sys/dev/usb/wlan/if_rsu.c

   1 /*      $OpenBSD: if_rsu.c,v 1.17 2013/04/15 09:23:01 mglocker Exp $    */
   2
   3 /*-
   4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
   5  *
   6  * Permission to use, copy, modify, and distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18 #include <sys/cdefs.h>
  19 __FBSDID("$FreeBSD$");
  20
  21 /*
  22  * Driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU.
  23  *
  24  * TODO:
  25  *   o tx a-mpdu
  26  *   o hostap / ibss / mesh
  27  *   o power-save operation
  28  */
  29
  30 #include "opt_wlan.h"
  31
  32 #include <sys/param.h>
  33 #include <sys/endian.h>
  34 #include <sys/sockio.h>
  35 #include <sys/malloc.h>
  36 #include <sys/mbuf.h>
  37 #include <sys/kernel.h>
  38 #include <sys/socket.h>
  39 #include <sys/systm.h>
  40 #include <sys/conf.h>
  41 #include <sys/bus.h>
  42 #include <sys/firmware.h>
  43 #include <sys/module.h>
  44
  45 #include <net/bpf.h>
  46 #include <net/if.h>
  47 #include <net/if_var.h>
  48 #include <net/if_arp.h>
  49 #include <net/if_dl.h>
  50 #include <net/if_media.h>
  51 #include <net/if_types.h>
  52
  53 #include <netinet/in.h>
  54 #include <netinet/in_systm.h>
  55 #include <netinet/in_var.h>
  56 #include <netinet/if_ether.h>
  57 #include <netinet/ip.h>
  58
  59 #include <net80211/ieee80211_var.h>
  60 #include <net80211/ieee80211_regdomain.h>
  61 #include <net80211/ieee80211_radiotap.h>
  62
  63 #include <dev/usb/usb.h>
  64 #include <dev/usb/usbdi.h>
  65 #include "usbdevs.h"
  66
  67 #include <dev/rtwn/if_rtwn_ridx.h>      /* XXX */
  68 #include <dev/usb/wlan/if_rsureg.h>
  69
  70 #define RSU_RATE_IS_CCK RTWN_RATE_IS_CCK
  71
  72 #ifdef USB_DEBUG
  73 static int rsu_debug = 0;
  74 SYSCTL_NODE(_hw_usb, OID_AUTO, rsu, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
  75     "USB rsu");
  76 SYSCTL_INT(_hw_usb_rsu, OID_AUTO, debug, CTLFLAG_RWTUN, &rsu_debug, 0,
  77     "Debug level");
  78 #define RSU_DPRINTF(_sc, _flg, ...)                                     \
  79         do                                                              \
  80                 if (((_flg) == (RSU_DEBUG_ANY)) || (rsu_debug & (_flg))) \
  81                         device_printf((_sc)->sc_dev, __VA_ARGS__);      \
  82         while (0)
  83 #else
  84 #define RSU_DPRINTF(_sc, _flg, ...)
  85 #endif
  86
  87 static int rsu_enable_11n = 1;
  88 TUNABLE_INT("hw.usb.rsu.enable_11n", &rsu_enable_11n);
  89
  90 #define RSU_DEBUG_ANY           0xffffffff
  91 #define RSU_DEBUG_TX            0x00000001
  92 #define RSU_DEBUG_RX            0x00000002
  93 #define RSU_DEBUG_RESET         0x00000004
  94 #define RSU_DEBUG_CALIB         0x00000008
  95 #define RSU_DEBUG_STATE         0x00000010
  96 #define RSU_DEBUG_SCAN          0x00000020
  97 #define RSU_DEBUG_FWCMD         0x00000040
  98 #define RSU_DEBUG_TXDONE        0x00000080
  99 #define RSU_DEBUG_FW            0x00000100
 100 #define RSU_DEBUG_FWDBG         0x00000200
 101 #define RSU_DEBUG_AMPDU         0x00000400
 102 #define RSU_DEBUG_KEY           0x00000800
 103 #define RSU_DEBUG_USB           0x00001000
 104
 105 static const STRUCT_USB_HOST_ID rsu_devs[] = {
 106 #define RSU_HT_NOT_SUPPORTED 0
 107 #define RSU_HT_SUPPORTED 1
 108 #define RSU_DEV_HT(v,p)  { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
 109                                    RSU_HT_SUPPORTED) }
 110 #define RSU_DEV(v,p)     { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
 111                                    RSU_HT_NOT_SUPPORTED) }
 112         RSU_DEV(ASUS,                   RTL8192SU),
 113         RSU_DEV(AZUREWAVE,              RTL8192SU_4),
 114         RSU_DEV(SITECOMEU,              WLA1000),
 115         RSU_DEV_HT(ACCTON,              RTL8192SU),
 116         RSU_DEV_HT(ASUS,                USBN10),
 117         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_1),
 118         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_2),
 119         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_3),
 120         RSU_DEV_HT(AZUREWAVE,           RTL8192SU_5),
 121         RSU_DEV_HT(BELKIN,              RTL8192SU_1),
 122         RSU_DEV_HT(BELKIN,              RTL8192SU_2),
 123         RSU_DEV_HT(BELKIN,              RTL8192SU_3),
 124         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_1),
 125         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_2),
 126         RSU_DEV_HT(CONCEPTRONIC2,       RTL8192SU_3),
 127         RSU_DEV_HT(COREGA,              RTL8192SU),
 128         RSU_DEV_HT(DLINK2,              DWA131A1),
 129         RSU_DEV_HT(DLINK2,              RTL8192SU_1),
 130         RSU_DEV_HT(DLINK2,              RTL8192SU_2),
 131         RSU_DEV_HT(EDIMAX,              RTL8192SU_1),
 132         RSU_DEV_HT(EDIMAX,              RTL8192SU_2),
 133         RSU_DEV_HT(EDIMAX,              EW7622UMN),
 134         RSU_DEV_HT(GUILLEMOT,           HWGUN54),
 135         RSU_DEV_HT(GUILLEMOT,           HWNUM300),
 136         RSU_DEV_HT(HAWKING,             RTL8192SU_1),
 137         RSU_DEV_HT(HAWKING,             RTL8192SU_2),
 138         RSU_DEV_HT(PLANEX2,             GWUSNANO),
 139         RSU_DEV_HT(REALTEK,             RTL8171),
 140         RSU_DEV_HT(REALTEK,             RTL8172),
 141         RSU_DEV_HT(REALTEK,             RTL8173),
 142         RSU_DEV_HT(REALTEK,             RTL8174),
 143         RSU_DEV_HT(REALTEK,             RTL8192SU),
 144         RSU_DEV_HT(REALTEK,             RTL8712),
 145         RSU_DEV_HT(REALTEK,             RTL8713),
 146         RSU_DEV_HT(SENAO,               RTL8192SU_1),
 147         RSU_DEV_HT(SENAO,               RTL8192SU_2),
 148         RSU_DEV_HT(SITECOMEU,           WL349V1),
 149         RSU_DEV_HT(SITECOMEU,           WL353),
 150         RSU_DEV_HT(SWEEX2,              LW154),
 151         RSU_DEV_HT(TRENDNET,            TEW646UBH),
 152 #undef RSU_DEV_HT
 153 #undef RSU_DEV
 154 };
 155
 156 static device_probe_t   rsu_match;
 157 static device_attach_t  rsu_attach;
 158 static device_detach_t  rsu_detach;
 159 static usb_callback_t   rsu_bulk_tx_callback_be_bk;
 160 static usb_callback_t   rsu_bulk_tx_callback_vi_vo;
 161 static usb_callback_t   rsu_bulk_tx_callback_h2c;
 162 static usb_callback_t   rsu_bulk_rx_callback;
 163 static usb_error_t      rsu_do_request(struct rsu_softc *,
 164                             struct usb_device_request *, void *);
 165 static struct ieee80211vap *
 166                 rsu_vap_create(struct ieee80211com *, const char name[],
 167                     int, enum ieee80211_opmode, int, const uint8_t bssid[],
 168                     const uint8_t mac[]);
 169 static void     rsu_vap_delete(struct ieee80211vap *);
 170 static void     rsu_scan_start(struct ieee80211com *);
 171 static void     rsu_scan_end(struct ieee80211com *);
 172 static void     rsu_getradiocaps(struct ieee80211com *, int, int *,
 173                     struct ieee80211_channel[]);
 174 static void     rsu_set_channel(struct ieee80211com *);
 175 static void     rsu_scan_curchan(struct ieee80211_scan_state *, unsigned long);
 176 static void     rsu_scan_mindwell(struct ieee80211_scan_state *);
 177 static void     rsu_update_promisc(struct ieee80211com *);
 178 static uint8_t  rsu_get_multi_pos(const uint8_t[]);
 179 static void     rsu_set_multi(struct rsu_softc *);
 180 static void     rsu_update_mcast(struct ieee80211com *);
 181 static int      rsu_alloc_rx_list(struct rsu_softc *);
 182 static void     rsu_free_rx_list(struct rsu_softc *);
 183 static int      rsu_alloc_tx_list(struct rsu_softc *);
 184 static void     rsu_free_tx_list(struct rsu_softc *);
 185 static void     rsu_free_list(struct rsu_softc *, struct rsu_data [], int);
 186 static struct rsu_data *_rsu_getbuf(struct rsu_softc *);
 187 static struct rsu_data *rsu_getbuf(struct rsu_softc *);
 188 static void     rsu_freebuf(struct rsu_softc *, struct rsu_data *);
 189 static int      rsu_write_region_1(struct rsu_softc *, uint16_t, uint8_t *,
 190                     int);
 191 static void     rsu_write_1(struct rsu_softc *, uint16_t, uint8_t);
 192 static void     rsu_write_2(struct rsu_softc *, uint16_t, uint16_t);
 193 static void     rsu_write_4(struct rsu_softc *, uint16_t, uint32_t);
 194 static int      rsu_read_region_1(struct rsu_softc *, uint16_t, uint8_t *,
 195                     int);
 196 static uint8_t  rsu_read_1(struct rsu_softc *, uint16_t);
 197 static uint16_t rsu_read_2(struct rsu_softc *, uint16_t);
 198 static uint32_t rsu_read_4(struct rsu_softc *, uint16_t);
 199 static int      rsu_fw_iocmd(struct rsu_softc *, uint32_t);
 200 static uint8_t  rsu_efuse_read_1(struct rsu_softc *, uint16_t);
 201 static int      rsu_read_rom(struct rsu_softc *);
 202 static int      rsu_fw_cmd(struct rsu_softc *, uint8_t, void *, int);
 203 static void     rsu_calib_task(void *, int);
 204 static void     rsu_tx_task(void *, int);
 205 static void     rsu_set_led(struct rsu_softc *, int);
 206 static int      rsu_monitor_newstate(struct ieee80211vap *,
 207                     enum ieee80211_state, int);
 208 static int      rsu_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 209 static int      rsu_key_alloc(struct ieee80211vap *, struct ieee80211_key *,
 210                     ieee80211_keyix *, ieee80211_keyix *);
 211 static int      rsu_process_key(struct ieee80211vap *,
 212                     const struct ieee80211_key *, int);
 213 static int      rsu_key_set(struct ieee80211vap *,
 214                     const struct ieee80211_key *);
 215 static int      rsu_key_delete(struct ieee80211vap *,
 216                     const struct ieee80211_key *);
 217 static int      rsu_cam_read(struct rsu_softc *, uint8_t, uint32_t *);
 218 static void     rsu_cam_write(struct rsu_softc *, uint8_t, uint32_t);
 219 static int      rsu_key_check(struct rsu_softc *, ieee80211_keyix, int);
 220 static uint8_t  rsu_crypto_mode(struct rsu_softc *, u_int, int);
 221 static int      rsu_set_key_group(struct rsu_softc *,
 222                     const struct ieee80211_key *);
 223 static int      rsu_set_key_pair(struct rsu_softc *,
 224                     const struct ieee80211_key *);
 225 static int      rsu_reinit_static_keys(struct rsu_softc *);
 226 static int      rsu_delete_key(struct rsu_softc *sc, ieee80211_keyix);
 227 static void     rsu_delete_key_pair_cb(void *, int);
 228 static int      rsu_site_survey(struct rsu_softc *,
 229                     struct ieee80211_scan_ssid *);
 230 static int      rsu_join_bss(struct rsu_softc *, struct ieee80211_node *);
 231 static int      rsu_disconnect(struct rsu_softc *);
 232 static int      rsu_hwrssi_to_rssi(struct rsu_softc *, int hw_rssi);
 233 static void     rsu_event_survey(struct rsu_softc *, uint8_t *, int);
 234 static void     rsu_event_join_bss(struct rsu_softc *, uint8_t *, int);
 235 static void     rsu_rx_event(struct rsu_softc *, uint8_t, uint8_t *, int);
 236 static void     rsu_rx_multi_event(struct rsu_softc *, uint8_t *, int);
 237 static int8_t   rsu_get_rssi(struct rsu_softc *, int, void *);
 238 static struct mbuf * rsu_rx_copy_to_mbuf(struct rsu_softc *,
 239                     struct r92s_rx_stat *, int);
 240 static uint32_t rsu_get_tsf_low(struct rsu_softc *);
 241 static uint32_t rsu_get_tsf_high(struct rsu_softc *);
 242 static struct ieee80211_node * rsu_rx_frame(struct rsu_softc *, struct mbuf *);
 243 static struct mbuf * rsu_rx_multi_frame(struct rsu_softc *, uint8_t *, int);
 244 static struct mbuf *
 245                 rsu_rxeof(struct usb_xfer *, struct rsu_data *);
 246 static void     rsu_txeof(struct usb_xfer *, struct rsu_data *);
 247 static int      rsu_raw_xmit(struct ieee80211_node *, struct mbuf *,
 248                     const struct ieee80211_bpf_params *);
 249 static void     rsu_rxfilter_init(struct rsu_softc *);
 250 static void     rsu_rxfilter_set(struct rsu_softc *, uint32_t, uint32_t);
 251 static void     rsu_rxfilter_refresh(struct rsu_softc *);
 252 static int      rsu_init(struct rsu_softc *);
 253 static int      rsu_tx_start(struct rsu_softc *, struct ieee80211_node *,
 254                     struct mbuf *, struct rsu_data *);
 255 static int      rsu_transmit(struct ieee80211com *, struct mbuf *);
 256 static void     rsu_start(struct rsu_softc *);
 257 static void     _rsu_start(struct rsu_softc *);
 258 static int      rsu_ioctl_net(struct ieee80211com *, u_long, void *);
 259 static void     rsu_parent(struct ieee80211com *);
 260 static void     rsu_stop(struct rsu_softc *);
 261 static void     rsu_ms_delay(struct rsu_softc *, int);
 262
 263 static device_method_t rsu_methods[] = {
 264         DEVMETHOD(device_probe,         rsu_match),
 265         DEVMETHOD(device_attach,        rsu_attach),
 266         DEVMETHOD(device_detach,        rsu_detach),
 267
 268         DEVMETHOD_END
 269 };
 270
 271 static driver_t rsu_driver = {
 272         .name = "rsu",
 273         .methods = rsu_methods,
 274         .size = sizeof(struct rsu_softc)
 275 };
 276
 277 static devclass_t rsu_devclass;
 278
 279 DRIVER_MODULE(rsu, uhub, rsu_driver, rsu_devclass, NULL, 0);
 280 MODULE_DEPEND(rsu, wlan, 1, 1, 1);
 281 MODULE_DEPEND(rsu, usb, 1, 1, 1);
 282 MODULE_DEPEND(rsu, firmware, 1, 1, 1);
 283 MODULE_VERSION(rsu, 1);
 284 USB_PNP_HOST_INFO(rsu_devs);
 285
 286 static uint8_t rsu_wme_ac_xfer_map[4] = {
 287         [WME_AC_BE] = RSU_BULK_TX_BE_BK,
 288         [WME_AC_BK] = RSU_BULK_TX_BE_BK,
 289         [WME_AC_VI] = RSU_BULK_TX_VI_VO,
 290         [WME_AC_VO] = RSU_BULK_TX_VI_VO,
 291 };
 292
 293 /* XXX hard-coded */
 294 #define RSU_H2C_ENDPOINT        3
 295
 296 static const struct usb_config rsu_config[RSU_N_TRANSFER] = {
 297         [RSU_BULK_RX] = {
 298                 .type = UE_BULK,
 299                 .endpoint = UE_ADDR_ANY,
 300                 .direction = UE_DIR_IN,
 301                 .bufsize = RSU_RXBUFSZ,
 302                 .flags = {
 303                         .pipe_bof = 1,
 304                         .short_xfer_ok = 1
 305                 },
 306                 .callback = rsu_bulk_rx_callback
 307         },
 308         [RSU_BULK_TX_BE_BK] = {
 309                 .type = UE_BULK,
 310                 .endpoint = 0x06,
 311                 .direction = UE_DIR_OUT,
 312                 .bufsize = RSU_TXBUFSZ,
 313                 .flags = {
 314                         .ext_buffer = 1,
 315                         .pipe_bof = 1,
 316                         .force_short_xfer = 1
 317                 },
 318                 .callback = rsu_bulk_tx_callback_be_bk,
 319                 .timeout = RSU_TX_TIMEOUT
 320         },
 321         [RSU_BULK_TX_VI_VO] = {
 322                 .type = UE_BULK,
 323                 .endpoint = 0x04,
 324                 .direction = UE_DIR_OUT,
 325                 .bufsize = RSU_TXBUFSZ,
 326                 .flags = {
 327                         .ext_buffer = 1,
 328                         .pipe_bof = 1,
 329                         .force_short_xfer = 1
 330                 },
 331                 .callback = rsu_bulk_tx_callback_vi_vo,
 332                 .timeout = RSU_TX_TIMEOUT
 333         },
 334         [RSU_BULK_TX_H2C] = {
 335                 .type = UE_BULK,
 336                 .endpoint = 0x0d,
 337                 .direction = UE_DIR_OUT,
 338                 .bufsize = RSU_TXBUFSZ,
 339                 .flags = {
 340                         .ext_buffer = 1,
 341                         .pipe_bof = 1,
 342                         .short_xfer_ok = 1
 343                 },
 344                 .callback = rsu_bulk_tx_callback_h2c,
 345                 .timeout = RSU_TX_TIMEOUT
 346         },
 347 };
 348
 349 static int
 350 rsu_match(device_t self)
 351 {
 352         struct usb_attach_arg *uaa = device_get_ivars(self);
 353
 354         if (uaa->usb_mode != USB_MODE_HOST ||
 355             uaa->info.bIfaceIndex != 0 ||
 356             uaa->info.bConfigIndex != 0)
 357                 return (ENXIO);
 358
 359         return (usbd_lookup_id_by_uaa(rsu_devs, sizeof(rsu_devs), uaa));
 360 }
 361
 362 static int
 363 rsu_send_mgmt(struct ieee80211_node *ni, int type, int arg)
 364 {
 365
 366         return (ENOTSUP);
 367 }
 368
 369 static void
 370 rsu_update_chw(struct ieee80211com *ic)
 371 {
 372
 373 }
 374
 375 /*
 376  * notification from net80211 that it'd like to do A-MPDU on the given TID.
 377  *
 378  * Note: this actually hangs traffic at the present moment, so don't use it.
 379  * The firmware debug does indiciate it's sending and establishing a TX AMPDU
 380  * session, but then no traffic flows.
 381  */
 382 static int
 383 rsu_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
 384 {
 385 #if 0
 386         struct rsu_softc *sc = ni->ni_ic->ic_softc;
 387         struct r92s_add_ba_req req;
 388
 389         /* Don't enable if it's requested or running */
 390         if (IEEE80211_AMPDU_REQUESTED(tap))
 391                 return (0);
 392         if (IEEE80211_AMPDU_RUNNING(tap))
 393                 return (0);
 394
 395         /* We've decided to send addba; so send it */
 396         req.tid = htole32(tap->txa_tid);
 397
 398         /* Attempt net80211 state */
 399         if (ieee80211_ampdu_tx_request_ext(ni, tap->txa_tid) != 1)
 400                 return (0);
 401
 402         /* Send the firmware command */
 403         RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: establishing AMPDU TX for TID %d\n",
 404             __func__,
 405             tap->txa_tid);
 406
 407         RSU_LOCK(sc);
 408         if (rsu_fw_cmd(sc, R92S_CMD_ADDBA_REQ, &req, sizeof(req)) != 1) {
 409                 RSU_UNLOCK(sc);
 410                 /* Mark failure */
 411                 (void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 0);
 412                 return (0);
 413         }
 414         RSU_UNLOCK(sc);
 415
 416         /* Mark success; we don't get any further notifications */
 417         (void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 1);
 418 #endif
 419         /* Return 0, we're driving this ourselves */
 420         return (0);
 421 }
 422
 423 static int
 424 rsu_wme_update(struct ieee80211com *ic)
 425 {
 426
 427         /* Firmware handles this; not our problem */
 428         return (0);
 429 }
 430
 431 static int
 432 rsu_attach(device_t self)
 433 {
 434         struct usb_attach_arg *uaa = device_get_ivars(self);
 435         struct rsu_softc *sc = device_get_softc(self);
 436         struct ieee80211com *ic = &sc->sc_ic;
 437         int error;
 438         uint8_t iface_index;
 439         struct usb_interface *iface;
 440         const char *rft;
 441
 442         device_set_usb_desc(self);
 443         sc->sc_udev = uaa->device;
 444         sc->sc_dev = self;
 445         sc->sc_rx_checksum_enable = 1;
 446         if (rsu_enable_11n)
 447                 sc->sc_ht = !! (USB_GET_DRIVER_INFO(uaa) & RSU_HT_SUPPORTED);
 448
 449         /* Get number of endpoints */
 450         iface = usbd_get_iface(sc->sc_udev, 0);
 451         sc->sc_nendpoints = iface->idesc->bNumEndpoints;
 452
 453         /* Endpoints are hard-coded for now, so enforce 4-endpoint only */
 454         if (sc->sc_nendpoints != 4) {
 455                 device_printf(sc->sc_dev,
 456                     "the driver currently only supports 4-endpoint devices\n");
 457                 return (ENXIO);
 458         }
 459
 460         mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
 461             MTX_DEF);
 462         RSU_DELKEY_BMAP_LOCK_INIT(sc);
 463         TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_task, 0,
 464             rsu_calib_task, sc);
 465         TASK_INIT(&sc->del_key_task, 0, rsu_delete_key_pair_cb, sc);
 466         TASK_INIT(&sc->tx_task, 0, rsu_tx_task, sc);
 467         mbufq_init(&sc->sc_snd, ifqmaxlen);
 468
 469         /* Allocate Tx/Rx buffers. */
 470         error = rsu_alloc_rx_list(sc);
 471         if (error != 0) {
 472                 device_printf(sc->sc_dev, "could not allocate Rx buffers\n");
 473                 goto fail_usb;
 474         }
 475
 476         error = rsu_alloc_tx_list(sc);
 477         if (error != 0) {
 478                 device_printf(sc->sc_dev, "could not allocate Tx buffers\n");
 479                 rsu_free_rx_list(sc);
 480                 goto fail_usb;
 481         }
 482
 483         iface_index = 0;
 484         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 485             rsu_config, RSU_N_TRANSFER, sc, &sc->sc_mtx);
 486         if (error) {
 487                 device_printf(sc->sc_dev,
 488                     "could not allocate USB transfers, err=%s\n",
 489                     usbd_errstr(error));
 490                 goto fail_usb;
 491         }
 492         RSU_LOCK(sc);
 493         /* Read chip revision. */
 494         sc->cut = MS(rsu_read_4(sc, R92S_PMC_FSM), R92S_PMC_FSM_CUT);
 495         if (sc->cut != 3)
 496                 sc->cut = (sc->cut >> 1) + 1;
 497         error = rsu_read_rom(sc);
 498         RSU_UNLOCK(sc);
 499         if (error != 0) {
 500                 device_printf(self, "could not read ROM\n");
 501                 goto fail_rom;
 502         }
 503
 504         /* Figure out TX/RX streams */
 505         switch (sc->rom[84]) {
 506         case 0x0:
 507                 sc->sc_rftype = RTL8712_RFCONFIG_1T1R;
 508                 sc->sc_nrxstream = 1;
 509                 sc->sc_ntxstream = 1;
 510                 rft = "1T1R";
 511                 break;
 512         case 0x1:
 513                 sc->sc_rftype = RTL8712_RFCONFIG_1T2R;
 514                 sc->sc_nrxstream = 2;
 515                 sc->sc_ntxstream = 1;
 516                 rft = "1T2R";
 517                 break;
 518         case 0x2:
 519                 sc->sc_rftype = RTL8712_RFCONFIG_2T2R;
 520                 sc->sc_nrxstream = 2;
 521                 sc->sc_ntxstream = 2;
 522                 rft = "2T2R";
 523                 break;
 524         case 0x3:       /* "green" NIC */
 525                 sc->sc_rftype = RTL8712_RFCONFIG_1T2R;
 526                 sc->sc_nrxstream = 2;
 527                 sc->sc_ntxstream = 1;
 528                 rft = "1T2R ('green')";
 529                 break;
 530         default:
 531                 device_printf(sc->sc_dev,
 532                     "%s: unknown board type (rfconfig=0x%02x)\n",
 533                     __func__,
 534                     sc->rom[84]);
 535                 goto fail_rom;
 536         }
 537
 538         IEEE80211_ADDR_COPY(ic->ic_macaddr, &sc->rom[0x12]);
 539         device_printf(self, "MAC/BB RTL8712 cut %d %s\n", sc->cut, rft);
 540
 541         ic->ic_softc = sc;
 542         ic->ic_name = device_get_nameunit(self);
 543         ic->ic_phytype = IEEE80211_T_OFDM;      /* Not only, but not used. */
 544         ic->ic_opmode = IEEE80211_M_STA;        /* Default to BSS mode. */
 545
 546         /* Set device capabilities. */
 547         ic->ic_caps =
 548             IEEE80211_C_STA |           /* station mode */
 549             IEEE80211_C_MONITOR |       /* monitor mode supported */
 550 #if 0
 551             IEEE80211_C_BGSCAN |        /* Background scan. */
 552 #endif
 553             IEEE80211_C_SHPREAMBLE |    /* Short preamble supported. */
 554             IEEE80211_C_WME |           /* WME/QoS */
 555             IEEE80211_C_SHSLOT |        /* Short slot time supported. */
 556             IEEE80211_C_WPA;            /* WPA/RSN. */
 557
 558         ic->ic_cryptocaps =
 559             IEEE80211_CRYPTO_WEP |
 560             IEEE80211_CRYPTO_TKIP |
 561             IEEE80211_CRYPTO_AES_CCM;
 562
 563         /* Check if HT support is present. */
 564         if (sc->sc_ht) {
 565                 device_printf(sc->sc_dev, "%s: enabling 11n\n", __func__);
 566
 567                 /* Enable basic HT */
 568                 ic->ic_htcaps = IEEE80211_HTC_HT |
 569 #if 0
 570                     IEEE80211_HTC_AMPDU |
 571 #endif
 572                     IEEE80211_HTC_AMSDU |
 573                     IEEE80211_HTCAP_MAXAMSDU_3839 |
 574                     IEEE80211_HTCAP_SMPS_OFF;
 575                 ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
 576
 577                 /* set number of spatial streams */
 578                 ic->ic_txstream = sc->sc_ntxstream;
 579                 ic->ic_rxstream = sc->sc_nrxstream;
 580         }
 581         ic->ic_flags_ext |= IEEE80211_FEXT_SCAN_OFFLOAD;
 582
 583         rsu_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
 584             ic->ic_channels);
 585
 586         ieee80211_ifattach(ic);
 587         ic->ic_raw_xmit = rsu_raw_xmit;
 588         ic->ic_scan_start = rsu_scan_start;
 589         ic->ic_scan_end = rsu_scan_end;
 590         ic->ic_getradiocaps = rsu_getradiocaps;
 591         ic->ic_set_channel = rsu_set_channel;
 592         ic->ic_scan_curchan = rsu_scan_curchan;
 593         ic->ic_scan_mindwell = rsu_scan_mindwell;
 594         ic->ic_vap_create = rsu_vap_create;
 595         ic->ic_vap_delete = rsu_vap_delete;
 596         ic->ic_update_promisc = rsu_update_promisc;
 597         ic->ic_update_mcast = rsu_update_mcast;
 598         ic->ic_ioctl = rsu_ioctl_net;
 599         ic->ic_parent = rsu_parent;
 600         ic->ic_transmit = rsu_transmit;
 601         ic->ic_send_mgmt = rsu_send_mgmt;
 602         ic->ic_update_chw = rsu_update_chw;
 603         ic->ic_ampdu_enable = rsu_ampdu_enable;
 604         ic->ic_wme.wme_update = rsu_wme_update;
 605
 606         ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
 607             sizeof(sc->sc_txtap), RSU_TX_RADIOTAP_PRESENT,
 608             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 609             RSU_RX_RADIOTAP_PRESENT);
 610
 611         if (bootverbose)
 612                 ieee80211_announce(ic);
 613
 614         return (0);
 615
 616 fail_rom:
 617         usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
 618 fail_usb:
 619         mtx_destroy(&sc->sc_mtx);
 620         return (ENXIO);
 621 }
 622
 623 static int
 624 rsu_detach(device_t self)
 625 {
 626         struct rsu_softc *sc = device_get_softc(self);
 627         struct ieee80211com *ic = &sc->sc_ic;
 628
 629         rsu_stop(sc);
 630
 631         usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
 632
 633         /*
 634          * Free buffers /before/ we detach from net80211, else node
 635          * references to destroyed vaps will lead to a panic.
 636          */
 637         /* Free Tx/Rx buffers. */
 638         RSU_LOCK(sc);
 639         rsu_free_tx_list(sc);
 640         rsu_free_rx_list(sc);
 641         RSU_UNLOCK(sc);
 642
 643         /* Frames are freed; detach from net80211 */
 644         ieee80211_ifdetach(ic);
 645
 646         taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
 647         taskqueue_drain(taskqueue_thread, &sc->del_key_task);
 648         taskqueue_drain(taskqueue_thread, &sc->tx_task);
 649
 650         RSU_DELKEY_BMAP_LOCK_DESTROY(sc);
 651         mtx_destroy(&sc->sc_mtx);
 652
 653         return (0);
 654 }
 655
 656 static usb_error_t
 657 rsu_do_request(struct rsu_softc *sc, struct usb_device_request *req,
 658     void *data)
 659 {
 660         usb_error_t err;
 661         int ntries = 10;
 662
 663         RSU_ASSERT_LOCKED(sc);
 664
 665         while (ntries--) {
 666                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
 667                     req, data, 0, NULL, 250 /* ms */);
 668                 if (err == 0 || err == USB_ERR_NOT_CONFIGURED)
 669                         break;
 670                 RSU_DPRINTF(sc, RSU_DEBUG_USB,
 671                     "Control request failed, %s (retries left: %d)\n",
 672                     usbd_errstr(err), ntries);
 673                 rsu_ms_delay(sc, 10);
 674         }
 675
 676         return (err);
 677 }
 678
 679 static struct ieee80211vap *
 680 rsu_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 681     enum ieee80211_opmode opmode, int flags,
 682     const uint8_t bssid[IEEE80211_ADDR_LEN],
 683     const uint8_t mac[IEEE80211_ADDR_LEN])
 684 {
 685         struct rsu_softc *sc = ic->ic_softc;
 686         struct rsu_vap *uvp;
 687         struct ieee80211vap *vap;
 688         struct ifnet *ifp;
 689
 690         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 691                 return (NULL);
 692
 693         uvp =  malloc(sizeof(struct rsu_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 694         vap = &uvp->vap;
 695
 696         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
 697             flags, bssid) != 0) {
 698                 /* out of memory */
 699                 free(uvp, M_80211_VAP);
 700                 return (NULL);
 701         }
 702
 703         ifp = vap->iv_ifp;
 704         ifp->if_capabilities = IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
 705         RSU_LOCK(sc);
 706         if (sc->sc_rx_checksum_enable)
 707                 ifp->if_capenable |= IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
 708         RSU_UNLOCK(sc);
 709
 710         /* override state transition machine */
 711         uvp->newstate = vap->iv_newstate;
 712         if (opmode == IEEE80211_M_MONITOR)
 713                 vap->iv_newstate = rsu_monitor_newstate;
 714         else
 715                 vap->iv_newstate = rsu_newstate;
 716         vap->iv_key_alloc = rsu_key_alloc;
 717         vap->iv_key_set = rsu_key_set;
 718         vap->iv_key_delete = rsu_key_delete;
 719
 720         /* Limits from the r92su driver */
 721         vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
 722         vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
 723
 724         /* complete setup */
 725         ieee80211_vap_attach(vap, ieee80211_media_change,
 726             ieee80211_media_status, mac);
 727         ic->ic_opmode = opmode;
 728
 729         return (vap);
 730 }
 731
 732 static void
 733 rsu_vap_delete(struct ieee80211vap *vap)
 734 {
 735         struct rsu_vap *uvp = RSU_VAP(vap);
 736
 737         ieee80211_vap_detach(vap);
 738         free(uvp, M_80211_VAP);
 739 }
 740
 741 static void
 742 rsu_scan_start(struct ieee80211com *ic)
 743 {
 744         struct rsu_softc *sc = ic->ic_softc;
 745         struct ieee80211_scan_state *ss = ic->ic_scan;
 746         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 747         int error;
 748
 749         /* Scanning is done by the firmware. */
 750         RSU_LOCK(sc);
 751         sc->sc_active_scan = !!(ss->ss_flags & IEEE80211_SCAN_ACTIVE);
 752         /* XXX TODO: force awake if in network-sleep? */
 753         error = rsu_site_survey(sc, ss->ss_nssid > 0 ? &ss->ss_ssid[0] : NULL);
 754         RSU_UNLOCK(sc);
 755         if (error != 0) {
 756                 device_printf(sc->sc_dev,
 757                     "could not send site survey command\n");
 758                 ieee80211_cancel_scan(vap);
 759         }
 760 }
 761
 762 static void
 763 rsu_scan_end(struct ieee80211com *ic)
 764 {
 765         /* Nothing to do here. */
 766 }
 767
 768 static void
 769 rsu_getradiocaps(struct ieee80211com *ic,
 770     int maxchans, int *nchans, struct ieee80211_channel chans[])
 771 {
 772         struct rsu_softc *sc = ic->ic_softc;
 773         uint8_t bands[IEEE80211_MODE_BYTES];
 774
 775         /* Set supported .11b and .11g rates. */
 776         memset(bands, 0, sizeof(bands));
 777         setbit(bands, IEEE80211_MODE_11B);
 778         setbit(bands, IEEE80211_MODE_11G);
 779         if (sc->sc_ht)
 780                 setbit(bands, IEEE80211_MODE_11NG);
 781         ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
 782             bands, (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) ?
 783                 NET80211_CBW_FLAG_HT40 : 0);
 784 }
 785
 786 static void
 787 rsu_set_channel(struct ieee80211com *ic)
 788 {
 789         struct rsu_softc *sc = ic->ic_softc;
 790
 791         /*
 792          * Only need to set the channel in Monitor mode. AP scanning and auth
 793          * are already taken care of by their respective firmware commands.
 794          */
 795         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
 796                 struct r92s_set_channel cmd;
 797                 int error;
 798
 799                 cmd.channel = IEEE80211_CHAN2IEEE(ic->ic_curchan);
 800
 801                 RSU_LOCK(sc);
 802                 error = rsu_fw_cmd(sc, R92S_CMD_SET_CHANNEL, &cmd,
 803                     sizeof(cmd));
 804                 if (error != 0) {
 805                         device_printf(sc->sc_dev,
 806                             "%s: error %d setting channel\n", __func__,
 807                             error);
 808                 }
 809                 RSU_UNLOCK(sc);
 810         }
 811 }
 812
 813 static void
 814 rsu_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
 815 {
 816         /* Scan is done in rsu_scan_start(). */
 817 }
 818
 819 /**
 820  * Called by the net80211 framework to indicate
 821  * the minimum dwell time has been met, terminate the scan.
 822  * We don't actually terminate the scan as the firmware will notify
 823  * us when it's finished and we have no way to interrupt it.
 824  */
 825 static void
 826 rsu_scan_mindwell(struct ieee80211_scan_state *ss)
 827 {
 828         /* NB: don't try to abort scan; wait for firmware to finish */
 829 }
 830
 831 static void
 832 rsu_update_promisc(struct ieee80211com *ic)
 833 {
 834         struct rsu_softc *sc = ic->ic_softc;
 835
 836         RSU_LOCK(sc);
 837         if (sc->sc_running)
 838                 rsu_rxfilter_refresh(sc);
 839         RSU_UNLOCK(sc);
 840 }
 841
 842 /*
 843  * The same as rtwn_get_multi_pos() / rtwn_set_multi().
 844  */
 845 static uint8_t
 846 rsu_get_multi_pos(const uint8_t maddr[])
 847 {
 848         uint64_t mask = 0x00004d101df481b4;
 849         uint8_t pos = 0x27;     /* initial value */
 850         int i, j;
 851
 852         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
 853                 for (j = (i == 0) ? 1 : 0; j < 8; j++)
 854                         if ((maddr[i] >> j) & 1)
 855                                 pos ^= (mask >> (i * 8 + j - 1));
 856
 857         pos &= 0x3f;
 858
 859         return (pos);
 860 }
 861
 862 static u_int
 863 rsu_hash_maddr(void *arg, struct sockaddr_dl *sdl, u_int cnt)
 864 {
 865         uint32_t *mfilt = arg;
 866         uint8_t pos;
 867
 868         pos = rsu_get_multi_pos(LLADDR(sdl));
 869         mfilt[pos / 32] |= (1 << (pos % 32));
 870
 871         return (1);
 872 }
 873
 874 static void
 875 rsu_set_multi(struct rsu_softc *sc)
 876 {
 877         struct ieee80211com *ic = &sc->sc_ic;
 878         uint32_t mfilt[2];
 879
 880         RSU_ASSERT_LOCKED(sc);
 881
 882         /* general structure was copied from ath(4). */
 883         if (ic->ic_allmulti == 0) {
 884                 struct ieee80211vap *vap;
 885
 886                 /*
 887                  * Merge multicast addresses to form the hardware filter.
 888                  */
 889                 mfilt[0] = mfilt[1] = 0;
 890                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
 891                         if_foreach_llmaddr(vap->iv_ifp, rsu_hash_maddr, &mfilt);
 892         } else
 893                 mfilt[0] = mfilt[1] = ~0;
 894
 895         rsu_write_4(sc, R92S_MAR + 0, mfilt[0]);
 896         rsu_write_4(sc, R92S_MAR + 4, mfilt[1]);
 897
 898         RSU_DPRINTF(sc, RSU_DEBUG_STATE, "%s: MC filter %08x:%08x\n",
 899             __func__, mfilt[0], mfilt[1]);
 900 }
 901
 902 static void
 903 rsu_update_mcast(struct ieee80211com *ic)
 904 {
 905         struct rsu_softc *sc = ic->ic_softc;
 906
 907         RSU_LOCK(sc);
 908         if (sc->sc_running)
 909                 rsu_set_multi(sc);
 910         RSU_UNLOCK(sc);
 911 }
 912
 913 static int
 914 rsu_alloc_list(struct rsu_softc *sc, struct rsu_data data[],
 915     int ndata, int maxsz)
 916 {
 917         int i, error;
 918
 919         for (i = 0; i < ndata; i++) {
 920                 struct rsu_data *dp = &data[i];
 921                 dp->sc = sc;
 922                 dp->m = NULL;
 923                 dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
 924                 if (dp->buf == NULL) {
 925                         device_printf(sc->sc_dev,
 926                             "could not allocate buffer\n");
 927                         error = ENOMEM;
 928                         goto fail;
 929                 }
 930                 dp->ni = NULL;
 931         }
 932
 933         return (0);
 934 fail:
 935         rsu_free_list(sc, data, ndata);
 936         return (error);
 937 }
 938
 939 static int
 940 rsu_alloc_rx_list(struct rsu_softc *sc)
 941 {
 942         int error, i;
 943
 944         error = rsu_alloc_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT,
 945             RSU_RXBUFSZ);
 946         if (error != 0)
 947                 return (error);
 948
 949         STAILQ_INIT(&sc->sc_rx_active);
 950         STAILQ_INIT(&sc->sc_rx_inactive);
 951
 952         for (i = 0; i < RSU_RX_LIST_COUNT; i++)
 953                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
 954
 955         return (0);
 956 }
 957
 958 static int
 959 rsu_alloc_tx_list(struct rsu_softc *sc)
 960 {
 961         int error, i;
 962
 963         error = rsu_alloc_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT,
 964             RSU_TXBUFSZ);
 965         if (error != 0)
 966                 return (error);
 967
 968         STAILQ_INIT(&sc->sc_tx_inactive);
 969
 970         for (i = 0; i != RSU_N_TRANSFER; i++) {
 971                 STAILQ_INIT(&sc->sc_tx_active[i]);
 972                 STAILQ_INIT(&sc->sc_tx_pending[i]);
 973         }
 974
 975         for (i = 0; i < RSU_TX_LIST_COUNT; i++) {
 976                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
 977         }
 978
 979         return (0);
 980 }
 981
 982 static void
 983 rsu_free_tx_list(struct rsu_softc *sc)
 984 {
 985         int i;
 986
 987         /* prevent further allocations from TX list(s) */
 988         STAILQ_INIT(&sc->sc_tx_inactive);
 989
 990         for (i = 0; i != RSU_N_TRANSFER; i++) {
 991                 STAILQ_INIT(&sc->sc_tx_active[i]);
 992                 STAILQ_INIT(&sc->sc_tx_pending[i]);
 993         }
 994
 995         rsu_free_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT);
 996 }
 997
 998 static void
 999 rsu_free_rx_list(struct rsu_softc *sc)
1000 {
1001         /* prevent further allocations from RX list(s) */
1002         STAILQ_INIT(&sc->sc_rx_inactive);
1003         STAILQ_INIT(&sc->sc_rx_active);
1004
1005         rsu_free_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT);
1006 }
1007
1008 static void
1009 rsu_free_list(struct rsu_softc *sc, struct rsu_data data[], int ndata)
1010 {
1011         int i;
1012
1013         for (i = 0; i < ndata; i++) {
1014                 struct rsu_data *dp = &data[i];
1015
1016                 if (dp->buf != NULL) {
1017                         free(dp->buf, M_USBDEV);
1018                         dp->buf = NULL;
1019                 }
1020                 if (dp->ni != NULL) {
1021                         ieee80211_free_node(dp->ni);
1022                         dp->ni = NULL;
1023                 }
1024         }
1025 }
1026
1027 static struct rsu_data *
1028 _rsu_getbuf(struct rsu_softc *sc)
1029 {
1030         struct rsu_data *bf;
1031
1032         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1033         if (bf != NULL)
1034                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1035         else
1036                 bf = NULL;
1037         return (bf);
1038 }
1039
1040 static struct rsu_data *
1041 rsu_getbuf(struct rsu_softc *sc)
1042 {
1043         struct rsu_data *bf;
1044
1045         RSU_ASSERT_LOCKED(sc);
1046
1047         bf = _rsu_getbuf(sc);
1048         if (bf == NULL) {
1049                 RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: no buffers\n", __func__);
1050         }
1051         return (bf);
1052 }
1053
1054 static void
1055 rsu_freebuf(struct rsu_softc *sc, struct rsu_data *bf)
1056 {
1057
1058         RSU_ASSERT_LOCKED(sc);
1059         STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
1060 }
1061
1062 static int
1063 rsu_write_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
1064     int len)
1065 {
1066         usb_device_request_t req;
1067
1068         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1069         req.bRequest = R92S_REQ_REGS;
1070         USETW(req.wValue, addr);
1071         USETW(req.wIndex, 0);
1072         USETW(req.wLength, len);
1073
1074         return (rsu_do_request(sc, &req, buf));
1075 }
1076
1077 static void
1078 rsu_write_1(struct rsu_softc *sc, uint16_t addr, uint8_t val)
1079 {
1080         rsu_write_region_1(sc, addr, &val, 1);
1081 }
1082
1083 static void
1084 rsu_write_2(struct rsu_softc *sc, uint16_t addr, uint16_t val)
1085 {
1086         val = htole16(val);
1087         rsu_write_region_1(sc, addr, (uint8_t *)&val, 2);
1088 }
1089
1090 static void
1091 rsu_write_4(struct rsu_softc *sc, uint16_t addr, uint32_t val)
1092 {
1093         val = htole32(val);
1094         rsu_write_region_1(sc, addr, (uint8_t *)&val, 4);
1095 }
1096
1097 static int
1098 rsu_read_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
1099     int len)
1100 {
1101         usb_device_request_t req;
1102
1103         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1104         req.bRequest = R92S_REQ_REGS;
1105         USETW(req.wValue, addr);
1106         USETW(req.wIndex, 0);
1107         USETW(req.wLength, len);
1108
1109         return (rsu_do_request(sc, &req, buf));
1110 }
1111
1112 static uint8_t
1113 rsu_read_1(struct rsu_softc *sc, uint16_t addr)
1114 {
1115         uint8_t val;
1116
1117         if (rsu_read_region_1(sc, addr, &val, 1) != 0)
1118                 return (0xff);
1119         return (val);
1120 }
1121
1122 static uint16_t
1123 rsu_read_2(struct rsu_softc *sc, uint16_t addr)
1124 {
1125         uint16_t val;
1126
1127         if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1128                 return (0xffff);
1129         return (le16toh(val));
1130 }
1131
1132 static uint32_t
1133 rsu_read_4(struct rsu_softc *sc, uint16_t addr)
1134 {
1135         uint32_t val;
1136
1137         if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1138                 return (0xffffffff);
1139         return (le32toh(val));
1140 }
1141
1142 static int
1143 rsu_fw_iocmd(struct rsu_softc *sc, uint32_t iocmd)
1144 {
1145         int ntries;
1146
1147         rsu_write_4(sc, R92S_IOCMD_CTRL, iocmd);
1148         rsu_ms_delay(sc, 1);
1149         for (ntries = 0; ntries < 50; ntries++) {
1150                 if (rsu_read_4(sc, R92S_IOCMD_CTRL) == 0)
1151                         return (0);
1152                 rsu_ms_delay(sc, 1);
1153         }
1154         return (ETIMEDOUT);
1155 }
1156
1157 static uint8_t
1158 rsu_efuse_read_1(struct rsu_softc *sc, uint16_t addr)
1159 {
1160         uint32_t reg;
1161         int ntries;
1162
1163         reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
1164         reg = RW(reg, R92S_EFUSE_CTRL_ADDR, addr);
1165         reg &= ~R92S_EFUSE_CTRL_VALID;
1166         rsu_write_4(sc, R92S_EFUSE_CTRL, reg);
1167         /* Wait for read operation to complete. */
1168         for (ntries = 0; ntries < 100; ntries++) {
1169                 reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
1170                 if (reg & R92S_EFUSE_CTRL_VALID)
1171                         return (MS(reg, R92S_EFUSE_CTRL_DATA));
1172                 rsu_ms_delay(sc, 1);
1173         }
1174         device_printf(sc->sc_dev,
1175             "could not read efuse byte at address 0x%x\n", addr);
1176         return (0xff);
1177 }
1178
1179 static int
1180 rsu_read_rom(struct rsu_softc *sc)
1181 {
1182         uint8_t *rom = sc->rom;
1183         uint16_t addr = 0;
1184         uint32_t reg;
1185         uint8_t off, msk;
1186         int i;
1187
1188         /* Make sure that ROM type is eFuse and that autoload succeeded. */
1189         reg = rsu_read_1(sc, R92S_EE_9346CR);
1190         if ((reg & (R92S_9356SEL | R92S_EEPROM_EN)) != R92S_EEPROM_EN)
1191                 return (EIO);
1192
1193         /* Turn on 2.5V to prevent eFuse leakage. */
1194         reg = rsu_read_1(sc, R92S_EFUSE_TEST + 3);
1195         rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg | 0x80);
1196         rsu_ms_delay(sc, 1);
1197         rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg & ~0x80);
1198
1199         /* Read full ROM image. */
1200         memset(&sc->rom, 0xff, sizeof(sc->rom));
1201         while (addr < 512) {
1202                 reg = rsu_efuse_read_1(sc, addr);
1203                 if (reg == 0xff)
1204                         break;
1205                 addr++;
1206                 off = reg >> 4;
1207                 msk = reg & 0xf;
1208                 for (i = 0; i < 4; i++) {
1209                         if (msk & (1 << i))
1210                                 continue;
1211                         rom[off * 8 + i * 2 + 0] =
1212                             rsu_efuse_read_1(sc, addr);
1213                         addr++;
1214                         rom[off * 8 + i * 2 + 1] =
1215                             rsu_efuse_read_1(sc, addr);
1216                         addr++;
1217                 }
1218         }
1219 #ifdef USB_DEBUG
1220         if (rsu_debug & RSU_DEBUG_RESET) {
1221                 /* Dump ROM content. */
1222                 printf("\n");
1223                 for (i = 0; i < sizeof(sc->rom); i++)
1224                         printf("%02x:", rom[i]);
1225                 printf("\n");
1226         }
1227 #endif
1228         return (0);
1229 }
1230
1231 static int
1232 rsu_fw_cmd(struct rsu_softc *sc, uint8_t code, void *buf, int len)
1233 {
1234         const uint8_t which = RSU_H2C_ENDPOINT;
1235         struct rsu_data *data;
1236         struct r92s_tx_desc *txd;
1237         struct r92s_fw_cmd_hdr *cmd;
1238         int cmdsz;
1239         int xferlen;
1240
1241         RSU_ASSERT_LOCKED(sc);
1242
1243         data = rsu_getbuf(sc);
1244         if (data == NULL)
1245                 return (ENOMEM);
1246
1247         /* Blank the entire payload, just to be safe */
1248         memset(data->buf, '\0', RSU_TXBUFSZ);
1249
1250         /* Round-up command length to a multiple of 8 bytes. */
1251         /* XXX TODO: is this required? */
1252         cmdsz = (len + 7) & ~7;
1253
1254         xferlen = sizeof(*txd) + sizeof(*cmd) + cmdsz;
1255         KASSERT(xferlen <= RSU_TXBUFSZ, ("%s: invalid length", __func__));
1256         memset(data->buf, 0, xferlen);
1257
1258         /* Setup Tx descriptor. */
1259         txd = (struct r92s_tx_desc *)data->buf;
1260         txd->txdw0 = htole32(
1261             SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
1262             SM(R92S_TXDW0_PKTLEN, sizeof(*cmd) + cmdsz) |
1263             R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
1264         txd->txdw1 = htole32(SM(R92S_TXDW1_QSEL, R92S_TXDW1_QSEL_H2C));
1265
1266         /* Setup command header. */
1267         cmd = (struct r92s_fw_cmd_hdr *)&txd[1];
1268         cmd->len = htole16(cmdsz);
1269         cmd->code = code;
1270         cmd->seq = sc->cmd_seq;
1271         sc->cmd_seq = (sc->cmd_seq + 1) & 0x7f;
1272
1273         /* Copy command payload. */
1274         memcpy(&cmd[1], buf, len);
1275
1276         RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FWCMD,
1277             "%s: Tx cmd code=0x%x len=0x%x\n",
1278             __func__, code, cmdsz);
1279         data->buflen = xferlen;
1280         STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
1281         usbd_transfer_start(sc->sc_xfer[which]);
1282
1283         return (0);
1284 }
1285
1286 /* ARGSUSED */
1287 static void
1288 rsu_calib_task(void *arg, int pending __unused)
1289 {
1290         struct rsu_softc *sc = arg;
1291 #ifdef notyet
1292         uint32_t reg;
1293 #endif
1294
1295         RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: running calibration task\n",
1296             __func__);
1297
1298         RSU_LOCK(sc);
1299 #ifdef notyet
1300         /* Read WPS PBC status. */
1301         rsu_write_1(sc, R92S_MAC_PINMUX_CTRL,
1302             R92S_GPIOMUX_EN | SM(R92S_GPIOSEL_GPIO, R92S_GPIOSEL_GPIO_JTAG));
1303         rsu_write_1(sc, R92S_GPIO_IO_SEL,
1304             rsu_read_1(sc, R92S_GPIO_IO_SEL) & ~R92S_GPIO_WPS);
1305         reg = rsu_read_1(sc, R92S_GPIO_CTRL);
1306         if (reg != 0xff && (reg & R92S_GPIO_WPS))
1307                 RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "WPS PBC is pushed\n");
1308 #endif
1309         /* Read current signal level. */
1310         if (rsu_fw_iocmd(sc, 0xf4000001) == 0) {
1311                 sc->sc_currssi = rsu_read_4(sc, R92S_IOCMD_DATA);
1312                 RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: RSSI=%d (%d)\n",
1313                     __func__, sc->sc_currssi,
1314                     rsu_hwrssi_to_rssi(sc, sc->sc_currssi));
1315         }
1316         if (sc->sc_calibrating)
1317                 taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task, hz);
1318         RSU_UNLOCK(sc);
1319 }
1320
1321 static void
1322 rsu_tx_task(void *arg, int pending __unused)
1323 {
1324         struct rsu_softc *sc = arg;
1325
1326         RSU_LOCK(sc);
1327         _rsu_start(sc);
1328         RSU_UNLOCK(sc);
1329 }
1330
1331 #define RSU_PWR_UNKNOWN         0x0
1332 #define RSU_PWR_ACTIVE          0x1
1333 #define RSU_PWR_OFF             0x2
1334 #define RSU_PWR_SLEEP           0x3
1335
1336 /*
1337  * Set the current power state.
1338  *
1339  * The rtlwifi code doesn't do this so aggressively; it
1340  * waits for an idle period after association with
1341  * no traffic before doing this.
1342  *
1343  * For now - it's on in all states except RUN, and
1344  * in RUN it'll transition to allow sleep.
1345  */
1346
1347 struct r92s_pwr_cmd {
1348         uint8_t mode;
1349         uint8_t smart_ps;
1350         uint8_t bcn_pass_time;
1351 };
1352
1353 static int
1354 rsu_set_fw_power_state(struct rsu_softc *sc, int state)
1355 {
1356         struct r92s_set_pwr_mode cmd;
1357         //struct r92s_pwr_cmd cmd;
1358         int error;
1359
1360         RSU_ASSERT_LOCKED(sc);
1361
1362         /* only change state if required */
1363         if (sc->sc_curpwrstate == state)
1364                 return (0);
1365
1366         memset(&cmd, 0, sizeof(cmd));
1367
1368         switch (state) {
1369         case RSU_PWR_ACTIVE:
1370                 /* Force the hardware awake */
1371                 rsu_write_1(sc, R92S_USB_HRPWM,
1372                     R92S_USB_HRPWM_PS_ST_ACTIVE | R92S_USB_HRPWM_PS_ALL_ON);
1373                 cmd.mode = R92S_PS_MODE_ACTIVE;
1374                 break;
1375         case RSU_PWR_SLEEP:
1376                 cmd.mode = R92S_PS_MODE_DTIM;   /* XXX configurable? */
1377                 cmd.smart_ps = 1; /* XXX 2 if doing p2p */
1378                 cmd.bcn_pass_time = 5; /* in 100mS usb.c, linux/rtlwifi */
1379                 break;
1380         case RSU_PWR_OFF:
1381                 cmd.mode = R92S_PS_MODE_RADIOOFF;
1382                 break;
1383         default:
1384                 device_printf(sc->sc_dev, "%s: unknown ps mode (%d)\n",
1385                     __func__,
1386                     state);
1387                 return (ENXIO);
1388         }
1389
1390         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1391             "%s: setting ps mode to %d (mode %d)\n",
1392             __func__, state, cmd.mode);
1393         error = rsu_fw_cmd(sc, R92S_CMD_SET_PWR_MODE, &cmd, sizeof(cmd));
1394         if (error == 0)
1395                 sc->sc_curpwrstate = state;
1396
1397         return (error);
1398 }
1399
1400 static void
1401 rsu_set_led(struct rsu_softc *sc, int on)
1402 {
1403         rsu_write_1(sc, R92S_LEDCFG,
1404             (rsu_read_1(sc, R92S_LEDCFG) & 0xf0) | (!on << 3));
1405 }
1406
1407 static int
1408 rsu_monitor_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate,
1409     int arg)
1410 {
1411         struct ieee80211com *ic = vap->iv_ic;
1412         struct rsu_softc *sc = ic->ic_softc;
1413         struct rsu_vap *uvp = RSU_VAP(vap);
1414
1415         if (vap->iv_state != nstate) {
1416                 IEEE80211_UNLOCK(ic);
1417                 RSU_LOCK(sc);
1418
1419                 switch (nstate) {
1420                 case IEEE80211_S_INIT:
1421                         sc->sc_vap_is_running = 0;
1422                         rsu_set_led(sc, 0);
1423                         break;
1424                 case IEEE80211_S_RUN:
1425                         sc->sc_vap_is_running = 1;
1426                         rsu_set_led(sc, 1);
1427                         break;
1428                 default:
1429                         /* NOTREACHED */
1430                         break;
1431                 }
1432                 rsu_rxfilter_refresh(sc);
1433
1434                 RSU_UNLOCK(sc);
1435                 IEEE80211_LOCK(ic);
1436         }
1437
1438         return (uvp->newstate(vap, nstate, arg));
1439 }
1440
1441 static int
1442 rsu_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1443 {
1444         struct rsu_vap *uvp = RSU_VAP(vap);
1445         struct ieee80211com *ic = vap->iv_ic;
1446         struct rsu_softc *sc = ic->ic_softc;
1447         struct ieee80211_node *ni;
1448         struct ieee80211_rateset *rs;
1449         enum ieee80211_state ostate;
1450         int error, startcal = 0;
1451
1452         ostate = vap->iv_state;
1453         RSU_DPRINTF(sc, RSU_DEBUG_STATE, "%s: %s -> %s\n",
1454             __func__,
1455             ieee80211_state_name[ostate],
1456             ieee80211_state_name[nstate]);
1457
1458         IEEE80211_UNLOCK(ic);
1459         if (ostate == IEEE80211_S_RUN) {
1460                 RSU_LOCK(sc);
1461                 /* Stop calibration. */
1462                 sc->sc_calibrating = 0;
1463
1464                 /* Pause Tx for AC queues. */
1465                 rsu_write_1(sc, R92S_TXPAUSE, R92S_TXPAUSE_AC);
1466                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1467
1468                 RSU_UNLOCK(sc);
1469                 taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
1470                 taskqueue_drain(taskqueue_thread, &sc->tx_task);
1471                 RSU_LOCK(sc);
1472                 /* Disassociate from our current BSS. */
1473                 rsu_disconnect(sc);
1474                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(10));
1475
1476                 /* Refresh Rx filter (may be modified by firmware). */
1477                 sc->sc_vap_is_running = 0;
1478                 rsu_rxfilter_refresh(sc);
1479
1480                 /* Reinstall static keys. */
1481                 if (sc->sc_running)
1482                         rsu_reinit_static_keys(sc);
1483         } else
1484                 RSU_LOCK(sc);
1485         switch (nstate) {
1486         case IEEE80211_S_INIT:
1487                 (void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
1488                 break;
1489         case IEEE80211_S_AUTH:
1490                 ni = ieee80211_ref_node(vap->iv_bss);
1491                 (void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
1492                 error = rsu_join_bss(sc, ni);
1493                 ieee80211_free_node(ni);
1494                 if (error != 0) {
1495                         device_printf(sc->sc_dev,
1496                             "could not send join command\n");
1497                 }
1498                 break;
1499         case IEEE80211_S_RUN:
1500                 /* Flush all AC queues. */
1501                 rsu_write_1(sc, R92S_TXPAUSE, 0);
1502
1503                 ni = ieee80211_ref_node(vap->iv_bss);
1504                 rs = &ni->ni_rates;
1505                 /* Indicate highest supported rate. */
1506                 ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1507                 (void) rsu_set_fw_power_state(sc, RSU_PWR_SLEEP);
1508                 ieee80211_free_node(ni);
1509                 startcal = 1;
1510                 break;
1511         default:
1512                 break;
1513         }
1514         if (startcal != 0) {
1515                 sc->sc_calibrating = 1;
1516                 /* Start periodic calibration. */
1517                 taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task,
1518                     hz);
1519         }
1520         RSU_UNLOCK(sc);
1521         IEEE80211_LOCK(ic);
1522         return (uvp->newstate(vap, nstate, arg));
1523 }
1524
1525 static int
1526 rsu_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
1527     ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
1528 {
1529         struct rsu_softc *sc = vap->iv_ic->ic_softc;
1530         int is_checked = 0;
1531
1532         if (&vap->iv_nw_keys[0] <= k &&
1533             k < &vap->iv_nw_keys[IEEE80211_WEP_NKID]) {
1534                 *keyix = ieee80211_crypto_get_key_wepidx(vap, k);
1535         } else {
1536                 if (vap->iv_opmode != IEEE80211_M_STA) {
1537                         *keyix = 0;
1538                         /* TODO: obtain keyix from node id */
1539                         is_checked = 1;
1540                         k->wk_flags |= IEEE80211_KEY_SWCRYPT;
1541                 } else
1542                         *keyix = R92S_MACID_BSS;
1543         }
1544
1545         if (!is_checked) {
1546                 RSU_LOCK(sc);
1547                 if (isset(sc->keys_bmap, *keyix)) {
1548                         device_printf(sc->sc_dev,
1549                             "%s: key slot %d is already used!\n",
1550                             __func__, *keyix);
1551                         RSU_UNLOCK(sc);
1552                         return (0);
1553                 }
1554                 setbit(sc->keys_bmap, *keyix);
1555                 RSU_UNLOCK(sc);
1556         }
1557
1558         *rxkeyix = *keyix;
1559
1560         return (1);
1561 }
1562
1563 static int
1564 rsu_process_key(struct ieee80211vap *vap, const struct ieee80211_key *k,
1565     int set)
1566 {
1567         struct rsu_softc *sc = vap->iv_ic->ic_softc;
1568         int ret;
1569
1570         if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
1571                 /* Not for us. */
1572                 return (1);
1573         }
1574
1575         /* Handle group keys. */
1576         if (&vap->iv_nw_keys[0] <= k &&
1577             k < &vap->iv_nw_keys[IEEE80211_WEP_NKID]) {
1578                 KASSERT(k->wk_keyix < nitems(sc->group_keys),
1579                     ("keyix %u > %zu\n", k->wk_keyix, nitems(sc->group_keys)));
1580
1581                 RSU_LOCK(sc);
1582                 sc->group_keys[k->wk_keyix] = (set ? k : NULL);
1583                 if (!sc->sc_running) {
1584                         /* Static keys will be set during device startup. */
1585                         RSU_UNLOCK(sc);
1586                         return (1);
1587                 }
1588
1589                 if (set)
1590                         ret = rsu_set_key_group(sc, k);
1591                 else
1592                         ret = rsu_delete_key(sc, k->wk_keyix);
1593                 RSU_UNLOCK(sc);
1594
1595                 return (!ret);
1596         }
1597
1598         if (set) {
1599                 /* wait for pending key removal */
1600                 taskqueue_drain(taskqueue_thread, &sc->del_key_task);
1601
1602                 RSU_LOCK(sc);
1603                 ret = rsu_set_key_pair(sc, k);
1604                 RSU_UNLOCK(sc);
1605         } else {
1606                 RSU_DELKEY_BMAP_LOCK(sc);
1607                 setbit(sc->free_keys_bmap, k->wk_keyix);
1608                 RSU_DELKEY_BMAP_UNLOCK(sc);
1609
1610                 /* workaround ieee80211_node_delucastkey() locking */
1611                 taskqueue_enqueue(taskqueue_thread, &sc->del_key_task);
1612                 ret = 0;        /* fake success */
1613         }
1614
1615         return (!ret);
1616 }
1617
1618 static int
1619 rsu_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
1620 {
1621         return (rsu_process_key(vap, k, 1));
1622 }
1623
1624 static int
1625 rsu_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1626 {
1627         return (rsu_process_key(vap, k, 0));
1628 }
1629
1630 static int
1631 rsu_cam_read(struct rsu_softc *sc, uint8_t addr, uint32_t *val)
1632 {
1633         int ntries;
1634
1635         rsu_write_4(sc, R92S_CAMCMD,
1636             R92S_CAMCMD_POLLING | SM(R92S_CAMCMD_ADDR, addr));
1637         for (ntries = 0; ntries < 10; ntries++) {
1638                 if (!(rsu_read_4(sc, R92S_CAMCMD) & R92S_CAMCMD_POLLING))
1639                         break;
1640
1641                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(1));
1642         }
1643         if (ntries == 10) {
1644                 device_printf(sc->sc_dev,
1645                     "%s: cannot read CAM entry at address %02X\n",
1646                     __func__, addr);
1647                 return (ETIMEDOUT);
1648         }
1649
1650         *val = rsu_read_4(sc, R92S_CAMREAD);
1651
1652         return (0);
1653 }
1654
1655 static void
1656 rsu_cam_write(struct rsu_softc *sc, uint8_t addr, uint32_t data)
1657 {
1658
1659         rsu_write_4(sc, R92S_CAMWRITE, data);
1660         rsu_write_4(sc, R92S_CAMCMD,
1661             R92S_CAMCMD_POLLING | R92S_CAMCMD_WRITE |
1662             SM(R92S_CAMCMD_ADDR, addr));
1663 }
1664
1665 static int
1666 rsu_key_check(struct rsu_softc *sc, ieee80211_keyix keyix, int is_valid)
1667 {
1668         uint32_t val;
1669         int error, ntries;
1670
1671         for (ntries = 0; ntries < 20; ntries++) {
1672                 usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(1));
1673
1674                 error = rsu_cam_read(sc, R92S_CAM_CTL0(keyix), &val);
1675                 if (error != 0) {
1676                         device_printf(sc->sc_dev,
1677                             "%s: cannot check key status!\n", __func__);
1678                         return (error);
1679                 }
1680                 if (((val & R92S_CAM_VALID) == 0) ^ is_valid)
1681                         break;
1682         }
1683         if (ntries == 20) {
1684                 device_printf(sc->sc_dev,
1685                     "%s: key %d is %s marked as valid, rejecting request\n",
1686                     __func__, keyix, is_valid ? "not" : "still");
1687                 return (EIO);
1688         }
1689
1690         return (0);
1691 }
1692
1693 /*
1694  * Map net80211 cipher to RTL8712 security mode.
1695  */
1696 static uint8_t
1697 rsu_crypto_mode(struct rsu_softc *sc, u_int cipher, int keylen)
1698 {
1699         switch (cipher) {
1700         case IEEE80211_CIPHER_WEP:
1701                 return keylen < 8 ? R92S_KEY_ALGO_WEP40 : R92S_KEY_ALGO_WEP104;
1702         case IEEE80211_CIPHER_TKIP:
1703                 return R92S_KEY_ALGO_TKIP;
1704         case IEEE80211_CIPHER_AES_CCM:
1705                 return R92S_KEY_ALGO_AES;
1706         default:
1707                 device_printf(sc->sc_dev, "unknown cipher %d\n", cipher);
1708                 return R92S_KEY_ALGO_INVALID;
1709         }
1710 }
1711
1712 static int
1713 rsu_set_key_group(struct rsu_softc *sc, const struct ieee80211_key *k)
1714 {
1715         struct r92s_fw_cmd_set_key key;
1716         uint8_t algo;
1717         int error;
1718
1719         RSU_ASSERT_LOCKED(sc);
1720
1721         /* Map net80211 cipher to HW crypto algorithm. */
1722         algo = rsu_crypto_mode(sc, k->wk_cipher->ic_cipher, k->wk_keylen);
1723         if (algo == R92S_KEY_ALGO_INVALID)
1724                 return (EINVAL);
1725
1726         memset(&key, 0, sizeof(key));
1727         key.algo = algo;
1728         key.cam_id = k->wk_keyix;
1729         key.grpkey = (k->wk_flags & IEEE80211_KEY_GROUP) != 0;
1730         memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
1731
1732         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1733             "%s: keyix %u, group %u, algo %u/%u, flags %04X, len %u, "
1734             "macaddr %s\n", __func__, key.cam_id, key.grpkey,
1735             k->wk_cipher->ic_cipher, key.algo, k->wk_flags, k->wk_keylen,
1736             ether_sprintf(k->wk_macaddr));
1737
1738         error = rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1739         if (error != 0) {
1740                 device_printf(sc->sc_dev,
1741                     "%s: cannot send firmware command, error %d\n",
1742                     __func__, error);
1743                 return (error);
1744         }
1745
1746         return (rsu_key_check(sc, k->wk_keyix, 1));
1747 }
1748
1749 static int
1750 rsu_set_key_pair(struct rsu_softc *sc, const struct ieee80211_key *k)
1751 {
1752         struct r92s_fw_cmd_set_key_mac key;
1753         uint8_t algo;
1754         int error;
1755
1756         RSU_ASSERT_LOCKED(sc);
1757
1758         if (!sc->sc_running)
1759                 return (ESHUTDOWN);
1760
1761         /* Map net80211 cipher to HW crypto algorithm. */
1762         algo = rsu_crypto_mode(sc, k->wk_cipher->ic_cipher, k->wk_keylen);
1763         if (algo == R92S_KEY_ALGO_INVALID)
1764                 return (EINVAL);
1765
1766         memset(&key, 0, sizeof(key));
1767         key.algo = algo;
1768         memcpy(key.macaddr, k->wk_macaddr, sizeof(key.macaddr));
1769         memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
1770
1771         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1772             "%s: keyix %u, algo %u/%u, flags %04X, len %u, macaddr %s\n",
1773             __func__, k->wk_keyix, k->wk_cipher->ic_cipher, key.algo,
1774             k->wk_flags, k->wk_keylen, ether_sprintf(key.macaddr));
1775
1776         error = rsu_fw_cmd(sc, R92S_CMD_SET_STA_KEY, &key, sizeof(key));
1777         if (error != 0) {
1778                 device_printf(sc->sc_dev,
1779                     "%s: cannot send firmware command, error %d\n",
1780                     __func__, error);
1781                 return (error);
1782         }
1783
1784         return (rsu_key_check(sc, k->wk_keyix, 1));
1785 }
1786
1787 static int
1788 rsu_reinit_static_keys(struct rsu_softc *sc)
1789 {
1790         int i, error;
1791
1792         for (i = 0; i < nitems(sc->group_keys); i++) {
1793                 if (sc->group_keys[i] != NULL) {
1794                         error = rsu_set_key_group(sc, sc->group_keys[i]);
1795                         if (error != 0) {
1796                                 device_printf(sc->sc_dev,
1797                                     "%s: failed to set static key %d, "
1798                                     "error %d\n", __func__, i, error);
1799                                 return (error);
1800                         }
1801                 }
1802         }
1803
1804         return (0);
1805 }
1806
1807 static int
1808 rsu_delete_key(struct rsu_softc *sc, ieee80211_keyix keyix)
1809 {
1810         struct r92s_fw_cmd_set_key key;
1811         uint32_t val;
1812         int error;
1813
1814         RSU_ASSERT_LOCKED(sc);
1815
1816         if (!sc->sc_running)
1817                 return (0);
1818
1819         /* check if it was automatically removed by firmware */
1820         error = rsu_cam_read(sc, R92S_CAM_CTL0(keyix), &val);
1821         if (error == 0 && (val & R92S_CAM_VALID) == 0) {
1822                 RSU_DPRINTF(sc, RSU_DEBUG_KEY,
1823                     "%s: key %u does not exist\n", __func__, keyix);
1824                 clrbit(sc->keys_bmap, keyix);
1825                 return (0);
1826         }
1827
1828         memset(&key, 0, sizeof(key));
1829         key.cam_id = keyix;
1830
1831         RSU_DPRINTF(sc, RSU_DEBUG_KEY | RSU_DEBUG_FWCMD,
1832             "%s: removing key %u\n", __func__, key.cam_id);
1833
1834         error = rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1835         if (error != 0) {
1836                 device_printf(sc->sc_dev,
1837                     "%s: cannot send firmware command, error %d\n",
1838                     __func__, error);
1839                 goto finish;
1840         }
1841
1842         usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(5));
1843
1844         /*
1845          * Clear 'valid' bit manually (cannot be done via firmware command).
1846          * Used for key check + when firmware command cannot be sent.
1847          */
1848 finish:
1849         rsu_cam_write(sc, R92S_CAM_CTL0(keyix), 0);
1850
1851         clrbit(sc->keys_bmap, keyix);
1852
1853         return (rsu_key_check(sc, keyix, 0));
1854 }
1855
1856 static void
1857 rsu_delete_key_pair_cb(void *arg, int pending __unused)
1858 {
1859         struct rsu_softc *sc = arg;
1860         int i;
1861
1862         RSU_DELKEY_BMAP_LOCK(sc);
1863         for (i = IEEE80211_WEP_NKID; i < R92S_CAM_ENTRY_LIMIT; i++) {
1864                 if (isset(sc->free_keys_bmap, i)) {
1865                         RSU_DELKEY_BMAP_UNLOCK(sc);
1866
1867                         RSU_LOCK(sc);
1868                         RSU_DPRINTF(sc, RSU_DEBUG_KEY,
1869                             "%s: calling rsu_delete_key() with keyix = %d\n",
1870                             __func__, i);
1871                         (void) rsu_delete_key(sc, i);
1872                         RSU_UNLOCK(sc);
1873
1874                         RSU_DELKEY_BMAP_LOCK(sc);
1875                         clrbit(sc->free_keys_bmap, i);
1876
1877                         /* bmap can be changed */
1878                         i = IEEE80211_WEP_NKID - 1;
1879                         continue;
1880                 }
1881         }
1882         RSU_DELKEY_BMAP_UNLOCK(sc);
1883 }
1884
1885 static int
1886 rsu_site_survey(struct rsu_softc *sc, struct ieee80211_scan_ssid *ssid)
1887 {
1888         struct r92s_fw_cmd_sitesurvey cmd;
1889
1890         RSU_ASSERT_LOCKED(sc);
1891
1892         memset(&cmd, 0, sizeof(cmd));
1893         /* TODO: passive channels? */
1894         if (sc->sc_active_scan)
1895                 cmd.active = htole32(1);
1896         cmd.limit = htole32(48);
1897
1898         if (ssid != NULL) {
1899                 sc->sc_extra_scan = 1;
1900                 cmd.ssidlen = htole32(ssid->len);
1901                 memcpy(cmd.ssid, ssid->ssid, ssid->len);
1902         }
1903 #ifdef USB_DEBUG
1904         if (rsu_debug & (RSU_DEBUG_SCAN | RSU_DEBUG_FWCMD)) {
1905                 device_printf(sc->sc_dev,
1906                     "sending site survey command, active %d",
1907                     le32toh(cmd.active));
1908                 if (ssid != NULL) {
1909                         printf(", ssid: ");
1910                         ieee80211_print_essid(cmd.ssid, le32toh(cmd.ssidlen));
1911                 }
1912                 printf("\n");
1913         }
1914 #endif
1915         return (rsu_fw_cmd(sc, R92S_CMD_SITE_SURVEY, &cmd, sizeof(cmd)));
1916 }
1917
1918 static int
1919 rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
1920 {
1921         struct ieee80211com *ic = &sc->sc_ic;
1922         struct ieee80211vap *vap = ni->ni_vap;
1923         struct ndis_wlan_bssid_ex *bss;
1924         struct ndis_802_11_fixed_ies *fixed;
1925         struct r92s_fw_cmd_auth auth;
1926         uint8_t buf[sizeof(*bss) + 128] __aligned(4);
1927         uint8_t *frm;
1928         uint8_t opmode;
1929         int error;
1930
1931         RSU_ASSERT_LOCKED(sc);
1932
1933         /* Let the FW decide the opmode based on the capinfo field. */
1934         opmode = NDIS802_11AUTOUNKNOWN;
1935         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1936             "%s: setting operating mode to %d\n",
1937             __func__, opmode);
1938         error = rsu_fw_cmd(sc, R92S_CMD_SET_OPMODE, &opmode, sizeof(opmode));
1939         if (error != 0)
1940                 return (error);
1941
1942         memset(&auth, 0, sizeof(auth));
1943         if (vap->iv_flags & IEEE80211_F_WPA) {
1944                 auth.mode = R92S_AUTHMODE_WPA;
1945                 auth.dot1x = (ni->ni_authmode == IEEE80211_AUTH_8021X);
1946         } else
1947                 auth.mode = R92S_AUTHMODE_OPEN;
1948         RSU_DPRINTF(sc, RSU_DEBUG_RESET,
1949             "%s: setting auth mode to %d\n",
1950             __func__, auth.mode);
1951         error = rsu_fw_cmd(sc, R92S_CMD_SET_AUTH, &auth, sizeof(auth));
1952         if (error != 0)
1953                 return (error);
1954
1955         memset(buf, 0, sizeof(buf));
1956         bss = (struct ndis_wlan_bssid_ex *)buf;
1957         IEEE80211_ADDR_COPY(bss->macaddr, ni->ni_bssid);
1958         bss->ssid.ssidlen = htole32(ni->ni_esslen);
1959         memcpy(bss->ssid.ssid, ni->ni_essid, ni->ni_esslen);
1960         if (vap->iv_flags & (IEEE80211_F_PRIVACY | IEEE80211_F_WPA))
1961                 bss->privacy = htole32(1);
1962         bss->rssi = htole32(ni->ni_avgrssi);
1963         if (ic->ic_curmode == IEEE80211_MODE_11B)
1964                 bss->networktype = htole32(NDIS802_11DS);
1965         else
1966                 bss->networktype = htole32(NDIS802_11OFDM24);
1967         bss->config.len = htole32(sizeof(bss->config));
1968         bss->config.bintval = htole32(ni->ni_intval);
1969         bss->config.dsconfig = htole32(ieee80211_chan2ieee(ic, ni->ni_chan));
1970         bss->inframode = htole32(NDIS802_11INFRASTRUCTURE);
1971         /* XXX verify how this is supposed to look! */
1972         memcpy(bss->supprates, ni->ni_rates.rs_rates,
1973             ni->ni_rates.rs_nrates);
1974         /* Write the fixed fields of the beacon frame. */
1975         fixed = (struct ndis_802_11_fixed_ies *)&bss[1];
1976         memcpy(&fixed->tstamp, ni->ni_tstamp.data, 8);
1977         fixed->bintval = htole16(ni->ni_intval);
1978         fixed->capabilities = htole16(ni->ni_capinfo);
1979         /* Write IEs to be included in the association request. */
1980         frm = (uint8_t *)&fixed[1];
1981         frm = ieee80211_add_rsn(frm, vap);
1982         frm = ieee80211_add_wpa(frm, vap);
1983         frm = ieee80211_add_qos(frm, ni);
1984         if ((ic->ic_flags & IEEE80211_F_WME) &&
1985             (ni->ni_ies.wme_ie != NULL))
1986                 frm = ieee80211_add_wme_info(frm, &ic->ic_wme, ni);
1987         if (ni->ni_flags & IEEE80211_NODE_HT) {
1988                 frm = ieee80211_add_htcap(frm, ni);
1989                 frm = ieee80211_add_htinfo(frm, ni);
1990         }
1991         bss->ieslen = htole32(frm - (uint8_t *)fixed);
1992         bss->len = htole32(((frm - buf) + 3) & ~3);
1993         RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_FWCMD,
1994             "%s: sending join bss command to %s chan %d\n",
1995             __func__,
1996             ether_sprintf(bss->macaddr), le32toh(bss->config.dsconfig));
1997         return (rsu_fw_cmd(sc, R92S_CMD_JOIN_BSS, buf, sizeof(buf)));
1998 }
1999
2000 static int
2001 rsu_disconnect(struct rsu_softc *sc)
2002 {
2003         uint32_t zero = 0;      /* :-) */
2004
2005         /* Disassociate from our current BSS. */
2006         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2007             "%s: sending disconnect command\n", __func__);
2008         return (rsu_fw_cmd(sc, R92S_CMD_DISCONNECT, &zero, sizeof(zero)));
2009 }
2010
2011 /*
2012  * Map the hardware provided RSSI value to a signal level.
2013  * For the most part it's just something we divide by and cap
2014  * so it doesn't overflow the representation by net80211.
2015  */
2016 static int
2017 rsu_hwrssi_to_rssi(struct rsu_softc *sc, int hw_rssi)
2018 {
2019         int v;
2020
2021         if (hw_rssi == 0)
2022                 return (0);
2023         v = hw_rssi >> 4;
2024         if (v > 80)
2025                 v = 80;
2026         return (v);
2027 }
2028
2029 CTASSERT(MCLBYTES > sizeof(struct ieee80211_frame));
2030
2031 static void
2032 rsu_event_survey(struct rsu_softc *sc, uint8_t *buf, int len)
2033 {
2034         struct ieee80211com *ic = &sc->sc_ic;
2035         struct ieee80211_frame *wh;
2036         struct ndis_wlan_bssid_ex *bss;
2037         struct ieee80211_rx_stats rxs;
2038         struct mbuf *m;
2039         uint32_t ieslen;
2040         uint32_t pktlen;
2041
2042         if (__predict_false(len < sizeof(*bss)))
2043                 return;
2044         bss = (struct ndis_wlan_bssid_ex *)buf;
2045         ieslen = le32toh(bss->ieslen);
2046         /* range check length of information element */
2047         if (__predict_false(ieslen > (uint32_t)(len - sizeof(*bss))))
2048                 return;
2049
2050         RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
2051             "%s: found BSS %s: len=%d chan=%d inframode=%d "
2052             "networktype=%d privacy=%d, RSSI=%d\n",
2053             __func__,
2054             ether_sprintf(bss->macaddr), ieslen,
2055             le32toh(bss->config.dsconfig), le32toh(bss->inframode),
2056             le32toh(bss->networktype), le32toh(bss->privacy),
2057             le32toh(bss->rssi));
2058
2059         /* Build a fake beacon frame to let net80211 do all the parsing. */
2060         /* XXX TODO: just call the new scan API methods! */
2061         if (__predict_false(ieslen > (size_t)(MCLBYTES - sizeof(*wh))))
2062                 return;
2063         pktlen = sizeof(*wh) + ieslen;
2064         m = m_get2(pktlen, M_NOWAIT, MT_DATA, M_PKTHDR);
2065         if (__predict_false(m == NULL))
2066                 return;
2067         wh = mtod(m, struct ieee80211_frame *);
2068         wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
2069             IEEE80211_FC0_SUBTYPE_BEACON;
2070         wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
2071         USETW(wh->i_dur, 0);
2072         IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
2073         IEEE80211_ADDR_COPY(wh->i_addr2, bss->macaddr);
2074         IEEE80211_ADDR_COPY(wh->i_addr3, bss->macaddr);
2075         *(uint16_t *)wh->i_seq = 0;
2076         memcpy(&wh[1], (uint8_t *)&bss[1], ieslen);
2077
2078         /* Finalize mbuf. */
2079         m->m_pkthdr.len = m->m_len = pktlen;
2080
2081         /* Set channel flags for input path */
2082         bzero(&rxs, sizeof(rxs));
2083         rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
2084         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2085         rxs.c_ieee = le32toh(bss->config.dsconfig);
2086         rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
2087         /* This is a number from 0..100; so let's just divide it down a bit */
2088         rxs.c_rssi = le32toh(bss->rssi) / 2;
2089         rxs.c_nf = -96;
2090         if (ieee80211_add_rx_params(m, &rxs) == 0)
2091                 return;
2092
2093         /* XXX avoid a LOR */
2094         RSU_UNLOCK(sc);
2095         ieee80211_input_mimo_all(ic, m);
2096         RSU_LOCK(sc);
2097 }
2098
2099 static void
2100 rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
2101 {
2102         struct ieee80211com *ic = &sc->sc_ic;
2103         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2104         struct ieee80211_node *ni = vap->iv_bss;
2105         struct r92s_event_join_bss *rsp;
2106         uint32_t tmp;
2107         int res;
2108
2109         if (__predict_false(len < sizeof(*rsp)))
2110                 return;
2111         rsp = (struct r92s_event_join_bss *)buf;
2112         res = (int)le32toh(rsp->join_res);
2113
2114         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2115             "%s: Rx join BSS event len=%d res=%d\n",
2116             __func__, len, res);
2117
2118         /*
2119          * XXX Don't do this; there's likely a better way to tell
2120          * the caller we failed.
2121          */
2122         if (res <= 0) {
2123                 RSU_UNLOCK(sc);
2124                 ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
2125                 RSU_LOCK(sc);
2126                 return;
2127         }
2128
2129         tmp = le32toh(rsp->associd);
2130         if (tmp >= vap->iv_max_aid) {
2131                 RSU_DPRINTF(sc, RSU_DEBUG_ANY, "Assoc ID overflow\n");
2132                 tmp = 1;
2133         }
2134         RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
2135             "%s: associated with %s associd=%d\n",
2136             __func__, ether_sprintf(rsp->bss.macaddr), tmp);
2137         /* XXX is this required? What's the top two bits for again? */
2138         ni->ni_associd = tmp | 0xc000;
2139
2140         /* Refresh Rx filter (was changed by firmware). */
2141         sc->sc_vap_is_running = 1;
2142         rsu_rxfilter_refresh(sc);
2143
2144         RSU_UNLOCK(sc);
2145         ieee80211_new_state(vap, IEEE80211_S_RUN,
2146             IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
2147         RSU_LOCK(sc);
2148 }
2149
2150 static void
2151 rsu_event_addba_req_report(struct rsu_softc *sc, uint8_t *buf, int len)
2152 {
2153         struct ieee80211com *ic = &sc->sc_ic;
2154         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2155         struct r92s_add_ba_event *ba = (void *) buf;
2156         struct ieee80211_node *ni;
2157
2158         if (len < sizeof(*ba)) {
2159                 device_printf(sc->sc_dev, "%s: short read (%d)\n", __func__, len);
2160                 return;
2161         }
2162
2163         if (vap == NULL)
2164                 return;
2165
2166         RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: mac=%s, tid=%d, ssn=%d\n",
2167             __func__,
2168             ether_sprintf(ba->mac_addr),
2169             (int) ba->tid,
2170             (int) le16toh(ba->ssn));
2171
2172         /* XXX do node lookup; this is STA specific */
2173
2174         ni = ieee80211_ref_node(vap->iv_bss);
2175         ieee80211_ampdu_rx_start_ext(ni, ba->tid, le16toh(ba->ssn) >> 4, 32);
2176         ieee80211_free_node(ni);
2177 }
2178
2179 static void
2180 rsu_rx_event(struct rsu_softc *sc, uint8_t code, uint8_t *buf, int len)
2181 {
2182         struct ieee80211com *ic = &sc->sc_ic;
2183         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2184
2185         RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
2186             "%s: Rx event code=%d len=%d\n", __func__, code, len);
2187         switch (code) {
2188         case R92S_EVT_SURVEY:
2189                 rsu_event_survey(sc, buf, len);
2190                 break;
2191         case R92S_EVT_SURVEY_DONE:
2192                 RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
2193                     "%s: %s scan done, found %d BSS\n",
2194                     __func__, sc->sc_extra_scan ? "direct" : "broadcast",
2195                     le32toh(*(uint32_t *)buf));
2196                 if (sc->sc_extra_scan == 1) {
2197                         /* Send broadcast probe request. */
2198                         sc->sc_extra_scan = 0;
2199                         if (vap != NULL && rsu_site_survey(sc, NULL) != 0) {
2200                                 RSU_UNLOCK(sc);
2201                                 ieee80211_cancel_scan(vap);
2202                                 RSU_LOCK(sc);
2203                         }
2204                         break;
2205                 }
2206                 if (vap != NULL) {
2207                         RSU_UNLOCK(sc);
2208                         ieee80211_scan_done(vap);
2209                         RSU_LOCK(sc);
2210                 }
2211                 break;
2212         case R92S_EVT_JOIN_BSS:
2213                 if (vap->iv_state == IEEE80211_S_AUTH)
2214                         rsu_event_join_bss(sc, buf, len);
2215                 break;
2216         case R92S_EVT_DEL_STA:
2217                 RSU_DPRINTF(sc, RSU_DEBUG_FWCMD | RSU_DEBUG_STATE,
2218                     "%s: disassociated from %s\n", __func__,
2219                     ether_sprintf(buf));
2220                 if (vap->iv_state == IEEE80211_S_RUN &&
2221                     IEEE80211_ADDR_EQ(vap->iv_bss->ni_bssid, buf)) {
2222                         RSU_UNLOCK(sc);
2223                         ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
2224                         RSU_LOCK(sc);
2225                 }
2226                 break;
2227         case R92S_EVT_WPS_PBC:
2228                 RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
2229                     "%s: WPS PBC pushed.\n", __func__);
2230                 break;
2231         case R92S_EVT_FWDBG:
2232                 buf[60] = '\0';
2233                 RSU_DPRINTF(sc, RSU_DEBUG_FWDBG, "FWDBG: %s\n", (char *)buf);
2234                 break;
2235         case R92S_EVT_ADDBA_REQ_REPORT:
2236                 rsu_event_addba_req_report(sc, buf, len);
2237                 break;
2238         default:
2239                 device_printf(sc->sc_dev, "%s: unhandled code (%d)\n", __func__, code);
2240                 break;
2241         }
2242 }
2243
2244 static void
2245 rsu_rx_multi_event(struct rsu_softc *sc, uint8_t *buf, int len)
2246 {
2247         struct r92s_fw_cmd_hdr *cmd;
2248         int cmdsz;
2249
2250         RSU_DPRINTF(sc, RSU_DEBUG_RX, "%s: Rx events len=%d\n", __func__, len);
2251
2252         /* Skip Rx status. */
2253         buf += sizeof(struct r92s_rx_stat);
2254         len -= sizeof(struct r92s_rx_stat);
2255
2256         /* Process all events. */
2257         for (;;) {
2258                 /* Check that command header fits. */
2259                 if (__predict_false(len < sizeof(*cmd)))
2260                         break;
2261                 cmd = (struct r92s_fw_cmd_hdr *)buf;
2262                 /* Check that command payload fits. */
2263                 cmdsz = le16toh(cmd->len);
2264                 if (__predict_false(len < sizeof(*cmd) + cmdsz))
2265                         break;
2266
2267                 /* Process firmware event. */
2268                 rsu_rx_event(sc, cmd->code, (uint8_t *)&cmd[1], cmdsz);
2269
2270                 if (!(cmd->seq & R92S_FW_CMD_MORE))
2271                         break;
2272                 buf += sizeof(*cmd) + cmdsz;
2273                 len -= sizeof(*cmd) + cmdsz;
2274         }
2275 }
2276
2277 static int8_t
2278 rsu_get_rssi(struct rsu_softc *sc, int rate, void *physt)
2279 {
2280         static const int8_t cckoff[] = { 14, -2, -20, -40 };
2281         struct r92s_rx_phystat *phy;
2282         struct r92s_rx_cck *cck;
2283         uint8_t rpt;
2284         int8_t rssi;
2285
2286         if (rate <= 3) {
2287                 cck = (struct r92s_rx_cck *)physt;
2288                 rpt = (cck->agc_rpt >> 6) & 0x3;
2289                 rssi = cck->agc_rpt & 0x3e;
2290                 rssi = cckoff[rpt] - rssi;
2291         } else {        /* OFDM/HT. */
2292                 phy = (struct r92s_rx_phystat *)physt;
2293                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 106;
2294         }
2295         return (rssi);
2296 }
2297
2298 static struct mbuf *
2299 rsu_rx_copy_to_mbuf(struct rsu_softc *sc, struct r92s_rx_stat *stat,
2300     int totlen)
2301 {
2302         struct ieee80211com *ic = &sc->sc_ic;
2303         struct mbuf *m;
2304         uint32_t rxdw0;
2305         int pktlen;
2306
2307         rxdw0 = le32toh(stat->rxdw0);
2308         if (__predict_false(rxdw0 & (R92S_RXDW0_CRCERR | R92S_RXDW0_ICVERR))) {
2309                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2310                     "%s: RX flags error (%s)\n", __func__,
2311                     rxdw0 & R92S_RXDW0_CRCERR ? "CRC" : "ICV");
2312                 goto fail;
2313         }
2314
2315         pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
2316         if (__predict_false(pktlen < sizeof (struct ieee80211_frame_ack))) {
2317                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2318                     "%s: frame is too short: %d\n", __func__, pktlen);
2319                 goto fail;
2320         }
2321
2322         m = m_get2(totlen, M_NOWAIT, MT_DATA, M_PKTHDR);
2323         if (__predict_false(m == NULL)) {
2324                 device_printf(sc->sc_dev,
2325                     "%s: could not allocate RX mbuf, totlen %d\n",
2326                     __func__, totlen);
2327                 goto fail;
2328         }
2329
2330         /* Finalize mbuf. */
2331         memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
2332         m->m_pkthdr.len = m->m_len = totlen;
2333
2334         return (m);
2335 fail:
2336         counter_u64_add(ic->ic_ierrors, 1);
2337         return (NULL);
2338 }
2339
2340 static uint32_t
2341 rsu_get_tsf_low(struct rsu_softc *sc)
2342 {
2343         return (rsu_read_4(sc, R92S_TSFTR));
2344 }
2345
2346 static uint32_t
2347 rsu_get_tsf_high(struct rsu_softc *sc)
2348 {
2349         return (rsu_read_4(sc, R92S_TSFTR + 4));
2350 }
2351
2352 static struct ieee80211_node *
2353 rsu_rx_frame(struct rsu_softc *sc, struct mbuf *m)
2354 {
2355         struct ieee80211com *ic = &sc->sc_ic;
2356         struct ieee80211_frame_min *wh;
2357         struct ieee80211_rx_stats rxs;
2358         struct r92s_rx_stat *stat;
2359         uint32_t rxdw0, rxdw3;
2360         uint8_t cipher, rate;
2361         int infosz;
2362         int rssi;
2363
2364         stat = mtod(m, struct r92s_rx_stat *);
2365         rxdw0 = le32toh(stat->rxdw0);
2366         rxdw3 = le32toh(stat->rxdw3);
2367
2368         rate = MS(rxdw3, R92S_RXDW3_RATE);
2369         cipher = MS(rxdw0, R92S_RXDW0_CIPHER);
2370         infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
2371
2372         /* Get RSSI from PHY status descriptor if present. */
2373         if (infosz != 0 && (rxdw0 & R92S_RXDW0_PHYST))
2374                 rssi = rsu_get_rssi(sc, rate, &stat[1]);
2375         else {
2376                 /* Cheat and get the last calibrated RSSI */
2377                 rssi = rsu_hwrssi_to_rssi(sc, sc->sc_currssi);
2378         }
2379
2380         /* Hardware does Rx TCP checksum offload. */
2381         /*
2382          * This flag can be set for some other
2383          * (e.g., EAPOL) frame types, so don't rely on it.
2384          */
2385         if (rxdw3 & R92S_RXDW3_TCPCHKVALID) {
2386                 RSU_DPRINTF(sc, RSU_DEBUG_RX,
2387                     "%s: TCP/IP checksums: %schecked / %schecked\n",
2388                     __func__,
2389                     (rxdw3 & R92S_RXDW3_TCPCHKRPT) ? "" : "not ",
2390                     (rxdw3 & R92S_RXDW3_IPCHKRPT) ? "" : "not ");
2391
2392                 /*
2393                  * 'IP header checksum valid' bit will not be set if
2394                  * the frame was not checked / has incorrect checksum /
2395                  * does not have checksum (IPv6).
2396                  *
2397                  * NB: if DF bit is not set then frame will not be checked.
2398                  */
2399                 if (rxdw3 & R92S_RXDW3_IPCHKRPT) {
2400                         m->m_pkthdr.csum_flags = CSUM_IP_CHECKED;
2401                         m->m_pkthdr.csum_flags |= CSUM_IP_VALID;
2402                 }
2403
2404                 /*
2405                  * This is independent of the above check.
2406                  */
2407                 if (rxdw3 & R92S_RXDW3_TCPCHKRPT) {
2408                         m->m_pkthdr.csum_flags |= CSUM_DATA_VALID;
2409                         m->m_pkthdr.csum_flags |= CSUM_PSEUDO_HDR;
2410                         m->m_pkthdr.csum_data = 0xffff;
2411                 }
2412         }
2413
2414         /* RX flags */
2415
2416         /* Set channel flags for input path */
2417         bzero(&rxs, sizeof(rxs));
2418
2419         /* normal RSSI */
2420         rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
2421         rxs.c_rssi = rssi;
2422         rxs.c_nf = -96;
2423
2424         /* Rate */
2425         if (rate < 12) {
2426                 rxs.c_rate = ridx2rate[rate];
2427                 if (RSU_RATE_IS_CCK(rate))
2428                         rxs.c_pktflags |= IEEE80211_RX_F_CCK;
2429                 else
2430                         rxs.c_pktflags |= IEEE80211_RX_F_OFDM;
2431         } else {
2432                 rxs.c_rate = IEEE80211_RATE_MCS | (rate - 12);
2433                 rxs.c_pktflags |= IEEE80211_RX_F_HT;
2434         }
2435
2436         if (ieee80211_radiotap_active(ic)) {
2437                 struct rsu_rx_radiotap_header *tap = &sc->sc_rxtap;
2438
2439                 /* Map HW rate index to 802.11 rate. */
2440                 tap->wr_flags = 0;              /* TODO */
2441                 tap->wr_tsft = rsu_get_tsf_high(sc);
2442                 if (le32toh(stat->tsf_low) > rsu_get_tsf_low(sc))
2443                         tap->wr_tsft--;
2444                 tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
2445                 tap->wr_tsft += stat->tsf_low;
2446
2447                 tap->wr_rate = rxs.c_rate;
2448                 tap->wr_dbm_antsignal = rssi;
2449         };
2450
2451         (void) ieee80211_add_rx_params(m, &rxs);
2452
2453         /* Drop descriptor. */
2454         m_adj(m, sizeof(*stat) + infosz);
2455         wh = mtod(m, struct ieee80211_frame_min *);
2456         if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
2457             cipher != R92S_KEY_ALGO_NONE) {
2458                 m->m_flags |= M_WEP;
2459         }
2460
2461         RSU_DPRINTF(sc, RSU_DEBUG_RX,
2462             "%s: Rx frame len %d, rate %d, infosz %d\n",
2463             __func__, m->m_len, rate, infosz);
2464
2465         if (m->m_len >= sizeof(*wh))
2466                 return (ieee80211_find_rxnode(ic, wh));
2467
2468         return (NULL);
2469 }
2470
2471 static struct mbuf *
2472 rsu_rx_multi_frame(struct rsu_softc *sc, uint8_t *buf, int len)
2473 {
2474         struct r92s_rx_stat *stat;
2475         uint32_t rxdw0;
2476         int totlen, pktlen, infosz, npkts;
2477         struct mbuf *m, *m0 = NULL, *prevm = NULL;
2478
2479         /*
2480          * don't pass packets to the ieee80211 framework if the driver isn't
2481          * RUNNING.
2482          */
2483         if (!sc->sc_running)
2484                 return (NULL);
2485
2486         /* Get the number of encapsulated frames. */
2487         stat = (struct r92s_rx_stat *)buf;
2488         npkts = MS(le32toh(stat->rxdw2), R92S_RXDW2_PKTCNT);
2489         RSU_DPRINTF(sc, RSU_DEBUG_RX,
2490             "%s: Rx %d frames in one chunk\n", __func__, npkts);
2491
2492         /* Process all of them. */
2493         while (npkts-- > 0) {
2494                 if (__predict_false(len < sizeof(*stat)))
2495                         break;
2496                 stat = (struct r92s_rx_stat *)buf;
2497                 rxdw0 = le32toh(stat->rxdw0);
2498
2499                 pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
2500                 if (__predict_false(pktlen == 0))
2501                         break;
2502
2503                 infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
2504
2505                 /* Make sure everything fits in xfer. */
2506                 totlen = sizeof(*stat) + infosz + pktlen;
2507                 if (__predict_false(totlen > len))
2508                         break;
2509
2510                 /* Process 802.11 frame. */
2511                 m = rsu_rx_copy_to_mbuf(sc, stat, totlen);
2512                 if (m0 == NULL)
2513                         m0 = m;
2514                 if (prevm == NULL)
2515                         prevm = m;
2516                 else {
2517                         prevm->m_next = m;
2518                         prevm = m;
2519                 }
2520                 /* Next chunk is 128-byte aligned. */
2521                 totlen = (totlen + 127) & ~127;
2522                 buf += totlen;
2523                 len -= totlen;
2524         }
2525
2526         return (m0);
2527 }
2528
2529 static struct mbuf *
2530 rsu_rxeof(struct usb_xfer *xfer, struct rsu_data *data)
2531 {
2532         struct rsu_softc *sc = data->sc;
2533         struct ieee80211com *ic = &sc->sc_ic;
2534         struct r92s_rx_stat *stat;
2535         int len;
2536
2537         usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
2538
2539         if (__predict_false(len < sizeof(*stat))) {
2540                 RSU_DPRINTF(sc, RSU_DEBUG_RX, "xfer too short %d\n", len);
2541                 counter_u64_add(ic->ic_ierrors, 1);
2542                 return (NULL);
2543         }
2544         /* Determine if it is a firmware C2H event or an 802.11 frame. */
2545         stat = (struct r92s_rx_stat *)data->buf;
2546         if ((le32toh(stat->rxdw1) & 0x1ff) == 0x1ff) {
2547                 rsu_rx_multi_event(sc, data->buf, len);
2548                 /* No packets to process. */
2549                 return (NULL);
2550         } else
2551                 return (rsu_rx_multi_frame(sc, data->buf, len));
2552 }
2553
2554 static void
2555 rsu_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2556 {
2557         struct epoch_tracker et;
2558         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2559         struct ieee80211com *ic = &sc->sc_ic;
2560         struct ieee80211_node *ni;
2561         struct mbuf *m = NULL, *next;
2562         struct rsu_data *data;
2563
2564         RSU_ASSERT_LOCKED(sc);
2565
2566         switch (USB_GET_STATE(xfer)) {
2567         case USB_ST_TRANSFERRED:
2568                 data = STAILQ_FIRST(&sc->sc_rx_active);
2569                 if (data == NULL)
2570                         goto tr_setup;
2571                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2572                 m = rsu_rxeof(xfer, data);
2573                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2574                 /* FALLTHROUGH */
2575         case USB_ST_SETUP:
2576 tr_setup:
2577                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
2578                 if (data == NULL) {
2579                         KASSERT(m == NULL, ("mbuf isn't NULL"));
2580                         return;
2581                 }
2582                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
2583                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
2584                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
2585                     usbd_xfer_max_len(xfer));
2586                 usbd_transfer_submit(xfer);
2587                 /*
2588                  * To avoid LOR we should unlock our private mutex here to call
2589                  * ieee80211_input() because here is at the end of a USB
2590                  * callback and safe to unlock.
2591                  */
2592                 NET_EPOCH_ENTER(et);
2593                 while (m != NULL) {
2594                         next = m->m_next;
2595                         m->m_next = NULL;
2596
2597                         ni = rsu_rx_frame(sc, m);
2598                         RSU_UNLOCK(sc);
2599
2600                         if (ni != NULL) {
2601                                 if (ni->ni_flags & IEEE80211_NODE_HT)
2602                                         m->m_flags |= M_AMPDU;
2603                                 (void)ieee80211_input_mimo(ni, m);
2604                                 ieee80211_free_node(ni);
2605                         } else
2606                                 (void)ieee80211_input_mimo_all(ic, m);
2607
2608                         RSU_LOCK(sc);
2609                         m = next;
2610                 }
2611                 NET_EPOCH_EXIT(et);
2612                 break;
2613         default:
2614                 /* needs it to the inactive queue due to a error. */
2615                 data = STAILQ_FIRST(&sc->sc_rx_active);
2616                 if (data != NULL) {
2617                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
2618                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
2619                 }
2620                 if (error != USB_ERR_CANCELLED) {
2621                         usbd_xfer_set_stall(xfer);
2622                         counter_u64_add(ic->ic_ierrors, 1);
2623                         goto tr_setup;
2624                 }
2625                 break;
2626         }
2627
2628 }
2629
2630 static void
2631 rsu_txeof(struct usb_xfer *xfer, struct rsu_data *data)
2632 {
2633 #ifdef  USB_DEBUG
2634         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2635 #endif
2636
2637         RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: called; data=%p\n",
2638             __func__,
2639             data);
2640
2641         if (data->m) {
2642                 /* XXX status? */
2643                 ieee80211_tx_complete(data->ni, data->m, 0);
2644                 data->m = NULL;
2645                 data->ni = NULL;
2646         }
2647 }
2648
2649 static void
2650 rsu_bulk_tx_callback_sub(struct usb_xfer *xfer, usb_error_t error,
2651     uint8_t which)
2652 {
2653         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2654         struct ieee80211com *ic = &sc->sc_ic;
2655         struct rsu_data *data;
2656
2657         RSU_ASSERT_LOCKED(sc);
2658
2659         switch (USB_GET_STATE(xfer)) {
2660         case USB_ST_TRANSFERRED:
2661                 data = STAILQ_FIRST(&sc->sc_tx_active[which]);
2662                 if (data == NULL)
2663                         goto tr_setup;
2664                 RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: transfer done %p\n",
2665                     __func__, data);
2666                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
2667                 rsu_txeof(xfer, data);
2668                 rsu_freebuf(sc, data);
2669                 /* FALLTHROUGH */
2670         case USB_ST_SETUP:
2671 tr_setup:
2672                 data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
2673                 if (data == NULL) {
2674                         RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
2675                             "%s: empty pending queue sc %p\n", __func__, sc);
2676                         return;
2677                 }
2678                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
2679                 STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
2680                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
2681                 RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
2682                     "%s: submitting transfer %p\n",
2683                     __func__,
2684                     data);
2685                 usbd_transfer_submit(xfer);
2686                 break;
2687         default:
2688                 data = STAILQ_FIRST(&sc->sc_tx_active[which]);
2689                 if (data != NULL) {
2690                         STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
2691                         rsu_txeof(xfer, data);
2692                         rsu_freebuf(sc, data);
2693                 }
2694                 counter_u64_add(ic->ic_oerrors, 1);
2695
2696                 if (error != USB_ERR_CANCELLED) {
2697                         usbd_xfer_set_stall(xfer);
2698                         goto tr_setup;
2699                 }
2700                 break;
2701         }
2702
2703         /*
2704          * XXX TODO: if the queue is low, flush out FF TX frames.
2705          * Remember to unlock the driver for now; net80211 doesn't
2706          * defer it for us.
2707          */
2708 }
2709
2710 static void
2711 rsu_bulk_tx_callback_be_bk(struct usb_xfer *xfer, usb_error_t error)
2712 {
2713         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2714
2715         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_BE_BK);
2716
2717         /* This kicks the TX taskqueue */
2718         rsu_start(sc);
2719 }
2720
2721 static void
2722 rsu_bulk_tx_callback_vi_vo(struct usb_xfer *xfer, usb_error_t error)
2723 {
2724         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2725
2726         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_VI_VO);
2727
2728         /* This kicks the TX taskqueue */
2729         rsu_start(sc);
2730 }
2731
2732 static void
2733 rsu_bulk_tx_callback_h2c(struct usb_xfer *xfer, usb_error_t error)
2734 {
2735         struct rsu_softc *sc = usbd_xfer_softc(xfer);
2736
2737         rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_H2C);
2738
2739         /* This kicks the TX taskqueue */
2740         rsu_start(sc);
2741 }
2742
2743 /*
2744  * Transmit the given frame.
2745  *
2746  * This doesn't free the node or mbuf upon failure.
2747  */
2748 static int
2749 rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
2750     struct mbuf *m0, struct rsu_data *data)
2751 {
2752         const struct ieee80211_txparam *tp = ni->ni_txparms;
2753         struct ieee80211vap *vap = ni->ni_vap;
2754         struct ieee80211_frame *wh;
2755         struct ieee80211_key *k = NULL;
2756         struct r92s_tx_desc *txd;
2757         uint8_t rate, ridx, type, cipher, qos;
2758         int prio = 0;
2759         uint8_t which;
2760         int hasqos;
2761         int ismcast;
2762         int xferlen;
2763         int qid;
2764
2765         RSU_ASSERT_LOCKED(sc);
2766
2767         wh = mtod(m0, struct ieee80211_frame *);
2768         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2769         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2770
2771         RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: data=%p, m=%p\n",
2772             __func__, data, m0);
2773
2774         /* Choose a TX rate index. */
2775         if (type == IEEE80211_FC0_TYPE_MGT ||
2776             type == IEEE80211_FC0_TYPE_CTL ||
2777             (m0->m_flags & M_EAPOL) != 0)
2778                 rate = tp->mgmtrate;
2779         else if (ismcast)
2780                 rate = tp->mcastrate;
2781         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2782                 rate = tp->ucastrate;
2783         else
2784                 rate = 0;
2785
2786         if (rate != 0)
2787                 ridx = rate2ridx(rate);
2788
2789         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2790                 k = ieee80211_crypto_encap(ni, m0);
2791                 if (k == NULL) {
2792                         device_printf(sc->sc_dev,
2793                             "ieee80211_crypto_encap returns NULL.\n");
2794                         /* XXX we don't expect the fragmented frames */
2795                         return (ENOBUFS);
2796                 }
2797                 wh = mtod(m0, struct ieee80211_frame *);
2798         }
2799         /* If we have QoS then use it */
2800         /* XXX TODO: mbuf WME/PRI versus TID? */
2801         if (IEEE80211_QOS_HAS_SEQ(wh)) {
2802                 /* Has QoS */
2803                 prio = M_WME_GETAC(m0);
2804                 which = rsu_wme_ac_xfer_map[prio];
2805                 hasqos = 1;
2806                 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2807         } else {
2808                 /* Non-QoS TID */
2809                 /* XXX TODO: tid=0 for non-qos TID? */
2810                 which = rsu_wme_ac_xfer_map[WME_AC_BE];
2811                 hasqos = 0;
2812                 prio = 0;
2813                 qos = 0;
2814         }
2815
2816         qid = rsu_ac2qid[prio];
2817 #if 0
2818         switch (type) {
2819         case IEEE80211_FC0_TYPE_CTL:
2820         case IEEE80211_FC0_TYPE_MGT:
2821                 which = rsu_wme_ac_xfer_map[WME_AC_VO];
2822                 break;
2823         default:
2824                 which = rsu_wme_ac_xfer_map[M_WME_GETAC(m0)];
2825                 break;
2826         }
2827         hasqos = 0;
2828 #endif
2829
2830         RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: pri=%d, which=%d, hasqos=%d\n",
2831             __func__,
2832             prio,
2833             which,
2834             hasqos);
2835
2836         /* Fill Tx descriptor. */
2837         txd = (struct r92s_tx_desc *)data->buf;
2838         memset(txd, 0, sizeof(*txd));
2839
2840         txd->txdw0 |= htole32(
2841             SM(R92S_TXDW0_PKTLEN, m0->m_pkthdr.len) |
2842             SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
2843             R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
2844
2845         txd->txdw1 |= htole32(
2846             SM(R92S_TXDW1_MACID, R92S_MACID_BSS) | SM(R92S_TXDW1_QSEL, qid));
2847         if (!hasqos)
2848                 txd->txdw1 |= htole32(R92S_TXDW1_NONQOS);
2849         if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWENCRYPT)) {
2850                 switch (k->wk_cipher->ic_cipher) {
2851                 case IEEE80211_CIPHER_WEP:
2852                         cipher = R92S_TXDW1_CIPHER_WEP;
2853                         break;
2854                 case IEEE80211_CIPHER_TKIP:
2855                         cipher = R92S_TXDW1_CIPHER_TKIP;
2856                         break;
2857                 case IEEE80211_CIPHER_AES_CCM:
2858                         cipher = R92S_TXDW1_CIPHER_AES;
2859                         break;
2860                 default:
2861                         cipher = R92S_TXDW1_CIPHER_NONE;
2862                 }
2863                 txd->txdw1 |= htole32(
2864                     SM(R92S_TXDW1_CIPHER, cipher) |
2865                     SM(R92S_TXDW1_KEYIDX, k->wk_keyix));
2866         }
2867         /* XXX todo: set AGGEN bit if appropriate? */
2868         txd->txdw2 |= htole32(R92S_TXDW2_BK);
2869         if (ismcast)
2870                 txd->txdw2 |= htole32(R92S_TXDW2_BMCAST);
2871
2872         if (!ismcast && (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
2873             IEEE80211_QOS_ACKPOLICY_NOACK)) {
2874                 txd->txdw2 |= htole32(R92S_TXDW2_RTY_LMT_ENA);
2875                 txd->txdw2 |= htole32(SM(R92S_TXDW2_RTY_LMT, tp->maxretry));
2876         }
2877
2878         /* Force mgmt / mcast / ucast rate if needed. */
2879         if (rate != 0) {
2880                 /* Data rate fallback limit (max). */
2881                 txd->txdw5 |= htole32(SM(R92S_TXDW5_DATARATE_FB_LMT, 0x1f));
2882                 txd->txdw5 |= htole32(SM(R92S_TXDW5_DATARATE, ridx));
2883                 txd->txdw4 |= htole32(R92S_TXDW4_DRVRATE);
2884         }
2885
2886         /*
2887          * Firmware will use and increment the sequence number for the
2888          * specified priority.
2889          */
2890         txd->txdw3 |= htole32(SM(R92S_TXDW3_SEQ, prio));
2891
2892         if (ieee80211_radiotap_active_vap(vap)) {
2893                 struct rsu_tx_radiotap_header *tap = &sc->sc_txtap;
2894
2895                 tap->wt_flags = 0;
2896                 ieee80211_radiotap_tx(vap, m0);
2897         }
2898
2899         xferlen = sizeof(*txd) + m0->m_pkthdr.len;
2900         m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
2901
2902         data->buflen = xferlen;
2903         data->ni = ni;
2904         data->m = m0;
2905         STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
2906
2907         /* start transfer, if any */
2908         usbd_transfer_start(sc->sc_xfer[which]);
2909         return (0);
2910 }
2911
2912 static int
2913 rsu_transmit(struct ieee80211com *ic, struct mbuf *m)
2914 {
2915         struct rsu_softc *sc = ic->ic_softc;
2916         int error;
2917
2918         RSU_LOCK(sc);
2919         if (!sc->sc_running) {
2920                 RSU_UNLOCK(sc);
2921                 return (ENXIO);
2922         }
2923
2924         /*
2925          * XXX TODO: ensure that we treat 'm' as a list of frames
2926          * to transmit!
2927          */
2928         error = mbufq_enqueue(&sc->sc_snd, m);
2929         if (error) {
2930                 RSU_DPRINTF(sc, RSU_DEBUG_TX,
2931                     "%s: mbufq_enable: failed (%d)\n",
2932                     __func__,
2933                     error);
2934                 RSU_UNLOCK(sc);
2935                 return (error);
2936         }
2937         RSU_UNLOCK(sc);
2938
2939         /* This kicks the TX taskqueue */
2940         rsu_start(sc);
2941
2942         return (0);
2943 }
2944
2945 static void
2946 rsu_drain_mbufq(struct rsu_softc *sc)
2947 {
2948         struct mbuf *m;
2949         struct ieee80211_node *ni;
2950
2951         RSU_ASSERT_LOCKED(sc);
2952         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2953                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2954                 m->m_pkthdr.rcvif = NULL;
2955                 ieee80211_free_node(ni);
2956                 m_freem(m);
2957         }
2958 }
2959
2960 static void
2961 _rsu_start(struct rsu_softc *sc)
2962 {
2963         struct ieee80211_node *ni;
2964         struct rsu_data *bf;
2965         struct mbuf *m;
2966
2967         RSU_ASSERT_LOCKED(sc);
2968
2969         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2970                 bf = rsu_getbuf(sc);
2971                 if (bf == NULL) {
2972                         RSU_DPRINTF(sc, RSU_DEBUG_TX,
2973                             "%s: failed to get buffer\n", __func__);
2974                         mbufq_prepend(&sc->sc_snd, m);
2975                         break;
2976                 }
2977
2978                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2979                 m->m_pkthdr.rcvif = NULL;
2980
2981                 if (rsu_tx_start(sc, ni, m, bf) != 0) {
2982                         RSU_DPRINTF(sc, RSU_DEBUG_TX,
2983                             "%s: failed to transmit\n", __func__);
2984                         if_inc_counter(ni->ni_vap->iv_ifp,
2985                             IFCOUNTER_OERRORS, 1);
2986                         rsu_freebuf(sc, bf);
2987                         ieee80211_free_node(ni);
2988                         m_freem(m);
2989                         break;
2990                 }
2991         }
2992 }
2993
2994 static void
2995 rsu_start(struct rsu_softc *sc)
2996 {
2997
2998         taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
2999 }
3000
3001 static int
3002 rsu_ioctl_net(struct ieee80211com *ic, u_long cmd, void *data)
3003 {
3004         struct rsu_softc *sc = ic->ic_softc;
3005         struct ifreq *ifr = (struct ifreq *)data;
3006         int error;
3007
3008         error = 0;
3009         switch (cmd) {
3010         case SIOCSIFCAP:
3011         {
3012                 struct ieee80211vap *vap;
3013                 int rxmask;
3014
3015                 rxmask = ifr->ifr_reqcap & (IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6);
3016
3017                 RSU_LOCK(sc);
3018                 /* Both RXCSUM bits must be set (or unset). */
3019                 if (sc->sc_rx_checksum_enable &&
3020                     rxmask != (IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6)) {
3021                         rxmask = 0;
3022                         sc->sc_rx_checksum_enable = 0;
3023                         rsu_rxfilter_set(sc, R92S_RCR_TCP_OFFLD_EN, 0);
3024                 } else if (!sc->sc_rx_checksum_enable && rxmask != 0) {
3025                         rxmask = IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6;
3026                         sc->sc_rx_checksum_enable = 1;
3027                         rsu_rxfilter_set(sc, 0, R92S_RCR_TCP_OFFLD_EN);
3028                 } else {
3029                         /* Nothing to do. */
3030                         RSU_UNLOCK(sc);
3031                         break;
3032                 }
3033                 RSU_UNLOCK(sc);
3034
3035                 IEEE80211_LOCK(ic);     /* XXX */
3036                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
3037                         struct ifnet *ifp = vap->iv_ifp;
3038
3039                         ifp->if_capenable &=
3040                             ~(IFCAP_RXCSUM | IFCAP_RXCSUM_IPV6);
3041                         ifp->if_capenable |= rxmask;
3042                 }
3043                 IEEE80211_UNLOCK(ic);
3044                 break;
3045         }
3046         default:
3047                 error = ENOTTY;         /* for net80211 */
3048                 break;
3049         }
3050
3051         return (error);
3052 }
3053
3054 static void
3055 rsu_parent(struct ieee80211com *ic)
3056 {
3057         struct rsu_softc *sc = ic->ic_softc;
3058
3059         if (ic->ic_nrunning > 0) {
3060                 if (rsu_init(sc) == 0)
3061                         ieee80211_start_all(ic);
3062                 else {
3063                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3064                         if (vap != NULL)
3065                                 ieee80211_stop(vap);
3066                 }
3067         } else
3068                 rsu_stop(sc);
3069 }
3070
3071 /*
3072  * Power on sequence for A-cut adapters.
3073  */
3074 static void
3075 rsu_power_on_acut(struct rsu_softc *sc)
3076 {
3077         uint32_t reg;
3078
3079         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
3080         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
3081
3082         /* Enable AFE macro block's bandgap and Mbias. */
3083         rsu_write_1(sc, R92S_AFE_MISC,
3084             rsu_read_1(sc, R92S_AFE_MISC) |
3085             R92S_AFE_MISC_BGEN | R92S_AFE_MISC_MBEN);
3086         /* Enable LDOA15 block. */
3087         rsu_write_1(sc, R92S_LDOA15_CTRL,
3088             rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
3089
3090         rsu_write_1(sc, R92S_SPS1_CTRL,
3091             rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_LDEN);
3092         rsu_ms_delay(sc, 2000);
3093         /* Enable switch regulator block. */
3094         rsu_write_1(sc, R92S_SPS1_CTRL,
3095             rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_SWEN);
3096
3097         rsu_write_4(sc, R92S_SPS1_CTRL, 0x00a7b267);
3098
3099         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3100             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
3101
3102         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3103             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
3104
3105         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3106             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x90);
3107
3108         /* Enable AFE clock. */
3109         rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
3110             rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
3111         /* Enable AFE PLL macro block. */
3112         rsu_write_1(sc, R92S_AFE_PLL_CTRL,
3113             rsu_read_1(sc, R92S_AFE_PLL_CTRL) | 0x11);
3114         /* Attach AFE PLL to MACTOP/BB. */
3115         rsu_write_1(sc, R92S_SYS_ISO_CTRL,
3116             rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
3117
3118         /* Switch to 40MHz clock instead of 80MHz. */
3119         rsu_write_2(sc, R92S_SYS_CLKR,
3120             rsu_read_2(sc, R92S_SYS_CLKR) & ~R92S_SYS_CLKSEL);
3121
3122         /* Enable MAC clock. */
3123         rsu_write_2(sc, R92S_SYS_CLKR,
3124             rsu_read_2(sc, R92S_SYS_CLKR) |
3125             R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
3126
3127         rsu_write_1(sc, R92S_PMC_FSM, 0x02);
3128
3129         /* Enable digital core and IOREG R/W. */
3130         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3131             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
3132
3133         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3134             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
3135
3136         /* Switch the control path to firmware. */
3137         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3138         reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
3139         rsu_write_2(sc, R92S_SYS_CLKR, reg);
3140
3141         rsu_write_2(sc, R92S_CR, 0x37fc);
3142
3143         /* Fix USB RX FIFO issue. */
3144         rsu_write_1(sc, 0xfe5c,
3145             rsu_read_1(sc, 0xfe5c) | 0x80);
3146         rsu_write_1(sc, 0x00ab,
3147             rsu_read_1(sc, 0x00ab) | 0xc0);
3148
3149         rsu_write_1(sc, R92S_SYS_CLKR,
3150             rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
3151 }
3152
3153 /*
3154  * Power on sequence for B-cut and C-cut adapters.
3155  */
3156 static void
3157 rsu_power_on_bcut(struct rsu_softc *sc)
3158 {
3159         uint32_t reg;
3160         int ntries;
3161
3162         /* Prevent eFuse leakage. */
3163         rsu_write_1(sc, 0x37, 0xb0);
3164         rsu_ms_delay(sc, 10);
3165         rsu_write_1(sc, 0x37, 0x30);
3166
3167         /* Switch the control path to hardware. */
3168         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3169         if (reg & R92S_FWHW_SEL) {
3170                 rsu_write_2(sc, R92S_SYS_CLKR,
3171                     reg & ~(R92S_SWHW_SEL | R92S_FWHW_SEL));
3172         }
3173         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3174             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) & ~0x8c);
3175         rsu_ms_delay(sc, 1);
3176
3177         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
3178         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
3179
3180         reg = rsu_read_1(sc, R92S_AFE_MISC);
3181         rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN);
3182         rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN |
3183             R92S_AFE_MISC_MBEN | R92S_AFE_MISC_I32_EN);
3184
3185         /* Enable PLL. */
3186         rsu_write_1(sc, R92S_LDOA15_CTRL,
3187             rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
3188
3189         rsu_write_1(sc, R92S_LDOV12D_CTRL,
3190             rsu_read_1(sc, R92S_LDOV12D_CTRL) | R92S_LDV12_EN);
3191
3192         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3193             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
3194
3195         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3196             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
3197
3198         /* Support 64KB IMEM. */
3199         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
3200             rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x97);
3201
3202         /* Enable AFE clock. */
3203         rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
3204             rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
3205         /* Enable AFE PLL macro block. */
3206         reg = rsu_read_1(sc, R92S_AFE_PLL_CTRL);
3207         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
3208         rsu_ms_delay(sc, 1);
3209         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x51);
3210         rsu_ms_delay(sc, 1);
3211         rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
3212         rsu_ms_delay(sc, 1);
3213
3214         /* Attach AFE PLL to MACTOP/BB. */
3215         rsu_write_1(sc, R92S_SYS_ISO_CTRL,
3216             rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
3217
3218         /* Switch to 40MHz clock. */
3219         rsu_write_1(sc, R92S_SYS_CLKR, 0x00);
3220         /* Disable CPU clock and 80MHz SSC. */
3221         rsu_write_1(sc, R92S_SYS_CLKR,
3222             rsu_read_1(sc, R92S_SYS_CLKR) | 0xa0);
3223         /* Enable MAC clock. */
3224         rsu_write_2(sc, R92S_SYS_CLKR,
3225             rsu_read_2(sc, R92S_SYS_CLKR) |
3226             R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
3227
3228         rsu_write_1(sc, R92S_PMC_FSM, 0x02);
3229
3230         /* Enable digital core and IOREG R/W. */
3231         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3232             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
3233
3234         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
3235             rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
3236
3237         /* Switch the control path to firmware. */
3238         reg = rsu_read_2(sc, R92S_SYS_CLKR);
3239         reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
3240         rsu_write_2(sc, R92S_SYS_CLKR, reg);
3241
3242         rsu_write_2(sc, R92S_CR, 0x37fc);
3243
3244         /* Fix USB RX FIFO issue. */
3245         rsu_write_1(sc, 0xfe5c,
3246             rsu_read_1(sc, 0xfe5c) | 0x80);
3247
3248         rsu_write_1(sc, R92S_SYS_CLKR,
3249             rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
3250
3251         rsu_write_1(sc, 0xfe1c, 0x80);
3252
3253         /* Make sure TxDMA is ready to download firmware. */
3254         for (ntries = 0; ntries < 20; ntries++) {
3255                 reg = rsu_read_1(sc, R92S_TCR);
3256                 if ((reg & (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT)) ==
3257                     (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT))
3258                         break;
3259                 rsu_ms_delay(sc, 1);
3260         }
3261         if (ntries == 20) {
3262                 RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_TX,
3263                     "%s: TxDMA is not ready\n",
3264                     __func__);
3265                 /* Reset TxDMA. */
3266                 reg = rsu_read_1(sc, R92S_CR);
3267                 rsu_write_1(sc, R92S_CR, reg & ~R92S_CR_TXDMA_EN);
3268                 rsu_ms_delay(sc, 1);
3269                 rsu_write_1(sc, R92S_CR, reg | R92S_CR_TXDMA_EN);
3270         }
3271 }
3272
3273 static void
3274 rsu_power_off(struct rsu_softc *sc)
3275 {
3276         /* Turn RF off. */
3277         rsu_write_1(sc, R92S_RF_CTRL, 0x00);
3278         rsu_ms_delay(sc, 5);
3279
3280         /* Turn MAC off. */
3281         /* Switch control path. */
3282         rsu_write_1(sc, R92S_SYS_CLKR + 1, 0x38);
3283         /* Reset MACTOP. */
3284         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x70);
3285         rsu_write_1(sc, R92S_PMC_FSM, 0x06);
3286         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 0, 0xf9);
3287         rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1, 0xe8);
3288
3289         /* Disable AFE PLL. */
3290         rsu_write_1(sc, R92S_AFE_PLL_CTRL, 0x00);
3291         /* Disable A15V. */
3292         rsu_write_1(sc, R92S_LDOA15_CTRL, 0x54);
3293         /* Disable eFuse 1.2V. */
3294         rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x50);
3295         rsu_write_1(sc, R92S_LDOV12D_CTRL, 0x24);
3296         /* Enable AFE macro block's bandgap and Mbias. */
3297         rsu_write_1(sc, R92S_AFE_MISC, 0x30);
3298         /* Disable 1.6V LDO. */
3299         rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x56);
3300         rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x43);
3301
3302         /* Firmware - tell it to switch things off */
3303         (void) rsu_set_fw_power_state(sc, RSU_PWR_OFF);
3304 }
3305
3306 static int
3307 rsu_fw_loadsection(struct rsu_softc *sc, const uint8_t *buf, int len)
3308 {
3309         const uint8_t which = rsu_wme_ac_xfer_map[WME_AC_VO];
3310         struct rsu_data *data;
3311         struct r92s_tx_desc *txd;
3312         int mlen;
3313
3314         while (len > 0) {
3315                 data = rsu_getbuf(sc);
3316                 if (data == NULL)
3317                         return (ENOMEM);
3318                 txd = (struct r92s_tx_desc *)data->buf;
3319                 memset(txd, 0, sizeof(*txd));
3320                 if (len <= RSU_TXBUFSZ - sizeof(*txd)) {
3321                         /* Last chunk. */
3322                         txd->txdw0 |= htole32(R92S_TXDW0_LINIP);
3323                         mlen = len;
3324                 } else
3325                         mlen = RSU_TXBUFSZ - sizeof(*txd);
3326                 txd->txdw0 |= htole32(SM(R92S_TXDW0_PKTLEN, mlen));
3327                 memcpy(&txd[1], buf, mlen);
3328                 data->buflen = sizeof(*txd) + mlen;
3329                 RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FW | RSU_DEBUG_RESET,
3330                     "%s: starting transfer %p\n",
3331                     __func__, data);
3332                 STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
3333                 buf += mlen;
3334                 len -= mlen;
3335         }
3336         usbd_transfer_start(sc->sc_xfer[which]);
3337         return (0);
3338 }
3339
3340 CTASSERT(sizeof(size_t) >= sizeof(uint32_t));
3341
3342 static int
3343 rsu_load_firmware(struct rsu_softc *sc)
3344 {
3345         const struct r92s_fw_hdr *hdr;
3346         struct r92s_fw_priv *dmem;
3347         struct ieee80211com *ic = &sc->sc_ic;
3348         const uint8_t *imem, *emem;
3349         uint32_t imemsz, ememsz;
3350         const struct firmware *fw;
3351         size_t size;
3352         uint32_t reg;
3353         int ntries, error;
3354
3355         if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY) {
3356                 RSU_DPRINTF(sc, RSU_DEBUG_ANY,
3357                     "%s: Firmware already loaded\n",
3358                     __func__);
3359                 return (0);
3360         }
3361
3362         RSU_UNLOCK(sc);
3363         /* Read firmware image from the filesystem. */
3364         if ((fw = firmware_get("rsu-rtl8712fw")) == NULL) {
3365                 device_printf(sc->sc_dev,
3366                     "%s: failed load firmware of file rsu-rtl8712fw\n",
3367                     __func__);
3368                 RSU_LOCK(sc);
3369                 return (ENXIO);
3370         }
3371         RSU_LOCK(sc);
3372         size = fw->datasize;
3373         if (size < sizeof(*hdr)) {
3374                 device_printf(sc->sc_dev, "firmware too short\n");
3375                 error = EINVAL;
3376                 goto fail;
3377         }
3378         hdr = (const struct r92s_fw_hdr *)fw->data;
3379         if (hdr->signature != htole16(0x8712) &&
3380             hdr->signature != htole16(0x8192)) {
3381                 device_printf(sc->sc_dev,
3382                     "invalid firmware signature 0x%x\n",
3383                     le16toh(hdr->signature));
3384                 error = EINVAL;
3385                 goto fail;
3386         }
3387         RSU_DPRINTF(sc, RSU_DEBUG_FW, "FW V%d %02x-%02x %02x:%02x\n",
3388             le16toh(hdr->version), hdr->month, hdr->day, hdr->hour,
3389             hdr->minute);
3390
3391         /* Make sure that driver and firmware are in sync. */
3392         if (hdr->privsz != htole32(sizeof(*dmem))) {
3393                 device_printf(sc->sc_dev, "unsupported firmware image\n");
3394                 error = EINVAL;
3395                 goto fail;
3396         }
3397         /* Get FW sections sizes. */
3398         imemsz = le32toh(hdr->imemsz);
3399         ememsz = le32toh(hdr->sramsz);
3400         /* Check that all FW sections fit in image. */
3401         if (imemsz > (size_t)(size - sizeof(*hdr)) ||
3402             ememsz > (size_t)(size - sizeof(*hdr) - imemsz)) {
3403                 device_printf(sc->sc_dev, "firmware too short\n");
3404                 error = EINVAL;
3405                 goto fail;
3406         }
3407         imem = (const uint8_t *)&hdr[1];
3408         emem = imem + imemsz;
3409
3410         /* Load IMEM section. */
3411         error = rsu_fw_loadsection(sc, imem, imemsz);
3412         if (error != 0) {
3413                 device_printf(sc->sc_dev,
3414                     "could not load firmware section %s\n", "IMEM");
3415                 goto fail;
3416         }
3417         /* Wait for load to complete. */
3418         for (ntries = 0; ntries != 50; ntries++) {
3419                 rsu_ms_delay(sc, 10);
3420                 reg = rsu_read_1(sc, R92S_TCR);
3421                 if (reg & R92S_TCR_IMEM_CODE_DONE)
3422                         break;
3423         }
3424         if (ntries == 50) {
3425                 device_printf(sc->sc_dev, "timeout waiting for IMEM transfer\n");
3426                 error = ETIMEDOUT;
3427                 goto fail;
3428         }
3429         /* Load EMEM section. */
3430         error = rsu_fw_loadsection(sc, emem, ememsz);
3431         if (error != 0) {
3432                 device_printf(sc->sc_dev,
3433                     "could not load firmware section %s\n", "EMEM");
3434                 goto fail;
3435         }
3436         /* Wait for load to complete. */
3437         for (ntries = 0; ntries != 50; ntries++) {
3438                 rsu_ms_delay(sc, 10);
3439                 reg = rsu_read_2(sc, R92S_TCR);
3440                 if (reg & R92S_TCR_EMEM_CODE_DONE)
3441                         break;
3442         }
3443         if (ntries == 50) {
3444                 device_printf(sc->sc_dev, "timeout waiting for EMEM transfer\n");
3445                 error = ETIMEDOUT;
3446                 goto fail;
3447         }
3448         /* Enable CPU. */
3449         rsu_write_1(sc, R92S_SYS_CLKR,
3450             rsu_read_1(sc, R92S_SYS_CLKR) | R92S_SYS_CPU_CLKSEL);
3451         if (!(rsu_read_1(sc, R92S_SYS_CLKR) & R92S_SYS_CPU_CLKSEL)) {
3452                 device_printf(sc->sc_dev, "could not enable system clock\n");
3453                 error = EIO;
3454                 goto fail;
3455         }
3456         rsu_write_2(sc, R92S_SYS_FUNC_EN,
3457             rsu_read_2(sc, R92S_SYS_FUNC_EN) | R92S_FEN_CPUEN);
3458         if (!(rsu_read_2(sc, R92S_SYS_FUNC_EN) & R92S_FEN_CPUEN)) {
3459                 device_printf(sc->sc_dev,
3460                     "could not enable microcontroller\n");
3461                 error = EIO;
3462                 goto fail;
3463         }
3464         /* Wait for CPU to initialize. */
3465         for (ntries = 0; ntries < 100; ntries++) {
3466                 if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_IMEM_RDY)
3467                         break;
3468                 rsu_ms_delay(sc, 1);
3469         }
3470         if (ntries == 100) {
3471                 device_printf(sc->sc_dev,
3472                     "timeout waiting for microcontroller\n");
3473                 error = ETIMEDOUT;
3474                 goto fail;
3475         }
3476
3477         /* Update DMEM section before loading. */
3478         dmem = __DECONST(struct r92s_fw_priv *, &hdr->priv);
3479         memset(dmem, 0, sizeof(*dmem));
3480         dmem->hci_sel = R92S_HCI_SEL_USB | R92S_HCI_SEL_8172;
3481         dmem->nendpoints = sc->sc_nendpoints;
3482         dmem->chip_version = sc->cut;
3483         dmem->rf_config = sc->sc_rftype;
3484         dmem->vcs_type = R92S_VCS_TYPE_AUTO;
3485         dmem->vcs_mode = R92S_VCS_MODE_RTS_CTS;
3486         dmem->turbo_mode = 0;
3487         dmem->bw40_en = !! (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40);
3488         dmem->amsdu2ampdu_en = !! (sc->sc_ht);
3489         dmem->ampdu_en = !! (sc->sc_ht);
3490         dmem->agg_offload = !! (sc->sc_ht);
3491         dmem->qos_en = 1;
3492         dmem->ps_offload = 1;
3493         dmem->lowpower_mode = 1;        /* XXX TODO: configurable? */
3494         /* Load DMEM section. */
3495         error = rsu_fw_loadsection(sc, (uint8_t *)dmem, sizeof(*dmem));
3496         if (error != 0) {
3497                 device_printf(sc->sc_dev,
3498                     "could not load firmware section %s\n", "DMEM");
3499                 goto fail;
3500         }
3501         /* Wait for load to complete. */
3502         for (ntries = 0; ntries < 100; ntries++) {
3503                 if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_DMEM_CODE_DONE)
3504                         break;
3505                 rsu_ms_delay(sc, 1);
3506         }
3507         if (ntries == 100) {
3508                 device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
3509                     "DMEM");
3510                 error = ETIMEDOUT;
3511                 goto fail;
3512         }
3513         /* Wait for firmware readiness. */
3514         for (ntries = 0; ntries < 60; ntries++) {
3515                 if (!(rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY))
3516                         break;
3517                 rsu_ms_delay(sc, 1);
3518         }
3519         if (ntries == 60) {
3520                 device_printf(sc->sc_dev,
3521                     "timeout waiting for firmware readiness\n");
3522                 error = ETIMEDOUT;
3523                 goto fail;
3524         }
3525  fail:
3526         firmware_put(fw, FIRMWARE_UNLOAD);
3527         return (error);
3528 }
3529
3530
3531 static int
3532 rsu_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3533     const struct ieee80211_bpf_params *params)
3534 {
3535         struct ieee80211com *ic = ni->ni_ic;
3536         struct rsu_softc *sc = ic->ic_softc;
3537         struct rsu_data *bf;
3538
3539         /* prevent management frames from being sent if we're not ready */
3540         if (!sc->sc_running) {
3541                 m_freem(m);
3542                 return (ENETDOWN);
3543         }
3544         RSU_LOCK(sc);
3545         bf = rsu_getbuf(sc);
3546         if (bf == NULL) {
3547                 m_freem(m);
3548                 RSU_UNLOCK(sc);
3549                 return (ENOBUFS);
3550         }
3551         if (rsu_tx_start(sc, ni, m, bf) != 0) {
3552                 m_freem(m);
3553                 rsu_freebuf(sc, bf);
3554                 RSU_UNLOCK(sc);
3555                 return (EIO);
3556         }
3557         RSU_UNLOCK(sc);
3558
3559         return (0);
3560 }
3561
3562 static void
3563 rsu_rxfilter_init(struct rsu_softc *sc)
3564 {
3565         uint32_t reg;
3566
3567         RSU_ASSERT_LOCKED(sc);
3568
3569         /* Setup multicast filter. */
3570         rsu_set_multi(sc);
3571
3572         /* Adjust Rx filter. */
3573         reg = rsu_read_4(sc, R92S_RCR);
3574         reg &= ~R92S_RCR_AICV;
3575         reg |= R92S_RCR_APP_PHYSTS;
3576         if (sc->sc_rx_checksum_enable)
3577                 reg |= R92S_RCR_TCP_OFFLD_EN;
3578         rsu_write_4(sc, R92S_RCR, reg);
3579
3580         /* Update dynamic Rx filter parts. */
3581         rsu_rxfilter_refresh(sc);
3582 }
3583
3584 static void
3585 rsu_rxfilter_set(struct rsu_softc *sc, uint32_t clear, uint32_t set)
3586 {
3587         /* NB: firmware can touch this register too. */
3588         rsu_write_4(sc, R92S_RCR,
3589            (rsu_read_4(sc, R92S_RCR) & ~clear) | set);
3590 }
3591
3592 static void
3593 rsu_rxfilter_refresh(struct rsu_softc *sc)
3594 {
3595         struct ieee80211com *ic = &sc->sc_ic;
3596         uint32_t mask_all, mask_min;
3597
3598         RSU_ASSERT_LOCKED(sc);
3599
3600         /* NB: RCR_AMF / RXFLTMAP_MGT are used by firmware. */
3601         mask_all = R92S_RCR_ACF | R92S_RCR_AAP;
3602         mask_min = R92S_RCR_APM;
3603         if (sc->sc_vap_is_running)
3604                 mask_min |= R92S_RCR_CBSSID;
3605         else
3606                 mask_all |= R92S_RCR_ADF;
3607
3608         if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3609                 uint16_t rxfltmap;
3610                 if (sc->sc_vap_is_running)
3611                         rxfltmap = 0;
3612                 else
3613                         rxfltmap = R92S_RXFLTMAP_MGT_DEF;
3614                 rsu_write_2(sc, R92S_RXFLTMAP_MGT, rxfltmap);
3615         }
3616
3617         if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_MONITOR)
3618                 rsu_rxfilter_set(sc, mask_all, mask_min);
3619         else
3620                 rsu_rxfilter_set(sc, mask_min, mask_all);
3621 }
3622
3623 static int
3624 rsu_init(struct rsu_softc *sc)
3625 {
3626         struct ieee80211com *ic = &sc->sc_ic;
3627         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3628         uint8_t macaddr[IEEE80211_ADDR_LEN];
3629         int error;
3630         int i;
3631
3632         RSU_LOCK(sc);
3633
3634         if (sc->sc_running) {
3635                 RSU_UNLOCK(sc);
3636                 return (0);
3637         }
3638
3639         /* Ensure the mbuf queue is drained */
3640         rsu_drain_mbufq(sc);
3641
3642         /* Reset power management state. */
3643         rsu_write_1(sc, R92S_USB_HRPWM, 0);
3644
3645         /* Power on adapter. */
3646         if (sc->cut == 1)
3647                 rsu_power_on_acut(sc);
3648         else
3649                 rsu_power_on_bcut(sc);
3650
3651         /* Load firmware. */
3652         error = rsu_load_firmware(sc);
3653         if (error != 0)
3654                 goto fail;
3655
3656         rsu_write_4(sc, R92S_CR,
3657             rsu_read_4(sc, R92S_CR) & ~0xff000000);
3658
3659         /* Use 128 bytes pages. */
3660         rsu_write_1(sc, 0x00b5,
3661             rsu_read_1(sc, 0x00b5) | 0x01);
3662         /* Enable USB Rx aggregation. */
3663         rsu_write_1(sc, 0x00bd,
3664             rsu_read_1(sc, 0x00bd) | 0x80);
3665         /* Set USB Rx aggregation threshold. */
3666         rsu_write_1(sc, 0x00d9, 0x01);
3667         /* Set USB Rx aggregation timeout (1.7ms/4). */
3668         rsu_write_1(sc, 0xfe5b, 0x04);
3669         /* Fix USB Rx FIFO issue. */
3670         rsu_write_1(sc, 0xfe5c,
3671             rsu_read_1(sc, 0xfe5c) | 0x80);
3672
3673         /* Set MAC address. */
3674         IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3675         rsu_write_region_1(sc, R92S_MACID, macaddr, IEEE80211_ADDR_LEN);
3676
3677         /* It really takes 1.5 seconds for the firmware to boot: */
3678         usb_pause_mtx(&sc->sc_mtx, USB_MS_TO_TICKS(2000));
3679
3680         RSU_DPRINTF(sc, RSU_DEBUG_RESET, "%s: setting MAC address to %s\n",
3681             __func__,
3682             ether_sprintf(macaddr));
3683         error = rsu_fw_cmd(sc, R92S_CMD_SET_MAC_ADDRESS, macaddr,
3684             IEEE80211_ADDR_LEN);
3685         if (error != 0) {
3686                 device_printf(sc->sc_dev, "could not set MAC address\n");
3687                 goto fail;
3688         }
3689
3690         /* Initialize Rx filter. */
3691         rsu_rxfilter_init(sc);
3692
3693         /* Set PS mode fully active */
3694         error = rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
3695         if (error != 0) {
3696                 device_printf(sc->sc_dev, "could not set PS mode\n");
3697                 goto fail;
3698         }
3699
3700         /* Install static keys (if any). */
3701         error = rsu_reinit_static_keys(sc);
3702         if (error != 0)
3703                 goto fail;
3704
3705         sc->sc_extra_scan = 0;
3706         usbd_transfer_start(sc->sc_xfer[RSU_BULK_RX]);
3707
3708         /* We're ready to go. */
3709         sc->sc_running = 1;
3710         RSU_UNLOCK(sc);
3711
3712         return (0);
3713 fail:
3714         /* Need to stop all failed transfers, if any */
3715         for (i = 0; i != RSU_N_TRANSFER; i++)
3716                 usbd_transfer_stop(sc->sc_xfer[i]);
3717         RSU_UNLOCK(sc);
3718
3719         return (error);
3720 }
3721
3722 static void
3723 rsu_stop(struct rsu_softc *sc)
3724 {
3725         int i;
3726
3727         RSU_LOCK(sc);
3728         if (!sc->sc_running) {
3729                 RSU_UNLOCK(sc);
3730                 return;
3731         }
3732
3733         sc->sc_running = 0;
3734         sc->sc_vap_is_running = 0;
3735         sc->sc_calibrating = 0;
3736         taskqueue_cancel_timeout(taskqueue_thread, &sc->calib_task, NULL);
3737         taskqueue_cancel(taskqueue_thread, &sc->tx_task, NULL);
3738
3739         /* Power off adapter. */
3740         rsu_power_off(sc);
3741
3742         /*
3743          * CAM is not accessible after shutdown;
3744          * all entries are marked (by firmware?) as invalid.
3745          */
3746         memset(sc->free_keys_bmap, 0, sizeof(sc->free_keys_bmap));
3747         memset(sc->keys_bmap, 0, sizeof(sc->keys_bmap));
3748
3749         for (i = 0; i < RSU_N_TRANSFER; i++)
3750                 usbd_transfer_stop(sc->sc_xfer[i]);
3751
3752         /* Ensure the mbuf queue is drained */
3753         rsu_drain_mbufq(sc);
3754         RSU_UNLOCK(sc);
3755 }
3756
3757 /*
3758  * Note: usb_pause_mtx() actually releases the mutex before calling pause(),
3759  * which breaks any kind of driver serialisation.
3760  */
3761 static void
3762 rsu_ms_delay(struct rsu_softc *sc, int ms)
3763 {
3764
3765         //usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3766         DELAY(ms * 1000);
3767 }