1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 * Copyright (c) 2015-2016 Andriy Voskoboinyk <avos@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD$");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU/RTL8812AU/RTL8821AU.
26 */
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/module.h>
40#include <sys/bus.h>
41#include <sys/endian.h>
42#include <sys/linker.h>
43#include <sys/firmware.h>
44#include <sys/kdb.h>
45
46#include <net/bpf.h>
47#include <net/if.h>
48#include <net/if_var.h>
49#include <net/if_arp.h>
50#include <net/ethernet.h>
51#include <net/if_dl.h>
52#include <net/if_media.h>
53#include <net/if_types.h>
54
55#include <netinet/in.h>
56#include <netinet/in_systm.h>
57#include <netinet/in_var.h>
58#include <netinet/if_ether.h>
59#include <netinet/ip.h>
60
61#include <net80211/ieee80211_var.h>
62#include <net80211/ieee80211_regdomain.h>
63#include <net80211/ieee80211_radiotap.h>
64#include <net80211/ieee80211_ratectl.h>
65
66#include <dev/rtwn/if_rtwnreg.h>
67#include <dev/rtwn/if_rtwnvar.h>
68
69#include <dev/rtwn/if_rtwn_beacon.h>
70#include <dev/rtwn/if_rtwn_calib.h>
71#include <dev/rtwn/if_rtwn_cam.h>
72#include <dev/rtwn/if_rtwn_debug.h>
73#include <dev/rtwn/if_rtwn_efuse.h>
74#include <dev/rtwn/if_rtwn_fw.h>
75#include <dev/rtwn/if_rtwn_ridx.h>
76#include <dev/rtwn/if_rtwn_rx.h>
77#include <dev/rtwn/if_rtwn_task.h>
78#include <dev/rtwn/if_rtwn_tx.h>
79
80#include <dev/rtwn/rtl8192c/r92c_reg.h>
81
82static void		rtwn_radiotap_attach(struct rtwn_softc *);
83static void		rtwn_vap_decrement_counters(struct rtwn_softc *,
84			    enum ieee80211_opmode, int);
85static void		rtwn_set_ic_opmode(struct rtwn_softc *);
86static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
87			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
88			    int, const uint8_t [IEEE80211_ADDR_LEN],
89			    const uint8_t [IEEE80211_ADDR_LEN]);
90static void		rtwn_vap_delete(struct ieee80211vap *);
91static int		rtwn_read_chipid(struct rtwn_softc *);
92static int		rtwn_ioctl_reset(struct ieee80211vap *, u_long);
93static void		rtwn_set_media_status(struct rtwn_softc *,
94			    union sec_param *);
95#ifndef RTWN_WITHOUT_UCODE
96static int		rtwn_tx_fwpkt_check(struct rtwn_softc *,
97			    struct ieee80211vap *);
98static int		rtwn_construct_nulldata(struct rtwn_softc *,
99			    struct ieee80211vap *, uint8_t *, int);
100static int		rtwn_push_nulldata(struct rtwn_softc *,
101			    struct ieee80211vap *);
102static void		rtwn_pwrmode_init(void *);
103static void		rtwn_set_pwrmode_cb(struct rtwn_softc *,
104			    union sec_param *);
105#endif
106static void		rtwn_tsf_sync_adhoc(void *);
107static void		rtwn_tsf_sync_adhoc_task(void *, int);
108static void		rtwn_tsf_sync_enable(struct rtwn_softc *,
109			    struct ieee80211vap *);
110static void		rtwn_set_ack_preamble(struct rtwn_softc *);
111static void		rtwn_set_mode(struct rtwn_softc *, uint8_t, int);
112static int		rtwn_monitor_newstate(struct ieee80211vap *,
113			    enum ieee80211_state, int);
114static int		rtwn_newstate(struct ieee80211vap *,
115			    enum ieee80211_state, int);
116static void		rtwn_calc_basicrates(struct rtwn_softc *);
117static int		rtwn_run(struct rtwn_softc *,
118			    struct ieee80211vap *);
119#ifndef D4054
120static void		rtwn_watchdog(void *);
121#endif
122static void		rtwn_parent(struct ieee80211com *);
123static int		rtwn_dma_init(struct rtwn_softc *);
124static int		rtwn_mac_init(struct rtwn_softc *);
125static void		rtwn_mrr_init(struct rtwn_softc *);
126static void		rtwn_scan_start(struct ieee80211com *);
127static void		rtwn_scan_curchan(struct ieee80211_scan_state *,
128			    unsigned long);
129static void		rtwn_scan_end(struct ieee80211com *);
130static void		rtwn_getradiocaps(struct ieee80211com *, int, int *,
131			    struct ieee80211_channel[]);
132static void		rtwn_update_chw(struct ieee80211com *);
133static void		rtwn_set_channel(struct ieee80211com *);
134static int		rtwn_wme_update(struct ieee80211com *);
135static void		rtwn_update_slot(struct ieee80211com *);
136static void		rtwn_update_slot_cb(struct rtwn_softc *,
137			    union sec_param *);
138static void		rtwn_update_aifs(struct rtwn_softc *, uint8_t);
139static void		rtwn_update_promisc(struct ieee80211com *);
140static void		rtwn_update_mcast(struct ieee80211com *);
141static int		rtwn_set_bssid(struct rtwn_softc *,
142			    const uint8_t *, int);
143static int		rtwn_set_macaddr(struct rtwn_softc *,
144			    const uint8_t *, int);
145static struct ieee80211_node *rtwn_node_alloc(struct ieee80211vap *,
146			    const uint8_t mac[IEEE80211_ADDR_LEN]);
147static void		rtwn_newassoc(struct ieee80211_node *, int);
148static void		rtwn_node_free(struct ieee80211_node *);
149static void		rtwn_init_beacon_reg(struct rtwn_softc *);
150static int		rtwn_init(struct rtwn_softc *);
151static void		rtwn_stop(struct rtwn_softc *);
152
153MALLOC_DEFINE(M_RTWN_PRIV, "rtwn_priv", "rtwn driver private state");
154
155static const uint16_t wme2reg[] =
156	{ R92C_EDCA_BE_PARAM, R92C_EDCA_BK_PARAM,
157	  R92C_EDCA_VI_PARAM, R92C_EDCA_VO_PARAM };
158
159int
160rtwn_attach(struct rtwn_softc *sc)
161{
162	struct ieee80211com *ic = &sc->sc_ic;
163	int error;
164
165	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
166
167	RTWN_NT_LOCK_INIT(sc);
168	rtwn_cmdq_init(sc);
169#ifndef D4054
170	callout_init_mtx(&sc->sc_watchdog_to, &sc->sc_mtx, 0);
171#endif
172	callout_init(&sc->sc_calib_to, 0);
173	callout_init(&sc->sc_pwrmode_init, 0);
174	mbufq_init(&sc->sc_snd, ifqmaxlen);
175
176	RTWN_LOCK(sc);
177	error = rtwn_read_chipid(sc);
178	RTWN_UNLOCK(sc);
179	if (error != 0) {
180		device_printf(sc->sc_dev, "unsupported test chip\n");
181		goto detach;
182	}
183
184	error = rtwn_read_rom(sc);
185	if (error != 0) {
186		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
187		    __func__, error);
188		goto detach;
189	}
190
191	if (sc->macid_limit > RTWN_MACID_LIMIT) {
192		device_printf(sc->sc_dev,
193		    "macid limit will be reduced from %d to %d\n",
194		    sc->macid_limit, RTWN_MACID_LIMIT);
195		sc->macid_limit = RTWN_MACID_LIMIT;
196	}
197	if (sc->cam_entry_limit > RTWN_CAM_ENTRY_LIMIT) {
198		device_printf(sc->sc_dev,
199		    "cam entry limit will be reduced from %d to %d\n",
200		    sc->cam_entry_limit, RTWN_CAM_ENTRY_LIMIT);
201		sc->cam_entry_limit = RTWN_CAM_ENTRY_LIMIT;
202	}
203	if (sc->txdesc_len > RTWN_TX_DESC_SIZE) {
204		device_printf(sc->sc_dev,
205		    "adjust size for Tx descriptor (current %d, needed %d)\n",
206		    RTWN_TX_DESC_SIZE, sc->txdesc_len);
207		goto detach;
208	}
209
210	device_printf(sc->sc_dev, "MAC/BB %s, RF 6052 %dT%dR\n",
211	    sc->name, sc->ntxchains, sc->nrxchains);
212
213	ic->ic_softc = sc;
214	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
215	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
216
217	/* set device capabilities */
218	ic->ic_caps =
219		  IEEE80211_C_STA		/* station mode */
220		| IEEE80211_C_MONITOR		/* monitor mode */
221		| IEEE80211_C_IBSS		/* adhoc mode */
222		| IEEE80211_C_HOSTAP		/* hostap mode */
223#if 0	/* TODO: HRPWM register setup */
224#ifndef RTWN_WITHOUT_UCODE
225		| IEEE80211_C_PMGT		/* Station-side power mgmt */
226#endif
227#endif
228		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
229		| IEEE80211_C_SHSLOT		/* short slot time supported */
230#if 0
231		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
232#endif
233		| IEEE80211_C_WPA		/* 802.11i */
234		| IEEE80211_C_WME		/* 802.11e */
235		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
236		| IEEE80211_C_FF		/* Atheros fast-frames */
237		;
238
239	if (sc->sc_hwcrypto != RTWN_CRYPTO_SW) {
240		ic->ic_cryptocaps =
241		    IEEE80211_CRYPTO_WEP |
242		    IEEE80211_CRYPTO_TKIP |
243		    IEEE80211_CRYPTO_AES_CCM;
244	}
245
246	ic->ic_htcaps =
247	      IEEE80211_HTCAP_SHORTGI20		/* short GI in 20MHz */
248	    | IEEE80211_HTCAP_MAXAMSDU_3839	/* max A-MSDU length */
249	    | IEEE80211_HTCAP_SMPS_OFF		/* SM PS mode disabled */
250	    /* s/w capabilities */
251	    | IEEE80211_HTC_HT			/* HT operation */
252	    | IEEE80211_HTC_AMPDU		/* A-MPDU tx */
253	    | IEEE80211_HTC_AMSDU		/* A-MSDU tx */
254	    ;
255
256	if (sc->sc_ht40) {
257		ic->ic_htcaps |=
258		      IEEE80211_HTCAP_CHWIDTH40	/* 40 MHz channel width */
259		    | IEEE80211_HTCAP_SHORTGI40	/* short GI in 40MHz */
260		    ;
261	}
262
263	ic->ic_txstream = sc->ntxchains;
264	ic->ic_rxstream = sc->nrxchains;
265
266	/* Enable TX watchdog */
267#ifdef D4054
268	ic->ic_flags_ext |= IEEE80211_FEXT_WATCHDOG;
269#endif
270
271	/* Adjust capabilities. */
272	rtwn_adj_devcaps(sc);
273
274	rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
275	    ic->ic_channels);
276
277	/* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
278
279	ieee80211_ifattach(ic);
280	ic->ic_raw_xmit = rtwn_raw_xmit;
281	ic->ic_scan_start = rtwn_scan_start;
282	sc->sc_scan_curchan = ic->ic_scan_curchan;
283	ic->ic_scan_curchan = rtwn_scan_curchan;
284	ic->ic_scan_end = rtwn_scan_end;
285	ic->ic_getradiocaps = rtwn_getradiocaps;
286	ic->ic_update_chw = rtwn_update_chw;
287	ic->ic_set_channel = rtwn_set_channel;
288	ic->ic_transmit = rtwn_transmit;
289	ic->ic_parent = rtwn_parent;
290	ic->ic_vap_create = rtwn_vap_create;
291	ic->ic_vap_delete = rtwn_vap_delete;
292	ic->ic_wme.wme_update = rtwn_wme_update;
293	ic->ic_updateslot = rtwn_update_slot;
294	ic->ic_update_promisc = rtwn_update_promisc;
295	ic->ic_update_mcast = rtwn_update_mcast;
296	ic->ic_node_alloc = rtwn_node_alloc;
297	ic->ic_newassoc = rtwn_newassoc;
298	sc->sc_node_free = ic->ic_node_free;
299	ic->ic_node_free = rtwn_node_free;
300
301	rtwn_postattach(sc);
302	rtwn_radiotap_attach(sc);
303
304	if (bootverbose)
305		ieee80211_announce(ic);
306
307	return (0);
308
309detach:
310	return (ENXIO);			/* failure */
311}
312
313static void
314rtwn_radiotap_attach(struct rtwn_softc *sc)
315{
316	struct rtwn_rx_radiotap_header *rxtap = &sc->sc_rxtap;
317	struct rtwn_tx_radiotap_header *txtap = &sc->sc_txtap;
318
319	ieee80211_radiotap_attach(&sc->sc_ic,
320	    &txtap->wt_ihdr, sizeof(*txtap), RTWN_TX_RADIOTAP_PRESENT,
321	    &rxtap->wr_ihdr, sizeof(*rxtap), RTWN_RX_RADIOTAP_PRESENT);
322}
323
324void
325rtwn_sysctlattach(struct rtwn_softc *sc)
326{
327	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
328	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
329
330#if 1
331	sc->sc_ht40 = 0;
332	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
333	    "ht40", CTLFLAG_RDTUN, &sc->sc_ht40,
334	    sc->sc_ht40, "Enable 40 MHz mode support");
335#endif
336
337#ifdef RTWN_DEBUG
338	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
339	    "debug", CTLFLAG_RWTUN, &sc->sc_debug, sc->sc_debug,
340	    "Control debugging printfs");
341#endif
342
343	sc->sc_hwcrypto = RTWN_CRYPTO_PAIR;
344	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
345	    "hwcrypto", CTLFLAG_RDTUN, &sc->sc_hwcrypto,
346	    sc->sc_hwcrypto, "Enable h/w crypto: "
347	    "0 - disable, 1 - pairwise keys, 2 - all keys");
348	if (sc->sc_hwcrypto >= RTWN_CRYPTO_MAX)
349		sc->sc_hwcrypto = RTWN_CRYPTO_FULL;
350
351	sc->sc_ratectl_sysctl = RTWN_RATECTL_NET80211;
352	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
353	    "ratectl", CTLFLAG_RDTUN, &sc->sc_ratectl_sysctl,
354	    sc->sc_ratectl_sysctl, "Select rate control mechanism: "
355	    "0 - disabled, 1 - via net80211, 2 - via firmware");
356	if (sc->sc_ratectl_sysctl >= RTWN_RATECTL_MAX)
357		sc->sc_ratectl_sysctl = RTWN_RATECTL_FW;
358
359	sc->sc_ratectl = sc->sc_ratectl_sysctl;
360	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
361	    "ratectl_selected", CTLFLAG_RD, &sc->sc_ratectl,
362	    sc->sc_ratectl,
363	    "Currently selected rate control mechanism (by the driver)");
364}
365
366void
367rtwn_detach(struct rtwn_softc *sc)
368{
369	struct ieee80211com *ic = &sc->sc_ic;
370
371	if (ic->ic_softc == sc) {
372		/* Stop command queue. */
373		RTWN_CMDQ_LOCK(sc);
374		sc->sc_detached = 1;
375		RTWN_CMDQ_UNLOCK(sc);
376
377		ieee80211_draintask(ic, &sc->cmdq_task);
378		ieee80211_ifdetach(ic);
379	}
380
381	rtwn_cmdq_destroy(sc);
382	if (RTWN_NT_LOCK_INITIALIZED(sc))
383		RTWN_NT_LOCK_DESTROY(sc);
384}
385
386void
387rtwn_suspend(struct rtwn_softc *sc)
388{
389	struct ieee80211com *ic = &sc->sc_ic;
390
391	ieee80211_suspend_all(ic);
392}
393
394void
395rtwn_resume(struct rtwn_softc *sc)
396{
397	struct ieee80211com *ic = &sc->sc_ic;
398
399	ieee80211_resume_all(ic);
400}
401
402static void
403rtwn_vap_decrement_counters(struct rtwn_softc *sc,
404    enum ieee80211_opmode opmode, int id)
405{
406
407	RTWN_ASSERT_LOCKED(sc);
408
409	if (id != RTWN_VAP_ID_INVALID) {
410		KASSERT(id == 0 || id == 1, ("wrong vap id %d!\n", id));
411		KASSERT(sc->vaps[id] != NULL, ("vap pointer is NULL\n"));
412		sc->vaps[id] = NULL;
413	}
414
415	switch (opmode) {
416	case IEEE80211_M_HOSTAP:
417		sc->ap_vaps--;
418		/* FALLTHROUGH */
419	case IEEE80211_M_IBSS:
420		sc->bcn_vaps--;
421		/* FALLTHROUGH */
422	case IEEE80211_M_STA:
423		sc->nvaps--;
424		break;
425	case IEEE80211_M_MONITOR:
426		sc->mon_vaps--;
427		break;
428	default:
429		KASSERT(0, ("wrong opmode %d\n", opmode));
430		break;
431	}
432
433	KASSERT(sc->vaps_running >= 0 && sc->monvaps_running >= 0,
434	    ("number of running vaps is negative (vaps %d, monvaps %d)\n",
435	    sc->vaps_running, sc->monvaps_running));
436	KASSERT(sc->vaps_running - sc->monvaps_running <= RTWN_PORT_COUNT,
437	    ("number of running vaps is too big (vaps %d, monvaps %d)\n",
438	    sc->vaps_running, sc->monvaps_running));
439
440	KASSERT(sc->nvaps >= 0 && sc->nvaps <= RTWN_PORT_COUNT,
441	    ("wrong value %d for nvaps\n", sc->nvaps));
442	KASSERT(sc->mon_vaps >= 0, ("mon_vaps is negative (%d)\n",
443	    sc->mon_vaps));
444	KASSERT(sc->bcn_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
445	    sc->bcn_vaps <= RTWN_PORT_COUNT) || sc->bcn_vaps <= 1),
446	    ("bcn_vaps value %d is wrong\n", sc->bcn_vaps));
447	KASSERT(sc->ap_vaps >= 0 && ((RTWN_CHIP_HAS_BCNQ1(sc) &&
448	    sc->ap_vaps <= RTWN_PORT_COUNT) || sc->ap_vaps <= 1),
449	    ("ap_vaps value %d is wrong\n", sc->ap_vaps));
450}
451
452static void
453rtwn_set_ic_opmode(struct rtwn_softc *sc)
454{
455	struct ieee80211com *ic = &sc->sc_ic;
456
457	RTWN_ASSERT_LOCKED(sc);
458
459	/* for ieee80211_reset_erp() */
460	if (sc->bcn_vaps - sc->ap_vaps > 0)
461		ic->ic_opmode = IEEE80211_M_IBSS;
462	else if (sc->ap_vaps > 0)
463		ic->ic_opmode = IEEE80211_M_HOSTAP;
464	else if (sc->nvaps > 0)
465		ic->ic_opmode = IEEE80211_M_STA;
466	else
467		ic->ic_opmode = IEEE80211_M_MONITOR;
468}
469
470static struct ieee80211vap *
471rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
472    enum ieee80211_opmode opmode, int flags,
473    const uint8_t bssid[IEEE80211_ADDR_LEN],
474    const uint8_t mac[IEEE80211_ADDR_LEN])
475{
476	struct rtwn_softc *sc = ic->ic_softc;
477	struct rtwn_vap *uvp;
478	struct ieee80211vap *vap;
479	int id = RTWN_VAP_ID_INVALID;
480
481	RTWN_LOCK(sc);
482	KASSERT(sc->nvaps <= RTWN_PORT_COUNT,
483	    ("nvaps overflow (%d > %d)\n", sc->nvaps, RTWN_PORT_COUNT));
484	KASSERT(sc->ap_vaps <= RTWN_PORT_COUNT,
485	    ("ap_vaps overflow (%d > %d)\n", sc->ap_vaps, RTWN_PORT_COUNT));
486	KASSERT(sc->bcn_vaps <= RTWN_PORT_COUNT,
487	    ("bcn_vaps overflow (%d > %d)\n", sc->bcn_vaps, RTWN_PORT_COUNT));
488
489	if (opmode != IEEE80211_M_MONITOR) {
490		switch (sc->nvaps) {
491		case 0:
492			id = 0;
493			break;
494		case 1:
495			if (sc->vaps[1] == NULL)
496				id = 1;
497			else if (sc->vaps[0] == NULL)
498				id = 0;
499			KASSERT(id != RTWN_VAP_ID_INVALID,
500			    ("no free ports left\n"));
501			break;
502		case 2:
503		default:
504			goto fail;
505		}
506
507		if (opmode == IEEE80211_M_IBSS ||
508		    opmode == IEEE80211_M_HOSTAP) {
509			if ((sc->bcn_vaps == 1 && !RTWN_CHIP_HAS_BCNQ1(sc)) ||
510			    sc->bcn_vaps == RTWN_PORT_COUNT)
511				goto fail;
512		}
513	}
514
515	switch (opmode) {
516	case IEEE80211_M_HOSTAP:
517		sc->ap_vaps++;
518		/* FALLTHROUGH */
519	case IEEE80211_M_IBSS:
520		sc->bcn_vaps++;
521		/* FALLTHROUGH */
522	case IEEE80211_M_STA:
523		sc->nvaps++;
524		break;
525	case IEEE80211_M_MONITOR:
526		sc->mon_vaps++;
527		break;
528	default:
529		KASSERT(0, ("unknown opmode %d\n", opmode));
530		goto fail;
531	}
532	RTWN_UNLOCK(sc);
533
534	uvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
535	uvp->id = id;
536	if (id != RTWN_VAP_ID_INVALID) {
537		RTWN_LOCK(sc);
538		sc->vaps[id] = uvp;
539		RTWN_UNLOCK(sc);
540	}
541	vap = &uvp->vap;
542	/* enable s/w bmiss handling for sta mode */
543
544	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
545	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
546		/* out of memory */
547		free(uvp, M_80211_VAP);
548
549		RTWN_LOCK(sc);
550		rtwn_vap_decrement_counters(sc, opmode, id);
551		RTWN_UNLOCK(sc);
552
553		return (NULL);
554	}
555
556	rtwn_beacon_init(sc, &uvp->bcn_desc.txd[0], uvp->id);
557	rtwn_vap_preattach(sc, vap);
558
559	/* override state transition machine */
560	uvp->newstate = vap->iv_newstate;
561	if (opmode == IEEE80211_M_MONITOR)
562		vap->iv_newstate = rtwn_monitor_newstate;
563	else
564		vap->iv_newstate = rtwn_newstate;
565	vap->iv_update_beacon = rtwn_update_beacon;
566	vap->iv_reset = rtwn_ioctl_reset;
567	vap->iv_key_alloc = rtwn_key_alloc;
568	vap->iv_key_set = rtwn_key_set;
569	vap->iv_key_delete = rtwn_key_delete;
570	vap->iv_max_aid = sc->macid_limit;
571
572	/* 802.11n parameters */
573	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
574	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
575
576	TIMEOUT_TASK_INIT(taskqueue_thread, &uvp->tx_beacon_csa, 0,
577	    rtwn_tx_beacon_csa, vap);
578	if (opmode == IEEE80211_M_IBSS) {
579		uvp->recv_mgmt = vap->iv_recv_mgmt;
580		vap->iv_recv_mgmt = rtwn_adhoc_recv_mgmt;
581		TASK_INIT(&uvp->tsf_sync_adhoc_task, 0,
582		    rtwn_tsf_sync_adhoc_task, vap);
583		callout_init(&uvp->tsf_sync_adhoc, 0);
584	}
585
586	/*
587	 * NB: driver can select net80211 RA even when user requests
588	 * another mechanism.
589	 */
590	ieee80211_ratectl_init(vap);
591
592	/* complete setup */
593	ieee80211_vap_attach(vap, ieee80211_media_change,
594	    ieee80211_media_status, mac);
595
596	RTWN_LOCK(sc);
597	rtwn_set_ic_opmode(sc);
598	if (sc->sc_flags & RTWN_RUNNING) {
599		if (uvp->id != RTWN_VAP_ID_INVALID)
600			rtwn_set_macaddr(sc, vap->iv_myaddr, uvp->id);
601
602		rtwn_rxfilter_update(sc);
603	}
604	RTWN_UNLOCK(sc);
605
606	return (vap);
607
608fail:
609	RTWN_UNLOCK(sc);
610	return (NULL);
611}
612
613static void
614rtwn_vap_delete(struct ieee80211vap *vap)
615{
616	struct ieee80211com *ic = vap->iv_ic;
617	struct rtwn_softc *sc = ic->ic_softc;
618	struct rtwn_vap *uvp = RTWN_VAP(vap);
619
620	/* Put vap into INIT state + stop device if needed. */
621	ieee80211_stop(vap);
622	ieee80211_draintask(ic, &vap->iv_nstate_task);
623	ieee80211_draintask(ic, &ic->ic_parent_task);
624
625	RTWN_LOCK(sc);
626	/* Cancel any unfinished Tx. */
627	rtwn_reset_lists(sc, vap);
628	if (uvp->bcn_mbuf != NULL)
629		m_freem(uvp->bcn_mbuf);
630	rtwn_vap_decrement_counters(sc, vap->iv_opmode, uvp->id);
631	rtwn_set_ic_opmode(sc);
632	if (sc->sc_flags & RTWN_RUNNING)
633		rtwn_rxfilter_update(sc);
634	RTWN_UNLOCK(sc);
635
636	if (vap->iv_opmode == IEEE80211_M_IBSS) {
637		ieee80211_draintask(ic, &uvp->tsf_sync_adhoc_task);
638		callout_drain(&uvp->tsf_sync_adhoc);
639	}
640
641	ieee80211_ratectl_deinit(vap);
642	ieee80211_vap_detach(vap);
643	free(uvp, M_80211_VAP);
644}
645
646static int
647rtwn_read_chipid(struct rtwn_softc *sc)
648{
649	uint32_t reg;
650
651	reg = rtwn_read_4(sc, R92C_SYS_CFG);
652	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)	/* test chip */
653		return (EOPNOTSUPP);
654
655	rtwn_read_chipid_vendor(sc, reg);
656
657	return (0);
658}
659
660static int
661rtwn_ioctl_reset(struct ieee80211vap *vap, u_long cmd)
662{
663	int error;
664
665	switch (cmd) {
666#ifndef RTWN_WITHOUT_UCODE
667	case IEEE80211_IOC_POWERSAVE:
668	case IEEE80211_IOC_POWERSAVESLEEP:
669	{
670		struct rtwn_softc *sc = vap->iv_ic->ic_softc;
671		struct rtwn_vap *uvp = RTWN_VAP(vap);
672
673		if (vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
674			RTWN_LOCK(sc);
675			if (sc->sc_flags & RTWN_RUNNING)
676				error = rtwn_set_pwrmode(sc, vap, 1);
677			else
678				error = 0;
679			RTWN_UNLOCK(sc);
680			if (error != 0)
681				error = ENETRESET;
682		} else
683			error = EOPNOTSUPP;
684		break;
685	}
686#endif
687	case IEEE80211_IOC_SHORTGI:
688	case IEEE80211_IOC_RTSTHRESHOLD:
689	case IEEE80211_IOC_PROTMODE:
690	case IEEE80211_IOC_HTPROTMODE:
691	case IEEE80211_IOC_LDPC:
692		error = 0;
693		break;
694	default:
695		error = ENETRESET;
696		break;
697	}
698
699	return (error);
700}
701
702static void
703rtwn_set_media_status(struct rtwn_softc *sc, union sec_param *data)
704{
705	sc->sc_set_media_status(sc, data->macid);
706}
707
708#ifndef RTWN_WITHOUT_UCODE
709static int
710rtwn_tx_fwpkt_check(struct rtwn_softc *sc, struct ieee80211vap *vap)
711{
712	int ntries, error;
713
714	for (ntries = 0; ntries < 5; ntries++) {
715		error = rtwn_push_nulldata(sc, vap);
716		if (error == 0)
717			break;
718	}
719	if (ntries == 5) {
720		device_printf(sc->sc_dev,
721		    "%s: cannot push f/w frames into chip, error %d!\n",
722		    __func__, error);
723		return (error);
724	}
725
726	return (0);
727}
728
729static int
730rtwn_construct_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap,
731    uint8_t *ptr, int qos)
732{
733	struct rtwn_vap *uvp = RTWN_VAP(vap);
734	struct ieee80211com *ic = &sc->sc_ic;
735	struct rtwn_tx_desc_common *txd;
736	struct ieee80211_frame *wh;
737	int pktlen;
738
739	/* XXX obtain from net80211 */
740	wh = (struct ieee80211_frame *)(ptr + sc->txdesc_len);
741	wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
742	wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
743	IEEE80211_ADDR_COPY(wh->i_addr1, vap->iv_bss->ni_bssid);
744	IEEE80211_ADDR_COPY(wh->i_addr2, vap->iv_myaddr);
745	IEEE80211_ADDR_COPY(wh->i_addr3, vap->iv_bss->ni_macaddr);
746
747	txd = (struct rtwn_tx_desc_common *)ptr;
748	txd->offset = sc->txdesc_len;
749	pktlen = sc->txdesc_len;
750	if (qos) {
751		struct ieee80211_qosframe *qwh;
752		const int tid = WME_AC_TO_TID(WME_AC_BE);
753
754		qwh = (struct ieee80211_qosframe *)wh;
755		qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS_NULL;
756		qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
757
758		txd->pktlen = htole16(sizeof(struct ieee80211_qosframe));
759		pktlen += sizeof(struct ieee80211_qosframe);
760	} else {
761		wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_NODATA;
762
763		txd->pktlen = htole16(sizeof(struct ieee80211_frame));
764		pktlen += sizeof(struct ieee80211_frame);
765	}
766
767	rtwn_fill_tx_desc_null(sc, ptr,
768	    ic->ic_curmode == IEEE80211_MODE_11B, qos, uvp->id);
769
770	return (pktlen);
771}
772
773static int
774rtwn_push_nulldata(struct rtwn_softc *sc, struct ieee80211vap *vap)
775{
776	struct rtwn_vap *uvp = RTWN_VAP(vap);
777	struct ieee80211com *ic = vap->iv_ic;
778	struct ieee80211_channel *c = ic->ic_curchan;
779	struct mbuf *m;
780	uint8_t *ptr;
781	int required_size, bcn_size, null_size, null_data, error;
782
783	if (!(sc->sc_flags & RTWN_FW_LOADED))
784		return (0);	/* requires firmware */
785
786	KASSERT(sc->page_size > 0, ("page size was not set!\n"));
787
788	/* Leave some space for beacon (multi-vap) */
789	bcn_size = roundup(RTWN_BCN_MAX_SIZE, sc->page_size);
790	/* 1 page for Null Data + 1 page for Qos Null Data frames. */
791	required_size = bcn_size + sc->page_size * 2;
792
793	m = m_get2(required_size, M_NOWAIT, MT_DATA, M_PKTHDR);
794	if (m == NULL)
795		return (ENOMEM);
796
797	/* Setup beacon descriptor. */
798	rtwn_beacon_set_rate(sc, &uvp->bcn_desc.txd[0],
799	    IEEE80211_IS_CHAN_5GHZ(c));
800
801	ptr = mtod(m, uint8_t *);
802	memset(ptr, 0, required_size - sc->txdesc_len);
803
804	/* Construct Null Data frame. */
805	ptr += bcn_size - sc->txdesc_len;
806	null_size = rtwn_construct_nulldata(sc, vap, ptr, 0);
807	KASSERT(null_size < sc->page_size,
808	    ("recalculate size for Null Data frame\n"));
809
810	/* Construct Qos Null Data frame. */
811	ptr += roundup(null_size, sc->page_size);
812	null_size = rtwn_construct_nulldata(sc, vap, ptr, 1);
813	KASSERT(null_size < sc->page_size,
814	    ("recalculate size for Qos Null Data frame\n"));
815
816	/* Do not try to detect a beacon here. */
817	rtwn_setbits_1_shift(sc, R92C_CR, 0, R92C_CR_ENSWBCN, 1);
818	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
819	    R92C_FWHW_TXQ_CTRL_REAL_BEACON, 0, 2);
820
821	if (uvp->bcn_mbuf != NULL) {
822		rtwn_beacon_unload(sc, uvp->id);
823		m_freem(uvp->bcn_mbuf);
824	}
825
826	m->m_pkthdr.len = m->m_len = required_size - sc->txdesc_len;
827	uvp->bcn_mbuf = m;
828
829	error = rtwn_tx_beacon_check(sc, uvp);
830	if (error != 0) {
831		RTWN_DPRINTF(sc, RTWN_DEBUG_BEACON,
832		    "%s: frame was not recognized!\n", __func__);
833		goto fail;
834	}
835
836	/* Setup addresses in firmware. */
837	null_data = howmany(bcn_size, sc->page_size);
838	error = rtwn_set_rsvd_page(sc, 0, null_data, null_data + 1);
839	if (error != 0) {
840		device_printf(sc->sc_dev,
841		    "%s: CMD_RSVD_PAGE was not sent, error %d\n",
842		    __func__, error);
843		goto fail;
844	}
845
846fail:
847	/* Re-enable beacon detection. */
848	rtwn_setbits_1_shift(sc, R92C_FWHW_TXQ_CTRL,
849	    0, R92C_FWHW_TXQ_CTRL_REAL_BEACON, 2);
850	rtwn_setbits_1_shift(sc, R92C_CR, R92C_CR_ENSWBCN, 0, 1);
851
852	/* Restore beacon (if present). */
853	if (sc->bcn_vaps > 0 && sc->vaps[!uvp->id] != NULL) {
854		struct rtwn_vap *uvp2 = sc->vaps[!uvp->id];
855
856		if (uvp2->curr_mode != R92C_MSR_NOLINK)
857			error = rtwn_tx_beacon_check(sc, uvp2);
858	}
859
860	return (error);
861}
862
863static void
864rtwn_pwrmode_init(void *arg)
865{
866	struct rtwn_softc *sc = arg;
867
868	rtwn_cmd_sleepable(sc, NULL, 0, rtwn_set_pwrmode_cb);
869}
870
871static void
872rtwn_set_pwrmode_cb(struct rtwn_softc *sc, union sec_param *data)
873{
874	struct ieee80211vap *vap = &sc->vaps[0]->vap;
875
876	if (vap != NULL)
877		rtwn_set_pwrmode(sc, vap, 1);
878}
879#endif
880
881static void
882rtwn_tsf_sync_adhoc(void *arg)
883{
884	struct ieee80211vap *vap = arg;
885	struct ieee80211com *ic = vap->iv_ic;
886	struct rtwn_vap *uvp = RTWN_VAP(vap);
887
888	if (uvp->curr_mode != R92C_MSR_NOLINK) {
889		/* Do it in process context. */
890		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
891	}
892}
893
894/*
895 * Workaround for TSF synchronization:
896 * when BSSID filter in IBSS mode is not set
897 * (and TSF synchronization is enabled), then any beacon may update it.
898 * This routine synchronizes it when BSSID matching is enabled (IBSS merge
899 * is not possible during this period).
900 *
901 * NOTE: there is no race with rtwn_newstate(), since it uses the same
902 * taskqueue.
903 */
904static void
905rtwn_tsf_sync_adhoc_task(void *arg, int pending)
906{
907	struct ieee80211vap *vap = arg;
908	struct rtwn_vap *uvp = RTWN_VAP(vap);
909	struct rtwn_softc *sc = vap->iv_ic->ic_softc;
910	struct ieee80211_node *ni;
911
912	RTWN_LOCK(sc);
913	ni = ieee80211_ref_node(vap->iv_bss);
914
915	/* Accept beacons with the same BSSID. */
916	rtwn_set_rx_bssid_all(sc, 0);
917
918	/* Deny RCR updates. */
919	sc->sc_flags |= RTWN_RCR_LOCKED;
920
921	/* Enable synchronization. */
922	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
923	    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
924
925	/* Synchronize. */
926	rtwn_delay(sc, ni->ni_intval * 5 * 1000);
927
928	/* Disable synchronization. */
929	rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
930	    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
931
932	/* Accept all beacons. */
933	sc->sc_flags &= ~RTWN_RCR_LOCKED;
934	rtwn_set_rx_bssid_all(sc, 1);
935
936	/* Schedule next TSF synchronization. */
937	callout_reset(&uvp->tsf_sync_adhoc, 60*hz, rtwn_tsf_sync_adhoc, vap);
938
939	ieee80211_free_node(ni);
940	RTWN_UNLOCK(sc);
941}
942
943static void
944rtwn_tsf_sync_enable(struct rtwn_softc *sc, struct ieee80211vap *vap)
945{
946	struct ieee80211com *ic = &sc->sc_ic;
947	struct rtwn_vap *uvp = RTWN_VAP(vap);
948
949	/* Reset TSF. */
950	rtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RESET(uvp->id));
951
952	switch (vap->iv_opmode) {
953	case IEEE80211_M_STA:
954		/* Enable TSF synchronization. */
955		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
956		    R92C_BCN_CTRL_DIS_TSF_UDT0, 0);
957		break;
958	case IEEE80211_M_IBSS:
959		ieee80211_runtask(ic, &uvp->tsf_sync_adhoc_task);
960		/* FALLTHROUGH */
961	case IEEE80211_M_HOSTAP:
962		/* Enable beaconing. */
963		rtwn_beacon_enable(sc, uvp->id, 1);
964		break;
965	default:
966		device_printf(sc->sc_dev, "undefined opmode %d\n",
967		    vap->iv_opmode);
968		return;
969	}
970}
971
972static void
973rtwn_set_ack_preamble(struct rtwn_softc *sc)
974{
975	struct ieee80211com *ic = &sc->sc_ic;
976	uint32_t reg;
977
978	reg = rtwn_read_4(sc, R92C_WMAC_TRXPTCL_CTL);
979	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
980		reg |= R92C_WMAC_TRXPTCL_SHPRE;
981	else
982		reg &= ~R92C_WMAC_TRXPTCL_SHPRE;
983	rtwn_write_4(sc, R92C_WMAC_TRXPTCL_CTL, reg);
984}
985
986static void
987rtwn_set_mode(struct rtwn_softc *sc, uint8_t mode, int id)
988{
989
990	rtwn_setbits_1(sc, R92C_MSR, R92C_MSR_MASK << id * 2, mode << id * 2);
991	if (sc->vaps[id] != NULL)
992		sc->vaps[id]->curr_mode = mode;
993}
994
995static int
996rtwn_monitor_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate,
997    int arg)
998{
999	struct ieee80211com *ic = vap->iv_ic;
1000	struct rtwn_softc *sc = ic->ic_softc;
1001	struct rtwn_vap *uvp = RTWN_VAP(vap);
1002
1003	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1004	    ieee80211_state_name[vap->iv_state],
1005	    ieee80211_state_name[nstate]);
1006
1007	if (vap->iv_state != nstate) {
1008		IEEE80211_UNLOCK(ic);
1009		RTWN_LOCK(sc);
1010
1011		switch (nstate) {
1012		case IEEE80211_S_INIT:
1013			sc->vaps_running--;
1014			sc->monvaps_running--;
1015
1016			if (sc->vaps_running == 0) {
1017				/* Turn link LED off. */
1018				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1019			}
1020			break;
1021		case IEEE80211_S_RUN:
1022			sc->vaps_running++;
1023			sc->monvaps_running++;
1024
1025			if (sc->vaps_running == 1) {
1026				/* Turn link LED on. */
1027				rtwn_set_led(sc, RTWN_LED_LINK, 1);
1028			}
1029			break;
1030		default:
1031			/* NOTREACHED */
1032			break;
1033		}
1034
1035		RTWN_UNLOCK(sc);
1036		IEEE80211_LOCK(ic);
1037	}
1038
1039	return (uvp->newstate(vap, nstate, arg));
1040}
1041
1042static int
1043rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1044{
1045	struct rtwn_vap *uvp = RTWN_VAP(vap);
1046	struct ieee80211com *ic = vap->iv_ic;
1047	struct rtwn_softc *sc = ic->ic_softc;
1048	enum ieee80211_state ostate;
1049	int error, early_newstate;
1050
1051	ostate = vap->iv_state;
1052	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s -> %s\n",
1053	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
1054
1055	if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC &&
1056	    ostate == IEEE80211_S_INIT && nstate == IEEE80211_S_RUN) {
1057		/* need to call iv_newstate() firstly */
1058		error = uvp->newstate(vap, nstate, arg);
1059		if (error != 0)
1060			return (error);
1061
1062		early_newstate = 1;
1063	} else
1064		early_newstate = 0;
1065
1066	if (ostate == IEEE80211_S_CSA) {
1067		taskqueue_cancel_timeout(taskqueue_thread,
1068		    &uvp->tx_beacon_csa, NULL);
1069
1070		/*
1071		 * In multi-vap case second counter may not be cleared
1072		 * properly.
1073		 */
1074		vap->iv_csa_count = 0;
1075	}
1076	IEEE80211_UNLOCK(ic);
1077	RTWN_LOCK(sc);
1078
1079	if (ostate == IEEE80211_S_CSA) {
1080		/* Unblock all queues (multi-vap case). */
1081		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1082	}
1083
1084	if ((ostate == IEEE80211_S_RUN && nstate != IEEE80211_S_CSA) ||
1085	    ostate == IEEE80211_S_CSA) {
1086		sc->vaps_running--;
1087
1088		/* Set media status to 'No Link'. */
1089		rtwn_set_mode(sc, R92C_MSR_NOLINK, uvp->id);
1090
1091		if (vap->iv_opmode == IEEE80211_M_IBSS) {
1092			/* Stop periodical TSF synchronization. */
1093			callout_stop(&uvp->tsf_sync_adhoc);
1094		}
1095
1096		/* Disable TSF synchronization / beaconing. */
1097		rtwn_beacon_enable(sc, uvp->id, 0);
1098		rtwn_setbits_1(sc, R92C_BCN_CTRL(uvp->id),
1099		    0, R92C_BCN_CTRL_DIS_TSF_UDT0);
1100
1101		/* NB: monitor mode vaps are using port 0. */
1102		if (uvp->id != 0 || sc->monvaps_running == 0) {
1103			/* Reset TSF. */
1104			rtwn_write_1(sc, R92C_DUAL_TSF_RST,
1105			    R92C_DUAL_TSF_RESET(uvp->id));
1106		}
1107
1108#ifndef RTWN_WITHOUT_UCODE
1109		if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 && uvp->id == 0) {
1110			/* Disable power management. */
1111			callout_stop(&sc->sc_pwrmode_init);
1112			rtwn_set_pwrmode(sc, vap, 0);
1113		}
1114#endif
1115		if (sc->vaps_running - sc->monvaps_running > 0) {
1116			/* Recalculate basic rates bitmap. */
1117			rtwn_calc_basicrates(sc);
1118		}
1119
1120		if (sc->vaps_running == sc->monvaps_running) {
1121			/* Stop calibration. */
1122			callout_stop(&sc->sc_calib_to);
1123
1124			/* Stop Rx of data frames. */
1125			rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1126
1127			/* Reset EDCA parameters. */
1128			rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1129			rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1130			rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1131			rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1132
1133			if (sc->vaps_running == 0) {
1134				/* Turn link LED off. */
1135				rtwn_set_led(sc, RTWN_LED_LINK, 0);
1136			}
1137		}
1138	}
1139
1140	error = 0;
1141	switch (nstate) {
1142	case IEEE80211_S_SCAN:
1143		/* Pause AC Tx queues. */
1144		if (sc->vaps_running == 0)
1145			rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_AC);
1146		break;
1147	case IEEE80211_S_RUN:
1148		error = rtwn_run(sc, vap);
1149		if (error != 0) {
1150			device_printf(sc->sc_dev,
1151			    "%s: could not move to RUN state\n", __func__);
1152			break;
1153		}
1154
1155		sc->vaps_running++;
1156		break;
1157	case IEEE80211_S_CSA:
1158		/* Block all Tx queues (except beacon queue). */
1159		rtwn_setbits_1(sc, R92C_TXPAUSE, 0,
1160		    R92C_TX_QUEUE_AC | R92C_TX_QUEUE_MGT | R92C_TX_QUEUE_HIGH);
1161		break;
1162	default:
1163		break;
1164	}
1165
1166	RTWN_UNLOCK(sc);
1167	IEEE80211_LOCK(ic);
1168	if (error != 0)
1169		return (error);
1170
1171	return (early_newstate ? 0 : uvp->newstate(vap, nstate, arg));
1172}
1173
1174static void
1175rtwn_calc_basicrates(struct rtwn_softc *sc)
1176{
1177	struct ieee80211com *ic = &sc->sc_ic;
1178	uint32_t basicrates;
1179	int i;
1180
1181	RTWN_ASSERT_LOCKED(sc);
1182
1183	if (ic->ic_flags & IEEE80211_F_SCAN)
1184		return;		/* will be done by rtwn_scan_end(). */
1185
1186	basicrates = 0;
1187	for (i = 0; i < nitems(sc->vaps); i++) {
1188		struct rtwn_vap *rvp;
1189		struct ieee80211vap *vap;
1190		struct ieee80211_node *ni;
1191		uint32_t rates;
1192
1193		rvp = sc->vaps[i];
1194		if (rvp == NULL || rvp->curr_mode == R92C_MSR_NOLINK)
1195			continue;
1196
1197		vap = &rvp->vap;
1198		if (vap->iv_bss == NULL)
1199			continue;
1200
1201		ni = ieee80211_ref_node(vap->iv_bss);
1202		rtwn_get_rates(sc, &ni->ni_rates, NULL, &rates, NULL, 1);
1203		basicrates |= rates;
1204		ieee80211_free_node(ni);
1205	}
1206
1207	if (basicrates == 0)
1208		return;
1209
1210	/* XXX initial RTS rate? */
1211	rtwn_set_basicrates(sc, basicrates);
1212}
1213
1214static int
1215rtwn_run(struct rtwn_softc *sc, struct ieee80211vap *vap)
1216{
1217	struct ieee80211com *ic = vap->iv_ic;
1218	struct rtwn_vap *uvp = RTWN_VAP(vap);
1219	struct ieee80211_node *ni;
1220	uint8_t mode;
1221	int error;
1222
1223	RTWN_ASSERT_LOCKED(sc);
1224
1225	error = 0;
1226	ni = ieee80211_ref_node(vap->iv_bss);
1227
1228	if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1229	    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1230		error = EINVAL;
1231		goto fail;
1232	}
1233
1234	switch (vap->iv_opmode) {
1235	case IEEE80211_M_STA:
1236		mode = R92C_MSR_INFRA;
1237		break;
1238	case IEEE80211_M_IBSS:
1239		mode = R92C_MSR_ADHOC;
1240		break;
1241	case IEEE80211_M_HOSTAP:
1242		mode = R92C_MSR_AP;
1243		break;
1244	default:
1245		KASSERT(0, ("undefined opmode %d\n", vap->iv_opmode));
1246		error = EINVAL;
1247		goto fail;
1248	}
1249
1250	/* Set media status to 'Associated'. */
1251	rtwn_set_mode(sc, mode, uvp->id);
1252
1253	/* Set AssocID. */
1254	/* XXX multi-vap? */
1255	rtwn_write_2(sc, R92C_BCN_PSR_RPT,
1256	    0xc000 | IEEE80211_NODE_AID(ni));
1257
1258	/* Set BSSID. */
1259	rtwn_set_bssid(sc, ni->ni_bssid, uvp->id);
1260
1261	/* Set beacon interval. */
1262	rtwn_write_2(sc, R92C_BCN_INTERVAL(uvp->id), ni->ni_intval);
1263
1264	if (sc->vaps_running == sc->monvaps_running) {
1265		/* Enable Rx of data frames. */
1266		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1267
1268		/* Flush all AC queues. */
1269		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1270	}
1271
1272#ifndef RTWN_WITHOUT_UCODE
1273	/* Upload (QoS) Null Data frame to firmware. */
1274	/* Note: do this for port 0 only. */
1275	if ((ic->ic_caps & IEEE80211_C_PMGT) != 0 &&
1276	    vap->iv_opmode == IEEE80211_M_STA && uvp->id == 0) {
1277		error = rtwn_tx_fwpkt_check(sc, vap);
1278		if (error != 0)
1279			goto fail;
1280
1281		/* Setup power management. */
1282		/*
1283		 * NB: it will be enabled immediately - delay it,
1284		 * so 4-Way handshake will not be interrupted.
1285		 */
1286		callout_reset(&sc->sc_pwrmode_init, 5*hz,
1287		    rtwn_pwrmode_init, sc);
1288	}
1289#endif
1290
1291	/* Enable TSF synchronization. */
1292	rtwn_tsf_sync_enable(sc, vap);
1293
1294	if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1295	    vap->iv_opmode == IEEE80211_M_IBSS) {
1296		error = rtwn_setup_beacon(sc, ni);
1297		if (error != 0) {
1298			device_printf(sc->sc_dev,
1299			    "unable to push beacon into the chip, "
1300			    "error %d\n", error);
1301			goto fail;
1302		}
1303	}
1304
1305	/* Set ACK preamble type. */
1306	rtwn_set_ack_preamble(sc);
1307
1308	/* Set basic rates mask. */
1309	rtwn_calc_basicrates(sc);
1310
1311#ifdef RTWN_TODO
1312	rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1313	rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1314	rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1315	rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1316	rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1317	rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1318#endif
1319
1320	if (sc->vaps_running == sc->monvaps_running) {
1321		/* Reset temperature calibration state machine. */
1322		sc->sc_flags &= ~RTWN_TEMP_MEASURED;
1323		sc->thcal_temp = sc->thermal_meter;
1324
1325		/* Start periodic calibration. */
1326		callout_reset(&sc->sc_calib_to, 2*hz, rtwn_calib_to,
1327		    sc);
1328
1329		if (sc->vaps_running == 0) {
1330			/* Turn link LED on. */
1331			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1332		}
1333	}
1334
1335fail:
1336	ieee80211_free_node(ni);
1337
1338	return (error);
1339}
1340
1341#ifndef D4054
1342static void
1343rtwn_watchdog(void *arg)
1344{
1345	struct rtwn_softc *sc = arg;
1346	struct ieee80211com *ic = &sc->sc_ic;
1347
1348	RTWN_ASSERT_LOCKED(sc);
1349
1350	KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1351
1352	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1353		ic_printf(ic, "device timeout\n");
1354		ieee80211_restart_all(ic);
1355		return;
1356	}
1357	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
1358}
1359#endif
1360
1361static void
1362rtwn_parent(struct ieee80211com *ic)
1363{
1364	struct rtwn_softc *sc = ic->ic_softc;
1365	struct ieee80211vap *vap;
1366
1367	if (ic->ic_nrunning > 0) {
1368		if (rtwn_init(sc) != 0) {
1369			IEEE80211_LOCK(ic);
1370			TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next)
1371				ieee80211_stop_locked(vap);
1372			IEEE80211_UNLOCK(ic);
1373		} else
1374			ieee80211_start_all(ic);
1375	} else
1376		rtwn_stop(sc);
1377}
1378
1379static int
1380rtwn_dma_init(struct rtwn_softc *sc)
1381{
1382#define RTWN_CHK(res) do {	\
1383	if (res != 0)		\
1384		return (EIO);	\
1385} while(0)
1386	uint16_t reg;
1387	uint8_t tx_boundary;
1388	int error;
1389
1390	/* Initialize LLT table. */
1391	error = rtwn_llt_init(sc);
1392	if (error != 0)
1393		return (error);
1394
1395	/* Set the number of pages for each queue. */
1396	RTWN_DPRINTF(sc, RTWN_DEBUG_RESET,
1397	    "%s: pages per queue: high %d, normal %d, low %d, public %d\n",
1398	    __func__, sc->nhqpages, sc->nnqpages, sc->nlqpages,
1399	    sc->npubqpages);
1400
1401	RTWN_CHK(rtwn_write_1(sc, R92C_RQPN_NPQ, sc->nnqpages));
1402	RTWN_CHK(rtwn_write_4(sc, R92C_RQPN,
1403	    /* Set number of pages for public queue. */
1404	    SM(R92C_RQPN_PUBQ, sc->npubqpages) |
1405	    /* Set number of pages for high priority queue. */
1406	    SM(R92C_RQPN_HPQ, sc->nhqpages) |
1407	    /* Set number of pages for low priority queue. */
1408	    SM(R92C_RQPN_LPQ, sc->nlqpages) |
1409	    /* Load values. */
1410	    R92C_RQPN_LD));
1411
1412	/* Initialize TX buffer boundary. */
1413	KASSERT(sc->page_count < 255 && sc->page_count > 0,
1414	    ("page_count is %d\n", sc->page_count));
1415	tx_boundary = sc->page_count + 1;
1416	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary));
1417	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary));
1418	RTWN_CHK(rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary));
1419	RTWN_CHK(rtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary));
1420	RTWN_CHK(rtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary));
1421
1422	error = rtwn_init_bcnq1_boundary(sc);
1423	if (error != 0)
1424		return (error);
1425
1426	/* Set queue to USB pipe mapping. */
1427	/* Note: PCIe devices are using some magic number here. */
1428	reg = rtwn_get_qmap(sc);
1429	RTWN_CHK(rtwn_setbits_2(sc, R92C_TRXDMA_CTRL,
1430	    R92C_TRXDMA_CTRL_QMAP_M, reg));
1431
1432	/* Configure Tx/Rx DMA (PCIe). */
1433	rtwn_set_desc_addr(sc);
1434
1435	/* Set Tx/Rx transfer page boundary. */
1436	RTWN_CHK(rtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
1437	    sc->rx_dma_size - 1));
1438
1439	/* Set Tx/Rx transfer page size. */
1440	rtwn_set_page_size(sc);
1441
1442	return (0);
1443}
1444
1445static int
1446rtwn_mac_init(struct rtwn_softc *sc)
1447{
1448	int i, error;
1449
1450	/* Write MAC initialization values. */
1451	for (i = 0; i < sc->mac_size; i++) {
1452		error = rtwn_write_1(sc, sc->mac_prog[i].reg,
1453		    sc->mac_prog[i].val);
1454		if (error != 0)
1455			return (error);
1456	}
1457
1458	return (0);
1459}
1460
1461static void
1462rtwn_mrr_init(struct rtwn_softc *sc)
1463{
1464	int i;
1465
1466	/* Drop rate index by 1 per retry. */
1467	for (i = 0; i < R92C_DARFRC_SIZE; i++) {
1468		rtwn_write_1(sc, R92C_DARFRC + i, i + 1);
1469		rtwn_write_1(sc, R92C_RARFRC + i, i + 1);
1470	}
1471}
1472
1473static void
1474rtwn_scan_start(struct ieee80211com *ic)
1475{
1476	struct rtwn_softc *sc = ic->ic_softc;
1477
1478	RTWN_LOCK(sc);
1479	/* Pause beaconing. */
1480	rtwn_setbits_1(sc, R92C_TXPAUSE, 0, R92C_TX_QUEUE_BCN);
1481	/* Receive beacons / probe responses from any BSSID. */
1482	if (sc->bcn_vaps == 0)
1483		rtwn_set_rx_bssid_all(sc, 1);
1484	RTWN_UNLOCK(sc);
1485}
1486
1487static void
1488rtwn_scan_curchan(struct ieee80211_scan_state *ss, unsigned long maxdwell)
1489{
1490	struct rtwn_softc *sc = ss->ss_ic->ic_softc;
1491
1492	/* Make link LED blink during scan. */
1493	RTWN_LOCK(sc);
1494	rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1495	RTWN_UNLOCK(sc);
1496
1497	sc->sc_scan_curchan(ss, maxdwell);
1498}
1499
1500static void
1501rtwn_scan_end(struct ieee80211com *ic)
1502{
1503	struct rtwn_softc *sc = ic->ic_softc;
1504
1505	RTWN_LOCK(sc);
1506	/* Restore limitations. */
1507	if (ic->ic_promisc == 0 && sc->bcn_vaps == 0)
1508		rtwn_set_rx_bssid_all(sc, 0);
1509
1510	/* Restore LED state. */
1511	rtwn_set_led(sc, RTWN_LED_LINK, (sc->vaps_running != 0));
1512
1513	/* Restore basic rates mask. */
1514	rtwn_calc_basicrates(sc);
1515
1516	/* Resume beaconing. */
1517	rtwn_setbits_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_BCN, 0);
1518	RTWN_UNLOCK(sc);
1519}
1520
1521static void
1522rtwn_getradiocaps(struct ieee80211com *ic,
1523    int maxchans, int *nchans, struct ieee80211_channel chans[])
1524{
1525	struct rtwn_softc *sc = ic->ic_softc;
1526	uint8_t bands[IEEE80211_MODE_BYTES];
1527	int cbw_flags, i;
1528
1529	cbw_flags = (ic->ic_htcaps & IEEE80211_HTCAP_CHWIDTH40) ?
1530	    NET80211_CBW_FLAG_HT40 : 0;
1531
1532	memset(bands, 0, sizeof(bands));
1533	setbit(bands, IEEE80211_MODE_11B);
1534	setbit(bands, IEEE80211_MODE_11G);
1535	setbit(bands, IEEE80211_MODE_11NG);
1536	ieee80211_add_channels_default_2ghz(chans, maxchans, nchans,
1537	    bands, cbw_flags);
1538
1539	/* XXX workaround add_channel_list() limitations */
1540	setbit(bands, IEEE80211_MODE_11A);
1541	setbit(bands, IEEE80211_MODE_11NA);
1542	for (i = 0; i < nitems(sc->chan_num_5ghz); i++) {
1543		if (sc->chan_num_5ghz[i] == 0)
1544			continue;
1545
1546		ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
1547		    sc->chan_list_5ghz[i], sc->chan_num_5ghz[i], bands,
1548		    cbw_flags);
1549	}
1550}
1551
1552static void
1553rtwn_update_chw(struct ieee80211com *ic)
1554{
1555}
1556
1557static void
1558rtwn_set_channel(struct ieee80211com *ic)
1559{
1560	struct rtwn_softc *sc = ic->ic_softc;
1561	struct ieee80211_channel *c = ic->ic_curchan;
1562
1563	RTWN_LOCK(sc);
1564	rtwn_set_chan(sc, c);
1565	RTWN_UNLOCK(sc);
1566}
1567
1568static int
1569rtwn_wme_update(struct ieee80211com *ic)
1570{
1571	struct chanAccParams chp;
1572	struct ieee80211_channel *c = ic->ic_curchan;
1573	struct rtwn_softc *sc = ic->ic_softc;
1574	struct wmeParams *wmep = sc->cap_wmeParams;
1575	uint8_t aifs, acm, slottime;
1576	int ac;
1577
1578	ieee80211_wme_ic_getparams(ic, &chp);
1579
1580	/* Prevent possible races. */
1581	IEEE80211_LOCK(ic);	/* XXX */
1582	RTWN_LOCK(sc);
1583	memcpy(wmep, chp.cap_wmeParams, sizeof(sc->cap_wmeParams));
1584	RTWN_UNLOCK(sc);
1585	IEEE80211_UNLOCK(ic);
1586
1587	acm = 0;
1588	slottime = IEEE80211_GET_SLOTTIME(ic);
1589
1590	RTWN_LOCK(sc);
1591	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1592		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1593		aifs = wmep[ac].wmep_aifsn * slottime +
1594		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1595			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1596		rtwn_write_4(sc, wme2reg[ac],
1597		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
1598		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
1599		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
1600		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1601		if (ac != WME_AC_BE)
1602			acm |= wmep[ac].wmep_acm << ac;
1603	}
1604
1605	if (acm != 0)
1606		acm |= R92C_ACMHWCTRL_EN;
1607	rtwn_setbits_1(sc, R92C_ACMHWCTRL, R92C_ACMHWCTRL_ACM_MASK, acm);
1608	RTWN_UNLOCK(sc);
1609
1610	return 0;
1611}
1612
1613static void
1614rtwn_update_slot(struct ieee80211com *ic)
1615{
1616	rtwn_cmd_sleepable(ic->ic_softc, NULL, 0, rtwn_update_slot_cb);
1617}
1618
1619static void
1620rtwn_update_slot_cb(struct rtwn_softc *sc, union sec_param *data)
1621{
1622	struct ieee80211com *ic = &sc->sc_ic;
1623	uint8_t slottime;
1624
1625	slottime = IEEE80211_GET_SLOTTIME(ic);
1626
1627	RTWN_DPRINTF(sc, RTWN_DEBUG_STATE, "%s: setting slot time to %uus\n",
1628	    __func__, slottime);
1629
1630	rtwn_write_1(sc, R92C_SLOT, slottime);
1631	rtwn_update_aifs(sc, slottime);
1632}
1633
1634static void
1635rtwn_update_aifs(struct rtwn_softc *sc, uint8_t slottime)
1636{
1637	struct ieee80211_channel *c = sc->sc_ic.ic_curchan;
1638	const struct wmeParams *wmep = sc->cap_wmeParams;
1639	uint8_t aifs, ac;
1640
1641	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
1642		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1643		aifs = wmep[ac].wmep_aifsn * slottime +
1644		    (IEEE80211_IS_CHAN_5GHZ(c) ?
1645			IEEE80211_DUR_OFDM_SIFS : IEEE80211_DUR_SIFS);
1646		rtwn_write_1(sc, wme2reg[ac], aifs);
1647	}
1648}
1649
1650static void
1651rtwn_update_promisc(struct ieee80211com *ic)
1652{
1653	struct rtwn_softc *sc = ic->ic_softc;
1654
1655	RTWN_LOCK(sc);
1656	if (sc->sc_flags & RTWN_RUNNING)
1657		rtwn_set_promisc(sc);
1658	RTWN_UNLOCK(sc);
1659}
1660
1661static void
1662rtwn_update_mcast(struct ieee80211com *ic)
1663{
1664	struct rtwn_softc *sc = ic->ic_softc;
1665
1666	RTWN_LOCK(sc);
1667	if (sc->sc_flags & RTWN_RUNNING)
1668		rtwn_set_multi(sc);
1669	RTWN_UNLOCK(sc);
1670}
1671
1672static int
1673rtwn_set_bssid(struct rtwn_softc *sc, const uint8_t *bssid, int id)
1674{
1675	int error;
1676
1677	error = rtwn_write_4(sc, R92C_BSSID(id), le32dec(&bssid[0]));
1678	if (error != 0)
1679		return (error);
1680	error = rtwn_write_2(sc, R92C_BSSID(id) + 4, le16dec(&bssid[4]));
1681
1682	return (error);
1683}
1684
1685static int
1686rtwn_set_macaddr(struct rtwn_softc *sc, const uint8_t *addr, int id)
1687{
1688	int error;
1689
1690	error = rtwn_write_4(sc, R92C_MACID(id), le32dec(&addr[0]));
1691	if (error != 0)
1692		return (error);
1693	error = rtwn_write_2(sc, R92C_MACID(id) + 4, le16dec(&addr[4]));
1694
1695	return (error);
1696}
1697
1698static struct ieee80211_node *
1699rtwn_node_alloc(struct ieee80211vap *vap,
1700    const uint8_t mac[IEEE80211_ADDR_LEN])
1701{
1702	struct rtwn_node *un;
1703
1704	un = malloc(sizeof (struct rtwn_node), M_80211_NODE,
1705	    M_NOWAIT | M_ZERO);
1706
1707	if (un == NULL)
1708		return NULL;
1709
1710	un->id = RTWN_MACID_UNDEFINED;
1711	un->avg_pwdb = -1;
1712
1713	return &un->ni;
1714}
1715
1716static void
1717rtwn_newassoc(struct ieee80211_node *ni, int isnew __unused)
1718{
1719	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1720	struct rtwn_node *un = RTWN_NODE(ni);
1721	int id;
1722
1723	if (un->id != RTWN_MACID_UNDEFINED)
1724		return;
1725
1726	RTWN_NT_LOCK(sc);
1727	for (id = 0; id <= sc->macid_limit; id++) {
1728		if (id != RTWN_MACID_BC && sc->node_list[id] == NULL) {
1729			un->id = id;
1730			sc->node_list[id] = ni;
1731			break;
1732		}
1733	}
1734	RTWN_NT_UNLOCK(sc);
1735
1736	if (id > sc->macid_limit) {
1737		device_printf(sc->sc_dev, "%s: node table is full\n",
1738		    __func__);
1739		return;
1740	}
1741
1742	/* Notify firmware. */
1743	id |= RTWN_MACID_VALID;
1744	rtwn_cmd_sleepable(sc, &id, sizeof(id), rtwn_set_media_status);
1745}
1746
1747static void
1748rtwn_node_free(struct ieee80211_node *ni)
1749{
1750	struct rtwn_softc *sc = ni->ni_ic->ic_softc;
1751	struct rtwn_node *un = RTWN_NODE(ni);
1752
1753	RTWN_NT_LOCK(sc);
1754	if (un->id != RTWN_MACID_UNDEFINED) {
1755		sc->node_list[un->id] = NULL;
1756		rtwn_cmd_sleepable(sc, &un->id, sizeof(un->id),
1757		    rtwn_set_media_status);
1758	}
1759	RTWN_NT_UNLOCK(sc);
1760
1761	sc->sc_node_free(ni);
1762}
1763
1764static void
1765rtwn_init_beacon_reg(struct rtwn_softc *sc)
1766{
1767	rtwn_write_1(sc, R92C_BCN_CTRL(0), R92C_BCN_CTRL_DIS_TSF_UDT0);
1768	rtwn_write_1(sc, R92C_BCN_CTRL(1), R92C_BCN_CTRL_DIS_TSF_UDT0);
1769	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
1770	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
1771	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
1772	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
1773}
1774
1775static int
1776rtwn_init(struct rtwn_softc *sc)
1777{
1778	struct ieee80211com *ic = &sc->sc_ic;
1779	int i, error;
1780
1781	RTWN_LOCK(sc);
1782	if (sc->sc_flags & RTWN_RUNNING) {
1783		RTWN_UNLOCK(sc);
1784		return (0);
1785	}
1786	sc->sc_flags |= RTWN_STARTED;
1787
1788	/* Power on adapter. */
1789	error = rtwn_power_on(sc);
1790	if (error != 0)
1791		goto fail;
1792
1793#ifndef RTWN_WITHOUT_UCODE
1794	/* Load 8051 microcode. */
1795	error = rtwn_load_firmware(sc);
1796	if (error == 0)
1797		sc->sc_flags |= RTWN_FW_LOADED;
1798
1799	/* Init firmware commands ring. */
1800	sc->fwcur = 0;
1801#endif
1802
1803	/* Initialize MAC block. */
1804	error = rtwn_mac_init(sc);
1805	if (error != 0) {
1806		device_printf(sc->sc_dev,
1807		    "%s: error while initializing MAC block\n", __func__);
1808		goto fail;
1809	}
1810
1811	/* Initialize DMA. */
1812	error = rtwn_dma_init(sc);
1813	if (error != 0)
1814		goto fail;
1815
1816	/* Drop incorrect TX (USB). */
1817	rtwn_drop_incorrect_tx(sc);
1818
1819	/* Set info size in Rx descriptors (in 64-bit words). */
1820	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, R92C_RX_DRVINFO_SZ_DEF);
1821
1822	/* Init interrupts. */
1823	rtwn_init_intr(sc);
1824
1825	for (i = 0; i < nitems(sc->vaps); i++) {
1826		struct rtwn_vap *uvp = sc->vaps[i];
1827
1828		/* Set initial network type. */
1829		rtwn_set_mode(sc, R92C_MSR_NOLINK, i);
1830
1831		if (uvp == NULL)
1832			continue;
1833
1834		/* Set MAC address. */
1835		error = rtwn_set_macaddr(sc, uvp->vap.iv_myaddr, uvp->id);
1836		if (error != 0)
1837			goto fail;
1838	}
1839
1840	/* Initialize Rx filter. */
1841	rtwn_rxfilter_init(sc);
1842
1843	/* Set short/long retry limits. */
1844	rtwn_write_2(sc, R92C_RL,
1845	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
1846
1847	/* Initialize EDCA parameters. */
1848	rtwn_init_edca(sc);
1849
1850	rtwn_setbits_1(sc, R92C_FWHW_TXQ_CTRL, 0,
1851	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
1852	/* Set ACK timeout. */
1853	rtwn_write_1(sc, R92C_ACKTO, sc->ackto);
1854
1855	/* Setup aggregation. */
1856	/* Tx aggregation. */
1857	rtwn_init_tx_agg(sc);
1858	rtwn_init_rx_agg(sc);
1859
1860	/* Initialize beacon parameters. */
1861	rtwn_init_beacon_reg(sc);
1862
1863	/* Init A-MPDU parameters. */
1864	rtwn_init_ampdu(sc);
1865
1866	/* Init MACTXEN / MACRXEN after setting RxFF boundary. */
1867	rtwn_setbits_1(sc, R92C_CR, 0, R92C_CR_MACTXEN | R92C_CR_MACRXEN);
1868
1869	/* Initialize BB/RF blocks. */
1870	rtwn_init_bb(sc);
1871	rtwn_init_rf(sc);
1872
1873	/* Initialize wireless band. */
1874	rtwn_set_chan(sc, ic->ic_curchan);
1875
1876	/* Clear per-station keys table. */
1877	rtwn_init_cam(sc);
1878
1879	/* Enable decryption / encryption. */
1880	rtwn_init_seccfg(sc);
1881
1882	/* Install static keys (if any). */
1883	for (i = 0; i < nitems(sc->vaps); i++) {
1884		if (sc->vaps[i] != NULL) {
1885			error = rtwn_init_static_keys(sc, sc->vaps[i]);
1886			if (error != 0)
1887				goto fail;
1888		}
1889	}
1890
1891	/* Initialize antenna selection. */
1892	rtwn_init_antsel(sc);
1893
1894	/* Enable hardware sequence numbering. */
1895	rtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
1896
1897	/* Disable BAR. */
1898	rtwn_write_4(sc, R92C_BAR_MODE_CTRL, 0x0201ffff);
1899
1900	/* NAV limit. */
1901	rtwn_write_1(sc, R92C_NAV_UPPER, 0);
1902
1903	/* Initialize GPIO setting. */
1904	rtwn_setbits_1(sc, R92C_GPIO_MUXCFG, R92C_GPIO_MUXCFG_ENBT, 0);
1905
1906	/* Initialize MRR. */
1907	rtwn_mrr_init(sc);
1908
1909	/* Device-specific post initialization. */
1910	rtwn_post_init(sc);
1911
1912	rtwn_start_xfers(sc);
1913
1914#ifndef D4054
1915	callout_reset(&sc->sc_watchdog_to, hz, rtwn_watchdog, sc);
1916#endif
1917
1918	sc->sc_flags |= RTWN_RUNNING;
1919fail:
1920	RTWN_UNLOCK(sc);
1921
1922	return (error);
1923}
1924
1925static void
1926rtwn_stop(struct rtwn_softc *sc)
1927{
1928
1929	RTWN_LOCK(sc);
1930	if (!(sc->sc_flags & RTWN_STARTED)) {
1931		RTWN_UNLOCK(sc);
1932		return;
1933	}
1934
1935#ifndef D4054
1936	callout_stop(&sc->sc_watchdog_to);
1937	sc->sc_tx_timer = 0;
1938#endif
1939	sc->sc_flags &= ~(RTWN_STARTED | RTWN_RUNNING | RTWN_FW_LOADED);
1940	sc->sc_flags &= ~RTWN_TEMP_MEASURED;
1941	sc->fwver = 0;
1942	sc->thcal_temp = 0;
1943	sc->cur_bcnq_id = RTWN_VAP_ID_INVALID;
1944	bzero(&sc->last_physt, sizeof(sc->last_physt));
1945
1946#ifdef D4054
1947	ieee80211_tx_watchdog_stop(&sc->sc_ic);
1948#endif
1949
1950	rtwn_abort_xfers(sc);
1951	rtwn_drain_mbufq(sc);
1952	rtwn_power_off(sc);
1953	rtwn_reset_lists(sc, NULL);
1954	RTWN_UNLOCK(sc);
1955}
1956
1957MODULE_VERSION(rtwn, 2);
1958MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
1959#ifndef RTWN_WITHOUT_UCODE
1960MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
1961#endif
1962