xref: /freebsd/sys/dev/usb/wlan/if_rsu.c (revision a3767659f0f9b9ab04b7f4ab1ecb14591f34978f)
131d98677SRui Paulo /*	$OpenBSD: if_rsu.c,v 1.17 2013/04/15 09:23:01 mglocker Exp $	*/
231d98677SRui Paulo 
331d98677SRui Paulo /*-
431d98677SRui Paulo  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
531d98677SRui Paulo  *
631d98677SRui Paulo  * Permission to use, copy, modify, and distribute this software for any
731d98677SRui Paulo  * purpose with or without fee is hereby granted, provided that the above
831d98677SRui Paulo  * copyright notice and this permission notice appear in all copies.
931d98677SRui Paulo  *
1031d98677SRui Paulo  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
1131d98677SRui Paulo  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
1231d98677SRui Paulo  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
1331d98677SRui Paulo  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
1431d98677SRui Paulo  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
1531d98677SRui Paulo  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1631d98677SRui Paulo  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1731d98677SRui Paulo  */
1831d98677SRui Paulo #include <sys/cdefs.h>
1931d98677SRui Paulo __FBSDID("$FreeBSD$");
2031d98677SRui Paulo 
2131d98677SRui Paulo /*
2231d98677SRui Paulo  * Driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU.
2331d98677SRui Paulo  *
2431d98677SRui Paulo  * TODO:
2531d98677SRui Paulo  *   o h/w crypto
2631d98677SRui Paulo  *   o hostap / ibss / mesh
2739089f06SAdrian Chadd  *   o sensible RSSI levels
2839089f06SAdrian Chadd  *   o power-save operation
2931d98677SRui Paulo  */
304914fa0fSAdrian Chadd 
313a8545c3SAdrian Chadd #include "opt_wlan.h"
323a8545c3SAdrian Chadd 
3331d98677SRui Paulo #include <sys/param.h>
3431d98677SRui Paulo #include <sys/endian.h>
3531d98677SRui Paulo #include <sys/sockio.h>
3631d98677SRui Paulo #include <sys/mbuf.h>
3731d98677SRui Paulo #include <sys/kernel.h>
3831d98677SRui Paulo #include <sys/socket.h>
3931d98677SRui Paulo #include <sys/systm.h>
4031d98677SRui Paulo #include <sys/conf.h>
4131d98677SRui Paulo #include <sys/bus.h>
4231d98677SRui Paulo #include <sys/rman.h>
4331d98677SRui Paulo #include <sys/firmware.h>
4431d98677SRui Paulo #include <sys/module.h>
4531d98677SRui Paulo 
4631d98677SRui Paulo #include <machine/bus.h>
4731d98677SRui Paulo #include <machine/resource.h>
4831d98677SRui Paulo 
4931d98677SRui Paulo #include <net/bpf.h>
5031d98677SRui Paulo #include <net/if.h>
5176039bc8SGleb Smirnoff #include <net/if_var.h>
5231d98677SRui Paulo #include <net/if_arp.h>
5331d98677SRui Paulo #include <net/if_dl.h>
5431d98677SRui Paulo #include <net/if_media.h>
5531d98677SRui Paulo #include <net/if_types.h>
5631d98677SRui Paulo 
5731d98677SRui Paulo #include <netinet/in.h>
5831d98677SRui Paulo #include <netinet/in_systm.h>
5931d98677SRui Paulo #include <netinet/in_var.h>
6031d98677SRui Paulo #include <netinet/if_ether.h>
6131d98677SRui Paulo #include <netinet/ip.h>
6231d98677SRui Paulo 
6331d98677SRui Paulo #include <net80211/ieee80211_var.h>
6431d98677SRui Paulo #include <net80211/ieee80211_regdomain.h>
6531d98677SRui Paulo #include <net80211/ieee80211_radiotap.h>
6631d98677SRui Paulo 
6731d98677SRui Paulo #include <dev/usb/usb.h>
6831d98677SRui Paulo #include <dev/usb/usbdi.h>
6931d98677SRui Paulo #include "usbdevs.h"
7031d98677SRui Paulo 
7131d98677SRui Paulo #define USB_DEBUG_VAR rsu_debug
7231d98677SRui Paulo #include <dev/usb/usb_debug.h>
7331d98677SRui Paulo 
7431d98677SRui Paulo #include <dev/usb/wlan/if_rsureg.h>
7531d98677SRui Paulo 
7631d98677SRui Paulo #ifdef USB_DEBUG
7731d98677SRui Paulo static int rsu_debug = 0;
7831d98677SRui Paulo SYSCTL_NODE(_hw_usb, OID_AUTO, rsu, CTLFLAG_RW, 0, "USB rsu");
79ece4b0bdSHans Petter Selasky SYSCTL_INT(_hw_usb_rsu, OID_AUTO, debug, CTLFLAG_RWTUN, &rsu_debug, 0,
8031d98677SRui Paulo     "Debug level");
814914fa0fSAdrian Chadd #define	RSU_DPRINTF(_sc, _flg, ...)					\
824914fa0fSAdrian Chadd 	do								\
834914fa0fSAdrian Chadd 		if (((_flg) == (RSU_DEBUG_ANY)) || (rsu_debug & (_flg))) \
844914fa0fSAdrian Chadd 			device_printf((_sc)->sc_dev, __VA_ARGS__);	\
854914fa0fSAdrian Chadd 	while (0)
864914fa0fSAdrian Chadd #else
874914fa0fSAdrian Chadd #define	RSU_DPRINTF(_sc, _flg, ...)
8831d98677SRui Paulo #endif
8931d98677SRui Paulo 
9039089f06SAdrian Chadd static int rsu_enable_11n = 1;
914b9d9eeeSAdrian Chadd TUNABLE_INT("hw.usb.rsu.enable_11n", &rsu_enable_11n);
924b9d9eeeSAdrian Chadd 
934914fa0fSAdrian Chadd #define	RSU_DEBUG_ANY		0xffffffff
944914fa0fSAdrian Chadd #define	RSU_DEBUG_TX		0x00000001
954914fa0fSAdrian Chadd #define	RSU_DEBUG_RX		0x00000002
964914fa0fSAdrian Chadd #define	RSU_DEBUG_RESET		0x00000004
974914fa0fSAdrian Chadd #define	RSU_DEBUG_CALIB		0x00000008
984914fa0fSAdrian Chadd #define	RSU_DEBUG_STATE		0x00000010
994914fa0fSAdrian Chadd #define	RSU_DEBUG_SCAN		0x00000020
1004914fa0fSAdrian Chadd #define	RSU_DEBUG_FWCMD		0x00000040
1014914fa0fSAdrian Chadd #define	RSU_DEBUG_TXDONE	0x00000080
1024914fa0fSAdrian Chadd #define	RSU_DEBUG_FW		0x00000100
1034914fa0fSAdrian Chadd #define	RSU_DEBUG_FWDBG		0x00000200
1046acf853dSAdrian Chadd #define	RSU_DEBUG_AMPDU		0x00000400
1054914fa0fSAdrian Chadd 
10631d98677SRui Paulo static const STRUCT_USB_HOST_ID rsu_devs[] = {
10731d98677SRui Paulo #define	RSU_HT_NOT_SUPPORTED 0
10831d98677SRui Paulo #define	RSU_HT_SUPPORTED 1
10931d98677SRui Paulo #define RSU_DEV_HT(v,p)  { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
11031d98677SRui Paulo 				   RSU_HT_SUPPORTED) }
11131d98677SRui Paulo #define RSU_DEV(v,p)     { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
11231d98677SRui Paulo 				   RSU_HT_NOT_SUPPORTED) }
11331d98677SRui Paulo 	RSU_DEV(ASUS,			RTL8192SU),
11431d98677SRui Paulo 	RSU_DEV(AZUREWAVE,		RTL8192SU_4),
11531d98677SRui Paulo 	RSU_DEV_HT(ACCTON,		RTL8192SU),
11631d98677SRui Paulo 	RSU_DEV_HT(ASUS,		USBN10),
11731d98677SRui Paulo 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_1),
11831d98677SRui Paulo 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_2),
11931d98677SRui Paulo 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_3),
12031d98677SRui Paulo 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_5),
12131d98677SRui Paulo 	RSU_DEV_HT(BELKIN,		RTL8192SU_1),
12231d98677SRui Paulo 	RSU_DEV_HT(BELKIN,		RTL8192SU_2),
12331d98677SRui Paulo 	RSU_DEV_HT(BELKIN,		RTL8192SU_3),
12431d98677SRui Paulo 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_1),
12531d98677SRui Paulo 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_2),
12631d98677SRui Paulo 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_3),
12731d98677SRui Paulo 	RSU_DEV_HT(COREGA,		RTL8192SU),
12831d98677SRui Paulo 	RSU_DEV_HT(DLINK2,		DWA131A1),
12931d98677SRui Paulo 	RSU_DEV_HT(DLINK2,		RTL8192SU_1),
13031d98677SRui Paulo 	RSU_DEV_HT(DLINK2,		RTL8192SU_2),
13131d98677SRui Paulo 	RSU_DEV_HT(EDIMAX,		RTL8192SU_1),
13231d98677SRui Paulo 	RSU_DEV_HT(EDIMAX,		RTL8192SU_2),
133bf124fcfSKevin Lo 	RSU_DEV_HT(EDIMAX,		EW7622UMN),
13431d98677SRui Paulo 	RSU_DEV_HT(GUILLEMOT,		HWGUN54),
13531d98677SRui Paulo 	RSU_DEV_HT(GUILLEMOT,		HWNUM300),
13631d98677SRui Paulo 	RSU_DEV_HT(HAWKING,		RTL8192SU_1),
13731d98677SRui Paulo 	RSU_DEV_HT(HAWKING,		RTL8192SU_2),
13831d98677SRui Paulo 	RSU_DEV_HT(PLANEX2,		GWUSNANO),
13931d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8171),
14031d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8172),
14131d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8173),
14231d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8174),
14331d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8192SU),
14431d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8712),
14531d98677SRui Paulo 	RSU_DEV_HT(REALTEK,		RTL8713),
14631d98677SRui Paulo 	RSU_DEV_HT(SENAO,		RTL8192SU_1),
14731d98677SRui Paulo 	RSU_DEV_HT(SENAO,		RTL8192SU_2),
14831d98677SRui Paulo 	RSU_DEV_HT(SITECOMEU,		WL349V1),
14931d98677SRui Paulo 	RSU_DEV_HT(SITECOMEU,		WL353),
15031d98677SRui Paulo 	RSU_DEV_HT(SWEEX2,		LW154),
151fa20eb98SKevin Lo 	RSU_DEV_HT(TRENDNET,		TEW646UBH),
15231d98677SRui Paulo #undef RSU_DEV_HT
15331d98677SRui Paulo #undef RSU_DEV
15431d98677SRui Paulo };
15531d98677SRui Paulo 
15631d98677SRui Paulo static device_probe_t   rsu_match;
15731d98677SRui Paulo static device_attach_t  rsu_attach;
15831d98677SRui Paulo static device_detach_t  rsu_detach;
159910593b5SHans Petter Selasky static usb_callback_t   rsu_bulk_tx_callback_be_bk;
160910593b5SHans Petter Selasky static usb_callback_t   rsu_bulk_tx_callback_vi_vo;
161bc6a9865SAdrian Chadd static usb_callback_t   rsu_bulk_tx_callback_h2c;
16231d98677SRui Paulo static usb_callback_t   rsu_bulk_rx_callback;
16331d98677SRui Paulo static usb_error_t	rsu_do_request(struct rsu_softc *,
16431d98677SRui Paulo 			    struct usb_device_request *, void *);
16531d98677SRui Paulo static struct ieee80211vap *
16631d98677SRui Paulo 		rsu_vap_create(struct ieee80211com *, const char name[],
16731d98677SRui Paulo 		    int, enum ieee80211_opmode, int, const uint8_t bssid[],
16831d98677SRui Paulo 		    const uint8_t mac[]);
16931d98677SRui Paulo static void	rsu_vap_delete(struct ieee80211vap *);
17031d98677SRui Paulo static void	rsu_scan_start(struct ieee80211com *);
17131d98677SRui Paulo static void	rsu_scan_end(struct ieee80211com *);
17231d98677SRui Paulo static void	rsu_set_channel(struct ieee80211com *);
173272f6adeSGleb Smirnoff static void	rsu_update_mcast(struct ieee80211com *);
17431d98677SRui Paulo static int	rsu_alloc_rx_list(struct rsu_softc *);
17531d98677SRui Paulo static void	rsu_free_rx_list(struct rsu_softc *);
17631d98677SRui Paulo static int	rsu_alloc_tx_list(struct rsu_softc *);
17731d98677SRui Paulo static void	rsu_free_tx_list(struct rsu_softc *);
17831d98677SRui Paulo static void	rsu_free_list(struct rsu_softc *, struct rsu_data [], int);
17931d98677SRui Paulo static struct rsu_data *_rsu_getbuf(struct rsu_softc *);
18031d98677SRui Paulo static struct rsu_data *rsu_getbuf(struct rsu_softc *);
181de76b5b7SAdrian Chadd static void	rsu_freebuf(struct rsu_softc *, struct rsu_data *);
18231d98677SRui Paulo static int	rsu_write_region_1(struct rsu_softc *, uint16_t, uint8_t *,
18331d98677SRui Paulo 		    int);
18431d98677SRui Paulo static void	rsu_write_1(struct rsu_softc *, uint16_t, uint8_t);
18531d98677SRui Paulo static void	rsu_write_2(struct rsu_softc *, uint16_t, uint16_t);
18631d98677SRui Paulo static void	rsu_write_4(struct rsu_softc *, uint16_t, uint32_t);
18731d98677SRui Paulo static int	rsu_read_region_1(struct rsu_softc *, uint16_t, uint8_t *,
18831d98677SRui Paulo 		    int);
18931d98677SRui Paulo static uint8_t	rsu_read_1(struct rsu_softc *, uint16_t);
19031d98677SRui Paulo static uint16_t	rsu_read_2(struct rsu_softc *, uint16_t);
19131d98677SRui Paulo static uint32_t	rsu_read_4(struct rsu_softc *, uint16_t);
19231d98677SRui Paulo static int	rsu_fw_iocmd(struct rsu_softc *, uint32_t);
19331d98677SRui Paulo static uint8_t	rsu_efuse_read_1(struct rsu_softc *, uint16_t);
19431d98677SRui Paulo static int	rsu_read_rom(struct rsu_softc *);
19531d98677SRui Paulo static int	rsu_fw_cmd(struct rsu_softc *, uint8_t, void *, int);
19631d98677SRui Paulo static void	rsu_calib_task(void *, int);
19777435f18SAdrian Chadd static void	rsu_tx_task(void *, int);
19831d98677SRui Paulo static int	rsu_newstate(struct ieee80211vap *, enum ieee80211_state, int);
19931d98677SRui Paulo #ifdef notyet
20031d98677SRui Paulo static void	rsu_set_key(struct rsu_softc *, const struct ieee80211_key *);
20131d98677SRui Paulo static void	rsu_delete_key(struct rsu_softc *, const struct ieee80211_key *);
20231d98677SRui Paulo #endif
20331d98677SRui Paulo static int	rsu_site_survey(struct rsu_softc *, struct ieee80211vap *);
20431d98677SRui Paulo static int	rsu_join_bss(struct rsu_softc *, struct ieee80211_node *);
20531d98677SRui Paulo static int	rsu_disconnect(struct rsu_softc *);
206*a3767659SAdrian Chadd static int	rsu_hwrssi_to_rssi(struct rsu_softc *, int hw_rssi);
20731d98677SRui Paulo static void	rsu_event_survey(struct rsu_softc *, uint8_t *, int);
20831d98677SRui Paulo static void	rsu_event_join_bss(struct rsu_softc *, uint8_t *, int);
20931d98677SRui Paulo static void	rsu_rx_event(struct rsu_softc *, uint8_t, uint8_t *, int);
21031d98677SRui Paulo static void	rsu_rx_multi_event(struct rsu_softc *, uint8_t *, int);
211*a3767659SAdrian Chadd #if 0
21231d98677SRui Paulo static int8_t	rsu_get_rssi(struct rsu_softc *, int, void *);
213*a3767659SAdrian Chadd #endif
214*a3767659SAdrian Chadd static struct mbuf * rsu_rx_frame(struct rsu_softc *, uint8_t *, int);
215*a3767659SAdrian Chadd static struct mbuf * rsu_rx_multi_frame(struct rsu_softc *, uint8_t *, int);
21631d98677SRui Paulo static struct mbuf *
217*a3767659SAdrian Chadd 		rsu_rxeof(struct usb_xfer *, struct rsu_data *);
21831d98677SRui Paulo static void	rsu_txeof(struct usb_xfer *, struct rsu_data *);
21931d98677SRui Paulo static int	rsu_raw_xmit(struct ieee80211_node *, struct mbuf *,
22031d98677SRui Paulo 		    const struct ieee80211_bpf_params *);
2217a79cebfSGleb Smirnoff static void	rsu_init(struct rsu_softc *);
22231d98677SRui Paulo static int	rsu_tx_start(struct rsu_softc *, struct ieee80211_node *,
223400b4e53SHans Petter Selasky 		    struct mbuf *, struct rsu_data *);
2247a79cebfSGleb Smirnoff static int	rsu_transmit(struct ieee80211com *, struct mbuf *);
2257a79cebfSGleb Smirnoff static void	rsu_start(struct rsu_softc *);
22677435f18SAdrian Chadd static void	_rsu_start(struct rsu_softc *);
2277a79cebfSGleb Smirnoff static void	rsu_parent(struct ieee80211com *);
2287a79cebfSGleb Smirnoff static void	rsu_stop(struct rsu_softc *);
22917ebf553SAdrian Chadd static void	rsu_ms_delay(struct rsu_softc *, int);
23031d98677SRui Paulo 
23131d98677SRui Paulo static device_method_t rsu_methods[] = {
23231d98677SRui Paulo 	DEVMETHOD(device_probe,		rsu_match),
23331d98677SRui Paulo 	DEVMETHOD(device_attach,	rsu_attach),
23431d98677SRui Paulo 	DEVMETHOD(device_detach,	rsu_detach),
23531d98677SRui Paulo 
23631d98677SRui Paulo 	DEVMETHOD_END
23731d98677SRui Paulo };
23831d98677SRui Paulo 
23931d98677SRui Paulo static driver_t rsu_driver = {
24031d98677SRui Paulo 	.name = "rsu",
24131d98677SRui Paulo 	.methods = rsu_methods,
24231d98677SRui Paulo 	.size = sizeof(struct rsu_softc)
24331d98677SRui Paulo };
24431d98677SRui Paulo 
24531d98677SRui Paulo static devclass_t rsu_devclass;
24631d98677SRui Paulo 
24731d98677SRui Paulo DRIVER_MODULE(rsu, uhub, rsu_driver, rsu_devclass, NULL, 0);
24831d98677SRui Paulo MODULE_DEPEND(rsu, wlan, 1, 1, 1);
24931d98677SRui Paulo MODULE_DEPEND(rsu, usb, 1, 1, 1);
25031d98677SRui Paulo MODULE_DEPEND(rsu, firmware, 1, 1, 1);
25131d98677SRui Paulo MODULE_VERSION(rsu, 1);
25231d98677SRui Paulo 
253910593b5SHans Petter Selasky static uint8_t rsu_wme_ac_xfer_map[4] = {
254910593b5SHans Petter Selasky 	[WME_AC_BE] = RSU_BULK_TX_BE_BK,
255910593b5SHans Petter Selasky 	[WME_AC_BK] = RSU_BULK_TX_BE_BK,
256910593b5SHans Petter Selasky 	[WME_AC_VI] = RSU_BULK_TX_VI_VO,
257910593b5SHans Petter Selasky 	[WME_AC_VO] = RSU_BULK_TX_VI_VO,
258910593b5SHans Petter Selasky };
259910593b5SHans Petter Selasky 
260bc6a9865SAdrian Chadd /* XXX hard-coded */
261bc6a9865SAdrian Chadd #define	RSU_H2C_ENDPOINT	3
262bc6a9865SAdrian Chadd 
26331d98677SRui Paulo static const struct usb_config rsu_config[RSU_N_TRANSFER] = {
26431d98677SRui Paulo 	[RSU_BULK_RX] = {
26531d98677SRui Paulo 		.type = UE_BULK,
26631d98677SRui Paulo 		.endpoint = UE_ADDR_ANY,
26731d98677SRui Paulo 		.direction = UE_DIR_IN,
26831d98677SRui Paulo 		.bufsize = RSU_RXBUFSZ,
26931d98677SRui Paulo 		.flags = {
27031d98677SRui Paulo 			.pipe_bof = 1,
27131d98677SRui Paulo 			.short_xfer_ok = 1
27231d98677SRui Paulo 		},
27331d98677SRui Paulo 		.callback = rsu_bulk_rx_callback
27431d98677SRui Paulo 	},
275910593b5SHans Petter Selasky 	[RSU_BULK_TX_BE_BK] = {
27631d98677SRui Paulo 		.type = UE_BULK,
27731d98677SRui Paulo 		.endpoint = 0x06,
27831d98677SRui Paulo 		.direction = UE_DIR_OUT,
27931d98677SRui Paulo 		.bufsize = RSU_TXBUFSZ,
28031d98677SRui Paulo 		.flags = {
28131d98677SRui Paulo 			.ext_buffer = 1,
28231d98677SRui Paulo 			.pipe_bof = 1,
28331d98677SRui Paulo 			.force_short_xfer = 1
28431d98677SRui Paulo 		},
285910593b5SHans Petter Selasky 		.callback = rsu_bulk_tx_callback_be_bk,
28631d98677SRui Paulo 		.timeout = RSU_TX_TIMEOUT
28731d98677SRui Paulo 	},
288910593b5SHans Petter Selasky 	[RSU_BULK_TX_VI_VO] = {
28931d98677SRui Paulo 		.type = UE_BULK,
29031d98677SRui Paulo 		.endpoint = 0x04,
29131d98677SRui Paulo 		.direction = UE_DIR_OUT,
29231d98677SRui Paulo 		.bufsize = RSU_TXBUFSZ,
29331d98677SRui Paulo 		.flags = {
29431d98677SRui Paulo 			.ext_buffer = 1,
29531d98677SRui Paulo 			.pipe_bof = 1,
29631d98677SRui Paulo 			.force_short_xfer = 1
29731d98677SRui Paulo 		},
298910593b5SHans Petter Selasky 		.callback = rsu_bulk_tx_callback_vi_vo,
29931d98677SRui Paulo 		.timeout = RSU_TX_TIMEOUT
30031d98677SRui Paulo 	},
301bc6a9865SAdrian Chadd 	[RSU_BULK_TX_H2C] = {
302bc6a9865SAdrian Chadd 		.type = UE_BULK,
303bc6a9865SAdrian Chadd 		.endpoint = 0x0d,
304bc6a9865SAdrian Chadd 		.direction = UE_DIR_OUT,
305bc6a9865SAdrian Chadd 		.bufsize = RSU_TXBUFSZ,
306bc6a9865SAdrian Chadd 		.flags = {
307bc6a9865SAdrian Chadd 			.ext_buffer = 1,
308bc6a9865SAdrian Chadd 			.pipe_bof = 1,
309bc6a9865SAdrian Chadd 			.short_xfer_ok = 1
310bc6a9865SAdrian Chadd 		},
311bc6a9865SAdrian Chadd 		.callback = rsu_bulk_tx_callback_h2c,
312bc6a9865SAdrian Chadd 		.timeout = RSU_TX_TIMEOUT
313bc6a9865SAdrian Chadd 	},
31431d98677SRui Paulo };
31531d98677SRui Paulo 
31631d98677SRui Paulo static int
31731d98677SRui Paulo rsu_match(device_t self)
31831d98677SRui Paulo {
31931d98677SRui Paulo 	struct usb_attach_arg *uaa = device_get_ivars(self);
32031d98677SRui Paulo 
32131d98677SRui Paulo 	if (uaa->usb_mode != USB_MODE_HOST ||
32231d98677SRui Paulo 	    uaa->info.bIfaceIndex != 0 ||
32331d98677SRui Paulo 	    uaa->info.bConfigIndex != 0)
32431d98677SRui Paulo 		return (ENXIO);
32531d98677SRui Paulo 
32631d98677SRui Paulo 	return (usbd_lookup_id_by_uaa(rsu_devs, sizeof(rsu_devs), uaa));
32731d98677SRui Paulo }
32831d98677SRui Paulo 
32931d98677SRui Paulo static int
330cf52bbe0SAdrian Chadd rsu_send_mgmt(struct ieee80211_node *ni, int type, int arg)
331cf52bbe0SAdrian Chadd {
332cf52bbe0SAdrian Chadd 
333cf52bbe0SAdrian Chadd 	return (ENOTSUP);
334cf52bbe0SAdrian Chadd }
335cf52bbe0SAdrian Chadd 
336882704d0SAdrian Chadd static void
337882704d0SAdrian Chadd rsu_update_chw(struct ieee80211com *ic)
338882704d0SAdrian Chadd {
339882704d0SAdrian Chadd 
340882704d0SAdrian Chadd }
341882704d0SAdrian Chadd 
3426acf853dSAdrian Chadd /*
3436acf853dSAdrian Chadd  * notification from net80211 that it'd like to do A-MPDU on the given TID.
3446acf853dSAdrian Chadd  *
3456acf853dSAdrian Chadd  * Note: this actually hangs traffic at the present moment, so don't use it.
3466acf853dSAdrian Chadd  * The firmware debug does indiciate it's sending and establishing a TX AMPDU
3476acf853dSAdrian Chadd  * session, but then no traffic flows.
3486acf853dSAdrian Chadd  */
349882704d0SAdrian Chadd static int
350882704d0SAdrian Chadd rsu_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
351882704d0SAdrian Chadd {
3526acf853dSAdrian Chadd #if 0
3536acf853dSAdrian Chadd 	struct rsu_softc *sc = ni->ni_ic->ic_softc;
3546acf853dSAdrian Chadd 	struct r92s_add_ba_req req;
355882704d0SAdrian Chadd 
3566acf853dSAdrian Chadd 	/* Don't enable if it's requested or running */
3576acf853dSAdrian Chadd 	if (IEEE80211_AMPDU_REQUESTED(tap))
3586acf853dSAdrian Chadd 		return (0);
3596acf853dSAdrian Chadd 	if (IEEE80211_AMPDU_RUNNING(tap))
3606acf853dSAdrian Chadd 		return (0);
3616acf853dSAdrian Chadd 
3626acf853dSAdrian Chadd 	/* We've decided to send addba; so send it */
3636acf853dSAdrian Chadd 	req.tid = htole32(tap->txa_tid);
3646acf853dSAdrian Chadd 
3656acf853dSAdrian Chadd 	/* Attempt net80211 state */
3666acf853dSAdrian Chadd 	if (ieee80211_ampdu_tx_request_ext(ni, tap->txa_tid) != 1)
3676acf853dSAdrian Chadd 		return (0);
3686acf853dSAdrian Chadd 
3696acf853dSAdrian Chadd 	/* Send the firmware command */
3706acf853dSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: establishing AMPDU TX for TID %d\n",
3716acf853dSAdrian Chadd 	    __func__,
3726acf853dSAdrian Chadd 	    tap->txa_tid);
3736acf853dSAdrian Chadd 
3746acf853dSAdrian Chadd 	RSU_LOCK(sc);
3756acf853dSAdrian Chadd 	if (rsu_fw_cmd(sc, R92S_CMD_ADDBA_REQ, &req, sizeof(req)) != 1) {
3766acf853dSAdrian Chadd 		RSU_UNLOCK(sc);
3776acf853dSAdrian Chadd 		/* Mark failure */
3786acf853dSAdrian Chadd 		(void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 0);
3796acf853dSAdrian Chadd 		return (0);
3806acf853dSAdrian Chadd 	}
3816acf853dSAdrian Chadd 	RSU_UNLOCK(sc);
3826acf853dSAdrian Chadd 
3836acf853dSAdrian Chadd 	/* Mark success; we don't get any further notifications */
3846acf853dSAdrian Chadd 	(void) ieee80211_ampdu_tx_request_active_ext(ni, tap->txa_tid, 1);
3856acf853dSAdrian Chadd #endif
3866acf853dSAdrian Chadd 	/* Return 0, we're driving this ourselves */
387882704d0SAdrian Chadd 	return (0);
388882704d0SAdrian Chadd }
389882704d0SAdrian Chadd 
390882704d0SAdrian Chadd static int
391882704d0SAdrian Chadd rsu_wme_update(struct ieee80211com *ic)
392882704d0SAdrian Chadd {
393882704d0SAdrian Chadd 
394882704d0SAdrian Chadd 	/* Firmware handles this; not our problem */
395882704d0SAdrian Chadd 	return (0);
396882704d0SAdrian Chadd }
397882704d0SAdrian Chadd 
398cf52bbe0SAdrian Chadd static int
39931d98677SRui Paulo rsu_attach(device_t self)
40031d98677SRui Paulo {
40131d98677SRui Paulo 	struct usb_attach_arg *uaa = device_get_ivars(self);
40231d98677SRui Paulo 	struct rsu_softc *sc = device_get_softc(self);
4037a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
40431d98677SRui Paulo 	int error;
40531d98677SRui Paulo 	uint8_t iface_index, bands;
40647b0d9ddSAdrian Chadd 	struct usb_interface *iface;
40785dafc69SAdrian Chadd 	const char *rft;
40831d98677SRui Paulo 
40931d98677SRui Paulo 	device_set_usb_desc(self);
41031d98677SRui Paulo 	sc->sc_udev = uaa->device;
41131d98677SRui Paulo 	sc->sc_dev = self;
4124b9d9eeeSAdrian Chadd 	if (rsu_enable_11n)
41347b0d9ddSAdrian Chadd 		sc->sc_ht = !! (USB_GET_DRIVER_INFO(uaa) & RSU_HT_SUPPORTED);
41447b0d9ddSAdrian Chadd 
41547b0d9ddSAdrian Chadd 	/* Get number of endpoints */
41647b0d9ddSAdrian Chadd 	iface = usbd_get_iface(sc->sc_udev, 0);
41747b0d9ddSAdrian Chadd 	sc->sc_nendpoints = iface->idesc->bNumEndpoints;
41831d98677SRui Paulo 
419b8303685SAdrian Chadd 	/* Endpoints are hard-coded for now, so enforce 4-endpoint only */
420b8303685SAdrian Chadd 	if (sc->sc_nendpoints != 4) {
421b8303685SAdrian Chadd 		device_printf(sc->sc_dev,
422b8303685SAdrian Chadd 		    "the driver currently only supports 4-endpoint devices\n");
423b8303685SAdrian Chadd 		return (ENXIO);
424b8303685SAdrian Chadd 	}
425b8303685SAdrian Chadd 
42631d98677SRui Paulo 	mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
42731d98677SRui Paulo 	    MTX_DEF);
42831d98677SRui Paulo 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_task, 0,
42931d98677SRui Paulo 	    rsu_calib_task, sc);
43077435f18SAdrian Chadd 	TASK_INIT(&sc->tx_task, 0, rsu_tx_task, sc);
4317a79cebfSGleb Smirnoff 	mbufq_init(&sc->sc_snd, ifqmaxlen);
43231d98677SRui Paulo 
433885476cbSHans Petter Selasky 	/* Allocate Tx/Rx buffers. */
434885476cbSHans Petter Selasky 	error = rsu_alloc_rx_list(sc);
435885476cbSHans Petter Selasky 	if (error != 0) {
436885476cbSHans Petter Selasky 		device_printf(sc->sc_dev, "could not allocate Rx buffers\n");
437885476cbSHans Petter Selasky 		goto fail_usb;
438885476cbSHans Petter Selasky 	}
439885476cbSHans Petter Selasky 
440885476cbSHans Petter Selasky 	error = rsu_alloc_tx_list(sc);
441885476cbSHans Petter Selasky 	if (error != 0) {
442885476cbSHans Petter Selasky 		device_printf(sc->sc_dev, "could not allocate Tx buffers\n");
443885476cbSHans Petter Selasky 		rsu_free_rx_list(sc);
444885476cbSHans Petter Selasky 		goto fail_usb;
445885476cbSHans Petter Selasky 	}
446885476cbSHans Petter Selasky 
44731d98677SRui Paulo 	iface_index = 0;
44831d98677SRui Paulo 	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
44931d98677SRui Paulo 	    rsu_config, RSU_N_TRANSFER, sc, &sc->sc_mtx);
45031d98677SRui Paulo 	if (error) {
45131d98677SRui Paulo 		device_printf(sc->sc_dev,
45231d98677SRui Paulo 		    "could not allocate USB transfers, err=%s\n",
45331d98677SRui Paulo 		    usbd_errstr(error));
45453dfd5c1SRui Paulo 		goto fail_usb;
45531d98677SRui Paulo 	}
45631d98677SRui Paulo 	RSU_LOCK(sc);
45731d98677SRui Paulo 	/* Read chip revision. */
45831d98677SRui Paulo 	sc->cut = MS(rsu_read_4(sc, R92S_PMC_FSM), R92S_PMC_FSM_CUT);
45931d98677SRui Paulo 	if (sc->cut != 3)
46031d98677SRui Paulo 		sc->cut = (sc->cut >> 1) + 1;
46131d98677SRui Paulo 	error = rsu_read_rom(sc);
462abfa11d6SHans Petter Selasky 	RSU_UNLOCK(sc);
46331d98677SRui Paulo 	if (error != 0) {
46431d98677SRui Paulo 		device_printf(self, "could not read ROM\n");
46553dfd5c1SRui Paulo 		goto fail_rom;
46631d98677SRui Paulo 	}
46785dafc69SAdrian Chadd 
46885dafc69SAdrian Chadd 	/* Figure out TX/RX streams */
46985dafc69SAdrian Chadd 	switch (sc->rom[84]) {
47085dafc69SAdrian Chadd 	case 0x0:
47185dafc69SAdrian Chadd 		sc->sc_rftype = RTL8712_RFCONFIG_1T1R;
47285dafc69SAdrian Chadd 		sc->sc_nrxstream = 1;
47385dafc69SAdrian Chadd 		sc->sc_ntxstream = 1;
47485dafc69SAdrian Chadd 		rft = "1T1R";
47585dafc69SAdrian Chadd 		break;
47685dafc69SAdrian Chadd 	case 0x1:
47785dafc69SAdrian Chadd 		sc->sc_rftype = RTL8712_RFCONFIG_1T2R;
47885dafc69SAdrian Chadd 		sc->sc_nrxstream = 2;
47985dafc69SAdrian Chadd 		sc->sc_ntxstream = 1;
48085dafc69SAdrian Chadd 		rft = "1T2R";
48185dafc69SAdrian Chadd 		break;
48285dafc69SAdrian Chadd 	case 0x2:
48385dafc69SAdrian Chadd 		sc->sc_rftype = RTL8712_RFCONFIG_2T2R;
48485dafc69SAdrian Chadd 		sc->sc_nrxstream = 2;
48585dafc69SAdrian Chadd 		sc->sc_ntxstream = 2;
48685dafc69SAdrian Chadd 		rft = "2T2R";
48785dafc69SAdrian Chadd 		break;
48885dafc69SAdrian Chadd 	default:
48985dafc69SAdrian Chadd 		device_printf(sc->sc_dev,
49085dafc69SAdrian Chadd 		    "%s: unknown board type (rfconfig=0x%02x)\n",
49185dafc69SAdrian Chadd 		    __func__,
49285dafc69SAdrian Chadd 		    sc->rom[84]);
49385dafc69SAdrian Chadd 		goto fail_rom;
49485dafc69SAdrian Chadd 	}
49585dafc69SAdrian Chadd 
4967a79cebfSGleb Smirnoff 	IEEE80211_ADDR_COPY(ic->ic_macaddr, &sc->rom[0x12]);
49785dafc69SAdrian Chadd 	device_printf(self, "MAC/BB RTL8712 cut %d %s\n", sc->cut, rft);
49831d98677SRui Paulo 
49959686fe9SGleb Smirnoff 	ic->ic_softc = sc;
500c8550c02SGleb Smirnoff 	ic->ic_name = device_get_nameunit(self);
50131d98677SRui Paulo 	ic->ic_phytype = IEEE80211_T_OFDM;	/* Not only, but not used. */
50231d98677SRui Paulo 	ic->ic_opmode = IEEE80211_M_STA;	/* Default to BSS mode. */
50331d98677SRui Paulo 
50431d98677SRui Paulo 	/* Set device capabilities. */
50531d98677SRui Paulo 	ic->ic_caps =
50631d98677SRui Paulo 	    IEEE80211_C_STA |		/* station mode */
5074914fa0fSAdrian Chadd #if 0
50831d98677SRui Paulo 	    IEEE80211_C_BGSCAN |	/* Background scan. */
5094914fa0fSAdrian Chadd #endif
51031d98677SRui Paulo 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
511b4d4079cSAdrian Chadd 	    IEEE80211_C_WME |		/* WME/QoS */
51231d98677SRui Paulo 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
51331d98677SRui Paulo 	    IEEE80211_C_WPA;		/* WPA/RSN. */
51431d98677SRui Paulo 
51531d98677SRui Paulo 	/* Check if HT support is present. */
5164b9d9eeeSAdrian Chadd 	if (sc->sc_ht) {
5174b9d9eeeSAdrian Chadd 		device_printf(sc->sc_dev, "%s: enabling 11n\n", __func__);
5184b9d9eeeSAdrian Chadd 
5194b9d9eeeSAdrian Chadd 		/* Enable basic HT */
5204b9d9eeeSAdrian Chadd 		ic->ic_htcaps = IEEE80211_HTC_HT |
5214b9d9eeeSAdrian Chadd 		    IEEE80211_HTC_AMPDU |
5224b9d9eeeSAdrian Chadd 		    IEEE80211_HTC_AMSDU |
5234b9d9eeeSAdrian Chadd 		    IEEE80211_HTCAP_MAXAMSDU_3839 |
5244b9d9eeeSAdrian Chadd 		    IEEE80211_HTCAP_SMPS_OFF;
5254b9d9eeeSAdrian Chadd 		ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
5264b9d9eeeSAdrian Chadd 
5274b9d9eeeSAdrian Chadd 		/* set number of spatial streams */
52885dafc69SAdrian Chadd 		ic->ic_txstream = sc->sc_ntxstream;
52985dafc69SAdrian Chadd 		ic->ic_rxstream = sc->sc_nrxstream;
53031d98677SRui Paulo 	}
53131d98677SRui Paulo 
53231d98677SRui Paulo 	/* Set supported .11b and .11g rates. */
53331d98677SRui Paulo 	bands = 0;
53431d98677SRui Paulo 	setbit(&bands, IEEE80211_MODE_11B);
53531d98677SRui Paulo 	setbit(&bands, IEEE80211_MODE_11G);
5364b9d9eeeSAdrian Chadd 	if (sc->sc_ht)
5374b9d9eeeSAdrian Chadd 		setbit(&bands, IEEE80211_MODE_11NG);
53831d98677SRui Paulo 	ieee80211_init_channels(ic, NULL, &bands);
53931d98677SRui Paulo 
5407a79cebfSGleb Smirnoff 	ieee80211_ifattach(ic);
54131d98677SRui Paulo 	ic->ic_raw_xmit = rsu_raw_xmit;
54231d98677SRui Paulo 	ic->ic_scan_start = rsu_scan_start;
54331d98677SRui Paulo 	ic->ic_scan_end = rsu_scan_end;
54431d98677SRui Paulo 	ic->ic_set_channel = rsu_set_channel;
54531d98677SRui Paulo 	ic->ic_vap_create = rsu_vap_create;
54631d98677SRui Paulo 	ic->ic_vap_delete = rsu_vap_delete;
54731d98677SRui Paulo 	ic->ic_update_mcast = rsu_update_mcast;
5487a79cebfSGleb Smirnoff 	ic->ic_parent = rsu_parent;
5497a79cebfSGleb Smirnoff 	ic->ic_transmit = rsu_transmit;
550cf52bbe0SAdrian Chadd 	ic->ic_send_mgmt = rsu_send_mgmt;
551882704d0SAdrian Chadd 	ic->ic_update_chw = rsu_update_chw;
552882704d0SAdrian Chadd 	ic->ic_ampdu_enable = rsu_ampdu_enable;
553882704d0SAdrian Chadd 	ic->ic_wme.wme_update = rsu_wme_update;
55431d98677SRui Paulo 
55531d98677SRui Paulo 	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
55631d98677SRui Paulo 	    sizeof(sc->sc_txtap), RSU_TX_RADIOTAP_PRESENT,
55731d98677SRui Paulo 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
55831d98677SRui Paulo 	    RSU_RX_RADIOTAP_PRESENT);
55931d98677SRui Paulo 
56031d98677SRui Paulo 	if (bootverbose)
56131d98677SRui Paulo 		ieee80211_announce(ic);
56231d98677SRui Paulo 
56331d98677SRui Paulo 	return (0);
56431d98677SRui Paulo 
56553dfd5c1SRui Paulo fail_rom:
56653dfd5c1SRui Paulo 	usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
56753dfd5c1SRui Paulo fail_usb:
56853dfd5c1SRui Paulo 	mtx_destroy(&sc->sc_mtx);
56931d98677SRui Paulo 	return (ENXIO);
57031d98677SRui Paulo }
57131d98677SRui Paulo 
57231d98677SRui Paulo static int
57331d98677SRui Paulo rsu_detach(device_t self)
57431d98677SRui Paulo {
57531d98677SRui Paulo 	struct rsu_softc *sc = device_get_softc(self);
5767a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
57731d98677SRui Paulo 
5787a79cebfSGleb Smirnoff 	RSU_LOCK(sc);
5797a79cebfSGleb Smirnoff 	rsu_stop(sc);
5807a79cebfSGleb Smirnoff 	RSU_UNLOCK(sc);
581ac9e537cSAdrian Chadd 
58231d98677SRui Paulo 	usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
583829e0b0bSAdrian Chadd 
584ac9e537cSAdrian Chadd 	/*
585ac9e537cSAdrian Chadd 	 * Free buffers /before/ we detach from net80211, else node
586ac9e537cSAdrian Chadd 	 * references to destroyed vaps will lead to a panic.
587ac9e537cSAdrian Chadd 	 */
588ac9e537cSAdrian Chadd 	/* Free Tx/Rx buffers. */
589ac9e537cSAdrian Chadd 	RSU_LOCK(sc);
590ac9e537cSAdrian Chadd 	rsu_free_tx_list(sc);
591ac9e537cSAdrian Chadd 	rsu_free_rx_list(sc);
592ac9e537cSAdrian Chadd 	RSU_UNLOCK(sc);
593ac9e537cSAdrian Chadd 
594829e0b0bSAdrian Chadd 	/* Frames are freed; detach from net80211 */
59531d98677SRui Paulo 	ieee80211_ifdetach(ic);
59631d98677SRui Paulo 
59731d98677SRui Paulo 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
59877435f18SAdrian Chadd 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
59931d98677SRui Paulo 
60031d98677SRui Paulo 	mtx_destroy(&sc->sc_mtx);
60131d98677SRui Paulo 
60231d98677SRui Paulo 	return (0);
60331d98677SRui Paulo }
60431d98677SRui Paulo 
60531d98677SRui Paulo static usb_error_t
60631d98677SRui Paulo rsu_do_request(struct rsu_softc *sc, struct usb_device_request *req,
60731d98677SRui Paulo     void *data)
60831d98677SRui Paulo {
60931d98677SRui Paulo 	usb_error_t err;
61031d98677SRui Paulo 	int ntries = 10;
61131d98677SRui Paulo 
61231d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
61331d98677SRui Paulo 
61431d98677SRui Paulo 	while (ntries--) {
61531d98677SRui Paulo 		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
61631d98677SRui Paulo 		    req, data, 0, NULL, 250 /* ms */);
6177243077cSHans Petter Selasky 		if (err == 0 || err == USB_ERR_NOT_CONFIGURED)
61831d98677SRui Paulo 			break;
61931d98677SRui Paulo 		DPRINTFN(1, "Control request failed, %s (retrying)\n",
62031d98677SRui Paulo 		    usbd_errstr(err));
62117ebf553SAdrian Chadd 		rsu_ms_delay(sc, 10);
62231d98677SRui Paulo         }
62331d98677SRui Paulo 
62431d98677SRui Paulo         return (err);
62531d98677SRui Paulo }
62631d98677SRui Paulo 
62731d98677SRui Paulo static struct ieee80211vap *
62831d98677SRui Paulo rsu_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
62931d98677SRui Paulo     enum ieee80211_opmode opmode, int flags,
63031d98677SRui Paulo     const uint8_t bssid[IEEE80211_ADDR_LEN],
63131d98677SRui Paulo     const uint8_t mac[IEEE80211_ADDR_LEN])
63231d98677SRui Paulo {
63331d98677SRui Paulo 	struct rsu_vap *uvp;
63431d98677SRui Paulo 	struct ieee80211vap *vap;
63531d98677SRui Paulo 
63631d98677SRui Paulo 	if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
63731d98677SRui Paulo 		return (NULL);
63831d98677SRui Paulo 
6397a79cebfSGleb Smirnoff 	uvp =  malloc(sizeof(struct rsu_vap), M_80211_VAP, M_WAITOK | M_ZERO);
64031d98677SRui Paulo 	vap = &uvp->vap;
641bb2f69e8SHans Petter Selasky 
642bb2f69e8SHans Petter Selasky 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
6437a79cebfSGleb Smirnoff 	    flags, bssid) != 0) {
644bb2f69e8SHans Petter Selasky 		/* out of memory */
645bb2f69e8SHans Petter Selasky 		free(uvp, M_80211_VAP);
646bb2f69e8SHans Petter Selasky 		return (NULL);
647bb2f69e8SHans Petter Selasky 	}
64831d98677SRui Paulo 
64931d98677SRui Paulo 	/* override state transition machine */
65031d98677SRui Paulo 	uvp->newstate = vap->iv_newstate;
65131d98677SRui Paulo 	vap->iv_newstate = rsu_newstate;
65231d98677SRui Paulo 
653a12cbef7SAdrian Chadd 	/* Limits from the r92su driver */
654a12cbef7SAdrian Chadd 	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
655a12cbef7SAdrian Chadd 	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_32K;
656a12cbef7SAdrian Chadd 
65731d98677SRui Paulo 	/* complete setup */
65831d98677SRui Paulo 	ieee80211_vap_attach(vap, ieee80211_media_change,
6597a79cebfSGleb Smirnoff 	    ieee80211_media_status, mac);
66031d98677SRui Paulo 	ic->ic_opmode = opmode;
66131d98677SRui Paulo 
66231d98677SRui Paulo 	return (vap);
66331d98677SRui Paulo }
66431d98677SRui Paulo 
66531d98677SRui Paulo static void
66631d98677SRui Paulo rsu_vap_delete(struct ieee80211vap *vap)
66731d98677SRui Paulo {
66831d98677SRui Paulo 	struct rsu_vap *uvp = RSU_VAP(vap);
66931d98677SRui Paulo 
67031d98677SRui Paulo 	ieee80211_vap_detach(vap);
67131d98677SRui Paulo 	free(uvp, M_80211_VAP);
67231d98677SRui Paulo }
67331d98677SRui Paulo 
67431d98677SRui Paulo static void
67531d98677SRui Paulo rsu_scan_start(struct ieee80211com *ic)
67631d98677SRui Paulo {
677d3fdd08cSAdrian Chadd 	struct rsu_softc *sc = ic->ic_softc;
6787a79cebfSGleb Smirnoff 	int error;
67931d98677SRui Paulo 
68031d98677SRui Paulo 	/* Scanning is done by the firmware. */
68131d98677SRui Paulo 	RSU_LOCK(sc);
6826acf853dSAdrian Chadd 	/* XXX TODO: force awake if in in network-sleep? */
68331d98677SRui Paulo 	error = rsu_site_survey(sc, TAILQ_FIRST(&ic->ic_vaps));
68431d98677SRui Paulo 	RSU_UNLOCK(sc);
68531d98677SRui Paulo 	if (error != 0)
68631d98677SRui Paulo 		device_printf(sc->sc_dev,
68731d98677SRui Paulo 		    "could not send site survey command\n");
68831d98677SRui Paulo }
68931d98677SRui Paulo 
69031d98677SRui Paulo static void
69131d98677SRui Paulo rsu_scan_end(struct ieee80211com *ic)
69231d98677SRui Paulo {
69331d98677SRui Paulo 	/* Nothing to do here. */
69431d98677SRui Paulo }
69531d98677SRui Paulo 
69631d98677SRui Paulo static void
69731d98677SRui Paulo rsu_set_channel(struct ieee80211com *ic __unused)
69831d98677SRui Paulo {
69931d98677SRui Paulo 	/* We are unable to switch channels, yet. */
70031d98677SRui Paulo }
70131d98677SRui Paulo 
70231d98677SRui Paulo static void
703272f6adeSGleb Smirnoff rsu_update_mcast(struct ieee80211com *ic)
70431d98677SRui Paulo {
70531d98677SRui Paulo         /* XXX do nothing?  */
70631d98677SRui Paulo }
70731d98677SRui Paulo 
70831d98677SRui Paulo static int
70931d98677SRui Paulo rsu_alloc_list(struct rsu_softc *sc, struct rsu_data data[],
71031d98677SRui Paulo     int ndata, int maxsz)
71131d98677SRui Paulo {
71231d98677SRui Paulo 	int i, error;
71331d98677SRui Paulo 
71431d98677SRui Paulo 	for (i = 0; i < ndata; i++) {
71531d98677SRui Paulo 		struct rsu_data *dp = &data[i];
71631d98677SRui Paulo 		dp->sc = sc;
71731d98677SRui Paulo 		dp->m = NULL;
71831d98677SRui Paulo 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
71931d98677SRui Paulo 		if (dp->buf == NULL) {
72031d98677SRui Paulo 			device_printf(sc->sc_dev,
72131d98677SRui Paulo 			    "could not allocate buffer\n");
72231d98677SRui Paulo 			error = ENOMEM;
72331d98677SRui Paulo 			goto fail;
72431d98677SRui Paulo 		}
72531d98677SRui Paulo 		dp->ni = NULL;
72631d98677SRui Paulo 	}
72731d98677SRui Paulo 
72831d98677SRui Paulo 	return (0);
72931d98677SRui Paulo fail:
73031d98677SRui Paulo 	rsu_free_list(sc, data, ndata);
73131d98677SRui Paulo 	return (error);
73231d98677SRui Paulo }
73331d98677SRui Paulo 
73431d98677SRui Paulo static int
73531d98677SRui Paulo rsu_alloc_rx_list(struct rsu_softc *sc)
73631d98677SRui Paulo {
73731d98677SRui Paulo         int error, i;
73831d98677SRui Paulo 
73931d98677SRui Paulo 	error = rsu_alloc_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT,
74031d98677SRui Paulo 	    RSU_RXBUFSZ);
74131d98677SRui Paulo 	if (error != 0)
74231d98677SRui Paulo 		return (error);
74331d98677SRui Paulo 
74431d98677SRui Paulo 	STAILQ_INIT(&sc->sc_rx_active);
74531d98677SRui Paulo 	STAILQ_INIT(&sc->sc_rx_inactive);
74631d98677SRui Paulo 
74731d98677SRui Paulo 	for (i = 0; i < RSU_RX_LIST_COUNT; i++)
74831d98677SRui Paulo 		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
74931d98677SRui Paulo 
75031d98677SRui Paulo 	return (0);
75131d98677SRui Paulo }
75231d98677SRui Paulo 
75331d98677SRui Paulo static int
75431d98677SRui Paulo rsu_alloc_tx_list(struct rsu_softc *sc)
75531d98677SRui Paulo {
75631d98677SRui Paulo 	int error, i;
75731d98677SRui Paulo 
75831d98677SRui Paulo 	error = rsu_alloc_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT,
75931d98677SRui Paulo 	    RSU_TXBUFSZ);
76031d98677SRui Paulo 	if (error != 0)
76131d98677SRui Paulo 		return (error);
76231d98677SRui Paulo 
76331d98677SRui Paulo 	STAILQ_INIT(&sc->sc_tx_inactive);
764400b4e53SHans Petter Selasky 
765910593b5SHans Petter Selasky 	for (i = 0; i != RSU_N_TRANSFER; i++) {
766400b4e53SHans Petter Selasky 		STAILQ_INIT(&sc->sc_tx_active[i]);
767400b4e53SHans Petter Selasky 		STAILQ_INIT(&sc->sc_tx_pending[i]);
768400b4e53SHans Petter Selasky 	}
76931d98677SRui Paulo 
77031d98677SRui Paulo 	for (i = 0; i < RSU_TX_LIST_COUNT; i++) {
77131d98677SRui Paulo 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
77231d98677SRui Paulo 	}
77331d98677SRui Paulo 
77431d98677SRui Paulo 	return (0);
77531d98677SRui Paulo }
77631d98677SRui Paulo 
77731d98677SRui Paulo static void
77831d98677SRui Paulo rsu_free_tx_list(struct rsu_softc *sc)
77931d98677SRui Paulo {
780885476cbSHans Petter Selasky 	int i;
781885476cbSHans Petter Selasky 
782885476cbSHans Petter Selasky 	/* prevent further allocations from TX list(s) */
783885476cbSHans Petter Selasky 	STAILQ_INIT(&sc->sc_tx_inactive);
784885476cbSHans Petter Selasky 
785910593b5SHans Petter Selasky 	for (i = 0; i != RSU_N_TRANSFER; i++) {
786885476cbSHans Petter Selasky 		STAILQ_INIT(&sc->sc_tx_active[i]);
787885476cbSHans Petter Selasky 		STAILQ_INIT(&sc->sc_tx_pending[i]);
788885476cbSHans Petter Selasky 	}
789885476cbSHans Petter Selasky 
79031d98677SRui Paulo 	rsu_free_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT);
79131d98677SRui Paulo }
79231d98677SRui Paulo 
79331d98677SRui Paulo static void
79431d98677SRui Paulo rsu_free_rx_list(struct rsu_softc *sc)
79531d98677SRui Paulo {
796885476cbSHans Petter Selasky 	/* prevent further allocations from RX list(s) */
797885476cbSHans Petter Selasky 	STAILQ_INIT(&sc->sc_rx_inactive);
798885476cbSHans Petter Selasky 	STAILQ_INIT(&sc->sc_rx_active);
799885476cbSHans Petter Selasky 
80031d98677SRui Paulo 	rsu_free_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT);
80131d98677SRui Paulo }
80231d98677SRui Paulo 
80331d98677SRui Paulo static void
80431d98677SRui Paulo rsu_free_list(struct rsu_softc *sc, struct rsu_data data[], int ndata)
80531d98677SRui Paulo {
80631d98677SRui Paulo 	int i;
80731d98677SRui Paulo 
80831d98677SRui Paulo 	for (i = 0; i < ndata; i++) {
80931d98677SRui Paulo 		struct rsu_data *dp = &data[i];
81031d98677SRui Paulo 
81131d98677SRui Paulo 		if (dp->buf != NULL) {
81231d98677SRui Paulo 			free(dp->buf, M_USBDEV);
81331d98677SRui Paulo 			dp->buf = NULL;
81431d98677SRui Paulo 		}
81531d98677SRui Paulo 		if (dp->ni != NULL) {
81631d98677SRui Paulo 			ieee80211_free_node(dp->ni);
81731d98677SRui Paulo 			dp->ni = NULL;
81831d98677SRui Paulo 		}
81931d98677SRui Paulo 	}
82031d98677SRui Paulo }
82131d98677SRui Paulo 
82231d98677SRui Paulo static struct rsu_data *
82331d98677SRui Paulo _rsu_getbuf(struct rsu_softc *sc)
82431d98677SRui Paulo {
82531d98677SRui Paulo 	struct rsu_data *bf;
82631d98677SRui Paulo 
82731d98677SRui Paulo 	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
82831d98677SRui Paulo 	if (bf != NULL)
82931d98677SRui Paulo 		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
83031d98677SRui Paulo 	else
83131d98677SRui Paulo 		bf = NULL;
83231d98677SRui Paulo 	return (bf);
83331d98677SRui Paulo }
83431d98677SRui Paulo 
83531d98677SRui Paulo static struct rsu_data *
83631d98677SRui Paulo rsu_getbuf(struct rsu_softc *sc)
83731d98677SRui Paulo {
83831d98677SRui Paulo 	struct rsu_data *bf;
83931d98677SRui Paulo 
84031d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
84131d98677SRui Paulo 
84231d98677SRui Paulo 	bf = _rsu_getbuf(sc);
843829e0b0bSAdrian Chadd 	if (bf == NULL) {
844829e0b0bSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: no buffers\n", __func__);
845829e0b0bSAdrian Chadd 	}
84631d98677SRui Paulo 	return (bf);
84731d98677SRui Paulo }
84831d98677SRui Paulo 
849de76b5b7SAdrian Chadd static void
850de76b5b7SAdrian Chadd rsu_freebuf(struct rsu_softc *sc, struct rsu_data *bf)
851de76b5b7SAdrian Chadd {
852de76b5b7SAdrian Chadd 
853de76b5b7SAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
854de76b5b7SAdrian Chadd 	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, bf, next);
855de76b5b7SAdrian Chadd }
856de76b5b7SAdrian Chadd 
85731d98677SRui Paulo static int
85831d98677SRui Paulo rsu_write_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
85931d98677SRui Paulo     int len)
86031d98677SRui Paulo {
86131d98677SRui Paulo 	usb_device_request_t req;
86231d98677SRui Paulo 
86331d98677SRui Paulo 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
86431d98677SRui Paulo 	req.bRequest = R92S_REQ_REGS;
86531d98677SRui Paulo 	USETW(req.wValue, addr);
86631d98677SRui Paulo 	USETW(req.wIndex, 0);
86731d98677SRui Paulo 	USETW(req.wLength, len);
86831d98677SRui Paulo 
86931d98677SRui Paulo 	return (rsu_do_request(sc, &req, buf));
87031d98677SRui Paulo }
87131d98677SRui Paulo 
87231d98677SRui Paulo static void
87331d98677SRui Paulo rsu_write_1(struct rsu_softc *sc, uint16_t addr, uint8_t val)
87431d98677SRui Paulo {
87531d98677SRui Paulo 	rsu_write_region_1(sc, addr, &val, 1);
87631d98677SRui Paulo }
87731d98677SRui Paulo 
87831d98677SRui Paulo static void
87931d98677SRui Paulo rsu_write_2(struct rsu_softc *sc, uint16_t addr, uint16_t val)
88031d98677SRui Paulo {
88131d98677SRui Paulo 	val = htole16(val);
88231d98677SRui Paulo 	rsu_write_region_1(sc, addr, (uint8_t *)&val, 2);
88331d98677SRui Paulo }
88431d98677SRui Paulo 
88531d98677SRui Paulo static void
88631d98677SRui Paulo rsu_write_4(struct rsu_softc *sc, uint16_t addr, uint32_t val)
88731d98677SRui Paulo {
88831d98677SRui Paulo 	val = htole32(val);
88931d98677SRui Paulo 	rsu_write_region_1(sc, addr, (uint8_t *)&val, 4);
89031d98677SRui Paulo }
89131d98677SRui Paulo 
89231d98677SRui Paulo static int
89331d98677SRui Paulo rsu_read_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
89431d98677SRui Paulo     int len)
89531d98677SRui Paulo {
89631d98677SRui Paulo 	usb_device_request_t req;
89731d98677SRui Paulo 
89831d98677SRui Paulo 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
89931d98677SRui Paulo 	req.bRequest = R92S_REQ_REGS;
90031d98677SRui Paulo 	USETW(req.wValue, addr);
90131d98677SRui Paulo 	USETW(req.wIndex, 0);
90231d98677SRui Paulo 	USETW(req.wLength, len);
90331d98677SRui Paulo 
90431d98677SRui Paulo 	return (rsu_do_request(sc, &req, buf));
90531d98677SRui Paulo }
90631d98677SRui Paulo 
90731d98677SRui Paulo static uint8_t
90831d98677SRui Paulo rsu_read_1(struct rsu_softc *sc, uint16_t addr)
90931d98677SRui Paulo {
91031d98677SRui Paulo 	uint8_t val;
91131d98677SRui Paulo 
91231d98677SRui Paulo 	if (rsu_read_region_1(sc, addr, &val, 1) != 0)
91331d98677SRui Paulo 		return (0xff);
91431d98677SRui Paulo 	return (val);
91531d98677SRui Paulo }
91631d98677SRui Paulo 
91731d98677SRui Paulo static uint16_t
91831d98677SRui Paulo rsu_read_2(struct rsu_softc *sc, uint16_t addr)
91931d98677SRui Paulo {
92031d98677SRui Paulo 	uint16_t val;
92131d98677SRui Paulo 
92231d98677SRui Paulo 	if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
92331d98677SRui Paulo 		return (0xffff);
92431d98677SRui Paulo 	return (le16toh(val));
92531d98677SRui Paulo }
92631d98677SRui Paulo 
92731d98677SRui Paulo static uint32_t
92831d98677SRui Paulo rsu_read_4(struct rsu_softc *sc, uint16_t addr)
92931d98677SRui Paulo {
93031d98677SRui Paulo 	uint32_t val;
93131d98677SRui Paulo 
93231d98677SRui Paulo 	if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
93331d98677SRui Paulo 		return (0xffffffff);
93431d98677SRui Paulo 	return (le32toh(val));
93531d98677SRui Paulo }
93631d98677SRui Paulo 
93731d98677SRui Paulo static int
93831d98677SRui Paulo rsu_fw_iocmd(struct rsu_softc *sc, uint32_t iocmd)
93931d98677SRui Paulo {
94031d98677SRui Paulo 	int ntries;
94131d98677SRui Paulo 
94231d98677SRui Paulo 	rsu_write_4(sc, R92S_IOCMD_CTRL, iocmd);
94317ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
94431d98677SRui Paulo 	for (ntries = 0; ntries < 50; ntries++) {
94531d98677SRui Paulo 		if (rsu_read_4(sc, R92S_IOCMD_CTRL) == 0)
94631d98677SRui Paulo 			return (0);
94717ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
94831d98677SRui Paulo 	}
94931d98677SRui Paulo 	return (ETIMEDOUT);
95031d98677SRui Paulo }
95131d98677SRui Paulo 
95231d98677SRui Paulo static uint8_t
95331d98677SRui Paulo rsu_efuse_read_1(struct rsu_softc *sc, uint16_t addr)
95431d98677SRui Paulo {
95531d98677SRui Paulo 	uint32_t reg;
95631d98677SRui Paulo 	int ntries;
95731d98677SRui Paulo 
95831d98677SRui Paulo 	reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
95931d98677SRui Paulo 	reg = RW(reg, R92S_EFUSE_CTRL_ADDR, addr);
96031d98677SRui Paulo 	reg &= ~R92S_EFUSE_CTRL_VALID;
96131d98677SRui Paulo 	rsu_write_4(sc, R92S_EFUSE_CTRL, reg);
96231d98677SRui Paulo 	/* Wait for read operation to complete. */
96331d98677SRui Paulo 	for (ntries = 0; ntries < 100; ntries++) {
96431d98677SRui Paulo 		reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
96531d98677SRui Paulo 		if (reg & R92S_EFUSE_CTRL_VALID)
96631d98677SRui Paulo 			return (MS(reg, R92S_EFUSE_CTRL_DATA));
96717ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
96831d98677SRui Paulo 	}
96931d98677SRui Paulo 	device_printf(sc->sc_dev,
97031d98677SRui Paulo 	    "could not read efuse byte at address 0x%x\n", addr);
97131d98677SRui Paulo 	return (0xff);
97231d98677SRui Paulo }
97331d98677SRui Paulo 
97431d98677SRui Paulo static int
97531d98677SRui Paulo rsu_read_rom(struct rsu_softc *sc)
97631d98677SRui Paulo {
97731d98677SRui Paulo 	uint8_t *rom = sc->rom;
97831d98677SRui Paulo 	uint16_t addr = 0;
97931d98677SRui Paulo 	uint32_t reg;
98031d98677SRui Paulo 	uint8_t off, msk;
98131d98677SRui Paulo 	int i;
98231d98677SRui Paulo 
98331d98677SRui Paulo 	/* Make sure that ROM type is eFuse and that autoload succeeded. */
98431d98677SRui Paulo 	reg = rsu_read_1(sc, R92S_EE_9346CR);
98531d98677SRui Paulo 	if ((reg & (R92S_9356SEL | R92S_EEPROM_EN)) != R92S_EEPROM_EN)
98631d98677SRui Paulo 		return (EIO);
98731d98677SRui Paulo 
98831d98677SRui Paulo 	/* Turn on 2.5V to prevent eFuse leakage. */
98931d98677SRui Paulo 	reg = rsu_read_1(sc, R92S_EFUSE_TEST + 3);
99031d98677SRui Paulo 	rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg | 0x80);
99117ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
99231d98677SRui Paulo 	rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg & ~0x80);
99331d98677SRui Paulo 
99431d98677SRui Paulo 	/* Read full ROM image. */
99531d98677SRui Paulo 	memset(&sc->rom, 0xff, sizeof(sc->rom));
99631d98677SRui Paulo 	while (addr < 512) {
99731d98677SRui Paulo 		reg = rsu_efuse_read_1(sc, addr);
99831d98677SRui Paulo 		if (reg == 0xff)
99931d98677SRui Paulo 			break;
100031d98677SRui Paulo 		addr++;
100131d98677SRui Paulo 		off = reg >> 4;
100231d98677SRui Paulo 		msk = reg & 0xf;
100331d98677SRui Paulo 		for (i = 0; i < 4; i++) {
100431d98677SRui Paulo 			if (msk & (1 << i))
100531d98677SRui Paulo 				continue;
100631d98677SRui Paulo 			rom[off * 8 + i * 2 + 0] =
100731d98677SRui Paulo 			    rsu_efuse_read_1(sc, addr);
100831d98677SRui Paulo 			addr++;
100931d98677SRui Paulo 			rom[off * 8 + i * 2 + 1] =
101031d98677SRui Paulo 			    rsu_efuse_read_1(sc, addr);
101131d98677SRui Paulo 			addr++;
101231d98677SRui Paulo 		}
101331d98677SRui Paulo 	}
101431d98677SRui Paulo #ifdef USB_DEBUG
101531d98677SRui Paulo 	if (rsu_debug >= 5) {
101631d98677SRui Paulo 		/* Dump ROM content. */
101731d98677SRui Paulo 		printf("\n");
101831d98677SRui Paulo 		for (i = 0; i < sizeof(sc->rom); i++)
101931d98677SRui Paulo 			printf("%02x:", rom[i]);
102031d98677SRui Paulo 		printf("\n");
102131d98677SRui Paulo 	}
102231d98677SRui Paulo #endif
102331d98677SRui Paulo 	return (0);
102431d98677SRui Paulo }
102531d98677SRui Paulo 
102631d98677SRui Paulo static int
102731d98677SRui Paulo rsu_fw_cmd(struct rsu_softc *sc, uint8_t code, void *buf, int len)
102831d98677SRui Paulo {
1029bc6a9865SAdrian Chadd 	const uint8_t which = RSU_H2C_ENDPOINT;
103031d98677SRui Paulo 	struct rsu_data *data;
103131d98677SRui Paulo 	struct r92s_tx_desc *txd;
103231d98677SRui Paulo 	struct r92s_fw_cmd_hdr *cmd;
1033400b4e53SHans Petter Selasky 	int cmdsz;
1034400b4e53SHans Petter Selasky 	int xferlen;
103531d98677SRui Paulo 
103623386fa4SAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
103723386fa4SAdrian Chadd 
103831d98677SRui Paulo 	data = rsu_getbuf(sc);
103931d98677SRui Paulo 	if (data == NULL)
104031d98677SRui Paulo 		return (ENOMEM);
104131d98677SRui Paulo 
10426acf853dSAdrian Chadd 	/* Blank the entire payload, just to be safe */
10436acf853dSAdrian Chadd 	memset(data->buf, '\0', RSU_TXBUFSZ);
10446acf853dSAdrian Chadd 
104531d98677SRui Paulo 	/* Round-up command length to a multiple of 8 bytes. */
10466acf853dSAdrian Chadd 	/* XXX TODO: is this required? */
104731d98677SRui Paulo 	cmdsz = (len + 7) & ~7;
104831d98677SRui Paulo 
104931d98677SRui Paulo 	xferlen = sizeof(*txd) + sizeof(*cmd) + cmdsz;
105031d98677SRui Paulo 	KASSERT(xferlen <= RSU_TXBUFSZ, ("%s: invalid length", __func__));
105131d98677SRui Paulo 	memset(data->buf, 0, xferlen);
105231d98677SRui Paulo 
105331d98677SRui Paulo 	/* Setup Tx descriptor. */
105431d98677SRui Paulo 	txd = (struct r92s_tx_desc *)data->buf;
105531d98677SRui Paulo 	txd->txdw0 = htole32(
105631d98677SRui Paulo 	    SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
105731d98677SRui Paulo 	    SM(R92S_TXDW0_PKTLEN, sizeof(*cmd) + cmdsz) |
105831d98677SRui Paulo 	    R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
105931d98677SRui Paulo 	txd->txdw1 = htole32(SM(R92S_TXDW1_QSEL, R92S_TXDW1_QSEL_H2C));
106031d98677SRui Paulo 
106131d98677SRui Paulo 	/* Setup command header. */
106231d98677SRui Paulo 	cmd = (struct r92s_fw_cmd_hdr *)&txd[1];
106331d98677SRui Paulo 	cmd->len = htole16(cmdsz);
106431d98677SRui Paulo 	cmd->code = code;
106531d98677SRui Paulo 	cmd->seq = sc->cmd_seq;
106631d98677SRui Paulo 	sc->cmd_seq = (sc->cmd_seq + 1) & 0x7f;
106731d98677SRui Paulo 
106831d98677SRui Paulo 	/* Copy command payload. */
106931d98677SRui Paulo 	memcpy(&cmd[1], buf, len);
107031d98677SRui Paulo 
1071e6d258f6SAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FWCMD,
10724914fa0fSAdrian Chadd 	    "%s: Tx cmd code=0x%x len=0x%x\n",
10734914fa0fSAdrian Chadd 	    __func__, code, cmdsz);
107431d98677SRui Paulo 	data->buflen = xferlen;
1075400b4e53SHans Petter Selasky 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
1076910593b5SHans Petter Selasky 	usbd_transfer_start(sc->sc_xfer[which]);
107731d98677SRui Paulo 
107831d98677SRui Paulo 	return (0);
107931d98677SRui Paulo }
108031d98677SRui Paulo 
108131d98677SRui Paulo /* ARGSUSED */
108231d98677SRui Paulo static void
108331d98677SRui Paulo rsu_calib_task(void *arg, int pending __unused)
108431d98677SRui Paulo {
108531d98677SRui Paulo 	struct rsu_softc *sc = arg;
1086*a3767659SAdrian Chadd #ifdef notyet
108731d98677SRui Paulo 	uint32_t reg;
1088*a3767659SAdrian Chadd #endif
108931d98677SRui Paulo 
10904914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: running calibration task\n",
10914914fa0fSAdrian Chadd 	    __func__);
1092910593b5SHans Petter Selasky 
109331d98677SRui Paulo 	RSU_LOCK(sc);
109431d98677SRui Paulo #ifdef notyet
109531d98677SRui Paulo 	/* Read WPS PBC status. */
109631d98677SRui Paulo 	rsu_write_1(sc, R92S_MAC_PINMUX_CTRL,
109731d98677SRui Paulo 	    R92S_GPIOMUX_EN | SM(R92S_GPIOSEL_GPIO, R92S_GPIOSEL_GPIO_JTAG));
109831d98677SRui Paulo 	rsu_write_1(sc, R92S_GPIO_IO_SEL,
109931d98677SRui Paulo 	    rsu_read_1(sc, R92S_GPIO_IO_SEL) & ~R92S_GPIO_WPS);
110031d98677SRui Paulo 	reg = rsu_read_1(sc, R92S_GPIO_CTRL);
110131d98677SRui Paulo 	if (reg != 0xff && (reg & R92S_GPIO_WPS))
110231d98677SRui Paulo 		DPRINTF(("WPS PBC is pushed\n"));
110331d98677SRui Paulo #endif
110431d98677SRui Paulo 	/* Read current signal level. */
110531d98677SRui Paulo 	if (rsu_fw_iocmd(sc, 0xf4000001) == 0) {
1106*a3767659SAdrian Chadd 		sc->sc_currssi = rsu_read_4(sc, R92S_IOCMD_DATA);
1107*a3767659SAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_CALIB, "%s: RSSI=%d (%d)\n",
1108*a3767659SAdrian Chadd 		    __func__, sc->sc_currssi,
1109*a3767659SAdrian Chadd 		    rsu_hwrssi_to_rssi(sc, sc->sc_currssi));
111031d98677SRui Paulo 	}
1111910593b5SHans Petter Selasky 	if (sc->sc_calibrating)
1112910593b5SHans Petter Selasky 		taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task, hz);
111331d98677SRui Paulo 	RSU_UNLOCK(sc);
111431d98677SRui Paulo }
111531d98677SRui Paulo 
111677435f18SAdrian Chadd static void
111777435f18SAdrian Chadd rsu_tx_task(void *arg, int pending __unused)
111877435f18SAdrian Chadd {
111977435f18SAdrian Chadd 	struct rsu_softc *sc = arg;
112077435f18SAdrian Chadd 
112177435f18SAdrian Chadd 	RSU_LOCK(sc);
112277435f18SAdrian Chadd 	_rsu_start(sc);
112377435f18SAdrian Chadd 	RSU_UNLOCK(sc);
112477435f18SAdrian Chadd }
112577435f18SAdrian Chadd 
112644369387SAdrian Chadd #define	RSU_PWR_UNKNOWN		0x0
11276acf853dSAdrian Chadd #define	RSU_PWR_ACTIVE		0x1
11286acf853dSAdrian Chadd #define	RSU_PWR_OFF		0x2
11296acf853dSAdrian Chadd #define	RSU_PWR_SLEEP		0x3
11306acf853dSAdrian Chadd 
11316acf853dSAdrian Chadd /*
11326acf853dSAdrian Chadd  * Set the current power state.
11336acf853dSAdrian Chadd  *
11346acf853dSAdrian Chadd  * The rtlwifi code doesn't do this so aggressively; it
11356acf853dSAdrian Chadd  * waits for an idle period after association with
11366acf853dSAdrian Chadd  * no traffic before doing this.
11376acf853dSAdrian Chadd  *
11386acf853dSAdrian Chadd  * For now - it's on in all states except RUN, and
11396acf853dSAdrian Chadd  * in RUN it'll transition to allow sleep.
11406acf853dSAdrian Chadd  */
11416acf853dSAdrian Chadd 
11426acf853dSAdrian Chadd struct r92s_pwr_cmd {
11436acf853dSAdrian Chadd 	uint8_t mode;
11446acf853dSAdrian Chadd 	uint8_t smart_ps;
11456acf853dSAdrian Chadd 	uint8_t bcn_pass_time;
11466acf853dSAdrian Chadd };
11476acf853dSAdrian Chadd 
11486acf853dSAdrian Chadd static int
11496acf853dSAdrian Chadd rsu_set_fw_power_state(struct rsu_softc *sc, int state)
11506acf853dSAdrian Chadd {
11516acf853dSAdrian Chadd 	struct r92s_set_pwr_mode cmd;
11526acf853dSAdrian Chadd 	//struct r92s_pwr_cmd cmd;
11536acf853dSAdrian Chadd 	int error;
11546acf853dSAdrian Chadd 
11556acf853dSAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
11566acf853dSAdrian Chadd 
115744369387SAdrian Chadd 	/* only change state if required */
115844369387SAdrian Chadd 	if (sc->sc_curpwrstate == state)
115944369387SAdrian Chadd 		return (0);
116044369387SAdrian Chadd 
116144369387SAdrian Chadd 	memset(&cmd, 0, sizeof(cmd));
116244369387SAdrian Chadd 
11636acf853dSAdrian Chadd 	switch (state) {
11646acf853dSAdrian Chadd 	case RSU_PWR_ACTIVE:
11656acf853dSAdrian Chadd 		/* Force the hardware awake */
11666acf853dSAdrian Chadd 		rsu_write_1(sc, R92S_USB_HRPWM,
11676acf853dSAdrian Chadd 		    R92S_USB_HRPWM_PS_ST_ACTIVE | R92S_USB_HRPWM_PS_ALL_ON);
11686acf853dSAdrian Chadd 		cmd.mode = R92S_PS_MODE_ACTIVE;
11696acf853dSAdrian Chadd 		break;
11706acf853dSAdrian Chadd 	case RSU_PWR_SLEEP:
11716acf853dSAdrian Chadd 		cmd.mode = R92S_PS_MODE_DTIM;	/* XXX configurable? */
11726acf853dSAdrian Chadd 		cmd.smart_ps = 1; /* XXX 2 if doing p2p */
11736acf853dSAdrian Chadd 		cmd.bcn_pass_time = 5; /* in 100mS usb.c, linux/rtlwifi */
11746acf853dSAdrian Chadd 		break;
117544369387SAdrian Chadd 	case RSU_PWR_OFF:
117644369387SAdrian Chadd 		cmd.mode = R92S_PS_MODE_RADIOOFF;
117744369387SAdrian Chadd 		break;
11786acf853dSAdrian Chadd 	default:
11796acf853dSAdrian Chadd 		device_printf(sc->sc_dev, "%s: unknown ps mode (%d)\n",
11806acf853dSAdrian Chadd 		    __func__,
11816acf853dSAdrian Chadd 		    state);
11826acf853dSAdrian Chadd 		return (ENXIO);
11836acf853dSAdrian Chadd 	}
11846acf853dSAdrian Chadd 
11856acf853dSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RESET,
11866acf853dSAdrian Chadd 	    "%s: setting ps mode to %d (mode %d)\n",
11876acf853dSAdrian Chadd 	    __func__, state, cmd.mode);
11886acf853dSAdrian Chadd 	error = rsu_fw_cmd(sc, R92S_CMD_SET_PWR_MODE, &cmd, sizeof(cmd));
118944369387SAdrian Chadd 	if (error == 0)
119044369387SAdrian Chadd 		sc->sc_curpwrstate = state;
11916acf853dSAdrian Chadd 
11926acf853dSAdrian Chadd 	return (error);
11936acf853dSAdrian Chadd }
11946acf853dSAdrian Chadd 
119531d98677SRui Paulo static int
119631d98677SRui Paulo rsu_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
119731d98677SRui Paulo {
119831d98677SRui Paulo 	struct rsu_vap *uvp = RSU_VAP(vap);
119931d98677SRui Paulo 	struct ieee80211com *ic = vap->iv_ic;
1200d3fdd08cSAdrian Chadd 	struct rsu_softc *sc = ic->ic_softc;
120131d98677SRui Paulo 	struct ieee80211_node *ni;
120231d98677SRui Paulo 	struct ieee80211_rateset *rs;
120331d98677SRui Paulo 	enum ieee80211_state ostate;
120431d98677SRui Paulo 	int error, startcal = 0;
120531d98677SRui Paulo 
120631d98677SRui Paulo 	ostate = vap->iv_state;
12074914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_STATE, "%s: %s -> %s\n",
12084914fa0fSAdrian Chadd 	    __func__,
12094914fa0fSAdrian Chadd 	    ieee80211_state_name[ostate],
121031d98677SRui Paulo 	    ieee80211_state_name[nstate]);
121131d98677SRui Paulo 
121231d98677SRui Paulo 	IEEE80211_UNLOCK(ic);
121331d98677SRui Paulo 	if (ostate == IEEE80211_S_RUN) {
121431d98677SRui Paulo 		RSU_LOCK(sc);
121531d98677SRui Paulo 		/* Stop calibration. */
121631d98677SRui Paulo 		sc->sc_calibrating = 0;
121731d98677SRui Paulo 		RSU_UNLOCK(sc);
121831d98677SRui Paulo 		taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
121977435f18SAdrian Chadd 		taskqueue_drain(taskqueue_thread, &sc->tx_task);
122031d98677SRui Paulo 		/* Disassociate from our current BSS. */
122131d98677SRui Paulo 		RSU_LOCK(sc);
122231d98677SRui Paulo 		rsu_disconnect(sc);
122331d98677SRui Paulo 	} else
122431d98677SRui Paulo 		RSU_LOCK(sc);
122531d98677SRui Paulo 	switch (nstate) {
122631d98677SRui Paulo 	case IEEE80211_S_INIT:
12276acf853dSAdrian Chadd 		(void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
122831d98677SRui Paulo 		break;
122931d98677SRui Paulo 	case IEEE80211_S_AUTH:
123031d98677SRui Paulo 		ni = ieee80211_ref_node(vap->iv_bss);
12316acf853dSAdrian Chadd 		(void) rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
123231d98677SRui Paulo 		error = rsu_join_bss(sc, ni);
123331d98677SRui Paulo 		ieee80211_free_node(ni);
123431d98677SRui Paulo 		if (error != 0) {
123531d98677SRui Paulo 			device_printf(sc->sc_dev,
123631d98677SRui Paulo 			    "could not send join command\n");
123731d98677SRui Paulo 		}
123831d98677SRui Paulo 		break;
123931d98677SRui Paulo 	case IEEE80211_S_RUN:
124031d98677SRui Paulo 		ni = ieee80211_ref_node(vap->iv_bss);
124131d98677SRui Paulo 		rs = &ni->ni_rates;
124231d98677SRui Paulo 		/* Indicate highest supported rate. */
124331d98677SRui Paulo 		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
12446acf853dSAdrian Chadd 		(void) rsu_set_fw_power_state(sc, RSU_PWR_SLEEP);
124531d98677SRui Paulo 		ieee80211_free_node(ni);
124631d98677SRui Paulo 		startcal = 1;
124731d98677SRui Paulo 		break;
124831d98677SRui Paulo 	default:
124931d98677SRui Paulo 		break;
125031d98677SRui Paulo 	}
125131d98677SRui Paulo 	sc->sc_calibrating = 1;
1252910593b5SHans Petter Selasky 	/* Start periodic calibration. */
1253910593b5SHans Petter Selasky 	taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task, hz);
125431d98677SRui Paulo 	RSU_UNLOCK(sc);
125531d98677SRui Paulo 	IEEE80211_LOCK(ic);
125631d98677SRui Paulo 	return (uvp->newstate(vap, nstate, arg));
125731d98677SRui Paulo }
125831d98677SRui Paulo 
125931d98677SRui Paulo #ifdef notyet
126031d98677SRui Paulo static void
126131d98677SRui Paulo rsu_set_key(struct rsu_softc *sc, const struct ieee80211_key *k)
126231d98677SRui Paulo {
126331d98677SRui Paulo 	struct r92s_fw_cmd_set_key key;
126431d98677SRui Paulo 
126531d98677SRui Paulo 	memset(&key, 0, sizeof(key));
126631d98677SRui Paulo 	/* Map net80211 cipher to HW crypto algorithm. */
126731d98677SRui Paulo 	switch (k->wk_cipher->ic_cipher) {
126831d98677SRui Paulo 	case IEEE80211_CIPHER_WEP:
126931d98677SRui Paulo 		if (k->wk_keylen < 8)
127031d98677SRui Paulo 			key.algo = R92S_KEY_ALGO_WEP40;
127131d98677SRui Paulo 		else
127231d98677SRui Paulo 			key.algo = R92S_KEY_ALGO_WEP104;
127331d98677SRui Paulo 		break;
127431d98677SRui Paulo 	case IEEE80211_CIPHER_TKIP:
127531d98677SRui Paulo 		key.algo = R92S_KEY_ALGO_TKIP;
127631d98677SRui Paulo 		break;
127731d98677SRui Paulo 	case IEEE80211_CIPHER_AES_CCM:
127831d98677SRui Paulo 		key.algo = R92S_KEY_ALGO_AES;
127931d98677SRui Paulo 		break;
128031d98677SRui Paulo 	default:
128131d98677SRui Paulo 		return;
128231d98677SRui Paulo 	}
128331d98677SRui Paulo 	key.id = k->wk_keyix;
128431d98677SRui Paulo 	key.grpkey = (k->wk_flags & IEEE80211_KEY_GROUP) != 0;
128531d98677SRui Paulo 	memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
128631d98677SRui Paulo 	(void)rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
128731d98677SRui Paulo }
128831d98677SRui Paulo 
128931d98677SRui Paulo static void
129031d98677SRui Paulo rsu_delete_key(struct rsu_softc *sc, const struct ieee80211_key *k)
129131d98677SRui Paulo {
129231d98677SRui Paulo 	struct r92s_fw_cmd_set_key key;
129331d98677SRui Paulo 
129431d98677SRui Paulo 	memset(&key, 0, sizeof(key));
129531d98677SRui Paulo 	key.id = k->wk_keyix;
129631d98677SRui Paulo 	(void)rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
129731d98677SRui Paulo }
129831d98677SRui Paulo #endif
129931d98677SRui Paulo 
130031d98677SRui Paulo static int
130131d98677SRui Paulo rsu_site_survey(struct rsu_softc *sc, struct ieee80211vap *vap)
130231d98677SRui Paulo {
130331d98677SRui Paulo 	struct r92s_fw_cmd_sitesurvey cmd;
13047a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
130523386fa4SAdrian Chadd 	int r;
130623386fa4SAdrian Chadd 
130723386fa4SAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
130831d98677SRui Paulo 
130931d98677SRui Paulo 	memset(&cmd, 0, sizeof(cmd));
13107a79cebfSGleb Smirnoff 	if ((ic->ic_flags & IEEE80211_F_ASCAN) || sc->sc_scan_pass == 1)
131131d98677SRui Paulo 		cmd.active = htole32(1);
131231d98677SRui Paulo 	cmd.limit = htole32(48);
13137a79cebfSGleb Smirnoff 	if (sc->sc_scan_pass == 1 && vap->iv_des_nssid > 0) {
131431d98677SRui Paulo 		/* Do a directed scan for second pass. */
131531d98677SRui Paulo 		cmd.ssidlen = htole32(vap->iv_des_ssid[0].len);
131631d98677SRui Paulo 		memcpy(cmd.ssid, vap->iv_des_ssid[0].ssid,
131731d98677SRui Paulo 		    vap->iv_des_ssid[0].len);
131831d98677SRui Paulo 
131931d98677SRui Paulo 	}
13207a79cebfSGleb Smirnoff 	DPRINTF("sending site survey command, pass=%d\n", sc->sc_scan_pass);
132123386fa4SAdrian Chadd 	r = rsu_fw_cmd(sc, R92S_CMD_SITE_SURVEY, &cmd, sizeof(cmd));
132223386fa4SAdrian Chadd 	if (r == 0) {
132323386fa4SAdrian Chadd 		sc->sc_scanning = 1;
132423386fa4SAdrian Chadd 	}
132523386fa4SAdrian Chadd 	return (r);
132631d98677SRui Paulo }
132731d98677SRui Paulo 
132831d98677SRui Paulo static int
132931d98677SRui Paulo rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
133031d98677SRui Paulo {
13317a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
133231d98677SRui Paulo 	struct ieee80211vap *vap = ni->ni_vap;
133331d98677SRui Paulo 	struct ndis_wlan_bssid_ex *bss;
133431d98677SRui Paulo 	struct ndis_802_11_fixed_ies *fixed;
133531d98677SRui Paulo 	struct r92s_fw_cmd_auth auth;
1336bb03cd6fSHans Petter Selasky 	uint8_t buf[sizeof(*bss) + 128] __aligned(4);
1337bb03cd6fSHans Petter Selasky 	uint8_t *frm;
133831d98677SRui Paulo 	uint8_t opmode;
133931d98677SRui Paulo 	int error;
134023386fa4SAdrian Chadd 	int cnt;
134123386fa4SAdrian Chadd 	char *msg = "rsujoin";
134223386fa4SAdrian Chadd 
134323386fa4SAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
134423386fa4SAdrian Chadd 
134523386fa4SAdrian Chadd 	/*
134623386fa4SAdrian Chadd 	 * Until net80211 scanning doesn't automatically finish
134723386fa4SAdrian Chadd 	 * before we tell it to, let's just wait until any pending
134823386fa4SAdrian Chadd 	 * scan is done.
134923386fa4SAdrian Chadd 	 *
135023386fa4SAdrian Chadd 	 * XXX TODO: yes, this releases and re-acquires the lock.
135123386fa4SAdrian Chadd 	 * We should re-verify the state whenever we re-attempt this!
135223386fa4SAdrian Chadd 	 */
135323386fa4SAdrian Chadd 	cnt = 0;
135423386fa4SAdrian Chadd 	while (sc->sc_scanning && cnt < 10) {
135523386fa4SAdrian Chadd 		device_printf(sc->sc_dev,
135623386fa4SAdrian Chadd 		    "%s: still scanning! (attempt %d)\n",
135723386fa4SAdrian Chadd 		    __func__, cnt);
135823386fa4SAdrian Chadd 		msleep(msg, &sc->sc_mtx, 0, msg, hz / 2);
135923386fa4SAdrian Chadd 		cnt++;
136023386fa4SAdrian Chadd 	}
136131d98677SRui Paulo 
136231d98677SRui Paulo 	/* Let the FW decide the opmode based on the capinfo field. */
136331d98677SRui Paulo 	opmode = NDIS802_11AUTOUNKNOWN;
13644914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RESET,
13654914fa0fSAdrian Chadd 	    "%s: setting operating mode to %d\n",
13664914fa0fSAdrian Chadd 	    __func__, opmode);
136731d98677SRui Paulo 	error = rsu_fw_cmd(sc, R92S_CMD_SET_OPMODE, &opmode, sizeof(opmode));
136831d98677SRui Paulo 	if (error != 0)
136931d98677SRui Paulo 		return (error);
137031d98677SRui Paulo 
137131d98677SRui Paulo 	memset(&auth, 0, sizeof(auth));
137231d98677SRui Paulo 	if (vap->iv_flags & IEEE80211_F_WPA) {
137331d98677SRui Paulo 		auth.mode = R92S_AUTHMODE_WPA;
1374bb03cd6fSHans Petter Selasky 		auth.dot1x = (ni->ni_authmode == IEEE80211_AUTH_8021X);
137531d98677SRui Paulo 	} else
137631d98677SRui Paulo 		auth.mode = R92S_AUTHMODE_OPEN;
13774914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RESET,
13784914fa0fSAdrian Chadd 	    "%s: setting auth mode to %d\n",
13794914fa0fSAdrian Chadd 	    __func__, auth.mode);
138031d98677SRui Paulo 	error = rsu_fw_cmd(sc, R92S_CMD_SET_AUTH, &auth, sizeof(auth));
138131d98677SRui Paulo 	if (error != 0)
138231d98677SRui Paulo 		return (error);
138331d98677SRui Paulo 
138431d98677SRui Paulo 	memset(buf, 0, sizeof(buf));
138531d98677SRui Paulo 	bss = (struct ndis_wlan_bssid_ex *)buf;
138631d98677SRui Paulo 	IEEE80211_ADDR_COPY(bss->macaddr, ni->ni_bssid);
138731d98677SRui Paulo 	bss->ssid.ssidlen = htole32(ni->ni_esslen);
138831d98677SRui Paulo 	memcpy(bss->ssid.ssid, ni->ni_essid, ni->ni_esslen);
138931d98677SRui Paulo 	if (vap->iv_flags & (IEEE80211_F_PRIVACY | IEEE80211_F_WPA))
139031d98677SRui Paulo 		bss->privacy = htole32(1);
139131d98677SRui Paulo 	bss->rssi = htole32(ni->ni_avgrssi);
139231d98677SRui Paulo 	if (ic->ic_curmode == IEEE80211_MODE_11B)
139331d98677SRui Paulo 		bss->networktype = htole32(NDIS802_11DS);
139431d98677SRui Paulo 	else
139531d98677SRui Paulo 		bss->networktype = htole32(NDIS802_11OFDM24);
139631d98677SRui Paulo 	bss->config.len = htole32(sizeof(bss->config));
139731d98677SRui Paulo 	bss->config.bintval = htole32(ni->ni_intval);
139831d98677SRui Paulo 	bss->config.dsconfig = htole32(ieee80211_chan2ieee(ic, ni->ni_chan));
139931d98677SRui Paulo 	bss->inframode = htole32(NDIS802_11INFRASTRUCTURE);
14004914fa0fSAdrian Chadd 	/* XXX verify how this is supposed to look! */
140131d98677SRui Paulo 	memcpy(bss->supprates, ni->ni_rates.rs_rates,
140231d98677SRui Paulo 	    ni->ni_rates.rs_nrates);
140331d98677SRui Paulo 	/* Write the fixed fields of the beacon frame. */
140431d98677SRui Paulo 	fixed = (struct ndis_802_11_fixed_ies *)&bss[1];
140531d98677SRui Paulo 	memcpy(&fixed->tstamp, ni->ni_tstamp.data, 8);
140631d98677SRui Paulo 	fixed->bintval = htole16(ni->ni_intval);
140731d98677SRui Paulo 	fixed->capabilities = htole16(ni->ni_capinfo);
140831d98677SRui Paulo 	/* Write IEs to be included in the association request. */
140931d98677SRui Paulo 	frm = (uint8_t *)&fixed[1];
141031d98677SRui Paulo 	frm = ieee80211_add_rsn(frm, vap);
141131d98677SRui Paulo 	frm = ieee80211_add_wpa(frm, vap);
141231d98677SRui Paulo 	frm = ieee80211_add_qos(frm, ni);
14134b9d9eeeSAdrian Chadd 	if ((ic->ic_flags & IEEE80211_F_WME) &&
14144b9d9eeeSAdrian Chadd 	    (ni->ni_ies.wme_ie != NULL))
14154b9d9eeeSAdrian Chadd 		frm = ieee80211_add_wme_info(frm, &ic->ic_wme);
141674d7b9a8SAdrian Chadd 	if (ni->ni_flags & IEEE80211_NODE_HT) {
141731d98677SRui Paulo 		frm = ieee80211_add_htcap(frm, ni);
141874d7b9a8SAdrian Chadd 		frm = ieee80211_add_htinfo(frm, ni);
141974d7b9a8SAdrian Chadd 	}
142031d98677SRui Paulo 	bss->ieslen = htole32(frm - (uint8_t *)fixed);
142131d98677SRui Paulo 	bss->len = htole32(((frm - buf) + 3) & ~3);
14224914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_FWCMD,
14234914fa0fSAdrian Chadd 	    "%s: sending join bss command to %s chan %d\n",
14244914fa0fSAdrian Chadd 	    __func__,
142531d98677SRui Paulo 	    ether_sprintf(bss->macaddr), le32toh(bss->config.dsconfig));
142631d98677SRui Paulo 	return (rsu_fw_cmd(sc, R92S_CMD_JOIN_BSS, buf, sizeof(buf)));
142731d98677SRui Paulo }
142831d98677SRui Paulo 
142931d98677SRui Paulo static int
143031d98677SRui Paulo rsu_disconnect(struct rsu_softc *sc)
143131d98677SRui Paulo {
143231d98677SRui Paulo 	uint32_t zero = 0;	/* :-) */
143331d98677SRui Paulo 
143431d98677SRui Paulo 	/* Disassociate from our current BSS. */
14354914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
14364914fa0fSAdrian Chadd 	    "%s: sending disconnect command\n", __func__);
143731d98677SRui Paulo 	return (rsu_fw_cmd(sc, R92S_CMD_DISCONNECT, &zero, sizeof(zero)));
143831d98677SRui Paulo }
143931d98677SRui Paulo 
1440*a3767659SAdrian Chadd /*
1441*a3767659SAdrian Chadd  * Map the hardware provided RSSI value to a signal level.
1442*a3767659SAdrian Chadd  * For the most part it's just something we divide by and cap
1443*a3767659SAdrian Chadd  * so it doesn't overflow the representation by net80211.
1444*a3767659SAdrian Chadd  */
1445*a3767659SAdrian Chadd static int
1446*a3767659SAdrian Chadd rsu_hwrssi_to_rssi(struct rsu_softc *sc, int hw_rssi)
1447*a3767659SAdrian Chadd {
1448*a3767659SAdrian Chadd 	int v;
1449*a3767659SAdrian Chadd 
1450*a3767659SAdrian Chadd 	if (hw_rssi == 0)
1451*a3767659SAdrian Chadd 		return (0);
1452*a3767659SAdrian Chadd 	v = hw_rssi >> 4;
1453*a3767659SAdrian Chadd 	if (v > 80)
1454*a3767659SAdrian Chadd 		v = 80;
1455*a3767659SAdrian Chadd 	return (v);
1456*a3767659SAdrian Chadd }
1457*a3767659SAdrian Chadd 
145831d98677SRui Paulo static void
145931d98677SRui Paulo rsu_event_survey(struct rsu_softc *sc, uint8_t *buf, int len)
146031d98677SRui Paulo {
14617a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
146231d98677SRui Paulo 	struct ieee80211_frame *wh;
146331d98677SRui Paulo 	struct ndis_wlan_bssid_ex *bss;
146489fd8237SAdrian Chadd 	struct ieee80211_rx_stats rxs;
146531d98677SRui Paulo 	struct mbuf *m;
146631d98677SRui Paulo 	int pktlen;
146731d98677SRui Paulo 
146831d98677SRui Paulo 	if (__predict_false(len < sizeof(*bss)))
146931d98677SRui Paulo 		return;
147031d98677SRui Paulo 	bss = (struct ndis_wlan_bssid_ex *)buf;
147131d98677SRui Paulo 	if (__predict_false(len < sizeof(*bss) + le32toh(bss->ieslen)))
147231d98677SRui Paulo 		return;
147331d98677SRui Paulo 
14744914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
14754914fa0fSAdrian Chadd 	    "%s: found BSS %s: len=%d chan=%d inframode=%d "
1476a934198bSAdrian Chadd 	    "networktype=%d privacy=%d, RSSI=%d\n",
14774914fa0fSAdrian Chadd 	    __func__,
147831d98677SRui Paulo 	    ether_sprintf(bss->macaddr), le32toh(bss->len),
147931d98677SRui Paulo 	    le32toh(bss->config.dsconfig), le32toh(bss->inframode),
1480a934198bSAdrian Chadd 	    le32toh(bss->networktype), le32toh(bss->privacy),
1481a934198bSAdrian Chadd 	    le32toh(bss->rssi));
148231d98677SRui Paulo 
148331d98677SRui Paulo 	/* Build a fake beacon frame to let net80211 do all the parsing. */
14844914fa0fSAdrian Chadd 	/* XXX TODO: just call the new scan API methods! */
148531d98677SRui Paulo 	pktlen = sizeof(*wh) + le32toh(bss->ieslen);
148631d98677SRui Paulo 	if (__predict_false(pktlen > MCLBYTES))
148731d98677SRui Paulo 		return;
1488107f00c0SKevin Lo 	m = m_get2(pktlen, M_NOWAIT, MT_DATA, M_PKTHDR);
148931d98677SRui Paulo 	if (__predict_false(m == NULL))
149031d98677SRui Paulo 		return;
149131d98677SRui Paulo 	wh = mtod(m, struct ieee80211_frame *);
149231d98677SRui Paulo 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
149331d98677SRui Paulo 	    IEEE80211_FC0_SUBTYPE_BEACON;
149431d98677SRui Paulo 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
14958cfe5440SHans Petter Selasky 	USETW(wh->i_dur, 0);
14967a79cebfSGleb Smirnoff 	IEEE80211_ADDR_COPY(wh->i_addr1, ieee80211broadcastaddr);
149731d98677SRui Paulo 	IEEE80211_ADDR_COPY(wh->i_addr2, bss->macaddr);
149831d98677SRui Paulo 	IEEE80211_ADDR_COPY(wh->i_addr3, bss->macaddr);
149931d98677SRui Paulo 	*(uint16_t *)wh->i_seq = 0;
150031d98677SRui Paulo 	memcpy(&wh[1], (uint8_t *)&bss[1], le32toh(bss->ieslen));
150131d98677SRui Paulo 
150231d98677SRui Paulo 	/* Finalize mbuf. */
150331d98677SRui Paulo 	m->m_pkthdr.len = m->m_len = pktlen;
150489fd8237SAdrian Chadd 
150589fd8237SAdrian Chadd 	/* Set channel flags for input path */
150689fd8237SAdrian Chadd 	bzero(&rxs, sizeof(rxs));
150789fd8237SAdrian Chadd 	rxs.r_flags |= IEEE80211_R_IEEE | IEEE80211_R_FREQ;
150889fd8237SAdrian Chadd 	rxs.r_flags |= IEEE80211_R_NF | IEEE80211_R_RSSI;
150989fd8237SAdrian Chadd 	rxs.c_ieee = le32toh(bss->config.dsconfig);
151089fd8237SAdrian Chadd 	rxs.c_freq = ieee80211_ieee2mhz(rxs.c_ieee, IEEE80211_CHAN_2GHZ);
1511*a3767659SAdrian Chadd 	/* This is a number from 0..100; so let's just divide it down a bit */
1512*a3767659SAdrian Chadd 	rxs.rssi = le32toh(bss->rssi) / 2;
1513*a3767659SAdrian Chadd 	rxs.nf = -96;
151489fd8237SAdrian Chadd 
151531d98677SRui Paulo 	/* XXX avoid a LOR */
151631d98677SRui Paulo 	RSU_UNLOCK(sc);
151789fd8237SAdrian Chadd 	ieee80211_input_mimo_all(ic, m, &rxs);
151831d98677SRui Paulo 	RSU_LOCK(sc);
151931d98677SRui Paulo }
152031d98677SRui Paulo 
152131d98677SRui Paulo static void
152231d98677SRui Paulo rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
152331d98677SRui Paulo {
15247a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
152531d98677SRui Paulo 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
152631d98677SRui Paulo 	struct ieee80211_node *ni = vap->iv_bss;
152731d98677SRui Paulo 	struct r92s_event_join_bss *rsp;
1528bb03cd6fSHans Petter Selasky 	uint32_t tmp;
152931d98677SRui Paulo 	int res;
153031d98677SRui Paulo 
153131d98677SRui Paulo 	if (__predict_false(len < sizeof(*rsp)))
153231d98677SRui Paulo 		return;
153331d98677SRui Paulo 	rsp = (struct r92s_event_join_bss *)buf;
153431d98677SRui Paulo 	res = (int)le32toh(rsp->join_res);
153531d98677SRui Paulo 
1536e6d258f6SAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
1537e6d258f6SAdrian Chadd 	    "%s: Rx join BSS event len=%d res=%d\n",
1538e6d258f6SAdrian Chadd 	    __func__, len, res);
153923386fa4SAdrian Chadd 
154023386fa4SAdrian Chadd 	/*
154123386fa4SAdrian Chadd 	 * XXX Don't do this; there's likely a better way to tell
154223386fa4SAdrian Chadd 	 * the caller we failed.
154323386fa4SAdrian Chadd 	 */
154431d98677SRui Paulo 	if (res <= 0) {
154531d98677SRui Paulo 		RSU_UNLOCK(sc);
154631d98677SRui Paulo 		ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
154731d98677SRui Paulo 		RSU_LOCK(sc);
154831d98677SRui Paulo 		return;
154931d98677SRui Paulo 	}
155023386fa4SAdrian Chadd 
1551bb03cd6fSHans Petter Selasky 	tmp = le32toh(rsp->associd);
1552bb03cd6fSHans Petter Selasky 	if (tmp >= vap->iv_max_aid) {
1553bb03cd6fSHans Petter Selasky 		DPRINTF("Assoc ID overflow\n");
1554bb03cd6fSHans Petter Selasky 		tmp = 1;
1555bb03cd6fSHans Petter Selasky 	}
1556e6d258f6SAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_STATE | RSU_DEBUG_FWCMD,
1557e6d258f6SAdrian Chadd 	    "%s: associated with %s associd=%d\n",
1558e6d258f6SAdrian Chadd 	    __func__, ether_sprintf(rsp->bss.macaddr), tmp);
1559e6d258f6SAdrian Chadd 	/* XXX is this required? What's the top two bits for again? */
1560bb03cd6fSHans Petter Selasky 	ni->ni_associd = tmp | 0xc000;
156131d98677SRui Paulo 	RSU_UNLOCK(sc);
156231d98677SRui Paulo 	ieee80211_new_state(vap, IEEE80211_S_RUN,
156331d98677SRui Paulo 	    IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
156431d98677SRui Paulo 	RSU_LOCK(sc);
156531d98677SRui Paulo }
156631d98677SRui Paulo 
156731d98677SRui Paulo static void
1568237c4b43SAdrian Chadd rsu_event_addba_req_report(struct rsu_softc *sc, uint8_t *buf, int len)
1569237c4b43SAdrian Chadd {
1570237c4b43SAdrian Chadd 	struct ieee80211com *ic = &sc->sc_ic;
1571237c4b43SAdrian Chadd 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1572237c4b43SAdrian Chadd 	struct r92s_add_ba_event *ba = (void *) buf;
1573237c4b43SAdrian Chadd 	struct ieee80211_node *ni;
1574237c4b43SAdrian Chadd 
1575237c4b43SAdrian Chadd 	if (len < sizeof(*ba)) {
1576237c4b43SAdrian Chadd 		device_printf(sc->sc_dev, "%s: short read (%d)\n", __func__, len);
1577237c4b43SAdrian Chadd 		return;
1578237c4b43SAdrian Chadd 	}
1579237c4b43SAdrian Chadd 
1580237c4b43SAdrian Chadd 	if (vap == NULL)
1581237c4b43SAdrian Chadd 		return;
1582237c4b43SAdrian Chadd 
1583*a3767659SAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_AMPDU, "%s: mac=%s, tid=%d, ssn=%d\n",
1584237c4b43SAdrian Chadd 	    __func__,
1585237c4b43SAdrian Chadd 	    ether_sprintf(ba->mac_addr),
1586237c4b43SAdrian Chadd 	    (int) ba->tid,
1587237c4b43SAdrian Chadd 	    (int) le16toh(ba->ssn));
1588237c4b43SAdrian Chadd 
1589237c4b43SAdrian Chadd 	/* XXX do node lookup; this is STA specific */
1590237c4b43SAdrian Chadd 
1591237c4b43SAdrian Chadd 	ni = ieee80211_ref_node(vap->iv_bss);
1592237c4b43SAdrian Chadd 	ieee80211_ampdu_rx_start_ext(ni, ba->tid, le16toh(ba->ssn) >> 4, 32);
1593237c4b43SAdrian Chadd 	ieee80211_free_node(ni);
1594237c4b43SAdrian Chadd }
1595237c4b43SAdrian Chadd 
1596237c4b43SAdrian Chadd static void
159731d98677SRui Paulo rsu_rx_event(struct rsu_softc *sc, uint8_t code, uint8_t *buf, int len)
159831d98677SRui Paulo {
15997a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
160031d98677SRui Paulo 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
160131d98677SRui Paulo 
1602e6d258f6SAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
16034914fa0fSAdrian Chadd 	    "%s: Rx event code=%d len=%d\n", __func__, code, len);
160431d98677SRui Paulo 	switch (code) {
160531d98677SRui Paulo 	case R92S_EVT_SURVEY:
160631d98677SRui Paulo 		rsu_event_survey(sc, buf, len);
160731d98677SRui Paulo 		break;
160831d98677SRui Paulo 	case R92S_EVT_SURVEY_DONE:
16094914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_SCAN,
16104914fa0fSAdrian Chadd 		    "%s: site survey pass %d done, found %d BSS\n",
16114914fa0fSAdrian Chadd 		    __func__, sc->sc_scan_pass, le32toh(*(uint32_t *)buf));
161223386fa4SAdrian Chadd 		sc->sc_scanning = 0;
161331d98677SRui Paulo 		if (vap->iv_state != IEEE80211_S_SCAN)
161431d98677SRui Paulo 			break;	/* Ignore if not scanning. */
161523386fa4SAdrian Chadd 
161623386fa4SAdrian Chadd 		/*
161723386fa4SAdrian Chadd 		 * XXX TODO: This needs to be done without a transition to
161823386fa4SAdrian Chadd 		 * the SCAN state again.  Grr.
161923386fa4SAdrian Chadd 		 */
16207a79cebfSGleb Smirnoff 		if (sc->sc_scan_pass == 0 && vap->iv_des_nssid != 0) {
162131d98677SRui Paulo 			/* Schedule a directed scan for hidden APs. */
16224b9d9eeeSAdrian Chadd 			/* XXX bad! */
16237a79cebfSGleb Smirnoff 			sc->sc_scan_pass = 1;
162431d98677SRui Paulo 			RSU_UNLOCK(sc);
162531d98677SRui Paulo 			ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
162631d98677SRui Paulo 			RSU_LOCK(sc);
162731d98677SRui Paulo 			break;
162831d98677SRui Paulo 		}
16297a79cebfSGleb Smirnoff 		sc->sc_scan_pass = 0;
163031d98677SRui Paulo 		break;
163131d98677SRui Paulo 	case R92S_EVT_JOIN_BSS:
163231d98677SRui Paulo 		if (vap->iv_state == IEEE80211_S_AUTH)
163331d98677SRui Paulo 			rsu_event_join_bss(sc, buf, len);
163431d98677SRui Paulo 		break;
163531d98677SRui Paulo 	case R92S_EVT_DEL_STA:
1636e6d258f6SAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_FWCMD | RSU_DEBUG_STATE,
1637e6d258f6SAdrian Chadd 		    "%s: disassociated from %s\n", __func__,
1638e6d258f6SAdrian Chadd 		    ether_sprintf(buf));
163931d98677SRui Paulo 		if (vap->iv_state == IEEE80211_S_RUN &&
164031d98677SRui Paulo 		    IEEE80211_ADDR_EQ(vap->iv_bss->ni_bssid, buf)) {
164131d98677SRui Paulo 			RSU_UNLOCK(sc);
164231d98677SRui Paulo 			ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
164331d98677SRui Paulo 			RSU_LOCK(sc);
164431d98677SRui Paulo 		}
164531d98677SRui Paulo 		break;
164631d98677SRui Paulo 	case R92S_EVT_WPS_PBC:
16474914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_RX | RSU_DEBUG_FWCMD,
16484914fa0fSAdrian Chadd 		    "%s: WPS PBC pushed.\n", __func__);
164931d98677SRui Paulo 		break;
165031d98677SRui Paulo 	case R92S_EVT_FWDBG:
165131d98677SRui Paulo 		buf[60] = '\0';
16524914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_FWDBG, "FWDBG: %s\n", (char *)buf);
165331d98677SRui Paulo 		break;
1654237c4b43SAdrian Chadd 	case R92S_EVT_ADDBA_REQ_REPORT:
1655237c4b43SAdrian Chadd 		rsu_event_addba_req_report(sc, buf, len);
1656237c4b43SAdrian Chadd 		break;
1657910593b5SHans Petter Selasky 	default:
16586acf853dSAdrian Chadd 		device_printf(sc->sc_dev, "%s: unhandled code (%d)\n", __func__, code);
1659910593b5SHans Petter Selasky 		break;
166031d98677SRui Paulo 	}
166131d98677SRui Paulo }
166231d98677SRui Paulo 
166331d98677SRui Paulo static void
166431d98677SRui Paulo rsu_rx_multi_event(struct rsu_softc *sc, uint8_t *buf, int len)
166531d98677SRui Paulo {
166631d98677SRui Paulo 	struct r92s_fw_cmd_hdr *cmd;
166731d98677SRui Paulo 	int cmdsz;
166831d98677SRui Paulo 
16694914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RX, "%s: Rx events len=%d\n", __func__, len);
167031d98677SRui Paulo 
167131d98677SRui Paulo 	/* Skip Rx status. */
167231d98677SRui Paulo 	buf += sizeof(struct r92s_rx_stat);
167331d98677SRui Paulo 	len -= sizeof(struct r92s_rx_stat);
167431d98677SRui Paulo 
167531d98677SRui Paulo 	/* Process all events. */
167631d98677SRui Paulo 	for (;;) {
167731d98677SRui Paulo 		/* Check that command header fits. */
167831d98677SRui Paulo 		if (__predict_false(len < sizeof(*cmd)))
167931d98677SRui Paulo 			break;
168031d98677SRui Paulo 		cmd = (struct r92s_fw_cmd_hdr *)buf;
168131d98677SRui Paulo 		/* Check that command payload fits. */
168231d98677SRui Paulo 		cmdsz = le16toh(cmd->len);
168331d98677SRui Paulo 		if (__predict_false(len < sizeof(*cmd) + cmdsz))
168431d98677SRui Paulo 			break;
168531d98677SRui Paulo 
168631d98677SRui Paulo 		/* Process firmware event. */
168731d98677SRui Paulo 		rsu_rx_event(sc, cmd->code, (uint8_t *)&cmd[1], cmdsz);
168831d98677SRui Paulo 
168931d98677SRui Paulo 		if (!(cmd->seq & R92S_FW_CMD_MORE))
169031d98677SRui Paulo 			break;
169131d98677SRui Paulo 		buf += sizeof(*cmd) + cmdsz;
169231d98677SRui Paulo 		len -= sizeof(*cmd) + cmdsz;
169331d98677SRui Paulo 	}
169431d98677SRui Paulo }
169531d98677SRui Paulo 
1696*a3767659SAdrian Chadd #if 0
169731d98677SRui Paulo static int8_t
169831d98677SRui Paulo rsu_get_rssi(struct rsu_softc *sc, int rate, void *physt)
169931d98677SRui Paulo {
170031d98677SRui Paulo 	static const int8_t cckoff[] = { 14, -2, -20, -40 };
170131d98677SRui Paulo 	struct r92s_rx_phystat *phy;
170231d98677SRui Paulo 	struct r92s_rx_cck *cck;
170331d98677SRui Paulo 	uint8_t rpt;
170431d98677SRui Paulo 	int8_t rssi;
170531d98677SRui Paulo 
170631d98677SRui Paulo 	if (rate <= 3) {
170731d98677SRui Paulo 		cck = (struct r92s_rx_cck *)physt;
170831d98677SRui Paulo 		rpt = (cck->agc_rpt >> 6) & 0x3;
170931d98677SRui Paulo 		rssi = cck->agc_rpt & 0x3e;
171031d98677SRui Paulo 		rssi = cckoff[rpt] - rssi;
171131d98677SRui Paulo 	} else {	/* OFDM/HT. */
171231d98677SRui Paulo 		phy = (struct r92s_rx_phystat *)physt;
171331d98677SRui Paulo 		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 106;
171431d98677SRui Paulo 	}
171531d98677SRui Paulo 	return (rssi);
171631d98677SRui Paulo }
1717*a3767659SAdrian Chadd #endif
171831d98677SRui Paulo 
171931d98677SRui Paulo static struct mbuf *
1720*a3767659SAdrian Chadd rsu_rx_frame(struct rsu_softc *sc, uint8_t *buf, int pktlen)
172131d98677SRui Paulo {
17227a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
172331d98677SRui Paulo 	struct ieee80211_frame *wh;
172431d98677SRui Paulo 	struct r92s_rx_stat *stat;
172531d98677SRui Paulo 	uint32_t rxdw0, rxdw3;
172631d98677SRui Paulo 	struct mbuf *m;
172731d98677SRui Paulo 	uint8_t rate;
172831d98677SRui Paulo 	int infosz;
172931d98677SRui Paulo 
173031d98677SRui Paulo 	stat = (struct r92s_rx_stat *)buf;
173131d98677SRui Paulo 	rxdw0 = le32toh(stat->rxdw0);
173231d98677SRui Paulo 	rxdw3 = le32toh(stat->rxdw3);
173331d98677SRui Paulo 
173431d98677SRui Paulo 	if (__predict_false(rxdw0 & R92S_RXDW0_CRCERR)) {
17357a79cebfSGleb Smirnoff 		counter_u64_add(ic->ic_ierrors, 1);
173631d98677SRui Paulo 		return NULL;
173731d98677SRui Paulo 	}
173831d98677SRui Paulo 	if (__predict_false(pktlen < sizeof(*wh) || pktlen > MCLBYTES)) {
17397a79cebfSGleb Smirnoff 		counter_u64_add(ic->ic_ierrors, 1);
174031d98677SRui Paulo 		return NULL;
174131d98677SRui Paulo 	}
174231d98677SRui Paulo 
174331d98677SRui Paulo 	rate = MS(rxdw3, R92S_RXDW3_RATE);
174431d98677SRui Paulo 	infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
174531d98677SRui Paulo 
1746*a3767659SAdrian Chadd #if 0
174731d98677SRui Paulo 	/* Get RSSI from PHY status descriptor if present. */
174831d98677SRui Paulo 	if (infosz != 0)
174931d98677SRui Paulo 		*rssi = rsu_get_rssi(sc, rate, &stat[1]);
175031d98677SRui Paulo 	else
175131d98677SRui Paulo 		*rssi = 0;
1752*a3767659SAdrian Chadd #endif
175331d98677SRui Paulo 
17544914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RX,
1755*a3767659SAdrian Chadd 	    "%s: Rx frame len=%d rate=%d infosz=%d\n",
1756*a3767659SAdrian Chadd 	    __func__, pktlen, rate, infosz);
175731d98677SRui Paulo 
1758107f00c0SKevin Lo 	m = m_get2(pktlen, M_NOWAIT, MT_DATA, M_PKTHDR);
175931d98677SRui Paulo 	if (__predict_false(m == NULL)) {
17607a79cebfSGleb Smirnoff 		counter_u64_add(ic->ic_ierrors, 1);
176131d98677SRui Paulo 		return NULL;
176231d98677SRui Paulo 	}
176331d98677SRui Paulo 	/* Hardware does Rx TCP checksum offload. */
176431d98677SRui Paulo 	if (rxdw3 & R92S_RXDW3_TCPCHKVALID) {
176531d98677SRui Paulo 		if (__predict_true(rxdw3 & R92S_RXDW3_TCPCHKRPT))
176631d98677SRui Paulo 			m->m_pkthdr.csum_flags |= CSUM_DATA_VALID;
176731d98677SRui Paulo 	}
176831d98677SRui Paulo 	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
176931d98677SRui Paulo 	memcpy(mtod(m, uint8_t *), wh, pktlen);
177031d98677SRui Paulo 	m->m_pkthdr.len = m->m_len = pktlen;
177131d98677SRui Paulo 
177231d98677SRui Paulo 	if (ieee80211_radiotap_active(ic)) {
177331d98677SRui Paulo 		struct rsu_rx_radiotap_header *tap = &sc->sc_rxtap;
177431d98677SRui Paulo 
177531d98677SRui Paulo 		/* Map HW rate index to 802.11 rate. */
177631d98677SRui Paulo 		tap->wr_flags = 2;
177731d98677SRui Paulo 		if (!(rxdw3 & R92S_RXDW3_HTC)) {
177831d98677SRui Paulo 			switch (rate) {
177931d98677SRui Paulo 			/* CCK. */
178031d98677SRui Paulo 			case  0: tap->wr_rate =   2; break;
178131d98677SRui Paulo 			case  1: tap->wr_rate =   4; break;
178231d98677SRui Paulo 			case  2: tap->wr_rate =  11; break;
178331d98677SRui Paulo 			case  3: tap->wr_rate =  22; break;
178431d98677SRui Paulo 			/* OFDM. */
178531d98677SRui Paulo 			case  4: tap->wr_rate =  12; break;
178631d98677SRui Paulo 			case  5: tap->wr_rate =  18; break;
178731d98677SRui Paulo 			case  6: tap->wr_rate =  24; break;
178831d98677SRui Paulo 			case  7: tap->wr_rate =  36; break;
178931d98677SRui Paulo 			case  8: tap->wr_rate =  48; break;
179031d98677SRui Paulo 			case  9: tap->wr_rate =  72; break;
179131d98677SRui Paulo 			case 10: tap->wr_rate =  96; break;
179231d98677SRui Paulo 			case 11: tap->wr_rate = 108; break;
179331d98677SRui Paulo 			}
179431d98677SRui Paulo 		} else if (rate >= 12) {	/* MCS0~15. */
179531d98677SRui Paulo 			/* Bit 7 set means HT MCS instead of rate. */
179631d98677SRui Paulo 			tap->wr_rate = 0x80 | (rate - 12);
179731d98677SRui Paulo 		}
1798*a3767659SAdrian Chadd #if 0
179931d98677SRui Paulo 		tap->wr_dbm_antsignal = *rssi;
1800*a3767659SAdrian Chadd #endif
1801*a3767659SAdrian Chadd 		/* XXX not nice */
1802*a3767659SAdrian Chadd 		tap->wr_dbm_antsignal = rsu_hwrssi_to_rssi(sc, sc->sc_currssi);
180331d98677SRui Paulo 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
180431d98677SRui Paulo 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
180531d98677SRui Paulo 	}
180631d98677SRui Paulo 
180731d98677SRui Paulo 	return (m);
180831d98677SRui Paulo }
180931d98677SRui Paulo 
181031d98677SRui Paulo static struct mbuf *
1811*a3767659SAdrian Chadd rsu_rx_multi_frame(struct rsu_softc *sc, uint8_t *buf, int len)
181231d98677SRui Paulo {
181331d98677SRui Paulo 	struct r92s_rx_stat *stat;
181431d98677SRui Paulo 	uint32_t rxdw0;
181531d98677SRui Paulo 	int totlen, pktlen, infosz, npkts;
181631d98677SRui Paulo 	struct mbuf *m, *m0 = NULL, *prevm = NULL;
181731d98677SRui Paulo 
181831d98677SRui Paulo 	/* Get the number of encapsulated frames. */
181931d98677SRui Paulo 	stat = (struct r92s_rx_stat *)buf;
182031d98677SRui Paulo 	npkts = MS(le32toh(stat->rxdw2), R92S_RXDW2_PKTCNT);
18214914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RX,
18224914fa0fSAdrian Chadd 	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
182331d98677SRui Paulo 
182431d98677SRui Paulo 	/* Process all of them. */
182531d98677SRui Paulo 	while (npkts-- > 0) {
182631d98677SRui Paulo 		if (__predict_false(len < sizeof(*stat)))
182731d98677SRui Paulo 			break;
182831d98677SRui Paulo 		stat = (struct r92s_rx_stat *)buf;
182931d98677SRui Paulo 		rxdw0 = le32toh(stat->rxdw0);
183031d98677SRui Paulo 
183131d98677SRui Paulo 		pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
183231d98677SRui Paulo 		if (__predict_false(pktlen == 0))
183331d98677SRui Paulo 			break;
183431d98677SRui Paulo 
183531d98677SRui Paulo 		infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
183631d98677SRui Paulo 
183731d98677SRui Paulo 		/* Make sure everything fits in xfer. */
183831d98677SRui Paulo 		totlen = sizeof(*stat) + infosz + pktlen;
183931d98677SRui Paulo 		if (__predict_false(totlen > len))
184031d98677SRui Paulo 			break;
184131d98677SRui Paulo 
184231d98677SRui Paulo 		/* Process 802.11 frame. */
1843*a3767659SAdrian Chadd 		m = rsu_rx_frame(sc, buf, pktlen);
184431d98677SRui Paulo 		if (m0 == NULL)
184531d98677SRui Paulo 			m0 = m;
184631d98677SRui Paulo 		if (prevm == NULL)
184731d98677SRui Paulo 			prevm = m;
184831d98677SRui Paulo 		else {
184931d98677SRui Paulo 			prevm->m_next = m;
185031d98677SRui Paulo 			prevm = m;
185131d98677SRui Paulo 		}
185231d98677SRui Paulo 		/* Next chunk is 128-byte aligned. */
185331d98677SRui Paulo 		totlen = (totlen + 127) & ~127;
185431d98677SRui Paulo 		buf += totlen;
185531d98677SRui Paulo 		len -= totlen;
185631d98677SRui Paulo 	}
185731d98677SRui Paulo 
185831d98677SRui Paulo 	return (m0);
185931d98677SRui Paulo }
186031d98677SRui Paulo 
186131d98677SRui Paulo static struct mbuf *
1862*a3767659SAdrian Chadd rsu_rxeof(struct usb_xfer *xfer, struct rsu_data *data)
186331d98677SRui Paulo {
186431d98677SRui Paulo 	struct rsu_softc *sc = data->sc;
18657a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
186631d98677SRui Paulo 	struct r92s_rx_stat *stat;
186731d98677SRui Paulo 	int len;
186831d98677SRui Paulo 
186931d98677SRui Paulo 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
187031d98677SRui Paulo 
187131d98677SRui Paulo 	if (__predict_false(len < sizeof(*stat))) {
187231d98677SRui Paulo 		DPRINTF("xfer too short %d\n", len);
18737a79cebfSGleb Smirnoff 		counter_u64_add(ic->ic_ierrors, 1);
187431d98677SRui Paulo 		return (NULL);
187531d98677SRui Paulo 	}
187631d98677SRui Paulo 	/* Determine if it is a firmware C2H event or an 802.11 frame. */
187731d98677SRui Paulo 	stat = (struct r92s_rx_stat *)data->buf;
187831d98677SRui Paulo 	if ((le32toh(stat->rxdw1) & 0x1ff) == 0x1ff) {
187931d98677SRui Paulo 		rsu_rx_multi_event(sc, data->buf, len);
188031d98677SRui Paulo 		/* No packets to process. */
188131d98677SRui Paulo 		return (NULL);
188231d98677SRui Paulo 	} else
1883*a3767659SAdrian Chadd 		return (rsu_rx_multi_frame(sc, data->buf, len));
188431d98677SRui Paulo }
188531d98677SRui Paulo 
188631d98677SRui Paulo static void
188731d98677SRui Paulo rsu_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
188831d98677SRui Paulo {
188931d98677SRui Paulo 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
18907a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
189131d98677SRui Paulo 	struct ieee80211_frame *wh;
189231d98677SRui Paulo 	struct ieee80211_node *ni;
189331d98677SRui Paulo 	struct mbuf *m = NULL, *next;
189431d98677SRui Paulo 	struct rsu_data *data;
189531d98677SRui Paulo 
189631d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
189731d98677SRui Paulo 
189831d98677SRui Paulo 	switch (USB_GET_STATE(xfer)) {
189931d98677SRui Paulo 	case USB_ST_TRANSFERRED:
190031d98677SRui Paulo 		data = STAILQ_FIRST(&sc->sc_rx_active);
190131d98677SRui Paulo 		if (data == NULL)
190231d98677SRui Paulo 			goto tr_setup;
190331d98677SRui Paulo 		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1904*a3767659SAdrian Chadd 		m = rsu_rxeof(xfer, data);
190531d98677SRui Paulo 		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
190631d98677SRui Paulo 		/* FALLTHROUGH */
190731d98677SRui Paulo 	case USB_ST_SETUP:
190831d98677SRui Paulo tr_setup:
190974d7b9a8SAdrian Chadd 		/*
191074d7b9a8SAdrian Chadd 		 * XXX TODO: if we have an mbuf list, but then
191174d7b9a8SAdrian Chadd 		 * we hit data == NULL, what now?
191274d7b9a8SAdrian Chadd 		 */
191331d98677SRui Paulo 		data = STAILQ_FIRST(&sc->sc_rx_inactive);
191431d98677SRui Paulo 		if (data == NULL) {
191531d98677SRui Paulo 			KASSERT(m == NULL, ("mbuf isn't NULL"));
191631d98677SRui Paulo 			return;
191731d98677SRui Paulo 		}
191831d98677SRui Paulo 		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
191931d98677SRui Paulo 		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
192031d98677SRui Paulo 		usbd_xfer_set_frame_data(xfer, 0, data->buf,
192131d98677SRui Paulo 		    usbd_xfer_max_len(xfer));
192231d98677SRui Paulo 		usbd_transfer_submit(xfer);
192331d98677SRui Paulo 		/*
192431d98677SRui Paulo 		 * To avoid LOR we should unlock our private mutex here to call
192531d98677SRui Paulo 		 * ieee80211_input() because here is at the end of a USB
192631d98677SRui Paulo 		 * callback and safe to unlock.
192731d98677SRui Paulo 		 */
192831d98677SRui Paulo 		RSU_UNLOCK(sc);
192931d98677SRui Paulo 		while (m != NULL) {
1930*a3767659SAdrian Chadd 			int rssi;
1931*a3767659SAdrian Chadd 
1932*a3767659SAdrian Chadd 			/* Cheat and get the last calibrated RSSI */
1933*a3767659SAdrian Chadd 			rssi = rsu_hwrssi_to_rssi(sc, sc->sc_currssi);
1934*a3767659SAdrian Chadd 
193531d98677SRui Paulo 			next = m->m_next;
193631d98677SRui Paulo 			m->m_next = NULL;
193731d98677SRui Paulo 			wh = mtod(m, struct ieee80211_frame *);
193831d98677SRui Paulo 			ni = ieee80211_find_rxnode(ic,
193931d98677SRui Paulo 			    (struct ieee80211_frame_min *)wh);
194031d98677SRui Paulo 			if (ni != NULL) {
1941237c4b43SAdrian Chadd 				if (ni->ni_flags & IEEE80211_NODE_HT)
1942237c4b43SAdrian Chadd 					m->m_flags |= M_AMPDU;
1943*a3767659SAdrian Chadd 				(void)ieee80211_input(ni, m, rssi, -96);
194431d98677SRui Paulo 				ieee80211_free_node(ni);
194531d98677SRui Paulo 			} else
1946*a3767659SAdrian Chadd 				(void)ieee80211_input_all(ic, m, rssi, -96);
194731d98677SRui Paulo 			m = next;
194831d98677SRui Paulo 		}
194931d98677SRui Paulo 		RSU_LOCK(sc);
195031d98677SRui Paulo 		break;
195131d98677SRui Paulo 	default:
195231d98677SRui Paulo 		/* needs it to the inactive queue due to a error. */
195331d98677SRui Paulo 		data = STAILQ_FIRST(&sc->sc_rx_active);
195431d98677SRui Paulo 		if (data != NULL) {
195531d98677SRui Paulo 			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
195631d98677SRui Paulo 			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
195731d98677SRui Paulo 		}
195831d98677SRui Paulo 		if (error != USB_ERR_CANCELLED) {
195931d98677SRui Paulo 			usbd_xfer_set_stall(xfer);
19607a79cebfSGleb Smirnoff 			counter_u64_add(ic->ic_ierrors, 1);
196131d98677SRui Paulo 			goto tr_setup;
196231d98677SRui Paulo 		}
196331d98677SRui Paulo 		break;
196431d98677SRui Paulo 	}
196531d98677SRui Paulo 
196631d98677SRui Paulo }
196731d98677SRui Paulo 
196831d98677SRui Paulo static void
196931d98677SRui Paulo rsu_txeof(struct usb_xfer *xfer, struct rsu_data *data)
197031d98677SRui Paulo {
19714914fa0fSAdrian Chadd #ifdef	USB_DEBUG
19724914fa0fSAdrian Chadd 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
19734914fa0fSAdrian Chadd #endif
19744914fa0fSAdrian Chadd 
19754914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: called; data=%p\n",
19764914fa0fSAdrian Chadd 	    __func__,
19774914fa0fSAdrian Chadd 	    data);
197831d98677SRui Paulo 
197931d98677SRui Paulo 	if (data->m) {
198031d98677SRui Paulo 		/* XXX status? */
19817a79cebfSGleb Smirnoff 		ieee80211_tx_complete(data->ni, data->m, 0);
198231d98677SRui Paulo 		data->m = NULL;
198331d98677SRui Paulo 		data->ni = NULL;
198431d98677SRui Paulo 	}
198531d98677SRui Paulo }
198631d98677SRui Paulo 
198731d98677SRui Paulo static void
1988400b4e53SHans Petter Selasky rsu_bulk_tx_callback_sub(struct usb_xfer *xfer, usb_error_t error,
1989400b4e53SHans Petter Selasky     uint8_t which)
199031d98677SRui Paulo {
199131d98677SRui Paulo 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
19927a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
199331d98677SRui Paulo 	struct rsu_data *data;
199431d98677SRui Paulo 
199531d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
199631d98677SRui Paulo 
199731d98677SRui Paulo 	switch (USB_GET_STATE(xfer)) {
199831d98677SRui Paulo 	case USB_ST_TRANSFERRED:
1999400b4e53SHans Petter Selasky 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
200031d98677SRui Paulo 		if (data == NULL)
200131d98677SRui Paulo 			goto tr_setup;
20024914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_TXDONE, "%s: transfer done %p\n",
20034914fa0fSAdrian Chadd 		    __func__, data);
2004400b4e53SHans Petter Selasky 		STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
200531d98677SRui Paulo 		rsu_txeof(xfer, data);
2006de76b5b7SAdrian Chadd 		rsu_freebuf(sc, data);
200731d98677SRui Paulo 		/* FALLTHROUGH */
200831d98677SRui Paulo 	case USB_ST_SETUP:
200931d98677SRui Paulo tr_setup:
2010400b4e53SHans Petter Selasky 		data = STAILQ_FIRST(&sc->sc_tx_pending[which]);
201131d98677SRui Paulo 		if (data == NULL) {
20124914fa0fSAdrian Chadd 			RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
20134914fa0fSAdrian Chadd 			    "%s: empty pending queue sc %p\n", __func__, sc);
201431d98677SRui Paulo 			return;
201531d98677SRui Paulo 		}
2016400b4e53SHans Petter Selasky 		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending[which], next);
2017400b4e53SHans Petter Selasky 		STAILQ_INSERT_TAIL(&sc->sc_tx_active[which], data, next);
201831d98677SRui Paulo 		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
20194914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_TXDONE,
20204914fa0fSAdrian Chadd 		    "%s: submitting transfer %p\n",
20214914fa0fSAdrian Chadd 		    __func__,
20224914fa0fSAdrian Chadd 		    data);
202331d98677SRui Paulo 		usbd_transfer_submit(xfer);
202431d98677SRui Paulo 		break;
202531d98677SRui Paulo 	default:
2026400b4e53SHans Petter Selasky 		data = STAILQ_FIRST(&sc->sc_tx_active[which]);
2027400b4e53SHans Petter Selasky 		if (data != NULL) {
2028400b4e53SHans Petter Selasky 			STAILQ_REMOVE_HEAD(&sc->sc_tx_active[which], next);
2029400b4e53SHans Petter Selasky 			rsu_txeof(xfer, data);
2030de76b5b7SAdrian Chadd 			rsu_freebuf(sc, data);
203131d98677SRui Paulo 		}
20327a79cebfSGleb Smirnoff 		counter_u64_add(ic->ic_oerrors, 1);
2033400b4e53SHans Petter Selasky 
203431d98677SRui Paulo 		if (error != USB_ERR_CANCELLED) {
203531d98677SRui Paulo 			usbd_xfer_set_stall(xfer);
203631d98677SRui Paulo 			goto tr_setup;
203731d98677SRui Paulo 		}
203831d98677SRui Paulo 		break;
203931d98677SRui Paulo 	}
2040*a3767659SAdrian Chadd 
2041*a3767659SAdrian Chadd 	/*
2042*a3767659SAdrian Chadd 	 * XXX TODO: if the queue is low, flush out FF TX frames.
2043*a3767659SAdrian Chadd 	 * Remember to unlock the driver for now; net80211 doesn't
2044*a3767659SAdrian Chadd 	 * defer it for us.
2045*a3767659SAdrian Chadd 	 */
204631d98677SRui Paulo }
204731d98677SRui Paulo 
2048400b4e53SHans Petter Selasky static void
2049910593b5SHans Petter Selasky rsu_bulk_tx_callback_be_bk(struct usb_xfer *xfer, usb_error_t error)
2050400b4e53SHans Petter Selasky {
205177435f18SAdrian Chadd 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
205277435f18SAdrian Chadd 
2053910593b5SHans Petter Selasky 	rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_BE_BK);
205477435f18SAdrian Chadd 
205577435f18SAdrian Chadd 	/* This kicks the TX taskqueue */
205677435f18SAdrian Chadd 	rsu_start(sc);
2057400b4e53SHans Petter Selasky }
2058400b4e53SHans Petter Selasky 
2059400b4e53SHans Petter Selasky static void
2060910593b5SHans Petter Selasky rsu_bulk_tx_callback_vi_vo(struct usb_xfer *xfer, usb_error_t error)
2061400b4e53SHans Petter Selasky {
206277435f18SAdrian Chadd 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
206377435f18SAdrian Chadd 
2064910593b5SHans Petter Selasky 	rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_VI_VO);
206577435f18SAdrian Chadd 
206677435f18SAdrian Chadd 	/* This kicks the TX taskqueue */
206777435f18SAdrian Chadd 	rsu_start(sc);
2068400b4e53SHans Petter Selasky }
2069400b4e53SHans Petter Selasky 
2070bc6a9865SAdrian Chadd static void
2071bc6a9865SAdrian Chadd rsu_bulk_tx_callback_h2c(struct usb_xfer *xfer, usb_error_t error)
2072bc6a9865SAdrian Chadd {
207377435f18SAdrian Chadd 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
207477435f18SAdrian Chadd 
2075bc6a9865SAdrian Chadd 	rsu_bulk_tx_callback_sub(xfer, error, RSU_BULK_TX_H2C);
207677435f18SAdrian Chadd 
207777435f18SAdrian Chadd 	/* This kicks the TX taskqueue */
207877435f18SAdrian Chadd 	rsu_start(sc);
2079bc6a9865SAdrian Chadd }
2080bc6a9865SAdrian Chadd 
208174d7b9a8SAdrian Chadd /*
208274d7b9a8SAdrian Chadd  * Transmit the given frame.
208374d7b9a8SAdrian Chadd  *
208474d7b9a8SAdrian Chadd  * This doesn't free the node or mbuf upon failure.
208574d7b9a8SAdrian Chadd  */
208631d98677SRui Paulo static int
208731d98677SRui Paulo rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
2088400b4e53SHans Petter Selasky     struct mbuf *m0, struct rsu_data *data)
208931d98677SRui Paulo {
20907a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
209131d98677SRui Paulo         struct ieee80211vap *vap = ni->ni_vap;
209231d98677SRui Paulo 	struct ieee80211_frame *wh;
209331d98677SRui Paulo 	struct ieee80211_key *k = NULL;
209431d98677SRui Paulo 	struct r92s_tx_desc *txd;
2095400b4e53SHans Petter Selasky 	uint8_t type;
2096b4d4079cSAdrian Chadd 	int prio = 0;
2097400b4e53SHans Petter Selasky 	uint8_t which;
2098400b4e53SHans Petter Selasky 	int hasqos;
2099400b4e53SHans Petter Selasky 	int xferlen;
2100b4d4079cSAdrian Chadd 	int qid;
210131d98677SRui Paulo 
210231d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
210331d98677SRui Paulo 
210431d98677SRui Paulo 	wh = mtod(m0, struct ieee80211_frame *);
210531d98677SRui Paulo 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
210631d98677SRui Paulo 
21074914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: data=%p, m=%p\n",
21084914fa0fSAdrian Chadd 	    __func__, data, m0);
21094914fa0fSAdrian Chadd 
21105945b5f5SKevin Lo 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
211131d98677SRui Paulo 		k = ieee80211_crypto_encap(ni, m0);
211231d98677SRui Paulo 		if (k == NULL) {
211331d98677SRui Paulo 			device_printf(sc->sc_dev,
211431d98677SRui Paulo 			    "ieee80211_crypto_encap returns NULL.\n");
211531d98677SRui Paulo 			/* XXX we don't expect the fragmented frames */
211631d98677SRui Paulo 			return (ENOBUFS);
211731d98677SRui Paulo 		}
211831d98677SRui Paulo 		wh = mtod(m0, struct ieee80211_frame *);
211931d98677SRui Paulo 	}
2120b4d4079cSAdrian Chadd 	/* If we have QoS then use it */
2121b4d4079cSAdrian Chadd 	/* XXX TODO: mbuf WME/PRI versus TID? */
2122b4d4079cSAdrian Chadd 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
2123b4d4079cSAdrian Chadd 		/* Has QoS */
2124b4d4079cSAdrian Chadd 		prio = M_WME_GETAC(m0);
2125b4d4079cSAdrian Chadd 		which = rsu_wme_ac_xfer_map[prio];
2126b4d4079cSAdrian Chadd 		hasqos = 1;
2127b4d4079cSAdrian Chadd 	} else {
2128b4d4079cSAdrian Chadd 		/* Non-QoS TID */
2129b4d4079cSAdrian Chadd 		/* XXX TODO: tid=0 for non-qos TID? */
2130b4d4079cSAdrian Chadd 		which = rsu_wme_ac_xfer_map[WME_AC_BE];
2131b4d4079cSAdrian Chadd 		hasqos = 0;
2132b4d4079cSAdrian Chadd 		prio = 0;
2133b4d4079cSAdrian Chadd 	}
2134b4d4079cSAdrian Chadd 
2135b4d4079cSAdrian Chadd 	qid = rsu_ac2qid[prio];
2136b4d4079cSAdrian Chadd #if 0
213731d98677SRui Paulo 	switch (type) {
213831d98677SRui Paulo 	case IEEE80211_FC0_TYPE_CTL:
213931d98677SRui Paulo 	case IEEE80211_FC0_TYPE_MGT:
2140910593b5SHans Petter Selasky 		which = rsu_wme_ac_xfer_map[WME_AC_VO];
214131d98677SRui Paulo 		break;
214231d98677SRui Paulo 	default:
2143910593b5SHans Petter Selasky 		which = rsu_wme_ac_xfer_map[M_WME_GETAC(m0)];
214431d98677SRui Paulo 		break;
214531d98677SRui Paulo 	}
214631d98677SRui Paulo 	hasqos = 0;
2147b4d4079cSAdrian Chadd #endif
21484b9d9eeeSAdrian Chadd 
21494b9d9eeeSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_TX, "%s: pri=%d, which=%d, hasqos=%d\n",
21504b9d9eeeSAdrian Chadd 	    __func__,
21514b9d9eeeSAdrian Chadd 	    prio,
21524b9d9eeeSAdrian Chadd 	    which,
21534b9d9eeeSAdrian Chadd 	    hasqos);
21544b9d9eeeSAdrian Chadd 
215531d98677SRui Paulo 	/* Fill Tx descriptor. */
215631d98677SRui Paulo 	txd = (struct r92s_tx_desc *)data->buf;
215731d98677SRui Paulo 	memset(txd, 0, sizeof(*txd));
215831d98677SRui Paulo 
215931d98677SRui Paulo 	txd->txdw0 |= htole32(
216031d98677SRui Paulo 	    SM(R92S_TXDW0_PKTLEN, m0->m_pkthdr.len) |
216131d98677SRui Paulo 	    SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
216231d98677SRui Paulo 	    R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
216331d98677SRui Paulo 
216431d98677SRui Paulo 	txd->txdw1 |= htole32(
2165b4d4079cSAdrian Chadd 	    SM(R92S_TXDW1_MACID, R92S_MACID_BSS) | SM(R92S_TXDW1_QSEL, qid));
216631d98677SRui Paulo 	if (!hasqos)
216731d98677SRui Paulo 		txd->txdw1 |= htole32(R92S_TXDW1_NONQOS);
216831d98677SRui Paulo #ifdef notyet
216931d98677SRui Paulo 	if (k != NULL) {
217031d98677SRui Paulo 		switch (k->wk_cipher->ic_cipher) {
217131d98677SRui Paulo 		case IEEE80211_CIPHER_WEP:
217231d98677SRui Paulo 			cipher = R92S_TXDW1_CIPHER_WEP;
217331d98677SRui Paulo 			break;
217431d98677SRui Paulo 		case IEEE80211_CIPHER_TKIP:
217531d98677SRui Paulo 			cipher = R92S_TXDW1_CIPHER_TKIP;
217631d98677SRui Paulo 			break;
217731d98677SRui Paulo 		case IEEE80211_CIPHER_AES_CCM:
217831d98677SRui Paulo 			cipher = R92S_TXDW1_CIPHER_AES;
217931d98677SRui Paulo 			break;
218031d98677SRui Paulo 		default:
218131d98677SRui Paulo 			cipher = R92S_TXDW1_CIPHER_NONE;
218231d98677SRui Paulo 		}
218331d98677SRui Paulo 		txd->txdw1 |= htole32(
218431d98677SRui Paulo 		    SM(R92S_TXDW1_CIPHER, cipher) |
218531d98677SRui Paulo 		    SM(R92S_TXDW1_KEYIDX, k->k_id));
218631d98677SRui Paulo 	}
218731d98677SRui Paulo #endif
21884b9d9eeeSAdrian Chadd 	/* XXX todo: set AGGEN bit if appropriate? */
218931d98677SRui Paulo 	txd->txdw2 |= htole32(R92S_TXDW2_BK);
219031d98677SRui Paulo 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
219131d98677SRui Paulo 		txd->txdw2 |= htole32(R92S_TXDW2_BMCAST);
219231d98677SRui Paulo 	/*
219331d98677SRui Paulo 	 * Firmware will use and increment the sequence number for the
2194b4d4079cSAdrian Chadd 	 * specified priority.
219531d98677SRui Paulo 	 */
2196b4d4079cSAdrian Chadd 	txd->txdw3 |= htole32(SM(R92S_TXDW3_SEQ, prio));
219731d98677SRui Paulo 
219831d98677SRui Paulo 	if (ieee80211_radiotap_active_vap(vap)) {
219931d98677SRui Paulo 		struct rsu_tx_radiotap_header *tap = &sc->sc_txtap;
220031d98677SRui Paulo 
220131d98677SRui Paulo 		tap->wt_flags = 0;
220231d98677SRui Paulo 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
220331d98677SRui Paulo 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
220431d98677SRui Paulo 		ieee80211_radiotap_tx(vap, m0);
220531d98677SRui Paulo 	}
22064914fa0fSAdrian Chadd 
220731d98677SRui Paulo 	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
220831d98677SRui Paulo 	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
220931d98677SRui Paulo 
221031d98677SRui Paulo 	data->buflen = xferlen;
221131d98677SRui Paulo 	data->ni = ni;
221231d98677SRui Paulo 	data->m = m0;
2213400b4e53SHans Petter Selasky 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
221431d98677SRui Paulo 
2215400b4e53SHans Petter Selasky 	/* start transfer, if any */
2216910593b5SHans Petter Selasky 	usbd_transfer_start(sc->sc_xfer[which]);
221731d98677SRui Paulo 	return (0);
221831d98677SRui Paulo }
221931d98677SRui Paulo 
22207a79cebfSGleb Smirnoff static int
22217a79cebfSGleb Smirnoff rsu_transmit(struct ieee80211com *ic, struct mbuf *m)
222231d98677SRui Paulo {
22237a79cebfSGleb Smirnoff 	struct rsu_softc *sc = ic->ic_softc;
22247a79cebfSGleb Smirnoff 	int error;
222531d98677SRui Paulo 
222631d98677SRui Paulo 	RSU_LOCK(sc);
22277a79cebfSGleb Smirnoff 	if (!sc->sc_running) {
222831d98677SRui Paulo 		RSU_UNLOCK(sc);
22297a79cebfSGleb Smirnoff 		return (ENXIO);
22307a79cebfSGleb Smirnoff 	}
223174d7b9a8SAdrian Chadd 
223274d7b9a8SAdrian Chadd 	/*
223374d7b9a8SAdrian Chadd 	 * XXX TODO: ensure that we treat 'm' as a list of frames
223474d7b9a8SAdrian Chadd 	 * to transmit!
223574d7b9a8SAdrian Chadd 	 */
22367a79cebfSGleb Smirnoff 	error = mbufq_enqueue(&sc->sc_snd, m);
22377a79cebfSGleb Smirnoff 	if (error) {
2238829e0b0bSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_TX,
2239829e0b0bSAdrian Chadd 		    "%s: mbufq_enable: failed (%d)\n",
2240829e0b0bSAdrian Chadd 		    __func__,
2241829e0b0bSAdrian Chadd 		    error);
22427a79cebfSGleb Smirnoff 		RSU_UNLOCK(sc);
22437a79cebfSGleb Smirnoff 		return (error);
22447a79cebfSGleb Smirnoff 	}
22457a79cebfSGleb Smirnoff 	RSU_UNLOCK(sc);
22467a79cebfSGleb Smirnoff 
224777435f18SAdrian Chadd 	/* This kicks the TX taskqueue */
224877435f18SAdrian Chadd 	rsu_start(sc);
224977435f18SAdrian Chadd 
22507a79cebfSGleb Smirnoff 	return (0);
225131d98677SRui Paulo }
225231d98677SRui Paulo 
225331d98677SRui Paulo static void
2254829e0b0bSAdrian Chadd rsu_drain_mbufq(struct rsu_softc *sc)
2255829e0b0bSAdrian Chadd {
2256829e0b0bSAdrian Chadd 	struct mbuf *m;
2257829e0b0bSAdrian Chadd 	struct ieee80211_node *ni;
2258829e0b0bSAdrian Chadd 
2259829e0b0bSAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
2260829e0b0bSAdrian Chadd 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2261829e0b0bSAdrian Chadd 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2262829e0b0bSAdrian Chadd 		m->m_pkthdr.rcvif = NULL;
2263829e0b0bSAdrian Chadd 		ieee80211_free_node(ni);
2264829e0b0bSAdrian Chadd 		m_freem(m);
2265829e0b0bSAdrian Chadd 	}
2266829e0b0bSAdrian Chadd }
2267829e0b0bSAdrian Chadd 
2268829e0b0bSAdrian Chadd static void
226977435f18SAdrian Chadd _rsu_start(struct rsu_softc *sc)
227031d98677SRui Paulo {
227131d98677SRui Paulo 	struct ieee80211_node *ni;
227231d98677SRui Paulo 	struct rsu_data *bf;
2273400b4e53SHans Petter Selasky 	struct mbuf *m;
227431d98677SRui Paulo 
227531d98677SRui Paulo 	RSU_ASSERT_LOCKED(sc);
227631d98677SRui Paulo 
22777a79cebfSGleb Smirnoff 	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
22787a79cebfSGleb Smirnoff 		bf = rsu_getbuf(sc);
22797a79cebfSGleb Smirnoff 		if (bf == NULL) {
2280829e0b0bSAdrian Chadd 			RSU_DPRINTF(sc, RSU_DEBUG_TX,
2281829e0b0bSAdrian Chadd 			    "%s: failed to get buffer\n", __func__);
22827a79cebfSGleb Smirnoff 			mbufq_prepend(&sc->sc_snd, m);
228331d98677SRui Paulo 			break;
22847a79cebfSGleb Smirnoff 		}
22857a79cebfSGleb Smirnoff 
228631d98677SRui Paulo 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
228731d98677SRui Paulo 		m->m_pkthdr.rcvif = NULL;
228831d98677SRui Paulo 
22897a79cebfSGleb Smirnoff 		if (rsu_tx_start(sc, ni, m, bf) != 0) {
2290829e0b0bSAdrian Chadd 			RSU_DPRINTF(sc, RSU_DEBUG_TX,
2291829e0b0bSAdrian Chadd 			    "%s: failed to transmit\n", __func__);
22927a79cebfSGleb Smirnoff 			if_inc_counter(ni->ni_vap->iv_ifp,
22937a79cebfSGleb Smirnoff 			    IFCOUNTER_OERRORS, 1);
2294de76b5b7SAdrian Chadd 			rsu_freebuf(sc, bf);
229531d98677SRui Paulo 			ieee80211_free_node(ni);
229674d7b9a8SAdrian Chadd 			m_freem(m);
22977a79cebfSGleb Smirnoff 			break;
229831d98677SRui Paulo 		}
229931d98677SRui Paulo 	}
230031d98677SRui Paulo }
230131d98677SRui Paulo 
23027a79cebfSGleb Smirnoff static void
230377435f18SAdrian Chadd rsu_start(struct rsu_softc *sc)
230477435f18SAdrian Chadd {
230577435f18SAdrian Chadd 
230677435f18SAdrian Chadd 	taskqueue_enqueue(taskqueue_thread, &sc->tx_task);
230777435f18SAdrian Chadd }
230877435f18SAdrian Chadd 
230977435f18SAdrian Chadd static void
23107a79cebfSGleb Smirnoff rsu_parent(struct ieee80211com *ic)
231131d98677SRui Paulo {
2312d3fdd08cSAdrian Chadd 	struct rsu_softc *sc = ic->ic_softc;
23137a79cebfSGleb Smirnoff 	int startall = 0;
231431d98677SRui Paulo 
23157a79cebfSGleb Smirnoff 	RSU_LOCK(sc);
23167a79cebfSGleb Smirnoff 	if (ic->ic_nrunning > 0) {
23177a79cebfSGleb Smirnoff 		if (!sc->sc_running) {
2318d3fdd08cSAdrian Chadd 			rsu_init(sc);
231931d98677SRui Paulo 			startall = 1;
232031d98677SRui Paulo 		}
23217a79cebfSGleb Smirnoff 	} else if (sc->sc_running)
23227a79cebfSGleb Smirnoff 		rsu_stop(sc);
23237a79cebfSGleb Smirnoff 	RSU_UNLOCK(sc);
23247a79cebfSGleb Smirnoff 
232531d98677SRui Paulo 	if (startall)
232631d98677SRui Paulo 		ieee80211_start_all(ic);
232731d98677SRui Paulo }
232831d98677SRui Paulo 
232931d98677SRui Paulo /*
233031d98677SRui Paulo  * Power on sequence for A-cut adapters.
233131d98677SRui Paulo  */
233231d98677SRui Paulo static void
233331d98677SRui Paulo rsu_power_on_acut(struct rsu_softc *sc)
233431d98677SRui Paulo {
233531d98677SRui Paulo 	uint32_t reg;
233631d98677SRui Paulo 
233731d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
233831d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
233931d98677SRui Paulo 
234031d98677SRui Paulo 	/* Enable AFE macro block's bandgap and Mbias. */
234131d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_MISC,
234231d98677SRui Paulo 	    rsu_read_1(sc, R92S_AFE_MISC) |
234331d98677SRui Paulo 	    R92S_AFE_MISC_BGEN | R92S_AFE_MISC_MBEN);
234431d98677SRui Paulo 	/* Enable LDOA15 block. */
234531d98677SRui Paulo 	rsu_write_1(sc, R92S_LDOA15_CTRL,
234631d98677SRui Paulo 	    rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
234731d98677SRui Paulo 
234831d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS1_CTRL,
234931d98677SRui Paulo 	    rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_LDEN);
235017ebf553SAdrian Chadd 	rsu_ms_delay(sc, 2000);
235131d98677SRui Paulo 	/* Enable switch regulator block. */
235231d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS1_CTRL,
235331d98677SRui Paulo 	    rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_SWEN);
235431d98677SRui Paulo 
235531d98677SRui Paulo 	rsu_write_4(sc, R92S_SPS1_CTRL, 0x00a7b267);
235631d98677SRui Paulo 
235731d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
235831d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
235931d98677SRui Paulo 
236031d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
236131d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
236231d98677SRui Paulo 
236331d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
236431d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x90);
236531d98677SRui Paulo 
236631d98677SRui Paulo 	/* Enable AFE clock. */
236731d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
236831d98677SRui Paulo 	    rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
236931d98677SRui Paulo 	/* Enable AFE PLL macro block. */
237031d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_PLL_CTRL,
237131d98677SRui Paulo 	    rsu_read_1(sc, R92S_AFE_PLL_CTRL) | 0x11);
237231d98677SRui Paulo 	/* Attach AFE PLL to MACTOP/BB. */
237331d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL,
237431d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
237531d98677SRui Paulo 
237631d98677SRui Paulo 	/* Switch to 40MHz clock instead of 80MHz. */
237731d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_CLKR,
237831d98677SRui Paulo 	    rsu_read_2(sc, R92S_SYS_CLKR) & ~R92S_SYS_CLKSEL);
237931d98677SRui Paulo 
238031d98677SRui Paulo 	/* Enable MAC clock. */
238131d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_CLKR,
238231d98677SRui Paulo 	    rsu_read_2(sc, R92S_SYS_CLKR) |
238331d98677SRui Paulo 	    R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
238431d98677SRui Paulo 
238531d98677SRui Paulo 	rsu_write_1(sc, R92S_PMC_FSM, 0x02);
238631d98677SRui Paulo 
238731d98677SRui Paulo 	/* Enable digital core and IOREG R/W. */
238831d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
238931d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
239031d98677SRui Paulo 
239131d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
239231d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
239331d98677SRui Paulo 
239431d98677SRui Paulo 	/* Switch the control path to firmware. */
239531d98677SRui Paulo 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
239631d98677SRui Paulo 	reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
239731d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_CLKR, reg);
239831d98677SRui Paulo 
239931d98677SRui Paulo 	rsu_write_2(sc, R92S_CR, 0x37fc);
240031d98677SRui Paulo 
240131d98677SRui Paulo 	/* Fix USB RX FIFO issue. */
240231d98677SRui Paulo 	rsu_write_1(sc, 0xfe5c,
240331d98677SRui Paulo 	    rsu_read_1(sc, 0xfe5c) | 0x80);
240431d98677SRui Paulo 	rsu_write_1(sc, 0x00ab,
240531d98677SRui Paulo 	    rsu_read_1(sc, 0x00ab) | 0xc0);
240631d98677SRui Paulo 
240731d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR,
240831d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
240931d98677SRui Paulo }
241031d98677SRui Paulo 
241131d98677SRui Paulo /*
241231d98677SRui Paulo  * Power on sequence for B-cut and C-cut adapters.
241331d98677SRui Paulo  */
241431d98677SRui Paulo static void
241531d98677SRui Paulo rsu_power_on_bcut(struct rsu_softc *sc)
241631d98677SRui Paulo {
241731d98677SRui Paulo 	uint32_t reg;
241831d98677SRui Paulo 	int ntries;
241931d98677SRui Paulo 
242031d98677SRui Paulo 	/* Prevent eFuse leakage. */
242131d98677SRui Paulo 	rsu_write_1(sc, 0x37, 0xb0);
242217ebf553SAdrian Chadd 	rsu_ms_delay(sc, 10);
242331d98677SRui Paulo 	rsu_write_1(sc, 0x37, 0x30);
242431d98677SRui Paulo 
242531d98677SRui Paulo 	/* Switch the control path to hardware. */
242631d98677SRui Paulo 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
242731d98677SRui Paulo 	if (reg & R92S_FWHW_SEL) {
242831d98677SRui Paulo 		rsu_write_2(sc, R92S_SYS_CLKR,
242931d98677SRui Paulo 		    reg & ~(R92S_SWHW_SEL | R92S_FWHW_SEL));
243031d98677SRui Paulo 	}
243131d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
243231d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) & ~0x8c);
243317ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
243431d98677SRui Paulo 
243531d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
243631d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
243731d98677SRui Paulo 
243831d98677SRui Paulo 	reg = rsu_read_1(sc, R92S_AFE_MISC);
243931d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN);
244031d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN |
244131d98677SRui Paulo 	    R92S_AFE_MISC_MBEN | R92S_AFE_MISC_I32_EN);
244231d98677SRui Paulo 
244331d98677SRui Paulo 	/* Enable PLL. */
244431d98677SRui Paulo 	rsu_write_1(sc, R92S_LDOA15_CTRL,
244531d98677SRui Paulo 	    rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
244631d98677SRui Paulo 
244731d98677SRui Paulo 	rsu_write_1(sc, R92S_LDOV12D_CTRL,
244831d98677SRui Paulo 	    rsu_read_1(sc, R92S_LDOV12D_CTRL) | R92S_LDV12_EN);
244931d98677SRui Paulo 
245031d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
245131d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
245231d98677SRui Paulo 
245331d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
245431d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
245531d98677SRui Paulo 
245631d98677SRui Paulo 	/* Support 64KB IMEM. */
245731d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
245831d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x97);
245931d98677SRui Paulo 
246031d98677SRui Paulo 	/* Enable AFE clock. */
246131d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
246231d98677SRui Paulo 	    rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
246331d98677SRui Paulo 	/* Enable AFE PLL macro block. */
246431d98677SRui Paulo 	reg = rsu_read_1(sc, R92S_AFE_PLL_CTRL);
246531d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
246617ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
246731d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x51);
246817ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
246931d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
247017ebf553SAdrian Chadd 	rsu_ms_delay(sc, 1);
247131d98677SRui Paulo 
247231d98677SRui Paulo 	/* Attach AFE PLL to MACTOP/BB. */
247331d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL,
247431d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
247531d98677SRui Paulo 
247631d98677SRui Paulo 	/* Switch to 40MHz clock. */
247731d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR, 0x00);
247831d98677SRui Paulo 	/* Disable CPU clock and 80MHz SSC. */
247931d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR,
248031d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_CLKR) | 0xa0);
248131d98677SRui Paulo 	/* Enable MAC clock. */
248231d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_CLKR,
248331d98677SRui Paulo 	    rsu_read_2(sc, R92S_SYS_CLKR) |
248431d98677SRui Paulo 	    R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
248531d98677SRui Paulo 
248631d98677SRui Paulo 	rsu_write_1(sc, R92S_PMC_FSM, 0x02);
248731d98677SRui Paulo 
248831d98677SRui Paulo 	/* Enable digital core and IOREG R/W. */
248931d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
249031d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
249131d98677SRui Paulo 
249231d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
249331d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
249431d98677SRui Paulo 
249531d98677SRui Paulo 	/* Switch the control path to firmware. */
249631d98677SRui Paulo 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
249731d98677SRui Paulo 	reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
249831d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_CLKR, reg);
249931d98677SRui Paulo 
250031d98677SRui Paulo 	rsu_write_2(sc, R92S_CR, 0x37fc);
250131d98677SRui Paulo 
250231d98677SRui Paulo 	/* Fix USB RX FIFO issue. */
250331d98677SRui Paulo 	rsu_write_1(sc, 0xfe5c,
250431d98677SRui Paulo 	    rsu_read_1(sc, 0xfe5c) | 0x80);
250531d98677SRui Paulo 
250631d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR,
250731d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
250831d98677SRui Paulo 
250931d98677SRui Paulo 	rsu_write_1(sc, 0xfe1c, 0x80);
251031d98677SRui Paulo 
251131d98677SRui Paulo 	/* Make sure TxDMA is ready to download firmware. */
251231d98677SRui Paulo 	for (ntries = 0; ntries < 20; ntries++) {
251331d98677SRui Paulo 		reg = rsu_read_1(sc, R92S_TCR);
251431d98677SRui Paulo 		if ((reg & (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT)) ==
251531d98677SRui Paulo 		    (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT))
251631d98677SRui Paulo 			break;
251717ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
251831d98677SRui Paulo 	}
251931d98677SRui Paulo 	if (ntries == 20) {
25204914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_RESET | RSU_DEBUG_TX,
25214914fa0fSAdrian Chadd 		    "%s: TxDMA is not ready\n",
25224914fa0fSAdrian Chadd 		    __func__);
252331d98677SRui Paulo 		/* Reset TxDMA. */
252431d98677SRui Paulo 		reg = rsu_read_1(sc, R92S_CR);
252531d98677SRui Paulo 		rsu_write_1(sc, R92S_CR, reg & ~R92S_CR_TXDMA_EN);
252617ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
252731d98677SRui Paulo 		rsu_write_1(sc, R92S_CR, reg | R92S_CR_TXDMA_EN);
252831d98677SRui Paulo 	}
252931d98677SRui Paulo }
253031d98677SRui Paulo 
253131d98677SRui Paulo static void
253231d98677SRui Paulo rsu_power_off(struct rsu_softc *sc)
253331d98677SRui Paulo {
253431d98677SRui Paulo 	/* Turn RF off. */
253531d98677SRui Paulo 	rsu_write_1(sc, R92S_RF_CTRL, 0x00);
253617ebf553SAdrian Chadd 	rsu_ms_delay(sc, 5);
253731d98677SRui Paulo 
253831d98677SRui Paulo 	/* Turn MAC off. */
253931d98677SRui Paulo 	/* Switch control path. */
254031d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR + 1, 0x38);
254131d98677SRui Paulo 	/* Reset MACTOP. */
254231d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x70);
254331d98677SRui Paulo 	rsu_write_1(sc, R92S_PMC_FSM, 0x06);
254431d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 0, 0xf9);
254531d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1, 0xe8);
254631d98677SRui Paulo 
254731d98677SRui Paulo 	/* Disable AFE PLL. */
254831d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, 0x00);
254931d98677SRui Paulo 	/* Disable A15V. */
255031d98677SRui Paulo 	rsu_write_1(sc, R92S_LDOA15_CTRL, 0x54);
255131d98677SRui Paulo 	/* Disable eFuse 1.2V. */
255231d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x50);
255331d98677SRui Paulo 	rsu_write_1(sc, R92S_LDOV12D_CTRL, 0x24);
255431d98677SRui Paulo 	/* Enable AFE macro block's bandgap and Mbias. */
255531d98677SRui Paulo 	rsu_write_1(sc, R92S_AFE_MISC, 0x30);
255631d98677SRui Paulo 	/* Disable 1.6V LDO. */
255731d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x56);
255831d98677SRui Paulo 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x43);
255944369387SAdrian Chadd 
256044369387SAdrian Chadd 	/* Firmware - tell it to switch things off */
256144369387SAdrian Chadd 	(void) rsu_set_fw_power_state(sc, RSU_PWR_OFF);
256231d98677SRui Paulo }
256331d98677SRui Paulo 
256431d98677SRui Paulo static int
25656d9b2f85SRui Paulo rsu_fw_loadsection(struct rsu_softc *sc, const uint8_t *buf, int len)
256631d98677SRui Paulo {
2567910593b5SHans Petter Selasky 	const uint8_t which = rsu_wme_ac_xfer_map[WME_AC_VO];
256831d98677SRui Paulo 	struct rsu_data *data;
256931d98677SRui Paulo 	struct r92s_tx_desc *txd;
257031d98677SRui Paulo 	int mlen;
257131d98677SRui Paulo 
257231d98677SRui Paulo 	while (len > 0) {
257331d98677SRui Paulo 		data = rsu_getbuf(sc);
257431d98677SRui Paulo 		if (data == NULL)
257531d98677SRui Paulo 			return (ENOMEM);
257631d98677SRui Paulo 		txd = (struct r92s_tx_desc *)data->buf;
257731d98677SRui Paulo 		memset(txd, 0, sizeof(*txd));
257831d98677SRui Paulo 		if (len <= RSU_TXBUFSZ - sizeof(*txd)) {
257931d98677SRui Paulo 			/* Last chunk. */
258031d98677SRui Paulo 			txd->txdw0 |= htole32(R92S_TXDW0_LINIP);
258131d98677SRui Paulo 			mlen = len;
258231d98677SRui Paulo 		} else
258331d98677SRui Paulo 			mlen = RSU_TXBUFSZ - sizeof(*txd);
258431d98677SRui Paulo 		txd->txdw0 |= htole32(SM(R92S_TXDW0_PKTLEN, mlen));
258531d98677SRui Paulo 		memcpy(&txd[1], buf, mlen);
258631d98677SRui Paulo 		data->buflen = sizeof(*txd) + mlen;
25874914fa0fSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_TX | RSU_DEBUG_FW | RSU_DEBUG_RESET,
25884914fa0fSAdrian Chadd 		    "%s: starting transfer %p\n",
25894914fa0fSAdrian Chadd 		    __func__, data);
2590400b4e53SHans Petter Selasky 		STAILQ_INSERT_TAIL(&sc->sc_tx_pending[which], data, next);
259131d98677SRui Paulo 		buf += mlen;
259231d98677SRui Paulo 		len -= mlen;
259331d98677SRui Paulo 	}
2594910593b5SHans Petter Selasky 	usbd_transfer_start(sc->sc_xfer[which]);
259531d98677SRui Paulo 	return (0);
259631d98677SRui Paulo }
259731d98677SRui Paulo 
259831d98677SRui Paulo static int
259931d98677SRui Paulo rsu_load_firmware(struct rsu_softc *sc)
260031d98677SRui Paulo {
26016d9b2f85SRui Paulo 	const struct r92s_fw_hdr *hdr;
260231d98677SRui Paulo 	struct r92s_fw_priv *dmem;
26034b9d9eeeSAdrian Chadd 	struct ieee80211com *ic = &sc->sc_ic;
26046d9b2f85SRui Paulo 	const uint8_t *imem, *emem;
260531d98677SRui Paulo 	int imemsz, ememsz;
260631d98677SRui Paulo 	const struct firmware *fw;
260731d98677SRui Paulo 	size_t size;
260831d98677SRui Paulo 	uint32_t reg;
260931d98677SRui Paulo 	int ntries, error;
261031d98677SRui Paulo 
2611910593b5SHans Petter Selasky 	if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY) {
26126acf853dSAdrian Chadd 		RSU_DPRINTF(sc, RSU_DEBUG_ANY,
26134914fa0fSAdrian Chadd 		    "%s: Firmware already loaded\n",
26144914fa0fSAdrian Chadd 		    __func__);
2615910593b5SHans Petter Selasky 		return (0);
2616910593b5SHans Petter Selasky 	}
2617910593b5SHans Petter Selasky 
261831d98677SRui Paulo 	RSU_UNLOCK(sc);
261931d98677SRui Paulo 	/* Read firmware image from the filesystem. */
262031d98677SRui Paulo 	if ((fw = firmware_get("rsu-rtl8712fw")) == NULL) {
262131d98677SRui Paulo 		device_printf(sc->sc_dev,
262231d98677SRui Paulo 		    "%s: failed load firmware of file rsu-rtl8712fw\n",
262331d98677SRui Paulo 		    __func__);
262431d98677SRui Paulo 		RSU_LOCK(sc);
262531d98677SRui Paulo 		return (ENXIO);
262631d98677SRui Paulo 	}
262731d98677SRui Paulo 	RSU_LOCK(sc);
262831d98677SRui Paulo 	size = fw->datasize;
262931d98677SRui Paulo 	if (size < sizeof(*hdr)) {
263031d98677SRui Paulo 		device_printf(sc->sc_dev, "firmware too short\n");
263131d98677SRui Paulo 		error = EINVAL;
263231d98677SRui Paulo 		goto fail;
263331d98677SRui Paulo 	}
26346d9b2f85SRui Paulo 	hdr = (const struct r92s_fw_hdr *)fw->data;
263531d98677SRui Paulo 	if (hdr->signature != htole16(0x8712) &&
263631d98677SRui Paulo 	    hdr->signature != htole16(0x8192)) {
263731d98677SRui Paulo 		device_printf(sc->sc_dev,
263831d98677SRui Paulo 		    "invalid firmware signature 0x%x\n",
263931d98677SRui Paulo 		    le16toh(hdr->signature));
264031d98677SRui Paulo 		error = EINVAL;
264131d98677SRui Paulo 		goto fail;
264231d98677SRui Paulo 	}
264331d98677SRui Paulo 	DPRINTF("FW V%d %02x-%02x %02x:%02x\n", le16toh(hdr->version),
264431d98677SRui Paulo 	    hdr->month, hdr->day, hdr->hour, hdr->minute);
264531d98677SRui Paulo 
264631d98677SRui Paulo 	/* Make sure that driver and firmware are in sync. */
264731d98677SRui Paulo 	if (hdr->privsz != htole32(sizeof(*dmem))) {
264831d98677SRui Paulo 		device_printf(sc->sc_dev, "unsupported firmware image\n");
264931d98677SRui Paulo 		error = EINVAL;
265031d98677SRui Paulo 		goto fail;
265131d98677SRui Paulo 	}
265231d98677SRui Paulo 	/* Get FW sections sizes. */
265331d98677SRui Paulo 	imemsz = le32toh(hdr->imemsz);
265431d98677SRui Paulo 	ememsz = le32toh(hdr->sramsz);
265531d98677SRui Paulo 	/* Check that all FW sections fit in image. */
265631d98677SRui Paulo 	if (size < sizeof(*hdr) + imemsz + ememsz) {
265731d98677SRui Paulo 		device_printf(sc->sc_dev, "firmware too short\n");
265831d98677SRui Paulo 		error = EINVAL;
265931d98677SRui Paulo 		goto fail;
266031d98677SRui Paulo 	}
26616d9b2f85SRui Paulo 	imem = (const uint8_t *)&hdr[1];
266231d98677SRui Paulo 	emem = imem + imemsz;
266331d98677SRui Paulo 
266431d98677SRui Paulo 	/* Load IMEM section. */
266531d98677SRui Paulo 	error = rsu_fw_loadsection(sc, imem, imemsz);
266631d98677SRui Paulo 	if (error != 0) {
266731d98677SRui Paulo 		device_printf(sc->sc_dev,
266831d98677SRui Paulo 		    "could not load firmware section %s\n", "IMEM");
266931d98677SRui Paulo 		goto fail;
267031d98677SRui Paulo 	}
267131d98677SRui Paulo 	/* Wait for load to complete. */
2672885476cbSHans Petter Selasky 	for (ntries = 0; ntries != 50; ntries++) {
267317ebf553SAdrian Chadd 		rsu_ms_delay(sc, 10);
2674910593b5SHans Petter Selasky 		reg = rsu_read_1(sc, R92S_TCR);
267531d98677SRui Paulo 		if (reg & R92S_TCR_IMEM_CODE_DONE)
267631d98677SRui Paulo 			break;
267731d98677SRui Paulo 	}
2678885476cbSHans Petter Selasky 	if (ntries == 50) {
2679885476cbSHans Petter Selasky 		device_printf(sc->sc_dev, "timeout waiting for IMEM transfer\n");
268031d98677SRui Paulo 		error = ETIMEDOUT;
268131d98677SRui Paulo 		goto fail;
268231d98677SRui Paulo 	}
268331d98677SRui Paulo 	/* Load EMEM section. */
268431d98677SRui Paulo 	error = rsu_fw_loadsection(sc, emem, ememsz);
268531d98677SRui Paulo 	if (error != 0) {
268631d98677SRui Paulo 		device_printf(sc->sc_dev,
268731d98677SRui Paulo 		    "could not load firmware section %s\n", "EMEM");
268831d98677SRui Paulo 		goto fail;
268931d98677SRui Paulo 	}
269031d98677SRui Paulo 	/* Wait for load to complete. */
26911593e875SHans Petter Selasky 	for (ntries = 0; ntries != 50; ntries++) {
269217ebf553SAdrian Chadd 		rsu_ms_delay(sc, 10);
269331d98677SRui Paulo 		reg = rsu_read_2(sc, R92S_TCR);
269431d98677SRui Paulo 		if (reg & R92S_TCR_EMEM_CODE_DONE)
269531d98677SRui Paulo 			break;
269631d98677SRui Paulo 	}
26971593e875SHans Petter Selasky 	if (ntries == 50) {
2698885476cbSHans Petter Selasky 		device_printf(sc->sc_dev, "timeout waiting for EMEM transfer\n");
269931d98677SRui Paulo 		error = ETIMEDOUT;
270031d98677SRui Paulo 		goto fail;
270131d98677SRui Paulo 	}
270231d98677SRui Paulo 	/* Enable CPU. */
270331d98677SRui Paulo 	rsu_write_1(sc, R92S_SYS_CLKR,
270431d98677SRui Paulo 	    rsu_read_1(sc, R92S_SYS_CLKR) | R92S_SYS_CPU_CLKSEL);
270531d98677SRui Paulo 	if (!(rsu_read_1(sc, R92S_SYS_CLKR) & R92S_SYS_CPU_CLKSEL)) {
270631d98677SRui Paulo 		device_printf(sc->sc_dev, "could not enable system clock\n");
270731d98677SRui Paulo 		error = EIO;
270831d98677SRui Paulo 		goto fail;
270931d98677SRui Paulo 	}
271031d98677SRui Paulo 	rsu_write_2(sc, R92S_SYS_FUNC_EN,
271131d98677SRui Paulo 	    rsu_read_2(sc, R92S_SYS_FUNC_EN) | R92S_FEN_CPUEN);
271231d98677SRui Paulo 	if (!(rsu_read_2(sc, R92S_SYS_FUNC_EN) & R92S_FEN_CPUEN)) {
271331d98677SRui Paulo 		device_printf(sc->sc_dev,
271431d98677SRui Paulo 		    "could not enable microcontroller\n");
271531d98677SRui Paulo 		error = EIO;
271631d98677SRui Paulo 		goto fail;
271731d98677SRui Paulo 	}
271831d98677SRui Paulo 	/* Wait for CPU to initialize. */
271931d98677SRui Paulo 	for (ntries = 0; ntries < 100; ntries++) {
2720910593b5SHans Petter Selasky 		if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_IMEM_RDY)
272131d98677SRui Paulo 			break;
272217ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
272331d98677SRui Paulo 	}
272431d98677SRui Paulo 	if (ntries == 100) {
272531d98677SRui Paulo 		device_printf(sc->sc_dev,
272631d98677SRui Paulo 		    "timeout waiting for microcontroller\n");
272731d98677SRui Paulo 		error = ETIMEDOUT;
272831d98677SRui Paulo 		goto fail;
272931d98677SRui Paulo 	}
273031d98677SRui Paulo 
273131d98677SRui Paulo 	/* Update DMEM section before loading. */
27326d9b2f85SRui Paulo 	dmem = __DECONST(struct r92s_fw_priv *, &hdr->priv);
273331d98677SRui Paulo 	memset(dmem, 0, sizeof(*dmem));
273431d98677SRui Paulo 	dmem->hci_sel = R92S_HCI_SEL_USB | R92S_HCI_SEL_8172;
2735b8303685SAdrian Chadd 	dmem->nendpoints = sc->sc_nendpoints;
27366acf853dSAdrian Chadd 	dmem->chip_version = sc->cut;
273785dafc69SAdrian Chadd 	dmem->rf_config = sc->sc_rftype;
273831d98677SRui Paulo 	dmem->vcs_type = R92S_VCS_TYPE_AUTO;
273931d98677SRui Paulo 	dmem->vcs_mode = R92S_VCS_MODE_RTS_CTS;
2740b8303685SAdrian Chadd 	dmem->turbo_mode = 0;
27414b9d9eeeSAdrian Chadd 	dmem->bw40_en = !! (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40);
27424b9d9eeeSAdrian Chadd 	dmem->amsdu2ampdu_en = !! (sc->sc_ht);
27434b9d9eeeSAdrian Chadd 	dmem->ampdu_en = !! (sc->sc_ht);
27444b9d9eeeSAdrian Chadd 	dmem->agg_offload = !! (sc->sc_ht);
2745a851c667SAdrian Chadd 	dmem->qos_en = 1;
27466acf853dSAdrian Chadd 	dmem->ps_offload = 1;
27476acf853dSAdrian Chadd 	dmem->lowpower_mode = 1;	/* XXX TODO: configurable? */
274831d98677SRui Paulo 	/* Load DMEM section. */
274931d98677SRui Paulo 	error = rsu_fw_loadsection(sc, (uint8_t *)dmem, sizeof(*dmem));
275031d98677SRui Paulo 	if (error != 0) {
275131d98677SRui Paulo 		device_printf(sc->sc_dev,
275231d98677SRui Paulo 		    "could not load firmware section %s\n", "DMEM");
275331d98677SRui Paulo 		goto fail;
275431d98677SRui Paulo 	}
275531d98677SRui Paulo 	/* Wait for load to complete. */
275631d98677SRui Paulo 	for (ntries = 0; ntries < 100; ntries++) {
2757910593b5SHans Petter Selasky 		if (rsu_read_1(sc, R92S_TCR) & R92S_TCR_DMEM_CODE_DONE)
275831d98677SRui Paulo 			break;
275917ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
276031d98677SRui Paulo 	}
276131d98677SRui Paulo 	if (ntries == 100) {
276231d98677SRui Paulo 		device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
276331d98677SRui Paulo 		    "DMEM");
276431d98677SRui Paulo 		error = ETIMEDOUT;
276531d98677SRui Paulo 		goto fail;
276631d98677SRui Paulo 	}
276731d98677SRui Paulo 	/* Wait for firmware readiness. */
276831d98677SRui Paulo 	for (ntries = 0; ntries < 60; ntries++) {
2769910593b5SHans Petter Selasky 		if (!(rsu_read_1(sc, R92S_TCR) & R92S_TCR_FWRDY))
277031d98677SRui Paulo 			break;
277117ebf553SAdrian Chadd 		rsu_ms_delay(sc, 1);
277231d98677SRui Paulo 	}
277331d98677SRui Paulo 	if (ntries == 60) {
277431d98677SRui Paulo 		device_printf(sc->sc_dev,
277531d98677SRui Paulo 		    "timeout waiting for firmware readiness\n");
277631d98677SRui Paulo 		error = ETIMEDOUT;
277731d98677SRui Paulo 		goto fail;
277831d98677SRui Paulo 	}
277931d98677SRui Paulo  fail:
278031d98677SRui Paulo 	firmware_put(fw, FIRMWARE_UNLOAD);
278131d98677SRui Paulo 	return (error);
278231d98677SRui Paulo }
278331d98677SRui Paulo 
278431d98677SRui Paulo 
278531d98677SRui Paulo static int
278631d98677SRui Paulo rsu_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
278731d98677SRui Paulo     const struct ieee80211_bpf_params *params)
278831d98677SRui Paulo {
278931d98677SRui Paulo 	struct ieee80211com *ic = ni->ni_ic;
2790d3fdd08cSAdrian Chadd 	struct rsu_softc *sc = ic->ic_softc;
279131d98677SRui Paulo 	struct rsu_data *bf;
279231d98677SRui Paulo 
279331d98677SRui Paulo 	/* prevent management frames from being sent if we're not ready */
27947a79cebfSGleb Smirnoff 	if (!sc->sc_running) {
279531d98677SRui Paulo 		m_freem(m);
279631d98677SRui Paulo 		ieee80211_free_node(ni);
279731d98677SRui Paulo 		return (ENETDOWN);
279831d98677SRui Paulo 	}
279931d98677SRui Paulo 	RSU_LOCK(sc);
280031d98677SRui Paulo 	bf = rsu_getbuf(sc);
280131d98677SRui Paulo 	if (bf == NULL) {
280231d98677SRui Paulo 		ieee80211_free_node(ni);
280331d98677SRui Paulo 		m_freem(m);
280431d98677SRui Paulo 		RSU_UNLOCK(sc);
280531d98677SRui Paulo 		return (ENOBUFS);
280631d98677SRui Paulo 	}
2807400b4e53SHans Petter Selasky 	if (rsu_tx_start(sc, ni, m, bf) != 0) {
280831d98677SRui Paulo 		ieee80211_free_node(ni);
280974d7b9a8SAdrian Chadd 		m_freem(m);
2810de76b5b7SAdrian Chadd 		rsu_freebuf(sc, bf);
281131d98677SRui Paulo 		RSU_UNLOCK(sc);
281231d98677SRui Paulo 		return (EIO);
281331d98677SRui Paulo 	}
281431d98677SRui Paulo 	RSU_UNLOCK(sc);
281531d98677SRui Paulo 
281631d98677SRui Paulo 	return (0);
281731d98677SRui Paulo }
281831d98677SRui Paulo 
281931d98677SRui Paulo static void
28207a79cebfSGleb Smirnoff rsu_init(struct rsu_softc *sc)
282131d98677SRui Paulo {
28227a79cebfSGleb Smirnoff 	struct ieee80211com *ic = &sc->sc_ic;
28237a79cebfSGleb Smirnoff 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
28247a79cebfSGleb Smirnoff 	uint8_t macaddr[IEEE80211_ADDR_LEN];
282531d98677SRui Paulo 	int error;
2826885476cbSHans Petter Selasky 	int i;
282731d98677SRui Paulo 
28287a79cebfSGleb Smirnoff 	RSU_ASSERT_LOCKED(sc);
28297a79cebfSGleb Smirnoff 
2830829e0b0bSAdrian Chadd 	/* Ensure the mbuf queue is drained */
2831829e0b0bSAdrian Chadd 	rsu_drain_mbufq(sc);
2832829e0b0bSAdrian Chadd 
283331d98677SRui Paulo 	/* Init host async commands ring. */
283431d98677SRui Paulo 	sc->cmdq.cur = sc->cmdq.next = sc->cmdq.queued = 0;
283531d98677SRui Paulo 
28366acf853dSAdrian Chadd 	/* Reset power management state. */
28376acf853dSAdrian Chadd 	rsu_write_1(sc, R92S_USB_HRPWM, 0);
28386acf853dSAdrian Chadd 
283931d98677SRui Paulo 	/* Power on adapter. */
284031d98677SRui Paulo 	if (sc->cut == 1)
284131d98677SRui Paulo 		rsu_power_on_acut(sc);
284231d98677SRui Paulo 	else
284331d98677SRui Paulo 		rsu_power_on_bcut(sc);
2844910593b5SHans Petter Selasky 
284531d98677SRui Paulo 	/* Load firmware. */
284631d98677SRui Paulo 	error = rsu_load_firmware(sc);
284731d98677SRui Paulo 	if (error != 0)
284831d98677SRui Paulo 		goto fail;
284931d98677SRui Paulo 
285031d98677SRui Paulo 	/* Enable Rx TCP checksum offload. */
285131d98677SRui Paulo 	rsu_write_4(sc, R92S_RCR,
285231d98677SRui Paulo 	    rsu_read_4(sc, R92S_RCR) | 0x04000000);
285331d98677SRui Paulo 	/* Append PHY status. */
285431d98677SRui Paulo 	rsu_write_4(sc, R92S_RCR,
285531d98677SRui Paulo 	    rsu_read_4(sc, R92S_RCR) | 0x02000000);
285631d98677SRui Paulo 
285731d98677SRui Paulo 	rsu_write_4(sc, R92S_CR,
285831d98677SRui Paulo 	    rsu_read_4(sc, R92S_CR) & ~0xff000000);
285931d98677SRui Paulo 
286031d98677SRui Paulo 	/* Use 128 bytes pages. */
286131d98677SRui Paulo 	rsu_write_1(sc, 0x00b5,
286231d98677SRui Paulo 	    rsu_read_1(sc, 0x00b5) | 0x01);
286331d98677SRui Paulo 	/* Enable USB Rx aggregation. */
286431d98677SRui Paulo 	rsu_write_1(sc, 0x00bd,
286531d98677SRui Paulo 	    rsu_read_1(sc, 0x00bd) | 0x80);
286631d98677SRui Paulo 	/* Set USB Rx aggregation threshold. */
286731d98677SRui Paulo 	rsu_write_1(sc, 0x00d9, 0x01);
286831d98677SRui Paulo 	/* Set USB Rx aggregation timeout (1.7ms/4). */
286931d98677SRui Paulo 	rsu_write_1(sc, 0xfe5b, 0x04);
287031d98677SRui Paulo 	/* Fix USB Rx FIFO issue. */
287131d98677SRui Paulo 	rsu_write_1(sc, 0xfe5c,
287231d98677SRui Paulo 	    rsu_read_1(sc, 0xfe5c) | 0x80);
287331d98677SRui Paulo 
287431d98677SRui Paulo 	/* Set MAC address. */
28757a79cebfSGleb Smirnoff 	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
28767a79cebfSGleb Smirnoff 	rsu_write_region_1(sc, R92S_MACID, macaddr, IEEE80211_ADDR_LEN);
287731d98677SRui Paulo 
2878b41381aeSHans Petter Selasky 	/* It really takes 1.5 seconds for the firmware to boot: */
287917ebf553SAdrian Chadd 	rsu_ms_delay(sc, 2000);
288031d98677SRui Paulo 
28814914fa0fSAdrian Chadd 	RSU_DPRINTF(sc, RSU_DEBUG_RESET, "%s: setting MAC address to %s\n",
28824914fa0fSAdrian Chadd 	    __func__,
28834914fa0fSAdrian Chadd 	    ether_sprintf(macaddr));
28847a79cebfSGleb Smirnoff 	error = rsu_fw_cmd(sc, R92S_CMD_SET_MAC_ADDRESS, macaddr,
288531d98677SRui Paulo 	    IEEE80211_ADDR_LEN);
288631d98677SRui Paulo 	if (error != 0) {
288731d98677SRui Paulo 		device_printf(sc->sc_dev, "could not set MAC address\n");
288831d98677SRui Paulo 		goto fail;
288931d98677SRui Paulo 	}
289031d98677SRui Paulo 
28919b6916dbSAdrian Chadd 	/* Set PS mode fully active */
28926acf853dSAdrian Chadd 	error = rsu_set_fw_power_state(sc, RSU_PWR_ACTIVE);
28936acf853dSAdrian Chadd 
289431d98677SRui Paulo 	if (error != 0) {
289531d98677SRui Paulo 		device_printf(sc->sc_dev, "could not set PS mode\n");
289631d98677SRui Paulo 		goto fail;
289731d98677SRui Paulo 	}
289831d98677SRui Paulo 
28997a79cebfSGleb Smirnoff 	sc->sc_scan_pass = 0;
290031d98677SRui Paulo 	usbd_transfer_start(sc->sc_xfer[RSU_BULK_RX]);
290131d98677SRui Paulo 
290231d98677SRui Paulo 	/* We're ready to go. */
29037a79cebfSGleb Smirnoff 	sc->sc_running = 1;
290423386fa4SAdrian Chadd 	sc->sc_scanning = 0;
290531d98677SRui Paulo 	return;
290631d98677SRui Paulo fail:
2907885476cbSHans Petter Selasky 	/* Need to stop all failed transfers, if any */
2908885476cbSHans Petter Selasky 	for (i = 0; i != RSU_N_TRANSFER; i++)
2909885476cbSHans Petter Selasky 		usbd_transfer_stop(sc->sc_xfer[i]);
291031d98677SRui Paulo }
291131d98677SRui Paulo 
291231d98677SRui Paulo static void
29137a79cebfSGleb Smirnoff rsu_stop(struct rsu_softc *sc)
291431d98677SRui Paulo {
291531d98677SRui Paulo 	int i;
291631d98677SRui Paulo 
291744369387SAdrian Chadd 	RSU_ASSERT_LOCKED(sc);
291844369387SAdrian Chadd 
29197a79cebfSGleb Smirnoff 	sc->sc_running = 0;
292031d98677SRui Paulo 	sc->sc_calibrating = 0;
292131d98677SRui Paulo 	taskqueue_cancel_timeout(taskqueue_thread, &sc->calib_task, NULL);
292277435f18SAdrian Chadd 	taskqueue_cancel(taskqueue_thread, &sc->tx_task, NULL);
292331d98677SRui Paulo 
292431d98677SRui Paulo 	/* Power off adapter. */
292531d98677SRui Paulo 	rsu_power_off(sc);
292631d98677SRui Paulo 
292731d98677SRui Paulo 	for (i = 0; i < RSU_N_TRANSFER; i++)
292831d98677SRui Paulo 		usbd_transfer_stop(sc->sc_xfer[i]);
2929829e0b0bSAdrian Chadd 
2930829e0b0bSAdrian Chadd 	/* Ensure the mbuf queue is drained */
2931829e0b0bSAdrian Chadd 	rsu_drain_mbufq(sc);
293231d98677SRui Paulo }
293331d98677SRui Paulo 
293417ebf553SAdrian Chadd /*
293517ebf553SAdrian Chadd  * Note: usb_pause_mtx() actually releases the mutex before calling pause(),
293617ebf553SAdrian Chadd  * which breaks any kind of driver serialisation.
293717ebf553SAdrian Chadd  */
2938b41381aeSHans Petter Selasky static void
293917ebf553SAdrian Chadd rsu_ms_delay(struct rsu_softc *sc, int ms)
2940b41381aeSHans Petter Selasky {
294117ebf553SAdrian Chadd 
294217ebf553SAdrian Chadd 	//usb_pause_mtx(&sc->sc_mtx, hz / 1000);
294317ebf553SAdrian Chadd 	DELAY(ms * 1000);
2944b41381aeSHans Petter Selasky }
2945