEV_HT(DLINK2,              RTL8192SU_2),
 130         RSU_DEV_HT(EDIMAX,              RTL8192SU_1),
 131         RSU_DEV_HT(EDIMAX,              RTL8192SU_2),
 132         RSU_DEV_HT(EDIMAX,              EW7622UMN),
 133         RSU_DEV_HT(GUILLEMOT,           HWGUN54),
 134         RSU_DEV_HT(GUILLEMOT,           HWNUM300),
 135         RSU_DEV_HT(HAWKING,             RTL8192SU_1),
 136         RSU_DEV_HT(HAWKING,             RTL8192SU_2),
 137         RSU_DEV_HT(PLANEX2,             GWUSNANO),
 138         RSU_DEV_HT(REALTEK,             RTL8171),
 139         RSU_DEV_HT(REALTEK,             RTL8172),
 140         RSU_DEV_HT(REALTEK,             RTL8173),
 141         RSU_DEV_HT(REALTEK,             RTL8174),
 142         RSU_DEV_HT(REALTEK,             RTL8192SU),
 143         RSU_DEV_HT(REALTEK,             RTL8712),
 144         RSU_DEV_HT(REALTEK,             RTL8713),
 145         RSU_DEV_HT(SENAO,               RTL8192SU_1),
 146         RSU_DEV_HT(SENAO,               RTL8192SU_2),
 147         RSU_DEV_HT(SITECOMEU,           WL349V1),
 148         RSU_DEV_HT(SITECOMEU,           WL353),
 149         RSU_DEV_HT(SWEEX2,              LW154),
 150         RSU_DEV_HT(TRENDNET,            TEW646UBH),
 151 #undef RSU_DEV_HT
 152 #undef RSU_DEV
 153 };
 154
 155 static device_probe_t   rsu_match;
 156 static device_attach_t  rsu_attach;
 157 static device_detach_t  rsu_detach;
 158 static usb_callback_t   rsu_bulk_tx_callback_be_bk;
 159 static usb_callback_t   rsu_bulk_tx_callback_vi_vo;
 160 static usb_callback_t   rsu_bulk_tx_callback_h2c;
 161 static usb_callback_t   rsu_bulk_rx_callback;
 162 static usb_error_t      rsu_do_request(struct rsu_softc *,
 163                             struct usb_device_request *, void *);
 164 static struct ieee80211vap *
 165                 rsu_vap_create(struct ieee80211com *, const char name[],
 166                     int, enum ieee80211_opmode, int, const uint8_t bssid[],
 167                     const uint8_t mac[]);
 168 static void     rsu_vap_delete(struct ieee80211vap *);
 169 static void     rsu_scan_start(struct ieee80211com *);
 170 static void     rsu_scan_end(struct ieee80211com *);
 171 static void     rsu_getradiocaps(struct ieee80211com *, int, int *,
 172                     struct ieee80211_channel[]);
 173 static void     rsu_set_channel(struct ieee80211com *);
 174 static void     rsu_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 175 static void     rsu_scan_mindwell(struct ieee80211_scan_state *);
 176 static void     rsu_update_promisc(struct ieee80211com *);
 177 static uint8_t  rsu_get_multi_pos(const uint8_t[]);
 178 static void     rsu_set_multi(struct rsu_softc *);
 179 static void     rsu_update_mcast(struct ieee80211com *);
 180 static int      rsu_alloc_rx_list(struct rsu_softc *);
 181 static void     rsu_free_rx_list(struct rsu_softc *);
 182 static int      rsu_alloc_tx_list(struct rsu_softc *);
 183 static void     rsu_free_tx_list(struct rsu_softc *);
 184 static void     rsu_free_list(struct rsu_softc *, struct rsu_data [], int);
 185 static struct rsu_data *_rsu_getbuf(struct rsu_softc *);
 186 static struct rsu_data *rsu_getbuf(struct rsu_softc *);
 187 static void     rsu_freebuf(struct rsu_softc *, struct rsu_data *);
 188 static int      rsu_write_region_1(struct rsu_softc *, uint16_t, uint8_t *,
 189                     int);
 190 static void     rsu_write_1(struct rsu_softc *, uint16_t, uint8_t);
 191 static void     rsu_write_2(struct rsu_softc *, uint16_t, uint16_t);
 192 static void     rsu_write_4(struct rsu_softc *, uint16_t, uint32_t);
 193 static int      rsu_read_region_1(struct rsu_softc *, uint16_t, uint8_t *,
 194                     int);
 195 static uint8_t  rsu_read_1(struct rsu_softc *, uint16_t);
 196 static uint16_t rsu_read_2(struct rsu_softc *, uint16_t);
 197 static uint32_t rsu_read_4(struct rsu_softc *, uint16_t);
 198 static int      rsu_fw_iocmd(struct rsu_softc *, uint32_t);
 199 static uint8_t  rsu_efuse_read_1(struct rsu_softc *, uint16_t);
 200 static int      rsu_read_rom(struct rsu_softc *);
 201 static int      rsu_fw_cmd(struct rsu_softc *, uint8_t, void *, int);
 202 static void     rsu_calib_task(void *, int);
 203 static void     rsu_tx_task(void *, int);
 204 static void     rsu_set_led(struct rsu_softc *, int);
 205 static int      rsu_monitor_newstate(struct ieee80211vap *,
 206                     enum ieee80211_state, int);
 207 static int      rsu_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 208 static int      rsu_key_alloc(struct ieee80211vap *, struct ieee80211_key *,
 209                     ieee80211_keyix *, ieee80211_keyix *);
 210 static int      rsu_process_key(struct ieee80211vap *,
 211                     const struct ieee80211_key *, int);
 212 static int      rsu_key_set(struct ieee80211vap *,
 213                     const struct ieee80211_key *);
 214 static int      rsu_key_delete(struct ieee80211vap *,
 215                     const struct ieee80211_key *);
 216 static int      rsu_cam_read(struct rsu_softc *, uint8_t, uint32_t *);
 217 static void     rsu_cam_write(struct rsu_softc *, uint8_t, uint32_t);
 218 static int      rsu_key_check(struct rsu_softc *, ieee80211_keyix, int);
 219 static uint8_t  rsu_crypto_mode(struct rsu_softc *, u_int, int);
 220 static int      rsu_set_key_group(struct rsu_softc *,
 221                     const struct ieee80211_key *);
 222 static int      rsu_set_key_pair(struct rsu_softc *,
 223                     const struct ieee80211_key *);
 224 static int      rsu_reinit_static_keys(struct rsu_softc *);
 225 static int      rsu_delete_key(struct rsu_softc *sc, ieee80211_keyix);
 226 static void     rsu_delete_key_pair_cb(void *, int);
 227 static int      rsu_site_survey(struct rsu_softc *,
 228                     struct ieee80211_scan_ssid *);
 229 static int      rsu_join_bss(struct rsu_softc *, struct ieee80211_node *);
 230 static int      rsu_disconnect(struct rsu_softc *);
 231 static int      rsu_hwrssi_to_rssi(struct rsu_softc *, int hw_rssi);
 232 static void     rsu_event_survey(struct rsu_softc *, uint8_t *, int);
 233 static void     rsu_event_join_bss(struct rsu_softc *, uint8_t *, int);
 234 static void     rsu_rx_event(struct rsu_softc *, uint8_t, uint8_t *, int);
 235 static void     rsu_rx_multi_event(struct rsu_softc *, uint8_t *, int);
 236 static int8_t   rsu_get_rssi(struct rsu_softc *, int, void *);
 237 static struct mbuf * rsu_rx_copy_to_mbuf(struct rsu_softc *,
 238                     struct r92s_rx_stat *, int);
 239 static uint32_t rsu_get_tsf_low(struct rsu_softc *);
 240 static uint32_t rsu_get_tsf_high(struct rsu_softc *);
 241 static struct ieee80211_node * rsu_rx_frame(struct rsu_softc *, struct mbuf *);
 242 static struct mbuf * rsu_rx_multi_frame(struct rsu_softc *, uint8_t *, int);
 243 static struct mbuf *
 244                 rsu_rxeof(struct usb_xfer *, struct rsu_data *);
 245 static void     rsu_txeof(struct usb_xfer *, struct rsu_data *);
 246 static int      rsu_raw_xmit(struct ieee80211_node *, struct mbuf *,
 247                     const struct ieee80211_bpf_params *);
 248 static void     rsu_rxfilter_init(struct rsu_softc *);
 249 static void     rsu_rxfilter_set(struct rsu_softc *, uint32_t, uint32_t);
 250 static void     rsu_rxfilter_refresh(struct rsu_softc *);
 251 static int      rsu_init(struct rsu_softc *);
 252 static int      rsu_tx_start(struct rsu_softc *, struct ieee80211_node *,
 253                     struct mbuf *, struct rsu_data *);
 254 static int      rsu_transmit(struct ieee80211com *, struct mbuf *);
 255 static void     rsu_start(struct rsu_softc *);
 256 static void     _rsu_start(struct rsu_softc *);
 257 static int      rsu_ioctl_net(struct ieee80211com *, u_long, void *);
 258 static void     rsu_parent(struct ieee80211com *);
 259 static void     rsu_stop(struct rsu_softc *);
 260 static void     rsu_ms_delay(struct rsu_softc *, int);
 261
 262 static device_method_t rsu_methods[] = {
 263         DEVMETHOD(device_probe,         rsu_match),
 264         DEVMETHOD(device_attach,        rsu_attach),
 265         DEVMETHOD(device_detach,        rsu_detach),
 266
 267         DEVMETHOD_END
 268 };
 269
 270 static driver_t rsu_driver = {
 271         .name = "rsu",
 272         .methods = rsu_methods,
 273         .size = sizeof(struct rsu_softc)
 274 };
 275
 276 static devclass_t rsu_devclass;
 277
 278 DRIVER_MODULE(rsu, uhub, rsu_driver, rsu_devclass, NULL, 0);
 279 MODULE_DEPEND(rsu, wlan, 1, 1, 1);
 280 MODULE_DEPEND(rsu, usb, 1, 1, 1);
 281 MODULE_DEPEND(rsu, firmware, 1, 1, 1);
 282 MODULE_VERSION(rsu, 1);
 283 USB_PNP_HOST_INFO(rsu_devs);
 284
 285 static uint8_t rsu_wme_ac_xfer_map[4] = {
 286         [WME_AC_BE] = RSU_BULK_TX_BE_BK,
 287         [WME_AC_BK] = RSU_BULK_TX_BE_BK,
 288         [WME_AC_VI] = RSU_BULK_TX_VI_VO,
 289         [WME_AC_VO] = RSU_BULK_TX_VI_VO,
 290 };
 291
 292 /* XXX hard-coded */
 293 #define RSU_H2C_ENDPOINT        3
 294
 295 static const struct usb_config rsu_config[RSU_N_TRANSFER] = {
 296         [RSU_BULK_RX] = {
 297                 .type = UE_BULK,
 298                 .endpoint = UE_ADDR_ANY,
 299                 .direction = UE_DIR_IN,
 300                 .bufsize = RSU_RXBUFSZ,
 301                 .flags = {
 302                         .pipe_bof = 1,
 303                         .short_xfer_ok = 1
 304                 },
 305                 .callback = rsu_bulk_rx_callback
 306         },
 307         [RSU_BULK_TX_BE_BK] = {
 308                 .type = UE_BULK,
 309                 .endpoint = 0x06,
 310                 .direction = UE_DIR_OUT,
 311                 .bufsize = RSU_TXBUFSZ,
 312                 .flags = {
 313                         .ext_buffer = 1,
 314                         .pipe_bof = 1,
 315                         .force_short_xfer = 1
 316                 },
 317                 .callback = rsu_bulk_tx_callback_be_bk,
 318                 .timeout = RSU_TX_TIMEOUT
 319         },
 320         [RSU_BULK_TX_VI_VO] = {
 321                 .type = UE_BULK,
 322                 .endpoint = 0x04,
 323                 .direction = UE_DIR_OUT,
 324                 .bufsize = RSU_TXBUFSZ,
 325                 .flags = {
 326                         .ext_buffer = 1,
 327                         .pipe_bof = 1,
 328                         .force_short_xfer = 1
 329                 },
 330                 .callback = rsu_bulk_tx_callback_vi_vo,
 331                 .timeout = RSU_TX_TIMEOUT
 332         },
 333         [RSU_BULK_TX_H2C] = {
 334                 .type = UE_BULK,
 335                 .endpoint = 0x0d,
 336                 .direction = UE_DIR_OUT,
 337                 .bufsize = RSU_TXBUFSZ,
 338                 .flags = {
 339                         .ext_buffer = 1,
 340                         .pipe_bof = 1,
 341                         .short_xfer_ok = 1
 342                 },
 343                 .callback = rsu_bulk_tx_callback_h2c,
 344                 .timeout = RSU_TX_TIMEOUT
 345         },
 346 };
 347
 348 static int
 349 rsu_match(device_t self)
 350 {
 351         struct usb_attach_arg *uaa = device_get_ivars(self);
 352
 353         if (uaa->usb_mode != USB_MODE_HOST ||
 354             uaa->info.bIfaceIndex != 0 ||
 355             uaa->info.bConfigIndex != 0)
 356                 return (ENXIO);
 357
 358         return (usbd_lookup_id_by_uaa(rsu_devs, sizeof(rsu_devs), uaa));
 359 }
 360
 361 static int
 362 rsu_send_mgmt(struct ieee80211_node *ni, int type, int arg)
 363 {
 364
 365         return (ENOTSUP);
 366 }
 367
 368 static void
 369 rsu_update_chw(struct ieee80211com *ic)
 370 {
 371
 372 }
 373
 374 /*
 375  * notification from net80211 that it'd like to do A-MPDU on the given TID.
 376  *
 377  * Note: this actually hangs traffic at the present moment, so don't use it.
 378  * The firmware debug does indiciate it's sending and establishing a TX AMPDU
 379  * session, but then no traffic flows.
 380  */
 381 static int
 382 rsu_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
 383 {
 384 #if 0
 385         struct rsu_softc *sc = ni->ni_ic->ic_softc;
 386         struct r92s_add_ba_req req;
 387
 388         /* Don't enable if it's requested or running */
 389         if (IEEE80211_AMPDU_REQUESTED(tap))
 390                 return (0);
 391         if (IEEE80211_AMPDU_RUNNING(tap))
 392                 return (0);
 393
 394         /* We've decided to send addba; so send it */
 395         req.tid = htole32(tap->txa_tid);
 396
 397         /* Attempt net80211 state */
 398         if (ieee80211_ampdu_tx_request_ext(ni, tap->txa_tid) != 1)
 399                 return (0);
 400
 401         /* Send the firmware command */
 402         RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: establishing AMPDU TX for TID %d\n",
 403             __func__,
 404             tap->txa_tid);
 405
 406         RSU_LOCK(sc);
 407         if (rsu_fw_cmd(sc, R92S_CMD_ADDBA_REQ, &req, sizeof(req)) != 1) {
 408                 RSU_UNLOCK(sc);
 409                 /* Mark failure */
 410                 (void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 0);
 411                 return (0);
 412         }
 413         RSU_UNLOCK(sc);
 414
 415         /* Mark success; we don't get any further notifications */
 416         (void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 1);
 417 #endif
 418         /* Return 0, we're driving this ourselves */
 419         return (0);
 420 }
 421
 422 static int
 423 rsu_wme_update(struct ieee80211com *ic)
 424 {
 425
 426         /* Firmware handles this; not our problem */
 427         return (0);
 428 }
 429
 430 static int
 431 rsu_attach(device_t self)
 432 {
 433         struct usb_attach_arg *uaa = device_get_ivars(self);
 434         struct rsu_softc *sc = device_get_softc(self);
 435         struct ieee80211com *ic = &sc->sc_ic;
 436         int error;
 437         uint8_t iface_index;
 438         struct usb_interface *iface;
 439         const char *rft;
 440
 441         device_set_usb_desc(self);
 442         sc->sc_udev = uaa->device;
 443         sc->sc_dev = self;
 444         sc->sc_rx_checksum_enable = 1;
 445         if (rsu_enable_11n)
 446                 sc->sc_ht = !! (USB_GET_DRIVER_INFO(uaa) & RSU_HT_SUPPORTED);
 447
 448         /* Get number of endpoints */
 449         iface = usbd_get_iface(sc->sc_udev, 0);
 450         sc->sc_nendpoints = iface->idesc->bNumEndpoints;
 451
 452         /* Endpoints are hard-coded for now, so enforce 4-endpoint only */
 453         if (sc->sc_nendpoints != 4) {
 454                 device_printf(sc->sc_dev,
 455                     "the driver currently only supports 4-endpoint devices\n");
 456                 return (ENXIO);
 457         }
 458
 459         mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
 460             MTX_DEF);
 461         RSU_DELKEY_BMAP_LOCK_INIT(sc);
 462         TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_task, 0,
 463             rsu_calib_task, sc);
 464         TASK_INIT(&sc->del_key_task, 0, rsu_delete_key_pair_cb, sc);
 465         TASK_INIT(&sc->tx_task, 0, rsu_tx_task, sc);
 466         mbufq_init(&sc->sc_snd, ifqmaxlen);
 467
 468         /* Allocate Tx/Rx buffers. */
 469         error = rsu_alloc_rx_list(sc);
 470         if (error != 0) {
 471                 device_printf(sc->sc_dev, "could not allocate Rx buffers\n");
 472                 goto fail_usb;
 473         }
 474
 475         error = rsu_alloc_tx_list(sc);
 476         if (error != 0) {
 477                 device_printf(sc->sc_dev, "could not allocate Tx buffers\n");
 478                 rsu_free_rx_list(sc);
 479                 goto fail_usb;
 480         }
 481
 482         iface_index = 0;
 483         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 484             rsu_config, RSU_N_TRANSFER, sc, &sc->sc_mtx);
 485         if (error) {
 486                 device_printf(sc->sc_dev,
 487                     "could not allocate USB transfers, err=%s\n",
 488                     usbd_errstr(error));
 489                 goto fail_usb;
 490         }
 491         RSU_LOCK(sc);
 492         /* Read chip revision. */
 493         sc->cut = MS(rsu_read_4(sc, R92S_PMC_FSM), R92S_PMC_FSM_CUT);
 494         if (sc->cut != 3)
 495                 sc->cut = (sc->cut >> 1) + 1;
 496         error = rsu_read_rom(sc);
 497         RSU_UNLOCK(sc);
 498         if (error != 0) {
 499                 device_printf(self, "could not read ROM\n");
 500                 goto fail_rom;
 501         }
 502
 503         /* Figure out TX/RX streams */
 504         switch (sc->rom[84]) {
 505         case 0x0:
 506                 sc->sc_rftype = RTL8712_RFCONFIG_1T1R;
 507                 sc->sc_nrxstream = 1;
 508                 sc->sc_ntxstream = 1;
 509                 rft = "1T1R";
 510                 break;
 511         case 0x1:
 512                 sc->sc_rftype = RTL8712_RFCONFIG_1T2R;
 513                 sc->sc_nrxstream = 2;
 514                 sc->sc_ntxstream = 1;
 515                 rft = "1T2R";
 516                 break;
 517         case 0x2:
 518                 sc->sc_rftype = RTL8712_RFCONFIG_2T2R;
 519                 sc->sc_nrxstream = 2;
 520                 sc->sc_ntxstream = 2;
 521                 rft = "2T2R";
 522                 break;
 523         case 0x3:       /* "green" NIC */
 524                 sc->sc_rftype = RTL8712_RFCONFIG_1T2R;
 525                 sc->sc_nrxstream = 2;
 526                 sc->sc_ntxstream = 1;
 527                 rft = "1T2R ('green')";
 528                 break;
 529         default:
 530                 device_printf(sc->sc_dev,
 531                     "%s: unknown board type (rfconfig=0x%02x)\n",
 532                     __func__,
 533                     sc->rom[84]);
 534                 goto fail_rom;
 535         }
 536
 537         IEEE80211_ADDR_COPY(ic->ic_macaddr, &sc->rom[0x12]);
 538         device_printf(self, "MAC/BB RTL8712 cut %d %s\n", sc->cut, rft);
 539
 540         ic->ic_softc = sc;
 541         ic->ic_name = device_get_nameunit(self);
 542         ic->ic_phytype = IEEE80211_T_OFDM;      /* Not only, but not used. */
 543         ic->ic_opmode = IEEE80211_M_STA;        /* Default to BSS mode. */
 544
 545         /* Set device capabilities. */
 546         ic->ic_caps =
 547             IEEE80211_C_STA |           /* station mode */
 548             IEEE80211_C_MONITOR |       /* monitor mode supported */
 549 #if 0
 550             IEEE80211_C_BGSCAN |        /* Background scan. */
 551 #endif
 552             IEEE80211_C_SHPREAMBLE |    /* Short preamble supported. */
 553             IEEE80211_C_WME |           /* WME/QoS */
 554             IEEE80211_C_SHSLOT |        /* Short slot time supported. */
 555             IEEE80211_C_WPA;            /* WPA/RSN. */
 556
 557         ic->ic_cryptocaps =
 558             IEEE80211_CRYPTO_WEP |
 559             IEEE80211_CRYPTO_TKIP |
 560             IEEE80211_CRYPTO_AES_CCM;
 561
 562         /* Check if HT support is present. */
 563         if (sc->sc_ht) {
 564                 device_printf(sc->sc_dev, "%s: enabling 11n\n", __func__);
 565
 566                 /* Enable basic HT */
 567                 ic->ic_htcaps = IEEE80211_HTC_HT |
 568 #if 0
 569                     IEEE80211_HTC_AMPDU |
 570 #endif
 571                     IEEE80211_HTC_AMSDU |
 572                     IEEE80211_HTCAP_MAXAMSDU_3839 |
 573                     IEEE80211_HTCAP_SMPS_OFF;
 574                 ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
 575
 576                 /* set number of spatial streams */
 577                 ic->ic_txstream = sc->sc_ntxstream;
 578                 ic->ic_rxstream = sc->sc_nrxstream;
 579         }
 580         ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
 581
 582         rsu_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
 583             ic->ic_channels);
 584
 585         ieee80211_ifattach(ic);
 586         ic->ic_raw_xmit = rsu_raw_xmit;
 587         ic->ic_scan_start = rsu_scan_start;
 588         ic->ic_scan_end = rsu_scan_end;
 589         ic->ic_getradiocaps = rsu_getradiocaps;
 590         ic->ic_set_channel = rsu_set_channel;
 591         ic->ic_scan_curchan = rsu_scan_curchan;
 592         ic->ic_scan_mindwell = rsu_scan_mindwell;
 593         ic->ic_vap_create = rsu_vap_create;
 594         ic->ic_vap_delete = rsu_vap_delete;
 595         ic->ic_update_promisc = rsu_update_promisc;
 596         ic->ic_update_mcast = rsu_update_mcast;
 597         ic->ic_ioctl = rsu_ioctl_net;
 598         ic->ic_parent = rsu_parent;
 599         ic->ic_transmit = rsu_transmit;
 600         ic->ic_send_mgmt = rsu_send_mgmt;
 601         ic->ic_update_chw = rsu_update_chw;
 602         ic->ic_ampdu_enable = rsu_ampdu_enable;
 603         ic->ic_wme.wme_update = rsu_wme_update;
 604
 605         ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
 606             sizeof(sc->sc_txtap), RSU_TX_RADIOTAP_PRESENT,
 607             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 608             RSU_RX_RADIOTAP_PRESENT);
 609
 610         if (bootverbose)
 611                 ieee80211_announce(ic);
 612
 613         return (0);
 614
 615 fail_rom:
 616         usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
 617 fail_usb:
 618         mtx_destroy(&sc->sc_mtx);
 619         return (ENXIO);
 620 }
 621
 622 static int
 623 rsu_detach(device_t self)
 624 {
 625         struct rsu_softc *sc = device_get_softc(self);
 626         struct ieee80211com *ic = &sc->sc_ic;
 627
 628         rsu_stop(sc);
 629
 630         usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
 631
 632         /*
 633          * Free buffers /before/ we detach from net80211, else node
 634          * references to destroyed vaps will lead to a panic.
 635          */
 636         /* Free Tx/Rx buffers. */
 637         RSU_LOCK(sc);
 638         rsu_free_tx_list(sc);
 639         rsu_free_rx_list(sc);
 640         RSU_UNLOCK(sc);
 641
 642         /* Frames are freed; detach from net80211 */
 643         ieee80211_ifdetach(ic);
 644
 645         taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
 646         taskqueue_drain(taskqueue_thread, &sc->del_key_task);
 647         taskqueue_drain(taskqueue_thread, &sc->tx_task);
 648
 649         RSU_DELKEY_BMAP_LOCK_DESTROY(sc);
 650         mtx_destroy(&sc->sc_mtx);
 651
 652         return (0);
 653 }
 654
 655 static usb_error_t
 656 rsu_do_request(struct rsu_softc *sc, struct usb_device_request *req,
 657     void *data)
 658 {
 659         usb_error_t err;
 660         int ntries = 10;
 661
 662         RSU_ASSERT_LOCKED(sc);
 663
 664         while (ntries--) {
 665                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
 666                     req, data, 0, NULL, 250 /* ms */);
 667                 if (err == 0 || err == USB_ERR_NOT_CONFIGURED)
 668                         break;
 669                 RSU_DPRINTF(sc, RSU_DEBUG_USB,
 670                     "Control request failed, %s (retries left: %d)\n",
 671                     usbd_errstr(err), ntries);
 672                 rsu_ms_delay(sc, 10);
 673         }
 674
 675         return (err);
 676 }
 677
 678 static struct ieee80211vap *
 679 rsu_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 680     enum ieee80211_opmode opmode, int flags,
 681     const uint8_t bssid[IEEE80211_ADDR_LEN],
 682     const uint8_t mac[IEEE80211_ADDR_LEN])
 683 {
 684         struct rsu_softc *sc = ic->ic_softc;
 685         struct rsu_vap *uvp;
 686         struct ieee80211vap *vap;
 687         struct ifnet *ifp;
 688
 689         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 690                 return (NULL);
 691
 692         uvp =  malloc(sizeof(struct rsu_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 693         vap = &uvp->vap;
 694
 695         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
 696             flags, bssid) != 0) {
 697                 /* out of memory */
 698                 free(uvp, M_80211_VAP);
 699                 return (NULL);
 700         }
 701
 702         ifp = vap->iv_ifp;
 703         ifp->if_capabilities = IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
 704         RSU_LOCK(sc);
 705         if (sc->sc_rx_checksum_enable)
 706                 ifp->if_capenable |= IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
 707         RSU_UNLOCK(sc);
 708
 709         /* override state transition machine */
 710         uvp->newstate = vap->iv_newstate;
 711         if (opmode == IEEE80211_M_MONITOR)
 712                 vap->iv_newstate = rsu_monitor_newstate;
 713         else
 714                 vap->iv_newstate = rsu_newstate;
 715         vap->iv_key_alloc = rsu_key_alloc;
 716         vap->iv_key_set = rsu_key_set;
 717         vap->iv_key_delete = rsu_key_delete;
 718
 719         /* Limits from the r92su driver */
 720         vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
 721         vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
 722
 723         /* complete setup */
 724         ieee80211_vap_attach(vap, ieee80211_media_change,
 725             ieee80211_media_status, mac);
 726         ic->ic_opmode = opmode;
 727
 728         return (vap);
 729 }
 730
 731 static void
 732 rsu_vap_delete(struct ieee80211vap *vap)
 733 {
 734         struct rsu_vap *uvp = RSU_VAP(vap);
 735
 736         ieee80211_vap_detach(vap);
 737         free(uvp, M_80211_VAP);
 738 }
 739
 740 static void
 741 rsu_scan_start(struct ieee80211com *ic)
 742 {
 743         struct rsu_softc *sc = ic->ic_softc;
 744         struct ieee80211_scan_state *ss = ic->ic_scan;
 745         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 746         int error;
 747
 748         /* Scanning is done by the firmware. */
 749         RSU_LOCK(sc);
 750         sc->sc_active_scan = !!(ss->ss_flags & IEEE80211_SCAN_ACTIVE);
 751         /* XXX TODO: force awake if in network-sleep? */
 752         error = rsu_site_survey(sc, ss->ss_nssid > 0 ? &ss->ss_ssid[0] : NULL);
 753         RSU_UNLOCK(sc);
 754         if (error != 0) {
 755                 device_printf(sc->sc_dev,
 756                     "could not send site survey command\n");
 757                 ieee80211_cancel_scan(vap);
 758         }
 759 }
 760
 761 static void
 762 rsu_scan_end(struct ieee80211com *ic)
 763 {
 764         /* Nothing to do here. */
 765 }
 766
 767 static void
 768 rsu_getradiocaps(struct ieee80211com *ic,
 769     int maxchans, int *nchans, struct ieee80211_channel chans[])
 770 {
 771         struct rsu_softc *sc = ic->ic_softc;
 772         uint8_t bands[IEEE80211_MODE_BYTES];
 773
 774         /* Set supported .11b and .11g rates. */
 775         memset(bands, 0, sizeof(bands));
 776         setbit(bands, IEEE80211_MODE_11B);
 777         setbit(bands, IEEE80211_MODE_11G);
 778         if (sc->sc_ht)
 779                 setbit(bands, IEEE80211_MODE_11NG);
 780         ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
 781             bands, (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) != 0);
 782 }
 783
 784 static void
 785 rsu_set_channel(struct ieee80211com *ic)
 786 {
 787         struct rsu_softc *sc = ic->ic_softc;
 788
 789         /*
 790          * Only need to set the channel in Monitor mode. AP scanning and auth
 791          * are already taken care of by their respective firmware commands.
 792          */
 793         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
 794                 struct r92s_set_channel cmd;
 795                 int error;
 796
 797                 cmd.channel = IEEE80211_CHAN2IEEE(ic->ic_curchan);
 798
 799                 RSU_LOCK(sc);
 800                 error = rsu_fw_cmd(sc, R92S_CMD_SET_CHANNEL, &cmd,
 801                     sizeof(cmd));
 802                 if (error != 0) {
 803                         device_printf(sc->sc_dev,
 804                             "%s: error %d setting channel\n", __func__,
 805                             error);
 806                 }
 807                 RSU_UNLOCK(sc);
 808         }
 809 }
 810
 811 static void
 812 rsu_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 813 {
 814         /* Scan is done in rsu_scan_start(). */
 815 }
 816
 817 /**
 818  * Called by the net80211 framework to indicate
 819  * the minimum dwell time has been met, terminate the scan.
 820  * We don't actually terminate the scan as the firmware will notify
 821  * us when it's finished and we have no way to interrupt it.
 822  */
 823 static void
 824 rsu_scan_mindwell(struct ieee80211_scan_state *ss)
 825 {
 826         /* NB: don't try to abort scan; wait for firmware to finish */
 827 }
 828
 829 static void
 830 rsu_update_promisc(struct ieee80211com *ic)
 831 {
 832         struct rsu_softc *sc = ic->ic_softc;
 833
 834         RSU_LOCK(sc);
 835         if (sc->sc_running)
 836                 rsu_rxfilter_refresh(sc);
 837         RSU_UNLOCK(sc);
 838 }
 839
 840 /*
 841  * The same as rtwn_get_multi_pos() / rtwn_set_multi().
 842  */
 843 static uint8_t
 844 rsu_get_multi_pos(const uint8_t maddr[])
 845 {
 846         uint64_t mask = 0x00004d101df481b4;
 847         uint8_t pos = 0x27;     /* initial value */
 848         int i, j;
 849
 850         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
 851                 for (j = (i == 0) ? 1 : 0; j < 8; j++)
 852                         if ((maddr[i] >> j) & 1)
 853                                 pos ^= (mask >> (i * 8 + j - 1));
 854
 855         pos &= 0x3f;
 856
 857         return (pos);
 858 }
 859
 860 static void
 861 rsu_set_multi(struct rsu_softc *sc)
 862 {
 863         struct ieee80211com *ic = &sc->sc_ic;
 864         uint32_t mfilt[2];
 865
 866         RSU_ASSERT_LOCKED(sc);
 867
 868         /* general structure was copied from ath(4). */
 869         if (ic->ic_allmulti == 0) {
 870                 struct ieee80211vap *vap;
 871                 struct ifnet *ifp;
 872                 struct ifmultiaddr *ifma;
 873
 874                 /*
 875                  * Merge multicast addresses to form the hardware filter.
 876                  */
 877                 mfilt[0] = mfilt[1] = 0;
 878                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
 879                         ifp = vap->iv_ifp;
 880                         if_maddr_rlock(ifp);
 881                         CK_STAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
 882                                 caddr_t dl;
 883                                 uint8_t pos;
 884
 885                                 dl = LLADDR((struct sockaddr_dl *)
 886                                     ifma->ifma_addr);
 887                                 pos = rsu_get_multi_pos(dl);
 888
 889                                 mfilt[pos / 32] |= (1 << (pos % 32));
 890                         }
 891                         if_maddr_runlock(ifp);
 892                 }
 893         } else
 894                 mfilt[0] = mfilt[1] = ~0;
 895
 896         rsu_write_4(sc, R92S_MAR + 0, mfilt[0]);
 897         rsu_write_4(sc, R92S_MAR + 4, mfilt[1]);
 898
 899         RSU_DPRINTF(sc, RSU_DEBUG_STATE, "%s: MC filter %08x:%08x\n",
 900             __func__, mfilt[0], mfilt[1]);
 901 }
 902
 903 static void
 904 rsu_update_mcast(struct ieee80211com *ic)
 905 {
 906         struct rsu_softc *sc = ic->ic_softc;
 907
 908         RSU_LOCK(sc);
 909         if (sc->sc_running)
 910                 rsu_set_multi(sc);
 911         RSU_UNLOCK(sc);
 912 }
 913
 914 static int
 915 rsu_alloc_list(struct rsu_softc *sc, struct rsu_data data[],
 916     int ndata, int maxsz)
 917 {
 918         int i, error;
 919
 920         for (i = 0; i < ndata; i++) {
 921                 struct rsu_data *dp = &data[i];
 922                 dp->sc = sc;
 923                 dp->m = NULL;
 924                 dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
 925                 if (dp->buf == NULL) {
 926                         device_printf(sc->sc_dev,
 927                             "could not allocate buffer\n");
 928                         error = ENOMEM;
 929                         goto fail;
 930                 }
 931                 dp->ni = NULL;
 932         }
 933
 934         return (0);
 935 fail:
 936         rsu_free_list(sc, data, ndata);
 937         return (error);
 938 }
 939
 940 static int
 941 rsu_alloc_rx_list(struct rsu_softc *sc)
 942 {
 943         int error, i;
 944
 945         error = rsu_alloc_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT,
 946             RSU_RXBUFSZ);
 947         if (error != 0)
 948                 return (error);
 949
 950         STAILQ_INIT(&sc->sc_rx_active);
 951         STAILQ_INIT(&sc->sc_rx_inactive);
 952
 953         for (i = 0; i < RSU_RX_LIST_COUNT; i++)
 954                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
 955
 956         return (0);
 957 }
 958
 959 static int
 960 rsu_alloc_tx_list(struct rsu_softc *sc)
 961 {
 962         int error, i;
 963
 964         error = rsu_alloc_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT,
 965             RSU_TXBUFSZ);
 966         if (error != 0)
 967                 return (error);
 968
 969         STAILQ_INIT(&sc->sc_tx_inactive);
 970
 971         for (i = 0; i != RSU_N_TRANSFER; i++) {
 972                 STAILQ_INIT(&sc->sc_tx_active[i]);
 973                 STAILQ_INIT(&sc->sc_tx_pending[i]);
 974         }
 975
 976         for (i = 0; i < RSU_TX_LIST_COUNT; i++) {
 977                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
 978         }
 979
 980         return (0);
 981 }
 982
 983 static void
 984 rsu_free_tx_list(struct rsu_softc *sc)
 985 {
 986         int i;
 987
 988         /* prevent further allocations from TX list(s) */
 989         STAILQ_INIT(&sc->sc_tx_inactive);
 990
 991         for (i = 0; i != RSU_N_TRANSFER; i++) {
 992                 STAILQ_INIT(&sc->sc_tx_active[i]);
 993                 STAILQ_INIT(&sc->sc_tx_pending[i]);
 994         }
 995
 996         rsu_free_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT);
 997 }
 998
 999 static void
1000 rsu_free_rx_list(struct rsu_softc *sc)
1001 {
1002         /* prevent further allocations from RX list(s) */
1003         STAILQ_INIT(&sc->sc_rx_inactive);
1004         STAILQ_INIT(&sc->sc_rx_active);
1005
1006         rsu_free_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT);
1007 }
1008
1009 static void
1010 rsu_free_list(struct rsu_softc *sc, struct rsu_data data[], int ndata)
1011 {
1012         int i;
1013
1014         for (i = 0; i < ndata; i++) {
1015                 struct rsu_data *dp = &data[i];
1016
1017                 if (dp->buf != NULL) {
1018                         free(dp->buf, M_USBDEV);
1019                         dp->buf = NULL;
1020                 }
1021                 if (dp->ni != NULL) {
1022                         ieee80211_free_node(dp->ni);
1023                         dp->ni = NULL;
1024                 }
1025         }
1026 }
1027
1028 static struct rsu_data *
1029 _rsu_getbuf(struct rsu_softc *sc)
1030 {
1031         struct rsu_data *bf;
1032
1033         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1034         if (bf != NULL)
1035                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1036         else
1037                 bf = NULL;
1038         return (bf);
1039 }
1040
1041 static struct rsu_data *
1042 rsu_getbuf(struct rsu_softc *sc)
1043 {
1044         struct rsu_data *bf;
1045
1046         RSU_ASSERT_LOCKED(sc);
1047
1048         bf = _rsu_getbuf(sc);
1049         if (bf == NULL) {
1050                 RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: no buffers\n", __func__);
1051         }
1052         return (bf);
1053 }
1054
1055 static void
1056 rsu_freebuf(struct rsu_softc *sc, struct rsu_data *bf)
1057 {
1058
1059         RSU_ASSERT_LOCKED(sc);
1060         STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
1061 }
1062
1063 static int
1064 rsu_write_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
1065     int len)
1066 {
1067         usb_device_request_t req;
1068
1069         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1070         req.bRequest = R92S_REQ_REGS;
1071         USETW(req.wValue, addr);
1072         USETW(req.wIndex, 0);
1073         USETW(req.wLength, len);
1074
1075         return (rsu_do_request(sc, &req, buf));
1076 }
1077
1078 static void
1079 rsu_write_1(struct rsu_softc *sc, uint16_t addr, uint8_t val)
1080 {
1081         rsu_write_region_1(sc, addr, &val, 1);
1082 }
1083
1084 static void
1085 rsu_write_2(struct rsu_softc *sc, uint16_t addr, uint16_t val)
1086 {
1087         val = htole16(val);
1088         rsu_write_region_1(sc, addr, (uint8_t *)&val, 2);
1089 }
1090
1091 static void
1092 rsu_write_4(struct rsu_softc *sc, uint16_t addr, uint32_t val)
1093 {
1094         val = htole32(val);
1095         rsu_write_region_1(sc, addr, (uint8_t *)&val, 4);
1096 }
1097
1098 static int
1099 rsu_read_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
1100     int len)
1101 {
1102         usb_device_request_t req;
1103
1104         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1105         req.bRequest = R92S_REQ_REGS;
1106         USETW(req.wValue, addr);
1107         USETW(req.wIndex, 0);
1108         USETW(req.wLength, len);
1109
1110         return (rsu_do_request(sc, &req, buf));
1111 }
1112
1113 static uint8_t
1114 rsu_read_1(struct rsu_softc *sc, uint16_t addr)
1115 {
1116         uint8_t val;
1117
1118         if (rsu_read_region_1(sc, addr, &val, 1) != 0)
1119                 return (0xff);
1120         return (val);
1121 }
1122
1123 static uint16_t
1124 rsu_read_2(struct rsu_softc *sc, uint16_t addr)
1125 {
1126         uint16_t val;
1127
1128         if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1129                 return (0xffff);
1130         return (le16toh(val));
1131 }
1132
1133 static uint32_t
1134 rsu_read_4(struct rsu_softc *sc, uint16_t addr)
1135 {
1136         uint32_t val;
1137
1138         if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1139                 return (0xffffffff);
1140         return (le32toh(val));
1141 }
1142
1143 static int
1144 rsu_fw_iocmd(struct rsu_softc *sc, uint32_t iocmd)
1145 {
1146         int ntries;
1147
1148         rsu_write_4(sc, R92S_IOCMD_CTRL, iocmd);
1149         rsu_ms_delay(sc, 1);
1150         for (ntries = 0; ntries < 50; ntries++) {
1151                 if (rsu_read_4(sc, R92S_IOCMD_CTRL) == 0)
1152                         return (0);
1153                 rsu_ms_delay(sc, 1);
1154         }
1155         return (ETIMEDOUT);
1156 }
1157
1158 static uint8_t
1159 rsu_efuse_read_1(struct rsu_softc *sc, uint16_t addr)
1160 {
1161         uint32_t reg;
1162         int ntries;
1163
1164         reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
1165         reg = RW(reg, R92S_EFUSE_CTRL_ADDR, addr);
1166         reg &= ~R92S_EFUSE_CTRL_VALID;
1167         rsu_write_4(sc, R92S_EFUSE_CTRL, reg);
1168         /* Wait for read operation to complete. */
1169         for (ntries = 0; ntries < 100; ntries++) {
1170                 reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
1171                 if (reg & R92S_EFUSE_CTRL_VALID)
1172                         return (MS(reg, R92S_EFUSE_CTRL_DATA));
1173                 rsu_ms_delay(sc, 1);
1174         }
1175         device_printf(sc->sc_dev,
1176             "could not read efuse byte at address 0x%x\n", addr);
1177         return (0xff);
1178 }
1179
1180 static int
1181 rsu_read_rom(struct rsu_softc *sc)
1182 {
1183         uint8_t *rom = sc->rom;
1184         uint16_t addr = 0;
1185         uint32_t reg;
1186         uint8_t off, msk;
1187         int i;
1188
1189         /* Make sure that ROM type is eFuse and that autoload succeeded. */
1190         reg = rsu_read_1(sc, R92S_EE_9346CR);
1191         if ((reg & (R92S_9356SEL | R92S_EEPROM_EN)) != R92S_EEPROM_EN)
1192                 return (EIO);
1193
1194         /* Turn on 2.5V to prevent eFuse leakage. */
1195         reg = rsu_read_1(sc, R92S_EFUSE_TEST + 3);
1196         rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg | 0x80);
1197         rsu_ms_delay(sc, 1);
1198         rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg & ~0x80);
1199
1200         /* Read full ROM image. */
1201         memset(&sc->rom, 0xff, sizeof(sc->rom));
1202         while (addr < 512) {
1203                 reg = rsu_efuse_read_1(sc, addr);
1204                 if (reg == 0xff)
1205                         break;
1206                 addr++;
1207                 off = reg >> 4;
1208                 msk = reg & 0xf;
1209                 for (i = 0; i < 4; i++) {
1210                         if (msk & (1 << i))
1211                                 continue;
1212                         rom[off * 8 + i * 2 + 0] =
1213                             rsu_efuse_read_1(sc, addr);
1214                         addr++;
1215                         rom[off * 8 + i * 2 + 1] =
1216                             rsu_efuse_read_1(sc, addr);
1217                         addr++;
1218                 }
1219         }
1220 #ifdef USB_DEBUG
1221         if (rsu_debug & RSU_DEBUG_RESET) {
1222                 /* Dump ROM content. */
1223                 printf("\n");
1224                 for (i = 0; i < sizeof(sc->rom); i++)
1225                         printf("%02x:", rom[i]);
1226                 printf("\n");
1227         }
1228 #endif
1229         return (0);
1230 }
1231
1232 static int
1233 rsu_fw_cmd(struct rsu_softc *sc, uint8_t code, void *buf, int len)
1234 {
1235         const uint8_t which = RSU_H2C_ENDPOINT;
1236         struct rsu_data *data;
1237         struct r92s_tx_desc *txd;
1238         struct r92s_fw_cmd_hdr *cmd;
1239         int cmdsz;
1240         int xferlen;
1241
1242         RSU_ASSERT_LOCKED(sc);
1243
1244         data = rsu_getbuf(sc);
1245         if (data == NULL)
1246                 return (ENOMEM);
1247
1248         /* Blank the entire payload, just to be safe */
1249         memset(data->buf, '\0', RSU_TXBUFSZ);
1250
1251         /* Round-up command length to a multiple of 8 bytes. */
1252         /* XXX TODO: is this required? */
1253         cmdsz = (len + 7) & ~7;
1254
1255         xferlen = sizeof(*txd) + sizeof(*cmd) + cmdsz;
1256         KASSERT(xferlen <= RSU_TXBUFSZ, ("%s: invalid length", __func__));
1257         memset(data->buf, 0, xferlen);
1258
1259         /* Setup Tx descriptor. */
1260         txd = (struct r92s_tx_desc *)data->buf;
1261         txd->txdw0 = htole32(
1262             SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
1263             SM(R92S_TXDW0_PKTLEN, sizeof(*cmd) + cmdsz) |
1264             R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
1265         txd->txdw1 = htole32(SM(R92S_TXDW1_QSEL, R92S_TXDW1_QSEL_H2C));
1266
1267         /* Setup command header. */
1268         cmd = (struct r92s_fw_cmd_hdr *)&txd[1];
1269         cmd->len = htole16(cmdsz);
1270         cmd->code = code;
1271         cmd->seq = sc->cmd_seq;
1272         sc->cmd_seq = (sc->cmd_seq + 1) & 0x7f;
1273
1274         /* Copy command payload. */
1275         memcpy(&cmd[1], buf, len);
1276
1277         RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FWCMD,
1278             "%s: Tx cmd code=0x%x len=0x%x\n",
1279             __func__, code, cmdsz);
1280         data->buflen = xferlen;
1281         STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
1282         usbd_transfer_start(sc->sc_xfer[which]);
1283
1284         return (0);
1285 }
1286
1287 /* ARGSUSED */
1288 static void
1289 rsu_calib_task(void *arg, int pending __unused)
1290 {
1291         struct rsu_softc *sc = arg;
1292 #ifdef notyet
1293         uint32_t reg;
1294 #endif
1295
1296         RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: running calibration task\n",
1297             __func__);
1298
1299         RSU_LOCK(sc);
1300 #ifdef notyet
1301         /* Read WPS PBC status. */
1302         rsu_write_1(sc, R92S_MAC_PINMUX_CTRL,
1303             R92S_GPIOMUX_EN | SM(R92S_GPIOSEL_GPIO, R92S_GPIOSEL_GPIO_JTAG));
1304         rsu_write_1(sc, R92S_GPIO_IO_SEL,
1305             rsu_read_1(sc, R92S_GPIO_IO_SEL) & ~R92S_GPIO_WPS);
1306         reg = rsu_read_1(sc, R92S_GPIO_CTRL);
1307         if (reg != 0xff && (reg & R92S_GPIO_WPS))
1308                 RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "WPS PBC is pushed\n");
1309 #endif
1310         /* Read current signal level. */
1311         if (rsu_fw_iocmd(sc, 0xf4000001) == 0) {
1312                 sc->sc_currssi = rsu_read_4(sc, R92S_IOCMD_DATA);
1313                 RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: RSSI=%d (%d)\n",
1314                     __func__, sc->sc_currssi,
1315                     rsu_hwrssi_to_rssi(sc, sc->sc_currssi));
1316         }
1317         if (sc->sc_calibrating)
1318                 taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task, hz);
1319         RSU_UNLOCK(sc);
1320 }
1321
1322 static void
1323 rsu_tx_task(void *arg, int pending __unused)
1324 {
1325         struct rsu_softc *sc = arg;
1326
1327         RSU_LOCK(sc);
1328         _rsu_start(sc);
1329         RSU_UNLOCK(sc);
1330 }
1331
1332 #define RSU_PWR_UNKNOWN         0x0
1333 #define RSU_PWR_ACTIVE          0x1
1334 #define RSU_PWR_OFF             0x2
1335 #define RSU_PWR_SLEEP           0x3
1336
1337 /*
1338  * Set the current power state.
1339  *
1340  * The rtlwifi code doesn't do this so aggressively; it
1341  * waits for an idle period after association with
1342  * no traffic before doing this.
1343  *
1344  * For now - it's on in all states except RUN, and
1345  * in RUN it'll transition to allow sleep.
1346  */
1347
1348 struct r92s_pwr_cmd {
1349         uint8_t mode;
1350         uint8_t smart_ps;
1351         uint8_t bcn_pass_time;
1352 };
1353
1354 static int
1355 rsu_set_fw_power_state(struct rsu_softc *sc, int state)
1356 {
1357         struct r92s_set_pwr_mode cmd;
1358         //struct r92s_pwr_cmd cmd;
1359         int error;
1360
1361         RSU_ASSERT_LOCKED(sc);
1362
1363         /* only change state if required */
1364         if (sc->sc_curpwrstate == state)
1365                 return (0);
1366
1367         memset(&cmd, 0, sizeof(cmd));
1368
1369         switch (state) {
1370         case RSU_PWR_ACTIVE:
1371                 /* Force the hardware awake */
1372                 rsu_write_1(sc, R92S_USB_HRPWM,
1373                     R92S_USB_HRPWM_PS_ST_ACTIVE | R92S_USB_HRPWM_PS_ALL_ON);
1374                 cmd.mode = R92S_PS_MODE_ACTIVE;
1375                 break;
1376         case RSU_PWR_SLEEP:
1377                 cmd.mode = R92S_PS_MODE_DTIM;   /* XXX configurable? */
1378                 cmd.smart_ps = 1; /* XXX 2 if doing p2p */
1379                 cmd.bcn_pass_time = 5; /* in 100mS usb.c, linux/rtlwifi */
1380                 break;
1381         case RSU_PWR_OFF:
1382                 cmd.mode = R92S_PS_MODE_RADIOOFF;
1383                 break;
1384         default:
1385                 device_printf(sc->sc_dev, "%s: unknown ps mode (%d)\n",
1386                     __func__,
1387                     state);
1388                 return (ENXIO);
1389         }
1390
1391         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1392             "%s: setting ps mode to %d (mode %d)\n",
1393             __func__, state, cmd.mode);
1394         error = rsu_fw_cmd(sc, R92S_CMD_SET_PWR_MODE, &cmd, sizeof(cmd));
1395         if (error == 0)
1396                 sc->sc_curpwrstate = state;
1397
1398         return (error);
1399 }
1400
1401 static void
1402 rsu_set_led(struct rsu_softc *sc, int on)
1403 {
1404         rsu_write_1(sc, R92S_LEDCFG,
1405             (rsu_read_1(sc, R92S_LEDCFG) & 0xf0) | (!on << 3));
1406 }
1407
1408 static int
1409 rsu_monitor_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate,
1410     int arg)
1411 {
1412         struct ieee80211com *ic = vap->iv_ic;
1413         struct rsu_softc *sc = ic->ic_softc;
1414         struct rsu_vap *uvp = RSU_VAP(vap);
1415
1416         if (vap->iv_state != nstate) {
1417                 IEEE80211_UNLOCK(ic);
1418                 RSU_LOCK(sc);
1419
1420                 switch (nstate) {
1421                 case IEEE80211_S_INIT:
1422                         sc->sc_vap_is_running = 0;
1423                         rsu_set_led(sc, 0);
1424                         break;
1425                 case IEEE80211_S_RUN:
1426                         sc->sc_vap_is_running = 1;
1427                         rsu_set_led(sc, 1);
1428                         break;
1429                 default:
1430                         /* NOTREACHED */
1431                         break;
1432                 }
1433                 rsu_rxfilter_refresh(sc);
1434
1435                 RSU_UNLOCK(sc);
1436                 IEEE80211_LOCK(ic);
1437         }
1438
1439         return (uvp->newstate(vap, nstate, arg));
1440 }
1441
1442 static int
1443 rsu_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1444 {
1445         struct rsu_vap *uvp = RSU_VAP(vap);
1446         struct ieee80211com *ic = vap->iv_ic;
1447         struct rsu_softc *sc = ic->ic_softc;
1448         struct ieee80211_node *ni;
1449         struct ieee80211_rateset *rs;
1450         enum ieee80211_state ostate;
1451         int error, startcal = 0;
1452
1453         ostate = vap->iv_state;
1454         RSU_DPRINTF(sc, RSU_DEBUG_STATE, "%s: %s -> %s\n",
1455             __func__,
1456             ieee80211_state_name[ostate],
1457             ieee80211_state_name[nstate]);
1458
1459         IEEE80211_UNLOCK(ic);
1460         if (ostate == IEEE80211_S_RUN) {
1461                 RSU_LOCK(sc);
1462                 /* Stop calibration. */
1463                 sc->sc_calibrating = 0;
1464
1465                 /* Pause Tx for AC queues. */
1466                 rsu_write_1(sc, R92S_TXPAUSE, R92S_TXPAUSE_AC);
1467                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1468
1469                 RSU_UNLOCK(sc);
1470                 taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
1471                 taskqueue_drain(taskqueue_thread, &sc->tx_task);
1472                 RSU_LOCK(sc);
1473                 /* Disassociate from our current BSS. */
1474                 rsu_disconnect(sc);
1475                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1476
1477                 /* Refresh Rx filter (may be modified by firmware). */
1478                 sc->sc_vap_is_running = 0;
1479                 rsu_rxfilter_refresh(sc);
1480
1481                 /* Reinstall static keys. */
1482                 if (sc->sc_running)
1483                         rsu_reinit_static_keys(sc);
1484         } else
1485                 RSU_LOCK(sc);
1486         switch (nstate) {
1487         case IEEE80211_S_INIT:
1488                 (void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
1489                 break;
1490         case IEEE80211_S_AUTH:
1491                 ni = ieee80211_ref_node(vap->iv_bss);
1492                 (void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
1493                 error = rsu_join_bss(sc, ni);
1494                 ieee80211_free_node(ni);
1495                 if (error != 0) {
1496                         device_printf(sc->sc_dev,
1497                             "could not send join command\n");
1498                 }
1499                 break;
1500         case IEEE80211_S_RUN:
1501                 /* Flush all AC queues. */
1502                 rsu_write_1(sc, R92S_TXPAUSE, 0);
1503
1504                 ni = ieee80211_ref_node(vap->iv_bss);
1505                 rs = &ni->ni_rates;
1506                 /* Indicate highest supported rate. */
1507                 ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1508                 (void) rsu_set_fw_power_state(sc, RSU_PWR_SLEEP);
1509                 ieee80211_free_node(ni);
1510                 startcal = 1;
1511                 break;
1512         default:
1513                 break;
1514         }
1515         if (startcal != 0) {
1516                 sc->sc_calibrating = 1;
1517                 /* Start periodic calibration. */
1518                 taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task,
1519                     hz);
1520         }
1521         RSU_UNLOCK(sc);
1522         IEEE80211_LOCK(ic);
1523         return (uvp->newstate(vap, nstate, arg));
1524 }
1525
1526 static int
1527 rsu_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
1528     ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
1529 {
1530         struct rsu_softc *sc = vap->iv_ic->ic_softc;
1531         int is_checked = 0;
1532
1533         if (&vap->iv_nw_keys[0] <= k &&
1534             k < &vap->iv_nw_keys[IEEE80211_WEP_NKID]) {
1535                 *keyix = ieee80211_crypto_get_key_wepidx(vap, k);
1536         } else {
1537                 if (vap->iv_opmode != IEEE80211_M_STA) {
1538                         *keyix = 0;
1539                         /* TODO: obtain keyix from node id */
1540                         is_checked = 1;
1541                         k->wk_flags |= IEEE80211_KEY_SWCRYPT;
1542                 } else
1543                         *keyix = R92S_MACID_BSS;
1544         }
1545
1546         if (!is_checked) {
1547                 RSU_LOCK(sc);
1548                 if (isset(sc->keys_bmap, *keyix)) {
1549                         device_printf(sc->sc_dev,
1550                             "%s: key slot %d is already used!\n",
1551                             __func__, *keyix);
1552                         RSU_UNLOCK(sc);
1553                         return (0);
1554                 }
1555                 setbit(sc->keys_bmap, *keyix);
1556                 RSU_UNLOCK(sc);
1557         }
1558
1559         *rxkeyix = *keyix;
1560
1561         return (1);
1562 }
1563
1564 static int
1565 rsu_process_key(struct ieee80211vap *vap, const struct ieee80211_key *k,
1566     int set)
1567 {
1568         struct rsu_softc *sc = vap->iv_ic->ic_softc;
1569         int ret;
1570
1571         if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
1572                 /* Not for us. */
1573                 return (1);
1574         }
1575
1576         /* Handle group keys. */
1577         if (&vap->iv_nw_keys[0] <= k &&
1578             k < &vap->iv_nw_keys[IEEE80211_WEP_NKID]) {
1579                 KASSERT(k->wk_keyix < nitems(sc->group_keys),
1580                     ("keyix %u > %zu\n", k->wk_keyix, nitems(sc->group_keys)));
1581
1582                 RSU_LOCK(sc);
1583                 sc->group_keys[k->wk_keyix] = (set ? k : NULL);
1584                 if (!sc->sc_running) {
1585                         /* Static keys will be set during device startup. */
1586                         RSU_UNLOCK(sc);
1587                         return (1);
1588                 }
1589
1590                 if (set)
1591                         ret = rsu_set_key_group(sc, k);
1592                 else
1593                         ret = rsu_delete_key(sc, k->wk_keyix);
1594                 RSU_UNLOCK(sc);
1595
1596                 return (!ret);
1597         }
1598
1599         if (set) {
1600                 /* wait for pending key removal */
1601                 taskqueue_drain(taskqueue_thread, &sc->del_key_task);
1602
1603                 RSU_LOCK(sc);
1604                 ret = rsu_set_key_pair(sc, k);
1605                 RSU_UNLOCK(sc);
1606         } else {
1607                 RSU_DELKEY_BMAP_LOCK(sc);
1608                 setbit(sc->free_keys_bmap, k->wk_keyix);
1609                 RSU_DELKEY_BMAP_UNLOCK(sc);
1610
1611                 /* workaround ieee80211_node_delucastkey() locking */
1612                 taskqueue_enqueue(taskqueue_thread, &sc->del_key_task);
1613                 ret = 0;        /* fake success */
1614         }
1615
1616         return (!ret);
1617 }
1618
1619 static int
1620 rsu_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1621 {
1622         return (rsu_process_key(vap, k, 1));
1623 }
1624
1625 static int
1626 rsu_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1627 {
1628         return (rsu_process_key(vap, k, 0));
1629 }
1630
1631 static int
1632 rsu_cam_read(struct rsu_softc *sc, uint8_t addr, uint32_t *val)
1633 {
1634         int ntries;
1635
1636         rsu_write_4(sc, R92S_CAMCMD,
1637             R92S_CAMCMD_POLLING | SM(R92S_CAMCMD_ADDR, addr));
1638         for (ntries = 0; ntries < 10; ntries++) {
1639                 if (!(rsu_read_4(sc, R92S_CAMCMD) & R92S_CAMCMD_POLLING))
1640                         break;
1641
1642                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(1));
1643         }
1644         if (ntries == 10) {
1645                 device_printf(sc->sc_dev,
1646                     "%s: cannot read CAM entry at address %02X\n",
1647                     __func__, addr);
1648                 return (ETIMEDOUT);
1649         }
1650
1651         *val = rsu_read_4(sc, R92S_CAMREAD);
1652
1653         return (0);
1654 }
1655
1656 static void
1657 rsu_cam_write(struct rsu_softc *sc, uint8_t addr, uint32_t data)
1658 {
1659
1660         rsu_write_4(sc, R92S_CAMWRITE, data);
1661         rsu_write_4(sc, R92S_CAMCMD,
1662             R92S_CAMCMD_POLLING | R92S_CAMCMD_WRITE |
1663             SM(R92S_CAMCMD_ADDR, addr));
1664 }
1665
1666 static int
1667 rsu_key_check(struct rsu_softc *sc, ieee80211_keyix keyix, int is_valid)
1668 {
1669         uint32_t val;
1670         int error, ntries;
1671
1672         for (ntries = 0; ntries < 20; ntries++) {
1673                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(1));
1674
1675                 error = rsu_cam_read(sc, R92S_CAM_CTL0(keyix), &val);
1676                 if (error != 0) {
1677                         device_printf(sc->sc_dev,
1678                             "%s: cannot check key status!\n", __func__);
1679                         return (error);
1680                 }
1681                 if (((val & R92S_CAM_VALID) == 0) ^ is_valid)
1682                         break;
1683         }
1684         if (ntries == 20) {
1685                 device_printf(sc->sc_dev,
1686                     "%s: key %d is %s marked as valid, rejecting request\n",
1687                     __func__, keyix, is_valid ? "not" : "still");
1688                 return (EIO);
1689         }
1690
1691         return (0);
1692 }
1693
1694 /*
1695  * Map net80211 cipher to RTL8712 security mode.
1696  */
1697 static uint8_t
1698 rsu_crypto_mode(struct rsu_softc *sc, u_int cipher, int keylen)
1699 {
1700         switch (cipher) {
1701         case IEEE80211_CIPHER_WEP:
1702                 return keylen < 8 ? R92S_KEY_ALGO_WEP40 : R92S_KEY_ALGO_WEP104;
1703         case IEEE80211_CIPHER_TKIP:
1704                 return R92S_KEY_ALGO_TKIP;
1705         case IEEE80211_CIPHER_AES_CCM:
1706                 return R92S_KEY_ALGO_AES;
1707         default:
1708                 device_printf(sc->sc_dev, "unknown cipher %d\n", cipher);
1709                 return R92S_KEY_ALGO_INVALID;
1710         }
1711 }
1712
1713 static int
1714 rsu_set_key_group(struct rsu_softc *sc, const struct ieee80211_key *k)
1715 {
1716         struct r92s_fw_cmd_set_key key;
1717         uint8_t algo;
1718         int error;
1719
1720         RSU_ASSERT_LOCKED(sc);
1721
1722         /* Map net80211 cipher to HW crypto algorithm. */
1723         algo = rsu_crypto_mode(sc, k->wk_cipher->ic_cipher, k->wk_keylen);
1724         if (algo == R92S_KEY_ALGO_INVALID)
1725                 return (EINVAL);
1726
1727         memset(&key, 0, sizeof(key));
1728         key.algo = algo;
1729         key.cam_id = k->wk_keyix;
1730         key.grpkey = (k->wk_flags & IEEE80211_KEY_GROUP) != 0;
1731         memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
1732
1733         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1734             "%s: keyix %u, group %u, algo %u/%u, flags %04X, len %u, "
1735             "macaddr %s\n", __func__, key.cam_id, key.grpkey,
1736             k->wk_cipher->ic_cipher, key.algo, k->wk_flags, k->wk_keylen,
1737             ether_sprintf(k->wk_macaddr));
1738
1739         error = rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1740         if (error != 0) {
1741                 device_printf(sc->sc_dev,
1742                     "%s: cannot send firmware command, error %d\n",
1743                     __func__, error);
1744                 return (error);
1745         }
1746
1747         return (rsu_key_check(sc, k->wk_keyix, 1));
1748 }
1749
1750 static int
1751 rsu_set_key_pair(struct rsu_softc *sc, const struct ieee80211_key *k)
1752 {
1753         struct r92s_fw_cmd_set_key_mac key;
1754         uint8_t algo;
1755         int error;
1756
1757         RSU_ASSERT_LOCKED(sc);
1758
1759         if (!sc->sc_running)
1760                 return (ESHUTDOWN);
1761
1762         /* Map net80211 cipher to HW crypto algorithm. */
1763         algo = rsu_crypto_mode(sc, k->wk_cipher->ic_cipher, k->wk_keylen);
1764         if (algo == R92S_KEY_ALGO_INVALID)
1765                 return (EINVAL);
1766
1767         memset(&key, 0, sizeof(key));
1768         key.algo = algo;
1769         memcpy(key.macaddr, k->wk_macaddr, sizeof(key.macaddr));
1770         memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
1771
1772         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1773             "%s: keyix %u, algo %u/%u, flags %04X, len %u, macaddr %s\n",
1774             __func__, k->wk_keyix, k->wk_cipher->ic_cipher, key.algo,
1775             k->wk_flags, k->wk_keylen, ether_sprintf(key.macaddr));
1776
1777         error = rsu_fw_cmd(sc, R92S_CMD_SET_STA_KEY, &key, sizeof(key));
1778         if (error != 0) {
1779                 device_printf(sc->sc_dev,
1780                     "%s: cannot send firmware command, error %d\n",
1781                     __func__, error);
1782                 return (error);
1783         }
1784
1785         return (rsu_key_check(sc, k->wk_keyix, 1));
1786 }
1787
1788 static int
1789 rsu_reinit_static_keys(struct rsu_softc *sc)
1790 {
1791         int i, error;
1792
1793         for (i = 0; i < nitems(sc->group_keys); i++) {
1794                 if (sc->group_keys[i] != NULL) {
1795                         error = rsu_set_key_group(sc, sc->group_keys[i]);
1796                         if (error != 0) {
1797                                 device_printf(sc->sc_dev,
1798                                     "%s: failed to set static key %d, "
1799                                     "error %d\n", __func__, i, error);
1800                                 return (error);
1801                         }
1802                 }
1803         }
1804
1805         return (0);
1806 }
1807
1808 static int
1809 rsu_delete_key(struct rsu_softc *sc, ieee80211_keyix keyix)
1810 {
1811         struct r92s_fw_cmd_set_key key;
1812         uint32_t val;
1813         int error;
1814
1815         RSU_ASSERT_LOCKED(sc);
1816
1817         if (!sc->sc_running)
1818                 return (0);
1819
1820         /* check if it was automatically removed by firmware */
1821         error = rsu_cam_read(sc, R92S_CAM_CTL0(keyix), &val);
1822         if (error == 0 && (val & R92S_CAM_VALID) == 0) {
1823                 RSU_DPRINTF(sc, RSU_DEBUG_KEY,
1824                     "%s: key %u does not exist\n", __func__, keyix);
1825                 clrbit(sc->keys_bmap, keyix);
1826                 return (0);
1827         }
1828
1829         memset(&key, 0, sizeof(key));
1830         key.cam_id = keyix;
1831
1832         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1833             "%s: removing key %u\n", __func__, key.cam_id);
1834
1835         error = rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1836         if (error != 0) {
1837                 device_printf(sc->sc_dev,
1838                     "%s: cannot send firmware command, error %d\n",
1839                     __func__, error);
1840                 goto finish;
1841         }
1842
1843         usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(5));
1844
1845         /*
1846          * Clear 'valid' bit manually (cannot be done via firmware command).
1847          * Used for key check + when firmware command cannot be sent.
1848          */
1849 finish:
1850         rsu_cam_write(sc, R92S_CAM_CTL0(keyix), 0);
1851
1852         clrbit(sc->keys_bmap, keyix);
1853
1854         return (rsu_key_check(sc, keyix, 0));
1855 }
1856
1857 static void
1858 rsu_delete_key_pair_cb(void *arg, int pending __unused)
1859 {
1860         struct rsu_softc *sc = arg;
1861         int i;
1862
1863         RSU_DELKEY_BMAP_LOCK(sc);
1864         for (i = IEEE80211_WEP_NKID; i < R92S_CAM_ENTRY_LIMIT; i++) {
1865                 if (isset(sc->free_keys_bmap, i)) {
1866                         RSU_DELKEY_BMAP_UNLOCK(sc);
1867
1868                         RSU_LOCK(sc);
1869                         RSU_DPRINTF(sc, RSU_DEBUG_KEY,
1870                             "%s: calling rsu_delete_key() with keyix = %d\n",
1871                             __func__, i);
1872                         (void) rsu_delete_key(sc, i);
1873                         RSU_UNLOCK(sc);
1874
1875                         RSU_DELKEY_BMAP_LOCK(sc);
1876                         clrbit(sc->free_keys_bmap, i);
1877
1878                         /* bmap can be changed */
1879                         i = IEEE80211_WEP_NKID - 1;
1880                         continue;
1881                 }
1882         }
1883         RSU_DELKEY_BMAP_UNLOCK(sc);
1884 }
1885
1886 static int
1887 rsu_site_survey(struct rsu_softc *sc, struct ieee80211_scan_ssid *ssid)
1888 {
1889         struct r92s_fw_cmd_sitesurvey cmd;
1890
1891         RSU_ASSERT_LOCKED(sc);
1892
1893         memset(&cmd, 0, sizeof(cmd));
1894         /* TODO: passive channels? */
1895         if (sc->sc_active_scan)
1896                 cmd.active = htole32(1);
1897         cmd.limit = htole32(48);
1898
1899         if (ssid != NULL) {
1900                 sc->sc_extra_scan = 1;
1901                 cmd.ssidlen = htole32(ssid->len);
1902                 memcpy(cmd.ssid, ssid->ssid, ssid->len);
1903         }
1904 #ifdef USB_DEBUG
1905         if (rsu_debug & (RSU_DEBUG_SCAN | RSU_DEBUG_FWCMD)) {
1906                 device_printf(sc->sc_dev,
1907                     "sending site survey command, active %d",
1908                     le32toh(cmd.active));
1909                 if (ssid != NULL) {
1910                         printf(", ssid: ");
1911                         ieee80211_print_essid(cmd.ssid, le32toh(cmd.ssidlen));
1912                 }
1913                 printf("\n");
1914         }
1915 #endif
1916         return (rsu_fw_cmd(sc, R92S_CMD_SITE_SURVEY, &cmd, sizeof(cmd)));
1917 }
1918
1919 static int
1920 rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
1921 {
1922         struct ieee80211com *ic = &sc->sc_ic;
1923         struct ieee80211vap *vap = ni->ni_vap;
1924         struct ndis_wlan_bssid_ex *bss;
1925         struct ndis_802_11_fixed_ies *fixed;
1926         struct r92s_fw_cmd_auth auth;
1927         uint8_t buf[sizeof(*bss) + 128] __aligned(4);
1928         uint8_t *frm;
1929         uint8_t opmode;
1930         int error;
1931
1932         RSU_ASSERT_LOCKED(sc);
1933
1934         /* Let the FW decide the opmode based on the capinfo field. */
1935         opmode = NDIS802_11AUTOUNKNOWN;
1936         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1937             "%s: setting operating mode to %d\n",
1938             __func__, opmode);
1939         error = rsu_fw_cmd(sc, R92S_CMD_SET_OPMODE, &opmode, sizeof(opmode));
1940         if (error != 0)
1941                 return (error);
1942
1943         memset(&auth, 0, sizeof(auth));
1944         if (vap->iv_flags & IEEE80211_F_WPA) {
1945                 auth.mode = R92S_AUTHMODE_WPA;
1946                 auth.dot1x = (ni->ni_authmode == IEEE80211_AUTH_8021X);
1947         } else
1948                 auth.mode = R92S_AUTHMODE_OPEN;
1949         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1950             "%s: setting auth mode to %d\n",
1951             __func__, auth.mode);
1952         error = rsu_fw_cmd(sc, R92S_CMD_SET_AUTH, &auth, sizeof(auth));
1953         if (error != 0)
1954                 return (error);
1955
1956         memset(buf, 0, sizeof(buf));
1957         bss = (struct ndis_wlan_bssid_ex *)buf;
1958         IEEE80211_ADDR_COPY(bss->macaddr, ni->ni_bssid);
1959         bss->ssid.ssidlen = htole32(ni->ni_esslen);
1960         memcpy(bss->ssid.ssid, ni->ni_essid, ni->ni_esslen);
1961         if (vap->iv_flags & (IEEE80211_F_PRIVACY | IEEE80211_F_WPA))
1962                 bss->privacy = htole32(1);
1963         bss->rssi = htole32(ni->ni_avgrssi);
1964         if (ic->ic_curmode == IEEE80211_MODE_11B)
1965                 bss->networktype = htole32(NDIS802_11DS);
1966         else
1967                 bss->networktype = htole32(NDIS802_11OFDM24);
1968         bss->config.len = htole32(sizeof(bss->config));
1969         bss->config.bintval = htole32(ni->ni_intval);
1970         bss->config.dsconfig = htole32(ieee80211_chan2ieee(ic, ni->ni_chan));
1971         bss->inframode = htole32(NDIS802_11INFRASTRUCTURE);
1972         /* XXX verify how this is supposed to look! */
1973         memcpy(bss->supprates, ni->ni_rates.rs_rates,
1974             ni->ni_rates.rs_nrates);
1975         /* Write the fixed fields of the beacon frame. */
1976         fixed = (struct ndis_802_11_fixed_ies *)&bss[1];
1977         memcpy(&fixed->tstamp, ni->ni_tstamp.data, 8);
1978         fixed->bintval = htole16(ni->ni_intval);
1979         fixed->capabilities = htole16(ni->ni_capinfo);
1980         /* Write IEs to be included in the association request. */
1981         frm = (uint8_t *)&fixed[1];
1982         frm = ieee80211_add_rsn(frm, vap);
1983         frm = ieee80211_add_wpa(frm, vap);
1984         frm = ieee80211_add_qos(frm, ni);
1985         if ((ic->ic_flags & IEEE80211_F_WME) &&
1986             (ni->ni_ies.wme_ie != NULL))
1987                 frm = ieee80211_add_wme_info(frm, &ic->ic_wme);
1988         if (ni->ni_flags & IEEE80211_NODE_HT) {
1989                 frm = ieee80211_add_htcap(frm, ni);
1990                 frm = ieee80211_add_htinfo(frm, ni);
1991         }
1992         bss->ieslen = htole32(frm - (uint8_t *)fixed);
1993         bss->len = htole32(((frm - buf) + 3) & ~3);
1994         RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_FWCMD,
1995             "%s: sending join bss command to %s chan %d\n",
1996             __func__,
1997             ether_sprintf(bss->macaddr), le32toh(bss->config.dsconfig));
1998         return (rsu_fw_cmd(sc, R92S_CMD_JOIN_BSS, buf, sizeof(buf)));
1999 }
2000
2001 static int
2002 rsu_disconnect(struct rsu_softc *sc)
2003 {
2004         uint32_t zero = 0;      /* :-) */
2005
2006         /* Disassociate from our current BSS. */
2007         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2008             "%s: sending disconnect command\n", __func__);
2009         return (rsu_fw_cmd(sc, R92S_CMD_DISCONNECT, &zero, sizeof(zero)));
2010 }
2011
2012 /*
2013  * Map the hardware provided RSSI value to a signal level.
2014  * For the most part it's just something we divide by and cap
2015  * so it doesn't overflow the representation by net80211.
2016  */
2017 static int
2018 rsu_hwrssi_to_rssi(struct rsu_softc *sc, int hw_rssi)
2019 {
2020         int v;
2021
2022         if (hw_rssi == 0)
2023                 return (0);
2024         v = hw_rssi >> 4;
2025         if (v > 80)
2026                 v = 80;
2027         return (v);
2028 }
2029
2030 CTASSERT(MCLBYTES > sizeof(struct ieee80211_frame));
2031
2032 static void
2033 rsu_event_survey(struct rsu_softc *sc, uint8_t *buf, int len)
2034 {
2035         struct ieee80211com *ic = &sc->sc_ic;
2036         struct ieee80211_frame *wh;
2037         struct ndis_wlan_bssid_ex *bss;
2038         struct ieee80211_rx_stats rxs;
2039         struct mbuf *m;
2040         uint32_t ieslen;
2041         uint32_t pktlen;
2042
2043         if (__predict_false(len < sizeof(*bss)))
2044                 return;
2045         bss = (struct ndis_wlan_bssid_ex *)buf;
2046         ieslen = le32toh(bss->ieslen);
2047         /* range check length of information element */
2048         if (__predict_false(ieslen > (uint32_t)(len - sizeof(*bss))))
2049                 return;
2050
2051         RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
2052             "%s: found BSS %s: len=%d chan=%d inframode=%d "
2053             "networktype=%d privacy=%d, RSSI=%d\n",
2054             __func__,
2055             ether_sprintf(bss->macaddr), ieslen,
2056             le32toh(bss->config.dsconfig), le32toh(bss->inframode),
2057             le32toh(bss->networktype), le32toh(bss->privacy),
2058             le32toh(bss->rssi));
2059
2060         /* Build a fake beacon frame to let net80211 do all the parsing. */
2061         /* XXX TODO: just call the new scan API methods! */
2062         if (__predict_false(ieslen > (size_t)(MCLBYTES - sizeof(*wh))))
2063                 return;
2064         pktlen = sizeof(*wh) + ieslen;
2065         m = m_get2(pktlen, M_NOWAIT, MT_DATA, M_PKTHDR);
2066         if (__predict_false(m == NULL))
2067                 return;
2068         wh = mtod(m, struct ieee80211_frame *);
2069         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2070             IEEE80211_FC0_SUBTYPE_BEACON;
2071         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2072         USETW(wh->i_dur, 0);
2073         IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
2074         IEEE80211_ADDR_COPY(wh->i_addr2, bss->macaddr);
2075         IEEE80211_ADDR_COPY(wh->i_addr3, bss->macaddr);
2076         *(uint16_t *)wh->i_seq = 0;
2077         memcpy(&wh[1], (uint8_t *)&bss[1], ieslen);
2078
2079         /* Finalize mbuf. */
2080         m->m_pkthdr.len = m->m_len = pktlen;
2081
2082         /* Set channel flags for input path */
2083         bzero(&rxs, sizeof(rxs));
2084         rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
2085         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2086         rxs.c_ieee = le32toh(bss->config.dsconfig);
2087         rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
2088         /* This is a number from 0..100; so let's just divide it down a bit */
2089         rxs.c_rssi = le32toh(bss->rssi) / 2;
2090         rxs.c_nf = -96;
2091         if (ieee80211_add_rx_params(m, &rxs) == 0)
2092                 return;
2093
2094         /* XXX avoid a LOR */
2095         RSU_UNLOCK(sc);
2096         ieee80211_input_mimo_all(ic, m);
2097         RSU_LOCK(sc);
2098 }
2099
2100 static void
2101 rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
2102 {
2103         struct ieee80211com *ic = &sc->sc_ic;
2104         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2105         struct ieee80211_node *ni = vap->iv_bss;
2106         struct r92s_event_join_bss *rsp;
2107         uint32_t tmp;
2108         int res;
2109
2110         if (__predict_false(len < sizeof(*rsp)))
2111                 return;
2112         rsp = (struct r92s_event_join_bss *)buf;
2113         res = (int)le32toh(rsp->join_res);
2114
2115         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2116             "%s: Rx join BSS event len=%d res=%d\n",
2117             __func__, len, res);
2118
2119         /*
2120          * XXX Don't do this; there's likely a better way to tell
2121          * the caller we failed.
2122          */
2123         if (res <= 0) {
2124                 RSU_UNLOCK(sc);
2125                 ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
2126                 RSU_LOCK(sc);
2127                 return;
2128         }
2129
2130         tmp = le32toh(rsp->associd);
2131         if (tmp >= vap->iv_max_aid) {
2132                 RSU_DPRINTF(sc, RSU_DEBUG_ANY, "Assoc ID overflow\n");
2133                 tmp = 1;
2134         }
2135         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2136             "%s: associated with %s associd=%d\n",
2137             __func__, ether_sprintf(rsp->bss.macaddr), tmp);
2138         /* XXX is this required? What's the top two bits for again? */
2139         ni->ni_associd = tmp | 0xc000;
2140
2141         /* Refresh Rx filter (was changed by firmware). */
2142         sc->sc_vap_is_running = 1;
2143         rsu_rxfilter_refresh(sc);
2144
2145         RSU_UNLOCK(sc);
2146         ieee80211_new_state(vap, IEEE80211_S_RUN,
2147             IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
2148         RSU_LOCK(sc);
2149 }
2150
2151 static void
2152 rsu_event_addba_req_report(struct rsu_softc *sc, uint8_t *buf, int len)
2153 {
2154         struct ieee80211com *ic = &sc->sc_ic;
2155         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2156         struct r92s_add_ba_event *ba = (void *) buf;
2157         struct ieee80211_node *ni;
2158
2159         if (len < sizeof(*ba)) {
2160                 device_printf(sc->sc_dev, "%s: short read (%d)\n", __func__, len);
2161                 return;
2162         }
2163
2164         if (vap == NULL)
2165                 return;
2166
2167         RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: mac=%s, tid=%d, ssn=%d\n",
2168             __func__,
2169             ether_sprintf(ba->mac_addr),
2170             (int) ba->tid,
2171             (int) le16toh(ba->ssn));
2172
2173         /* XXX do node lookup; this is STA specific */
2174
2175         ni = ieee80211_ref_node(vap->iv_bss);
2176         ieee80211_ampdu_rx_start_ext(ni, ba->tid, le16toh(ba->ssn) >> 4, 32);
2177         ieee80211_free_node(ni);
2178 }
2179
2180 static void
2181 rsu_rx_event(struct rsu_softc *sc, uint8_t code, uint8_t *buf, int len)
2182 {
2183         struct ieee80211com *ic = &sc->sc_ic;
2184         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2185
2186         RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
2187             "%s: Rx event code=%d len=%d\n", __func__, code, len);
2188         switch (code) {
2189         case R92S_EVT_SURVEY:
2190                 rsu_event_survey(sc, buf, len);
2191                 break;
2192         case R92S_EVT_SURVEY_DONE:
2193                 RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
2194                     "%s: %s scan done, found %d BSS\n",
2195                     __func__, sc->sc_extra_scan ? "direct" : "broadcast",
2196                     le32toh(*(uint32_t *)buf));
2197                 if (sc->sc_extra_scan == 1) {
2198                         /* Send broadcast probe request. */
2199                         sc->sc_extra_scan = 0;
2200                         if (vap != NULL && rsu_site_survey(sc, NULL) != 0) {
2201                                 RSU_UNLOCK(sc);
2202                                 ieee80211_cancel_scan(vap);
2203                                 RSU_LOCK(sc);
2204                         }
2205                         break;
2206                 }
2207                 if (vap != NULL) {
2208                         RSU_UNLOCK(sc);
2209                         ieee80211_scan_done(vap);
2210                         RSU_LOCK(sc);
2211                 }
2212                 break;
2213         case R92S_EVT_JOIN_BSS:
2214                 if (vap->iv_state == IEEE80211_S_AUTH)
2215                         rsu_event_join_bss(sc, buf, len);
2216                 break;
2217         case R92S_EVT_DEL_STA:
2218                 RSU_DPRINTF(sc, RSU_DEBUG_FWCMD | RSU_DEBUG_STATE,
2219                     "%s: disassociated from %s\n", __func__,
2220                     ether_sprintf(buf));
2221                 if (vap->iv_state == IEEE80211_S_RUN &&
2222                     IEEE80211_ADDR_EQ(vap->iv_bss->ni_bssid, buf)) {
2223                         RSU_UNLOCK(sc);
2224                         ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
2225                         RSU_LOCK(sc);
2226                 }
2227                 break;
2228         case R92S_EVT_WPS_PBC:
2229                 RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
2230                     "%s: WPS PBC pushed.\n", __func__);
2231                 break;
2232         case R92S_EVT_FWDBG:
2233                 buf[60] = '\0';
2234                 RSU_DPRINTF(sc, RSU_DEBUG_FWDBG, "FWDBG: %s\n", (char *)buf);
2235                 break;
2236         case R92S_EVT_ADDBA_REQ_REPORT:
2237                 rsu_event_addba_req_report(sc, buf, len);
2238                 break;
2239         default:
2240                 device_printf(sc->sc_dev, "%s: unhandled code (%d)\n", __func__, code);
2241                 break;
2242         }
2243 }
2244
2245 static void
2246 rsu_rx_multi_event(struct rsu_softc *sc, uint8_t *buf, int len)
2247 {
2248         struct r92s_fw_cmd_hdr *cmd;
2249         int cmdsz;
2250
2251         RSU_DPRINTF(sc, RSU_DEBUG_RX, "%s: Rx events len=%d\n", __func__, len);
2252
2253         /* Skip Rx status. */
2254         buf += sizeof(struct r92s_rx_stat);
2255         len -= sizeof(struct r92s_rx_stat);
2256
2257         /* Process all events. */
2258         for (;;) {
2259                 /* Check that command header fits. */
2260                 if (__predict_false(len < sizeof(*cmd)))
2261                         break;
2262                 cmd = (struct r92s_fw_cmd_hdr *)buf;
2263                 /* Check that command payload fits. */
2264                 cmdsz = le16toh(cmd->len);
2265                 if (__predict_false(len < sizeof(*cmd) + cmdsz))
2266                         break;
2267
2268                 /* Process firmware event. */
2269                 rsu_rx_event(sc, cmd->code, (uint8_t *)&cmd[1], cmdsz);
2270
2271                 if (!(cmd->seq & R92S_FW_CMD_MORE))
2272                         break;
2273                 buf += sizeof(*cmd) + cmdsz;
2274                 len -= sizeof(*cmd) + cmdsz;
2275         }
2276 }
2277
2278 static int8_t
2279 rsu_get_rssi(struct rsu_softc *sc, int rate, void *physt)
2280 {
2281         static const int8_t cckoff[] = { 14, -2, -20, -40 };
2282         struct r92s_rx_phystat *phy;
2283         struct r92s_rx_cck *cck;
2284         uint8_t rpt;
2285         int8_t rssi;
2286
2287         if (rate <= 3) {
2288                 cck = (struct r92s_rx_cck *)physt;
2289                 rpt = (cck->agc_rpt >> 6) & 0x3;
2290                 rssi = cck->agc_rpt & 0x3e;
2291                 rssi = cckoff[rpt] - rssi;
2292         } else {        /* OFDM/HT. */
2293                 phy = (struct r92s_rx_phystat *)physt;
2294                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 106;
2295         }
2296         return (rssi);
2297 }
2298
2299 static struct mbuf *
2300 rsu_rx_copy_to_mbuf(struct rsu_softc *sc, struct r92s_rx_stat *stat,
2301     int totlen)
2302 {
2303         struct ieee80211com *ic = &sc->sc_ic;
2304         struct mbuf *m;
2305         uint32_t rxdw0;
2306         int pktlen;
2307
2308         rxdw0 = le32toh(stat->rxdw0);
2309         if (__predict_false(rxdw0 & (R92S_RXDW0_CRCERR | R92S_RXDW0_ICVERR))) {
2310                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2311                     "%s: RX flags error (%s)\n", __func__,
2312                     rxdw0 & R92S_RXDW0_CRCERR ? "CRC" : "ICV");
2313                 goto fail;
2314         }
2315
2316         pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
2317         if (__predict_false(pktlen < sizeof (struct ieee80211_frame_ack))) {
2318                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2319                     "%s: frame is too short: %d\n", __func__, pktlen);
2320                 goto fail;
2321         }
2322
2323         m = m_get2(totlen, M_NOWAIT, MT_DATA, M_PKTHDR);
2324         if (__predict_false(m == NULL)) {
2325                 device_printf(sc->sc_dev,
2326                     "%s: could not allocate RX mbuf, totlen %d\n",
2327                     __func__, totlen);
2328                 goto fail;
2329         }
2330
2331         /* Finalize mbuf. */
2332         memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
2333         m->m_pkthdr.len = m->m_len = totlen;
2334
2335         return (m);
2336 fail:
2337         counter_u64_add(ic->ic_ierrors, 1);
2338         return (NULL);
2339 }
2340
2341 static uint32_t
2342 rsu_get_tsf_low(struct rsu_softc *sc)
2343 {
2344         return (rsu_read_4(sc, R92S_TSFTR));
2345 }
2346
2347 static uint32_t
2348 rsu_get_tsf_high(struct rsu_softc *sc)
2349 {
2350         return (rsu_read_4(sc, R92S_TSFTR + 4));
2351 }
2352
2353 static struct ieee80211_node *
2354 rsu_rx_frame(struct rsu_softc *sc, struct mbuf *m)
2355 {
2356         struct ieee80211com *ic = &sc->sc_ic;
2357         struct ieee80211_frame_min *wh;
2358         struct ieee80211_rx_stats rxs;
2359         struct r92s_rx_stat *stat;
2360         uint32_t rxdw0, rxdw3;
2361         uint8_t cipher, rate;
2362         int infosz;
2363         int rssi;
2364
2365         stat = mtod(m, struct r92s_rx_stat *);
2366         rxdw0 = le32toh(stat->rxdw0);
2367         rxdw3 = le32toh(stat->rxdw3);
2368
2369         rate = MS(rxdw3, R92S_RXDW3_RATE);
2370         cipher = MS(rxdw0, R92S_RXDW0_CIPHER);
2371         infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
2372
2373         /* Get RSSI from PHY status descriptor if present. */
2374         if (infosz != 0 && (rxdw0 & R92S_RXDW0_PHYST))
2375                 rssi = rsu_get_rssi(sc, rate, &stat[1]);
2376         else {
2377                 /* Cheat and get the last calibrated RSSI */
2378                 rssi = rsu_hwrssi_to_rssi(sc, sc->sc_currssi);
2379         }
2380
2381         /* Hardware does Rx TCP checksum offload. */
2382         /*
2383          * This flag can be set for some other
2384          * (e.g., EAPOL) frame types, so don't rely on it.
2385          */
2386         if (rxdw3 & R92S_RXDW3_TCPCHKVALID) {
2387                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2388                     "%s: TCP/IP checksums: %schecked / %schecked\n",
2389                     __func__,
2390                     (rxdw3 & R92S_RXDW3_TCPCHKRPT) ? "" : "not ",
2391                     (rxdw3 & R92S_RXDW3_IPCHKRPT) ? "" : "not ");
2392
2393                 /*
2394                  * 'IP header checksum valid' bit will not be set if
2395                  * the frame was not checked / has incorrect checksum /
2396                  * does not have checksum (IPv6).
2397                  *
2398                  * NB: if DF bit is not set then frame will not be checked.
2399                  */
2400                 if (rxdw3 & R92S_RXDW3_IPCHKRPT) {
2401                         m->m_pkthdr.csum_flags = CSUM_IP_CHECKED;
2402                         m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
2403                 }
2404
2405                 /*
2406                  * This is independent of the above check.
2407                  */
2408                 if (rxdw3 & R92S_RXDW3_TCPCHKRPT) {
2409                         m->m_pkthdr.csum_flags |= CSUM_DATA_VALID;
2410                         m->m_pkthdr.csum_flags |= CSUM_PSEUDO_HDR;
2411                         m->m_pkthdr.csum_data = 0xffff;
2412                 }
2413         }
2414
2415         /* RX flags */
2416
2417         /* Set channel flags for input path */
2418         bzero(&rxs, sizeof(rxs));
2419
2420         /* normal RSSI */
2421         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2422         rxs.c_rssi = rssi;
2423         rxs.c_nf = -96;
2424
2425         /* Rate */
2426         if (rate < 12) {
2427                 rxs.c_rate = ridx2rate[rate];
2428                 if (RSU_RATE_IS_CCK(rate))
2429                         rxs.c_pktflags |= IEEE80211_RX_F_CCK;
2430                 else
2431                         rxs.c_pktflags |= IEEE80211_RX_F_OFDM;
2432         } else {
2433                 rxs.c_rate = IEEE80211_RATE_MCS | (rate - 12);
2434                 rxs.c_pktflags |= IEEE80211_RX_F_HT;
2435         }
2436
2437         if (ieee80211_radiotap_active(ic)) {
2438                 struct rsu_rx_radiotap_header *tap = &sc->sc_rxtap;
2439
2440                 /* Map HW rate index to 802.11 rate. */
2441                 tap->wr_flags = 0;              /* TODO */
2442                 tap->wr_tsft = rsu_get_tsf_high(sc);
2443                 if (le32toh(stat->tsf_low) > rsu_get_tsf_low(sc))
2444                         tap->wr_tsft--;
2445                 tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
2446                 tap->wr_tsft += stat->tsf_low;
2447
2448                 tap->wr_rate = rxs.c_rate;
2449                 tap->wr_dbm_antsignal = rssi;
2450                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2451                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2452         };
2453
2454         (void) ieee80211_add_rx_params(m, &rxs);
2455
2456         /* Drop descriptor. */
2457         m_adj(m, sizeof(*stat) + infosz);
2458         wh = mtod(m, struct ieee80211_frame_min *);
2459         if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
2460             cipher != R92S_KEY_ALGO_NONE) {
2461                 m->m_flags |= M_WEP;
2462         }
2463
2464         RSU_DPRINTF(sc, RSU_DEBUG_RX,
2465             "%s: Rx frame len %d, rate %d, infosz %d\n",
2466             __func__, m->m_len, rate, infosz);
2467
2468         if (m->m_len >= sizeof(*wh))
2469                 return (ieee80211_find_rxnode(ic, wh));
2470
2471         return (NULL);
2472 }
2473
2474 static struct mbuf *
2475 rsu_rx_multi_frame(struct rsu_softc *sc, uint8_t *buf, int len)
2476 {
2477         struct r92s_rx_stat *stat;
2478         uint32_t rxdw0;
2479         int totlen, pktlen, infosz, npkts;
2480         struct mbuf *m, *m0 = NULL, *prevm = NULL;
2481
2482         /*
2483          * don't pass packets to the ieee80211 framework if the driver isn't
2484          * RUNNING.
2485          */
2486         if (!sc->sc_running)
2487                 return (NULL);
2488
2489         /* Get the number of encapsulated frames. */
2490         stat = (struct r92s_rx_stat *)buf;
2491         npkts = MS(le32toh(stat->rxdw2), R92S_RXDW2_PKTCNT);
2492         RSU_DPRINTF(sc, RSU_DEBUG_RX,
2493             "%s: Rx %d frames in one chunk\n", __func__, npkts);
2494
2495         /* Process all of them. */
2496         while (npkts-- > 0) {
2497                 if (__predict_false(len < sizeof(*stat)))
2498                         break;
2499                 stat = (struct r92s_rx_stat *)buf;
2500                 rxdw0 = le32toh(stat->rxdw0);
2501
2502                 pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
2503                 if (__predict_false(pktlen == 0))
2504                         break;
2505
2506                 infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
2507
2508                 /* Make sure everything fits in xfer. */
2509                 totlen = sizeof(*stat) + infosz + pktlen;
2510                 if (__predict_false(totlen > len))
2511                         break;
2512
2513                 /* Process 802.11 frame. */
2514                 m = rsu_rx_copy_to_mbuf(sc, stat, totlen);
2515                 if (m0 == NULL)
2516                         m0 = m;
2517                 if (prevm == NULL)
2518                         prevm = m;
2519                 else {
2520                         prevm->m_next = m;
2521                         prevm = m;
2522                 }
2523                 /* Next chunk is 128-byte aligned. */
2524                 totlen = (totlen + 127) & ~127;
2525                 buf += totlen;
2526                 len -= totlen;
2527         }
2528
2529         return (m0);
2530 }
2531
2532 static struct mbuf *
2533 rsu_rxeof(struct usb_xfer *xfer, struct rsu_data *data)
2534 {
2535         struct rsu_softc *sc = data->sc;
2536         struct ieee80211com *ic = &sc->sc_ic;
2537         struct r92s_rx_stat *stat;
2538         int len;
2539
2540         usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
2541
2542         if (__predict_false(len < sizeof(*stat))) {
2543                 RSU_DPRINTF(sc, RSU_DEBUG_RX, "xfer too short %d\n", len);
2544                 counter_u64_add(ic->ic_ierrors, 1);
2545                 return (NULL);
2546         }
2547         /* Determine if it is a firmware C2H event or an 802.11 frame. */
2548         stat = (struct r92s_rx_stat *)data->buf;
2549         if ((le32toh(stat->rxdw1) & 0x1ff) == 0x1ff) {
2550                 rsu_rx_multi_event(sc, data->buf, len);
2551                 /* No packets to process. */
2552                 return (NULL);
2553         } else
2554                 return (rsu_rx_multi_frame(sc, data->buf, len));
2555 }
2556
2557 static void
2558 rsu_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2559 {
2560         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2561         struct ieee80211com *ic = &sc->sc_ic;
2562         struct ieee80211_node *ni;
2563         struct mbuf *m = NULL, *next;
2564         struct rsu_data *data;
2565
2566         RSU_ASSERT_LOCKED(sc);
2567
2568         switch (USB_GET_STATE(xfer)) {
2569         case USB_ST_TRANSFERRED:
2570                 data = STAILQ_FIRST(&sc->sc_rx_active);
2571                 if (data == NULL)
2572                         goto tr_setup;
2573                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2574                 m = rsu_rxeof(xfer, data);
2575                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2576                 /* FALLTHROUGH */
2577         case USB_ST_SETUP:
2578 tr_setup:
2579                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
2580                 if (data == NULL) {
2581                         KASSERT(m == NULL, ("mbuf isn't NULL"));
2582                         return;
2583                 }
2584                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
2585                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
2586                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
2587                     usbd_xfer_max_len(xfer));
2588                 usbd_transfer_submit(xfer);
2589                 /*
2590                  * To avoid LOR we should unlock our private mutex here to call
2591                  * ieee80211_input() because here is at the end of a USB
2592                  * callback and safe to unlock.
2593                  */
2594                 while (m != NULL) {
2595                         next = m->m_next;
2596                         m->m_next = NULL;
2597
2598                         ni = rsu_rx_frame(sc, m);
2599                         RSU_UNLOCK(sc);
2600
2601                         if (ni != NULL) {
2602                                 if (ni->ni_flags & IEEE80211_NODE_HT)
2603                                         m->m_flags |= M_AMPDU;
2604                                 (void)ieee80211_input_mimo(ni, m);
2605                                 ieee80211_free_node(ni);
2606                         } else
2607                                 (void)ieee80211_input_mimo_all(ic, m);
2608
2609                         RSU_LOCK(sc);
2610                         m = next;
2611                 }
2612                 break;
2613         default:
2614                 /* needs it to the inactive queue due to a error. */
2615                 data = STAILQ_FIRST(&sc->sc_rx_active);
2616                 if (data != NULL) {
2617                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2618                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2619                 }
2620                 if (error != USB_ERR_CANCELLED) {
2621                         usbd_xfer_set_stall(xfer);
2622                         counter_u64_add(ic->ic_ierrors, 1);
2623                         goto tr_setup;
2624                 }
2625                 break;
2626         }
2627
2628 }
2629
2630 static void
2631 rsu_txeof(struct usb_xfer *xfer, struct rsu_data *data)
2632 {
2633 #ifdef  USB_DEBUG
2634         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2635 #endif
2636
2637         RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: called; data=%p\n",
2638             __func__,
2639             data);
2640
2641         if (data->m) {
2642                 /* XXX status? */
2643                 ieee80211_tx_complete(data->ni, data->m, 0);
2644                 data->m = NULL;
2645                 data->ni = NULL;
2646         }
2647 }
2648
2649 static void
2650 rsu_bulk_tx_callback_sub(struct usb_xfer *xfer, usb_error_t error,
2651     uint8_t which)
2652 {
2653         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2654         struct ieee80211com *ic = &sc->sc_ic;
2655         struct rsu_data *data;
2656
2657         RSU_ASSERT_LOCKED(sc);
2658
2659         switch (USB_GET_STATE(xfer)) {
2660         case USB_ST_TRANSFERRED:
2661                 data = STAILQ_FIRST(&sc->sc_tx_active[which]);
2662                 if (data == NULL)
2663                         goto tr_setup;
2664                 RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: transfer done %p\n",
2665                     __func__, data);
2666                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
2667                 rsu_txeof(xfer, data);
2668                 rsu_freebuf(sc, data);
2669                 /* FALLTHROUGH */
2670         case USB_ST_SETUP:
2671 tr_setup:
2672                 data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
2673                 if (data == NULL) {
2674                         RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
2675                             "%s: empty pending queue sc %p\n", __func__, sc);
2676                         return;
2677                 }
2678                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
2679                 STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
2680                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
2681                 RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
2682                     "%s: submitting transfer %p\n",
2683                     __func__,
2684                     data);
2685                 usbd_transfer_submit(xfer);
2686                 break;
2687         default:
2688                 data = STAILQ_FIRST(&sc->sc_tx_active[which]);
2689                 if (data != NULL) {
2690                         STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
2691                         rsu_txeof(xfer, data);
2692                         rsu_freebuf(sc, data);
2693                 }
2694                 counter_u64_add(ic->ic_oerrors, 1);
2695
2696                 if (error != USB_ERR_CANCELLED) {
2697                         usbd_xfer_set_stall(xfer);
2698                         goto tr_setup;
2699                 }
2700                 break;
2701         }
2702
2703         /*
2704          * XXX TODO: if the queue is low, flush out FF TX frames.
2705          * Remember to unlock the driver for now; net80211 doesn't
2706          * defer it for us.
2707          */
2708 }
2709
2710 static void
2711 rsu_bulk_tx_callback_be_bk(struct usb_xfer *xfer, usb_error_t error)
2712 {
2713         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2714
2715         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_BE_BK);
2716
2717         /* This kicks the TX taskqueue */
2718         rsu_start(sc);
2719 }
2720
2721 static void
2722 rsu_bulk_tx_callback_vi_vo(struct usb_xfer *xfer, usb_error_t error)
2723 {
2724         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2725
2726         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_VI_VO);
2727
2728         /* This kicks the TX taskqueue */
2729         rsu_start(sc);
2730 }
2731
2732 static void
2733 rsu_bulk_tx_callback_h2c(struct usb_xfer *xfer, usb_error_t error)
2734 {
2735         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2736
2737         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_H2C);
2738
2739         /* This kicks the TX taskqueue */
2740         rsu_start(sc);
2741 }
2742
2743 /*
2744  * Transmit the given frame.
2745  *
2746  * This doesn't free the node or mbuf upon failure.
2747  */
2748 static int
2749 rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
2750     struct mbuf *m0, struct rsu_data *data)
2751 {
2752         const struct ieee80211_txparam *tp = ni->ni_txparms;
2753         struct ieee80211com *ic = &sc->sc_ic;
2754         struct ieee80211vap *vap = ni->ni_vap;
2755         struct ieee80211_frame *wh;
2756         struct ieee80211_key *k = NULL;
2757         struct r92s_tx_desc *txd;
2758         uint8_t rate, ridx, type, cipher, qos;
2759         int prio = 0;
2760         uint8_t which;
2761         int hasqos;
2762         int ismcast;
2763         int xferlen;
2764         int qid;
2765
2766         RSU_ASSERT_LOCKED(sc);
2767
2768         wh = mtod(m0, struct ieee80211_frame *);
2769         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2770         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2771
2772         RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: data=%p, m=%p\n",
2773             __func__, data, m0);
2774
2775         /* Choose a TX rate index. */
2776         if (type == IEEE80211_FC0_TYPE_MGT ||
2777             type == IEEE80211_FC0_TYPE_CTL ||
2778             (m0->m_flags & M_EAPOL) != 0)
2779                 rate = tp->mgmtrate;
2780         else if (ismcast)
2781                 rate = tp->mcastrate;
2782         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2783                 rate = tp->ucastrate;
2784         else
2785                 rate = 0;
2786
2787         if (rate != 0)
2788                 ridx = rate2ridx(rate);
2789
2790         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2791                 k = ieee80211_crypto_encap(ni, m0);
2792                 if (k == NULL) {
2793                         device_printf(sc->sc_dev,
2794                             "ieee80211_crypto_encap returns NULL.\n");
2795                         /* XXX we don't expect the fragmented frames */
2796                         return (ENOBUFS);
2797                 }
2798                 wh = mtod(m0, struct ieee80211_frame *);
2799         }
2800         /* If we have QoS then use it */
2801         /* XXX TODO: mbuf WME/PRI versus TID? */
2802         if (IEEE80211_QOS_HAS_SEQ(wh)) {
2803                 /* Has QoS */
2804                 prio = M_WME_GETAC(m0);
2805                 which = rsu_wme_ac_xfer_map[prio];
2806                 hasqos = 1;
2807                 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2808         } else {
2809                 /* Non-QoS TID */
2810                 /* XXX TODO: tid=0 for non-qos TID? */
2811                 which = rsu_wme_ac_xfer_map[WME_AC_BE];
2812                 hasqos = 0;
2813                 prio = 0;
2814                 qos = 0;
2815         }
2816
2817         qid = rsu_ac2qid[prio];
2818 #if 0
2819         switch (type) {
2820         case IEEE80211_FC0_TYPE_CTL:
2821         case IEEE80211_FC0_TYPE_MGT:
2822                 which = rsu_wme_ac_xfer_map[WME_AC_VO];
2823                 break;
2824         default:
2825                 which = rsu_wme_ac_xfer_map[M_WME_GETAC(m0)];
2826                 break;
2827         }
2828         hasqos = 0;
2829 #endif
2830
2831         RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: pri=%d, which=%d, hasqos=%d\n",
2832             __func__,
2833             prio,
2834             which,
2835             hasqos);
2836
2837         /* Fill Tx descriptor. */
2838         txd = (struct r92s_tx_desc *)data->buf;
2839         memset(txd, 0, sizeof(*txd));
2840
2841         txd->txdw0 |= htole32(
2842             SM(R92S_TXDW0_PKTLEN, m0->m_pkthdr.len) |
2843             SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
2844             R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
2845
2846         txd->txdw1 |= htole32(
2847             SM(R92S_TXDW1_MACID, R92S_MACID_BSS) | SM(R92S_TXDW1_QSEL, qid));
2848         if (!hasqos)
2849                 txd->txdw1 |= htole32(R92S_TXDW1_NONQOS);
2850         if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWENCRYPT)) {
2851                 switch (k->wk_cipher->ic_cipher) {
2852                 case IEEE80211_CIPHER_WEP:
2853                         cipher = R92S_TXDW1_CIPHER_WEP;
2854                         break;
2855                 case IEEE80211_CIPHER_TKIP:
2856                         cipher = R92S_TXDW1_CIPHER_TKIP;
2857                         break;
2858                 case IEEE80211_CIPHER_AES_CCM:
2859                         cipher = R92S_TXDW1_CIPHER_AES;
2860                         break;
2861                 default:
2862                         cipher = R92S_TXDW1_CIPHER_NONE;
2863                 }
2864                 txd->txdw1 |= htole32(
2865                     SM(R92S_TXDW1_CIPHER, cipher) |
2866                     SM(R92S_TXDW1_KEYIDX, k->wk_keyix));
2867         }
2868         /* XXX todo: set AGGEN bit if appropriate? */
2869         txd->txdw2 |= htole32(R92S_TXDW2_BK);
2870         if (ismcast)
2871                 txd->txdw2 |= htole32(R92S_TXDW2_BMCAST);
2872
2873         if (!ismcast && (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
2874             IEEE80211_QOS_ACKPOLICY_NOACK)) {
2875                 txd->txdw2 |= htole32(R92S_TXDW2_RTY_LMT_ENA);
2876                 txd->txdw2 |= htole32(SM(R92S_TXDW2_RTY_LMT, tp->maxretry));
2877         }
2878
2879         /* Force mgmt / mcast / ucast rate if needed. */
2880         if (rate != 0) {
2881                 /* Data rate fallback limit (max). */
2882                 txd->txdw5 |= htole32(SM(R92S_TXDW5_DATARATE_FB_LMT, 0x1f));
2883                 txd->txdw5 |= htole32(SM(R92S_TXDW5_DATARATE, ridx));
2884                 txd->txdw4 |= htole32(R92S_TXDW4_DRVRATE);
2885         }
2886
2887         /*
2888          * Firmware will use and increment the sequence number for the
2889          * specified priority.
2890          */
2891         txd->txdw3 |= htole32(SM(R92S_TXDW3_SEQ, prio));
2892
2893         if (ieee80211_radiotap_active_vap(vap)) {
2894                 struct rsu_tx_radiotap_header *tap = &sc->sc_txtap;
2895
2896                 tap->wt_flags = 0;
2897                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2898                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2899                 ieee80211_radiotap_tx(vap, m0);
2900         }
2901
2902         xferlen = sizeof(*txd) + m0->m_pkthdr.len;
2903         m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
2904
2905         data->buflen = xferlen;
2906         data->ni = ni;
2907         data->m = m0;
2908         STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
2909
2910         /* start transfer, if any */
2911         usbd_transfer_start(sc->sc_xfer[which]);
2912         return (0);
2913 }
2914
2915 static int
2916 rsu_transmit(struct ieee80211com *ic, struct mbuf *m)
2917 {
2918         struct rsu_softc *sc = ic->ic_softc;
2919         int error;
2920
2921         RSU_LOCK(sc);
2922         if (!sc->sc_running) {
2923                 RSU_UNLOCK(sc);
2924                 return (ENXIO);
2925         }
2926
2927         /*
2928          * XXX TODO: ensure that we treat 'm' as a list of frames
2929          * to transmit!
2930          */
2931         error = mbufq_enqueue(&sc->sc_snd, m);
2932         if (error) {
2933                 RSU_DPRINTF(sc, RSU_DEBUG_TX,
2934                     "%s: mbufq_enable: failed (%d)\n",
2935                     __func__,
2936                     error);
2937                 RSU_UNLOCK(sc);
2938                 return (error);
2939         }
2940         RSU_UNLOCK(sc);
2941
2942         /* This kicks the TX taskqueue */
2943         rsu_start(sc);
2944
2945         return (0);
2946 }
2947
2948 static void
2949 rsu_drain_mbufq(struct rsu_softc *sc)
2950 {
2951         struct mbuf *m;
2952         struct ieee80211_node *ni;
2953
2954         RSU_ASSERT_LOCKED(sc);
2955         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2956                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2957                 m->m_pkthdr.rcvif = NULL;
2958                 ieee80211_free_node(ni);
2959                 m_freem(m);
2960         }
2961 }
2962
2963 static void
2964 _rsu_start(struct rsu_softc *sc)
2965 {
2966         struct ieee80211_node *ni;
2967         struct rsu_data *bf;
2968         struct mbuf *m;
2969
2970         RSU_ASSERT_LOCKED(sc);
2971
2972         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2973                 bf = rsu_getbuf(sc);
2974                 if (bf == NULL) {
2975                         RSU_DPRINTF(sc, RSU_DEBUG_TX,
2976                             "%s: failed to get buffer\n", __func__);
2977                         mbufq_prepend(&sc->sc_snd, m);
2978                         break;
2979                 }
2980
2981                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2982                 m->m_pkthdr.rcvif = NULL;
2983
2984                 if (rsu_tx_start(sc, ni, m, bf) != 0) {
2985                         RSU_DPRINTF(sc, RSU_DEBUG_TX,
2986                             "%s: failed to transmit\n", __func__);
2987                         if_inc_counter(ni->ni_vap->iv_ifp,
2988                             IFCOUNTER_OERRORS, 1);
2989                         rsu_freebuf(sc, bf);
2990                         ieee80211_free_node(ni);
2991                         m_freem(m);
2992                         break;
2993                 }
2994         }
2995 }
2996
2997 static void
2998 rsu_start(struct rsu_softc *sc)
2999 {
3000
3001         taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
3002 }
3003
3004 static int
3005 rsu_ioctl_net(struct ieee80211com *ic, u_long cmd, void *data)
3006 {
3007         struct rsu_softc *sc = ic->ic_softc;
3008         struct ifreq *ifr = (struct ifreq *)data;
3009         int error;
3010
3011         error = 0;
3012         switch (cmd) {
3013         case SIOCSIFCAP:
3014         {
3015                 struct ieee80211vap *vap;
3016                 int rxmask;
3017
3018                 rxmask = ifr->ifr_reqcap & (IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6);
3019
3020                 RSU_LOCK(sc);
3021                 /* Both RXCSUM bits must be set (or unset). */
3022                 if (sc->sc_rx_checksum_enable &&
3023                     rxmask != (IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6)) {
3024                         rxmask = 0;
3025                         sc->sc_rx_checksum_enable = 0;
3026                         rsu_rxfilter_set(sc, R92S_RCR_TCP_OFFLD_EN, 0);
3027                 } else if (!sc->sc_rx_checksum_enable && rxmask != 0) {
3028                         rxmask = IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
3029                         sc->sc_rx_checksum_enable = 1;
3030                         rsu_rxfilter_set(sc, 0, R92S_RCR_TCP_OFFLD_EN);
3031                 } else {
3032                         /* Nothing to do. */
3033                         RSU_UNLOCK(sc);
3034                         break;
3035                 }
3036                 RSU_UNLOCK(sc);
3037
3038                 IEEE80211_LOCK(ic);     /* XXX */
3039                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
3040                         struct ifnet *ifp = vap->iv_ifp;
3041
3042                         ifp->if_capenable &=
3043                             ~(IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6);
3044                         ifp->if_capenable |= rxmask;
3045                 }
3046                 IEEE80211_UNLOCK(ic);
3047                 break;
3048         }
3049         default:
3050                 error = ENOTTY;         /* for net80211 */
3051                 break;
3052         }
3053
3054         return (error);
3055 }
3056
3057 static void
3058 rsu_parent(struct ieee80211com *ic)
3059 {
3060         struct rsu_softc *sc = ic->ic_softc;
3061
3062         if (ic->ic_nrunning > 0) {
3063                 if (rsu_init(sc) == 0)
3064                         ieee80211_start_all(ic);
3065                 else {
3066                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3067                         if (vap != NULL)
3068                                 ieee80211_stop(vap);
3069                 }
3070         } else
3071                 rsu_stop(sc);
3072 }
3073
3074 /*
3075  * Power on sequence for A-cut adapters.
3076  */
3077 static void
3078 rsu_power_on_acut(struct rsu_softc *sc)
3079 {
3080         uint32_t reg;
3081
3082         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
3083         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
3084
3085         /* Enable AFE macro block's bandgap and Mbias. */
3086         rsu_write_1(sc, R92S_AFE_MISC,
3087             rsu_read_1(sc, R92S_AFE_MISC) |
3088             R92S_AFE_MISC_BGEN | R92S_AFE_MISC_MBEN);
3089         /* Enable LDOA15 block. */
3090         rsu_write_1(sc, R92S_LDOA15_CTRL,
3091             rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
3092
3093         rsu_write_1(sc, R92S_SPS1_CTRL,
3094             rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_LDEN);
3095         rsu_ms_delay(sc, 2000);
3096         /* Enable switch regulator block. */
3097         rsu_write_1(sc, R92S_SPS1_CTRL,
3098             rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_SWEN);
3099
3100         rsu_write_4(sc, R92S_SPS1_CTRL, 0x00a7b267);
3101
3102         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3103             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
3104
3105         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3106             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
3107
3108         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3109             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x90);
3110
3111         /* Enable AFE clock. */
3112         rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
3113             rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
3114         /* Enable AFE PLL macro block. */
3115         rsu_write_1(sc, R92S_AFE_PLL_CTRL,
3116             rsu_read_1(sc, R92S_AFE_PLL_CTRL) | 0x11);
3117         /* Attach AFE PLL to MACTOP/BB. */
3118         rsu_write_1(sc, R92S_SYS_ISO_CTRL,
3119             rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
3120
3121         /* Switch to 40MHz clock instead of 80MHz. */
3122         rsu_write_2(sc, R92S_SYS_CLKR,
3123             rsu_read_2(sc, R92S_SYS_CLKR) & ~R92S_SYS_CLKSEL);
3124
3125         /* Enable MAC clock. */
3126         rsu_write_2(sc, R92S_SYS_CLKR,
3127             rsu_read_2(sc, R92S_SYS_CLKR) |
3128             R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
3129
3130         rsu_write_1(sc, R92S_PMC_FSM, 0x02);
3131
3132         /* Enable digital core and IOREG R/W. */
3133         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3134             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
3135
3136         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3137             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
3138
3139         /* Switch the control path to firmware. */
3140         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3141         reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
3142         rsu_write_2(sc, R92S_SYS_CLKR, reg);
3143
3144         rsu_write_2(sc, R92S_CR, 0x37fc);
3145
3146         /* Fix USB RX FIFO issue. */
3147         rsu_write_1(sc, 0xfe5c,
3148             rsu_read_1(sc, 0xfe5c) | 0x80);
3149         rsu_write_1(sc, 0x00ab,
3150             rsu_read_1(sc, 0x00ab) | 0xc0);
3151
3152         rsu_write_1(sc, R92S_SYS_CLKR,
3153             rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
3154 }
3155
3156 /*
3157  * Power on sequence for B-cut and C-cut adapters.
3158  */
3159 static void
3160 rsu_power_on_bcut(struct rsu_softc *sc)
3161 {
3162         uint32_t reg;
3163         int ntries;
3164
3165         /* Prevent eFuse leakage. */
3166         rsu_write_1(sc, 0x37, 0xb0);
3167         rsu_ms_delay(sc, 10);
3168         rsu_write_1(sc, 0x37, 0x30);
3169
3170         /* Switch the control path to hardware. */
3171         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3172         if (reg & R92S_FWHW_SEL) {
3173                 rsu_write_2(sc, R92S_SYS_CLKR,
3174                     reg & ~(R92S_SWHW_SEL | R92S_FWHW_SEL));
3175         }
3176         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3177             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) & ~0x8c);
3178         rsu_ms_delay(sc, 1);
3179
3180         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
3181         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
3182
3183         reg = rsu_read_1(sc, R92S_AFE_MISC);
3184         rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN);
3185         rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN |
3186             R92S_AFE_MISC_MBEN | R92S_AFE_MISC_I32_EN);
3187
3188         /* Enable PLL. */
3189         rsu_write_1(sc, R92S_LDOA15_CTRL,
3190             rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
3191
3192         rsu_write_1(sc, R92S_LDOV12D_CTRL,
3193             rsu_read_1(sc, R92S_LDOV12D_CTRL) | R92S_LDV12_EN);
3194
3195         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3196             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
3197
3198         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3199             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
3200
3201         /* Support 64KB IMEM. */
3202         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3203             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x97);
3204
3205         /* Enable AFE clock. */
3206         rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
3207             rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
3208         /* Enable AFE PLL macro block. */
3209         reg = rsu_read_1(sc, R92S_AFE_PLL_CTRL);
3210         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
3211         rsu_ms_delay(sc, 1);
3212         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x51);
3213         rsu_ms_delay(sc, 1);
3214         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
3215         rsu_ms_delay(sc, 1);
3216
3217         /* Attach AFE PLL to MACTOP/BB. */
3218         rsu_write_1(sc, R92S_SYS_ISO_CTRL,
3219             rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
3220
3221         /* Switch to 40MHz clock. */
3222         rsu_write_1(sc, R92S_SYS_CLKR, 0x00);
3223         /* Disable CPU clock and 80MHz SSC. */
3224         rsu_write_1(sc, R92S_SYS_CLKR,
3225             rsu_read_1(sc, R92S_SYS_CLKR) | 0xa0);
3226         /* Enable MAC clock. */
3227         rsu_write_2(sc, R92S_SYS_CLKR,
3228             rsu_read_2(sc, R92S_SYS_CLKR) |
3229             R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
3230
3231         rsu_write_1(sc, R92S_PMC_FSM, 0x02);
3232
3233         /* Enable digital core and IOREG R/W. */
3234         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3235             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
3236
3237         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3238             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
3239
3240         /* Switch the control path to firmware. */
3241         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3242         reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
3243         rsu_write_2(sc, R92S_SYS_CLKR, reg);
3244
3245         rsu_write_2(sc, R92S_CR, 0x37fc);
3246
3247         /* Fix USB RX FIFO issue. */
3248         rsu_write_1(sc, 0xfe5c,
3249             rsu_read_1(sc, 0xfe5c) | 0x80);
3250
3251         rsu_write_1(sc, R92S_SYS_CLKR,
3252             rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
3253
3254         rsu_write_1(sc, 0xfe1c, 0x80);
3255
3256         /* Make sure TxDMA is ready to download firmware. */
3257         for (ntries = 0; ntries < 20; ntries++) {
3258                 reg = rsu_read_1(sc, R92S_TCR);
3259                 if ((reg & (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT)) ==
3260                     (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT))
3261                         break;
3262                 rsu_ms_delay(sc, 1);
3263         }
3264         if (ntries == 20) {
3265                 RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_TX,
3266                     "%s: TxDMA is not ready\n",
3267                     __func__);
3268                 /* Reset TxDMA. */
3269                 reg = rsu_read_1(sc, R92S_CR);
3270                 rsu_write_1(sc, R92S_CR, reg & ~R92S_CR_TXDMA_EN);
3271                 rsu_ms_delay(sc, 1);
3272                 rsu_write_1(sc, R92S_CR, reg | R92S_CR_TXDMA_EN);
3273         }
3274 }
3275
3276 static void
3277 rsu_power_off(struct rsu_softc *sc)
3278 {
3279         /* Turn RF off. */
3280         rsu_write_1(sc, R92S_RF_CTRL, 0x00);
3281         rsu_ms_delay(sc, 5);
3282
3283         /* Turn MAC off. */
3284         /* Switch control path. */
3285         rsu_write_1(sc, R92S_SYS_CLKR + 1, 0x38);
3286         /* Reset MACTOP. */
3287         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x70);
3288         rsu_write_1(sc, R92S_PMC_FSM, 0x06);
3289         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 0, 0xf9);
3290         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1, 0xe8);
3291
3292         /* Disable AFE PLL. */
3293         rsu_write_1(sc, R92S_AFE_PLL_CTRL, 0x00);
3294         /* Disable A15V. */
3295         rsu_write_1(sc, R92S_LDOA15_CTRL, 0x54);
3296         /* Disable eFuse 1.2V. */
3297         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x50);
3298         rsu_write_1(sc, R92S_LDOV12D_CTRL, 0x24);
3299         /* Enable AFE macro block's bandgap and Mbias. */
3300         rsu_write_1(sc, R92S_AFE_MISC, 0x30);
3301         /* Disable 1.6V LDO. */
3302         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x56);
3303         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x43);
3304
3305         /* Firmware - tell it to switch things off */
3306         (void) rsu_set_fw_power_state(sc, RSU_PWR_OFF);
3307 }
3308
3309 static int
3310 rsu_fw_loadsection(struct rsu_softc *sc, const uint8_t *buf, int len)
3311 {
3312         const uint8_t which = rsu_wme_ac_xfer_map[WME_AC_VO];
3313         struct rsu_data *data;
3314         struct r92s_tx_desc *txd;
3315         int mlen;
3316
3317         while (len > 0) {
3318                 data = rsu_getbuf(sc);
3319                 if (data == NULL)
3320                         return (ENOMEM);
3321                 txd = (struct r92s_tx_desc *)data->buf;
3322                 memset(txd, 0, sizeof(*txd));
3323                 if (len <= RSU_TXBUFSZ - sizeof(*txd)) {
3324                         /* Last chunk. */
3325                         txd->txdw0 |= htole32(R92S_TXDW0_LINIP);
3326                         mlen = len;
3327                 } else
3328                         mlen = RSU_TXBUFSZ - sizeof(*txd);
3329                 txd->txdw0 |= htole32(SM(R92S_TXDW0_PKTLEN, mlen));
3330                 memcpy(&txd[1], buf, mlen);
3331                 data->buflen = sizeof(*txd) + mlen;
3332                 RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FW | RSU_DEBUG_RESET,
3333                     "%s: starting transfer %p\n",
3334                     __func__, data);
3335                 STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
3336                 buf += mlen;
3337                 len -= mlen;
3338         }
3339         usbd_transfer_start(sc->sc_xfer[which]);
3340         return (0);
3341 }
3342
3343 CTASSERT(sizeof(size_t) >= sizeof(uint32_t));
3344
3345 static int
3346 rsu_load_firmware(struct rsu_softc *sc)
3347 {
3348         const struct r92s_fw_hdr *hdr;
3349         struct r92s_fw_priv *dmem;
3350         struct ieee80211com *ic = &sc->sc_ic;
3351         const uint8_t *imem, *emem;
3352         uint32_t imemsz, ememsz;
3353         const struct firmware *fw;
3354         size_t size;
3355         uint32_t reg;
3356         int ntries, error;
3357
3358         if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY) {
3359                 RSU_DPRINTF(sc, RSU_DEBUG_ANY,
3360                     "%s: Firmware already loaded\n",
3361                     __func__);
3362                 return (0);
3363         }
3364
3365         RSU_UNLOCK(sc);
3366         /* Read firmware image from the filesystem. */
3367         if ((fw = firmware_get("rsu-rtl8712fw")) == NULL) {
3368                 device_printf(sc->sc_dev,
3369                     "%s: failed load firmware of file rsu-rtl8712fw\n",
3370                     __func__);
3371                 RSU_LOCK(sc);
3372                 return (ENXIO);
3373         }
3374         RSU_LOCK(sc);
3375         size = fw->datasize;
3376         if (size < sizeof(*hdr)) {
3377                 device_printf(sc->sc_dev, "firmware too short\n");
3378                 error = EINVAL;
3379                 goto fail;
3380         }
3381         hdr = (const struct r92s_fw_hdr *)fw->data;
3382         if (hdr->signature != htole16(0x8712) &&
3383             hdr->signature != htole16(0x8192)) {
3384                 device_printf(sc->sc_dev,
3385                     "invalid firmware signature 0x%x\n",
3386                     le16toh(hdr->signature));
3387                 error = EINVAL;
3388                 goto fail;
3389         }
3390         RSU_DPRINTF(sc, RSU_DEBUG_FW, "FW V%d %02x-%02x %02x:%02x\n",
3391             le16toh(hdr->version), hdr->month, hdr->day, hdr->hour,
3392             hdr->minute);
3393
3394         /* Make sure that driver and firmware are in sync. */
3395         if (hdr->privsz != htole32(sizeof(*dmem))) {
3396                 device_printf(sc->sc_dev, "unsupported firmware image\n");
3397                 error = EINVAL;
3398                 goto fail;
3399         }
3400         /* Get FW sections sizes. */
3401         imemsz = le32toh(hdr->imemsz);
3402         ememsz = le32toh(hdr->sramsz);
3403         /* Check that all FW sections fit in image. */
3404         if (imemsz > (size_t)(size - sizeof(*hdr)) ||
3405             ememsz > (size_t)(size - sizeof(*hdr) - imemsz)) {
3406                 device_printf(sc->sc_dev, "firmware too short\n");
3407                 error = EINVAL;
3408                 goto fail;
3409         }
3410         imem = (const uint8_t *)&hdr[1];
3411         emem = imem + imemsz;
3412
3413         /* Load IMEM section. */
3414         error = rsu_fw_loadsection(sc, imem, imemsz);
3415         if (error != 0) {
3416                 device_printf(sc->sc_dev,
3417                     "could not load firmware section %s\n", "IMEM");
3418                 goto fail;
3419         }
3420         /* Wait for load to complete. */
3421         for (ntries = 0; ntries != 50; ntries++) {
3422                 rsu_ms_delay(sc, 10);
3423                 reg = rsu_read_1(sc, R92S_TCR);
3424                 if (reg & R92S_TCR_IMEM_CODE_DONE)
3425                         break;
3426         }
3427         if (ntries == 50) {
3428                 device_printf(sc->sc_dev, "timeout waiting for IMEM transfer\n");
3429                 error = ETIMEDOUT;
3430                 goto fail;
3431         }
3432         /* Load EMEM section. */
3433         error = rsu_fw_loadsection(sc, emem, ememsz);
3434         if (error != 0) {
3435                 device_printf(sc->sc_dev,
3436                     "could not load firmware section %s\n", "EMEM");
3437                 goto fail;
3438         }
3439         /* Wait for load to complete. */
3440         for (ntries = 0; ntries != 50; ntries++) {
3441                 rsu_ms_delay(sc, 10);
3442                 reg = rsu_read_2(sc, R92S_TCR);
3443                 if (reg & R92S_TCR_EMEM_CODE_DONE)
3444                         break;
3445         }
3446         if (ntries == 50) {
3447                 device_printf(sc->sc_dev, "timeout waiting for EMEM transfer\n");
3448                 error = ETIMEDOUT;
3449                 goto fail;
3450         }
3451         /* Enable CPU. */
3452         rsu_write_1(sc, R92S_SYS_CLKR,
3453             rsu_read_1(sc, R92S_SYS_CLKR) | R92S_SYS_CPU_CLKSEL);
3454         if (!(rsu_read_1(sc, R92S_SYS_CLKR) & R92S_SYS_CPU_CLKSEL)) {
3455                 device_printf(sc->sc_dev, "could not enable system clock\n");
3456                 error = EIO;
3457                 goto fail;
3458         }
3459         rsu_write_2(sc, R92S_SYS_FUNC_EN,
3460             rsu_read_2(sc, R92S_SYS_FUNC_EN) | R92S_FEN_CPUEN);
3461         if (!(rsu_read_2(sc, R92S_SYS_FUNC_EN) & R92S_FEN_CPUEN)) {
3462                 device_printf(sc->sc_dev,
3463                     "could not enable microcontroller\n");
3464                 error = EIO;
3465                 goto fail;
3466         }
3467         /* Wait for CPU to initialize. */
3468         for (ntries = 0; ntries < 100; ntries++) {
3469                 if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_IMEM_RDY)
3470                         break;
3471                 rsu_ms_delay(sc, 1);
3472         }
3473         if (ntries == 100) {
3474                 device_printf(sc->sc_dev,
3475                     "timeout waiting for microcontroller\n");
3476                 error = ETIMEDOUT;
3477                 goto fail;
3478         }
3479
3480         /* Update DMEM section before loading. */
3481         dmem = __DECONST(struct r92s_fw_priv *, &hdr->priv);
3482         memset(dmem, 0, sizeof(*dmem));
3483         dmem->hci_sel = R92S_HCI_SEL_USB | R92S_HCI_SEL_8172;
3484         dmem->nendpoints = sc->sc_nendpoints;
3485         dmem->chip_version = sc->cut;
3486         dmem->rf_config = sc->sc_rftype;
3487         dmem->vcs_type = R92S_VCS_TYPE_AUTO;
3488         dmem->vcs_mode = R92S_VCS_MODE_RTS_CTS;
3489         dmem->turbo_mode = 0;
3490         dmem->bw40_en = !! (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40);
3491         dmem->amsdu2ampdu_en = !! (sc->sc_ht);
3492         dmem->ampdu_en = !! (sc->sc_ht);
3493         dmem->agg_offload = !! (sc->sc_ht);
3494         dmem->qos_en = 1;
3495         dmem->ps_offload = 1;
3496         dmem->lowpower_mode = 1;        /* XXX TODO: configurable? */
3497         /* Load DMEM section. */
3498         error = rsu_fw_loadsection(sc, (uint8_t *)dmem, sizeof(*dmem));
3499         if (error != 0) {
3500                 device_printf(sc->sc_dev,
3501                     "could not load firmware section %s\n", "DMEM");
3502                 goto fail;
3503         }
3504         /* Wait for load to complete. */
3505         for (ntries = 0; ntries < 100; ntries++) {
3506                 if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_DMEM_CODE_DONE)
3507                         break;
3508                 rsu_ms_delay(sc, 1);
3509         }
3510         if (ntries == 100) {
3511                 device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
3512                     "DMEM");
3513                 error = ETIMEDOUT;
3514                 goto fail;
3515         }
3516         /* Wait for firmware readiness. */
3517         for (ntries = 0; ntries < 60; ntries++) {
3518                 if (!(rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY))
3519                         break;
3520                 rsu_ms_delay(sc, 1);
3521         }
3522         if (ntries == 60) {
3523                 device_printf(sc->sc_dev,
3524                     "timeout waiting for firmware readiness\n");
3525                 error = ETIMEDOUT;
3526                 goto fail;
3527         }
3528  fail:
3529         firmware_put(fw, FIRMWARE_UNLOAD);
3530         return (error);
3531 }
3532
3533
3534 static int
3535 rsu_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3536     const struct ieee80211_bpf_params *params)
3537 {
3538         struct ieee80211com *ic = ni->ni_ic;
3539         struct rsu_softc *sc = ic->ic_softc;
3540         struct rsu_data *bf;
3541
3542         /* prevent management frames from being sent if we're not ready */
3543         if (!sc->sc_running) {
3544                 m_freem(m);
3545                 return (ENETDOWN);
3546         }
3547         RSU_LOCK(sc);
3548         bf = rsu_getbuf(sc);
3549         if (bf == NULL) {
3550                 m_freem(m);
3551                 RSU_UNLOCK(sc);
3552                 return (ENOBUFS);
3553         }
3554         if (rsu_tx_start(sc, ni, m, bf) != 0) {
3555                 m_freem(m);
3556                 rsu_freebuf(sc, bf);
3557                 RSU_UNLOCK(sc);
3558                 return (EIO);
3559         }
3560         RSU_UNLOCK(sc);
3561
3562         return (0);
3563 }
3564
3565 static void
3566 rsu_rxfilter_init(struct rsu_softc *sc)
3567 {
3568         uint32_t reg;
3569
3570         RSU_ASSERT_LOCKED(sc);
3571
3572         /* Setup multicast filter. */
3573         rsu_set_multi(sc);
3574
3575         /* Adjust Rx filter. */
3576         reg = rsu_read_4(sc, R92S_RCR);
3577         reg &= ~R92S_RCR_AICV;
3578         reg |= R92S_RCR_APP_PHYSTS;
3579         if (sc->sc_rx_checksum_enable)
3580                 reg |= R92S_RCR_TCP_OFFLD_EN;
3581         rsu_write_4(sc, R92S_RCR, reg);
3582
3583         /* Update dynamic Rx filter parts. */
3584         rsu_rxfilter_refresh(sc);
3585 }
3586
3587 static void
3588 rsu_rxfilter_set(struct rsu_softc *sc, uint32_t clear, uint32_t set)
3589 {
3590         /* NB: firmware can touch this register too. */
3591         rsu_write_4(sc, R92S_RCR,
3592            (rsu_read_4(sc, R92S_RCR) & ~clear) | set);
3593 }
3594
3595 static void
3596 rsu_rxfilter_refresh(struct rsu_softc *sc)
3597 {
3598         struct ieee80211com *ic = &sc->sc_ic;
3599         uint32_t mask_all, mask_min;
3600
3601         RSU_ASSERT_LOCKED(sc);
3602
3603         /* NB: RCR_AMF / RXFLTMAP_MGT are used by firmware. */
3604         mask_all = R92S_RCR_ACF | R92S_RCR_AAP;
3605         mask_min = R92S_RCR_APM;
3606         if (sc->sc_vap_is_running)
3607                 mask_min |= R92S_RCR_CBSSID;
3608         else
3609                 mask_all |= R92S_RCR_ADF;
3610
3611         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3612                 uint16_t rxfltmap;
3613                 if (sc->sc_vap_is_running)
3614                         rxfltmap = 0;
3615                 else
3616                         rxfltmap = R92S_RXFLTMAP_MGT_DEF;
3617                 rsu_write_2(sc, R92S_RXFLTMAP_MGT, rxfltmap);
3618         }
3619
3620         if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_MONITOR)
3621                 rsu_rxfilter_set(sc, mask_all, mask_min);
3622         else
3623                 rsu_rxfilter_set(sc, mask_min, mask_all);
3624 }
3625
3626 static int
3627 rsu_init(struct rsu_softc *sc)
3628 {
3629         struct ieee80211com *ic = &sc->sc_ic;
3630         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3631         uint8_t macaddr[IEEE80211_ADDR_LEN];
3632         int error;
3633         int i;
3634
3635         RSU_LOCK(sc);
3636
3637         if (sc->sc_running) {
3638                 RSU_UNLOCK(sc);
3639                 return (0);
3640         }
3641
3642         /* Ensure the mbuf queue is drained */
3643         rsu_drain_mbufq(sc);
3644
3645         /* Reset power management state. */
3646         rsu_write_1(sc, R92S_USB_HRPWM, 0);
3647
3648         /* Power on adapter. */
3649         if (sc->cut == 1)
3650                 rsu_power_on_acut(sc);
3651         else
3652                 rsu_power_on_bcut(sc);
3653
3654         /* Load firmware. */
3655         error = rsu_load_firmware(sc);
3656         if (error != 0)
3657                 goto fail;
3658
3659         rsu_write_4(sc, R92S_CR,
3660             rsu_read_4(sc, R92S_CR) & ~0xff000000);
3661
3662         /* Use 128 bytes pages. */
3663         rsu_write_1(sc, 0x00b5,
3664             rsu_read_1(sc, 0x00b5) | 0x01);
3665         /* Enable USB Rx aggregation. */
3666         rsu_write_1(sc, 0x00bd,
3667             rsu_read_1(sc, 0x00bd) | 0x80);
3668         /* Set USB Rx aggregation threshold. */
3669         rsu_write_1(sc, 0x00d9, 0x01);
3670         /* Set USB Rx aggregation timeout (1.7ms/4). */
3671         rsu_write_1(sc, 0xfe5b, 0x04);
3672         /* Fix USB Rx FIFO issue. */
3673         rsu_write_1(sc, 0xfe5c,
3674             rsu_read_1(sc, 0xfe5c) | 0x80);
3675
3676         /* Set MAC address. */
3677         IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3678         rsu_write_region_1(sc, R92S_MACID, macaddr, IEEE80211_ADDR_LEN);
3679
3680         /* It really takes 1.5 seconds for the firmware to boot: */
3681         usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(2000));
3682
3683         RSU_DPRINTF(sc, RSU_DEBUG_RESET, "%s: setting MAC address to %s\n",
3684             __func__,
3685             ether_sprintf(macaddr));
3686         error = rsu_fw_cmd(sc, R92S_CMD_SET_MAC_ADDRESS, macaddr,
3687             IEEE80211_ADDR_LEN);
3688         if (error != 0) {
3689                 device_printf(sc->sc_dev, "could not set MAC address\n");
3690                 goto fail;
3691         }
3692
3693         /* Initialize Rx filter. */
3694         rsu_rxfilter_init(sc);
3695
3696         /* Set PS mode fully active */
3697         error = rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
3698         if (error != 0) {
3699                 device_printf(sc->sc_dev, "could not set PS mode\n");
3700                 goto fail;
3701         }
3702
3703         /* Install static keys (if any). */
3704         error = rsu_reinit_static_keys(sc);
3705         if (error != 0)
3706                 goto fail;
3707
3708         sc->sc_extra_scan = 0;
3709         usbd_transfer_start(sc->sc_xfer[RSU_BULK_RX]);
3710
3711         /* We're ready to go. */
3712         sc->sc_running = 1;
3713         RSU_UNLOCK(sc);
3714
3715         return (0);
3716 fail:
3717         /* Need to stop all failed transfers, if any */
3718         for (i = 0; i != RSU_N_TRANSFER; i++)
3719                 usbd_transfer_stop(sc->sc_xfer[i]);
3720         RSU_UNLOCK(sc);
3721
3722         return (error);
3723 }
3724
3725 static void
3726 rsu_stop(struct rsu_softc *sc)
3727 {
3728         int i;
3729
3730         RSU_LOCK(sc);
3731         if (!sc->sc_running) {
3732                 RSU_UNLOCK(sc);
3733                 return;
3734         }
3735
3736         sc->sc_running = 0;
3737         sc->sc_vap_is_running = 0;
3738         sc->sc_calibrating = 0;
3739         taskqueue_cancel_timeout(taskqueue_thread, &sc->calib_task, NULL);
3740         taskqueue_cancel(taskqueue_thread, &sc->tx_task, NULL);
3741
3742         /* Power off adapter. */
3743         rsu_power_off(sc);
3744
3745         /*
3746          * CAM is not accessible after shutdown;
3747          * all entries are marked (by firmware?) as invalid.
3748          */
3749         memset(sc->free_keys_bmap, 0, sizeof(sc->free_keys_bmap));
3750         memset(sc->keys_bmap, 0, sizeof(sc->keys_bmap));
3751
3752         for (i = 0; i < RSU_N_TRANSFER; i++)
3753                 usbd_transfer_stop(sc->sc_xfer[i]);
3754
3755         /* Ensure the mbuf queue is drained */
3756         rsu_drain_mbufq(sc);
3757         RSU_UNLOCK(sc);
3758 }
3759
3760 /*
3761  * Note: usb_pause_mtx() actually releases the mutex before calling pause(),
3762  * which breaks any kind of driver serialisation.
3763  */
3764 static void
3765 rsu_ms_delay(struct rsu_softc *sc, int ms)
3766 {
3767
3768         //usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3769         DELAY(ms * 1000);
3770 }