xref: /freebsd/sys/dev/rtwn/if_rtwn.c (revision dd21556857e8d40f66bf5ad54754d9d52669ebf7)
1 /*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6  * Copyright (c) 2015-2016 Andriy Voskoboinyk <avos@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 /*
23  * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU/RTL8812AU/RTL8821AU.
24  */
25 #include "opt_wlan.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/sysctl.h>
30 #include <sys/lock.h>
31 #include <sys/mutex.h>
32 #include <sys/mbuf.h>
33 #include <sys/kernel.h>
34 #include <sys/socket.h>
35 #include <sys/systm.h>
36 #include <sys/malloc.h>
37 #include <sys/module.h>
38 #include <sys/bus.h>
39 #include <sys/endian.h>
40 #include <sys/linker.h>
41 #include <sys/firmware.h>
42 #include <sys/kdb.h>
43 
44 #include <net/bpf.h>
45 #include <net/if.h>
46 #include <net/if_var.h>
47 #include <net/if_arp.h>
48 #include <net/ethernet.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 #include <net/if_types.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_systm.h>
55 #include <netinet/in_var.h>
56 #include <netinet/if_ether.h>
57 #include <netinet/ip.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_regdomain.h>
61 #include <net80211/ieee80211_radiotap.h>
62 #include <net80211/ieee80211_ratectl.h>
63 
64 #include <dev/rtwn/if_rtwnreg.h>
65 #include <dev/rtwn/if_rtwnvar.h>
66 
67 #include <dev/rtwn/if_rtwn_beacon.h>
68 #include <dev/rtwn/if_rtwn_calib.h>
69 #include <dev/rtwn/if_rtwn_cam.h>
70 #include <dev/rtwn/if_rtwn_debug.h>
71 #include <dev/rtwn/if_rtwn_efuse.h>
72 #include <dev/rtwn/if_rtwn_fw.h>
73 #include <dev/rtwn/if_rtwn_ridx.h>
74 #include <dev/rtwn/if_rtwn_rx.h>
75 #include <dev/rtwn/if_rtwn_task.h>
76 #include <dev/rtwn/if_rtwn_tx.h>
77 
78 #include <dev/rtwn/rtl8192c/r92c_reg.h>
79 
80 static void		rtwn_radiotap_attach(struct rtwn_softc *);
81 static void		rtwn_vap_decrement_counters(struct rtwn_softc *,
82 			    enum ieee80211_opmode, int);
83 static void		rtwn_set_ic_opmode(struct rtwn_softc *);
84 static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
85 			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
86 			    int, const uint8_t [IEEE80211_ADDR_LEN],
87 			    const uint8_t [IEEE80211_ADDR_LEN]);
88 static void		rtwn_vap_delete(struct ieee80211vap *);
89 static int		rtwn_read_chipid(struct rtwn_softc *);
90 static int		rtwn_ioctl_reset(struct ieee80211vap *, u_long);
91 static void		rtwn_set_media_status(struct rtwn_softc *,
92 			    union sec_param *);
93 #ifndef RTWN_WITHOUT_UCODE
94 static int		rtwn_tx_fwpkt_check(struct rtwn_softc *,
95 			    struct ieee80211vap *);
96 static int		rtwn_construct_nulldata(struct rtwn_softc *,
97 			    struct ieee80211vap *, uint8_t *, int);
98 static int		rtwn_push_nulldata(struct rtwn_softc *,
99 			    struct ieee80211vap *);
100 static void		rtwn_pwrmode_init(void *);
101 static void		rtwn_set_pwrmode_cb(struct rtwn_softc *,
102 			    union sec_param *);
103 #endif
104 static void		rtwn_tsf_sync_adhoc(void *);
105 static void		rtwn_tsf_sync_adhoc_task(void *, int);
106 static void		rtwn_tsf_sync_enable(struct rtwn_softc *,
107 			    struct ieee80211vap *);
108 static void		rtwn_set_ack_preamble(struct rtwn_softc *);
109 static void		rtwn_set_mode(struct rtwn_softc *, uint8_t, int);
110 static int		rtwn_monitor_newstate(struct ieee80211vap *,
111 			    enum ieee80211_state, int);
112 static int		rtwn_newstate(struct ieee80211vap *,
113 			    enum ieee80211_state, int);
114 static void		rtwn_calc_basicrates(struct rtwn_softc *);
115 static int		rtwn_run(struct rtwn_softc *,
116 			    struct ieee80211vap *);
117 #ifndef D4054
118 static void		rtwn_watchdog(void *);
119 #endif
120 static void		rtwn_parent(struct ieee80211com *);
121 static int		rtwn_dma_init(struct rtwn_softc *);
122 static int		rtwn_mac_init(struct rtwn_softc *);
123 static void		rtwn_mrr_init(struct rtwn_softc *);
124 static void		rtwn_scan_start(struct ieee80211com *);
125 static void		rtwn_scan_curchan(struct ieee80211_scan_state *,
126 			    unsigned long);
127 static void		rtwn_scan_end(struct ieee80211com *);
128 static void		rtwn_getradiocaps(struct ieee80211com *, int, int *,
129 			    struct ieee80211_channel[]);
130 static void		rtwn_update_chw(struct ieee80211com *);
131 static void		rtwn_set_channel(struct ieee80211com *);
132 static int		rtwn_wme_update(struct ieee80211com *);
133 static void		rtwn_update_slot(struct ieee80211com *);
134 static void		rtwn_update_slot_cb(struct rtwn_softc *,
135 			    union sec_param *);
136 static void		rtwn_update_aifs(struct rtwn_softc *, uint8_t);
137 static void		rtwn_update_promisc(struct ieee80211com *);
138 static void		rtwn_update_mcast(struct ieee80211com *);
139 static int		rtwn_set_bssid(struct rtwn_softc *,
140 			    const uint8_t *, int);
141 static int		rtwn_set_macaddr(struct rtwn_softc *,
142 			    const uint8_t *, int);
143 static struct ieee80211_node *rtwn_node_alloc(struct ieee80211vap *,
144 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
145 static void		rtwn_newassoc(struct ieee80211_node *, int);
146 static void		rtwn_node_free(struct ieee80211_node *);
147 static void		rtwn_init_beacon_reg(struct rtwn_softc *);
148 static int		rtwn_init(struct rtwn_softc *);
149 static void		rtwn_stop(struct rtwn_softc *);
150 
151 MALLOC_DEFINE(M_RTWN_PRIV, "rtwn_priv", "rtwn driver private state");
152 
153 static const uint16_t wme2reg[] =
154 	{ R92C_EDCA_BE_PARAM, R92C_EDCA_BK_PARAM,
155 	  R92C_EDCA_VI_PARAM, R92C_EDCA_VO_PARAM };
156 
157 int
158 rtwn_attach(struct rtwn_softc *sc)
159 {
160 	struct ieee80211com *ic = &sc->sc_ic;
161 	int error;
162 
163 	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
164 
165 	RTWN_NT_LOCK_INIT(sc);
166 	rtwn_cmdq_init(sc);
167 #ifndef D4054
168 	callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
169 #endif
170 	callout_init(&sc->sc_calib_to, 0);
171 	callout_init(&sc->sc_pwrmode_init, 0);
172 	mbufq_init(&sc->sc_snd, ifqmaxlen);
173 
174 	RTWN_LOCK(sc);
175 	error = rtwn_read_chipid(sc);
176 	RTWN_UNLOCK(sc);
177 	if (error != 0) {
178 		device_printf(sc->sc_dev, "unsupported test chip\n");
179 		goto detach;
180 	}
181 
182 	error = rtwn_read_rom(sc);
183 	if (error != 0) {
184 		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
185 		    __func__, error);
186 		goto detach;
187 	}
188 
189 	if (sc->macid_limit > RTWN_MACID_LIMIT) {
190 		device_printf(sc->sc_dev,
191 		    "macid limit will be reduced from %d to %d\n",
192 		    sc->macid_limit, RTWN_MACID_LIMIT);
193 		sc->macid_limit = RTWN_MACID_LIMIT;
194 	}
195 	if (sc->cam_entry_limit > RTWN_CAM_ENTRY_LIMIT) {
196 		device_printf(sc->sc_dev,
197 		    "cam entry limit will be reduced from %d to %d\n",
198 		    sc->cam_entry_limit, RTWN_CAM_ENTRY_LIMIT);
199 		sc->cam_entry_limit = RTWN_CAM_ENTRY_LIMIT;
200 	}
201 	if (sc->txdesc_len > RTWN_TX_DESC_SIZE) {
202 		device_printf(sc->sc_dev,
203 		    "adjust size for Tx descriptor (current %d, needed %d)\n",
204 		    RTWN_TX_DESC_SIZE, sc->txdesc_len);
205 		goto detach;
206 	}
207 
208 	device_printf(sc->sc_dev, "MAC/BB %s, RF 6052 %dT%dR\n",
209 	    sc->name, sc->ntxchains, sc->nrxchains);
210 
211 	ic->ic_softc = sc;
212 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
213 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
214 
215 	/* set device capabilities */
216 	ic->ic_caps =
217 		  IEEE80211_C_STA		/* station mode */
218 		| IEEE80211_C_MONITOR		/* monitor mode */
219 		| IEEE80211_C_IBSS		/* adhoc mode */
220 		| IEEE80211_C_HOSTAP		/* hostap mode */
221 #if 0	/* TODO: HRPWM register setup */
222 #ifndef RTWN_WITHOUT_UCODE
223 		| IEEE80211_C_PMGT		/* Station-side power mgmt */
224 #endif
225 #endif
226 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
227 		| IEEE80211_C_SHSLOT		/* short slot time supported */
228 #if 0
229 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
230 #endif
231 		| IEEE80211_C_WPA		/* 802.11i */
232 		| IEEE80211_C_WME		/* 802.11e */
233 		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
234 		| IEEE80211_C_FF		/* Atheros fast-frames */
235 		| IEEE80211_C_TXPMGT		/* TX power control */
236 		;
237 
238 	if (sc->sc_hwcrypto != RTWN_CRYPTO_SW) {
239 		ic->ic_cryptocaps =
240 		    IEEE80211_CRYPTO_WEP |
241 		    IEEE80211_CRYPTO_TKIP |
242 		    IEEE80211_CRYPTO_AES_CCM;
243 	}
244 
245 	ic->ic_htcaps =
246 	      IEEE80211_HTCAP_SHORTGI20		/* short GI in 20MHz */
247 	    | IEEE80211_HTCAP_MAXAMSDU_3839	/* max A-MSDU length */
248 	    | IEEE80211_HTCAP_SMPS_OFF		/* SM PS mode disabled */
249 	    /* s/w capabilities */
250 	    | IEEE80211_HTC_HT			/* HT operation */
251 	    | IEEE80211_HTC_RX_AMSDU_AMPDU	/* A-MSDU in A-MPDU */
252 	    | IEEE80211_HTC_AMPDU		/* A-MPDU tx */
253 	    | IEEE80211_HTC_AMSDU		/* A-MSDU tx */
254 	    ;
255 
256 	if (sc->sc_ht40) {
257 		ic->ic_htcaps |=
258 		      IEEE80211_HTCAP_CHWIDTH40	/* 40 MHz channel width */
259 		    | IEEE80211_HTCAP_SHORTGI40	/* short GI in 40MHz */
260 		    ;
261 	}
262 
263 	ic->ic_txstream = sc->ntxchains;
264 	ic->ic_rxstream = sc->nrxchains;
265 
266 	/* Enable TX watchdog */
267 #ifdef D4054
268 	ic->ic_flags_ext |= IEEE80211_FEXT_WATCHDOG;
269 #endif
270 
271 	/* Adjust capabilities. */
272 	rtwn_adj_devcaps(sc);
273 
274 	rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
275 	    ic->ic_channels);
276 
277 	/* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
278 
279 	ieee80211_ifattach(ic);
280 	ic->ic_raw_xmit = rtwn_raw_xmit;
281 	ic->ic_scan_start = rtwn_scan_start;
282 	sc->sc_scan_curchan = ic->ic_scan_curchan;
283 	ic->ic_scan_curchan = rtwn_scan_curchan;
284 	ic->ic_scan_end = rtwn_scan_end;
285 	ic->ic_getradiocaps = rtwn_getradiocaps;
286 	ic->ic_update_chw = rtwn_update_chw;
287 	ic->ic_set_channel = rtwn_set_channel;
288 	ic->ic_transmit = rtwn_transmit;
289 	ic->ic_parent = rtwn_parent;
290 	ic->ic_vap_create = rtwn_vap_create;
291 	ic->ic_vap_delete = rtwn_vap_delete;
292 	ic->ic_wme.wme_update = rtwn_wme_update;
293 	ic->ic_updateslot = rtwn_update_slot;
294 	ic->ic_update_promisc = rtwn_update_promisc;
295 	ic->ic_update_mcast = rtwn_update_mcast;
296 	ic->ic_node_alloc = rtwn_node_alloc;
297 	ic->ic_newassoc = rtwn_newassoc;
298 	sc->sc_node_free = ic->ic_node_free;
299 	ic->ic_node_free = rtwn_node_free;
300 
301 	rtwn_postattach(sc);
302 	rtwn_radiotap_attach(sc);
303 
304 	if (bootverbose)
305 		ieee80211_announce(ic);
306 
307 	return (0);
308 
309 detach:
310 	return (ENXIO);			/* failure */
311 }
312 
313 static void
314 rtwn_radiotap_attach(struct rtwn_softc *sc)
315 {
316 	struct rtwn_rx_radiotap_header *rxtap = &sc->sc_rxtap;
317 	struct rtwn_tx_radiotap_header *txtap = &sc->sc_txtap;
318 
319 	ieee80211_radiotap_attach(&sc->sc_ic,
320 	    &txtap->wt_ihdr, sizeof(*txtap), RTWN_TX_RADIOTAP_PRESENT,
321 	    &rxtap->wr_ihdr, sizeof(*rxtap), RTWN_RX_RADIOTAP_PRESENT);
322 }
323 
324 #ifdef	RTWN_DEBUG
325 static int
326 rtwn_sysctl_reg_readwrite(SYSCTL_HANDLER_ARGS)
327 {
328 	struct rtwn_softc *sc = arg1;
329 	int error;
330 	uint32_t val;
331 
332 	if (sc->sc_reg_addr > 0xffff)
333 		return (EINVAL);
334 
335 	RTWN_LOCK(sc);
336 	val = rtwn_read_4(sc, sc->sc_reg_addr);
337 	RTWN_UNLOCK(sc);
338 	error = sysctl_handle_int(oidp, &val, 0, req);
339 	if (error || !req->newptr)
340 		return (error);
341 	RTWN_LOCK(sc);
342 	rtwn_write_4(sc, sc->sc_reg_addr, val);
343 	RTWN_UNLOCK(sc);
344 	return (0);
345 }
346 #endif	/* RTWN_DEBUG */
347 
348 void
349 rtwn_sysctlattach(struct rtwn_softc *sc)
350 {
351 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
352 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
353 
354 	sc->sc_reg_addr = 0;
355 #ifdef	RTWN_DEBUG
356 	SYSCTL_ADD_UINT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
357 	    "reg_addr", CTLFLAG_RW, &sc->sc_reg_addr,
358 	    sc->sc_reg_addr, "debug register address");
359 	SYSCTL_ADD_PROC(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
360 	   "reg_val", CTLTYPE_INT | CTLFLAG_RW, sc, 0,
361 	    rtwn_sysctl_reg_readwrite, "I", "debug register read/write");
362 #endif	/* RTWN_DEBUG */
363 
364 	sc->sc_ht40 = 0;
365 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
366 	    "ht40", CTLFLAG_RDTUN, &sc->sc_ht40,
367 	    sc->sc_ht40, "Enable 40 MHz mode support");
368 
369 	sc->sc_ena_tsf64 = 0;
370 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
371 	    "ena_tsf64", CTLFLAG_RWTUN, &sc->sc_ena_tsf64,
372 	    sc->sc_ena_tsf64, "Enable/disable per-packet TSF64 reporting");
373 
374 #ifdef RTWN_DEBUG
375 	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
376 	    "debug", CTLFLAG_RWTUN, &sc->sc_debug, sc->sc_debug,
377 	    "Control debugging printfs");
378 #endif
379 
380 	sc->sc_hwcrypto = RTWN_CRYPTO_PAIR;
381 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
382 	    "hwcrypto", CTLFLAG_RDTUN, &sc->sc_hwcrypto,
383 	    sc->sc_hwcrypto, "Enable h/w crypto: "
384 	    "0 - disable, 1 - pairwise keys, 2 - all keys");
385 	if (sc->sc_hwcrypto >= RTWN_CRYPTO_MAX)
386 		sc->sc_hwcrypto = RTWN_CRYPTO_FULL;
387 
388 	sc->sc_ratectl_sysctl = RTWN_RATECTL_NET80211;
389 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
390 	    "ratectl", CTLFLAG_RDTUN, &sc->sc_ratectl_sysctl,
391 	    sc->sc_ratectl_sysctl, "Select rate control mechanism: "
392 	    "0 - disabled, 1 - via net80211, 2 - via firmware");
393 	if (sc->sc_ratectl_sysctl >= RTWN_RATECTL_MAX)
394 		sc->sc_ratectl_sysctl = RTWN_RATECTL_FW;
395 
396 	sc->sc_ratectl = sc->sc_ratectl_sysctl;
397 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
398 	    "ratectl_selected", CTLFLAG_RD, &sc->sc_ratectl,
399 	    sc->sc_ratectl,
400 	    "Currently selected rate control mechanism (by the driver)");
401 }
402 
403 void
404 rtwn_detach(struct rtwn_softc *sc)
405 {
406 	struct ieee80211com *ic = &sc->sc_ic;
407 
408 	if (ic->ic_softc == sc) {
409 		/* Stop command queue. */
410 		RTWN_CMDQ_LOCK(sc);
411 		sc->sc_detached = 1;
412 		RTWN_CMDQ_UNLOCK(sc);
413 
414 		ieee80211_draintask(ic, &sc->cmdq_task);
415 		ieee80211_ifdetach(ic);
416 	}
417 
418 	rtwn_cmdq_destroy(sc);
419 	if (RTWN_NT_LOCK_INITIALIZED(sc))
420 		RTWN_NT_LOCK_DESTROY(sc);
421 }
422 
423 void
424 rtwn_suspend(struct rtwn_softc *sc)
425 {
426 	struct ieee80211com *ic = &sc->sc_ic;
427 
428 	ieee80211_suspend_all(ic);
429 }
430 
431 void
432 rtwn_resume(struct rtwn_softc *sc)
433 {
434 	struct ieee80211com *ic = &sc->sc_ic;
435 
436 	ieee80211_resume_all(ic);
437 }
438 
439 void
440 rtwn_attach_vht_cap_info_mcs(struct rtwn_softc *sc)
441 {
442 	struct ieee80211com *ic = &sc->sc_ic;
443 	uint32_t rx_mcs = 0, tx_mcs = 0;
444 
445 	for (int i = 0 ; i < 8; i++) {
446 		if (i < sc->ntxchains)
447 			tx_mcs |= (IEEE80211_VHT_MCS_SUPPORT_0_9 << (i*2));
448 		else
449 			tx_mcs |= (IEEE80211_VHT_MCS_NOT_SUPPORTED << (i*2));
450 
451 		if (i < sc->nrxchains)
452 			rx_mcs |= (IEEE80211_VHT_MCS_SUPPORT_0_9 << (i*2));
453 		else
454 			rx_mcs |= (IEEE80211_VHT_MCS_NOT_SUPPORTED << (i*2));
455 	}
456 	ic->ic_vht_cap.supp_mcs.rx_mcs_map = rx_mcs;
457 	ic->ic_vht_cap.supp_mcs.rx_highest = 0;
458 	ic->ic_vht_cap.supp_mcs.tx_mcs_map = tx_mcs;
459 	ic->ic_vht_cap.supp_mcs.tx_highest = 0;
460 }
461 
462 static void
463 rtwn_vap_decrement_counters(struct rtwn_softc *sc,
464     enum ieee80211_opmode opmode, int id)
465 {
466 
467 	RTWN_ASSERT_LOCKED(sc);
468 
469 	if (id != RTWN_VAP_ID_INVALID) {
470 		KASSERT(id == 0 || id == 1, ("wrong vap id %d!\n", id));
471 		KASSERT(sc->vaps[id] != NULL, ("vap pointer is NULL\n"));
472 		sc->vaps[id] = NULL;
473 	}
474 
475 	switch (opmode) {
476 	case IEEE80211_M_HOSTAP:
477 		sc->ap_vaps--;
478 		/* FALLTHROUGH */
479 	case IEEE80211_M_IBSS:
480 		sc->bcn_vaps--;
481 		/* FALLTHROUGH */
482 	case IEEE80211_M_STA:
483 		sc->nvaps--;
484 		break;
485 	case IEEE80211_M_MONITOR:
486 		sc->mon_vaps--;
487 		break;
488 	default:
489 		KASSERT(0, ("wrong opmode %d\n", opmode));
490 		break;
491 	}
492 
493 	KASSERT(sc->vaps_running >= 0 && sc->monvaps_running >= 0,
494 	    ("number of running vaps is negative (vaps %d, monvaps %d)\n",
495 	    sc->vaps_running, sc->monvaps_running));
496 	KASSERT(sc->vaps_running - sc->monvaps_running <= RTWN_PORT_COUNT,
497 	    ("number of running vaps is too big (vaps %d, monvaps %d)\n",
498 	    sc->vaps_running, sc->monvaps_running));
499 
500 	KASSERT(sc->nvaps >= 0 && sc->nvaps <= RTWN_PORT_COUNT,
501 	    ("wrong value %d for nvaps\n", sc->nvaps));
502 	KASSERT(sc->mon_vaps >= 0, ("mon_vaps is negative (%d)\n",
503 	    sc->mon_vaps));
504 	KASSERT(sc->bcn_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
505 	    sc->bcn_vaps <= RTWN_PORT_COUNT) || sc->bcn_vaps <= 1),
506 	    ("bcn_vaps value %d is wrong\n", sc->bcn_vaps));
507 	KASSERT(sc->ap_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
508 	    sc->ap_vaps <= RTWN_PORT_COUNT) || sc->ap_vaps <= 1),
509 	    ("ap_vaps value %d is wrong\n", sc->ap_vaps));
510 }
511 
512 static void
513 rtwn_set_ic_opmode(struct rtwn_softc *sc)
514 {
515 	struct ieee80211com *ic = &sc->sc_ic;
516 
517 	RTWN_ASSERT_LOCKED(sc);
518 
519 	/* for ieee80211_reset_erp() */
520 	if (sc->bcn_vaps - sc->ap_vaps > 0)
521 		ic->ic_opmode = IEEE80211_M_IBSS;
522 	else if (sc->ap_vaps > 0)
523 		ic->ic_opmode = IEEE80211_M_HOSTAP;
524 	else if (sc->nvaps > 0)
525 		ic->ic_opmode = IEEE80211_M_STA;
526 	else
527 		ic->ic_opmode = IEEE80211_M_MONITOR;
528 }
529 
530 static struct ieee80211vap *
531 rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
532     enum ieee80211_opmode opmode, int flags,
533     const uint8_t bssid[IEEE80211_ADDR_LEN],
534     const uint8_t mac[IEEE80211_ADDR_LEN])
535 {
536 	struct rtwn_softc *sc = ic->ic_softc;
537 	struct rtwn_vap *uvp;
538 	struct ieee80211vap *vap;
539 	int id = RTWN_VAP_ID_INVALID;
540 
541 	RTWN_LOCK(sc);
542 	KASSERT(sc->nvaps <= RTWN_PORT_COUNT,
543 	    ("nvaps overflow (%d > %d)\n", sc->nvaps, RTWN_PORT_COUNT));
544 	KASSERT(sc->ap_vaps <= RTWN_PORT_COUNT,
545 	    ("ap_vaps overflow (%d > %d)\n", sc->ap_vaps, RTWN_PORT_COUNT));
546 	KASSERT(sc->bcn_vaps <= RTWN_PORT_COUNT,
547 	    ("bcn_vaps overflow (%d > %d)\n", sc->bcn_vaps, RTWN_PORT_COUNT));
548 
549 	if (opmode != IEEE80211_M_MONITOR) {
550 		switch (sc->nvaps) {
551 		case 0:
552 			id = 0;
553 			break;
554 		case 1:
555 			if (sc->vaps[1] == NULL)
556 				id = 1;
557 			else if (sc->vaps[0] == NULL)
558 				id = 0;
559 			KASSERT(id != RTWN_VAP_ID_INVALID,
560 			    ("no free ports left\n"));
561 			break;
562 		case 2:
563 		default:
564 			goto fail;
565 		}
566 
567 		if (opmode == IEEE80211_M_IBSS ||
568 		    opmode == IEEE80211_M_HOSTAP) {
569 			if ((sc->bcn_vaps == 1 && !RTWN_CHIP_HAS_BCNQ1(sc)) ||
570 			    sc->bcn_vaps == RTWN_PORT_COUNT)
571 				goto fail;
572 		}
573 	}
574 
575 	switch (opmode) {
576 	case IEEE80211_M_HOSTAP:
577 		sc->ap_vaps++;
578 		/* FALLTHROUGH */
579 	case IEEE80211_M_IBSS:
580 		sc->bcn_vaps++;
581 		/* FALLTHROUGH */
582 	case IEEE80211_M_STA:
583 		sc->nvaps++;
584 		break;
585 	case IEEE80211_M_MONITOR:
586 		sc->mon_vaps++;
587 		break;
588 	default:
589 		KASSERT(0, ("unknown opmode %d\n", opmode));
590 		goto fail;
591 	}
592 	RTWN_UNLOCK(sc);
593 
594 	uvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
595 	uvp->id = id;
596 	if (id != RTWN_VAP_ID_INVALID) {
597 		RTWN_LOCK(sc);
598 		sc->vaps[id] = uvp;
599 		RTWN_UNLOCK(sc);
600 	}
601 	vap = &uvp->vap;
602 	/* enable s/w bmiss handling for sta mode */
603 
604 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
605 	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
606 		/* out of memory */
607 		free(uvp, M_80211_VAP);
608 
609 		RTWN_LOCK(sc);
610 		rtwn_vap_decrement_counters(sc, opmode, id);
611 		RTWN_UNLOCK(sc);
612 
613 		return (NULL);
614 	}
615 
616 	rtwn_beacon_init(sc, &uvp->bcn_desc.txd[0], uvp->id);
617 	rtwn_vap_preattach(sc, vap);
618 
619 	/* override state transition machine */
620 	uvp->newstate = vap->iv_newstate;
621 	if (opmode == IEEE80211_M_MONITOR)
622 		vap->iv_newstate = rtwn_monitor_newstate;
623 	else
624 		vap->iv_newstate = rtwn_newstate;
625 	vap->iv_update_beacon = rtwn_update_beacon;
626 	vap->iv_reset = rtwn_ioctl_reset;
627 	vap->iv_key_alloc = rtwn_key_alloc;
628 	vap->iv_key_set = rtwn_key_set;
629 	vap->iv_key_delete = rtwn_key_delete;
630 	vap->iv_max_aid = sc->macid_limit;
631 
632 	/* 802.11n parameters */
633 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
634 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
635 	vap->iv_ampdu_limit = IEEE80211_HTCAP_MAXRXAMPDU_64K;
636 
637 	TIMEOUT_TASK_INIT(taskqueue_thread, &uvp->tx_beacon_csa, 0,
638 	    rtwn_tx_beacon_csa, vap);
639 	if (opmode == IEEE80211_M_IBSS) {
640 		uvp->recv_mgmt = vap->iv_recv_mgmt;
641 		vap->iv_recv_mgmt = rtwn_adhoc_recv_mgmt;
642 		TASK_INIT(&uvp->tsf_sync_adhoc_task, 0,
643 		    rtwn_tsf_sync_adhoc_task, vap);
644 		callout_init(&uvp->tsf_sync_adhoc, 0);
645 	}
646 
647 	/*
648 	 * NB: driver can select net80211 RA even when user requests
649 	 * another mechanism.
650 	 */
651 	ieee80211_ratectl_init(vap);
652 
653 	/* complete setup */
654 	ieee80211_vap_attach(vap, ieee80211_media_change,
655 	    ieee80211_media_status, mac);
656 
657 	RTWN_LOCK(sc);
658 	rtwn_set_ic_opmode(sc);
659 	if (sc->sc_flags & RTWN_RUNNING) {
660 		if (uvp->id != RTWN_VAP_ID_INVALID)
661 			rtwn_set_macaddr(sc, vap->iv_myaddr, uvp->id);
662 
663 		rtwn_rxfilter_update(sc);
664 	}
665 	RTWN_UNLOCK(sc);
666 
667 	return (vap);
668 
669 fail:
670 	RTWN_UNLOCK(sc);
671 	return (NULL);
672 }
673 
674 static void
675 rtwn_vap_delete(struct ieee80211vap *vap)
676 {
677 	struct ieee80211com *ic = vap->iv_ic;
678 	struct rtwn_softc *sc = ic->ic_softc;
679 	struct rtwn_vap *uvp = RTWN_VAP(vap);
680 	int i;
681 
682 	/* Put vap into INIT state + stop device if needed. */
683 	ieee80211_stop(vap);
684 	for (i = 0; i < NET80211_IV_NSTATE_NUM; i++)
685 		ieee80211_draintask(ic, &vap->iv_nstate_task[i]);
686 	ieee80211_draintask(ic, &ic->ic_parent_task);
687 
688 	RTWN_LOCK(sc);
689 	/* Cancel any unfinished Tx. */
690 	rtwn_reset_lists(sc, vap);
691 	if (uvp->bcn_mbuf != NULL)
692 		m_freem(uvp->bcn_mbuf);
693 	rtwn_vap_decrement_counters(sc, vap->iv_opmode, uvp->id);
694 	rtwn_set_ic_opmode(sc);
695 	if (sc->sc_flags & RTWN_RUNNING)
696 		rtwn_rxfilter_update(sc);
697 	RTWN_UNLOCK(sc);
698 
699 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
700 		ieee80211_draintask(ic, &uvp->tsf_sync_adhoc_task);
701 		callout_drain(&uvp->tsf_sync_adhoc);
702 	}
703 
704 	ieee80211_ratectl_deinit(vap);
705 	ieee80211_vap_detach(vap);
706 	free(uvp, M_80211_VAP);
707 }
708 
709 static int
710 rtwn_read_chipid(struct rtwn_softc *sc)
711 {
712 	uint32_t reg;
713 
714 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
715 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)	/* test chip */
716 		return (EOPNOTSUPP);
717 
718 	rtwn_read_chipid_vendor(sc, reg);
719 
720 	return (0);
721 }
722 
723 static int
724 rtwn_ioctl_reset(struct ieee80211vap *vap, u_long cmd)
725 {
726 	int error;
727 
728 	switch (cmd) {
729 #ifndef RTWN_WITHOUT_UCODE
730 	case IEEE80211_IOC_POWERSAVE:
731 	case IEEE80211_IOC_POWERSAVESLEEP:
732 	{
733 		struct rtwn_softc *sc = vap->iv_ic->ic_softc;
734 		struct rtwn_vap *uvp = RTWN_VAP(vap);
735 
736 		if (vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
737 			RTWN_LOCK(sc);
738 			if (sc->sc_flags & RTWN_RUNNING)
739 				error = rtwn_set_pwrmode(sc, vap, 1);
740 			else
741 				error = 0;
742 			RTWN_UNLOCK(sc);
743 			if (error != 0)
744 				error = ENETRESET;
745 		} else
746 			error = EOPNOTSUPP;
747 		break;
748 	}
749 #endif
750 	case IEEE80211_IOC_SHORTGI:
751 	case IEEE80211_IOC_RTSTHRESHOLD:
752 	case IEEE80211_IOC_PROTMODE:
753 	case IEEE80211_IOC_HTPROTMODE:
754 	case IEEE80211_IOC_LDPC:
755 		error = 0;
756 		break;
757 	case IEEE80211_IOC_TXPOWER:
758 		{
759 			struct rtwn_softc *sc = vap->iv_ic->ic_softc;
760 			RTWN_LOCK(sc);
761 			error = rtwn_set_tx_power(sc, vap);
762 			RTWN_UNLOCK(sc);
763 		}
764 		break;
765 	default:
766 		error = ENETRESET;
767 		break;
768 	}
769 
770 	return (error);
771 }
772 
773 static void
774 rtwn_set_media_status(struct rtwn_softc *sc, union sec_param *data)
775 {
776 	sc->sc_set_media_status(sc, data->macid);
777 }
778 
779 #ifndef RTWN_WITHOUT_UCODE
780 static int
781 rtwn_tx_fwpkt_check(struct rtwn_softc *sc, struct ieee80211vap *vap)
782 {
783 	int ntries, error;
784 
785 	for (ntries = 0; ntries < 5; ntries++) {
786 		error = rtwn_push_nulldata(sc, vap);
787 		if (error == 0)
788 			break;
789 	}
790 	if (ntries == 5) {
791 		device_printf(sc->sc_dev,
792 		    "%s: cannot push f/w frames into chip, error %d!\n",
793 		    __func__, error);
794 		return (error);
795 	}
796 
797 	return (0);
798 }
799 
800 static int
801 rtwn_construct_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap,
802     uint8_t *ptr, int qos)
803 {
804 	struct rtwn_vap *uvp = RTWN_VAP(vap);
805 	struct ieee80211com *ic = &sc->sc_ic;
806 	struct rtwn_tx_desc_common *txd;
807 	struct ieee80211_frame *wh;
808 	int pktlen;
809 
810 	/* XXX obtain from net80211 */
811 	wh = (struct ieee80211_frame *)(ptr + sc->txdesc_len);
812 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
813 	wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
814 	IEEE80211_ADDR_COPY(wh->i_addr1, vap->iv_bss->ni_bssid);
815 	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
816 	IEEE80211_ADDR_COPY(wh->i_addr3, vap->iv_bss->ni_macaddr);
817 
818 	txd = (struct rtwn_tx_desc_common *)ptr;
819 	txd->offset = sc->txdesc_len;
820 	pktlen = sc->txdesc_len;
821 	if (qos) {
822 		struct ieee80211_qosframe *qwh;
823 		const int tid = WME_AC_TO_TID(WME_AC_BE);
824 
825 		qwh = (struct ieee80211_qosframe *)wh;
826 		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS_NULL;
827 		qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
828 
829 		txd->pktlen = htole16(sizeof(struct ieee80211_qosframe));
830 		pktlen += sizeof(struct ieee80211_qosframe);
831 	} else {
832 		wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA;
833 
834 		txd->pktlen = htole16(sizeof(struct ieee80211_frame));
835 		pktlen += sizeof(struct ieee80211_frame);
836 	}
837 
838 	rtwn_fill_tx_desc_null(sc, ptr,
839 	    ic->ic_curmode == IEEE80211_MODE_11B, qos, uvp->id);
840 
841 	return (pktlen);
842 }
843 
844 static int
845 rtwn_push_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap)
846 {
847 	struct rtwn_vap *uvp = RTWN_VAP(vap);
848 	struct ieee80211com *ic = vap->iv_ic;
849 	struct ieee80211_channel *c = ic->ic_curchan;
850 	struct mbuf *m;
851 	uint8_t *ptr;
852 	int required_size, bcn_size, null_size, null_data, error;
853 
854 	if (!(sc->sc_flags & RTWN_FW_LOADED))
855 		return (0);	/* requires firmware */
856 
857 	KASSERT(sc->page_size > 0, ("page size was not set!\n"));
858 
859 	/* Leave some space for beacon (multi-vap) */
860 	bcn_size = roundup(RTWN_BCN_MAX_SIZE, sc->page_size);
861 	/* 1 page for Null Data + 1 page for Qos Null Data frames. */
862 	required_size = bcn_size + sc->page_size * 2;
863 
864 	m = m_get2(required_size, M_NOWAIT, MT_DATA, M_PKTHDR);
865 	if (m == NULL)
866 		return (ENOMEM);
867 
868 	/* Setup beacon descriptor. */
869 	rtwn_beacon_set_rate(sc, &uvp->bcn_desc.txd[0],
870 	    IEEE80211_IS_CHAN_5GHZ(c));
871 
872 	ptr = mtod(m, uint8_t *);
873 	memset(ptr, 0, required_size - sc->txdesc_len);
874 
875 	/* Construct Null Data frame. */
876 	ptr += bcn_size - sc->txdesc_len;
877 	null_size = rtwn_construct_nulldata(sc, vap, ptr, 0);
878 	KASSERT(null_size < sc->page_size,
879 	    ("recalculate size for Null Data frame\n"));
880 
881 	/* Construct Qos Null Data frame. */
882 	ptr += roundup(null_size, sc->page_size);
883 	null_size = rtwn_construct_nulldata(sc, vap, ptr, 1);
884 	KASSERT(null_size < sc->page_size,
885 	    ("recalculate size for Qos Null Data frame\n"));
886 
887 	/* Do not try to detect a beacon here. */
888 	rtwn_setbits_1_shift(sc, R92C_CR, 0, R92C_CR_ENSWBCN, 1);
889 	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
890 	    R92C_FWHW_TXQ_CTRL_REAL_BEACON, 0, 2);
891 
892 	if (uvp->bcn_mbuf != NULL) {
893 		rtwn_beacon_unload(sc, uvp->id);
894 		m_freem(uvp->bcn_mbuf);
895 	}
896 
897 	m->m_pkthdr.len = m->m_len = required_size - sc->txdesc_len;
898 	uvp->bcn_mbuf = m;
899 
900 	error = rtwn_tx_beacon_check(sc, uvp);
901 	if (error != 0) {
902 		RTWN_DPRINTF(sc, RTWN_DEBUG_BEACON,
903 		    "%s: frame was not recognized!\n", __func__);
904 		goto fail;
905 	}
906 
907 	/* Setup addresses in firmware. */
908 	null_data = howmany(bcn_size, sc->page_size);
909 	error = rtwn_set_rsvd_page(sc, 0, null_data, null_data + 1);
910 	if (error != 0) {
911 		device_printf(sc->sc_dev,
912 		    "%s: CMD_RSVD_PAGE was not sent, error %d\n",
913 		    __func__, error);
914 		goto fail;
915 	}
916 
917 fail:
918 	/* Re-enable beacon detection. */
919 	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
920 	    0, R92C_FWHW_TXQ_CTRL_REAL_BEACON, 2);
921 	rtwn_setbits_1_shift(sc, R92C_CR, R92C_CR_ENSWBCN, 0, 1);
922 
923 	/* Restore beacon (if present). */
924 	if (sc->bcn_vaps > 0 && sc->vaps[!uvp->id] != NULL) {
925 		struct rtwn_vap *uvp2 = sc->vaps[!uvp->id];
926 
927 		if (uvp2->curr_mode != R92C_MSR_NOLINK)
928 			error = rtwn_tx_beacon_check(sc, uvp2);
929 	}
930 
931 	return (error);
932 }
933 
934 static void
935 rtwn_pwrmode_init(void *arg)
936 {
937 	struct rtwn_softc *sc = arg;
938 
939 	rtwn_cmd_sleepable(sc, NULL, 0, rtwn_set_pwrmode_cb);
940 }
941 
942 static void
943 rtwn_set_pwrmode_cb(struct rtwn_softc *sc, union sec_param *data)
944 {
945 	struct ieee80211vap *vap = &sc->vaps[0]->vap;
946 
947 	if (vap != NULL)
948 		rtwn_set_pwrmode(sc, vap, 1);
949 }
950 #endif
951 
952 static void
953 rtwn_tsf_sync_adhoc(void *arg)
954 {
955 	struct ieee80211vap *vap = arg;
956 	struct ieee80211com *ic = vap->iv_ic;
957 	struct rtwn_vap *uvp = RTWN_VAP(vap);
958 
959 	if (uvp->curr_mode != R92C_MSR_NOLINK) {
960 		/* Do it in process context. */
961 		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
962 	}
963 }
964 
965 /*
966  * Workaround for TSF synchronization:
967  * when BSSID filter in IBSS mode is not set
968  * (and TSF synchronization is enabled), then any beacon may update it.
969  * This routine synchronizes it when BSSID matching is enabled (IBSS merge
970  * is not possible during this period).
971  *
972  * NOTE: there is no race with rtwn_newstate(), since it uses the same
973  * taskqueue.
974  */
975 static void
976 rtwn_tsf_sync_adhoc_task(void *arg, int pending)
977 {
978 	struct ieee80211vap *vap = arg;
979 	struct rtwn_vap *uvp = RTWN_VAP(vap);
980 	struct rtwn_softc *sc = vap->iv_ic->ic_softc;
981 	struct ieee80211_node *ni;
982 
983 	RTWN_LOCK(sc);
984 	ni = ieee80211_ref_node(vap->iv_bss);
985 
986 	/* Accept beacons with the same BSSID. */
987 	rtwn_set_rx_bssid_all(sc, 0);
988 
989 	/* Deny RCR updates. */
990 	sc->sc_flags |= RTWN_RCR_LOCKED;
991 
992 	/* Enable synchronization. */
993 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
994 	    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
995 
996 	/* Synchronize. */
997 	rtwn_delay(sc, ni->ni_intval * 5 * 1000);
998 
999 	/* Disable synchronization. */
1000 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
1001 	    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
1002 
1003 	/* Accept all beacons. */
1004 	sc->sc_flags &= ~RTWN_RCR_LOCKED;
1005 	rtwn_set_rx_bssid_all(sc, 1);
1006 
1007 	/* Schedule next TSF synchronization. */
1008 	callout_reset(&uvp->tsf_sync_adhoc, 60*hz, rtwn_tsf_sync_adhoc, vap);
1009 
1010 	ieee80211_free_node(ni);
1011 	RTWN_UNLOCK(sc);
1012 }
1013 
1014 static void
1015 rtwn_tsf_sync_enable(struct rtwn_softc *sc, struct ieee80211vap *vap)
1016 {
1017 	struct ieee80211com *ic = &sc->sc_ic;
1018 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1019 
1020 	/* Reset TSF. */
1021 	rtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RESET(uvp->id));
1022 
1023 	switch (vap->iv_opmode) {
1024 	case IEEE80211_M_STA:
1025 		/* Enable TSF synchronization. */
1026 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
1027 		    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
1028 		/* Enable TSF beacon handling, needed for RA */
1029 		rtwn_sta_beacon_enable(sc, uvp->id, true);
1030 		break;
1031 	case IEEE80211_M_IBSS:
1032 		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
1033 		/* FALLTHROUGH */
1034 	case IEEE80211_M_HOSTAP:
1035 		/* Enable beaconing. */
1036 		rtwn_beacon_enable(sc, uvp->id, 1);
1037 		break;
1038 	default:
1039 		device_printf(sc->sc_dev, "undefined opmode %d\n",
1040 		    vap->iv_opmode);
1041 		return;
1042 	}
1043 }
1044 
1045 static void
1046 rtwn_set_ack_preamble(struct rtwn_softc *sc)
1047 {
1048 	struct ieee80211com *ic = &sc->sc_ic;
1049 	uint32_t reg;
1050 
1051 	reg = rtwn_read_4(sc, R92C_WMAC_TRXPTCL_CTL);
1052 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1053 		reg |= R92C_WMAC_TRXPTCL_SHPRE;
1054 	else
1055 		reg &= ~R92C_WMAC_TRXPTCL_SHPRE;
1056 	rtwn_write_4(sc, R92C_WMAC_TRXPTCL_CTL, reg);
1057 }
1058 
1059 static void
1060 rtwn_set_mode(struct rtwn_softc *sc, uint8_t mode, int id)
1061 {
1062 
1063 	rtwn_setbits_1(sc, R92C_MSR, R92C_MSR_MASK << id * 2, mode << id * 2);
1064 	if (sc->vaps[id] != NULL)
1065 		sc->vaps[id]->curr_mode = mode;
1066 }
1067 
1068 static int
1069 rtwn_monitor_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate,
1070     int arg)
1071 {
1072 	struct ieee80211com *ic = vap->iv_ic;
1073 	struct rtwn_softc *sc = ic->ic_softc;
1074 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1075 
1076 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1077 	    ieee80211_state_name[vap->iv_state],
1078 	    ieee80211_state_name[nstate]);
1079 
1080 	if (vap->iv_state != nstate) {
1081 		IEEE80211_UNLOCK(ic);
1082 		RTWN_LOCK(sc);
1083 
1084 		switch (nstate) {
1085 		case IEEE80211_S_INIT:
1086 			sc->vaps_running--;
1087 			sc->monvaps_running--;
1088 
1089 			if (sc->vaps_running == 0) {
1090 				/* Turn link LED off. */
1091 				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1092 			}
1093 			break;
1094 		case IEEE80211_S_RUN:
1095 			sc->vaps_running++;
1096 			sc->monvaps_running++;
1097 
1098 			if (sc->vaps_running == 1) {
1099 				/* Turn link LED on. */
1100 				rtwn_set_led(sc, RTWN_LED_LINK, 1);
1101 			}
1102 			break;
1103 		default:
1104 			/* NOTREACHED */
1105 			break;
1106 		}
1107 
1108 		RTWN_UNLOCK(sc);
1109 		IEEE80211_LOCK(ic);
1110 	}
1111 
1112 	return (uvp->newstate(vap, nstate, arg));
1113 }
1114 
1115 static int
1116 rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1117 {
1118 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1119 	struct ieee80211com *ic = vap->iv_ic;
1120 	struct rtwn_softc *sc = ic->ic_softc;
1121 	enum ieee80211_state ostate;
1122 	int error, early_newstate;
1123 
1124 	ostate = vap->iv_state;
1125 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1126 	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
1127 
1128 	if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC &&
1129 	    ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_RUN) {
1130 		/* need to call iv_newstate() firstly */
1131 		error = uvp->newstate(vap, nstate, arg);
1132 		if (error != 0)
1133 			return (error);
1134 
1135 		early_newstate = 1;
1136 	} else
1137 		early_newstate = 0;
1138 
1139 	if (ostate == IEEE80211_S_CSA) {
1140 		taskqueue_cancel_timeout(taskqueue_thread,
1141 		    &uvp->tx_beacon_csa, NULL);
1142 
1143 		/*
1144 		 * In multi-vap case second counter may not be cleared
1145 		 * properly.
1146 		 */
1147 		vap->iv_csa_count = 0;
1148 	}
1149 	IEEE80211_UNLOCK(ic);
1150 	RTWN_LOCK(sc);
1151 
1152 	if (ostate == IEEE80211_S_CSA) {
1153 		/* Unblock all queues (multi-vap case). */
1154 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1155 	}
1156 
1157 	if ((ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_CSA) ||
1158 	    ostate == IEEE80211_S_CSA) {
1159 		sc->vaps_running--;
1160 
1161 		/* Set media status to 'No Link'. */
1162 		rtwn_set_mode(sc, R92C_MSR_NOLINK, uvp->id);
1163 
1164 		if (vap->iv_opmode == IEEE80211_M_IBSS) {
1165 			/* Stop periodical TSF synchronization. */
1166 			callout_stop(&uvp->tsf_sync_adhoc);
1167 		}
1168 
1169 		/* Disable TSF synchronization / beaconing. */
1170 		rtwn_beacon_enable(sc, uvp->id, 0);
1171 		rtwn_sta_beacon_enable(sc, uvp->id, false);
1172 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
1173 		    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
1174 
1175 		/* NB: monitor mode vaps are using port 0. */
1176 		if (uvp->id != 0 || sc->monvaps_running == 0) {
1177 			/* Reset TSF. */
1178 			rtwn_write_1(sc, R92C_DUAL_TSF_RST,
1179 			    R92C_DUAL_TSF_RESET(uvp->id));
1180 		}
1181 
1182 #ifndef RTWN_WITHOUT_UCODE
1183 		if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 && uvp->id == 0) {
1184 			/* Disable power management. */
1185 			callout_stop(&sc->sc_pwrmode_init);
1186 			rtwn_set_pwrmode(sc, vap, 0);
1187 		}
1188 #endif
1189 		if (sc->vaps_running - sc->monvaps_running > 0) {
1190 			/* Recalculate basic rates bitmap. */
1191 			rtwn_calc_basicrates(sc);
1192 		}
1193 
1194 		if (sc->vaps_running == sc->monvaps_running) {
1195 			/* Stop calibration. */
1196 			callout_stop(&sc->sc_calib_to);
1197 
1198 			/* Stop Rx of data frames. */
1199 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1200 
1201 			/* Reset EDCA parameters. */
1202 			rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1203 			rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1204 			rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1205 			rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1206 
1207 			if (sc->vaps_running == 0) {
1208 				/* Turn link LED off. */
1209 				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1210 			}
1211 		}
1212 	}
1213 
1214 	error = 0;
1215 	switch (nstate) {
1216 	case IEEE80211_S_SCAN:
1217 		/* Pause AC Tx queues. */
1218 		if (sc->vaps_running == 0)
1219 			rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_AC);
1220 		break;
1221 	case IEEE80211_S_RUN:
1222 		error = rtwn_run(sc, vap);
1223 		if (error != 0) {
1224 			device_printf(sc->sc_dev,
1225 			    "%s: could not move to RUN state\n", __func__);
1226 			break;
1227 		}
1228 
1229 		sc->vaps_running++;
1230 		break;
1231 	case IEEE80211_S_CSA:
1232 		/* Block all Tx queues (except beacon queue). */
1233 		rtwn_setbits_1(sc, R92C_TXPAUSE, 0,
1234 		    R92C_TX_QUEUE_AC | R92C_TX_QUEUE_MGT | R92C_TX_QUEUE_HIGH);
1235 		break;
1236 	default:
1237 		break;
1238 	}
1239 
1240 	RTWN_UNLOCK(sc);
1241 	IEEE80211_LOCK(ic);
1242 	if (error != 0)
1243 		return (error);
1244 
1245 	return (early_newstate ? 0 : uvp->newstate(vap, nstate, arg));
1246 }
1247 
1248 static void
1249 rtwn_calc_basicrates(struct rtwn_softc *sc)
1250 {
1251 	struct ieee80211com *ic = &sc->sc_ic;
1252 	uint32_t basicrates;
1253 	int i;
1254 
1255 	RTWN_ASSERT_LOCKED(sc);
1256 
1257 	if (ic->ic_flags & IEEE80211_F_SCAN)
1258 		return;		/* will be done by rtwn_scan_end(). */
1259 
1260 	basicrates = 0;
1261 	for (i = 0; i < nitems(sc->vaps); i++) {
1262 		struct rtwn_vap *rvp;
1263 		struct ieee80211vap *vap;
1264 		struct ieee80211_node *ni;
1265 		struct ieee80211_htrateset *rs_ht;
1266 		uint32_t rates = 0, htrates = 0;
1267 
1268 		rvp = sc->vaps[i];
1269 		if (rvp == NULL || rvp->curr_mode == R92C_MSR_NOLINK)
1270 			continue;
1271 
1272 		vap = &rvp->vap;
1273 		if (vap->iv_bss == NULL)
1274 			continue;
1275 
1276 		ni = ieee80211_ref_node(vap->iv_bss);
1277 		if (ni->ni_flags & IEEE80211_NODE_HT)
1278 			rs_ht = &ni->ni_htrates;
1279 		else
1280 			rs_ht = NULL;
1281 		/*
1282 		 * Only fetches basic rates; fetch 802.11abg and 11n basic
1283 		 * rates
1284 		 */
1285 		rtwn_get_rates(sc, &ni->ni_rates, rs_ht, &rates, &htrates,
1286 		    NULL, 1);
1287 
1288 		/*
1289 		 * We need at least /an/ OFDM and/or MCS rate for HT
1290 		 * operation, or the MAC will generate MCS7 ACK/Block-ACK
1291 		 * frames and thus performance will suffer.
1292 		 */
1293 		if (ni->ni_flags & IEEE80211_NODE_HT) {
1294 			htrates |= 0x01; /* MCS0 */
1295 			rates |= (1 << RTWN_RIDX_OFDM6);
1296 		}
1297 
1298 		basicrates |= rates;
1299 		basicrates |= (htrates << RTWN_RIDX_HT_MCS_SHIFT);
1300 
1301 		/* Filter out undesired high rates */
1302 		if (ni->ni_chan != IEEE80211_CHAN_ANYC &&
1303 		    IEEE80211_IS_CHAN_5GHZ(ni->ni_chan))
1304 			basicrates &= R92C_RRSR_RATE_MASK_5GHZ;
1305 		else
1306 			basicrates &= R92C_RRSR_RATE_MASK_2GHZ;
1307 
1308 		ieee80211_free_node(ni);
1309 	}
1310 
1311 
1312 	if (basicrates == 0)
1313 		return;
1314 
1315 	/* XXX also set initial RTS rate? */
1316 	rtwn_set_basicrates(sc, basicrates);
1317 }
1318 
1319 static int
1320 rtwn_run(struct rtwn_softc *sc, struct ieee80211vap *vap)
1321 {
1322 	struct ieee80211com *ic = vap->iv_ic;
1323 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1324 	struct ieee80211_node *ni;
1325 	uint8_t mode;
1326 	int error;
1327 
1328 	RTWN_ASSERT_LOCKED(sc);
1329 
1330 	error = 0;
1331 	ni = ieee80211_ref_node(vap->iv_bss);
1332 
1333 	if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1334 	    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1335 		error = EINVAL;
1336 		goto fail;
1337 	}
1338 
1339 	switch (vap->iv_opmode) {
1340 	case IEEE80211_M_STA:
1341 		mode = R92C_MSR_INFRA;
1342 		break;
1343 	case IEEE80211_M_IBSS:
1344 		mode = R92C_MSR_ADHOC;
1345 		break;
1346 	case IEEE80211_M_HOSTAP:
1347 		mode = R92C_MSR_AP;
1348 		break;
1349 	default:
1350 		KASSERT(0, ("undefined opmode %d\n", vap->iv_opmode));
1351 		error = EINVAL;
1352 		goto fail;
1353 	}
1354 
1355 	/* Set media status to 'Associated'. */
1356 	rtwn_set_mode(sc, mode, uvp->id);
1357 
1358 	/* Set AssocID. */
1359 	/* XXX multi-vap? */
1360 	rtwn_write_2(sc, R92C_BCN_PSR_RPT,
1361 	    0xc000 | IEEE80211_NODE_AID(ni));
1362 
1363 	/* Set BSSID. */
1364 	rtwn_set_bssid(sc, ni->ni_bssid, uvp->id);
1365 
1366 	/* Set beacon interval. */
1367 	rtwn_write_2(sc, R92C_BCN_INTERVAL(uvp->id), ni->ni_intval);
1368 
1369 	if (sc->vaps_running == sc->monvaps_running) {
1370 		/* Enable Rx of data frames. */
1371 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1372 
1373 		/* Flush all AC queues. */
1374 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1375 	}
1376 
1377 #ifndef RTWN_WITHOUT_UCODE
1378 	/* Upload (QoS) Null Data frame to firmware. */
1379 	/* Note: do this for port 0 only. */
1380 	if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 &&
1381 	    vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
1382 		error = rtwn_tx_fwpkt_check(sc, vap);
1383 		if (error != 0)
1384 			goto fail;
1385 
1386 		/* Setup power management. */
1387 		/*
1388 		 * NB: it will be enabled immediately - delay it,
1389 		 * so 4-Way handshake will not be interrupted.
1390 		 */
1391 		callout_reset(&sc->sc_pwrmode_init, 5*hz,
1392 		    rtwn_pwrmode_init, sc);
1393 	}
1394 #endif
1395 
1396 	/* Enable TSF synchronization. */
1397 	rtwn_tsf_sync_enable(sc, vap);
1398 
1399 	if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1400 	    vap->iv_opmode == IEEE80211_M_IBSS) {
1401 		error = rtwn_setup_beacon(sc, ni);
1402 		if (error != 0) {
1403 			device_printf(sc->sc_dev,
1404 			    "unable to push beacon into the chip, "
1405 			    "error %d\n", error);
1406 			goto fail;
1407 		}
1408 	}
1409 
1410 	/* Set ACK preamble type. */
1411 	rtwn_set_ack_preamble(sc);
1412 
1413 	/* Set basic rates mask. */
1414 	rtwn_calc_basicrates(sc);
1415 
1416 #ifdef RTWN_TODO
1417 	rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1418 	rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1419 	rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1420 	rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1421 	rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1422 	rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1423 #endif
1424 
1425 	if (sc->vaps_running == sc->monvaps_running) {
1426 		/* Reset temperature calibration state machine. */
1427 		sc->sc_flags &= ~RTWN_TEMP_MEASURED;
1428 		sc->thcal_temp = sc->thermal_meter;
1429 
1430 		/* Start periodic calibration. */
1431 		callout_reset(&sc->sc_calib_to, 2*hz, rtwn_calib_to,
1432 		    sc);
1433 
1434 		if (sc->vaps_running == 0) {
1435 			/* Turn link LED on. */
1436 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1437 		}
1438 	}
1439 
1440 fail:
1441 	ieee80211_free_node(ni);
1442 
1443 	return (error);
1444 }
1445 
1446 #ifndef D4054
1447 static void
1448 rtwn_watchdog(void *arg)
1449 {
1450 	struct rtwn_softc *sc = arg;
1451 	struct ieee80211com *ic = &sc->sc_ic;
1452 
1453 	RTWN_ASSERT_LOCKED(sc);
1454 
1455 	KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1456 
1457 	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1458 		ic_printf(ic, "device timeout\n");
1459 		ieee80211_restart_all(ic);
1460 		return;
1461 	}
1462 	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
1463 }
1464 #endif
1465 
1466 static void
1467 rtwn_parent(struct ieee80211com *ic)
1468 {
1469 	struct rtwn_softc *sc = ic->ic_softc;
1470 	struct ieee80211vap *vap;
1471 
1472 	if (ic->ic_nrunning > 0) {
1473 		if (rtwn_init(sc) != 0) {
1474 			IEEE80211_LOCK(ic);
1475 			TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1476 				ieee80211_stop_locked(vap);
1477 			IEEE80211_UNLOCK(ic);
1478 		} else
1479 			ieee80211_start_all(ic);
1480 	} else
1481 		rtwn_stop(sc);
1482 }
1483 
1484 static int
1485 rtwn_dma_init(struct rtwn_softc *sc)
1486 {
1487 #define RTWN_CHK(res) do {	\
1488 	if (res != 0)		\
1489 		return (EIO);	\
1490 } while(0)
1491 	uint16_t reg;
1492 	uint8_t tx_boundary;
1493 	int error;
1494 
1495 	/* Initialize LLT table. */
1496 	error = rtwn_llt_init(sc);
1497 	if (error != 0)
1498 		return (error);
1499 
1500 	/* Set the number of pages for each queue. */
1501 	RTWN_DPRINTF(sc, RTWN_DEBUG_RESET,
1502 	    "%s: pages per queue: high %d, normal %d, low %d, public %d\n",
1503 	    __func__, sc->nhqpages, sc->nnqpages, sc->nlqpages,
1504 	    sc->npubqpages);
1505 
1506 	RTWN_CHK(rtwn_write_1(sc, R92C_RQPN_NPQ, sc->nnqpages));
1507 	RTWN_CHK(rtwn_write_4(sc, R92C_RQPN,
1508 	    /* Set number of pages for public queue. */
1509 	    SM(R92C_RQPN_PUBQ, sc->npubqpages) |
1510 	    /* Set number of pages for high priority queue. */
1511 	    SM(R92C_RQPN_HPQ, sc->nhqpages) |
1512 	    /* Set number of pages for low priority queue. */
1513 	    SM(R92C_RQPN_LPQ, sc->nlqpages) |
1514 	    /* Load values. */
1515 	    R92C_RQPN_LD));
1516 
1517 	/* Initialize TX buffer boundary. */
1518 	KASSERT(sc->page_count < 255 && sc->page_count > 0,
1519 	    ("page_count is %d\n", sc->page_count));
1520 	tx_boundary = sc->page_count + 1;
1521 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary));
1522 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary));
1523 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary));
1524 	RTWN_CHK(rtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary));
1525 	RTWN_CHK(rtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary));
1526 
1527 	error = rtwn_init_bcnq1_boundary(sc);
1528 	if (error != 0)
1529 		return (error);
1530 
1531 	/* Set queue to USB pipe mapping. */
1532 	/* Note: PCIe devices are using some magic number here. */
1533 	reg = rtwn_get_qmap(sc);
1534 	RTWN_CHK(rtwn_setbits_2(sc, R92C_TRXDMA_CTRL,
1535 	    R92C_TRXDMA_CTRL_QMAP_M, reg));
1536 
1537 	/* Configure Tx/Rx DMA (PCIe). */
1538 	rtwn_set_desc_addr(sc);
1539 
1540 	/* Set Tx/Rx transfer page boundary. */
1541 	RTWN_CHK(rtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
1542 	    sc->rx_dma_size - 1));
1543 
1544 	/* Set Tx/Rx transfer page size. */
1545 	rtwn_set_page_size(sc);
1546 
1547 	return (0);
1548 }
1549 
1550 static int
1551 rtwn_mac_init(struct rtwn_softc *sc)
1552 {
1553 	int i, error;
1554 
1555 	/* Write MAC initialization values. */
1556 	for (i = 0; i < sc->mac_size; i++) {
1557 		error = rtwn_write_1(sc, sc->mac_prog[i].reg,
1558 		    sc->mac_prog[i].val);
1559 		if (error != 0)
1560 			return (error);
1561 	}
1562 
1563 	return (0);
1564 }
1565 
1566 static void
1567 rtwn_mrr_init(struct rtwn_softc *sc)
1568 {
1569 	int i;
1570 
1571 	/* Drop rate index by 1 per retry. */
1572 	for (i = 0; i < R92C_DARFRC_SIZE; i++) {
1573 		rtwn_write_1(sc, R92C_DARFRC + i, i + 1);
1574 		rtwn_write_1(sc, R92C_RARFRC + i, i + 1);
1575 	}
1576 }
1577 
1578 static void
1579 rtwn_scan_start(struct ieee80211com *ic)
1580 {
1581 	struct rtwn_softc *sc = ic->ic_softc;
1582 
1583 	RTWN_LOCK(sc);
1584 	/* Pause beaconing. */
1585 	rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_BCN);
1586 	/* Receive beacons / probe responses from any BSSID. */
1587 	if (sc->bcn_vaps == 0)
1588 		rtwn_set_rx_bssid_all(sc, 1);
1589 	RTWN_UNLOCK(sc);
1590 }
1591 
1592 static void
1593 rtwn_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
1594 {
1595 	struct rtwn_softc *sc = ss->ss_ic->ic_softc;
1596 
1597 	/* Make link LED blink during scan. */
1598 	RTWN_LOCK(sc);
1599 	rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1600 	RTWN_UNLOCK(sc);
1601 
1602 	sc->sc_scan_curchan(ss, maxdwell);
1603 }
1604 
1605 static void
1606 rtwn_scan_end(struct ieee80211com *ic)
1607 {
1608 	struct rtwn_softc *sc = ic->ic_softc;
1609 
1610 	RTWN_LOCK(sc);
1611 	/* Restore limitations. */
1612 	if (ic->ic_promisc == 0 && sc->bcn_vaps == 0)
1613 		rtwn_set_rx_bssid_all(sc, 0);
1614 
1615 	/* Restore LED state. */
1616 	rtwn_set_led(sc, RTWN_LED_LINK, (sc->vaps_running != 0));
1617 
1618 	/* Restore basic rates mask. */
1619 	rtwn_calc_basicrates(sc);
1620 
1621 	/* Resume beaconing. */
1622 	rtwn_setbits_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_BCN, 0);
1623 	RTWN_UNLOCK(sc);
1624 }
1625 
1626 static void
1627 rtwn_getradiocaps(struct ieee80211com *ic,
1628     int maxchans, int *nchans, struct ieee80211_channel chans[])
1629 {
1630 	struct rtwn_softc *sc = ic->ic_softc;
1631 	uint8_t bands[IEEE80211_MODE_BYTES];
1632 	int cbw_flags, i;
1633 
1634 	cbw_flags = (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) ?
1635 	    NET80211_CBW_FLAG_HT40 : 0;
1636 
1637 	memset(bands, 0, sizeof(bands));
1638 	setbit(bands, IEEE80211_MODE_11B);
1639 	setbit(bands, IEEE80211_MODE_11G);
1640 	setbit(bands, IEEE80211_MODE_11NG);
1641 	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
1642 	    bands, cbw_flags);
1643 
1644 	/* XXX workaround add_channel_list() limitations */
1645 	setbit(bands, IEEE80211_MODE_11A);
1646 	setbit(bands, IEEE80211_MODE_11NA);
1647 
1648 	if (IEEE80211_CONF_VHT(ic)) {
1649 		setbit(bands, IEEE80211_MODE_VHT_5GHZ);
1650 		/* Only enable VHT80 if HT40/VHT40 is available */
1651 		if (sc->sc_ht40)
1652 			cbw_flags |= NET80211_CBW_FLAG_VHT80;
1653 	}
1654 
1655 	for (i = 0; i < nitems(sc->chan_num_5ghz); i++) {
1656 		if (sc->chan_num_5ghz[i] == 0)
1657 			continue;
1658 
1659 		ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
1660 		    sc->chan_list_5ghz[i], sc->chan_num_5ghz[i], bands,
1661 		    cbw_flags);
1662 	}
1663 }
1664 
1665 static void
1666 rtwn_update_chw(struct ieee80211com *ic)
1667 {
1668 }
1669 
1670 static void
1671 rtwn_set_channel(struct ieee80211com *ic)
1672 {
1673 	struct rtwn_softc *sc = ic->ic_softc;
1674 	struct ieee80211_channel *c = ic->ic_curchan;
1675 
1676 	RTWN_LOCK(sc);
1677 	rtwn_set_chan(sc, c);
1678 	RTWN_UNLOCK(sc);
1679 }
1680 
1681 static int
1682 rtwn_wme_update(struct ieee80211com *ic)
1683 {
1684 	struct chanAccParams chp;
1685 	struct ieee80211_channel *c = ic->ic_curchan;
1686 	struct rtwn_softc *sc = ic->ic_softc;
1687 	struct wmeParams *wmep = sc->cap_wmeParams;
1688 	uint8_t aifs, acm, slottime;
1689 	int ac;
1690 
1691 	ieee80211_wme_ic_getparams(ic, &chp);
1692 
1693 	/* Prevent possible races. */
1694 	IEEE80211_LOCK(ic);	/* XXX */
1695 	RTWN_LOCK(sc);
1696 	memcpy(wmep, chp.cap_wmeParams, sizeof(sc->cap_wmeParams));
1697 	RTWN_UNLOCK(sc);
1698 	IEEE80211_UNLOCK(ic);
1699 
1700 	acm = 0;
1701 	slottime = IEEE80211_GET_SLOTTIME(ic);
1702 
1703 	RTWN_LOCK(sc);
1704 	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1705 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1706 		aifs = wmep[ac].wmep_aifsn * slottime +
1707 		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1708 			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1709 		rtwn_write_4(sc, wme2reg[ac],
1710 		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
1711 		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
1712 		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
1713 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1714 		if (ac != WME_AC_BE)
1715 			acm |= wmep[ac].wmep_acm << ac;
1716 	}
1717 
1718 	if (acm != 0)
1719 		acm |= R92C_ACMHWCTRL_EN;
1720 	rtwn_setbits_1(sc, R92C_ACMHWCTRL, R92C_ACMHWCTRL_ACM_MASK, acm);
1721 	RTWN_UNLOCK(sc);
1722 
1723 	return 0;
1724 }
1725 
1726 static void
1727 rtwn_update_slot(struct ieee80211com *ic)
1728 {
1729 	rtwn_cmd_sleepable(ic->ic_softc, NULL, 0, rtwn_update_slot_cb);
1730 }
1731 
1732 static void
1733 rtwn_update_slot_cb(struct rtwn_softc *sc, union sec_param *data)
1734 {
1735 	struct ieee80211com *ic = &sc->sc_ic;
1736 	uint8_t slottime;
1737 
1738 	slottime = IEEE80211_GET_SLOTTIME(ic);
1739 
1740 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s: setting slot time to %uus\n",
1741 	    __func__, slottime);
1742 
1743 	rtwn_write_1(sc, R92C_SLOT, slottime);
1744 	rtwn_update_aifs(sc, slottime);
1745 }
1746 
1747 static void
1748 rtwn_update_aifs(struct rtwn_softc *sc, uint8_t slottime)
1749 {
1750 	struct ieee80211_channel *c = sc->sc_ic.ic_curchan;
1751 	const struct wmeParams *wmep = sc->cap_wmeParams;
1752 	uint8_t aifs, ac;
1753 
1754 	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1755 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1756 		aifs = wmep[ac].wmep_aifsn * slottime +
1757 		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1758 			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1759 		rtwn_write_1(sc, wme2reg[ac], aifs);
1760 	}
1761 }
1762 
1763 static void
1764 rtwn_update_promisc(struct ieee80211com *ic)
1765 {
1766 	struct rtwn_softc *sc = ic->ic_softc;
1767 
1768 	RTWN_LOCK(sc);
1769 	if (sc->sc_flags & RTWN_RUNNING)
1770 		rtwn_set_promisc(sc);
1771 	RTWN_UNLOCK(sc);
1772 }
1773 
1774 static void
1775 rtwn_update_mcast(struct ieee80211com *ic)
1776 {
1777 	struct rtwn_softc *sc = ic->ic_softc;
1778 
1779 	RTWN_LOCK(sc);
1780 	if (sc->sc_flags & RTWN_RUNNING)
1781 		rtwn_set_multi(sc);
1782 	RTWN_UNLOCK(sc);
1783 }
1784 
1785 static int
1786 rtwn_set_bssid(struct rtwn_softc *sc, const uint8_t *bssid, int id)
1787 {
1788 	int error;
1789 
1790 	error = rtwn_write_4(sc, R92C_BSSID(id), le32dec(&bssid[0]));
1791 	if (error != 0)
1792 		return (error);
1793 	error = rtwn_write_2(sc, R92C_BSSID(id) + 4, le16dec(&bssid[4]));
1794 
1795 	return (error);
1796 }
1797 
1798 static int
1799 rtwn_set_macaddr(struct rtwn_softc *sc, const uint8_t *addr, int id)
1800 {
1801 	int error;
1802 
1803 	error = rtwn_write_4(sc, R92C_MACID(id), le32dec(&addr[0]));
1804 	if (error != 0)
1805 		return (error);
1806 	error = rtwn_write_2(sc, R92C_MACID(id) + 4, le16dec(&addr[4]));
1807 
1808 	return (error);
1809 }
1810 
1811 static struct ieee80211_node *
1812 rtwn_node_alloc(struct ieee80211vap *vap,
1813     const uint8_t mac[IEEE80211_ADDR_LEN])
1814 {
1815 	struct rtwn_node *un;
1816 
1817 	un = malloc(sizeof (struct rtwn_node), M_80211_NODE,
1818 	    M_NOWAIT | M_ZERO);
1819 
1820 	if (un == NULL)
1821 		return NULL;
1822 
1823 	un->id = RTWN_MACID_UNDEFINED;
1824 	un->avg_pwdb = -1;
1825 
1826 	return &un->ni;
1827 }
1828 
1829 static void
1830 rtwn_newassoc(struct ieee80211_node *ni, int isnew __unused)
1831 {
1832 	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1833 	struct rtwn_node *un = RTWN_NODE(ni);
1834 	int id;
1835 
1836 	if (un->id != RTWN_MACID_UNDEFINED)
1837 		return;
1838 
1839 	RTWN_NT_LOCK(sc);
1840 	for (id = 0; id <= sc->macid_limit; id++) {
1841 		if (id != RTWN_MACID_BC && sc->node_list[id] == NULL) {
1842 			un->id = id;
1843 			sc->node_list[id] = ni;
1844 			break;
1845 		}
1846 	}
1847 	RTWN_NT_UNLOCK(sc);
1848 
1849 	if (id > sc->macid_limit) {
1850 		device_printf(sc->sc_dev, "%s: node table is full\n",
1851 		    __func__);
1852 		return;
1853 	}
1854 
1855 	/* Notify firmware. */
1856 	id |= RTWN_MACID_VALID;
1857 	rtwn_cmd_sleepable(sc, &id, sizeof(id), rtwn_set_media_status);
1858 }
1859 
1860 static void
1861 rtwn_node_free(struct ieee80211_node *ni)
1862 {
1863 	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1864 	struct rtwn_node *un = RTWN_NODE(ni);
1865 
1866 	RTWN_NT_LOCK(sc);
1867 	if (un->id != RTWN_MACID_UNDEFINED) {
1868 		sc->node_list[un->id] = NULL;
1869 		rtwn_cmd_sleepable(sc, &un->id, sizeof(un->id),
1870 		    rtwn_set_media_status);
1871 	}
1872 	RTWN_NT_UNLOCK(sc);
1873 
1874 	sc->sc_node_free(ni);
1875 }
1876 
1877 static void
1878 rtwn_init_beacon_reg(struct rtwn_softc *sc)
1879 {
1880 	rtwn_write_1(sc, R92C_BCN_CTRL(0), R92C_BCN_CTRL_DIS_TSF_UDT0);
1881 	rtwn_write_1(sc, R92C_BCN_CTRL(1), R92C_BCN_CTRL_DIS_TSF_UDT0);
1882 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
1883 	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
1884 	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
1885 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
1886 }
1887 
1888 static int
1889 rtwn_init(struct rtwn_softc *sc)
1890 {
1891 	struct ieee80211com *ic = &sc->sc_ic;
1892 	int i, error;
1893 
1894 	RTWN_LOCK(sc);
1895 	if (sc->sc_flags & RTWN_RUNNING) {
1896 		RTWN_UNLOCK(sc);
1897 		return (0);
1898 	}
1899 	sc->sc_flags |= RTWN_STARTED;
1900 
1901 	/* Power on adapter. */
1902 	error = rtwn_power_on(sc);
1903 	if (error != 0)
1904 		goto fail;
1905 
1906 #ifndef RTWN_WITHOUT_UCODE
1907 	/* Load 8051 microcode. */
1908 	error = rtwn_load_firmware(sc);
1909 	if (error == 0)
1910 		sc->sc_flags |= RTWN_FW_LOADED;
1911 
1912 	/* Init firmware commands ring. */
1913 	sc->fwcur = 0;
1914 #endif
1915 
1916 	/* Initialize MAC block. */
1917 	error = rtwn_mac_init(sc);
1918 	if (error != 0) {
1919 		device_printf(sc->sc_dev,
1920 		    "%s: error while initializing MAC block\n", __func__);
1921 		goto fail;
1922 	}
1923 
1924 	/* Initialize DMA. */
1925 	error = rtwn_dma_init(sc);
1926 	if (error != 0)
1927 		goto fail;
1928 
1929 	/* Drop incorrect TX (USB). */
1930 	rtwn_drop_incorrect_tx(sc);
1931 
1932 	/* Set info size in Rx descriptors (in 64-bit words). */
1933 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, R92C_RX_DRVINFO_SZ_DEF);
1934 
1935 	/* Init interrupts. */
1936 	rtwn_init_intr(sc);
1937 
1938 	for (i = 0; i < nitems(sc->vaps); i++) {
1939 		struct rtwn_vap *uvp = sc->vaps[i];
1940 
1941 		/* Set initial network type. */
1942 		rtwn_set_mode(sc, R92C_MSR_NOLINK, i);
1943 
1944 		if (uvp == NULL)
1945 			continue;
1946 
1947 		/* Set MAC address. */
1948 		error = rtwn_set_macaddr(sc, uvp->vap.iv_myaddr, uvp->id);
1949 		if (error != 0)
1950 			goto fail;
1951 	}
1952 
1953 	/* Initialize Rx filter. */
1954 	rtwn_rxfilter_init(sc);
1955 
1956 	/* Set short/long retry limits. */
1957 	rtwn_write_2(sc, R92C_RL,
1958 	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
1959 
1960 	/* Initialize EDCA parameters. */
1961 	rtwn_init_edca(sc);
1962 
1963 	rtwn_setbits_1(sc, R92C_FWHW_TXQ_CTRL, 0,
1964 	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
1965 	/* Set ACK timeout. */
1966 	rtwn_write_1(sc, R92C_ACKTO, sc->ackto);
1967 
1968 	/* Setup aggregation. */
1969 	/* Tx aggregation. */
1970 	rtwn_init_tx_agg(sc);
1971 	rtwn_init_rx_agg(sc);
1972 
1973 	/* Initialize beacon parameters. */
1974 	rtwn_init_beacon_reg(sc);
1975 
1976 	/* Init A-MPDU parameters. */
1977 	rtwn_init_ampdu(sc);
1978 
1979 	/* Init MACTXEN / MACRXEN after setting RxFF boundary. */
1980 	rtwn_setbits_1(sc, R92C_CR, 0, R92C_CR_MACTXEN | R92C_CR_MACRXEN);
1981 
1982 	/* Initialize BB/RF blocks. */
1983 	rtwn_init_bb(sc);
1984 	rtwn_init_rf(sc);
1985 
1986 	/* Initialize wireless band. */
1987 	rtwn_set_chan(sc, ic->ic_curchan);
1988 
1989 	/* Clear per-station keys table. */
1990 	rtwn_init_cam(sc);
1991 
1992 	/* Enable decryption / encryption. */
1993 	rtwn_init_seccfg(sc);
1994 
1995 	/* Install static keys (if any). */
1996 	for (i = 0; i < nitems(sc->vaps); i++) {
1997 		if (sc->vaps[i] != NULL) {
1998 			error = rtwn_init_static_keys(sc, sc->vaps[i]);
1999 			if (error != 0)
2000 				goto fail;
2001 		}
2002 	}
2003 
2004 	/* Initialize antenna selection. */
2005 	rtwn_init_antsel(sc);
2006 
2007 	/* Enable hardware sequence numbering. */
2008 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
2009 
2010 	/* Disable BAR. */
2011 	rtwn_write_4(sc, R92C_BAR_MODE_CTRL, 0x0201ffff);
2012 
2013 	/* NAV limit. */
2014 	rtwn_write_1(sc, R92C_NAV_UPPER, 0);
2015 
2016 	/* Initialize GPIO setting. */
2017 	rtwn_setbits_1(sc, R92C_GPIO_MUXCFG, R92C_GPIO_MUXCFG_ENBT, 0);
2018 
2019 	/* Initialize MRR. */
2020 	rtwn_mrr_init(sc);
2021 
2022 	/* Device-specific post initialization. */
2023 	rtwn_post_init(sc);
2024 
2025 	rtwn_start_xfers(sc);
2026 
2027 #ifndef D4054
2028 	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
2029 #endif
2030 
2031 	sc->sc_flags |= RTWN_RUNNING;
2032 fail:
2033 	RTWN_UNLOCK(sc);
2034 
2035 	return (error);
2036 }
2037 
2038 static void
2039 rtwn_stop(struct rtwn_softc *sc)
2040 {
2041 
2042 	RTWN_LOCK(sc);
2043 	if (!(sc->sc_flags & RTWN_STARTED)) {
2044 		RTWN_UNLOCK(sc);
2045 		return;
2046 	}
2047 
2048 #ifndef D4054
2049 	callout_stop(&sc->sc_watchdog_to);
2050 	sc->sc_tx_timer = 0;
2051 #endif
2052 	sc->sc_flags &= ~(RTWN_STARTED | RTWN_RUNNING | RTWN_FW_LOADED);
2053 	sc->sc_flags &= ~RTWN_TEMP_MEASURED;
2054 	sc->fwver = 0;
2055 	sc->thcal_temp = 0;
2056 	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
2057 	bzero(&sc->last_physt, sizeof(sc->last_physt));
2058 
2059 #ifdef D4054
2060 	ieee80211_tx_watchdog_stop(&sc->sc_ic);
2061 #endif
2062 
2063 	rtwn_abort_xfers(sc);
2064 	rtwn_drain_mbufq(sc);
2065 	rtwn_power_off(sc);
2066 	rtwn_reset_lists(sc, NULL);
2067 	RTWN_UNLOCK(sc);
2068 }
2069 
2070 MODULE_VERSION(rtwn, 2);
2071 MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
2072 #ifndef RTWN_WITHOUT_UCODE
2073 MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
2074 #endif
2075