xref: /freebsd/sys/dev/rtwn/if_rtwn.c (revision fe6060f10f634930ff71b7c50291ddc610da2475)
1 /*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6  * Copyright (c) 2015-2016 Andriy Voskoboinyk <avos@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __FBSDID("$FreeBSD$");
23 
24 /*
25  * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU/RTL8812AU/RTL8821AU.
26  */
27 #include "opt_wlan.h"
28 
29 #include <sys/param.h>
30 #include <sys/sockio.h>
31 #include <sys/sysctl.h>
32 #include <sys/lock.h>
33 #include <sys/mutex.h>
34 #include <sys/mbuf.h>
35 #include <sys/kernel.h>
36 #include <sys/socket.h>
37 #include <sys/systm.h>
38 #include <sys/malloc.h>
39 #include <sys/module.h>
40 #include <sys/bus.h>
41 #include <sys/endian.h>
42 #include <sys/linker.h>
43 #include <sys/firmware.h>
44 #include <sys/kdb.h>
45 
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <net/if_var.h>
49 #include <net/if_arp.h>
50 #include <net/ethernet.h>
51 #include <net/if_dl.h>
52 #include <net/if_media.h>
53 #include <net/if_types.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/in_var.h>
58 #include <netinet/if_ether.h>
59 #include <netinet/ip.h>
60 
61 #include <net80211/ieee80211_var.h>
62 #include <net80211/ieee80211_regdomain.h>
63 #include <net80211/ieee80211_radiotap.h>
64 #include <net80211/ieee80211_ratectl.h>
65 
66 #include <dev/rtwn/if_rtwnreg.h>
67 #include <dev/rtwn/if_rtwnvar.h>
68 
69 #include <dev/rtwn/if_rtwn_beacon.h>
70 #include <dev/rtwn/if_rtwn_calib.h>
71 #include <dev/rtwn/if_rtwn_cam.h>
72 #include <dev/rtwn/if_rtwn_debug.h>
73 #include <dev/rtwn/if_rtwn_efuse.h>
74 #include <dev/rtwn/if_rtwn_fw.h>
75 #include <dev/rtwn/if_rtwn_ridx.h>
76 #include <dev/rtwn/if_rtwn_rx.h>
77 #include <dev/rtwn/if_rtwn_task.h>
78 #include <dev/rtwn/if_rtwn_tx.h>
79 
80 #include <dev/rtwn/rtl8192c/r92c_reg.h>
81 
82 static void		rtwn_radiotap_attach(struct rtwn_softc *);
83 static void		rtwn_vap_decrement_counters(struct rtwn_softc *,
84 			    enum ieee80211_opmode, int);
85 static void		rtwn_set_ic_opmode(struct rtwn_softc *);
86 static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
87 			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
88 			    int, const uint8_t [IEEE80211_ADDR_LEN],
89 			    const uint8_t [IEEE80211_ADDR_LEN]);
90 static void		rtwn_vap_delete(struct ieee80211vap *);
91 static int		rtwn_read_chipid(struct rtwn_softc *);
92 static int		rtwn_ioctl_reset(struct ieee80211vap *, u_long);
93 static void		rtwn_set_media_status(struct rtwn_softc *,
94 			    union sec_param *);
95 #ifndef RTWN_WITHOUT_UCODE
96 static int		rtwn_tx_fwpkt_check(struct rtwn_softc *,
97 			    struct ieee80211vap *);
98 static int		rtwn_construct_nulldata(struct rtwn_softc *,
99 			    struct ieee80211vap *, uint8_t *, int);
100 static int		rtwn_push_nulldata(struct rtwn_softc *,
101 			    struct ieee80211vap *);
102 static void		rtwn_pwrmode_init(void *);
103 static void		rtwn_set_pwrmode_cb(struct rtwn_softc *,
104 			    union sec_param *);
105 #endif
106 static void		rtwn_tsf_sync_adhoc(void *);
107 static void		rtwn_tsf_sync_adhoc_task(void *, int);
108 static void		rtwn_tsf_sync_enable(struct rtwn_softc *,
109 			    struct ieee80211vap *);
110 static void		rtwn_set_ack_preamble(struct rtwn_softc *);
111 static void		rtwn_set_mode(struct rtwn_softc *, uint8_t, int);
112 static int		rtwn_monitor_newstate(struct ieee80211vap *,
113 			    enum ieee80211_state, int);
114 static int		rtwn_newstate(struct ieee80211vap *,
115 			    enum ieee80211_state, int);
116 static void		rtwn_calc_basicrates(struct rtwn_softc *);
117 static int		rtwn_run(struct rtwn_softc *,
118 			    struct ieee80211vap *);
119 #ifndef D4054
120 static void		rtwn_watchdog(void *);
121 #endif
122 static void		rtwn_parent(struct ieee80211com *);
123 static int		rtwn_dma_init(struct rtwn_softc *);
124 static int		rtwn_mac_init(struct rtwn_softc *);
125 static void		rtwn_mrr_init(struct rtwn_softc *);
126 static void		rtwn_scan_start(struct ieee80211com *);
127 static void		rtwn_scan_curchan(struct ieee80211_scan_state *,
128 			    unsigned long);
129 static void		rtwn_scan_end(struct ieee80211com *);
130 static void		rtwn_getradiocaps(struct ieee80211com *, int, int *,
131 			    struct ieee80211_channel[]);
132 static void		rtwn_update_chw(struct ieee80211com *);
133 static void		rtwn_set_channel(struct ieee80211com *);
134 static int		rtwn_wme_update(struct ieee80211com *);
135 static void		rtwn_update_slot(struct ieee80211com *);
136 static void		rtwn_update_slot_cb(struct rtwn_softc *,
137 			    union sec_param *);
138 static void		rtwn_update_aifs(struct rtwn_softc *, uint8_t);
139 static void		rtwn_update_promisc(struct ieee80211com *);
140 static void		rtwn_update_mcast(struct ieee80211com *);
141 static int		rtwn_set_bssid(struct rtwn_softc *,
142 			    const uint8_t *, int);
143 static int		rtwn_set_macaddr(struct rtwn_softc *,
144 			    const uint8_t *, int);
145 static struct ieee80211_node *rtwn_node_alloc(struct ieee80211vap *,
146 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
147 static void		rtwn_newassoc(struct ieee80211_node *, int);
148 static void		rtwn_node_free(struct ieee80211_node *);
149 static void		rtwn_init_beacon_reg(struct rtwn_softc *);
150 static int		rtwn_init(struct rtwn_softc *);
151 static void		rtwn_stop(struct rtwn_softc *);
152 
153 MALLOC_DEFINE(M_RTWN_PRIV, "rtwn_priv", "rtwn driver private state");
154 
155 static const uint16_t wme2reg[] =
156 	{ R92C_EDCA_BE_PARAM, R92C_EDCA_BK_PARAM,
157 	  R92C_EDCA_VI_PARAM, R92C_EDCA_VO_PARAM };
158 
159 int
160 rtwn_attach(struct rtwn_softc *sc)
161 {
162 	struct ieee80211com *ic = &sc->sc_ic;
163 	int error;
164 
165 	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
166 
167 	RTWN_NT_LOCK_INIT(sc);
168 	rtwn_cmdq_init(sc);
169 #ifndef D4054
170 	callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
171 #endif
172 	callout_init(&sc->sc_calib_to, 0);
173 	callout_init(&sc->sc_pwrmode_init, 0);
174 	mbufq_init(&sc->sc_snd, ifqmaxlen);
175 
176 	RTWN_LOCK(sc);
177 	error = rtwn_read_chipid(sc);
178 	RTWN_UNLOCK(sc);
179 	if (error != 0) {
180 		device_printf(sc->sc_dev, "unsupported test chip\n");
181 		goto detach;
182 	}
183 
184 	error = rtwn_read_rom(sc);
185 	if (error != 0) {
186 		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
187 		    __func__, error);
188 		goto detach;
189 	}
190 
191 	if (sc->macid_limit > RTWN_MACID_LIMIT) {
192 		device_printf(sc->sc_dev,
193 		    "macid limit will be reduced from %d to %d\n",
194 		    sc->macid_limit, RTWN_MACID_LIMIT);
195 		sc->macid_limit = RTWN_MACID_LIMIT;
196 	}
197 	if (sc->cam_entry_limit > RTWN_CAM_ENTRY_LIMIT) {
198 		device_printf(sc->sc_dev,
199 		    "cam entry limit will be reduced from %d to %d\n",
200 		    sc->cam_entry_limit, RTWN_CAM_ENTRY_LIMIT);
201 		sc->cam_entry_limit = RTWN_CAM_ENTRY_LIMIT;
202 	}
203 	if (sc->txdesc_len > RTWN_TX_DESC_SIZE) {
204 		device_printf(sc->sc_dev,
205 		    "adjust size for Tx descriptor (current %d, needed %d)\n",
206 		    RTWN_TX_DESC_SIZE, sc->txdesc_len);
207 		goto detach;
208 	}
209 
210 	device_printf(sc->sc_dev, "MAC/BB %s, RF 6052 %dT%dR\n",
211 	    sc->name, sc->ntxchains, sc->nrxchains);
212 
213 	ic->ic_softc = sc;
214 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
215 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
216 
217 	/* set device capabilities */
218 	ic->ic_caps =
219 		  IEEE80211_C_STA		/* station mode */
220 		| IEEE80211_C_MONITOR		/* monitor mode */
221 		| IEEE80211_C_IBSS		/* adhoc mode */
222 		| IEEE80211_C_HOSTAP		/* hostap mode */
223 #if 0	/* TODO: HRPWM register setup */
224 #ifndef RTWN_WITHOUT_UCODE
225 		| IEEE80211_C_PMGT		/* Station-side power mgmt */
226 #endif
227 #endif
228 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
229 		| IEEE80211_C_SHSLOT		/* short slot time supported */
230 #if 0
231 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
232 #endif
233 		| IEEE80211_C_WPA		/* 802.11i */
234 		| IEEE80211_C_WME		/* 802.11e */
235 		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
236 		| IEEE80211_C_FF		/* Atheros fast-frames */
237 		;
238 
239 	if (sc->sc_hwcrypto != RTWN_CRYPTO_SW) {
240 		ic->ic_cryptocaps =
241 		    IEEE80211_CRYPTO_WEP |
242 		    IEEE80211_CRYPTO_TKIP |
243 		    IEEE80211_CRYPTO_AES_CCM;
244 	}
245 
246 	ic->ic_htcaps =
247 	      IEEE80211_HTCAP_SHORTGI20		/* short GI in 20MHz */
248 	    | IEEE80211_HTCAP_MAXAMSDU_3839	/* max A-MSDU length */
249 	    | IEEE80211_HTCAP_SMPS_OFF		/* SM PS mode disabled */
250 	    /* s/w capabilities */
251 	    | IEEE80211_HTC_HT			/* HT operation */
252 	    | IEEE80211_HTC_AMPDU		/* A-MPDU tx */
253 	    | IEEE80211_HTC_AMSDU		/* A-MSDU tx */
254 	    ;
255 
256 	if (sc->sc_ht40) {
257 		ic->ic_htcaps |=
258 		      IEEE80211_HTCAP_CHWIDTH40	/* 40 MHz channel width */
259 		    | IEEE80211_HTCAP_SHORTGI40	/* short GI in 40MHz */
260 		    ;
261 	}
262 
263 	ic->ic_txstream = sc->ntxchains;
264 	ic->ic_rxstream = sc->nrxchains;
265 
266 	/* Enable TX watchdog */
267 #ifdef D4054
268 	ic->ic_flags_ext |= IEEE80211_FEXT_WATCHDOG;
269 #endif
270 
271 	/* Adjust capabilities. */
272 	rtwn_adj_devcaps(sc);
273 
274 	rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
275 	    ic->ic_channels);
276 
277 	/* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
278 
279 	ieee80211_ifattach(ic);
280 	ic->ic_raw_xmit = rtwn_raw_xmit;
281 	ic->ic_scan_start = rtwn_scan_start;
282 	sc->sc_scan_curchan = ic->ic_scan_curchan;
283 	ic->ic_scan_curchan = rtwn_scan_curchan;
284 	ic->ic_scan_end = rtwn_scan_end;
285 	ic->ic_getradiocaps = rtwn_getradiocaps;
286 	ic->ic_update_chw = rtwn_update_chw;
287 	ic->ic_set_channel = rtwn_set_channel;
288 	ic->ic_transmit = rtwn_transmit;
289 	ic->ic_parent = rtwn_parent;
290 	ic->ic_vap_create = rtwn_vap_create;
291 	ic->ic_vap_delete = rtwn_vap_delete;
292 	ic->ic_wme.wme_update = rtwn_wme_update;
293 	ic->ic_updateslot = rtwn_update_slot;
294 	ic->ic_update_promisc = rtwn_update_promisc;
295 	ic->ic_update_mcast = rtwn_update_mcast;
296 	ic->ic_node_alloc = rtwn_node_alloc;
297 	ic->ic_newassoc = rtwn_newassoc;
298 	sc->sc_node_free = ic->ic_node_free;
299 	ic->ic_node_free = rtwn_node_free;
300 
301 	rtwn_postattach(sc);
302 	rtwn_radiotap_attach(sc);
303 
304 	if (bootverbose)
305 		ieee80211_announce(ic);
306 
307 	return (0);
308 
309 detach:
310 	return (ENXIO);			/* failure */
311 }
312 
313 static void
314 rtwn_radiotap_attach(struct rtwn_softc *sc)
315 {
316 	struct rtwn_rx_radiotap_header *rxtap = &sc->sc_rxtap;
317 	struct rtwn_tx_radiotap_header *txtap = &sc->sc_txtap;
318 
319 	ieee80211_radiotap_attach(&sc->sc_ic,
320 	    &txtap->wt_ihdr, sizeof(*txtap), RTWN_TX_RADIOTAP_PRESENT,
321 	    &rxtap->wr_ihdr, sizeof(*rxtap), RTWN_RX_RADIOTAP_PRESENT);
322 }
323 
324 void
325 rtwn_sysctlattach(struct rtwn_softc *sc)
326 {
327 	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
328 	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
329 
330 #if 1
331 	sc->sc_ht40 = 0;
332 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
333 	    "ht40", CTLFLAG_RDTUN, &sc->sc_ht40,
334 	    sc->sc_ht40, "Enable 40 MHz mode support");
335 #endif
336 
337 #ifdef RTWN_DEBUG
338 	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
339 	    "debug", CTLFLAG_RWTUN, &sc->sc_debug, sc->sc_debug,
340 	    "Control debugging printfs");
341 #endif
342 
343 	sc->sc_hwcrypto = RTWN_CRYPTO_PAIR;
344 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
345 	    "hwcrypto", CTLFLAG_RDTUN, &sc->sc_hwcrypto,
346 	    sc->sc_hwcrypto, "Enable h/w crypto: "
347 	    "0 - disable, 1 - pairwise keys, 2 - all keys");
348 	if (sc->sc_hwcrypto >= RTWN_CRYPTO_MAX)
349 		sc->sc_hwcrypto = RTWN_CRYPTO_FULL;
350 
351 	sc->sc_ratectl_sysctl = RTWN_RATECTL_NET80211;
352 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
353 	    "ratectl", CTLFLAG_RDTUN, &sc->sc_ratectl_sysctl,
354 	    sc->sc_ratectl_sysctl, "Select rate control mechanism: "
355 	    "0 - disabled, 1 - via net80211, 2 - via firmware");
356 	if (sc->sc_ratectl_sysctl >= RTWN_RATECTL_MAX)
357 		sc->sc_ratectl_sysctl = RTWN_RATECTL_FW;
358 
359 	sc->sc_ratectl = sc->sc_ratectl_sysctl;
360 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
361 	    "ratectl_selected", CTLFLAG_RD, &sc->sc_ratectl,
362 	    sc->sc_ratectl,
363 	    "Currently selected rate control mechanism (by the driver)");
364 }
365 
366 void
367 rtwn_detach(struct rtwn_softc *sc)
368 {
369 	struct ieee80211com *ic = &sc->sc_ic;
370 
371 	if (ic->ic_softc == sc) {
372 		/* Stop command queue. */
373 		RTWN_CMDQ_LOCK(sc);
374 		sc->sc_detached = 1;
375 		RTWN_CMDQ_UNLOCK(sc);
376 
377 		ieee80211_draintask(ic, &sc->cmdq_task);
378 		ieee80211_ifdetach(ic);
379 	}
380 
381 	rtwn_cmdq_destroy(sc);
382 	if (RTWN_NT_LOCK_INITIALIZED(sc))
383 		RTWN_NT_LOCK_DESTROY(sc);
384 }
385 
386 void
387 rtwn_suspend(struct rtwn_softc *sc)
388 {
389 	struct ieee80211com *ic = &sc->sc_ic;
390 
391 	ieee80211_suspend_all(ic);
392 }
393 
394 void
395 rtwn_resume(struct rtwn_softc *sc)
396 {
397 	struct ieee80211com *ic = &sc->sc_ic;
398 
399 	ieee80211_resume_all(ic);
400 }
401 
402 static void
403 rtwn_vap_decrement_counters(struct rtwn_softc *sc,
404     enum ieee80211_opmode opmode, int id)
405 {
406 
407 	RTWN_ASSERT_LOCKED(sc);
408 
409 	if (id != RTWN_VAP_ID_INVALID) {
410 		KASSERT(id == 0 || id == 1, ("wrong vap id %d!\n", id));
411 		KASSERT(sc->vaps[id] != NULL, ("vap pointer is NULL\n"));
412 		sc->vaps[id] = NULL;
413 	}
414 
415 	switch (opmode) {
416 	case IEEE80211_M_HOSTAP:
417 		sc->ap_vaps--;
418 		/* FALLTHROUGH */
419 	case IEEE80211_M_IBSS:
420 		sc->bcn_vaps--;
421 		/* FALLTHROUGH */
422 	case IEEE80211_M_STA:
423 		sc->nvaps--;
424 		break;
425 	case IEEE80211_M_MONITOR:
426 		sc->mon_vaps--;
427 		break;
428 	default:
429 		KASSERT(0, ("wrong opmode %d\n", opmode));
430 		break;
431 	}
432 
433 	KASSERT(sc->vaps_running >= 0 && sc->monvaps_running >= 0,
434 	    ("number of running vaps is negative (vaps %d, monvaps %d)\n",
435 	    sc->vaps_running, sc->monvaps_running));
436 	KASSERT(sc->vaps_running - sc->monvaps_running <= RTWN_PORT_COUNT,
437 	    ("number of running vaps is too big (vaps %d, monvaps %d)\n",
438 	    sc->vaps_running, sc->monvaps_running));
439 
440 	KASSERT(sc->nvaps >= 0 && sc->nvaps <= RTWN_PORT_COUNT,
441 	    ("wrong value %d for nvaps\n", sc->nvaps));
442 	KASSERT(sc->mon_vaps >= 0, ("mon_vaps is negative (%d)\n",
443 	    sc->mon_vaps));
444 	KASSERT(sc->bcn_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
445 	    sc->bcn_vaps <= RTWN_PORT_COUNT) || sc->bcn_vaps <= 1),
446 	    ("bcn_vaps value %d is wrong\n", sc->bcn_vaps));
447 	KASSERT(sc->ap_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
448 	    sc->ap_vaps <= RTWN_PORT_COUNT) || sc->ap_vaps <= 1),
449 	    ("ap_vaps value %d is wrong\n", sc->ap_vaps));
450 }
451 
452 static void
453 rtwn_set_ic_opmode(struct rtwn_softc *sc)
454 {
455 	struct ieee80211com *ic = &sc->sc_ic;
456 
457 	RTWN_ASSERT_LOCKED(sc);
458 
459 	/* for ieee80211_reset_erp() */
460 	if (sc->bcn_vaps - sc->ap_vaps > 0)
461 		ic->ic_opmode = IEEE80211_M_IBSS;
462 	else if (sc->ap_vaps > 0)
463 		ic->ic_opmode = IEEE80211_M_HOSTAP;
464 	else if (sc->nvaps > 0)
465 		ic->ic_opmode = IEEE80211_M_STA;
466 	else
467 		ic->ic_opmode = IEEE80211_M_MONITOR;
468 }
469 
470 static struct ieee80211vap *
471 rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
472     enum ieee80211_opmode opmode, int flags,
473     const uint8_t bssid[IEEE80211_ADDR_LEN],
474     const uint8_t mac[IEEE80211_ADDR_LEN])
475 {
476 	struct rtwn_softc *sc = ic->ic_softc;
477 	struct rtwn_vap *uvp;
478 	struct ieee80211vap *vap;
479 	int id = RTWN_VAP_ID_INVALID;
480 
481 	RTWN_LOCK(sc);
482 	KASSERT(sc->nvaps <= RTWN_PORT_COUNT,
483 	    ("nvaps overflow (%d > %d)\n", sc->nvaps, RTWN_PORT_COUNT));
484 	KASSERT(sc->ap_vaps <= RTWN_PORT_COUNT,
485 	    ("ap_vaps overflow (%d > %d)\n", sc->ap_vaps, RTWN_PORT_COUNT));
486 	KASSERT(sc->bcn_vaps <= RTWN_PORT_COUNT,
487 	    ("bcn_vaps overflow (%d > %d)\n", sc->bcn_vaps, RTWN_PORT_COUNT));
488 
489 	if (opmode != IEEE80211_M_MONITOR) {
490 		switch (sc->nvaps) {
491 		case 0:
492 			id = 0;
493 			break;
494 		case 1:
495 			if (sc->vaps[1] == NULL)
496 				id = 1;
497 			else if (sc->vaps[0] == NULL)
498 				id = 0;
499 			KASSERT(id != RTWN_VAP_ID_INVALID,
500 			    ("no free ports left\n"));
501 			break;
502 		case 2:
503 		default:
504 			goto fail;
505 		}
506 
507 		if (opmode == IEEE80211_M_IBSS ||
508 		    opmode == IEEE80211_M_HOSTAP) {
509 			if ((sc->bcn_vaps == 1 && !RTWN_CHIP_HAS_BCNQ1(sc)) ||
510 			    sc->bcn_vaps == RTWN_PORT_COUNT)
511 				goto fail;
512 		}
513 	}
514 
515 	switch (opmode) {
516 	case IEEE80211_M_HOSTAP:
517 		sc->ap_vaps++;
518 		/* FALLTHROUGH */
519 	case IEEE80211_M_IBSS:
520 		sc->bcn_vaps++;
521 		/* FALLTHROUGH */
522 	case IEEE80211_M_STA:
523 		sc->nvaps++;
524 		break;
525 	case IEEE80211_M_MONITOR:
526 		sc->mon_vaps++;
527 		break;
528 	default:
529 		KASSERT(0, ("unknown opmode %d\n", opmode));
530 		goto fail;
531 	}
532 	RTWN_UNLOCK(sc);
533 
534 	uvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
535 	uvp->id = id;
536 	if (id != RTWN_VAP_ID_INVALID) {
537 		RTWN_LOCK(sc);
538 		sc->vaps[id] = uvp;
539 		RTWN_UNLOCK(sc);
540 	}
541 	vap = &uvp->vap;
542 	/* enable s/w bmiss handling for sta mode */
543 
544 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
545 	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
546 		/* out of memory */
547 		free(uvp, M_80211_VAP);
548 
549 		RTWN_LOCK(sc);
550 		rtwn_vap_decrement_counters(sc, opmode, id);
551 		RTWN_UNLOCK(sc);
552 
553 		return (NULL);
554 	}
555 
556 	rtwn_beacon_init(sc, &uvp->bcn_desc.txd[0], uvp->id);
557 	rtwn_vap_preattach(sc, vap);
558 
559 	/* override state transition machine */
560 	uvp->newstate = vap->iv_newstate;
561 	if (opmode == IEEE80211_M_MONITOR)
562 		vap->iv_newstate = rtwn_monitor_newstate;
563 	else
564 		vap->iv_newstate = rtwn_newstate;
565 	vap->iv_update_beacon = rtwn_update_beacon;
566 	vap->iv_reset = rtwn_ioctl_reset;
567 	vap->iv_key_alloc = rtwn_key_alloc;
568 	vap->iv_key_set = rtwn_key_set;
569 	vap->iv_key_delete = rtwn_key_delete;
570 	vap->iv_max_aid = sc->macid_limit;
571 
572 	/* 802.11n parameters */
573 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
574 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
575 
576 	TIMEOUT_TASK_INIT(taskqueue_thread, &uvp->tx_beacon_csa, 0,
577 	    rtwn_tx_beacon_csa, vap);
578 	if (opmode == IEEE80211_M_IBSS) {
579 		uvp->recv_mgmt = vap->iv_recv_mgmt;
580 		vap->iv_recv_mgmt = rtwn_adhoc_recv_mgmt;
581 		TASK_INIT(&uvp->tsf_sync_adhoc_task, 0,
582 		    rtwn_tsf_sync_adhoc_task, vap);
583 		callout_init(&uvp->tsf_sync_adhoc, 0);
584 	}
585 
586 	/*
587 	 * NB: driver can select net80211 RA even when user requests
588 	 * another mechanism.
589 	 */
590 	ieee80211_ratectl_init(vap);
591 
592 	/* complete setup */
593 	ieee80211_vap_attach(vap, ieee80211_media_change,
594 	    ieee80211_media_status, mac);
595 
596 	RTWN_LOCK(sc);
597 	rtwn_set_ic_opmode(sc);
598 	if (sc->sc_flags & RTWN_RUNNING) {
599 		if (uvp->id != RTWN_VAP_ID_INVALID)
600 			rtwn_set_macaddr(sc, vap->iv_myaddr, uvp->id);
601 
602 		rtwn_rxfilter_update(sc);
603 	}
604 	RTWN_UNLOCK(sc);
605 
606 	return (vap);
607 
608 fail:
609 	RTWN_UNLOCK(sc);
610 	return (NULL);
611 }
612 
613 static void
614 rtwn_vap_delete(struct ieee80211vap *vap)
615 {
616 	struct ieee80211com *ic = vap->iv_ic;
617 	struct rtwn_softc *sc = ic->ic_softc;
618 	struct rtwn_vap *uvp = RTWN_VAP(vap);
619 
620 	/* Put vap into INIT state + stop device if needed. */
621 	ieee80211_stop(vap);
622 	ieee80211_draintask(ic, &vap->iv_nstate_task);
623 	ieee80211_draintask(ic, &ic->ic_parent_task);
624 
625 	RTWN_LOCK(sc);
626 	/* Cancel any unfinished Tx. */
627 	rtwn_reset_lists(sc, vap);
628 	if (uvp->bcn_mbuf != NULL)
629 		m_freem(uvp->bcn_mbuf);
630 	rtwn_vap_decrement_counters(sc, vap->iv_opmode, uvp->id);
631 	rtwn_set_ic_opmode(sc);
632 	if (sc->sc_flags & RTWN_RUNNING)
633 		rtwn_rxfilter_update(sc);
634 	RTWN_UNLOCK(sc);
635 
636 	if (vap->iv_opmode == IEEE80211_M_IBSS) {
637 		ieee80211_draintask(ic, &uvp->tsf_sync_adhoc_task);
638 		callout_drain(&uvp->tsf_sync_adhoc);
639 	}
640 
641 	ieee80211_ratectl_deinit(vap);
642 	ieee80211_vap_detach(vap);
643 	free(uvp, M_80211_VAP);
644 }
645 
646 static int
647 rtwn_read_chipid(struct rtwn_softc *sc)
648 {
649 	uint32_t reg;
650 
651 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
652 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)	/* test chip */
653 		return (EOPNOTSUPP);
654 
655 	rtwn_read_chipid_vendor(sc, reg);
656 
657 	return (0);
658 }
659 
660 static int
661 rtwn_ioctl_reset(struct ieee80211vap *vap, u_long cmd)
662 {
663 	int error;
664 
665 	switch (cmd) {
666 #ifndef RTWN_WITHOUT_UCODE
667 	case IEEE80211_IOC_POWERSAVE:
668 	case IEEE80211_IOC_POWERSAVESLEEP:
669 	{
670 		struct rtwn_softc *sc = vap->iv_ic->ic_softc;
671 		struct rtwn_vap *uvp = RTWN_VAP(vap);
672 
673 		if (vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
674 			RTWN_LOCK(sc);
675 			if (sc->sc_flags & RTWN_RUNNING)
676 				error = rtwn_set_pwrmode(sc, vap, 1);
677 			else
678 				error = 0;
679 			RTWN_UNLOCK(sc);
680 			if (error != 0)
681 				error = ENETRESET;
682 		} else
683 			error = EOPNOTSUPP;
684 		break;
685 	}
686 #endif
687 	case IEEE80211_IOC_SHORTGI:
688 	case IEEE80211_IOC_RTSTHRESHOLD:
689 	case IEEE80211_IOC_PROTMODE:
690 	case IEEE80211_IOC_HTPROTMODE:
691 	case IEEE80211_IOC_LDPC:
692 		error = 0;
693 		break;
694 	default:
695 		error = ENETRESET;
696 		break;
697 	}
698 
699 	return (error);
700 }
701 
702 static void
703 rtwn_set_media_status(struct rtwn_softc *sc, union sec_param *data)
704 {
705 	sc->sc_set_media_status(sc, data->macid);
706 }
707 
708 #ifndef RTWN_WITHOUT_UCODE
709 static int
710 rtwn_tx_fwpkt_check(struct rtwn_softc *sc, struct ieee80211vap *vap)
711 {
712 	int ntries, error;
713 
714 	for (ntries = 0; ntries < 5; ntries++) {
715 		error = rtwn_push_nulldata(sc, vap);
716 		if (error == 0)
717 			break;
718 	}
719 	if (ntries == 5) {
720 		device_printf(sc->sc_dev,
721 		    "%s: cannot push f/w frames into chip, error %d!\n",
722 		    __func__, error);
723 		return (error);
724 	}
725 
726 	return (0);
727 }
728 
729 static int
730 rtwn_construct_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap,
731     uint8_t *ptr, int qos)
732 {
733 	struct rtwn_vap *uvp = RTWN_VAP(vap);
734 	struct ieee80211com *ic = &sc->sc_ic;
735 	struct rtwn_tx_desc_common *txd;
736 	struct ieee80211_frame *wh;
737 	int pktlen;
738 
739 	/* XXX obtain from net80211 */
740 	wh = (struct ieee80211_frame *)(ptr + sc->txdesc_len);
741 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
742 	wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
743 	IEEE80211_ADDR_COPY(wh->i_addr1, vap->iv_bss->ni_bssid);
744 	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
745 	IEEE80211_ADDR_COPY(wh->i_addr3, vap->iv_bss->ni_macaddr);
746 
747 	txd = (struct rtwn_tx_desc_common *)ptr;
748 	txd->offset = sc->txdesc_len;
749 	pktlen = sc->txdesc_len;
750 	if (qos) {
751 		struct ieee80211_qosframe *qwh;
752 		const int tid = WME_AC_TO_TID(WME_AC_BE);
753 
754 		qwh = (struct ieee80211_qosframe *)wh;
755 		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS_NULL;
756 		qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
757 
758 		txd->pktlen = htole16(sizeof(struct ieee80211_qosframe));
759 		pktlen += sizeof(struct ieee80211_qosframe);
760 	} else {
761 		wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA;
762 
763 		txd->pktlen = htole16(sizeof(struct ieee80211_frame));
764 		pktlen += sizeof(struct ieee80211_frame);
765 	}
766 
767 	rtwn_fill_tx_desc_null(sc, ptr,
768 	    ic->ic_curmode == IEEE80211_MODE_11B, qos, uvp->id);
769 
770 	return (pktlen);
771 }
772 
773 static int
774 rtwn_push_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap)
775 {
776 	struct rtwn_vap *uvp = RTWN_VAP(vap);
777 	struct ieee80211com *ic = vap->iv_ic;
778 	struct ieee80211_channel *c = ic->ic_curchan;
779 	struct mbuf *m;
780 	uint8_t *ptr;
781 	int required_size, bcn_size, null_size, null_data, error;
782 
783 	if (!(sc->sc_flags & RTWN_FW_LOADED))
784 		return (0);	/* requires firmware */
785 
786 	KASSERT(sc->page_size > 0, ("page size was not set!\n"));
787 
788 	/* Leave some space for beacon (multi-vap) */
789 	bcn_size = roundup(RTWN_BCN_MAX_SIZE, sc->page_size);
790 	/* 1 page for Null Data + 1 page for Qos Null Data frames. */
791 	required_size = bcn_size + sc->page_size * 2;
792 
793 	m = m_get2(required_size, M_NOWAIT, MT_DATA, M_PKTHDR);
794 	if (m == NULL)
795 		return (ENOMEM);
796 
797 	/* Setup beacon descriptor. */
798 	rtwn_beacon_set_rate(sc, &uvp->bcn_desc.txd[0],
799 	    IEEE80211_IS_CHAN_5GHZ(c));
800 
801 	ptr = mtod(m, uint8_t *);
802 	memset(ptr, 0, required_size - sc->txdesc_len);
803 
804 	/* Construct Null Data frame. */
805 	ptr += bcn_size - sc->txdesc_len;
806 	null_size = rtwn_construct_nulldata(sc, vap, ptr, 0);
807 	KASSERT(null_size < sc->page_size,
808 	    ("recalculate size for Null Data frame\n"));
809 
810 	/* Construct Qos Null Data frame. */
811 	ptr += roundup(null_size, sc->page_size);
812 	null_size = rtwn_construct_nulldata(sc, vap, ptr, 1);
813 	KASSERT(null_size < sc->page_size,
814 	    ("recalculate size for Qos Null Data frame\n"));
815 
816 	/* Do not try to detect a beacon here. */
817 	rtwn_setbits_1_shift(sc, R92C_CR, 0, R92C_CR_ENSWBCN, 1);
818 	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
819 	    R92C_FWHW_TXQ_CTRL_REAL_BEACON, 0, 2);
820 
821 	if (uvp->bcn_mbuf != NULL) {
822 		rtwn_beacon_unload(sc, uvp->id);
823 		m_freem(uvp->bcn_mbuf);
824 	}
825 
826 	m->m_pkthdr.len = m->m_len = required_size - sc->txdesc_len;
827 	uvp->bcn_mbuf = m;
828 
829 	error = rtwn_tx_beacon_check(sc, uvp);
830 	if (error != 0) {
831 		RTWN_DPRINTF(sc, RTWN_DEBUG_BEACON,
832 		    "%s: frame was not recognized!\n", __func__);
833 		goto fail;
834 	}
835 
836 	/* Setup addresses in firmware. */
837 	null_data = howmany(bcn_size, sc->page_size);
838 	error = rtwn_set_rsvd_page(sc, 0, null_data, null_data + 1);
839 	if (error != 0) {
840 		device_printf(sc->sc_dev,
841 		    "%s: CMD_RSVD_PAGE was not sent, error %d\n",
842 		    __func__, error);
843 		goto fail;
844 	}
845 
846 fail:
847 	/* Re-enable beacon detection. */
848 	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
849 	    0, R92C_FWHW_TXQ_CTRL_REAL_BEACON, 2);
850 	rtwn_setbits_1_shift(sc, R92C_CR, R92C_CR_ENSWBCN, 0, 1);
851 
852 	/* Restore beacon (if present). */
853 	if (sc->bcn_vaps > 0 && sc->vaps[!uvp->id] != NULL) {
854 		struct rtwn_vap *uvp2 = sc->vaps[!uvp->id];
855 
856 		if (uvp2->curr_mode != R92C_MSR_NOLINK)
857 			error = rtwn_tx_beacon_check(sc, uvp2);
858 	}
859 
860 	return (error);
861 }
862 
863 static void
864 rtwn_pwrmode_init(void *arg)
865 {
866 	struct rtwn_softc *sc = arg;
867 
868 	rtwn_cmd_sleepable(sc, NULL, 0, rtwn_set_pwrmode_cb);
869 }
870 
871 static void
872 rtwn_set_pwrmode_cb(struct rtwn_softc *sc, union sec_param *data)
873 {
874 	struct ieee80211vap *vap = &sc->vaps[0]->vap;
875 
876 	if (vap != NULL)
877 		rtwn_set_pwrmode(sc, vap, 1);
878 }
879 #endif
880 
881 static void
882 rtwn_tsf_sync_adhoc(void *arg)
883 {
884 	struct ieee80211vap *vap = arg;
885 	struct ieee80211com *ic = vap->iv_ic;
886 	struct rtwn_vap *uvp = RTWN_VAP(vap);
887 
888 	if (uvp->curr_mode != R92C_MSR_NOLINK) {
889 		/* Do it in process context. */
890 		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
891 	}
892 }
893 
894 /*
895  * Workaround for TSF synchronization:
896  * when BSSID filter in IBSS mode is not set
897  * (and TSF synchronization is enabled), then any beacon may update it.
898  * This routine synchronizes it when BSSID matching is enabled (IBSS merge
899  * is not possible during this period).
900  *
901  * NOTE: there is no race with rtwn_newstate(), since it uses the same
902  * taskqueue.
903  */
904 static void
905 rtwn_tsf_sync_adhoc_task(void *arg, int pending)
906 {
907 	struct ieee80211vap *vap = arg;
908 	struct rtwn_vap *uvp = RTWN_VAP(vap);
909 	struct rtwn_softc *sc = vap->iv_ic->ic_softc;
910 	struct ieee80211_node *ni;
911 
912 	RTWN_LOCK(sc);
913 	ni = ieee80211_ref_node(vap->iv_bss);
914 
915 	/* Accept beacons with the same BSSID. */
916 	rtwn_set_rx_bssid_all(sc, 0);
917 
918 	/* Deny RCR updates. */
919 	sc->sc_flags |= RTWN_RCR_LOCKED;
920 
921 	/* Enable synchronization. */
922 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
923 	    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
924 
925 	/* Synchronize. */
926 	rtwn_delay(sc, ni->ni_intval * 5 * 1000);
927 
928 	/* Disable synchronization. */
929 	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
930 	    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
931 
932 	/* Accept all beacons. */
933 	sc->sc_flags &= ~RTWN_RCR_LOCKED;
934 	rtwn_set_rx_bssid_all(sc, 1);
935 
936 	/* Schedule next TSF synchronization. */
937 	callout_reset(&uvp->tsf_sync_adhoc, 60*hz, rtwn_tsf_sync_adhoc, vap);
938 
939 	ieee80211_free_node(ni);
940 	RTWN_UNLOCK(sc);
941 }
942 
943 static void
944 rtwn_tsf_sync_enable(struct rtwn_softc *sc, struct ieee80211vap *vap)
945 {
946 	struct ieee80211com *ic = &sc->sc_ic;
947 	struct rtwn_vap *uvp = RTWN_VAP(vap);
948 
949 	/* Reset TSF. */
950 	rtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RESET(uvp->id));
951 
952 	switch (vap->iv_opmode) {
953 	case IEEE80211_M_STA:
954 		/* Enable TSF synchronization. */
955 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
956 		    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
957 		break;
958 	case IEEE80211_M_IBSS:
959 		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
960 		/* FALLTHROUGH */
961 	case IEEE80211_M_HOSTAP:
962 		/* Enable beaconing. */
963 		rtwn_beacon_enable(sc, uvp->id, 1);
964 		break;
965 	default:
966 		device_printf(sc->sc_dev, "undefined opmode %d\n",
967 		    vap->iv_opmode);
968 		return;
969 	}
970 }
971 
972 static void
973 rtwn_set_ack_preamble(struct rtwn_softc *sc)
974 {
975 	struct ieee80211com *ic = &sc->sc_ic;
976 	uint32_t reg;
977 
978 	reg = rtwn_read_4(sc, R92C_WMAC_TRXPTCL_CTL);
979 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
980 		reg |= R92C_WMAC_TRXPTCL_SHPRE;
981 	else
982 		reg &= ~R92C_WMAC_TRXPTCL_SHPRE;
983 	rtwn_write_4(sc, R92C_WMAC_TRXPTCL_CTL, reg);
984 }
985 
986 static void
987 rtwn_set_mode(struct rtwn_softc *sc, uint8_t mode, int id)
988 {
989 
990 	rtwn_setbits_1(sc, R92C_MSR, R92C_MSR_MASK << id * 2, mode << id * 2);
991 	if (sc->vaps[id] != NULL)
992 		sc->vaps[id]->curr_mode = mode;
993 }
994 
995 static int
996 rtwn_monitor_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate,
997     int arg)
998 {
999 	struct ieee80211com *ic = vap->iv_ic;
1000 	struct rtwn_softc *sc = ic->ic_softc;
1001 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1002 
1003 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1004 	    ieee80211_state_name[vap->iv_state],
1005 	    ieee80211_state_name[nstate]);
1006 
1007 	if (vap->iv_state != nstate) {
1008 		IEEE80211_UNLOCK(ic);
1009 		RTWN_LOCK(sc);
1010 
1011 		switch (nstate) {
1012 		case IEEE80211_S_INIT:
1013 			sc->vaps_running--;
1014 			sc->monvaps_running--;
1015 
1016 			if (sc->vaps_running == 0) {
1017 				/* Turn link LED off. */
1018 				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1019 			}
1020 			break;
1021 		case IEEE80211_S_RUN:
1022 			sc->vaps_running++;
1023 			sc->monvaps_running++;
1024 
1025 			if (sc->vaps_running == 1) {
1026 				/* Turn link LED on. */
1027 				rtwn_set_led(sc, RTWN_LED_LINK, 1);
1028 			}
1029 			break;
1030 		default:
1031 			/* NOTREACHED */
1032 			break;
1033 		}
1034 
1035 		RTWN_UNLOCK(sc);
1036 		IEEE80211_LOCK(ic);
1037 	}
1038 
1039 	return (uvp->newstate(vap, nstate, arg));
1040 }
1041 
1042 static int
1043 rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1044 {
1045 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1046 	struct ieee80211com *ic = vap->iv_ic;
1047 	struct rtwn_softc *sc = ic->ic_softc;
1048 	enum ieee80211_state ostate;
1049 	int error, early_newstate;
1050 
1051 	ostate = vap->iv_state;
1052 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1053 	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
1054 
1055 	if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC &&
1056 	    ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_RUN) {
1057 		/* need to call iv_newstate() firstly */
1058 		error = uvp->newstate(vap, nstate, arg);
1059 		if (error != 0)
1060 			return (error);
1061 
1062 		early_newstate = 1;
1063 	} else
1064 		early_newstate = 0;
1065 
1066 	if (ostate == IEEE80211_S_CSA) {
1067 		taskqueue_cancel_timeout(taskqueue_thread,
1068 		    &uvp->tx_beacon_csa, NULL);
1069 
1070 		/*
1071 		 * In multi-vap case second counter may not be cleared
1072 		 * properly.
1073 		 */
1074 		vap->iv_csa_count = 0;
1075 	}
1076 	IEEE80211_UNLOCK(ic);
1077 	RTWN_LOCK(sc);
1078 
1079 	if (ostate == IEEE80211_S_CSA) {
1080 		/* Unblock all queues (multi-vap case). */
1081 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1082 	}
1083 
1084 	if ((ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_CSA) ||
1085 	    ostate == IEEE80211_S_CSA) {
1086 		sc->vaps_running--;
1087 
1088 		/* Set media status to 'No Link'. */
1089 		rtwn_set_mode(sc, R92C_MSR_NOLINK, uvp->id);
1090 
1091 		if (vap->iv_opmode == IEEE80211_M_IBSS) {
1092 			/* Stop periodical TSF synchronization. */
1093 			callout_stop(&uvp->tsf_sync_adhoc);
1094 		}
1095 
1096 		/* Disable TSF synchronization / beaconing. */
1097 		rtwn_beacon_enable(sc, uvp->id, 0);
1098 		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
1099 		    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
1100 
1101 		/* NB: monitor mode vaps are using port 0. */
1102 		if (uvp->id != 0 || sc->monvaps_running == 0) {
1103 			/* Reset TSF. */
1104 			rtwn_write_1(sc, R92C_DUAL_TSF_RST,
1105 			    R92C_DUAL_TSF_RESET(uvp->id));
1106 		}
1107 
1108 #ifndef RTWN_WITHOUT_UCODE
1109 		if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 && uvp->id == 0) {
1110 			/* Disable power management. */
1111 			callout_stop(&sc->sc_pwrmode_init);
1112 			rtwn_set_pwrmode(sc, vap, 0);
1113 		}
1114 #endif
1115 		if (sc->vaps_running - sc->monvaps_running > 0) {
1116 			/* Recalculate basic rates bitmap. */
1117 			rtwn_calc_basicrates(sc);
1118 		}
1119 
1120 		if (sc->vaps_running == sc->monvaps_running) {
1121 			/* Stop calibration. */
1122 			callout_stop(&sc->sc_calib_to);
1123 
1124 			/* Stop Rx of data frames. */
1125 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1126 
1127 			/* Reset EDCA parameters. */
1128 			rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1129 			rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1130 			rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1131 			rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1132 
1133 			if (sc->vaps_running == 0) {
1134 				/* Turn link LED off. */
1135 				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1136 			}
1137 		}
1138 	}
1139 
1140 	error = 0;
1141 	switch (nstate) {
1142 	case IEEE80211_S_SCAN:
1143 		/* Pause AC Tx queues. */
1144 		if (sc->vaps_running == 0)
1145 			rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_AC);
1146 		break;
1147 	case IEEE80211_S_RUN:
1148 		error = rtwn_run(sc, vap);
1149 		if (error != 0) {
1150 			device_printf(sc->sc_dev,
1151 			    "%s: could not move to RUN state\n", __func__);
1152 			break;
1153 		}
1154 
1155 		sc->vaps_running++;
1156 		break;
1157 	case IEEE80211_S_CSA:
1158 		/* Block all Tx queues (except beacon queue). */
1159 		rtwn_setbits_1(sc, R92C_TXPAUSE, 0,
1160 		    R92C_TX_QUEUE_AC | R92C_TX_QUEUE_MGT | R92C_TX_QUEUE_HIGH);
1161 		break;
1162 	default:
1163 		break;
1164 	}
1165 
1166 	RTWN_UNLOCK(sc);
1167 	IEEE80211_LOCK(ic);
1168 	if (error != 0)
1169 		return (error);
1170 
1171 	return (early_newstate ? 0 : uvp->newstate(vap, nstate, arg));
1172 }
1173 
1174 static void
1175 rtwn_calc_basicrates(struct rtwn_softc *sc)
1176 {
1177 	struct ieee80211com *ic = &sc->sc_ic;
1178 	uint32_t basicrates;
1179 	int i;
1180 
1181 	RTWN_ASSERT_LOCKED(sc);
1182 
1183 	if (ic->ic_flags & IEEE80211_F_SCAN)
1184 		return;		/* will be done by rtwn_scan_end(). */
1185 
1186 	basicrates = 0;
1187 	for (i = 0; i < nitems(sc->vaps); i++) {
1188 		struct rtwn_vap *rvp;
1189 		struct ieee80211vap *vap;
1190 		struct ieee80211_node *ni;
1191 		uint32_t rates;
1192 
1193 		rvp = sc->vaps[i];
1194 		if (rvp == NULL || rvp->curr_mode == R92C_MSR_NOLINK)
1195 			continue;
1196 
1197 		vap = &rvp->vap;
1198 		if (vap->iv_bss == NULL)
1199 			continue;
1200 
1201 		ni = ieee80211_ref_node(vap->iv_bss);
1202 		rtwn_get_rates(sc, &ni->ni_rates, NULL, &rates, NULL, 1);
1203 		basicrates |= rates;
1204 		ieee80211_free_node(ni);
1205 	}
1206 
1207 	if (basicrates == 0)
1208 		return;
1209 
1210 	/* XXX initial RTS rate? */
1211 	rtwn_set_basicrates(sc, basicrates);
1212 }
1213 
1214 static int
1215 rtwn_run(struct rtwn_softc *sc, struct ieee80211vap *vap)
1216 {
1217 	struct ieee80211com *ic = vap->iv_ic;
1218 	struct rtwn_vap *uvp = RTWN_VAP(vap);
1219 	struct ieee80211_node *ni;
1220 	uint8_t mode;
1221 	int error;
1222 
1223 	RTWN_ASSERT_LOCKED(sc);
1224 
1225 	error = 0;
1226 	ni = ieee80211_ref_node(vap->iv_bss);
1227 
1228 	if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1229 	    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1230 		error = EINVAL;
1231 		goto fail;
1232 	}
1233 
1234 	switch (vap->iv_opmode) {
1235 	case IEEE80211_M_STA:
1236 		mode = R92C_MSR_INFRA;
1237 		break;
1238 	case IEEE80211_M_IBSS:
1239 		mode = R92C_MSR_ADHOC;
1240 		break;
1241 	case IEEE80211_M_HOSTAP:
1242 		mode = R92C_MSR_AP;
1243 		break;
1244 	default:
1245 		KASSERT(0, ("undefined opmode %d\n", vap->iv_opmode));
1246 		error = EINVAL;
1247 		goto fail;
1248 	}
1249 
1250 	/* Set media status to 'Associated'. */
1251 	rtwn_set_mode(sc, mode, uvp->id);
1252 
1253 	/* Set AssocID. */
1254 	/* XXX multi-vap? */
1255 	rtwn_write_2(sc, R92C_BCN_PSR_RPT,
1256 	    0xc000 | IEEE80211_NODE_AID(ni));
1257 
1258 	/* Set BSSID. */
1259 	rtwn_set_bssid(sc, ni->ni_bssid, uvp->id);
1260 
1261 	/* Set beacon interval. */
1262 	rtwn_write_2(sc, R92C_BCN_INTERVAL(uvp->id), ni->ni_intval);
1263 
1264 	if (sc->vaps_running == sc->monvaps_running) {
1265 		/* Enable Rx of data frames. */
1266 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1267 
1268 		/* Flush all AC queues. */
1269 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1270 	}
1271 
1272 #ifndef RTWN_WITHOUT_UCODE
1273 	/* Upload (QoS) Null Data frame to firmware. */
1274 	/* Note: do this for port 0 only. */
1275 	if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 &&
1276 	    vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
1277 		error = rtwn_tx_fwpkt_check(sc, vap);
1278 		if (error != 0)
1279 			goto fail;
1280 
1281 		/* Setup power management. */
1282 		/*
1283 		 * NB: it will be enabled immediately - delay it,
1284 		 * so 4-Way handshake will not be interrupted.
1285 		 */
1286 		callout_reset(&sc->sc_pwrmode_init, 5*hz,
1287 		    rtwn_pwrmode_init, sc);
1288 	}
1289 #endif
1290 
1291 	/* Enable TSF synchronization. */
1292 	rtwn_tsf_sync_enable(sc, vap);
1293 
1294 	if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1295 	    vap->iv_opmode == IEEE80211_M_IBSS) {
1296 		error = rtwn_setup_beacon(sc, ni);
1297 		if (error != 0) {
1298 			device_printf(sc->sc_dev,
1299 			    "unable to push beacon into the chip, "
1300 			    "error %d\n", error);
1301 			goto fail;
1302 		}
1303 	}
1304 
1305 	/* Set ACK preamble type. */
1306 	rtwn_set_ack_preamble(sc);
1307 
1308 	/* Set basic rates mask. */
1309 	rtwn_calc_basicrates(sc);
1310 
1311 #ifdef RTWN_TODO
1312 	rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1313 	rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1314 	rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1315 	rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1316 	rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1317 	rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1318 #endif
1319 
1320 	if (sc->vaps_running == sc->monvaps_running) {
1321 		/* Reset temperature calibration state machine. */
1322 		sc->sc_flags &= ~RTWN_TEMP_MEASURED;
1323 		sc->thcal_temp = sc->thermal_meter;
1324 
1325 		/* Start periodic calibration. */
1326 		callout_reset(&sc->sc_calib_to, 2*hz, rtwn_calib_to,
1327 		    sc);
1328 
1329 		if (sc->vaps_running == 0) {
1330 			/* Turn link LED on. */
1331 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1332 		}
1333 	}
1334 
1335 fail:
1336 	ieee80211_free_node(ni);
1337 
1338 	return (error);
1339 }
1340 
1341 #ifndef D4054
1342 static void
1343 rtwn_watchdog(void *arg)
1344 {
1345 	struct rtwn_softc *sc = arg;
1346 	struct ieee80211com *ic = &sc->sc_ic;
1347 
1348 	RTWN_ASSERT_LOCKED(sc);
1349 
1350 	KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1351 
1352 	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1353 		ic_printf(ic, "device timeout\n");
1354 		ieee80211_restart_all(ic);
1355 		return;
1356 	}
1357 	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
1358 }
1359 #endif
1360 
1361 static void
1362 rtwn_parent(struct ieee80211com *ic)
1363 {
1364 	struct rtwn_softc *sc = ic->ic_softc;
1365 	struct ieee80211vap *vap;
1366 
1367 	if (ic->ic_nrunning > 0) {
1368 		if (rtwn_init(sc) != 0) {
1369 			IEEE80211_LOCK(ic);
1370 			TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1371 				ieee80211_stop_locked(vap);
1372 			IEEE80211_UNLOCK(ic);
1373 		} else
1374 			ieee80211_start_all(ic);
1375 	} else
1376 		rtwn_stop(sc);
1377 }
1378 
1379 static int
1380 rtwn_dma_init(struct rtwn_softc *sc)
1381 {
1382 #define RTWN_CHK(res) do {	\
1383 	if (res != 0)		\
1384 		return (EIO);	\
1385 } while(0)
1386 	uint16_t reg;
1387 	uint8_t tx_boundary;
1388 	int error;
1389 
1390 	/* Initialize LLT table. */
1391 	error = rtwn_llt_init(sc);
1392 	if (error != 0)
1393 		return (error);
1394 
1395 	/* Set the number of pages for each queue. */
1396 	RTWN_DPRINTF(sc, RTWN_DEBUG_RESET,
1397 	    "%s: pages per queue: high %d, normal %d, low %d, public %d\n",
1398 	    __func__, sc->nhqpages, sc->nnqpages, sc->nlqpages,
1399 	    sc->npubqpages);
1400 
1401 	RTWN_CHK(rtwn_write_1(sc, R92C_RQPN_NPQ, sc->nnqpages));
1402 	RTWN_CHK(rtwn_write_4(sc, R92C_RQPN,
1403 	    /* Set number of pages for public queue. */
1404 	    SM(R92C_RQPN_PUBQ, sc->npubqpages) |
1405 	    /* Set number of pages for high priority queue. */
1406 	    SM(R92C_RQPN_HPQ, sc->nhqpages) |
1407 	    /* Set number of pages for low priority queue. */
1408 	    SM(R92C_RQPN_LPQ, sc->nlqpages) |
1409 	    /* Load values. */
1410 	    R92C_RQPN_LD));
1411 
1412 	/* Initialize TX buffer boundary. */
1413 	KASSERT(sc->page_count < 255 && sc->page_count > 0,
1414 	    ("page_count is %d\n", sc->page_count));
1415 	tx_boundary = sc->page_count + 1;
1416 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary));
1417 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary));
1418 	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary));
1419 	RTWN_CHK(rtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary));
1420 	RTWN_CHK(rtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary));
1421 
1422 	error = rtwn_init_bcnq1_boundary(sc);
1423 	if (error != 0)
1424 		return (error);
1425 
1426 	/* Set queue to USB pipe mapping. */
1427 	/* Note: PCIe devices are using some magic number here. */
1428 	reg = rtwn_get_qmap(sc);
1429 	RTWN_CHK(rtwn_setbits_2(sc, R92C_TRXDMA_CTRL,
1430 	    R92C_TRXDMA_CTRL_QMAP_M, reg));
1431 
1432 	/* Configure Tx/Rx DMA (PCIe). */
1433 	rtwn_set_desc_addr(sc);
1434 
1435 	/* Set Tx/Rx transfer page boundary. */
1436 	RTWN_CHK(rtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
1437 	    sc->rx_dma_size - 1));
1438 
1439 	/* Set Tx/Rx transfer page size. */
1440 	rtwn_set_page_size(sc);
1441 
1442 	return (0);
1443 }
1444 
1445 static int
1446 rtwn_mac_init(struct rtwn_softc *sc)
1447 {
1448 	int i, error;
1449 
1450 	/* Write MAC initialization values. */
1451 	for (i = 0; i < sc->mac_size; i++) {
1452 		error = rtwn_write_1(sc, sc->mac_prog[i].reg,
1453 		    sc->mac_prog[i].val);
1454 		if (error != 0)
1455 			return (error);
1456 	}
1457 
1458 	return (0);
1459 }
1460 
1461 static void
1462 rtwn_mrr_init(struct rtwn_softc *sc)
1463 {
1464 	int i;
1465 
1466 	/* Drop rate index by 1 per retry. */
1467 	for (i = 0; i < R92C_DARFRC_SIZE; i++) {
1468 		rtwn_write_1(sc, R92C_DARFRC + i, i + 1);
1469 		rtwn_write_1(sc, R92C_RARFRC + i, i + 1);
1470 	}
1471 }
1472 
1473 static void
1474 rtwn_scan_start(struct ieee80211com *ic)
1475 {
1476 	struct rtwn_softc *sc = ic->ic_softc;
1477 
1478 	RTWN_LOCK(sc);
1479 	/* Pause beaconing. */
1480 	rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_BCN);
1481 	/* Receive beacons / probe responses from any BSSID. */
1482 	if (sc->bcn_vaps == 0)
1483 		rtwn_set_rx_bssid_all(sc, 1);
1484 	RTWN_UNLOCK(sc);
1485 }
1486 
1487 static void
1488 rtwn_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
1489 {
1490 	struct rtwn_softc *sc = ss->ss_ic->ic_softc;
1491 
1492 	/* Make link LED blink during scan. */
1493 	RTWN_LOCK(sc);
1494 	rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1495 	RTWN_UNLOCK(sc);
1496 
1497 	sc->sc_scan_curchan(ss, maxdwell);
1498 }
1499 
1500 static void
1501 rtwn_scan_end(struct ieee80211com *ic)
1502 {
1503 	struct rtwn_softc *sc = ic->ic_softc;
1504 
1505 	RTWN_LOCK(sc);
1506 	/* Restore limitations. */
1507 	if (ic->ic_promisc == 0 && sc->bcn_vaps == 0)
1508 		rtwn_set_rx_bssid_all(sc, 0);
1509 
1510 	/* Restore LED state. */
1511 	rtwn_set_led(sc, RTWN_LED_LINK, (sc->vaps_running != 0));
1512 
1513 	/* Restore basic rates mask. */
1514 	rtwn_calc_basicrates(sc);
1515 
1516 	/* Resume beaconing. */
1517 	rtwn_setbits_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_BCN, 0);
1518 	RTWN_UNLOCK(sc);
1519 }
1520 
1521 static void
1522 rtwn_getradiocaps(struct ieee80211com *ic,
1523     int maxchans, int *nchans, struct ieee80211_channel chans[])
1524 {
1525 	struct rtwn_softc *sc = ic->ic_softc;
1526 	uint8_t bands[IEEE80211_MODE_BYTES];
1527 	int cbw_flags, i;
1528 
1529 	cbw_flags = (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) ?
1530 	    NET80211_CBW_FLAG_HT40 : 0;
1531 
1532 	memset(bands, 0, sizeof(bands));
1533 	setbit(bands, IEEE80211_MODE_11B);
1534 	setbit(bands, IEEE80211_MODE_11G);
1535 	setbit(bands, IEEE80211_MODE_11NG);
1536 	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
1537 	    bands, cbw_flags);
1538 
1539 	/* XXX workaround add_channel_list() limitations */
1540 	setbit(bands, IEEE80211_MODE_11A);
1541 	setbit(bands, IEEE80211_MODE_11NA);
1542 	for (i = 0; i < nitems(sc->chan_num_5ghz); i++) {
1543 		if (sc->chan_num_5ghz[i] == 0)
1544 			continue;
1545 
1546 		ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
1547 		    sc->chan_list_5ghz[i], sc->chan_num_5ghz[i], bands,
1548 		    cbw_flags);
1549 	}
1550 }
1551 
1552 static void
1553 rtwn_update_chw(struct ieee80211com *ic)
1554 {
1555 }
1556 
1557 static void
1558 rtwn_set_channel(struct ieee80211com *ic)
1559 {
1560 	struct rtwn_softc *sc = ic->ic_softc;
1561 	struct ieee80211_channel *c = ic->ic_curchan;
1562 
1563 	RTWN_LOCK(sc);
1564 	rtwn_set_chan(sc, c);
1565 	RTWN_UNLOCK(sc);
1566 }
1567 
1568 static int
1569 rtwn_wme_update(struct ieee80211com *ic)
1570 {
1571 	struct chanAccParams chp;
1572 	struct ieee80211_channel *c = ic->ic_curchan;
1573 	struct rtwn_softc *sc = ic->ic_softc;
1574 	struct wmeParams *wmep = sc->cap_wmeParams;
1575 	uint8_t aifs, acm, slottime;
1576 	int ac;
1577 
1578 	ieee80211_wme_ic_getparams(ic, &chp);
1579 
1580 	/* Prevent possible races. */
1581 	IEEE80211_LOCK(ic);	/* XXX */
1582 	RTWN_LOCK(sc);
1583 	memcpy(wmep, chp.cap_wmeParams, sizeof(sc->cap_wmeParams));
1584 	RTWN_UNLOCK(sc);
1585 	IEEE80211_UNLOCK(ic);
1586 
1587 	acm = 0;
1588 	slottime = IEEE80211_GET_SLOTTIME(ic);
1589 
1590 	RTWN_LOCK(sc);
1591 	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1592 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1593 		aifs = wmep[ac].wmep_aifsn * slottime +
1594 		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1595 			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1596 		rtwn_write_4(sc, wme2reg[ac],
1597 		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
1598 		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
1599 		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
1600 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1601 		if (ac != WME_AC_BE)
1602 			acm |= wmep[ac].wmep_acm << ac;
1603 	}
1604 
1605 	if (acm != 0)
1606 		acm |= R92C_ACMHWCTRL_EN;
1607 	rtwn_setbits_1(sc, R92C_ACMHWCTRL, R92C_ACMHWCTRL_ACM_MASK, acm);
1608 	RTWN_UNLOCK(sc);
1609 
1610 	return 0;
1611 }
1612 
1613 static void
1614 rtwn_update_slot(struct ieee80211com *ic)
1615 {
1616 	rtwn_cmd_sleepable(ic->ic_softc, NULL, 0, rtwn_update_slot_cb);
1617 }
1618 
1619 static void
1620 rtwn_update_slot_cb(struct rtwn_softc *sc, union sec_param *data)
1621 {
1622 	struct ieee80211com *ic = &sc->sc_ic;
1623 	uint8_t slottime;
1624 
1625 	slottime = IEEE80211_GET_SLOTTIME(ic);
1626 
1627 	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s: setting slot time to %uus\n",
1628 	    __func__, slottime);
1629 
1630 	rtwn_write_1(sc, R92C_SLOT, slottime);
1631 	rtwn_update_aifs(sc, slottime);
1632 }
1633 
1634 static void
1635 rtwn_update_aifs(struct rtwn_softc *sc, uint8_t slottime)
1636 {
1637 	struct ieee80211_channel *c = sc->sc_ic.ic_curchan;
1638 	const struct wmeParams *wmep = sc->cap_wmeParams;
1639 	uint8_t aifs, ac;
1640 
1641 	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1642 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1643 		aifs = wmep[ac].wmep_aifsn * slottime +
1644 		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1645 			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1646 		rtwn_write_1(sc, wme2reg[ac], aifs);
1647 	}
1648 }
1649 
1650 static void
1651 rtwn_update_promisc(struct ieee80211com *ic)
1652 {
1653 	struct rtwn_softc *sc = ic->ic_softc;
1654 
1655 	RTWN_LOCK(sc);
1656 	if (sc->sc_flags & RTWN_RUNNING)
1657 		rtwn_set_promisc(sc);
1658 	RTWN_UNLOCK(sc);
1659 }
1660 
1661 static void
1662 rtwn_update_mcast(struct ieee80211com *ic)
1663 {
1664 	struct rtwn_softc *sc = ic->ic_softc;
1665 
1666 	RTWN_LOCK(sc);
1667 	if (sc->sc_flags & RTWN_RUNNING)
1668 		rtwn_set_multi(sc);
1669 	RTWN_UNLOCK(sc);
1670 }
1671 
1672 static int
1673 rtwn_set_bssid(struct rtwn_softc *sc, const uint8_t *bssid, int id)
1674 {
1675 	int error;
1676 
1677 	error = rtwn_write_4(sc, R92C_BSSID(id), le32dec(&bssid[0]));
1678 	if (error != 0)
1679 		return (error);
1680 	error = rtwn_write_2(sc, R92C_BSSID(id) + 4, le16dec(&bssid[4]));
1681 
1682 	return (error);
1683 }
1684 
1685 static int
1686 rtwn_set_macaddr(struct rtwn_softc *sc, const uint8_t *addr, int id)
1687 {
1688 	int error;
1689 
1690 	error = rtwn_write_4(sc, R92C_MACID(id), le32dec(&addr[0]));
1691 	if (error != 0)
1692 		return (error);
1693 	error = rtwn_write_2(sc, R92C_MACID(id) + 4, le16dec(&addr[4]));
1694 
1695 	return (error);
1696 }
1697 
1698 static struct ieee80211_node *
1699 rtwn_node_alloc(struct ieee80211vap *vap,
1700     const uint8_t mac[IEEE80211_ADDR_LEN])
1701 {
1702 	struct rtwn_node *un;
1703 
1704 	un = malloc(sizeof (struct rtwn_node), M_80211_NODE,
1705 	    M_NOWAIT | M_ZERO);
1706 
1707 	if (un == NULL)
1708 		return NULL;
1709 
1710 	un->id = RTWN_MACID_UNDEFINED;
1711 	un->avg_pwdb = -1;
1712 
1713 	return &un->ni;
1714 }
1715 
1716 static void
1717 rtwn_newassoc(struct ieee80211_node *ni, int isnew __unused)
1718 {
1719 	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1720 	struct rtwn_node *un = RTWN_NODE(ni);
1721 	int id;
1722 
1723 	if (un->id != RTWN_MACID_UNDEFINED)
1724 		return;
1725 
1726 	RTWN_NT_LOCK(sc);
1727 	for (id = 0; id <= sc->macid_limit; id++) {
1728 		if (id != RTWN_MACID_BC && sc->node_list[id] == NULL) {
1729 			un->id = id;
1730 			sc->node_list[id] = ni;
1731 			break;
1732 		}
1733 	}
1734 	RTWN_NT_UNLOCK(sc);
1735 
1736 	if (id > sc->macid_limit) {
1737 		device_printf(sc->sc_dev, "%s: node table is full\n",
1738 		    __func__);
1739 		return;
1740 	}
1741 
1742 	/* Notify firmware. */
1743 	id |= RTWN_MACID_VALID;
1744 	rtwn_cmd_sleepable(sc, &id, sizeof(id), rtwn_set_media_status);
1745 }
1746 
1747 static void
1748 rtwn_node_free(struct ieee80211_node *ni)
1749 {
1750 	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1751 	struct rtwn_node *un = RTWN_NODE(ni);
1752 
1753 	RTWN_NT_LOCK(sc);
1754 	if (un->id != RTWN_MACID_UNDEFINED) {
1755 		sc->node_list[un->id] = NULL;
1756 		rtwn_cmd_sleepable(sc, &un->id, sizeof(un->id),
1757 		    rtwn_set_media_status);
1758 	}
1759 	RTWN_NT_UNLOCK(sc);
1760 
1761 	sc->sc_node_free(ni);
1762 }
1763 
1764 static void
1765 rtwn_init_beacon_reg(struct rtwn_softc *sc)
1766 {
1767 	rtwn_write_1(sc, R92C_BCN_CTRL(0), R92C_BCN_CTRL_DIS_TSF_UDT0);
1768 	rtwn_write_1(sc, R92C_BCN_CTRL(1), R92C_BCN_CTRL_DIS_TSF_UDT0);
1769 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
1770 	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
1771 	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
1772 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
1773 }
1774 
1775 static int
1776 rtwn_init(struct rtwn_softc *sc)
1777 {
1778 	struct ieee80211com *ic = &sc->sc_ic;
1779 	int i, error;
1780 
1781 	RTWN_LOCK(sc);
1782 	if (sc->sc_flags & RTWN_RUNNING) {
1783 		RTWN_UNLOCK(sc);
1784 		return (0);
1785 	}
1786 	sc->sc_flags |= RTWN_STARTED;
1787 
1788 	/* Power on adapter. */
1789 	error = rtwn_power_on(sc);
1790 	if (error != 0)
1791 		goto fail;
1792 
1793 #ifndef RTWN_WITHOUT_UCODE
1794 	/* Load 8051 microcode. */
1795 	error = rtwn_load_firmware(sc);
1796 	if (error == 0)
1797 		sc->sc_flags |= RTWN_FW_LOADED;
1798 
1799 	/* Init firmware commands ring. */
1800 	sc->fwcur = 0;
1801 #endif
1802 
1803 	/* Initialize MAC block. */
1804 	error = rtwn_mac_init(sc);
1805 	if (error != 0) {
1806 		device_printf(sc->sc_dev,
1807 		    "%s: error while initializing MAC block\n", __func__);
1808 		goto fail;
1809 	}
1810 
1811 	/* Initialize DMA. */
1812 	error = rtwn_dma_init(sc);
1813 	if (error != 0)
1814 		goto fail;
1815 
1816 	/* Drop incorrect TX (USB). */
1817 	rtwn_drop_incorrect_tx(sc);
1818 
1819 	/* Set info size in Rx descriptors (in 64-bit words). */
1820 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, R92C_RX_DRVINFO_SZ_DEF);
1821 
1822 	/* Init interrupts. */
1823 	rtwn_init_intr(sc);
1824 
1825 	for (i = 0; i < nitems(sc->vaps); i++) {
1826 		struct rtwn_vap *uvp = sc->vaps[i];
1827 
1828 		/* Set initial network type. */
1829 		rtwn_set_mode(sc, R92C_MSR_NOLINK, i);
1830 
1831 		if (uvp == NULL)
1832 			continue;
1833 
1834 		/* Set MAC address. */
1835 		error = rtwn_set_macaddr(sc, uvp->vap.iv_myaddr, uvp->id);
1836 		if (error != 0)
1837 			goto fail;
1838 	}
1839 
1840 	/* Initialize Rx filter. */
1841 	rtwn_rxfilter_init(sc);
1842 
1843 	/* Set short/long retry limits. */
1844 	rtwn_write_2(sc, R92C_RL,
1845 	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
1846 
1847 	/* Initialize EDCA parameters. */
1848 	rtwn_init_edca(sc);
1849 
1850 	rtwn_setbits_1(sc, R92C_FWHW_TXQ_CTRL, 0,
1851 	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
1852 	/* Set ACK timeout. */
1853 	rtwn_write_1(sc, R92C_ACKTO, sc->ackto);
1854 
1855 	/* Setup aggregation. */
1856 	/* Tx aggregation. */
1857 	rtwn_init_tx_agg(sc);
1858 	rtwn_init_rx_agg(sc);
1859 
1860 	/* Initialize beacon parameters. */
1861 	rtwn_init_beacon_reg(sc);
1862 
1863 	/* Init A-MPDU parameters. */
1864 	rtwn_init_ampdu(sc);
1865 
1866 	/* Init MACTXEN / MACRXEN after setting RxFF boundary. */
1867 	rtwn_setbits_1(sc, R92C_CR, 0, R92C_CR_MACTXEN | R92C_CR_MACRXEN);
1868 
1869 	/* Initialize BB/RF blocks. */
1870 	rtwn_init_bb(sc);
1871 	rtwn_init_rf(sc);
1872 
1873 	/* Initialize wireless band. */
1874 	rtwn_set_chan(sc, ic->ic_curchan);
1875 
1876 	/* Clear per-station keys table. */
1877 	rtwn_init_cam(sc);
1878 
1879 	/* Enable decryption / encryption. */
1880 	rtwn_init_seccfg(sc);
1881 
1882 	/* Install static keys (if any). */
1883 	for (i = 0; i < nitems(sc->vaps); i++) {
1884 		if (sc->vaps[i] != NULL) {
1885 			error = rtwn_init_static_keys(sc, sc->vaps[i]);
1886 			if (error != 0)
1887 				goto fail;
1888 		}
1889 	}
1890 
1891 	/* Initialize antenna selection. */
1892 	rtwn_init_antsel(sc);
1893 
1894 	/* Enable hardware sequence numbering. */
1895 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
1896 
1897 	/* Disable BAR. */
1898 	rtwn_write_4(sc, R92C_BAR_MODE_CTRL, 0x0201ffff);
1899 
1900 	/* NAV limit. */
1901 	rtwn_write_1(sc, R92C_NAV_UPPER, 0);
1902 
1903 	/* Initialize GPIO setting. */
1904 	rtwn_setbits_1(sc, R92C_GPIO_MUXCFG, R92C_GPIO_MUXCFG_ENBT, 0);
1905 
1906 	/* Initialize MRR. */
1907 	rtwn_mrr_init(sc);
1908 
1909 	/* Device-specific post initialization. */
1910 	rtwn_post_init(sc);
1911 
1912 	rtwn_start_xfers(sc);
1913 
1914 #ifndef D4054
1915 	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
1916 #endif
1917 
1918 	sc->sc_flags |= RTWN_RUNNING;
1919 fail:
1920 	RTWN_UNLOCK(sc);
1921 
1922 	return (error);
1923 }
1924 
1925 static void
1926 rtwn_stop(struct rtwn_softc *sc)
1927 {
1928 
1929 	RTWN_LOCK(sc);
1930 	if (!(sc->sc_flags & RTWN_STARTED)) {
1931 		RTWN_UNLOCK(sc);
1932 		return;
1933 	}
1934 
1935 #ifndef D4054
1936 	callout_stop(&sc->sc_watchdog_to);
1937 	sc->sc_tx_timer = 0;
1938 #endif
1939 	sc->sc_flags &= ~(RTWN_STARTED | RTWN_RUNNING | RTWN_FW_LOADED);
1940 	sc->sc_flags &= ~RTWN_TEMP_MEASURED;
1941 	sc->fwver = 0;
1942 	sc->thcal_temp = 0;
1943 	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
1944 	bzero(&sc->last_physt, sizeof(sc->last_physt));
1945 
1946 #ifdef D4054
1947 	ieee80211_tx_watchdog_stop(&sc->sc_ic);
1948 #endif
1949 
1950 	rtwn_abort_xfers(sc);
1951 	rtwn_drain_mbufq(sc);
1952 	rtwn_power_off(sc);
1953 	rtwn_reset_lists(sc, NULL);
1954 	RTWN_UNLOCK(sc);
1955 }
1956 
1957 MODULE_VERSION(rtwn, 2);
1958 MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
1959 #ifndef RTWN_WITHOUT_UCODE
1960 MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
1961 #endif
1962