xref: /freebsd/sys/dev/usb/wlan/if_rsu.c (revision 13de33a5dc2304b13d595d75d48c51793958474f)
1 /*	$OpenBSD: if_rsu.c,v 1.17 2013/04/15 09:23:01 mglocker Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 #include <sys/cdefs.h>
19 __FBSDID("$FreeBSD$");
20 
21 /*
22  * Driver for Realtek RTL8188SU/RTL8191SU/RTL8192SU.
23  *
24  * TODO:
25  *   o 11n support
26  *   o h/w crypto
27  *   o hostap / ibss / mesh
28  */
29 #include <sys/param.h>
30 #include <sys/endian.h>
31 #include <sys/sockio.h>
32 #include <sys/mbuf.h>
33 #include <sys/kernel.h>
34 #include <sys/socket.h>
35 #include <sys/systm.h>
36 #include <sys/conf.h>
37 #include <sys/bus.h>
38 #include <sys/rman.h>
39 #include <sys/firmware.h>
40 #include <sys/module.h>
41 
42 #include <machine/bus.h>
43 #include <machine/resource.h>
44 
45 #include <net/bpf.h>
46 #include <net/if.h>
47 #include <net/if_var.h>
48 #include <net/if_arp.h>
49 #include <net/if_dl.h>
50 #include <net/if_media.h>
51 #include <net/if_types.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/in_systm.h>
55 #include <netinet/in_var.h>
56 #include <netinet/if_ether.h>
57 #include <netinet/ip.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_regdomain.h>
61 #include <net80211/ieee80211_radiotap.h>
62 
63 #include <dev/usb/usb.h>
64 #include <dev/usb/usbdi.h>
65 #include "usbdevs.h"
66 
67 #define USB_DEBUG_VAR rsu_debug
68 #include <dev/usb/usb_debug.h>
69 
70 #include <dev/usb/wlan/if_rsureg.h>
71 
72 #ifdef USB_DEBUG
73 static int rsu_debug = 0;
74 SYSCTL_NODE(_hw_usb, OID_AUTO, rsu, CTLFLAG_RW, 0, "USB rsu");
75 SYSCTL_INT(_hw_usb_rsu, OID_AUTO, debug, CTLFLAG_RW, &rsu_debug, 0,
76     "Debug level");
77 #endif
78 
79 static const STRUCT_USB_HOST_ID rsu_devs[] = {
80 #define	RSU_HT_NOT_SUPPORTED 0
81 #define	RSU_HT_SUPPORTED 1
82 #define RSU_DEV_HT(v,p)  { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
83 				   RSU_HT_SUPPORTED) }
84 #define RSU_DEV(v,p)     { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, \
85 				   RSU_HT_NOT_SUPPORTED) }
86 	RSU_DEV(ASUS,			RTL8192SU),
87 	RSU_DEV(AZUREWAVE,		RTL8192SU_4),
88 	RSU_DEV_HT(ACCTON,		RTL8192SU),
89 	RSU_DEV_HT(ASUS,		USBN10),
90 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_1),
91 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_2),
92 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_3),
93 	RSU_DEV_HT(AZUREWAVE,		RTL8192SU_5),
94 	RSU_DEV_HT(BELKIN,		RTL8192SU_1),
95 	RSU_DEV_HT(BELKIN,		RTL8192SU_2),
96 	RSU_DEV_HT(BELKIN,		RTL8192SU_3),
97 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_1),
98 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_2),
99 	RSU_DEV_HT(CONCEPTRONIC2,	RTL8192SU_3),
100 	RSU_DEV_HT(COREGA,		RTL8192SU),
101 	RSU_DEV_HT(DLINK2,		DWA131A1),
102 	RSU_DEV_HT(DLINK2,		RTL8192SU_1),
103 	RSU_DEV_HT(DLINK2,		RTL8192SU_2),
104 	RSU_DEV_HT(EDIMAX,		RTL8192SU_1),
105 	RSU_DEV_HT(EDIMAX,		RTL8192SU_2),
106 	RSU_DEV_HT(EDIMAX,		EW7622UMN),
107 	RSU_DEV_HT(GUILLEMOT,		HWGUN54),
108 	RSU_DEV_HT(GUILLEMOT,		HWNUM300),
109 	RSU_DEV_HT(HAWKING,		RTL8192SU_1),
110 	RSU_DEV_HT(HAWKING,		RTL8192SU_2),
111 	RSU_DEV_HT(PLANEX2,		GWUSNANO),
112 	RSU_DEV_HT(REALTEK,		RTL8171),
113 	RSU_DEV_HT(REALTEK,		RTL8172),
114 	RSU_DEV_HT(REALTEK,		RTL8173),
115 	RSU_DEV_HT(REALTEK,		RTL8174),
116 	RSU_DEV_HT(REALTEK,		RTL8192SU),
117 	RSU_DEV_HT(REALTEK,		RTL8712),
118 	RSU_DEV_HT(REALTEK,		RTL8713),
119 	RSU_DEV_HT(SENAO,		RTL8192SU_1),
120 	RSU_DEV_HT(SENAO,		RTL8192SU_2),
121 	RSU_DEV_HT(SITECOMEU,		WL349V1),
122 	RSU_DEV_HT(SITECOMEU,		WL353),
123 	RSU_DEV_HT(SWEEX2,		LW154),
124 #undef RSU_DEV_HT
125 #undef RSU_DEV
126 };
127 
128 static device_probe_t   rsu_match;
129 static device_attach_t  rsu_attach;
130 static device_detach_t  rsu_detach;
131 static usb_callback_t   rsu_bulk_tx_callback;
132 static usb_callback_t   rsu_bulk_rx_callback;
133 static usb_error_t	rsu_do_request(struct rsu_softc *,
134 			    struct usb_device_request *, void *);
135 static struct ieee80211vap *
136 		rsu_vap_create(struct ieee80211com *, const char name[],
137 		    int, enum ieee80211_opmode, int, const uint8_t bssid[],
138 		    const uint8_t mac[]);
139 static void	rsu_vap_delete(struct ieee80211vap *);
140 static void	rsu_scan_start(struct ieee80211com *);
141 static void	rsu_scan_end(struct ieee80211com *);
142 static void	rsu_set_channel(struct ieee80211com *);
143 static void	rsu_update_mcast(struct ifnet *);
144 static int	rsu_alloc_rx_list(struct rsu_softc *);
145 static void	rsu_free_rx_list(struct rsu_softc *);
146 static int	rsu_alloc_tx_list(struct rsu_softc *);
147 static void	rsu_free_tx_list(struct rsu_softc *);
148 static void	rsu_free_list(struct rsu_softc *, struct rsu_data [], int);
149 static struct rsu_data *_rsu_getbuf(struct rsu_softc *);
150 static struct rsu_data *rsu_getbuf(struct rsu_softc *);
151 static int	rsu_write_region_1(struct rsu_softc *, uint16_t, uint8_t *,
152 		    int);
153 static void	rsu_write_1(struct rsu_softc *, uint16_t, uint8_t);
154 static void	rsu_write_2(struct rsu_softc *, uint16_t, uint16_t);
155 static void	rsu_write_4(struct rsu_softc *, uint16_t, uint32_t);
156 static int	rsu_read_region_1(struct rsu_softc *, uint16_t, uint8_t *,
157 		    int);
158 static uint8_t	rsu_read_1(struct rsu_softc *, uint16_t);
159 static uint16_t	rsu_read_2(struct rsu_softc *, uint16_t);
160 static uint32_t	rsu_read_4(struct rsu_softc *, uint16_t);
161 static int	rsu_fw_iocmd(struct rsu_softc *, uint32_t);
162 static uint8_t	rsu_efuse_read_1(struct rsu_softc *, uint16_t);
163 static int	rsu_read_rom(struct rsu_softc *);
164 static int	rsu_fw_cmd(struct rsu_softc *, uint8_t, void *, int);
165 static void	rsu_calib_task(void *, int);
166 static int	rsu_newstate(struct ieee80211vap *, enum ieee80211_state, int);
167 #ifdef notyet
168 static void	rsu_set_key(struct rsu_softc *, const struct ieee80211_key *);
169 static void	rsu_delete_key(struct rsu_softc *, const struct ieee80211_key *);
170 #endif
171 static int	rsu_site_survey(struct rsu_softc *, struct ieee80211vap *);
172 static int	rsu_join_bss(struct rsu_softc *, struct ieee80211_node *);
173 static int	rsu_disconnect(struct rsu_softc *);
174 static void	rsu_event_survey(struct rsu_softc *, uint8_t *, int);
175 static void	rsu_event_join_bss(struct rsu_softc *, uint8_t *, int);
176 static void	rsu_rx_event(struct rsu_softc *, uint8_t, uint8_t *, int);
177 static void	rsu_rx_multi_event(struct rsu_softc *, uint8_t *, int);
178 static int8_t	rsu_get_rssi(struct rsu_softc *, int, void *);
179 static struct mbuf *
180 		rsu_rx_frame(struct rsu_softc *, uint8_t *, int, int *);
181 static struct mbuf *
182 		rsu_rx_multi_frame(struct rsu_softc *, uint8_t *, int, int *);
183 static struct mbuf *
184 		rsu_rxeof(struct usb_xfer *, struct rsu_data *, int *);
185 static void	rsu_txeof(struct usb_xfer *, struct rsu_data *);
186 static int	rsu_raw_xmit(struct ieee80211_node *, struct mbuf *,
187 		    const struct ieee80211_bpf_params *);
188 static void	rsu_init(void *);
189 static void	rsu_init_locked(struct rsu_softc *);
190 static void	rsu_watchdog(void *);
191 static int	rsu_tx_start(struct rsu_softc *, struct ieee80211_node *,
192 		    struct mbuf *, struct rsu_data *);
193 static void	rsu_start(struct ifnet *);
194 static void	rsu_start_locked(struct ifnet *);
195 static int	rsu_ioctl(struct ifnet *, u_long, caddr_t);
196 static void	rsu_stop(struct ifnet *, int);
197 static void	rsu_stop_locked(struct ifnet *, int);
198 
199 static device_method_t rsu_methods[] = {
200 	DEVMETHOD(device_probe,		rsu_match),
201 	DEVMETHOD(device_attach,	rsu_attach),
202 	DEVMETHOD(device_detach,	rsu_detach),
203 
204 	DEVMETHOD_END
205 };
206 
207 static driver_t rsu_driver = {
208 	.name = "rsu",
209 	.methods = rsu_methods,
210 	.size = sizeof(struct rsu_softc)
211 };
212 
213 static devclass_t rsu_devclass;
214 
215 DRIVER_MODULE(rsu, uhub, rsu_driver, rsu_devclass, NULL, 0);
216 MODULE_DEPEND(rsu, wlan, 1, 1, 1);
217 MODULE_DEPEND(rsu, usb, 1, 1, 1);
218 MODULE_DEPEND(rsu, firmware, 1, 1, 1);
219 MODULE_VERSION(rsu, 1);
220 
221 static const struct usb_config rsu_config[RSU_N_TRANSFER] = {
222 	[RSU_BULK_RX] = {
223 		.type = UE_BULK,
224 		.endpoint = UE_ADDR_ANY,
225 		.direction = UE_DIR_IN,
226 		.bufsize = RSU_RXBUFSZ,
227 		.flags = {
228 			.pipe_bof = 1,
229 			.short_xfer_ok = 1
230 		},
231 		.callback = rsu_bulk_rx_callback
232 	},
233 	[RSU_BULK_TX_BE] = {
234 		.type = UE_BULK,
235 		.endpoint = 0x06,
236 		.direction = UE_DIR_OUT,
237 		.bufsize = RSU_TXBUFSZ,
238 		.flags = {
239 			.ext_buffer = 1,
240 			.pipe_bof = 1,
241 			.force_short_xfer = 1
242 		},
243 		.callback = rsu_bulk_tx_callback,
244 		.timeout = RSU_TX_TIMEOUT
245 	},
246 	[RSU_BULK_TX_BK] = {
247 		.type = UE_BULK,
248 		.endpoint = 0x06,
249 		.direction = UE_DIR_OUT,
250 		.bufsize = RSU_TXBUFSZ,
251 		.flags = {
252 			.ext_buffer = 1,
253 			.pipe_bof = 1,
254 			.force_short_xfer = 1
255 		},
256 		.callback = rsu_bulk_tx_callback,
257 		.timeout = RSU_TX_TIMEOUT
258 	},
259 	[RSU_BULK_TX_VI] = {
260 		.type = UE_BULK,
261 		.endpoint = 0x04,
262 		.direction = UE_DIR_OUT,
263 		.bufsize = RSU_TXBUFSZ,
264 		.flags = {
265 			.ext_buffer = 1,
266 			.pipe_bof = 1,
267 			.force_short_xfer = 1
268 		},
269 		.callback = rsu_bulk_tx_callback,
270 		.timeout = RSU_TX_TIMEOUT
271 	},
272 	[RSU_BULK_TX_VO] = {
273 		.type = UE_BULK,
274 		.endpoint = 0x04,
275 		.direction = UE_DIR_OUT,
276 		.bufsize = RSU_TXBUFSZ,
277 		.flags = {
278 			.ext_buffer = 1,
279 			.pipe_bof = 1,
280 			.force_short_xfer = 1
281 		},
282 		.callback = rsu_bulk_tx_callback,
283 		.timeout = RSU_TX_TIMEOUT
284 	},
285 };
286 
287 static int
288 rsu_match(device_t self)
289 {
290 	struct usb_attach_arg *uaa = device_get_ivars(self);
291 
292 	if (uaa->usb_mode != USB_MODE_HOST ||
293 	    uaa->info.bIfaceIndex != 0 ||
294 	    uaa->info.bConfigIndex != 0)
295 		return (ENXIO);
296 
297 	return (usbd_lookup_id_by_uaa(rsu_devs, sizeof(rsu_devs), uaa));
298 }
299 
300 static int
301 rsu_attach(device_t self)
302 {
303 	struct usb_attach_arg *uaa = device_get_ivars(self);
304 	struct rsu_softc *sc = device_get_softc(self);
305 	struct ifnet *ifp;
306 	struct ieee80211com *ic;
307 	int error;
308 	uint8_t iface_index, bands;
309 
310 	device_set_usb_desc(self);
311 	sc->sc_udev = uaa->device;
312 	sc->sc_dev = self;
313 
314 	mtx_init(&sc->sc_mtx, device_get_nameunit(self), MTX_NETWORK_LOCK,
315 	    MTX_DEF);
316 	TIMEOUT_TASK_INIT(taskqueue_thread, &sc->calib_task, 0,
317 	    rsu_calib_task, sc);
318 	callout_init(&sc->sc_watchdog_ch, 0);
319 
320 	iface_index = 0;
321 	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
322 	    rsu_config, RSU_N_TRANSFER, sc, &sc->sc_mtx);
323 	if (error) {
324 		device_printf(sc->sc_dev,
325 		    "could not allocate USB transfers, err=%s\n",
326 		    usbd_errstr(error));
327 		goto fail_usb;
328 	}
329 	RSU_LOCK(sc);
330 	/* Read chip revision. */
331 	sc->cut = MS(rsu_read_4(sc, R92S_PMC_FSM), R92S_PMC_FSM_CUT);
332 	if (sc->cut != 3)
333 		sc->cut = (sc->cut >> 1) + 1;
334 	error = rsu_read_rom(sc);
335 	if (error != 0) {
336 		device_printf(self, "could not read ROM\n");
337 		goto fail_rom;
338 	}
339 	RSU_UNLOCK(sc);
340 	IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->rom[0x12]);
341 	device_printf(self, "MAC/BB RTL8712 cut %d\n", sc->cut);
342 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
343 	if (ifp == NULL) {
344 		device_printf(self, "cannot allocate interface\n");
345 		goto fail_ifalloc;
346 	}
347 	ic = ifp->if_l2com;
348 	ifp->if_softc = sc;
349 	if_initname(ifp, "rsu", device_get_unit(self));
350 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
351 	ifp->if_init = rsu_init;
352 	ifp->if_ioctl = rsu_ioctl;
353 	ifp->if_start = rsu_start;
354 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
355 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
356 	IFQ_SET_READY(&ifp->if_snd);
357 	ifp->if_capabilities |= IFCAP_RXCSUM;
358 	ifp->if_capenable |= IFCAP_RXCSUM;
359 	ifp->if_hwassist = CSUM_TCP;
360 
361 	ic->ic_ifp = ifp;
362 	ic->ic_phytype = IEEE80211_T_OFDM;	/* Not only, but not used. */
363 	ic->ic_opmode = IEEE80211_M_STA;	/* Default to BSS mode. */
364 
365 	/* Set device capabilities. */
366 	ic->ic_caps =
367 	    IEEE80211_C_STA |		/* station mode */
368 	    IEEE80211_C_BGSCAN |	/* Background scan. */
369 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
370 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
371 	    IEEE80211_C_WPA;		/* WPA/RSN. */
372 
373 #if 0
374 	/* Check if HT support is present. */
375 	if (usb_lookup(rsu_devs_noht, uaa->vendor, uaa->product) == NULL) {
376 		/* Set HT capabilities. */
377 		ic->ic_htcaps =
378 		    IEEE80211_HTCAP_CBW20_40 |
379 		    IEEE80211_HTCAP_DSSSCCK40;
380 		/* Set supported HT rates. */
381 		for (i = 0; i < 2; i++)
382 			ic->ic_sup_mcs[i] = 0xff;
383 	}
384 #endif
385 
386 	/* Set supported .11b and .11g rates. */
387 	bands = 0;
388 	setbit(&bands, IEEE80211_MODE_11B);
389 	setbit(&bands, IEEE80211_MODE_11G);
390 	ieee80211_init_channels(ic, NULL, &bands);
391 
392 	ieee80211_ifattach(ic, sc->sc_bssid);
393 	ic->ic_raw_xmit = rsu_raw_xmit;
394 	ic->ic_scan_start = rsu_scan_start;
395 	ic->ic_scan_end = rsu_scan_end;
396 	ic->ic_set_channel = rsu_set_channel;
397 	ic->ic_vap_create = rsu_vap_create;
398 	ic->ic_vap_delete = rsu_vap_delete;
399 	ic->ic_update_mcast = rsu_update_mcast;
400 
401 	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
402 	    sizeof(sc->sc_txtap), RSU_TX_RADIOTAP_PRESENT,
403 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
404 	    RSU_RX_RADIOTAP_PRESENT);
405 
406 	if (bootverbose)
407 		ieee80211_announce(ic);
408 
409 	return (0);
410 
411 fail_ifalloc:
412 fail_rom:
413 	usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
414 fail_usb:
415 	mtx_destroy(&sc->sc_mtx);
416 	return (ENXIO);
417 }
418 
419 static int
420 rsu_detach(device_t self)
421 {
422 	struct rsu_softc *sc = device_get_softc(self);
423 	struct ifnet *ifp = sc->sc_ifp;
424 	struct ieee80211com *ic = ifp->if_l2com;
425 
426 	if (!device_is_attached(self))
427 		return (0);
428 	rsu_stop(ifp, 1);
429 	usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
430 	ieee80211_ifdetach(ic);
431 
432 	callout_drain(&sc->sc_watchdog_ch);
433 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
434 
435 	/* Free Tx/Rx buffers. */
436 	rsu_free_tx_list(sc);
437 	rsu_free_rx_list(sc);
438 
439 	if_free(ifp);
440 	mtx_destroy(&sc->sc_mtx);
441 
442 	return (0);
443 }
444 
445 static usb_error_t
446 rsu_do_request(struct rsu_softc *sc, struct usb_device_request *req,
447     void *data)
448 {
449 	usb_error_t err;
450 	int ntries = 10;
451 
452 	RSU_ASSERT_LOCKED(sc);
453 
454 	while (ntries--) {
455 		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
456 		    req, data, 0, NULL, 250 /* ms */);
457 		if (err == 0 || !device_is_attached(sc->sc_dev))
458 			break;
459 		DPRINTFN(1, "Control request failed, %s (retrying)\n",
460 		    usbd_errstr(err));
461 		usb_pause_mtx(&sc->sc_mtx, hz / 100);
462         }
463 
464         return (err);
465 }
466 
467 static struct ieee80211vap *
468 rsu_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
469     enum ieee80211_opmode opmode, int flags,
470     const uint8_t bssid[IEEE80211_ADDR_LEN],
471     const uint8_t mac[IEEE80211_ADDR_LEN])
472 {
473 	struct rsu_vap *uvp;
474 	struct ieee80211vap *vap;
475 
476 	if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
477 		return (NULL);
478 
479 	uvp = (struct rsu_vap *) malloc(sizeof(struct rsu_vap),
480 	    M_80211_VAP, M_NOWAIT | M_ZERO);
481 	if (uvp == NULL)
482 		return (NULL);
483 	vap = &uvp->vap;
484 
485 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
486 	    flags, bssid, mac) != 0) {
487 		/* out of memory */
488 		free(uvp, M_80211_VAP);
489 		return (NULL);
490 	}
491 
492 	/* override state transition machine */
493 	uvp->newstate = vap->iv_newstate;
494 	vap->iv_newstate = rsu_newstate;
495 
496 	/* complete setup */
497 	ieee80211_vap_attach(vap, ieee80211_media_change,
498 	    ieee80211_media_status);
499 	ic->ic_opmode = opmode;
500 
501 	return (vap);
502 }
503 
504 static void
505 rsu_vap_delete(struct ieee80211vap *vap)
506 {
507 	struct rsu_vap *uvp = RSU_VAP(vap);
508 
509 	ieee80211_vap_detach(vap);
510 	free(uvp, M_80211_VAP);
511 }
512 
513 static void
514 rsu_scan_start(struct ieee80211com *ic)
515 {
516 	int error;
517 	struct ifnet *ifp = ic->ic_ifp;
518 	struct rsu_softc *sc = ifp->if_softc;
519 
520 	/* Scanning is done by the firmware. */
521 	RSU_LOCK(sc);
522 	error = rsu_site_survey(sc, TAILQ_FIRST(&ic->ic_vaps));
523 	RSU_UNLOCK(sc);
524 	if (error != 0)
525 		device_printf(sc->sc_dev,
526 		    "could not send site survey command\n");
527 }
528 
529 static void
530 rsu_scan_end(struct ieee80211com *ic)
531 {
532 	/* Nothing to do here. */
533 }
534 
535 static void
536 rsu_set_channel(struct ieee80211com *ic __unused)
537 {
538 	/* We are unable to switch channels, yet. */
539 }
540 
541 static void
542 rsu_update_mcast(struct ifnet *ifp)
543 {
544         /* XXX do nothing?  */
545 }
546 
547 static int
548 rsu_alloc_list(struct rsu_softc *sc, struct rsu_data data[],
549     int ndata, int maxsz)
550 {
551 	int i, error;
552 
553 	for (i = 0; i < ndata; i++) {
554 		struct rsu_data *dp = &data[i];
555 		dp->sc = sc;
556 		dp->m = NULL;
557 		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
558 		if (dp->buf == NULL) {
559 			device_printf(sc->sc_dev,
560 			    "could not allocate buffer\n");
561 			error = ENOMEM;
562 			goto fail;
563 		}
564 		dp->ni = NULL;
565 	}
566 
567 	return (0);
568 fail:
569 	rsu_free_list(sc, data, ndata);
570 	return (error);
571 }
572 
573 static int
574 rsu_alloc_rx_list(struct rsu_softc *sc)
575 {
576         int error, i;
577 
578 	error = rsu_alloc_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT,
579 	    RSU_RXBUFSZ);
580 	if (error != 0)
581 		return (error);
582 
583 	STAILQ_INIT(&sc->sc_rx_active);
584 	STAILQ_INIT(&sc->sc_rx_inactive);
585 
586 	for (i = 0; i < RSU_RX_LIST_COUNT; i++)
587 		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
588 
589 	return (0);
590 }
591 
592 static int
593 rsu_alloc_tx_list(struct rsu_softc *sc)
594 {
595 	int error, i;
596 
597 	error = rsu_alloc_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT,
598 	    RSU_TXBUFSZ);
599 	if (error != 0)
600 		return (error);
601 
602 	STAILQ_INIT(&sc->sc_tx_active);
603 	STAILQ_INIT(&sc->sc_tx_inactive);
604 	STAILQ_INIT(&sc->sc_tx_pending);
605 
606 	for (i = 0; i < RSU_TX_LIST_COUNT; i++) {
607 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
608 	}
609 
610 	return (0);
611 }
612 
613 static void
614 rsu_free_tx_list(struct rsu_softc *sc)
615 {
616 	rsu_free_list(sc, sc->sc_tx, RSU_TX_LIST_COUNT);
617 }
618 
619 static void
620 rsu_free_rx_list(struct rsu_softc *sc)
621 {
622 	rsu_free_list(sc, sc->sc_rx, RSU_RX_LIST_COUNT);
623 }
624 
625 static void
626 rsu_free_list(struct rsu_softc *sc, struct rsu_data data[], int ndata)
627 {
628 	int i;
629 
630 	for (i = 0; i < ndata; i++) {
631 		struct rsu_data *dp = &data[i];
632 
633 		if (dp->buf != NULL) {
634 			free(dp->buf, M_USBDEV);
635 			dp->buf = NULL;
636 		}
637 		if (dp->ni != NULL) {
638 			ieee80211_free_node(dp->ni);
639 			dp->ni = NULL;
640 		}
641 	}
642 }
643 
644 static struct rsu_data *
645 _rsu_getbuf(struct rsu_softc *sc)
646 {
647 	struct rsu_data *bf;
648 
649 	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
650 	if (bf != NULL)
651 		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
652 	else
653 		bf = NULL;
654 	if (bf == NULL)
655 		DPRINTF("out of xmit buffers\n");
656         return (bf);
657 }
658 
659 static struct rsu_data *
660 rsu_getbuf(struct rsu_softc *sc)
661 {
662 	struct rsu_data *bf;
663 
664 	RSU_ASSERT_LOCKED(sc);
665 
666 	bf = _rsu_getbuf(sc);
667 	if (bf == NULL) {
668 		struct ifnet *ifp = sc->sc_ifp;
669 		DPRINTF("stop queue\n");
670 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
671 	}
672 	return (bf);
673 }
674 
675 static int
676 rsu_write_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
677     int len)
678 {
679 	usb_device_request_t req;
680 
681 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
682 	req.bRequest = R92S_REQ_REGS;
683 	USETW(req.wValue, addr);
684 	USETW(req.wIndex, 0);
685 	USETW(req.wLength, len);
686 
687 	return (rsu_do_request(sc, &req, buf));
688 }
689 
690 static void
691 rsu_write_1(struct rsu_softc *sc, uint16_t addr, uint8_t val)
692 {
693 	rsu_write_region_1(sc, addr, &val, 1);
694 }
695 
696 static void
697 rsu_write_2(struct rsu_softc *sc, uint16_t addr, uint16_t val)
698 {
699 	val = htole16(val);
700 	rsu_write_region_1(sc, addr, (uint8_t *)&val, 2);
701 }
702 
703 static void
704 rsu_write_4(struct rsu_softc *sc, uint16_t addr, uint32_t val)
705 {
706 	val = htole32(val);
707 	rsu_write_region_1(sc, addr, (uint8_t *)&val, 4);
708 }
709 
710 static int
711 rsu_read_region_1(struct rsu_softc *sc, uint16_t addr, uint8_t *buf,
712     int len)
713 {
714 	usb_device_request_t req;
715 
716 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
717 	req.bRequest = R92S_REQ_REGS;
718 	USETW(req.wValue, addr);
719 	USETW(req.wIndex, 0);
720 	USETW(req.wLength, len);
721 
722 	return (rsu_do_request(sc, &req, buf));
723 }
724 
725 static uint8_t
726 rsu_read_1(struct rsu_softc *sc, uint16_t addr)
727 {
728 	uint8_t val;
729 
730 	if (rsu_read_region_1(sc, addr, &val, 1) != 0)
731 		return (0xff);
732 	return (val);
733 }
734 
735 static uint16_t
736 rsu_read_2(struct rsu_softc *sc, uint16_t addr)
737 {
738 	uint16_t val;
739 
740 	if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
741 		return (0xffff);
742 	return (le16toh(val));
743 }
744 
745 static uint32_t
746 rsu_read_4(struct rsu_softc *sc, uint16_t addr)
747 {
748 	uint32_t val;
749 
750 	if (rsu_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
751 		return (0xffffffff);
752 	return (le32toh(val));
753 }
754 
755 static int
756 rsu_fw_iocmd(struct rsu_softc *sc, uint32_t iocmd)
757 {
758 	int ntries;
759 
760 	rsu_write_4(sc, R92S_IOCMD_CTRL, iocmd);
761 	DELAY(100);
762 	for (ntries = 0; ntries < 50; ntries++) {
763 		if (rsu_read_4(sc, R92S_IOCMD_CTRL) == 0)
764 			return (0);
765 		DELAY(10);
766 	}
767 	return (ETIMEDOUT);
768 }
769 
770 static uint8_t
771 rsu_efuse_read_1(struct rsu_softc *sc, uint16_t addr)
772 {
773 	uint32_t reg;
774 	int ntries;
775 
776 	reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
777 	reg = RW(reg, R92S_EFUSE_CTRL_ADDR, addr);
778 	reg &= ~R92S_EFUSE_CTRL_VALID;
779 	rsu_write_4(sc, R92S_EFUSE_CTRL, reg);
780 	/* Wait for read operation to complete. */
781 	for (ntries = 0; ntries < 100; ntries++) {
782 		reg = rsu_read_4(sc, R92S_EFUSE_CTRL);
783 		if (reg & R92S_EFUSE_CTRL_VALID)
784 			return (MS(reg, R92S_EFUSE_CTRL_DATA));
785 		DELAY(5);
786 	}
787 	device_printf(sc->sc_dev,
788 	    "could not read efuse byte at address 0x%x\n", addr);
789 	return (0xff);
790 }
791 
792 static int
793 rsu_read_rom(struct rsu_softc *sc)
794 {
795 	uint8_t *rom = sc->rom;
796 	uint16_t addr = 0;
797 	uint32_t reg;
798 	uint8_t off, msk;
799 	int i;
800 
801 	/* Make sure that ROM type is eFuse and that autoload succeeded. */
802 	reg = rsu_read_1(sc, R92S_EE_9346CR);
803 	if ((reg & (R92S_9356SEL | R92S_EEPROM_EN)) != R92S_EEPROM_EN)
804 		return (EIO);
805 
806 	/* Turn on 2.5V to prevent eFuse leakage. */
807 	reg = rsu_read_1(sc, R92S_EFUSE_TEST + 3);
808 	rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg | 0x80);
809 	DELAY(1000);
810 	rsu_write_1(sc, R92S_EFUSE_TEST + 3, reg & ~0x80);
811 
812 	/* Read full ROM image. */
813 	memset(&sc->rom, 0xff, sizeof(sc->rom));
814 	while (addr < 512) {
815 		reg = rsu_efuse_read_1(sc, addr);
816 		if (reg == 0xff)
817 			break;
818 		addr++;
819 		off = reg >> 4;
820 		msk = reg & 0xf;
821 		for (i = 0; i < 4; i++) {
822 			if (msk & (1 << i))
823 				continue;
824 			rom[off * 8 + i * 2 + 0] =
825 			    rsu_efuse_read_1(sc, addr);
826 			addr++;
827 			rom[off * 8 + i * 2 + 1] =
828 			    rsu_efuse_read_1(sc, addr);
829 			addr++;
830 		}
831 	}
832 #ifdef USB_DEBUG
833 	if (rsu_debug >= 5) {
834 		/* Dump ROM content. */
835 		printf("\n");
836 		for (i = 0; i < sizeof(sc->rom); i++)
837 			printf("%02x:", rom[i]);
838 		printf("\n");
839 	}
840 #endif
841 	return (0);
842 }
843 
844 static int
845 rsu_fw_cmd(struct rsu_softc *sc, uint8_t code, void *buf, int len)
846 {
847 	struct rsu_data *data;
848 	struct r92s_tx_desc *txd;
849 	struct r92s_fw_cmd_hdr *cmd;
850 	int cmdsz, xferlen;
851 
852 	data = rsu_getbuf(sc);
853 	if (data == NULL)
854 		return (ENOMEM);
855 
856 	/* Round-up command length to a multiple of 8 bytes. */
857 	cmdsz = (len + 7) & ~7;
858 
859 	xferlen = sizeof(*txd) + sizeof(*cmd) + cmdsz;
860 	KASSERT(xferlen <= RSU_TXBUFSZ, ("%s: invalid length", __func__));
861 	memset(data->buf, 0, xferlen);
862 
863 	/* Setup Tx descriptor. */
864 	txd = (struct r92s_tx_desc *)data->buf;
865 	txd->txdw0 = htole32(
866 	    SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
867 	    SM(R92S_TXDW0_PKTLEN, sizeof(*cmd) + cmdsz) |
868 	    R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
869 	txd->txdw1 = htole32(SM(R92S_TXDW1_QSEL, R92S_TXDW1_QSEL_H2C));
870 
871 	/* Setup command header. */
872 	cmd = (struct r92s_fw_cmd_hdr *)&txd[1];
873 	cmd->len = htole16(cmdsz);
874 	cmd->code = code;
875 	cmd->seq = sc->cmd_seq;
876 	sc->cmd_seq = (sc->cmd_seq + 1) & 0x7f;
877 
878 	/* Copy command payload. */
879 	memcpy(&cmd[1], buf, len);
880 
881 	DPRINTFN(2, "Tx cmd code=0x%x len=0x%x\n", code, cmdsz);
882 	data->buflen = xferlen;
883 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
884 	usbd_transfer_start(sc->sc_xfer[RSU_BULK_TX_VO]);
885 
886 	return (0);
887 }
888 
889 /* ARGSUSED */
890 static void
891 rsu_calib_task(void *arg, int pending __unused)
892 {
893 	struct rsu_softc *sc = arg;
894 	uint32_t reg;
895 
896 	DPRINTFN(6, "running calibration task\n");
897 	RSU_LOCK(sc);
898 #ifdef notyet
899 	/* Read WPS PBC status. */
900 	rsu_write_1(sc, R92S_MAC_PINMUX_CTRL,
901 	    R92S_GPIOMUX_EN | SM(R92S_GPIOSEL_GPIO, R92S_GPIOSEL_GPIO_JTAG));
902 	rsu_write_1(sc, R92S_GPIO_IO_SEL,
903 	    rsu_read_1(sc, R92S_GPIO_IO_SEL) & ~R92S_GPIO_WPS);
904 	reg = rsu_read_1(sc, R92S_GPIO_CTRL);
905 	if (reg != 0xff && (reg & R92S_GPIO_WPS))
906 		DPRINTF(("WPS PBC is pushed\n"));
907 #endif
908 	/* Read current signal level. */
909 	if (rsu_fw_iocmd(sc, 0xf4000001) == 0) {
910 		reg = rsu_read_4(sc, R92S_IOCMD_DATA);
911 		DPRINTFN(8, "RSSI=%d%%\n", reg >> 4);
912 	}
913 	if (sc->sc_calibrating) {
914 		RSU_UNLOCK(sc);
915 		taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task,
916 		    hz * 2);
917 	} else
918 		RSU_UNLOCK(sc);
919 }
920 
921 static int
922 rsu_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
923 {
924 	struct rsu_vap *uvp = RSU_VAP(vap);
925 	struct ieee80211com *ic = vap->iv_ic;
926 	struct rsu_softc *sc = ic->ic_ifp->if_softc;
927 	struct ieee80211_node *ni;
928 	struct ieee80211_rateset *rs;
929 	enum ieee80211_state ostate;
930 	int error, startcal = 0;
931 
932 	ostate = vap->iv_state;
933 	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
934 	    ieee80211_state_name[nstate]);
935 
936 	IEEE80211_UNLOCK(ic);
937 	if (ostate == IEEE80211_S_RUN) {
938 		RSU_LOCK(sc);
939 		/* Stop calibration. */
940 		sc->sc_calibrating = 0;
941 		RSU_UNLOCK(sc);
942 		taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
943 		/* Disassociate from our current BSS. */
944 		RSU_LOCK(sc);
945 		rsu_disconnect(sc);
946 	} else
947 		RSU_LOCK(sc);
948 	switch (nstate) {
949 	case IEEE80211_S_INIT:
950 		break;
951 	case IEEE80211_S_AUTH:
952 		ni = ieee80211_ref_node(vap->iv_bss);
953 		error = rsu_join_bss(sc, ni);
954 		ieee80211_free_node(ni);
955 		if (error != 0) {
956 			device_printf(sc->sc_dev,
957 			    "could not send join command\n");
958 		}
959 		break;
960 	case IEEE80211_S_RUN:
961 		ni = ieee80211_ref_node(vap->iv_bss);
962 		rs = &ni->ni_rates;
963 		/* Indicate highest supported rate. */
964 		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
965 		ieee80211_free_node(ni);
966 		startcal = 1;
967 		break;
968 	default:
969 		break;
970 	}
971 	sc->sc_calibrating = 1;
972 	RSU_UNLOCK(sc);
973 	IEEE80211_LOCK(ic);
974 	/* Start periodic calibration. */
975 	taskqueue_enqueue_timeout(taskqueue_thread, &sc->calib_task, hz * 2);
976 
977 	return (uvp->newstate(vap, nstate, arg));
978 }
979 
980 #ifdef notyet
981 static void
982 rsu_set_key(struct rsu_softc *sc, const struct ieee80211_key *k)
983 {
984 	struct r92s_fw_cmd_set_key key;
985 
986 	memset(&key, 0, sizeof(key));
987 	/* Map net80211 cipher to HW crypto algorithm. */
988 	switch (k->wk_cipher->ic_cipher) {
989 	case IEEE80211_CIPHER_WEP:
990 		if (k->wk_keylen < 8)
991 			key.algo = R92S_KEY_ALGO_WEP40;
992 		else
993 			key.algo = R92S_KEY_ALGO_WEP104;
994 		break;
995 	case IEEE80211_CIPHER_TKIP:
996 		key.algo = R92S_KEY_ALGO_TKIP;
997 		break;
998 	case IEEE80211_CIPHER_AES_CCM:
999 		key.algo = R92S_KEY_ALGO_AES;
1000 		break;
1001 	default:
1002 		return;
1003 	}
1004 	key.id = k->wk_keyix;
1005 	key.grpkey = (k->wk_flags & IEEE80211_KEY_GROUP) != 0;
1006 	memcpy(key.key, k->wk_key, MIN(k->wk_keylen, sizeof(key.key)));
1007 	(void)rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1008 }
1009 
1010 static void
1011 rsu_delete_key(struct rsu_softc *sc, const struct ieee80211_key *k)
1012 {
1013 	struct r92s_fw_cmd_set_key key;
1014 
1015 	memset(&key, 0, sizeof(key));
1016 	key.id = k->wk_keyix;
1017 	(void)rsu_fw_cmd(sc, R92S_CMD_SET_KEY, &key, sizeof(key));
1018 }
1019 #endif
1020 
1021 static int
1022 rsu_site_survey(struct rsu_softc *sc, struct ieee80211vap *vap)
1023 {
1024 	struct r92s_fw_cmd_sitesurvey cmd;
1025 	struct ifnet *ifp = sc->sc_ifp;
1026 	struct ieee80211com *ic = ifp->if_l2com;
1027 
1028 	memset(&cmd, 0, sizeof(cmd));
1029 	if ((ic->ic_flags & IEEE80211_F_ASCAN) || sc->scan_pass == 1)
1030 		cmd.active = htole32(1);
1031 	cmd.limit = htole32(48);
1032 	if (sc->scan_pass == 1 && vap->iv_des_nssid > 0) {
1033 		/* Do a directed scan for second pass. */
1034 		cmd.ssidlen = htole32(vap->iv_des_ssid[0].len);
1035 		memcpy(cmd.ssid, vap->iv_des_ssid[0].ssid,
1036 		    vap->iv_des_ssid[0].len);
1037 
1038 	}
1039 	DPRINTF("sending site survey command, pass=%d\n", sc->scan_pass);
1040 	return (rsu_fw_cmd(sc, R92S_CMD_SITE_SURVEY, &cmd, sizeof(cmd)));
1041 }
1042 
1043 static int
1044 rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
1045 {
1046 	struct ifnet *ifp = sc->sc_ifp;
1047 	struct ieee80211com *ic = ifp->if_l2com;
1048 	struct ieee80211vap *vap = ni->ni_vap;
1049 	struct ndis_wlan_bssid_ex *bss;
1050 	struct ndis_802_11_fixed_ies *fixed;
1051 	struct r92s_fw_cmd_auth auth;
1052 	uint8_t buf[sizeof(*bss) + 128], *frm;
1053 	uint8_t opmode;
1054 	int error;
1055 
1056 	/* Let the FW decide the opmode based on the capinfo field. */
1057 	opmode = NDIS802_11AUTOUNKNOWN;
1058 	DPRINTF("setting operating mode to %d\n", opmode);
1059 	error = rsu_fw_cmd(sc, R92S_CMD_SET_OPMODE, &opmode, sizeof(opmode));
1060 	if (error != 0)
1061 		return (error);
1062 
1063 	memset(&auth, 0, sizeof(auth));
1064 	if (vap->iv_flags & IEEE80211_F_WPA) {
1065 		auth.mode = R92S_AUTHMODE_WPA;
1066 		auth.dot1x = ni->ni_authmode == IEEE80211_AUTH_8021X;
1067 	} else
1068 		auth.mode = R92S_AUTHMODE_OPEN;
1069 	DPRINTF("setting auth mode to %d\n", auth.mode);
1070 	error = rsu_fw_cmd(sc, R92S_CMD_SET_AUTH, &auth, sizeof(auth));
1071 	if (error != 0)
1072 		return (error);
1073 
1074 	memset(buf, 0, sizeof(buf));
1075 	bss = (struct ndis_wlan_bssid_ex *)buf;
1076 	IEEE80211_ADDR_COPY(bss->macaddr, ni->ni_bssid);
1077 	bss->ssid.ssidlen = htole32(ni->ni_esslen);
1078 	memcpy(bss->ssid.ssid, ni->ni_essid, ni->ni_esslen);
1079 	if (vap->iv_flags & (IEEE80211_F_PRIVACY | IEEE80211_F_WPA))
1080 		bss->privacy = htole32(1);
1081 	bss->rssi = htole32(ni->ni_avgrssi);
1082 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1083 		bss->networktype = htole32(NDIS802_11DS);
1084 	else
1085 		bss->networktype = htole32(NDIS802_11OFDM24);
1086 	bss->config.len = htole32(sizeof(bss->config));
1087 	bss->config.bintval = htole32(ni->ni_intval);
1088 	bss->config.dsconfig = htole32(ieee80211_chan2ieee(ic, ni->ni_chan));
1089 	bss->inframode = htole32(NDIS802_11INFRASTRUCTURE);
1090 	memcpy(bss->supprates, ni->ni_rates.rs_rates,
1091 	    ni->ni_rates.rs_nrates);
1092 	/* Write the fixed fields of the beacon frame. */
1093 	fixed = (struct ndis_802_11_fixed_ies *)&bss[1];
1094 	memcpy(&fixed->tstamp, ni->ni_tstamp.data, 8);
1095 	fixed->bintval = htole16(ni->ni_intval);
1096 	fixed->capabilities = htole16(ni->ni_capinfo);
1097 	/* Write IEs to be included in the association request. */
1098 	frm = (uint8_t *)&fixed[1];
1099 	frm = ieee80211_add_rsn(frm, vap);
1100 	frm = ieee80211_add_wpa(frm, vap);
1101 	frm = ieee80211_add_qos(frm, ni);
1102 	if (ni->ni_flags & IEEE80211_NODE_HT)
1103 		frm = ieee80211_add_htcap(frm, ni);
1104 	bss->ieslen = htole32(frm - (uint8_t *)fixed);
1105 	bss->len = htole32(((frm - buf) + 3) & ~3);
1106 	DPRINTF("sending join bss command to %s chan %d\n",
1107 	    ether_sprintf(bss->macaddr), le32toh(bss->config.dsconfig));
1108 	return (rsu_fw_cmd(sc, R92S_CMD_JOIN_BSS, buf, sizeof(buf)));
1109 }
1110 
1111 static int
1112 rsu_disconnect(struct rsu_softc *sc)
1113 {
1114 	uint32_t zero = 0;	/* :-) */
1115 
1116 	/* Disassociate from our current BSS. */
1117 	DPRINTF("sending disconnect command\n");
1118 	return (rsu_fw_cmd(sc, R92S_CMD_DISCONNECT, &zero, sizeof(zero)));
1119 }
1120 
1121 static void
1122 rsu_event_survey(struct rsu_softc *sc, uint8_t *buf, int len)
1123 {
1124 	struct ifnet *ifp = sc->sc_ifp;
1125 	struct ieee80211com *ic = ifp->if_l2com;
1126 	struct ieee80211_frame *wh;
1127 	struct ieee80211_channel *c;
1128 	struct ndis_wlan_bssid_ex *bss;
1129 	struct mbuf *m;
1130 	int pktlen;
1131 
1132 	if (__predict_false(len < sizeof(*bss)))
1133 		return;
1134 	bss = (struct ndis_wlan_bssid_ex *)buf;
1135 	if (__predict_false(len < sizeof(*bss) + le32toh(bss->ieslen)))
1136 		return;
1137 
1138 	DPRINTFN(2, "found BSS %s: len=%d chan=%d inframode=%d "
1139 	    "networktype=%d privacy=%d\n",
1140 	    ether_sprintf(bss->macaddr), le32toh(bss->len),
1141 	    le32toh(bss->config.dsconfig), le32toh(bss->inframode),
1142 	    le32toh(bss->networktype), le32toh(bss->privacy));
1143 
1144 	/* Build a fake beacon frame to let net80211 do all the parsing. */
1145 	pktlen = sizeof(*wh) + le32toh(bss->ieslen);
1146 	if (__predict_false(pktlen > MCLBYTES))
1147 		return;
1148 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1149 	if (__predict_false(m == NULL))
1150 		return;
1151 	if (pktlen > MHLEN) {
1152 		MCLGET(m, M_DONTWAIT);
1153 		if (!(m->m_flags & M_EXT)) {
1154 			m_free(m);
1155 			return;
1156 		}
1157 	}
1158 	wh = mtod(m, struct ieee80211_frame *);
1159 	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
1160 	    IEEE80211_FC0_SUBTYPE_BEACON;
1161 	wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1162 	USETW(wh->i_dur, 0);
1163 	IEEE80211_ADDR_COPY(wh->i_addr1, ifp->if_broadcastaddr);
1164 	IEEE80211_ADDR_COPY(wh->i_addr2, bss->macaddr);
1165 	IEEE80211_ADDR_COPY(wh->i_addr3, bss->macaddr);
1166 	*(uint16_t *)wh->i_seq = 0;
1167 	memcpy(&wh[1], (uint8_t *)&bss[1], le32toh(bss->ieslen));
1168 
1169 	/* Finalize mbuf. */
1170 	m->m_pkthdr.len = m->m_len = pktlen;
1171 	m->m_pkthdr.rcvif = ifp;
1172 	/* Fix the channel. */
1173 	c = ieee80211_find_channel_byieee(ic,
1174 	    le32toh(bss->config.dsconfig),
1175 	    IEEE80211_CHAN_G);
1176 	if (c) {
1177 		ic->ic_curchan = c;
1178 		ieee80211_radiotap_chan_change(ic);
1179 	}
1180 	/* XXX avoid a LOR */
1181 	RSU_UNLOCK(sc);
1182 	ieee80211_input_all(ic, m, le32toh(bss->rssi), 0);
1183 	RSU_LOCK(sc);
1184 }
1185 
1186 static void
1187 rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
1188 {
1189 	struct ifnet *ifp = sc->sc_ifp;
1190 	struct ieee80211com *ic = ifp->if_l2com;
1191 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1192 	struct ieee80211_node *ni = vap->iv_bss;
1193 	struct r92s_event_join_bss *rsp;
1194 	int res;
1195 
1196 	if (__predict_false(len < sizeof(*rsp)))
1197 		return;
1198 	rsp = (struct r92s_event_join_bss *)buf;
1199 	res = (int)le32toh(rsp->join_res);
1200 
1201 	DPRINTF("Rx join BSS event len=%d res=%d\n", len, res);
1202 	if (res <= 0) {
1203 		RSU_UNLOCK(sc);
1204 		ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
1205 		RSU_LOCK(sc);
1206 		return;
1207 	}
1208 	DPRINTF("associated with %s associd=%d\n",
1209 	    ether_sprintf(rsp->bss.macaddr), le32toh(rsp->associd));
1210 	ni->ni_associd = le32toh(rsp->associd) | 0xc000;
1211 	RSU_UNLOCK(sc);
1212 	ieee80211_new_state(vap, IEEE80211_S_RUN,
1213 	    IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
1214 	RSU_LOCK(sc);
1215 }
1216 
1217 static void
1218 rsu_rx_event(struct rsu_softc *sc, uint8_t code, uint8_t *buf, int len)
1219 {
1220 	struct ifnet *ifp = sc->sc_ifp;
1221 	struct ieee80211com *ic = ifp->if_l2com;
1222 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1223 
1224 	DPRINTFN(4, "Rx event code=%d len=%d\n", code, len);
1225 	switch (code) {
1226 	case R92S_EVT_SURVEY:
1227 		if (vap->iv_state == IEEE80211_S_SCAN)
1228 			rsu_event_survey(sc, buf, len);
1229 		break;
1230 	case R92S_EVT_SURVEY_DONE:
1231 		DPRINTF("site survey pass %d done, found %d BSS\n",
1232 		    sc->scan_pass, le32toh(*(uint32_t *)buf));
1233 		if (vap->iv_state != IEEE80211_S_SCAN)
1234 			break;	/* Ignore if not scanning. */
1235 		if (sc->scan_pass == 0 && vap->iv_des_nssid != 0) {
1236 			/* Schedule a directed scan for hidden APs. */
1237 			sc->scan_pass = 1;
1238 			RSU_UNLOCK(sc);
1239 			ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
1240 			RSU_LOCK(sc);
1241 			break;
1242 		}
1243 		sc->scan_pass = 0;
1244 		break;
1245 	case R92S_EVT_JOIN_BSS:
1246 		if (vap->iv_state == IEEE80211_S_AUTH)
1247 			rsu_event_join_bss(sc, buf, len);
1248 		break;
1249 	case R92S_EVT_DEL_STA:
1250 		DPRINTF("disassociated from %s\n", ether_sprintf(buf));
1251 		if (vap->iv_state == IEEE80211_S_RUN &&
1252 		    IEEE80211_ADDR_EQ(vap->iv_bss->ni_bssid, buf)) {
1253 			RSU_UNLOCK(sc);
1254 			ieee80211_new_state(vap, IEEE80211_S_SCAN, -1);
1255 			RSU_LOCK(sc);
1256 		}
1257 		break;
1258 	case R92S_EVT_WPS_PBC:
1259 		DPRINTF("WPS PBC pushed.\n");
1260 		break;
1261 	case R92S_EVT_FWDBG:
1262 		if (ifp->if_flags & IFF_DEBUG) {
1263 			buf[60] = '\0';
1264 			printf("FWDBG: %s\n", (char *)buf);
1265 		}
1266 		break;
1267 	}
1268 }
1269 
1270 static void
1271 rsu_rx_multi_event(struct rsu_softc *sc, uint8_t *buf, int len)
1272 {
1273 	struct r92s_fw_cmd_hdr *cmd;
1274 	int cmdsz;
1275 
1276 	DPRINTFN(6, "Rx events len=%d\n", len);
1277 
1278 	/* Skip Rx status. */
1279 	buf += sizeof(struct r92s_rx_stat);
1280 	len -= sizeof(struct r92s_rx_stat);
1281 
1282 	/* Process all events. */
1283 	for (;;) {
1284 		/* Check that command header fits. */
1285 		if (__predict_false(len < sizeof(*cmd)))
1286 			break;
1287 		cmd = (struct r92s_fw_cmd_hdr *)buf;
1288 		/* Check that command payload fits. */
1289 		cmdsz = le16toh(cmd->len);
1290 		if (__predict_false(len < sizeof(*cmd) + cmdsz))
1291 			break;
1292 
1293 		/* Process firmware event. */
1294 		rsu_rx_event(sc, cmd->code, (uint8_t *)&cmd[1], cmdsz);
1295 
1296 		if (!(cmd->seq & R92S_FW_CMD_MORE))
1297 			break;
1298 		buf += sizeof(*cmd) + cmdsz;
1299 		len -= sizeof(*cmd) + cmdsz;
1300 	}
1301 }
1302 
1303 static int8_t
1304 rsu_get_rssi(struct rsu_softc *sc, int rate, void *physt)
1305 {
1306 	static const int8_t cckoff[] = { 14, -2, -20, -40 };
1307 	struct r92s_rx_phystat *phy;
1308 	struct r92s_rx_cck *cck;
1309 	uint8_t rpt;
1310 	int8_t rssi;
1311 
1312 	if (rate <= 3) {
1313 		cck = (struct r92s_rx_cck *)physt;
1314 		rpt = (cck->agc_rpt >> 6) & 0x3;
1315 		rssi = cck->agc_rpt & 0x3e;
1316 		rssi = cckoff[rpt] - rssi;
1317 	} else {	/* OFDM/HT. */
1318 		phy = (struct r92s_rx_phystat *)physt;
1319 		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 106;
1320 	}
1321 	return (rssi);
1322 }
1323 
1324 static struct mbuf *
1325 rsu_rx_frame(struct rsu_softc *sc, uint8_t *buf, int pktlen, int *rssi)
1326 {
1327 	struct ifnet *ifp = sc->sc_ifp;
1328 	struct ieee80211com *ic = ifp->if_l2com;
1329 	struct ieee80211_frame *wh;
1330 	struct r92s_rx_stat *stat;
1331 	uint32_t rxdw0, rxdw3;
1332 	struct mbuf *m;
1333 	uint8_t rate;
1334 	int infosz;
1335 
1336 	stat = (struct r92s_rx_stat *)buf;
1337 	rxdw0 = le32toh(stat->rxdw0);
1338 	rxdw3 = le32toh(stat->rxdw3);
1339 
1340 	if (__predict_false(rxdw0 & R92S_RXDW0_CRCERR)) {
1341 		ifp->if_ierrors++;
1342 		return NULL;
1343 	}
1344 	if (__predict_false(pktlen < sizeof(*wh) || pktlen > MCLBYTES)) {
1345 		ifp->if_ierrors++;
1346 		return NULL;
1347 	}
1348 
1349 	rate = MS(rxdw3, R92S_RXDW3_RATE);
1350 	infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
1351 
1352 	/* Get RSSI from PHY status descriptor if present. */
1353 	if (infosz != 0)
1354 		*rssi = rsu_get_rssi(sc, rate, &stat[1]);
1355 	else
1356 		*rssi = 0;
1357 
1358 	DPRINTFN(5, "Rx frame len=%d rate=%d infosz=%d rssi=%d\n",
1359 	    pktlen, rate, infosz, *rssi);
1360 
1361 	MGETHDR(m, M_DONTWAIT, MT_DATA);
1362 	if (__predict_false(m == NULL)) {
1363 		ifp->if_ierrors++;
1364 		return NULL;
1365 	}
1366 	if (pktlen > MHLEN) {
1367 		MCLGET(m, M_DONTWAIT);
1368 		if (__predict_false(!(m->m_flags & M_EXT))) {
1369 			ifp->if_ierrors++;
1370 			m_freem(m);
1371 			return NULL;
1372 		}
1373 	}
1374 	/* Finalize mbuf. */
1375 	m->m_pkthdr.rcvif = ifp;
1376 	/* Hardware does Rx TCP checksum offload. */
1377 	if (rxdw3 & R92S_RXDW3_TCPCHKVALID) {
1378 		if (__predict_true(rxdw3 & R92S_RXDW3_TCPCHKRPT))
1379 			m->m_pkthdr.csum_flags |= CSUM_DATA_VALID;
1380 	}
1381 	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
1382 	memcpy(mtod(m, uint8_t *), wh, pktlen);
1383 	m->m_pkthdr.len = m->m_len = pktlen;
1384 
1385 	if (ieee80211_radiotap_active(ic)) {
1386 		struct rsu_rx_radiotap_header *tap = &sc->sc_rxtap;
1387 
1388 		/* Map HW rate index to 802.11 rate. */
1389 		tap->wr_flags = 2;
1390 		if (!(rxdw3 & R92S_RXDW3_HTC)) {
1391 			switch (rate) {
1392 			/* CCK. */
1393 			case  0: tap->wr_rate =   2; break;
1394 			case  1: tap->wr_rate =   4; break;
1395 			case  2: tap->wr_rate =  11; break;
1396 			case  3: tap->wr_rate =  22; break;
1397 			/* OFDM. */
1398 			case  4: tap->wr_rate =  12; break;
1399 			case  5: tap->wr_rate =  18; break;
1400 			case  6: tap->wr_rate =  24; break;
1401 			case  7: tap->wr_rate =  36; break;
1402 			case  8: tap->wr_rate =  48; break;
1403 			case  9: tap->wr_rate =  72; break;
1404 			case 10: tap->wr_rate =  96; break;
1405 			case 11: tap->wr_rate = 108; break;
1406 			}
1407 		} else if (rate >= 12) {	/* MCS0~15. */
1408 			/* Bit 7 set means HT MCS instead of rate. */
1409 			tap->wr_rate = 0x80 | (rate - 12);
1410 		}
1411 		tap->wr_dbm_antsignal = *rssi;
1412 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1413 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1414 	}
1415 
1416 	return (m);
1417 }
1418 
1419 static struct mbuf *
1420 rsu_rx_multi_frame(struct rsu_softc *sc, uint8_t *buf, int len, int *rssi)
1421 {
1422 	struct r92s_rx_stat *stat;
1423 	uint32_t rxdw0;
1424 	int totlen, pktlen, infosz, npkts;
1425 	struct mbuf *m, *m0 = NULL, *prevm = NULL;
1426 
1427 	/* Get the number of encapsulated frames. */
1428 	stat = (struct r92s_rx_stat *)buf;
1429 	npkts = MS(le32toh(stat->rxdw2), R92S_RXDW2_PKTCNT);
1430 	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
1431 
1432 	/* Process all of them. */
1433 	while (npkts-- > 0) {
1434 		if (__predict_false(len < sizeof(*stat)))
1435 			break;
1436 		stat = (struct r92s_rx_stat *)buf;
1437 		rxdw0 = le32toh(stat->rxdw0);
1438 
1439 		pktlen = MS(rxdw0, R92S_RXDW0_PKTLEN);
1440 		if (__predict_false(pktlen == 0))
1441 			break;
1442 
1443 		infosz = MS(rxdw0, R92S_RXDW0_INFOSZ) * 8;
1444 
1445 		/* Make sure everything fits in xfer. */
1446 		totlen = sizeof(*stat) + infosz + pktlen;
1447 		if (__predict_false(totlen > len))
1448 			break;
1449 
1450 		/* Process 802.11 frame. */
1451 		m = rsu_rx_frame(sc, buf, pktlen, rssi);
1452 		if (m0 == NULL)
1453 			m0 = m;
1454 		if (prevm == NULL)
1455 			prevm = m;
1456 		else {
1457 			prevm->m_next = m;
1458 			prevm = m;
1459 		}
1460 		/* Next chunk is 128-byte aligned. */
1461 		totlen = (totlen + 127) & ~127;
1462 		buf += totlen;
1463 		len -= totlen;
1464 	}
1465 
1466 	return (m0);
1467 }
1468 
1469 static struct mbuf *
1470 rsu_rxeof(struct usb_xfer *xfer, struct rsu_data *data, int *rssi)
1471 {
1472 	struct rsu_softc *sc = data->sc;
1473 	struct r92s_rx_stat *stat;
1474 	int len;
1475 
1476 	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
1477 
1478 	if (__predict_false(len < sizeof(*stat))) {
1479 		DPRINTF("xfer too short %d\n", len);
1480 		sc->sc_ifp->if_ierrors++;
1481 		return (NULL);
1482 	}
1483 	/* Determine if it is a firmware C2H event or an 802.11 frame. */
1484 	stat = (struct r92s_rx_stat *)data->buf;
1485 	if ((le32toh(stat->rxdw1) & 0x1ff) == 0x1ff) {
1486 		rsu_rx_multi_event(sc, data->buf, len);
1487 		/* No packets to process. */
1488 		return (NULL);
1489 	} else
1490 		return (rsu_rx_multi_frame(sc, data->buf, len, rssi));
1491 }
1492 
1493 static void
1494 rsu_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1495 {
1496 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
1497 	struct ifnet *ifp = sc->sc_ifp;
1498 	struct ieee80211com *ic = ifp->if_l2com;
1499 	struct ieee80211_frame *wh;
1500 	struct ieee80211_node *ni;
1501 	struct mbuf *m = NULL, *next;
1502 	struct rsu_data *data;
1503 	int rssi = 1;
1504 
1505 	RSU_ASSERT_LOCKED(sc);
1506 
1507 	switch (USB_GET_STATE(xfer)) {
1508 	case USB_ST_TRANSFERRED:
1509 		data = STAILQ_FIRST(&sc->sc_rx_active);
1510 		if (data == NULL)
1511 			goto tr_setup;
1512 		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1513 		m = rsu_rxeof(xfer, data, &rssi);
1514 		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1515 		/* FALLTHROUGH */
1516 	case USB_ST_SETUP:
1517 tr_setup:
1518 		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1519 		if (data == NULL) {
1520 			KASSERT(m == NULL, ("mbuf isn't NULL"));
1521 			return;
1522 		}
1523 		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1524 		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1525 		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1526 		    usbd_xfer_max_len(xfer));
1527 		usbd_transfer_submit(xfer);
1528 		/*
1529 		 * To avoid LOR we should unlock our private mutex here to call
1530 		 * ieee80211_input() because here is at the end of a USB
1531 		 * callback and safe to unlock.
1532 		 */
1533 		RSU_UNLOCK(sc);
1534 		while (m != NULL) {
1535 			next = m->m_next;
1536 			m->m_next = NULL;
1537 			wh = mtod(m, struct ieee80211_frame *);
1538 			ni = ieee80211_find_rxnode(ic,
1539 			    (struct ieee80211_frame_min *)wh);
1540 			if (ni != NULL) {
1541 				(void)ieee80211_input(ni, m, rssi, 0);
1542 				ieee80211_free_node(ni);
1543 			} else
1544 				(void)ieee80211_input_all(ic, m, rssi, 0);
1545 			m = next;
1546 		}
1547 		RSU_LOCK(sc);
1548 		break;
1549 	default:
1550 		/* needs it to the inactive queue due to a error. */
1551 		data = STAILQ_FIRST(&sc->sc_rx_active);
1552 		if (data != NULL) {
1553 			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1554 			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1555 		}
1556 		if (error != USB_ERR_CANCELLED) {
1557 			usbd_xfer_set_stall(xfer);
1558 			ifp->if_ierrors++;
1559 			goto tr_setup;
1560 		}
1561 		break;
1562 	}
1563 
1564 }
1565 
1566 
1567 static void
1568 rsu_txeof(struct usb_xfer *xfer, struct rsu_data *data)
1569 {
1570 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
1571 	struct ifnet *ifp = sc->sc_ifp;
1572 	struct mbuf *m;
1573 
1574 	RSU_ASSERT_LOCKED(sc);
1575 
1576 	/*
1577 	 * Do any tx complete callback.  Note this must be done before releasing
1578 	 * the node reference.
1579 	 */
1580 	if (data->m) {
1581 		m = data->m;
1582 		if (m->m_flags & M_TXCB) {
1583 			/* XXX status? */
1584 			ieee80211_process_callback(data->ni, m, 0);
1585 		}
1586 		m_freem(m);
1587 		data->m = NULL;
1588 	}
1589 	if (data->ni) {
1590 		ieee80211_free_node(data->ni);
1591 		data->ni = NULL;
1592 	}
1593 	sc->sc_tx_timer = 0;
1594 	ifp->if_opackets++;
1595 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1596 }
1597 
1598 static void
1599 rsu_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1600 {
1601 	struct rsu_softc *sc = usbd_xfer_softc(xfer);
1602 	struct ifnet *ifp = sc->sc_ifp;
1603 	struct rsu_data *data;
1604 
1605 	RSU_ASSERT_LOCKED(sc);
1606 
1607 	switch (USB_GET_STATE(xfer)) {
1608 	case USB_ST_TRANSFERRED:
1609 		data = STAILQ_FIRST(&sc->sc_tx_active);
1610 		if (data == NULL)
1611 			goto tr_setup;
1612 		DPRINTF("transfer done %p\n", data);
1613 		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1614 		rsu_txeof(xfer, data);
1615 		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1616 		/* FALLTHROUGH */
1617 	case USB_ST_SETUP:
1618 tr_setup:
1619 		data = STAILQ_FIRST(&sc->sc_tx_pending);
1620 		if (data == NULL) {
1621 			DPRINTF("empty pending queue sc %p\n", sc);
1622 			return;
1623 		}
1624 		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1625 		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1626 		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1627 		DPRINTF("submitting transfer %p\n", data);
1628 		usbd_transfer_submit(xfer);
1629 		rsu_start_locked(ifp);
1630 		break;
1631 	default:
1632 		data = STAILQ_FIRST(&sc->sc_tx_active);
1633 		if (data == NULL)
1634 			goto tr_setup;
1635 		if (data->ni != NULL) {
1636 			ieee80211_free_node(data->ni);
1637 			data->ni = NULL;
1638 			ifp->if_oerrors++;
1639 		}
1640 		if (error != USB_ERR_CANCELLED) {
1641 			usbd_xfer_set_stall(xfer);
1642 			goto tr_setup;
1643 		}
1644 		break;
1645 	}
1646 }
1647 
1648 static int
1649 rsu_tx_start(struct rsu_softc *sc, struct ieee80211_node *ni,
1650     struct mbuf *m0, struct rsu_data *data)
1651 {
1652 	struct ifnet *ifp = sc->sc_ifp;
1653 	struct ieee80211com *ic = ifp->if_l2com;
1654         struct ieee80211vap *vap = ni->ni_vap;
1655 	struct ieee80211_frame *wh;
1656 	struct ieee80211_key *k = NULL;
1657 	struct r92s_tx_desc *txd;
1658 	struct usb_xfer *xfer;
1659 	uint8_t type, tid = 0;
1660 	int hasqos, xferlen;
1661 	struct usb_xfer *rsu_pipes[4] = {
1662 		sc->sc_xfer[RSU_BULK_TX_BE],
1663 		sc->sc_xfer[RSU_BULK_TX_BK],
1664 		sc->sc_xfer[RSU_BULK_TX_VI],
1665 		sc->sc_xfer[RSU_BULK_TX_VO]
1666 	};
1667 
1668 	RSU_ASSERT_LOCKED(sc);
1669 
1670 	wh = mtod(m0, struct ieee80211_frame *);
1671 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1672 
1673 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1674 		k = ieee80211_crypto_encap(ni, m0);
1675 		if (k == NULL) {
1676 			device_printf(sc->sc_dev,
1677 			    "ieee80211_crypto_encap returns NULL.\n");
1678 			/* XXX we don't expect the fragmented frames */
1679 			m_freem(m0);
1680 			return (ENOBUFS);
1681 		}
1682 		wh = mtod(m0, struct ieee80211_frame *);
1683 	}
1684 	switch (type) {
1685 	case IEEE80211_FC0_TYPE_CTL:
1686 	case IEEE80211_FC0_TYPE_MGT:
1687 		xfer = sc->sc_xfer[RSU_BULK_TX_VO];
1688 		break;
1689 	default:
1690 		KASSERT(M_WME_GETAC(m0) < 4,
1691 		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1692 		xfer = rsu_pipes[M_WME_GETAC(m0)];
1693 		break;
1694 	}
1695 	hasqos = 0;
1696 
1697 	/* Fill Tx descriptor. */
1698 	txd = (struct r92s_tx_desc *)data->buf;
1699 	memset(txd, 0, sizeof(*txd));
1700 
1701 	txd->txdw0 |= htole32(
1702 	    SM(R92S_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1703 	    SM(R92S_TXDW0_OFFSET, sizeof(*txd)) |
1704 	    R92S_TXDW0_OWN | R92S_TXDW0_FSG | R92S_TXDW0_LSG);
1705 
1706 	txd->txdw1 |= htole32(
1707 	    SM(R92S_TXDW1_MACID, R92S_MACID_BSS) |
1708 	    SM(R92S_TXDW1_QSEL, R92S_TXDW1_QSEL_BE));
1709 	if (!hasqos)
1710 		txd->txdw1 |= htole32(R92S_TXDW1_NONQOS);
1711 #ifdef notyet
1712 	if (k != NULL) {
1713 		switch (k->wk_cipher->ic_cipher) {
1714 		case IEEE80211_CIPHER_WEP:
1715 			cipher = R92S_TXDW1_CIPHER_WEP;
1716 			break;
1717 		case IEEE80211_CIPHER_TKIP:
1718 			cipher = R92S_TXDW1_CIPHER_TKIP;
1719 			break;
1720 		case IEEE80211_CIPHER_AES_CCM:
1721 			cipher = R92S_TXDW1_CIPHER_AES;
1722 			break;
1723 		default:
1724 			cipher = R92S_TXDW1_CIPHER_NONE;
1725 		}
1726 		txd->txdw1 |= htole32(
1727 		    SM(R92S_TXDW1_CIPHER, cipher) |
1728 		    SM(R92S_TXDW1_KEYIDX, k->k_id));
1729 	}
1730 #endif
1731 	txd->txdw2 |= htole32(R92S_TXDW2_BK);
1732 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1733 		txd->txdw2 |= htole32(R92S_TXDW2_BMCAST);
1734 	/*
1735 	 * Firmware will use and increment the sequence number for the
1736 	 * specified TID.
1737 	 */
1738 	txd->txdw3 |= htole32(SM(R92S_TXDW3_SEQ, tid));
1739 
1740 	if (ieee80211_radiotap_active_vap(vap)) {
1741 		struct rsu_tx_radiotap_header *tap = &sc->sc_txtap;
1742 
1743 		tap->wt_flags = 0;
1744 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1745 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1746 		ieee80211_radiotap_tx(vap, m0);
1747 	}
1748 	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1749 	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1750 
1751 	data->buflen = xferlen;
1752 	data->ni = ni;
1753 	data->m = m0;
1754 	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1755 	usbd_transfer_start(xfer);
1756 
1757 	return (0);
1758 }
1759 
1760 static void
1761 rsu_start(struct ifnet *ifp)
1762 {
1763 	struct rsu_softc *sc = ifp->if_softc;
1764 
1765 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1766 		return;
1767 
1768 	RSU_LOCK(sc);
1769 	rsu_start_locked(ifp);
1770 	RSU_UNLOCK(sc);
1771 }
1772 
1773 static void
1774 rsu_start_locked(struct ifnet *ifp)
1775 {
1776 	struct rsu_softc *sc = ifp->if_softc;
1777 	struct ieee80211_node *ni;
1778 	struct mbuf *m;
1779 	struct rsu_data *bf;
1780 
1781 	RSU_ASSERT_LOCKED(sc);
1782 
1783 	for (;;) {
1784 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1785 		if (m == NULL)
1786 			break;
1787 		bf = rsu_getbuf(sc);
1788 		if (bf == NULL) {
1789 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1790 			break;
1791 		}
1792 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1793 		m->m_pkthdr.rcvif = NULL;
1794 
1795 		if (rsu_tx_start(sc, ni, m, bf) != 0) {
1796 			ifp->if_oerrors++;
1797 			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1798 			ieee80211_free_node(ni);
1799 			break;
1800 		}
1801 		sc->sc_tx_timer = 5;
1802 		callout_reset(&sc->sc_watchdog_ch, hz, rsu_watchdog, sc);
1803 	}
1804 }
1805 
1806 static void
1807 rsu_watchdog(void *arg)
1808 {
1809 	struct rsu_softc *sc = arg;
1810 	struct ifnet *ifp = sc->sc_ifp;
1811 
1812 	if (sc->sc_tx_timer > 0) {
1813 		if (--sc->sc_tx_timer == 0) {
1814 			device_printf(sc->sc_dev, "device timeout\n");
1815 			/* rsu_init(ifp); XXX needs a process context! */
1816 			ifp->if_oerrors++;
1817 			return;
1818 		}
1819 		callout_reset(&sc->sc_watchdog_ch, hz, rsu_watchdog, sc);
1820 	}
1821 }
1822 
1823 static int
1824 rsu_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1825 {
1826 	struct ieee80211com *ic = ifp->if_l2com;
1827 	struct ifreq *ifr = (struct ifreq *) data;
1828 	int error = 0, startall = 0;
1829 
1830 	switch (cmd) {
1831 	case SIOCSIFFLAGS:
1832 		if (ifp->if_flags & IFF_UP) {
1833 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1834 				rsu_init(ifp->if_softc);
1835 				startall = 1;
1836 			}
1837 		} else {
1838 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1839 				rsu_stop(ifp, 1);
1840 		}
1841 		if (startall)
1842 			ieee80211_start_all(ic);
1843 		break;
1844 	case SIOCGIFMEDIA:
1845 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1846 		break;
1847 	case SIOCGIFADDR:
1848 		error = ether_ioctl(ifp, cmd, data);
1849 		break;
1850 	default:
1851 		error = EINVAL;
1852 		break;
1853 	}
1854 
1855 	return (error);
1856 }
1857 
1858 /*
1859  * Power on sequence for A-cut adapters.
1860  */
1861 static void
1862 rsu_power_on_acut(struct rsu_softc *sc)
1863 {
1864 	uint32_t reg;
1865 
1866 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
1867 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
1868 
1869 	/* Enable AFE macro block's bandgap and Mbias. */
1870 	rsu_write_1(sc, R92S_AFE_MISC,
1871 	    rsu_read_1(sc, R92S_AFE_MISC) |
1872 	    R92S_AFE_MISC_BGEN | R92S_AFE_MISC_MBEN);
1873 	/* Enable LDOA15 block. */
1874 	rsu_write_1(sc, R92S_LDOA15_CTRL,
1875 	    rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
1876 
1877 	rsu_write_1(sc, R92S_SPS1_CTRL,
1878 	    rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_LDEN);
1879 	usb_pause_mtx(&sc->sc_mtx, 2 * hz);
1880 	/* Enable switch regulator block. */
1881 	rsu_write_1(sc, R92S_SPS1_CTRL,
1882 	    rsu_read_1(sc, R92S_SPS1_CTRL) | R92S_SPS1_SWEN);
1883 
1884 	rsu_write_4(sc, R92S_SPS1_CTRL, 0x00a7b267);
1885 
1886 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
1887 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
1888 
1889 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
1890 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
1891 
1892 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
1893 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x90);
1894 
1895 	/* Enable AFE clock. */
1896 	rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
1897 	    rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
1898 	/* Enable AFE PLL macro block. */
1899 	rsu_write_1(sc, R92S_AFE_PLL_CTRL,
1900 	    rsu_read_1(sc, R92S_AFE_PLL_CTRL) | 0x11);
1901 	/* Attach AFE PLL to MACTOP/BB. */
1902 	rsu_write_1(sc, R92S_SYS_ISO_CTRL,
1903 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
1904 
1905 	/* Switch to 40MHz clock instead of 80MHz. */
1906 	rsu_write_2(sc, R92S_SYS_CLKR,
1907 	    rsu_read_2(sc, R92S_SYS_CLKR) & ~R92S_SYS_CLKSEL);
1908 
1909 	/* Enable MAC clock. */
1910 	rsu_write_2(sc, R92S_SYS_CLKR,
1911 	    rsu_read_2(sc, R92S_SYS_CLKR) |
1912 	    R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
1913 
1914 	rsu_write_1(sc, R92S_PMC_FSM, 0x02);
1915 
1916 	/* Enable digital core and IOREG R/W. */
1917 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
1918 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
1919 
1920 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
1921 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
1922 
1923 	/* Switch the control path to firmware. */
1924 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
1925 	reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
1926 	rsu_write_2(sc, R92S_SYS_CLKR, reg);
1927 
1928 	rsu_write_2(sc, R92S_CR, 0x37fc);
1929 
1930 	/* Fix USB RX FIFO issue. */
1931 	rsu_write_1(sc, 0xfe5c,
1932 	    rsu_read_1(sc, 0xfe5c) | 0x80);
1933 	rsu_write_1(sc, 0x00ab,
1934 	    rsu_read_1(sc, 0x00ab) | 0xc0);
1935 
1936 	rsu_write_1(sc, R92S_SYS_CLKR,
1937 	    rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
1938 }
1939 
1940 /*
1941  * Power on sequence for B-cut and C-cut adapters.
1942  */
1943 static void
1944 rsu_power_on_bcut(struct rsu_softc *sc)
1945 {
1946 	uint32_t reg;
1947 	int ntries;
1948 
1949 	/* Prevent eFuse leakage. */
1950 	rsu_write_1(sc, 0x37, 0xb0);
1951 	usb_pause_mtx(&sc->sc_mtx, 10);
1952 	rsu_write_1(sc, 0x37, 0x30);
1953 
1954 	/* Switch the control path to hardware. */
1955 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
1956 	if (reg & R92S_FWHW_SEL) {
1957 		rsu_write_2(sc, R92S_SYS_CLKR,
1958 		    reg & ~(R92S_SWHW_SEL | R92S_FWHW_SEL));
1959 	}
1960 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
1961 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) & ~0x8c);
1962 	DELAY(1000);
1963 
1964 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x53);
1965 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x57);
1966 
1967 	reg = rsu_read_1(sc, R92S_AFE_MISC);
1968 	rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN);
1969 	rsu_write_1(sc, R92S_AFE_MISC, reg | R92S_AFE_MISC_BGEN |
1970 	    R92S_AFE_MISC_MBEN | R92S_AFE_MISC_I32_EN);
1971 
1972 	/* Enable PLL. */
1973 	rsu_write_1(sc, R92S_LDOA15_CTRL,
1974 	    rsu_read_1(sc, R92S_LDOA15_CTRL) | R92S_LDA15_EN);
1975 
1976 	rsu_write_1(sc, R92S_LDOV12D_CTRL,
1977 	    rsu_read_1(sc, R92S_LDOV12D_CTRL) | R92S_LDV12_EN);
1978 
1979 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
1980 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) | 0x08);
1981 
1982 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
1983 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x20);
1984 
1985 	/* Support 64KB IMEM. */
1986 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1,
1987 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL + 1) & ~0x97);
1988 
1989 	/* Enable AFE clock. */
1990 	rsu_write_1(sc, R92S_AFE_XTAL_CTRL + 1,
1991 	    rsu_read_1(sc, R92S_AFE_XTAL_CTRL + 1) & ~0x04);
1992 	/* Enable AFE PLL macro block. */
1993 	reg = rsu_read_1(sc, R92S_AFE_PLL_CTRL);
1994 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
1995 	DELAY(500);
1996 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x51);
1997 	DELAY(500);
1998 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, reg | 0x11);
1999 	DELAY(500);
2000 
2001 	/* Attach AFE PLL to MACTOP/BB. */
2002 	rsu_write_1(sc, R92S_SYS_ISO_CTRL,
2003 	    rsu_read_1(sc, R92S_SYS_ISO_CTRL) & ~0x11);
2004 
2005 	/* Switch to 40MHz clock. */
2006 	rsu_write_1(sc, R92S_SYS_CLKR, 0x00);
2007 	/* Disable CPU clock and 80MHz SSC. */
2008 	rsu_write_1(sc, R92S_SYS_CLKR,
2009 	    rsu_read_1(sc, R92S_SYS_CLKR) | 0xa0);
2010 	/* Enable MAC clock. */
2011 	rsu_write_2(sc, R92S_SYS_CLKR,
2012 	    rsu_read_2(sc, R92S_SYS_CLKR) |
2013 	    R92S_MAC_CLK_EN | R92S_SYS_CLK_EN);
2014 
2015 	rsu_write_1(sc, R92S_PMC_FSM, 0x02);
2016 
2017 	/* Enable digital core and IOREG R/W. */
2018 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
2019 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x08);
2020 
2021 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1,
2022 	    rsu_read_1(sc, R92S_SYS_FUNC_EN + 1) | 0x80);
2023 
2024 	/* Switch the control path to firmware. */
2025 	reg = rsu_read_2(sc, R92S_SYS_CLKR);
2026 	reg = (reg & ~R92S_SWHW_SEL) | R92S_FWHW_SEL;
2027 	rsu_write_2(sc, R92S_SYS_CLKR, reg);
2028 
2029 	rsu_write_2(sc, R92S_CR, 0x37fc);
2030 
2031 	/* Fix USB RX FIFO issue. */
2032 	rsu_write_1(sc, 0xfe5c,
2033 	    rsu_read_1(sc, 0xfe5c) | 0x80);
2034 
2035 	rsu_write_1(sc, R92S_SYS_CLKR,
2036 	    rsu_read_1(sc, R92S_SYS_CLKR) & ~R92S_SYS_CPU_CLKSEL);
2037 
2038 	rsu_write_1(sc, 0xfe1c, 0x80);
2039 
2040 	/* Make sure TxDMA is ready to download firmware. */
2041 	for (ntries = 0; ntries < 20; ntries++) {
2042 		reg = rsu_read_1(sc, R92S_TCR);
2043 		if ((reg & (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT)) ==
2044 		    (R92S_TCR_IMEM_CHK_RPT | R92S_TCR_EMEM_CHK_RPT))
2045 			break;
2046 		DELAY(5);
2047 	}
2048 	if (ntries == 20) {
2049 		DPRINTF("TxDMA is not ready\n");
2050 		/* Reset TxDMA. */
2051 		reg = rsu_read_1(sc, R92S_CR);
2052 		rsu_write_1(sc, R92S_CR, reg & ~R92S_CR_TXDMA_EN);
2053 		DELAY(2);
2054 		rsu_write_1(sc, R92S_CR, reg | R92S_CR_TXDMA_EN);
2055 	}
2056 }
2057 
2058 static void
2059 rsu_power_off(struct rsu_softc *sc)
2060 {
2061 	/* Turn RF off. */
2062 	rsu_write_1(sc, R92S_RF_CTRL, 0x00);
2063 	usb_pause_mtx(&sc->sc_mtx, 5);
2064 
2065 	/* Turn MAC off. */
2066 	/* Switch control path. */
2067 	rsu_write_1(sc, R92S_SYS_CLKR + 1, 0x38);
2068 	/* Reset MACTOP. */
2069 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x70);
2070 	rsu_write_1(sc, R92S_PMC_FSM, 0x06);
2071 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 0, 0xf9);
2072 	rsu_write_1(sc, R92S_SYS_ISO_CTRL + 1, 0xe8);
2073 
2074 	/* Disable AFE PLL. */
2075 	rsu_write_1(sc, R92S_AFE_PLL_CTRL, 0x00);
2076 	/* Disable A15V. */
2077 	rsu_write_1(sc, R92S_LDOA15_CTRL, 0x54);
2078 	/* Disable eFuse 1.2V. */
2079 	rsu_write_1(sc, R92S_SYS_FUNC_EN + 1, 0x50);
2080 	rsu_write_1(sc, R92S_LDOV12D_CTRL, 0x24);
2081 	/* Enable AFE macro block's bandgap and Mbias. */
2082 	rsu_write_1(sc, R92S_AFE_MISC, 0x30);
2083 	/* Disable 1.6V LDO. */
2084 	rsu_write_1(sc, R92S_SPS0_CTRL + 0, 0x56);
2085 	rsu_write_1(sc, R92S_SPS0_CTRL + 1, 0x43);
2086 }
2087 
2088 static int
2089 rsu_fw_loadsection(struct rsu_softc *sc, const uint8_t *buf, int len)
2090 {
2091 	struct rsu_data *data;
2092 	struct r92s_tx_desc *txd;
2093 	int mlen;
2094 
2095 	while (len > 0) {
2096 		data = rsu_getbuf(sc);
2097 		if (data == NULL)
2098 			return (ENOMEM);
2099 		txd = (struct r92s_tx_desc *)data->buf;
2100 		memset(txd, 0, sizeof(*txd));
2101 		if (len <= RSU_TXBUFSZ - sizeof(*txd)) {
2102 			/* Last chunk. */
2103 			txd->txdw0 |= htole32(R92S_TXDW0_LINIP);
2104 			mlen = len;
2105 		} else
2106 			mlen = RSU_TXBUFSZ - sizeof(*txd);
2107 		txd->txdw0 |= htole32(SM(R92S_TXDW0_PKTLEN, mlen));
2108 		memcpy(&txd[1], buf, mlen);
2109 		data->buflen = sizeof(*txd) + mlen;
2110 		DPRINTF("starting transfer %p\n", data);
2111 		STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2112 		buf += mlen;
2113 		len -= mlen;
2114 	}
2115 	usbd_transfer_start(sc->sc_xfer[RSU_BULK_TX_VO]);
2116 
2117 	return (0);
2118 }
2119 
2120 static int
2121 rsu_load_firmware(struct rsu_softc *sc)
2122 {
2123 	const struct r92s_fw_hdr *hdr;
2124 	struct r92s_fw_priv *dmem;
2125 	const uint8_t *imem, *emem;
2126 	int imemsz, ememsz;
2127 	const struct firmware *fw;
2128 	size_t size;
2129 	uint32_t reg;
2130 	int ntries, error;
2131 
2132 	RSU_UNLOCK(sc);
2133 	/* Read firmware image from the filesystem. */
2134 	if ((fw = firmware_get("rsu-rtl8712fw")) == NULL) {
2135 		device_printf(sc->sc_dev,
2136 		    "%s: failed load firmware of file rsu-rtl8712fw\n",
2137 		    __func__);
2138 		RSU_LOCK(sc);
2139 		return (ENXIO);
2140 	}
2141 	RSU_LOCK(sc);
2142 	size = fw->datasize;
2143 	if (size < sizeof(*hdr)) {
2144 		device_printf(sc->sc_dev, "firmware too short\n");
2145 		error = EINVAL;
2146 		goto fail;
2147 	}
2148 	hdr = (const struct r92s_fw_hdr *)fw->data;
2149 	if (hdr->signature != htole16(0x8712) &&
2150 	    hdr->signature != htole16(0x8192)) {
2151 		device_printf(sc->sc_dev,
2152 		    "invalid firmware signature 0x%x\n",
2153 		    le16toh(hdr->signature));
2154 		error = EINVAL;
2155 		goto fail;
2156 	}
2157 	DPRINTF("FW V%d %02x-%02x %02x:%02x\n", le16toh(hdr->version),
2158 	    hdr->month, hdr->day, hdr->hour, hdr->minute);
2159 
2160 	/* Make sure that driver and firmware are in sync. */
2161 	if (hdr->privsz != htole32(sizeof(*dmem))) {
2162 		device_printf(sc->sc_dev, "unsupported firmware image\n");
2163 		error = EINVAL;
2164 		goto fail;
2165 	}
2166 	/* Get FW sections sizes. */
2167 	imemsz = le32toh(hdr->imemsz);
2168 	ememsz = le32toh(hdr->sramsz);
2169 	/* Check that all FW sections fit in image. */
2170 	if (size < sizeof(*hdr) + imemsz + ememsz) {
2171 		device_printf(sc->sc_dev, "firmware too short\n");
2172 		error = EINVAL;
2173 		goto fail;
2174 	}
2175 	imem = (const uint8_t *)&hdr[1];
2176 	emem = imem + imemsz;
2177 
2178 	/* Load IMEM section. */
2179 	error = rsu_fw_loadsection(sc, imem, imemsz);
2180 	if (error != 0) {
2181 		device_printf(sc->sc_dev,
2182 		    "could not load firmware section %s\n", "IMEM");
2183 		goto fail;
2184 	}
2185 	/* Wait for load to complete. */
2186 	for (ntries = 0; ntries < 10; ntries++) {
2187 		usb_pause_mtx(&sc->sc_mtx, 10);
2188 		reg = rsu_read_2(sc, R92S_TCR);
2189 		if (reg & R92S_TCR_IMEM_CODE_DONE)
2190 			break;
2191 	}
2192 	if (ntries == 10 || !(reg & R92S_TCR_IMEM_CHK_RPT)) {
2193 		device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
2194 		    "IMEM");
2195 		error = ETIMEDOUT;
2196 		goto fail;
2197 	}
2198 
2199 	/* Load EMEM section. */
2200 	error = rsu_fw_loadsection(sc, emem, ememsz);
2201 	if (error != 0) {
2202 		device_printf(sc->sc_dev,
2203 		    "could not load firmware section %s\n", "EMEM");
2204 		goto fail;
2205 	}
2206 	/* Wait for load to complete. */
2207 	for (ntries = 0; ntries < 10; ntries++) {
2208 		usb_pause_mtx(&sc->sc_mtx, 10);
2209 		reg = rsu_read_2(sc, R92S_TCR);
2210 		if (reg & R92S_TCR_EMEM_CODE_DONE)
2211 			break;
2212 	}
2213 	if (ntries == 10 || !(reg & R92S_TCR_EMEM_CHK_RPT)) {
2214 		device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
2215 		    "EMEM");
2216 		error = ETIMEDOUT;
2217 		goto fail;
2218 	}
2219 
2220 	/* Enable CPU. */
2221 	rsu_write_1(sc, R92S_SYS_CLKR,
2222 	    rsu_read_1(sc, R92S_SYS_CLKR) | R92S_SYS_CPU_CLKSEL);
2223 	if (!(rsu_read_1(sc, R92S_SYS_CLKR) & R92S_SYS_CPU_CLKSEL)) {
2224 		device_printf(sc->sc_dev, "could not enable system clock\n");
2225 		error = EIO;
2226 		goto fail;
2227 	}
2228 	rsu_write_2(sc, R92S_SYS_FUNC_EN,
2229 	    rsu_read_2(sc, R92S_SYS_FUNC_EN) | R92S_FEN_CPUEN);
2230 	if (!(rsu_read_2(sc, R92S_SYS_FUNC_EN) & R92S_FEN_CPUEN)) {
2231 		device_printf(sc->sc_dev,
2232 		    "could not enable microcontroller\n");
2233 		error = EIO;
2234 		goto fail;
2235 	}
2236 	/* Wait for CPU to initialize. */
2237 	for (ntries = 0; ntries < 100; ntries++) {
2238 		if (rsu_read_2(sc, R92S_TCR) & R92S_TCR_IMEM_RDY)
2239 			break;
2240 		DELAY(1000);
2241 	}
2242 	if (ntries == 100) {
2243 		device_printf(sc->sc_dev,
2244 		    "timeout waiting for microcontroller\n");
2245 		error = ETIMEDOUT;
2246 		goto fail;
2247 	}
2248 
2249 	/* Update DMEM section before loading. */
2250 	dmem = __DECONST(struct r92s_fw_priv *, &hdr->priv);
2251 	memset(dmem, 0, sizeof(*dmem));
2252 	dmem->hci_sel = R92S_HCI_SEL_USB | R92S_HCI_SEL_8172;
2253 	dmem->nendpoints = sc->npipes;
2254 	dmem->rf_config = 0x12;	/* 1T2R */
2255 	dmem->vcs_type = R92S_VCS_TYPE_AUTO;
2256 	dmem->vcs_mode = R92S_VCS_MODE_RTS_CTS;
2257 #ifdef notyet
2258 	dmem->bw40_en = (ic->ic_htcaps & IEEE80211_HTCAP_CBW20_40) != 0;
2259 #endif
2260 	dmem->turbo_mode = 1;
2261 	/* Load DMEM section. */
2262 	error = rsu_fw_loadsection(sc, (uint8_t *)dmem, sizeof(*dmem));
2263 	if (error != 0) {
2264 		device_printf(sc->sc_dev,
2265 		    "could not load firmware section %s\n", "DMEM");
2266 		goto fail;
2267 	}
2268 	/* Wait for load to complete. */
2269 	for (ntries = 0; ntries < 100; ntries++) {
2270 		if (rsu_read_2(sc, R92S_TCR) & R92S_TCR_DMEM_CODE_DONE)
2271 			break;
2272 		DELAY(1000);
2273 	}
2274 	if (ntries == 100) {
2275 		device_printf(sc->sc_dev, "timeout waiting for %s transfer\n",
2276 		    "DMEM");
2277 		error = ETIMEDOUT;
2278 		goto fail;
2279 	}
2280 	/* Wait for firmware readiness. */
2281 	for (ntries = 0; ntries < 60; ntries++) {
2282 		if (!(rsu_read_2(sc, R92S_TCR) & R92S_TCR_FWRDY))
2283 			break;
2284 		DELAY(1000);
2285 	}
2286 	if (ntries == 60) {
2287 		device_printf(sc->sc_dev,
2288 		    "timeout waiting for firmware readiness\n");
2289 		error = ETIMEDOUT;
2290 		goto fail;
2291 	}
2292  fail:
2293 	firmware_put(fw, FIRMWARE_UNLOAD);
2294 	return (error);
2295 }
2296 
2297 
2298 static int
2299 rsu_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2300     const struct ieee80211_bpf_params *params)
2301 {
2302 	struct ieee80211com *ic = ni->ni_ic;
2303 	struct ifnet *ifp = ic->ic_ifp;
2304 	struct rsu_softc *sc = ifp->if_softc;
2305 	struct rsu_data *bf;
2306 
2307 	/* prevent management frames from being sent if we're not ready */
2308 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2309 		m_freem(m);
2310 		ieee80211_free_node(ni);
2311 		return (ENETDOWN);
2312 	}
2313 	RSU_LOCK(sc);
2314 	bf = rsu_getbuf(sc);
2315 	if (bf == NULL) {
2316 		ieee80211_free_node(ni);
2317 		m_freem(m);
2318 		RSU_UNLOCK(sc);
2319 		return (ENOBUFS);
2320 	}
2321 	ifp->if_opackets++;
2322 	if (rsu_tx_start(sc, ni, m, bf) != 0) {
2323 		ieee80211_free_node(ni);
2324 		ifp->if_oerrors++;
2325 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2326 		RSU_UNLOCK(sc);
2327 		return (EIO);
2328 	}
2329 	RSU_UNLOCK(sc);
2330 	sc->sc_tx_timer = 5;
2331 
2332 	return (0);
2333 }
2334 
2335 static void
2336 rsu_init(void *arg)
2337 {
2338 	struct rsu_softc *sc = arg;
2339 
2340 	RSU_LOCK(sc);
2341 	rsu_init_locked(arg);
2342 	RSU_UNLOCK(sc);
2343 }
2344 
2345 static void
2346 rsu_init_locked(struct rsu_softc *sc)
2347 {
2348 	struct ifnet *ifp = sc->sc_ifp;
2349 	struct r92s_set_pwr_mode cmd;
2350 	int error;
2351 
2352 	/* Init host async commands ring. */
2353 	sc->cmdq.cur = sc->cmdq.next = sc->cmdq.queued = 0;
2354 
2355 	/* Allocate Tx/Rx buffers. */
2356 	error = rsu_alloc_rx_list(sc);
2357 	if (error != 0) {
2358 		device_printf(sc->sc_dev, "could not allocate Rx buffers\n");
2359 		return;
2360 	}
2361 	error = rsu_alloc_tx_list(sc);
2362 	if (error != 0) {
2363 		device_printf(sc->sc_dev, "could not allocate Tx buffers\n");
2364 		rsu_free_rx_list(sc);
2365 		return;
2366 	}
2367 	/* Power on adapter. */
2368 	if (sc->cut == 1)
2369 		rsu_power_on_acut(sc);
2370 	else
2371 		rsu_power_on_bcut(sc);
2372 	/* Load firmware. */
2373 	error = rsu_load_firmware(sc);
2374 	if (error != 0)
2375 		goto fail;
2376 
2377 	/* Enable Rx TCP checksum offload. */
2378 	rsu_write_4(sc, R92S_RCR,
2379 	    rsu_read_4(sc, R92S_RCR) | 0x04000000);
2380 	/* Append PHY status. */
2381 	rsu_write_4(sc, R92S_RCR,
2382 	    rsu_read_4(sc, R92S_RCR) | 0x02000000);
2383 
2384 	rsu_write_4(sc, R92S_CR,
2385 	    rsu_read_4(sc, R92S_CR) & ~0xff000000);
2386 
2387 	/* Use 128 bytes pages. */
2388 	rsu_write_1(sc, 0x00b5,
2389 	    rsu_read_1(sc, 0x00b5) | 0x01);
2390 	/* Enable USB Rx aggregation. */
2391 	rsu_write_1(sc, 0x00bd,
2392 	    rsu_read_1(sc, 0x00bd) | 0x80);
2393 	/* Set USB Rx aggregation threshold. */
2394 	rsu_write_1(sc, 0x00d9, 0x01);
2395 	/* Set USB Rx aggregation timeout (1.7ms/4). */
2396 	rsu_write_1(sc, 0xfe5b, 0x04);
2397 	/* Fix USB Rx FIFO issue. */
2398 	rsu_write_1(sc, 0xfe5c,
2399 	    rsu_read_1(sc, 0xfe5c) | 0x80);
2400 
2401 	/* Set MAC address. */
2402 	rsu_write_region_1(sc, R92S_MACID, IF_LLADDR(ifp),
2403 	    IEEE80211_ADDR_LEN);
2404 
2405 	/* NB: it really takes that long for firmware to boot. */
2406 	usb_pause_mtx(&sc->sc_mtx, 1500);
2407 
2408 	DPRINTF("setting MAC address to %s\n", ether_sprintf(IF_LLADDR(ifp)));
2409 	error = rsu_fw_cmd(sc, R92S_CMD_SET_MAC_ADDRESS, IF_LLADDR(ifp),
2410 	    IEEE80211_ADDR_LEN);
2411 	if (error != 0) {
2412 		device_printf(sc->sc_dev, "could not set MAC address\n");
2413 		goto fail;
2414 	}
2415 
2416 	rsu_write_1(sc, R92S_USB_HRPWM,
2417 	    R92S_USB_HRPWM_PS_ST_ACTIVE | R92S_USB_HRPWM_PS_ALL_ON);
2418 
2419 	memset(&cmd, 0, sizeof(cmd));
2420 	cmd.mode = R92S_PS_MODE_ACTIVE;
2421 	DPRINTF("setting ps mode to %d\n", cmd.mode);
2422 	error = rsu_fw_cmd(sc, R92S_CMD_SET_PWR_MODE, &cmd, sizeof(cmd));
2423 	if (error != 0) {
2424 		device_printf(sc->sc_dev, "could not set PS mode\n");
2425 		goto fail;
2426 	}
2427 
2428 #if 0
2429 	if (ic->ic_htcaps & IEEE80211_HTCAP_CBW20_40) {
2430 		/* Enable 40MHz mode. */
2431 		error = rsu_fw_iocmd(sc,
2432 		    SM(R92S_IOCMD_CLASS, 0xf4) |
2433 		    SM(R92S_IOCMD_INDEX, 0x00) |
2434 		    SM(R92S_IOCMD_VALUE, 0x0007));
2435 		if (error != 0) {
2436 			device_printf(sc->sc_dev,
2437 			    "could not enable 40MHz mode\n");
2438 			goto fail;
2439 		}
2440 	}
2441 
2442 	/* Set default channel. */
2443 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2444 #endif
2445 	sc->scan_pass = 0;
2446 	usbd_transfer_start(sc->sc_xfer[RSU_BULK_RX]);
2447 
2448 	/* We're ready to go. */
2449 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2450 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2451 
2452 	callout_reset(&sc->sc_watchdog_ch, hz, rsu_watchdog, sc);
2453 
2454 	return;
2455 fail:
2456 	rsu_free_rx_list(sc);
2457 	rsu_free_tx_list(sc);
2458 	return;
2459 }
2460 
2461 static void
2462 rsu_stop(struct ifnet *ifp, int disable)
2463 {
2464 	struct rsu_softc *sc = ifp->if_softc;
2465 
2466 	RSU_LOCK(sc);
2467 	rsu_stop_locked(ifp, disable);
2468 	RSU_UNLOCK(sc);
2469 }
2470 
2471 static void
2472 rsu_stop_locked(struct ifnet *ifp, int disable __unused)
2473 {
2474 	struct rsu_softc *sc = ifp->if_softc;
2475 	int i;
2476 
2477 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2478 	callout_stop(&sc->sc_watchdog_ch);
2479 	sc->sc_calibrating = 0;
2480 	taskqueue_cancel_timeout(taskqueue_thread, &sc->calib_task, NULL);
2481 
2482 	/* Power off adapter. */
2483 	rsu_power_off(sc);
2484 
2485 	for (i = 0; i < RSU_N_TRANSFER; i++)
2486 		usbd_transfer_stop(sc->sc_xfer[i]);
2487 }
2488 
2489