if_urtwn.c revision 252196
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include <sys/cdefs.h>
20__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 252196 2013-06-25 06:43:04Z kevlo $");
21
22/*
23 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188RU/RTL8192CU.
24 */
25
26#include <sys/param.h>
27#include <sys/sockio.h>
28#include <sys/sysctl.h>
29#include <sys/lock.h>
30#include <sys/mutex.h>
31#include <sys/mbuf.h>
32#include <sys/kernel.h>
33#include <sys/socket.h>
34#include <sys/systm.h>
35#include <sys/malloc.h>
36#include <sys/module.h>
37#include <sys/bus.h>
38#include <sys/endian.h>
39#include <sys/linker.h>
40#include <sys/firmware.h>
41#include <sys/kdb.h>
42
43#include <machine/bus.h>
44#include <machine/resource.h>
45#include <sys/rman.h>
46
47#include <net/bpf.h>
48#include <net/if.h>
49#include <net/if_arp.h>
50#include <net/ethernet.h>
51#include <net/if_dl.h>
52#include <net/if_media.h>
53#include <net/if_types.h>
54
55#include <netinet/in.h>
56#include <netinet/in_systm.h>
57#include <netinet/in_var.h>
58#include <netinet/if_ether.h>
59#include <netinet/ip.h>
60
61#include <net80211/ieee80211_var.h>
62#include <net80211/ieee80211_regdomain.h>
63#include <net80211/ieee80211_radiotap.h>
64#include <net80211/ieee80211_ratectl.h>
65
66#include <dev/usb/usb.h>
67#include <dev/usb/usbdi.h>
68#include "usbdevs.h"
69
70#define USB_DEBUG_VAR urtwn_debug
71#include <dev/usb/usb_debug.h>
72
73#include <dev/usb/wlan/if_urtwnreg.h>
74
75#ifdef USB_DEBUG
76static int urtwn_debug = 0;
77
78SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
79SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
80    "Debug level");
81#endif
82
83#define	IEEE80211_HAS_ADDR4(wh)	\
84	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
85
86/* various supported device vendors/products */
87static const STRUCT_USB_HOST_ID urtwn_devs[] = {
88#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
89	URTWN_DEV(ABOCOM,	RTL8188CU_1),
90	URTWN_DEV(ABOCOM,	RTL8188CU_2),
91	URTWN_DEV(ABOCOM,	RTL8192CU),
92	URTWN_DEV(ASUS,		RTL8192CU),
93	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
94	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
95	URTWN_DEV(AZUREWAVE,	RTL8188CU),
96	URTWN_DEV(BELKIN,	F7D2102),
97	URTWN_DEV(BELKIN,	RTL8188CU),
98	URTWN_DEV(BELKIN,	RTL8192CU),
99	URTWN_DEV(CHICONY,	RTL8188CUS_1),
100	URTWN_DEV(CHICONY,	RTL8188CUS_2),
101	URTWN_DEV(CHICONY,	RTL8188CUS_3),
102	URTWN_DEV(CHICONY,	RTL8188CUS_4),
103	URTWN_DEV(CHICONY,	RTL8188CUS_5),
104	URTWN_DEV(COREGA,	RTL8192CU),
105	URTWN_DEV(DLINK,	RTL8188CU),
106	URTWN_DEV(DLINK,	RTL8192CU_1),
107	URTWN_DEV(DLINK,	RTL8192CU_2),
108	URTWN_DEV(DLINK,	RTL8192CU_3),
109	URTWN_DEV(DLINK,	DWA131B),
110	URTWN_DEV(EDIMAX,	EW7811UN),
111	URTWN_DEV(EDIMAX,	RTL8192CU),
112	URTWN_DEV(FEIXUN,	RTL8188CU),
113	URTWN_DEV(FEIXUN,	RTL8192CU),
114	URTWN_DEV(GUILLEMOT,	HWNUP150),
115	URTWN_DEV(HAWKING,	RTL8192CU),
116	URTWN_DEV(HP3,		RTL8188CU),
117	URTWN_DEV(NETGEAR,	WNA1000M),
118	URTWN_DEV(NETGEAR,	RTL8192CU),
119	URTWN_DEV(NETGEAR4,	RTL8188CU),
120	URTWN_DEV(NOVATECH,	RTL8188CU),
121	URTWN_DEV(PLANEX2,	RTL8188CU_1),
122	URTWN_DEV(PLANEX2,	RTL8188CU_2),
123	URTWN_DEV(PLANEX2,	RTL8188CU_3),
124	URTWN_DEV(PLANEX2,	RTL8188CU_4),
125	URTWN_DEV(PLANEX2,	RTL8188CUS),
126	URTWN_DEV(PLANEX2,	RTL8192CU),
127	URTWN_DEV(REALTEK,	RTL8188CE_0),
128	URTWN_DEV(REALTEK,	RTL8188CE_1),
129	URTWN_DEV(REALTEK,	RTL8188CTV),
130	URTWN_DEV(REALTEK,	RTL8188CU_0),
131	URTWN_DEV(REALTEK,	RTL8188CU_1),
132	URTWN_DEV(REALTEK,	RTL8188CU_2),
133	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
134	URTWN_DEV(REALTEK,	RTL8188CUS),
135	URTWN_DEV(REALTEK,	RTL8188RU_1),
136	URTWN_DEV(REALTEK,	RTL8188RU_2),
137	URTWN_DEV(REALTEK,	RTL8191CU),
138	URTWN_DEV(REALTEK,	RTL8192CE),
139	URTWN_DEV(REALTEK,	RTL8192CU),
140	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
141	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
142	URTWN_DEV(SITECOMEU,	RTL8192CU),
143	URTWN_DEV(TRENDNET,	RTL8188CU),
144	URTWN_DEV(TRENDNET,	RTL8192CU),
145	URTWN_DEV(ZYXEL,	RTL8192CU),
146#undef URTWN_DEV
147};
148
149static device_probe_t	urtwn_match;
150static device_attach_t	urtwn_attach;
151static device_detach_t	urtwn_detach;
152
153static usb_callback_t   urtwn_bulk_tx_callback;
154static usb_callback_t	urtwn_bulk_rx_callback;
155
156static usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
157			    struct usb_device_request *req, void *data);
158static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
159		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
160                    const uint8_t [IEEE80211_ADDR_LEN],
161                    const uint8_t [IEEE80211_ADDR_LEN]);
162static void		urtwn_vap_delete(struct ieee80211vap *);
163static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
164			    int *);
165static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
166			    int *, int8_t *);
167static void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
168static int		urtwn_alloc_list(struct urtwn_softc *,
169			    struct urtwn_data[], int, int);
170static int		urtwn_alloc_rx_list(struct urtwn_softc *);
171static int		urtwn_alloc_tx_list(struct urtwn_softc *);
172static void		urtwn_free_tx_list(struct urtwn_softc *);
173static void		urtwn_free_rx_list(struct urtwn_softc *);
174static void		urtwn_free_list(struct urtwn_softc *,
175			    struct urtwn_data data[], int);
176static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
177static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
178static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
179			    uint8_t *, int);
180static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
181static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
182static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
183static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
184			    uint8_t *, int);
185static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
186static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
187static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
188static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
189			    const void *, int);
190static void		urtwn_rf_write(struct urtwn_softc *, int, uint8_t,
191			    uint32_t);
192static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
193static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
194			    uint32_t);
195static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
196static void		urtwn_efuse_read(struct urtwn_softc *);
197static int		urtwn_read_chipid(struct urtwn_softc *);
198static void		urtwn_read_rom(struct urtwn_softc *);
199static int		urtwn_ra_init(struct urtwn_softc *);
200static void		urtwn_tsf_sync_enable(struct urtwn_softc *);
201static void		urtwn_set_led(struct urtwn_softc *, int, int);
202static int		urtwn_newstate(struct ieee80211vap *,
203			    enum ieee80211_state, int);
204static void		urtwn_watchdog(void *);
205static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
206static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
207static int		urtwn_tx_start(struct urtwn_softc *,
208			    struct ieee80211_node *, struct mbuf *,
209			    struct urtwn_data *);
210static void		urtwn_start(struct ifnet *);
211static int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
212static int		urtwn_power_on(struct urtwn_softc *);
213static int		urtwn_llt_init(struct urtwn_softc *);
214static void		urtwn_fw_reset(struct urtwn_softc *);
215static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
216			    const uint8_t *, int);
217static int		urtwn_load_firmware(struct urtwn_softc *);
218static int		urtwn_dma_init(struct urtwn_softc *);
219static void		urtwn_mac_init(struct urtwn_softc *);
220static void		urtwn_bb_init(struct urtwn_softc *);
221static void		urtwn_rf_init(struct urtwn_softc *);
222static void		urtwn_cam_init(struct urtwn_softc *);
223static void		urtwn_pa_bias_init(struct urtwn_softc *);
224static void		urtwn_rxfilter_init(struct urtwn_softc *);
225static void		urtwn_edca_init(struct urtwn_softc *);
226static void		urtwn_write_txpower(struct urtwn_softc *, int,
227			    uint16_t[]);
228static void		urtwn_get_txpower(struct urtwn_softc *, int,
229		      	    struct ieee80211_channel *,
230			    struct ieee80211_channel *, uint16_t[]);
231static void		urtwn_set_txpower(struct urtwn_softc *,
232		    	    struct ieee80211_channel *,
233			    struct ieee80211_channel *);
234static void		urtwn_scan_start(struct ieee80211com *);
235static void		urtwn_scan_end(struct ieee80211com *);
236static void		urtwn_set_channel(struct ieee80211com *);
237static void		urtwn_set_chan(struct urtwn_softc *,
238		    	    struct ieee80211_channel *,
239			    struct ieee80211_channel *);
240static void		urtwn_update_mcast(struct ifnet *);
241static void		urtwn_iq_calib(struct urtwn_softc *);
242static void		urtwn_lc_calib(struct urtwn_softc *);
243static void		urtwn_init(void *);
244static void		urtwn_init_locked(void *);
245static void		urtwn_stop(struct ifnet *, int);
246static void		urtwn_stop_locked(struct ifnet *, int);
247static void		urtwn_abort_xfers(struct urtwn_softc *);
248static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
249			    const struct ieee80211_bpf_params *);
250
251/* Aliases. */
252#define	urtwn_bb_write	urtwn_write_4
253#define urtwn_bb_read	urtwn_read_4
254
255static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
256	[URTWN_BULK_RX] = {
257		.type = UE_BULK,
258		.endpoint = UE_ADDR_ANY,
259		.direction = UE_DIR_IN,
260		.bufsize = URTWN_RXBUFSZ,
261		.flags = {
262			.pipe_bof = 1,
263			.short_xfer_ok = 1
264		},
265		.callback = urtwn_bulk_rx_callback,
266	},
267	[URTWN_BULK_TX_BE] = {
268		.type = UE_BULK,
269		.endpoint = 0x03,
270		.direction = UE_DIR_OUT,
271		.bufsize = URTWN_TXBUFSZ,
272		.flags = {
273			.ext_buffer = 1,
274			.pipe_bof = 1,
275			.force_short_xfer = 1
276		},
277		.callback = urtwn_bulk_tx_callback,
278		.timeout = URTWN_TX_TIMEOUT,	/* ms */
279	},
280	[URTWN_BULK_TX_BK] = {
281		.type = UE_BULK,
282		.endpoint = 0x03,
283		.direction = UE_DIR_OUT,
284		.bufsize = URTWN_TXBUFSZ,
285		.flags = {
286			.ext_buffer = 1,
287			.pipe_bof = 1,
288			.force_short_xfer = 1,
289		},
290		.callback = urtwn_bulk_tx_callback,
291		.timeout = URTWN_TX_TIMEOUT,	/* ms */
292	},
293	[URTWN_BULK_TX_VI] = {
294		.type = UE_BULK,
295		.endpoint = 0x02,
296		.direction = UE_DIR_OUT,
297		.bufsize = URTWN_TXBUFSZ,
298		.flags = {
299			.ext_buffer = 1,
300			.pipe_bof = 1,
301			.force_short_xfer = 1
302		},
303		.callback = urtwn_bulk_tx_callback,
304		.timeout = URTWN_TX_TIMEOUT,	/* ms */
305	},
306	[URTWN_BULK_TX_VO] = {
307		.type = UE_BULK,
308		.endpoint = 0x02,
309		.direction = UE_DIR_OUT,
310		.bufsize = URTWN_TXBUFSZ,
311		.flags = {
312			.ext_buffer = 1,
313			.pipe_bof = 1,
314			.force_short_xfer = 1
315		},
316		.callback = urtwn_bulk_tx_callback,
317		.timeout = URTWN_TX_TIMEOUT,	/* ms */
318	},
319};
320
321static int
322urtwn_match(device_t self)
323{
324	struct usb_attach_arg *uaa = device_get_ivars(self);
325
326	if (uaa->usb_mode != USB_MODE_HOST)
327		return (ENXIO);
328	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
329		return (ENXIO);
330	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
331		return (ENXIO);
332
333	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
334}
335
336static int
337urtwn_attach(device_t self)
338{
339	struct usb_attach_arg *uaa = device_get_ivars(self);
340	struct urtwn_softc *sc = device_get_softc(self);
341	struct ifnet *ifp;
342	struct ieee80211com *ic;
343	uint8_t iface_index, bands;
344	int error;
345
346	device_set_usb_desc(self);
347	sc->sc_udev = uaa->device;
348	sc->sc_dev = self;
349
350	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
351	    MTX_NETWORK_LOCK, MTX_DEF);
352	callout_init(&sc->sc_watchdog_ch, 0);
353
354	iface_index = URTWN_IFACE_INDEX;
355	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
356	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
357	if (error) {
358		device_printf(self, "could not allocate USB transfers, "
359		    "err=%s\n", usbd_errstr(error));
360		goto detach;
361	}
362
363	URTWN_LOCK(sc);
364
365	error = urtwn_read_chipid(sc);
366	if (error) {
367		device_printf(sc->sc_dev, "unsupported test chip\n");
368		URTWN_UNLOCK(sc);
369		goto detach;
370	}
371
372	/* Determine number of Tx/Rx chains. */
373	if (sc->chip & URTWN_CHIP_92C) {
374		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
375		sc->nrxchains = 2;
376	} else {
377		sc->ntxchains = 1;
378		sc->nrxchains = 1;
379	}
380	urtwn_read_rom(sc);
381
382	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
383	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
384	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
385	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
386	    "8188CUS", sc->ntxchains, sc->nrxchains);
387
388	URTWN_UNLOCK(sc);
389
390	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
391	if (ifp == NULL) {
392		device_printf(sc->sc_dev, "can not if_alloc()\n");
393		goto detach;
394	}
395	ic = ifp->if_l2com;
396
397	ifp->if_softc = sc;
398	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
399	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
400	ifp->if_init = urtwn_init;
401	ifp->if_ioctl = urtwn_ioctl;
402	ifp->if_start = urtwn_start;
403	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
404	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
405	IFQ_SET_READY(&ifp->if_snd);
406
407	ic->ic_ifp = ifp;
408	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
409	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
410
411	/* set device capabilities */
412	ic->ic_caps =
413		  IEEE80211_C_STA		/* station mode */
414		| IEEE80211_C_MONITOR		/* monitor mode */
415		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
416		| IEEE80211_C_SHSLOT		/* short slot time supported */
417		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
418		| IEEE80211_C_WPA		/* 802.11i */
419		;
420
421	bands = 0;
422	setbit(&bands, IEEE80211_MODE_11B);
423	setbit(&bands, IEEE80211_MODE_11G);
424	ieee80211_init_channels(ic, NULL, &bands);
425
426	ieee80211_ifattach(ic, sc->sc_bssid);
427	ic->ic_raw_xmit = urtwn_raw_xmit;
428	ic->ic_scan_start = urtwn_scan_start;
429	ic->ic_scan_end = urtwn_scan_end;
430	ic->ic_set_channel = urtwn_set_channel;
431
432	ic->ic_vap_create = urtwn_vap_create;
433	ic->ic_vap_delete = urtwn_vap_delete;
434	ic->ic_update_mcast = urtwn_update_mcast;
435
436	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
437	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
438	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
439	    URTWN_RX_RADIOTAP_PRESENT);
440
441	if (bootverbose)
442		ieee80211_announce(ic);
443
444	return (0);
445
446detach:
447	urtwn_detach(self);
448	return (ENXIO);			/* failure */
449}
450
451static int
452urtwn_detach(device_t self)
453{
454	struct urtwn_softc *sc = device_get_softc(self);
455	struct ifnet *ifp = sc->sc_ifp;
456	struct ieee80211com *ic = ifp->if_l2com;
457
458	if (!device_is_attached(self))
459		return (0);
460
461	urtwn_stop(ifp, 1);
462
463	callout_drain(&sc->sc_watchdog_ch);
464
465	/* stop all USB transfers */
466	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
467	ieee80211_ifdetach(ic);
468
469	urtwn_free_tx_list(sc);
470	urtwn_free_rx_list(sc);
471
472	if_free(ifp);
473	mtx_destroy(&sc->sc_mtx);
474
475	return (0);
476}
477
478static void
479urtwn_free_tx_list(struct urtwn_softc *sc)
480{
481	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
482}
483
484static void
485urtwn_free_rx_list(struct urtwn_softc *sc)
486{
487	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
488}
489
490static void
491urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
492{
493	int i;
494
495	for (i = 0; i < ndata; i++) {
496		struct urtwn_data *dp = &data[i];
497
498		if (dp->buf != NULL) {
499			free(dp->buf, M_USBDEV);
500			dp->buf = NULL;
501		}
502		if (dp->ni != NULL) {
503			ieee80211_free_node(dp->ni);
504			dp->ni = NULL;
505		}
506	}
507}
508
509static usb_error_t
510urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
511    void *data)
512{
513	usb_error_t err;
514	int ntries = 10;
515
516	URTWN_ASSERT_LOCKED(sc);
517
518	while (ntries--) {
519		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
520		    req, data, 0, NULL, 250 /* ms */);
521		if (err == 0)
522			break;
523
524		DPRINTFN(1, "Control request failed, %s (retrying)\n",
525		    usbd_errstr(err));
526		usb_pause_mtx(&sc->sc_mtx, hz / 100);
527	}
528	return (err);
529}
530
531static struct ieee80211vap *
532urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
533    enum ieee80211_opmode opmode, int flags,
534    const uint8_t bssid[IEEE80211_ADDR_LEN],
535    const uint8_t mac[IEEE80211_ADDR_LEN])
536{
537	struct urtwn_vap *uvp;
538	struct ieee80211vap *vap;
539
540	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
541		return (NULL);
542
543	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
544	    M_80211_VAP, M_NOWAIT | M_ZERO);
545	if (uvp == NULL)
546		return (NULL);
547	vap = &uvp->vap;
548	/* enable s/w bmiss handling for sta mode */
549	ieee80211_vap_setup(ic, vap, name, unit, opmode,
550	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
551
552	/* override state transition machine */
553	uvp->newstate = vap->iv_newstate;
554	vap->iv_newstate = urtwn_newstate;
555
556	/* complete setup */
557	ieee80211_vap_attach(vap, ieee80211_media_change,
558	    ieee80211_media_status);
559	ic->ic_opmode = opmode;
560	return (vap);
561}
562
563static void
564urtwn_vap_delete(struct ieee80211vap *vap)
565{
566	struct urtwn_vap *uvp = URTWN_VAP(vap);
567
568	ieee80211_vap_detach(vap);
569	free(uvp, M_80211_VAP);
570}
571
572static struct mbuf *
573urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
574{
575	struct ifnet *ifp = sc->sc_ifp;
576	struct ieee80211com *ic = ifp->if_l2com;
577	struct ieee80211_frame *wh;
578	struct mbuf *m;
579	struct r92c_rx_stat *stat;
580	uint32_t rxdw0, rxdw3;
581	uint8_t rate;
582	int8_t rssi = 0;
583	int infosz;
584
585	/*
586	 * don't pass packets to the ieee80211 framework if the driver isn't
587	 * RUNNING.
588	 */
589	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
590		return (NULL);
591
592	stat = (struct r92c_rx_stat *)buf;
593	rxdw0 = le32toh(stat->rxdw0);
594	rxdw3 = le32toh(stat->rxdw3);
595
596	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
597		/*
598		 * This should not happen since we setup our Rx filter
599		 * to not receive these frames.
600		 */
601		ifp->if_ierrors++;
602		return (NULL);
603	}
604
605	rate = MS(rxdw3, R92C_RXDW3_RATE);
606	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
607
608	/* Get RSSI from PHY status descriptor if present. */
609	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
610		rssi = urtwn_get_rssi(sc, rate, &stat[1]);
611		/* Update our average RSSI. */
612		urtwn_update_avgrssi(sc, rate, rssi);
613	}
614
615	m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
616	if (m == NULL) {
617		device_printf(sc->sc_dev, "could not create RX mbuf\n");
618		return (NULL);
619	}
620
621	/* Finalize mbuf. */
622	m->m_pkthdr.rcvif = ifp;
623	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
624	memcpy(mtod(m, uint8_t *), wh, pktlen);
625	m->m_pkthdr.len = m->m_len = pktlen;
626
627	if (ieee80211_radiotap_active(ic)) {
628		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
629
630		tap->wr_flags = 0;
631		/* Map HW rate index to 802.11 rate. */
632		if (!(rxdw3 & R92C_RXDW3_HT)) {
633			switch (rate) {
634			/* CCK. */
635			case  0: tap->wr_rate =   2; break;
636			case  1: tap->wr_rate =   4; break;
637			case  2: tap->wr_rate =  11; break;
638			case  3: tap->wr_rate =  22; break;
639			/* OFDM. */
640			case  4: tap->wr_rate =  12; break;
641			case  5: tap->wr_rate =  18; break;
642			case  6: tap->wr_rate =  24; break;
643			case  7: tap->wr_rate =  36; break;
644			case  8: tap->wr_rate =  48; break;
645			case  9: tap->wr_rate =  72; break;
646			case 10: tap->wr_rate =  96; break;
647			case 11: tap->wr_rate = 108; break;
648			}
649		} else if (rate >= 12) {	/* MCS0~15. */
650			/* Bit 7 set means HT MCS instead of rate. */
651			tap->wr_rate = 0x80 | (rate - 12);
652		}
653		tap->wr_dbm_antsignal = rssi;
654		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
655		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
656	}
657
658	*rssi_p = rssi;
659
660	return (m);
661}
662
663static struct mbuf *
664urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
665    int8_t *nf)
666{
667	struct urtwn_softc *sc = data->sc;
668	struct ifnet *ifp = sc->sc_ifp;
669	struct r92c_rx_stat *stat;
670	struct mbuf *m, *m0 = NULL, *prevm = NULL;
671	uint32_t rxdw0;
672	uint8_t *buf;
673	int len, totlen, pktlen, infosz, npkts;
674
675	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
676
677	if (len < sizeof(*stat)) {
678		ifp->if_ierrors++;
679		return (NULL);
680	}
681
682	buf = data->buf;
683	/* Get the number of encapsulated frames. */
684	stat = (struct r92c_rx_stat *)buf;
685	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
686	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
687
688	/* Process all of them. */
689	while (npkts-- > 0) {
690		if (len < sizeof(*stat))
691			break;
692		stat = (struct r92c_rx_stat *)buf;
693		rxdw0 = le32toh(stat->rxdw0);
694
695		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
696		if (pktlen == 0)
697			break;
698
699		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
700
701		/* Make sure everything fits in xfer. */
702		totlen = sizeof(*stat) + infosz + pktlen;
703		if (totlen > len)
704			break;
705
706		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
707		if (m0 == NULL)
708			m0 = m;
709		if (prevm == NULL)
710			prevm = m;
711		else {
712			prevm->m_next = m;
713			prevm = m;
714		}
715
716		/* Next chunk is 128-byte aligned. */
717		totlen = (totlen + 127) & ~127;
718		buf += totlen;
719		len -= totlen;
720	}
721
722	return (m0);
723}
724
725static void
726urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
727{
728	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
729	struct ifnet *ifp = sc->sc_ifp;
730	struct ieee80211com *ic = ifp->if_l2com;
731	struct ieee80211_frame *wh;
732	struct ieee80211_node *ni;
733	struct mbuf *m = NULL, *next;
734	struct urtwn_data *data;
735	int8_t nf;
736	int rssi = 1;
737
738	URTWN_ASSERT_LOCKED(sc);
739
740	switch (USB_GET_STATE(xfer)) {
741	case USB_ST_TRANSFERRED:
742		data = STAILQ_FIRST(&sc->sc_rx_active);
743		if (data == NULL)
744			goto tr_setup;
745		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
746		m = urtwn_rxeof(xfer, data, &rssi, &nf);
747		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
748		/* FALLTHROUGH */
749	case USB_ST_SETUP:
750tr_setup:
751		data = STAILQ_FIRST(&sc->sc_rx_inactive);
752		if (data == NULL) {
753			KASSERT(m == NULL, ("mbuf isn't NULL"));
754			return;
755		}
756		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
757		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
758		usbd_xfer_set_frame_data(xfer, 0, data->buf,
759		    usbd_xfer_max_len(xfer));
760		usbd_transfer_submit(xfer);
761
762		/*
763		 * To avoid LOR we should unlock our private mutex here to call
764		 * ieee80211_input() because here is at the end of a USB
765		 * callback and safe to unlock.
766		 */
767		URTWN_UNLOCK(sc);
768		while (m != NULL) {
769			next = m->m_next;
770			m->m_next = NULL;
771			wh = mtod(m, struct ieee80211_frame *);
772			ni = ieee80211_find_rxnode(ic,
773			    (struct ieee80211_frame_min *)wh);
774			nf = URTWN_NOISE_FLOOR;
775			if (ni != NULL) {
776				(void)ieee80211_input(ni, m, rssi, nf);
777				ieee80211_free_node(ni);
778			} else
779				(void)ieee80211_input_all(ic, m, rssi, nf);
780			m = next;
781		}
782		URTWN_LOCK(sc);
783		break;
784	default:
785		/* needs it to the inactive queue due to a error. */
786		data = STAILQ_FIRST(&sc->sc_rx_active);
787		if (data != NULL) {
788			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
789			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
790		}
791		if (error != USB_ERR_CANCELLED) {
792			usbd_xfer_set_stall(xfer);
793			ifp->if_ierrors++;
794			goto tr_setup;
795		}
796		break;
797	}
798}
799
800static void
801urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
802{
803	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
804	struct ifnet *ifp = sc->sc_ifp;
805	struct mbuf *m;
806
807	URTWN_ASSERT_LOCKED(sc);
808
809	/*
810	 * Do any tx complete callback.  Note this must be done before releasing
811	 * the node reference.
812	 */
813	if (data->m) {
814		m = data->m;
815		if (m->m_flags & M_TXCB) {
816			/* XXX status? */
817			ieee80211_process_callback(data->ni, m, 0);
818		}
819		m_freem(m);
820		data->m = NULL;
821	}
822	if (data->ni) {
823		ieee80211_free_node(data->ni);
824		data->ni = NULL;
825	}
826	sc->sc_txtimer = 0;
827	ifp->if_opackets++;
828	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
829}
830
831static void
832urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
833{
834	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
835	struct ifnet *ifp = sc->sc_ifp;
836	struct urtwn_data *data;
837
838	URTWN_ASSERT_LOCKED(sc);
839
840	switch (USB_GET_STATE(xfer)){
841	case USB_ST_TRANSFERRED:
842		data = STAILQ_FIRST(&sc->sc_tx_active);
843		if (data == NULL)
844			goto tr_setup;
845		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
846		urtwn_txeof(xfer, data);
847		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
848		/* FALLTHROUGH */
849	case USB_ST_SETUP:
850tr_setup:
851		data = STAILQ_FIRST(&sc->sc_tx_pending);
852		if (data == NULL) {
853			DPRINTF("%s: empty pending queue\n", __func__);
854			return;
855		}
856		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
857		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
858
859		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
860		usbd_transfer_submit(xfer);
861
862		URTWN_UNLOCK(sc);
863		urtwn_start(ifp);
864		URTWN_LOCK(sc);
865		break;
866	default:
867		data = STAILQ_FIRST(&sc->sc_tx_active);
868		if (data == NULL)
869			goto tr_setup;
870		if (data->ni != NULL) {
871			ieee80211_free_node(data->ni);
872			data->ni = NULL;
873			ifp->if_oerrors++;
874		}
875		if (error != USB_ERR_CANCELLED) {
876			usbd_xfer_set_stall(xfer);
877			goto tr_setup;
878		}
879		break;
880	}
881}
882
883static struct urtwn_data *
884_urtwn_getbuf(struct urtwn_softc *sc)
885{
886	struct urtwn_data *bf;
887
888	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
889	if (bf != NULL)
890		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
891	else
892		bf = NULL;
893	if (bf == NULL)
894		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
895	return (bf);
896}
897
898static struct urtwn_data *
899urtwn_getbuf(struct urtwn_softc *sc)
900{
901        struct urtwn_data *bf;
902
903	URTWN_ASSERT_LOCKED(sc);
904
905	bf = _urtwn_getbuf(sc);
906	if (bf == NULL) {
907		struct ifnet *ifp = sc->sc_ifp;
908		DPRINTF("%s: stop queue\n", __func__);
909		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
910	}
911	return (bf);
912}
913
914static int
915urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
916    int len)
917{
918	usb_device_request_t req;
919
920	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
921	req.bRequest = R92C_REQ_REGS;
922	USETW(req.wValue, addr);
923	USETW(req.wIndex, 0);
924	USETW(req.wLength, len);
925	return (urtwn_do_request(sc, &req, buf));
926}
927
928static void
929urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
930{
931	urtwn_write_region_1(sc, addr, &val, 1);
932}
933
934
935static void
936urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
937{
938	val = htole16(val);
939	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
940}
941
942static void
943urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
944{
945	val = htole32(val);
946	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
947}
948
949static int
950urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
951    int len)
952{
953	usb_device_request_t req;
954
955	req.bmRequestType = UT_READ_VENDOR_DEVICE;
956	req.bRequest = R92C_REQ_REGS;
957	USETW(req.wValue, addr);
958	USETW(req.wIndex, 0);
959	USETW(req.wLength, len);
960	return (urtwn_do_request(sc, &req, buf));
961}
962
963static uint8_t
964urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
965{
966	uint8_t val;
967
968	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
969		return (0xff);
970	return (val);
971}
972
973static uint16_t
974urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
975{
976	uint16_t val;
977
978	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
979		return (0xffff);
980	return (le16toh(val));
981}
982
983static uint32_t
984urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
985{
986	uint32_t val;
987
988	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
989		return (0xffffffff);
990	return (le32toh(val));
991}
992
993static int
994urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
995{
996	struct r92c_fw_cmd cmd;
997	int ntries;
998
999	/* Wait for current FW box to be empty. */
1000	for (ntries = 0; ntries < 100; ntries++) {
1001		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1002			break;
1003		DELAY(1);
1004	}
1005	if (ntries == 100) {
1006		device_printf(sc->sc_dev,
1007		    "could not send firmware command\n");
1008		return (ETIMEDOUT);
1009	}
1010	memset(&cmd, 0, sizeof(cmd));
1011	cmd.id = id;
1012	if (len > 3)
1013		cmd.id |= R92C_CMD_FLAG_EXT;
1014	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1015	memcpy(cmd.msg, buf, len);
1016
1017	/* Write the first word last since that will trigger the FW. */
1018	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1019	    (uint8_t *)&cmd + 4, 2);
1020	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1021	    (uint8_t *)&cmd + 0, 4);
1022
1023	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1024	return (0);
1025}
1026
1027static void
1028urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1029{
1030	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1031	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1032	    SM(R92C_LSSI_PARAM_DATA, val));
1033}
1034
1035static uint32_t
1036urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1037{
1038	uint32_t reg[R92C_MAX_CHAINS], val;
1039
1040	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1041	if (chain != 0)
1042		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1043
1044	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1045	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1046	DELAY(1000);
1047
1048	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1049	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1050	    R92C_HSSI_PARAM2_READ_EDGE);
1051	DELAY(1000);
1052
1053	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1054	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1055	DELAY(1000);
1056
1057	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1058		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1059	else
1060		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1061	return (MS(val, R92C_LSSI_READBACK_DATA));
1062}
1063
1064static int
1065urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1066{
1067	int ntries;
1068
1069	urtwn_write_4(sc, R92C_LLT_INIT,
1070	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1071	    SM(R92C_LLT_INIT_ADDR, addr) |
1072	    SM(R92C_LLT_INIT_DATA, data));
1073	/* Wait for write operation to complete. */
1074	for (ntries = 0; ntries < 20; ntries++) {
1075		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1076		    R92C_LLT_INIT_OP_NO_ACTIVE)
1077			return (0);
1078		DELAY(5);
1079	}
1080	return (ETIMEDOUT);
1081}
1082
1083static uint8_t
1084urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1085{
1086	uint32_t reg;
1087	int ntries;
1088
1089	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1090	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1091	reg &= ~R92C_EFUSE_CTRL_VALID;
1092	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1093	/* Wait for read operation to complete. */
1094	for (ntries = 0; ntries < 100; ntries++) {
1095		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1096		if (reg & R92C_EFUSE_CTRL_VALID)
1097			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1098		DELAY(5);
1099	}
1100	device_printf(sc->sc_dev,
1101	    "could not read efuse byte at address 0x%x\n", addr);
1102	return (0xff);
1103}
1104
1105static void
1106urtwn_efuse_read(struct urtwn_softc *sc)
1107{
1108	uint8_t *rom = (uint8_t *)&sc->rom;
1109	uint16_t addr = 0;
1110	uint32_t reg;
1111	uint8_t off, msk;
1112	int i;
1113
1114	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1115	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1116		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1117		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1118	}
1119	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1120	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1121		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1122		    reg | R92C_SYS_FUNC_EN_ELDR);
1123	}
1124	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1125	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1126	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1127		urtwn_write_2(sc, R92C_SYS_CLKR,
1128		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1129	}
1130	memset(&sc->rom, 0xff, sizeof(sc->rom));
1131	while (addr < 512) {
1132		reg = urtwn_efuse_read_1(sc, addr);
1133		if (reg == 0xff)
1134			break;
1135		addr++;
1136		off = reg >> 4;
1137		msk = reg & 0xf;
1138		for (i = 0; i < 4; i++) {
1139			if (msk & (1 << i))
1140				continue;
1141			rom[off * 8 + i * 2 + 0] =
1142			    urtwn_efuse_read_1(sc, addr);
1143			addr++;
1144			rom[off * 8 + i * 2 + 1] =
1145			    urtwn_efuse_read_1(sc, addr);
1146			addr++;
1147		}
1148	}
1149#ifdef URTWN_DEBUG
1150	if (urtwn_debug >= 2) {
1151		/* Dump ROM content. */
1152		printf("\n");
1153		for (i = 0; i < sizeof(sc->rom); i++)
1154			printf("%02x:", rom[i]);
1155		printf("\n");
1156	}
1157#endif
1158}
1159
1160static int
1161urtwn_read_chipid(struct urtwn_softc *sc)
1162{
1163	uint32_t reg;
1164
1165	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1166	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1167		return (EIO);
1168
1169	if (reg & R92C_SYS_CFG_TYPE_92C) {
1170		sc->chip |= URTWN_CHIP_92C;
1171		/* Check if it is a castrated 8192C. */
1172		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1173		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1174		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1175			sc->chip |= URTWN_CHIP_92C_1T2R;
1176	}
1177	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1178		sc->chip |= URTWN_CHIP_UMC;
1179		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1180			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1181	}
1182	return (0);
1183}
1184
1185static void
1186urtwn_read_rom(struct urtwn_softc *sc)
1187{
1188	struct r92c_rom *rom = &sc->rom;
1189
1190	/* Read full ROM image. */
1191	urtwn_efuse_read(sc);
1192
1193	/* XXX Weird but this is what the vendor driver does. */
1194	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1195	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1196
1197	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1198
1199	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1200	DPRINTF("regulatory type=%d\n", sc->regulatory);
1201
1202	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1203}
1204
1205/*
1206 * Initialize rate adaptation in firmware.
1207 */
1208static int
1209urtwn_ra_init(struct urtwn_softc *sc)
1210{
1211	static const uint8_t map[] =
1212	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1213	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1214	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1215	struct ieee80211_node *ni;
1216	struct ieee80211_rateset *rs;
1217	struct r92c_fw_cmd_macid_cfg cmd;
1218	uint32_t rates, basicrates;
1219	uint8_t mode;
1220	int maxrate, maxbasicrate, error, i, j;
1221
1222	ni = ieee80211_ref_node(vap->iv_bss);
1223	rs = &ni->ni_rates;
1224
1225	/* Get normal and basic rates mask. */
1226	rates = basicrates = 0;
1227	maxrate = maxbasicrate = 0;
1228	for (i = 0; i < rs->rs_nrates; i++) {
1229		/* Convert 802.11 rate to HW rate index. */
1230		for (j = 0; j < nitems(map); j++)
1231			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1232				break;
1233		if (j == nitems(map))	/* Unknown rate, skip. */
1234			continue;
1235		rates |= 1 << j;
1236		if (j > maxrate)
1237			maxrate = j;
1238		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1239			basicrates |= 1 << j;
1240			if (j > maxbasicrate)
1241				maxbasicrate = j;
1242		}
1243	}
1244	if (ic->ic_curmode == IEEE80211_MODE_11B)
1245		mode = R92C_RAID_11B;
1246	else
1247		mode = R92C_RAID_11BG;
1248	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1249	    mode, rates, basicrates);
1250
1251	/* Set rates mask for group addressed frames. */
1252	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1253	cmd.mask = htole32(mode << 28 | basicrates);
1254	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1255	if (error != 0) {
1256		device_printf(sc->sc_dev,
1257		    "could not add broadcast station\n");
1258		return (error);
1259	}
1260	/* Set initial MRR rate. */
1261	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1262	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1263	    maxbasicrate);
1264
1265	/* Set rates mask for unicast frames. */
1266	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1267	cmd.mask = htole32(mode << 28 | rates);
1268	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1269	if (error != 0) {
1270		device_printf(sc->sc_dev, "could not add BSS station\n");
1271		return (error);
1272	}
1273	/* Set initial MRR rate. */
1274	DPRINTF("maxrate=%d\n", maxrate);
1275	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1276	    maxrate);
1277
1278	/* Indicate highest supported rate. */
1279	ni->ni_txrate = rs->rs_nrates - 1;
1280	return (0);
1281}
1282
1283void
1284urtwn_tsf_sync_enable(struct urtwn_softc *sc)
1285{
1286	struct ifnet *ifp = sc->sc_ifp;
1287	struct ieee80211com *ic = ifp->if_l2com;
1288	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1289	struct ieee80211_node *ni = vap->iv_bss;
1290
1291	uint64_t tsf;
1292
1293	/* Enable TSF synchronization. */
1294	urtwn_write_1(sc, R92C_BCN_CTRL,
1295	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1296
1297	urtwn_write_1(sc, R92C_BCN_CTRL,
1298	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1299
1300	/* Set initial TSF. */
1301	memcpy(&tsf, ni->ni_tstamp.data, 8);
1302	tsf = le64toh(tsf);
1303	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1304	tsf -= IEEE80211_DUR_TU;
1305	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1306	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1307
1308	urtwn_write_1(sc, R92C_BCN_CTRL,
1309	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1310}
1311
1312static void
1313urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1314{
1315	uint8_t reg;
1316
1317	if (led == URTWN_LED_LINK) {
1318		reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1319		if (!on)
1320			reg |= R92C_LEDCFG0_DIS;
1321		urtwn_write_1(sc, R92C_LEDCFG0, reg);
1322		sc->ledlink = on;	/* Save LED state. */
1323	}
1324}
1325
1326static int
1327urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1328{
1329	struct urtwn_vap *uvp = URTWN_VAP(vap);
1330	struct ieee80211com *ic = vap->iv_ic;
1331	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1332	struct ieee80211_node *ni;
1333	enum ieee80211_state ostate;
1334	uint32_t reg;
1335
1336	ostate = vap->iv_state;
1337	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1338	    ieee80211_state_name[nstate]);
1339
1340	IEEE80211_UNLOCK(ic);
1341	URTWN_LOCK(sc);
1342	callout_stop(&sc->sc_watchdog_ch);
1343
1344	if (ostate == IEEE80211_S_RUN) {
1345		/* Turn link LED off. */
1346		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1347
1348		/* Set media status to 'No Link'. */
1349		reg = urtwn_read_4(sc, R92C_CR);
1350		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1351		urtwn_write_4(sc, R92C_CR, reg);
1352
1353		/* Stop Rx of data frames. */
1354		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1355
1356		/* Rest TSF. */
1357		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1358
1359		/* Disable TSF synchronization. */
1360		urtwn_write_1(sc, R92C_BCN_CTRL,
1361		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1362		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1363
1364		/* Reset EDCA parameters. */
1365		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1366		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1367		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1368		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1369	}
1370
1371	switch (nstate) {
1372	case IEEE80211_S_INIT:
1373		/* Turn link LED off. */
1374		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1375		break;
1376	case IEEE80211_S_SCAN:
1377		if (ostate != IEEE80211_S_SCAN) {
1378			/* Allow Rx from any BSSID. */
1379			urtwn_write_4(sc, R92C_RCR,
1380			    urtwn_read_4(sc, R92C_RCR) &
1381			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1382
1383			/* Set gain for scanning. */
1384			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1385			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1386			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1387
1388			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1389			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1390			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1391		}
1392
1393		/* Make link LED blink during scan. */
1394		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
1395
1396		/* Pause AC Tx queues. */
1397		urtwn_write_1(sc, R92C_TXPAUSE,
1398		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1399
1400		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1401		break;
1402	case IEEE80211_S_AUTH:
1403		/* Set initial gain under link. */
1404		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1405		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1406		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1407
1408		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1409		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1410		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1411
1412		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1413		break;
1414	case IEEE80211_S_RUN:
1415		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1416			/* Enable Rx of data frames. */
1417			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1418
1419			/* Turn link LED on. */
1420			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1421			break;
1422		}
1423
1424		ni = ieee80211_ref_node(vap->iv_bss);
1425		/* Set media status to 'Associated'. */
1426		reg = urtwn_read_4(sc, R92C_CR);
1427		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1428		urtwn_write_4(sc, R92C_CR, reg);
1429
1430		/* Set BSSID. */
1431		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1432		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1433
1434		if (ic->ic_curmode == IEEE80211_MODE_11B)
1435			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1436		else	/* 802.11b/g */
1437			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1438
1439		/* Enable Rx of data frames. */
1440		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1441
1442		/* Flush all AC queues. */
1443		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1444
1445		/* Set beacon interval. */
1446		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1447
1448		/* Allow Rx from our BSSID only. */
1449		urtwn_write_4(sc, R92C_RCR,
1450		    urtwn_read_4(sc, R92C_RCR) |
1451		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1452
1453		/* Enable TSF synchronization. */
1454		urtwn_tsf_sync_enable(sc);
1455
1456		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1457		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1458		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1459		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1460		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1461		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1462
1463		/* Intialize rate adaptation. */
1464		urtwn_ra_init(sc);
1465		/* Turn link LED on. */
1466		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1467
1468		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1469		/* Reset temperature calibration state machine. */
1470		sc->thcal_state = 0;
1471		sc->thcal_lctemp = 0;
1472		ieee80211_free_node(ni);
1473		break;
1474	default:
1475		break;
1476	}
1477	URTWN_UNLOCK(sc);
1478	IEEE80211_LOCK(ic);
1479	return(uvp->newstate(vap, nstate, arg));
1480}
1481
1482static void
1483urtwn_watchdog(void *arg)
1484{
1485	struct urtwn_softc *sc = arg;
1486	struct ifnet *ifp = sc->sc_ifp;
1487
1488	if (sc->sc_txtimer > 0) {
1489		if (--sc->sc_txtimer == 0) {
1490			device_printf(sc->sc_dev, "device timeout\n");
1491			ifp->if_oerrors++;
1492			return;
1493		}
1494		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1495	}
1496}
1497
1498static void
1499urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1500{
1501	int pwdb;
1502
1503	/* Convert antenna signal to percentage. */
1504	if (rssi <= -100 || rssi >= 20)
1505		pwdb = 0;
1506	else if (rssi >= 0)
1507		pwdb = 100;
1508	else
1509		pwdb = 100 + rssi;
1510	if (rate <= 3) {
1511		/* CCK gain is smaller than OFDM/MCS gain. */
1512		pwdb += 6;
1513		if (pwdb > 100)
1514			pwdb = 100;
1515		if (pwdb <= 14)
1516			pwdb -= 4;
1517		else if (pwdb <= 26)
1518			pwdb -= 8;
1519		else if (pwdb <= 34)
1520			pwdb -= 6;
1521		else if (pwdb <= 42)
1522			pwdb -= 2;
1523	}
1524	if (sc->avg_pwdb == -1)	/* Init. */
1525		sc->avg_pwdb = pwdb;
1526	else if (sc->avg_pwdb < pwdb)
1527		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1528	else
1529		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1530	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1531}
1532
1533static int8_t
1534urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1535{
1536	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1537	struct r92c_rx_phystat *phy;
1538	struct r92c_rx_cck *cck;
1539	uint8_t rpt;
1540	int8_t rssi;
1541
1542	if (rate <= 3) {
1543		cck = (struct r92c_rx_cck *)physt;
1544		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1545			rpt = (cck->agc_rpt >> 5) & 0x3;
1546			rssi = (cck->agc_rpt & 0x1f) << 1;
1547		} else {
1548			rpt = (cck->agc_rpt >> 6) & 0x3;
1549			rssi = cck->agc_rpt & 0x3e;
1550		}
1551		rssi = cckoff[rpt] - rssi;
1552	} else {	/* OFDM/HT. */
1553		phy = (struct r92c_rx_phystat *)physt;
1554		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1555	}
1556	return (rssi);
1557}
1558
1559static int
1560urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1561    struct mbuf *m0, struct urtwn_data *data)
1562{
1563	struct ifnet *ifp = sc->sc_ifp;
1564	struct ieee80211_frame *wh;
1565	struct ieee80211_key *k;
1566	struct ieee80211com *ic = ifp->if_l2com;
1567	struct ieee80211vap *vap = ni->ni_vap;
1568	struct usb_xfer *xfer;
1569	struct r92c_tx_desc *txd;
1570	uint8_t raid, type;
1571	uint16_t sum;
1572	int i, hasqos, xferlen;
1573	struct usb_xfer *urtwn_pipes[4] = {
1574		sc->sc_xfer[URTWN_BULK_TX_BE],
1575		sc->sc_xfer[URTWN_BULK_TX_BK],
1576		sc->sc_xfer[URTWN_BULK_TX_VI],
1577		sc->sc_xfer[URTWN_BULK_TX_VO]
1578	};
1579
1580	URTWN_ASSERT_LOCKED(sc);
1581
1582	/*
1583	 * Software crypto.
1584	 */
1585	wh = mtod(m0, struct ieee80211_frame *);
1586	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1587		k = ieee80211_crypto_encap(ni, m0);
1588		if (k == NULL) {
1589			device_printf(sc->sc_dev,
1590			    "ieee80211_crypto_encap returns NULL.\n");
1591			/* XXX we don't expect the fragmented frames */
1592			m_freem(m0);
1593			return (ENOBUFS);
1594		}
1595
1596		/* in case packet header moved, reset pointer */
1597		wh = mtod(m0, struct ieee80211_frame *);
1598	}
1599
1600	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1601	case IEEE80211_FC0_TYPE_CTL:
1602	case IEEE80211_FC0_TYPE_MGT:
1603		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1604		break;
1605	default:
1606		KASSERT(M_WME_GETAC(m0) < 4,
1607		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1608		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1609		break;
1610	}
1611
1612	hasqos = 0;
1613
1614	/* Fill Tx descriptor. */
1615	txd = (struct r92c_tx_desc *)data->buf;
1616	memset(txd, 0, sizeof(*txd));
1617
1618	txd->txdw0 |= htole32(
1619	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1620	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1621	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1622	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1623		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1624
1625	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1626	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1627	    type == IEEE80211_FC0_TYPE_DATA) {
1628		if (ic->ic_curmode == IEEE80211_MODE_11B)
1629			raid = R92C_RAID_11B;
1630		else
1631			raid = R92C_RAID_11BG;
1632		txd->txdw1 |= htole32(
1633		    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1634		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1635		    SM(R92C_TXDW1_RAID, raid) |
1636		    R92C_TXDW1_AGGBK);
1637
1638		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1639			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1640				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1641				    R92C_TXDW4_HWRTSEN);
1642			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1643				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1644				    R92C_TXDW4_HWRTSEN);
1645			}
1646		}
1647		/* Send RTS at OFDM24. */
1648		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1649		txd->txdw5 |= htole32(0x0001ff00);
1650		/* Send data at OFDM54. */
1651		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1652	} else {
1653		txd->txdw1 |= htole32(
1654		    SM(R92C_TXDW1_MACID, 0) |
1655		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1656		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1657
1658		/* Force CCK1. */
1659		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1660		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1661	}
1662	/* Set sequence number (already little endian). */
1663	txd->txdseq |= *(uint16_t *)wh->i_seq;
1664
1665	if (!hasqos) {
1666		/* Use HW sequence numbering for non-QoS frames. */
1667		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1668		txd->txdseq |= htole16(0x8000);
1669	} else
1670		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1671
1672	/* Compute Tx descriptor checksum. */
1673	sum = 0;
1674	for (i = 0; i < sizeof(*txd) / 2; i++)
1675		sum ^= ((uint16_t *)txd)[i];
1676	txd->txdsum = sum; 	/* NB: already little endian. */
1677
1678	if (ieee80211_radiotap_active_vap(vap)) {
1679		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1680
1681		tap->wt_flags = 0;
1682		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1683		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1684		ieee80211_radiotap_tx(vap, m0);
1685	}
1686
1687	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1688	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1689
1690	data->buflen = xferlen;
1691	data->ni = ni;
1692	data->m = m0;
1693
1694	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1695	usbd_transfer_start(xfer);
1696	return (0);
1697}
1698
1699static void
1700urtwn_start(struct ifnet *ifp)
1701{
1702	struct urtwn_softc *sc = ifp->if_softc;
1703	struct ieee80211_node *ni;
1704	struct mbuf *m;
1705	struct urtwn_data *bf;
1706
1707	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1708		return;
1709
1710	URTWN_LOCK(sc);
1711	for (;;) {
1712		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1713		if (m == NULL)
1714			break;
1715		bf = urtwn_getbuf(sc);
1716		if (bf == NULL) {
1717			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1718			break;
1719		}
1720		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1721		m->m_pkthdr.rcvif = NULL;
1722
1723		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1724			ifp->if_oerrors++;
1725			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1726			ieee80211_free_node(ni);
1727			break;
1728		}
1729
1730		sc->sc_txtimer = 5;
1731		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1732	}
1733	URTWN_UNLOCK(sc);
1734}
1735
1736static int
1737urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1738{
1739	struct ieee80211com *ic = ifp->if_l2com;
1740	struct ifreq *ifr = (struct ifreq *) data;
1741	int error = 0, startall = 0;
1742
1743	switch (cmd) {
1744	case SIOCSIFFLAGS:
1745		if (ifp->if_flags & IFF_UP) {
1746			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1747				urtwn_init(ifp->if_softc);
1748				startall = 1;
1749			}
1750		} else {
1751			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1752				urtwn_stop(ifp, 1);
1753		}
1754		if (startall)
1755			ieee80211_start_all(ic);
1756		break;
1757	case SIOCGIFMEDIA:
1758		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1759		break;
1760	case SIOCGIFADDR:
1761		error = ether_ioctl(ifp, cmd, data);
1762		break;
1763	default:
1764		error = EINVAL;
1765		break;
1766	}
1767	return (error);
1768}
1769
1770static int
1771urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1772    int ndata, int maxsz)
1773{
1774	int i, error;
1775
1776	for (i = 0; i < ndata; i++) {
1777		struct urtwn_data *dp = &data[i];
1778		dp->sc = sc;
1779		dp->m = NULL;
1780		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1781		if (dp->buf == NULL) {
1782			device_printf(sc->sc_dev,
1783			    "could not allocate buffer\n");
1784			error = ENOMEM;
1785			goto fail;
1786		}
1787		dp->ni = NULL;
1788	}
1789
1790	return (0);
1791fail:
1792	urtwn_free_list(sc, data, ndata);
1793	return (error);
1794}
1795
1796static int
1797urtwn_alloc_rx_list(struct urtwn_softc *sc)
1798{
1799        int error, i;
1800
1801	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1802	    URTWN_RXBUFSZ);
1803	if (error != 0)
1804		return (error);
1805
1806	STAILQ_INIT(&sc->sc_rx_active);
1807	STAILQ_INIT(&sc->sc_rx_inactive);
1808
1809	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1810		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1811
1812	return (0);
1813}
1814
1815static int
1816urtwn_alloc_tx_list(struct urtwn_softc *sc)
1817{
1818	int error, i;
1819
1820	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1821	    URTWN_TXBUFSZ);
1822	if (error != 0)
1823		return (error);
1824
1825	STAILQ_INIT(&sc->sc_tx_active);
1826	STAILQ_INIT(&sc->sc_tx_inactive);
1827	STAILQ_INIT(&sc->sc_tx_pending);
1828
1829	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1830		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1831
1832	return (0);
1833}
1834
1835static int
1836urtwn_power_on(struct urtwn_softc *sc)
1837{
1838	uint32_t reg;
1839	int ntries;
1840
1841	/* Wait for autoload done bit. */
1842	for (ntries = 0; ntries < 1000; ntries++) {
1843		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1844			break;
1845		DELAY(5);
1846	}
1847	if (ntries == 1000) {
1848		device_printf(sc->sc_dev,
1849		    "timeout waiting for chip autoload\n");
1850		return (ETIMEDOUT);
1851	}
1852
1853	/* Unlock ISO/CLK/Power control register. */
1854	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
1855	/* Move SPS into PWM mode. */
1856	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1857	DELAY(100);
1858
1859	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
1860	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
1861		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
1862		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
1863		DELAY(100);
1864		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
1865		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
1866		    ~R92C_SYS_ISO_CTRL_MD2PP);
1867	}
1868
1869	/* Auto enable WLAN. */
1870	urtwn_write_2(sc, R92C_APS_FSMCO,
1871	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1872	for (ntries = 0; ntries < 1000; ntries++) {
1873		if (urtwn_read_2(sc, R92C_APS_FSMCO) &
1874		    R92C_APS_FSMCO_APFM_ONMAC)
1875			break;
1876		DELAY(5);
1877	}
1878	if (ntries == 1000) {
1879		device_printf(sc->sc_dev,
1880		    "timeout waiting for MAC auto ON\n");
1881		return (ETIMEDOUT);
1882	}
1883
1884	/* Enable radio, GPIO and LED functions. */
1885	urtwn_write_2(sc, R92C_APS_FSMCO,
1886	    R92C_APS_FSMCO_AFSM_HSUS |
1887	    R92C_APS_FSMCO_PDN_EN |
1888	    R92C_APS_FSMCO_PFM_ALDN);
1889	/* Release RF digital isolation. */
1890	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1891	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1892
1893	/* Initialize MAC. */
1894	urtwn_write_1(sc, R92C_APSD_CTRL,
1895	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
1896	for (ntries = 0; ntries < 200; ntries++) {
1897		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
1898		    R92C_APSD_CTRL_OFF_STATUS))
1899			break;
1900		DELAY(5);
1901	}
1902	if (ntries == 200) {
1903		device_printf(sc->sc_dev,
1904		    "timeout waiting for MAC initialization\n");
1905		return (ETIMEDOUT);
1906	}
1907
1908	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
1909	reg = urtwn_read_2(sc, R92C_CR);
1910	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
1911	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
1912	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
1913	    R92C_CR_ENSEC;
1914	urtwn_write_2(sc, R92C_CR, reg);
1915
1916	urtwn_write_1(sc, 0xfe10, 0x19);
1917	return (0);
1918}
1919
1920static int
1921urtwn_llt_init(struct urtwn_softc *sc)
1922{
1923	int i, error;
1924
1925	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
1926	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
1927		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1928			return (error);
1929	}
1930	/* NB: 0xff indicates end-of-list. */
1931	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
1932		return (error);
1933	/*
1934	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
1935	 * as ring buffer.
1936	 */
1937	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
1938		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1939			return (error);
1940	}
1941	/* Make the last page point to the beginning of the ring buffer. */
1942	error = urtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
1943	return (error);
1944}
1945
1946static void
1947urtwn_fw_reset(struct urtwn_softc *sc)
1948{
1949	uint16_t reg;
1950	int ntries;
1951
1952	/* Tell 8051 to reset itself. */
1953	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1954
1955	/* Wait until 8051 resets by itself. */
1956	for (ntries = 0; ntries < 100; ntries++) {
1957		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1958		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1959			return;
1960		DELAY(50);
1961	}
1962	/* Force 8051 reset. */
1963	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1964}
1965
1966static int
1967urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
1968{
1969	uint32_t reg;
1970	int off, mlen, error = 0;
1971
1972	reg = urtwn_read_4(sc, R92C_MCUFWDL);
1973	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
1974	urtwn_write_4(sc, R92C_MCUFWDL, reg);
1975
1976	off = R92C_FW_START_ADDR;
1977	while (len > 0) {
1978		if (len > 196)
1979			mlen = 196;
1980		else if (len > 4)
1981			mlen = 4;
1982		else
1983			mlen = 1;
1984		/* XXX fix this deconst */
1985		error = urtwn_write_region_1(sc, off,
1986		    __DECONST(uint8_t *, buf), mlen);
1987		if (error != 0)
1988			break;
1989		off += mlen;
1990		buf += mlen;
1991		len -= mlen;
1992	}
1993	return (error);
1994}
1995
1996static int
1997urtwn_load_firmware(struct urtwn_softc *sc)
1998{
1999	const struct firmware *fw;
2000	const struct r92c_fw_hdr *hdr;
2001	const char *imagename;
2002	const u_char *ptr;
2003	size_t len;
2004	uint32_t reg;
2005	int mlen, ntries, page, error;
2006
2007	/* Read firmware image from the filesystem. */
2008	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2009	    URTWN_CHIP_UMC_A_CUT)
2010		imagename = "urtwn-rtl8192cfwU";
2011	else
2012		imagename = "urtwn-rtl8192cfwT";
2013
2014	fw = firmware_get(imagename);
2015	if (fw == NULL) {
2016		device_printf(sc->sc_dev,
2017		    "failed loadfirmware of file %s\n", imagename);
2018		return (ENOENT);
2019	}
2020
2021	len = fw->datasize;
2022
2023	if (len < sizeof(*hdr)) {
2024		device_printf(sc->sc_dev, "firmware too short\n");
2025		error = EINVAL;
2026		goto fail;
2027	}
2028	ptr = fw->data;
2029	hdr = (const struct r92c_fw_hdr *)ptr;
2030	/* Check if there is a valid FW header and skip it. */
2031	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2032	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2033		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2034		    le16toh(hdr->version), le16toh(hdr->subversion),
2035		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2036		ptr += sizeof(*hdr);
2037		len -= sizeof(*hdr);
2038	}
2039
2040	if (urtwn_read_1(sc, R92C_MCUFWDL) & 0x80) {
2041		urtwn_fw_reset(sc);
2042		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2043	}
2044	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2045	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2046	    R92C_SYS_FUNC_EN_CPUEN);
2047	urtwn_write_1(sc, R92C_MCUFWDL,
2048	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2049	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2050	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2051
2052	for (page = 0; len > 0; page++) {
2053		mlen = min(len, R92C_FW_PAGE_SIZE);
2054		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2055		if (error != 0) {
2056			device_printf(sc->sc_dev,
2057			    "could not load firmware page\n");
2058			goto fail;
2059		}
2060		ptr += mlen;
2061		len -= mlen;
2062	}
2063	urtwn_write_1(sc, R92C_MCUFWDL,
2064	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2065	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2066
2067	/* Wait for checksum report. */
2068	for (ntries = 0; ntries < 1000; ntries++) {
2069		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2070			break;
2071		DELAY(5);
2072	}
2073	if (ntries == 1000) {
2074		device_printf(sc->sc_dev,
2075		    "timeout waiting for checksum report\n");
2076		error = ETIMEDOUT;
2077		goto fail;
2078	}
2079
2080	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2081	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2082	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2083	/* Wait for firmware readiness. */
2084	for (ntries = 0; ntries < 1000; ntries++) {
2085		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2086			break;
2087		DELAY(5);
2088	}
2089	if (ntries == 1000) {
2090		device_printf(sc->sc_dev,
2091		    "timeout waiting for firmware readiness\n");
2092		error = ETIMEDOUT;
2093		goto fail;
2094	}
2095fail:
2096	firmware_put(fw, FIRMWARE_UNLOAD);
2097	return (error);
2098}
2099
2100static int
2101urtwn_dma_init(struct urtwn_softc *sc)
2102{
2103	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2104	uint32_t reg;
2105	int error;
2106
2107	/* Initialize LLT table. */
2108	error = urtwn_llt_init(sc);
2109	if (error != 0)
2110		return (error);
2111
2112	/* Get Tx queues to USB endpoints mapping. */
2113	hashq = hasnq = haslq = 0;
2114	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2115	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2116	if (MS(reg, R92C_USB_EP_HQ) != 0)
2117		hashq = 1;
2118	if (MS(reg, R92C_USB_EP_NQ) != 0)
2119		hasnq = 1;
2120	if (MS(reg, R92C_USB_EP_LQ) != 0)
2121		haslq = 1;
2122	nqueues = hashq + hasnq + haslq;
2123	if (nqueues == 0)
2124		return (EIO);
2125	/* Get the number of pages for each queue. */
2126	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2127	/* The remaining pages are assigned to the high priority queue. */
2128	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2129
2130	/* Set number of pages for normal priority queue. */
2131	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2132	urtwn_write_4(sc, R92C_RQPN,
2133	    /* Set number of pages for public queue. */
2134	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2135	    /* Set number of pages for high priority queue. */
2136	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2137	    /* Set number of pages for low priority queue. */
2138	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2139	    /* Load values. */
2140	    R92C_RQPN_LD);
2141
2142	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2143	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2144	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2145	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2146	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2147
2148	/* Set queue to USB pipe mapping. */
2149	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2150	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2151	if (nqueues == 1) {
2152		if (hashq)
2153			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2154		else if (hasnq)
2155			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2156		else
2157			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2158	} else if (nqueues == 2) {
2159		/* All 2-endpoints configs have a high priority queue. */
2160		if (!hashq)
2161			return (EIO);
2162		if (hasnq)
2163			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2164		else
2165			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2166	} else
2167		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2168	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2169
2170	/* Set Tx/Rx transfer page boundary. */
2171	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2172
2173	/* Set Tx/Rx transfer page size. */
2174	urtwn_write_1(sc, R92C_PBP,
2175	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2176	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2177	return (0);
2178}
2179
2180static void
2181urtwn_mac_init(struct urtwn_softc *sc)
2182{
2183	int i;
2184
2185	/* Write MAC initialization values. */
2186	for (i = 0; i < nitems(rtl8192cu_mac); i++)
2187		urtwn_write_1(sc, rtl8192cu_mac[i].reg, rtl8192cu_mac[i].val);
2188}
2189
2190static void
2191urtwn_bb_init(struct urtwn_softc *sc)
2192{
2193	const struct urtwn_bb_prog *prog;
2194	uint32_t reg;
2195	int i;
2196
2197	/* Enable BB and RF. */
2198	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2199	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2200	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2201	    R92C_SYS_FUNC_EN_DIO_RF);
2202
2203	urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2204
2205	urtwn_write_1(sc, R92C_RF_CTRL,
2206	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2207	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2208	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2209	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2210
2211	urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2212	urtwn_write_1(sc, 0x15, 0xe9);
2213	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2214
2215	/* Select BB programming based on board type. */
2216	if (!(sc->chip & URTWN_CHIP_92C)) {
2217		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2218			prog = &rtl8188ce_bb_prog;
2219		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2220			prog = &rtl8188ru_bb_prog;
2221		else
2222			prog = &rtl8188cu_bb_prog;
2223	} else {
2224		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2225			prog = &rtl8192ce_bb_prog;
2226		else
2227			prog = &rtl8192cu_bb_prog;
2228	}
2229	/* Write BB initialization values. */
2230	for (i = 0; i < prog->count; i++) {
2231		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2232		DELAY(1);
2233	}
2234
2235	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2236		/* 8192C 1T only configuration. */
2237		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2238		reg = (reg & ~0x00000003) | 0x2;
2239		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2240
2241		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2242		reg = (reg & ~0x00300033) | 0x00200022;
2243		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2244
2245		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2246		reg = (reg & ~0xff000000) | 0x45 << 24;
2247		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2248
2249		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2250		reg = (reg & ~0x000000ff) | 0x23;
2251		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2252
2253		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2254		reg = (reg & ~0x00000030) | 1 << 4;
2255		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2256
2257		reg = urtwn_bb_read(sc, 0xe74);
2258		reg = (reg & ~0x0c000000) | 2 << 26;
2259		urtwn_bb_write(sc, 0xe74, reg);
2260		reg = urtwn_bb_read(sc, 0xe78);
2261		reg = (reg & ~0x0c000000) | 2 << 26;
2262		urtwn_bb_write(sc, 0xe78, reg);
2263		reg = urtwn_bb_read(sc, 0xe7c);
2264		reg = (reg & ~0x0c000000) | 2 << 26;
2265		urtwn_bb_write(sc, 0xe7c, reg);
2266		reg = urtwn_bb_read(sc, 0xe80);
2267		reg = (reg & ~0x0c000000) | 2 << 26;
2268		urtwn_bb_write(sc, 0xe80, reg);
2269		reg = urtwn_bb_read(sc, 0xe88);
2270		reg = (reg & ~0x0c000000) | 2 << 26;
2271		urtwn_bb_write(sc, 0xe88, reg);
2272	}
2273
2274	/* Write AGC values. */
2275	for (i = 0; i < prog->agccount; i++) {
2276		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2277		    prog->agcvals[i]);
2278		DELAY(1);
2279	}
2280
2281	if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2282	    R92C_HSSI_PARAM2_CCK_HIPWR)
2283		sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2284}
2285
2286void
2287urtwn_rf_init(struct urtwn_softc *sc)
2288{
2289	const struct urtwn_rf_prog *prog;
2290	uint32_t reg, type;
2291	int i, j, idx, off;
2292
2293	/* Select RF programming based on board type. */
2294	if (!(sc->chip & URTWN_CHIP_92C)) {
2295		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2296			prog = rtl8188ce_rf_prog;
2297		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2298			prog = rtl8188ru_rf_prog;
2299		else
2300			prog = rtl8188cu_rf_prog;
2301	} else
2302		prog = rtl8192ce_rf_prog;
2303
2304	for (i = 0; i < sc->nrxchains; i++) {
2305		/* Save RF_ENV control type. */
2306		idx = i / 2;
2307		off = (i % 2) * 16;
2308		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2309		type = (reg >> off) & 0x10;
2310
2311		/* Set RF_ENV enable. */
2312		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2313		reg |= 0x100000;
2314		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2315		DELAY(1);
2316		/* Set RF_ENV output high. */
2317		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2318		reg |= 0x10;
2319		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2320		DELAY(1);
2321		/* Set address and data lengths of RF registers. */
2322		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2323		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2324		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2325		DELAY(1);
2326		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2327		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2328		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2329		DELAY(1);
2330
2331		/* Write RF initialization values for this chain. */
2332		for (j = 0; j < prog[i].count; j++) {
2333			if (prog[i].regs[j] >= 0xf9 &&
2334			    prog[i].regs[j] <= 0xfe) {
2335				/*
2336				 * These are fake RF registers offsets that
2337				 * indicate a delay is required.
2338				 */
2339				usb_pause_mtx(&sc->sc_mtx, 50);
2340				continue;
2341			}
2342			urtwn_rf_write(sc, i, prog[i].regs[j],
2343			    prog[i].vals[j]);
2344			DELAY(1);
2345		}
2346
2347		/* Restore RF_ENV control type. */
2348		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2349		reg &= ~(0x10 << off) | (type << off);
2350		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2351
2352		/* Cache RF register CHNLBW. */
2353		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2354	}
2355
2356	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2357	    URTWN_CHIP_UMC_A_CUT) {
2358		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2359		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2360	}
2361}
2362
2363static void
2364urtwn_cam_init(struct urtwn_softc *sc)
2365{
2366	/* Invalidate all CAM entries. */
2367	urtwn_write_4(sc, R92C_CAMCMD,
2368	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2369}
2370
2371static void
2372urtwn_pa_bias_init(struct urtwn_softc *sc)
2373{
2374	uint8_t reg;
2375	int i;
2376
2377	for (i = 0; i < sc->nrxchains; i++) {
2378		if (sc->pa_setting & (1 << i))
2379			continue;
2380		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2381		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2382		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2383		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2384	}
2385	if (!(sc->pa_setting & 0x10)) {
2386		reg = urtwn_read_1(sc, 0x16);
2387		reg = (reg & ~0xf0) | 0x90;
2388		urtwn_write_1(sc, 0x16, reg);
2389	}
2390}
2391
2392static void
2393urtwn_rxfilter_init(struct urtwn_softc *sc)
2394{
2395	/* Initialize Rx filter. */
2396	/* TODO: use better filter for monitor mode. */
2397	urtwn_write_4(sc, R92C_RCR,
2398	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2399	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2400	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2401	/* Accept all multicast frames. */
2402	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2403	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2404	/* Accept all management frames. */
2405	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2406	/* Reject all control frames. */
2407	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2408	/* Accept all data frames. */
2409	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2410}
2411
2412static void
2413urtwn_edca_init(struct urtwn_softc *sc)
2414{
2415	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2416	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2417	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2418	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2419	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2420	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2421	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2422	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2423}
2424
2425void
2426urtwn_write_txpower(struct urtwn_softc *sc, int chain,
2427    uint16_t power[URTWN_RIDX_COUNT])
2428{
2429	uint32_t reg;
2430
2431	/* Write per-CCK rate Tx power. */
2432	if (chain == 0) {
2433		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2434		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2435		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2436		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2437		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2438		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2439		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2440		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2441	} else {
2442		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2443		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2444		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2445		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2446		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2447		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2448		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2449		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2450	}
2451	/* Write per-OFDM rate Tx power. */
2452	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2453	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2454	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2455	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2456	    SM(R92C_TXAGC_RATE18, power[ 7]));
2457	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2458	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2459	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2460	    SM(R92C_TXAGC_RATE48, power[10]) |
2461	    SM(R92C_TXAGC_RATE54, power[11]));
2462	/* Write per-MCS Tx power. */
2463	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2464	    SM(R92C_TXAGC_MCS00,  power[12]) |
2465	    SM(R92C_TXAGC_MCS01,  power[13]) |
2466	    SM(R92C_TXAGC_MCS02,  power[14]) |
2467	    SM(R92C_TXAGC_MCS03,  power[15]));
2468	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2469	    SM(R92C_TXAGC_MCS04,  power[16]) |
2470	    SM(R92C_TXAGC_MCS05,  power[17]) |
2471	    SM(R92C_TXAGC_MCS06,  power[18]) |
2472	    SM(R92C_TXAGC_MCS07,  power[19]));
2473	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2474	    SM(R92C_TXAGC_MCS08,  power[20]) |
2475	    SM(R92C_TXAGC_MCS08,  power[21]) |
2476	    SM(R92C_TXAGC_MCS10,  power[22]) |
2477	    SM(R92C_TXAGC_MCS11,  power[23]));
2478	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2479	    SM(R92C_TXAGC_MCS12,  power[24]) |
2480	    SM(R92C_TXAGC_MCS13,  power[25]) |
2481	    SM(R92C_TXAGC_MCS14,  power[26]) |
2482	    SM(R92C_TXAGC_MCS15,  power[27]));
2483}
2484
2485void
2486urtwn_get_txpower(struct urtwn_softc *sc, int chain,
2487    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2488    uint16_t power[URTWN_RIDX_COUNT])
2489{
2490	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2491	struct r92c_rom *rom = &sc->rom;
2492	uint16_t cckpow, ofdmpow, htpow, diff, max;
2493	const struct urtwn_txpwr *base;
2494	int ridx, chan, group;
2495
2496	/* Determine channel group. */
2497	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2498	if (chan <= 3)
2499		group = 0;
2500	else if (chan <= 9)
2501		group = 1;
2502	else
2503		group = 2;
2504
2505	/* Get original Tx power based on board type and RF chain. */
2506	if (!(sc->chip & URTWN_CHIP_92C)) {
2507		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2508			base = &rtl8188ru_txagc[chain];
2509		else
2510			base = &rtl8192cu_txagc[chain];
2511	} else
2512		base = &rtl8192cu_txagc[chain];
2513
2514	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2515	if (sc->regulatory == 0) {
2516		for (ridx = 0; ridx <= 3; ridx++)
2517			power[ridx] = base->pwr[0][ridx];
2518	}
2519	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2520		if (sc->regulatory == 3) {
2521			power[ridx] = base->pwr[0][ridx];
2522			/* Apply vendor limits. */
2523			if (extc != NULL)
2524				max = rom->ht40_max_pwr[group];
2525			else
2526				max = rom->ht20_max_pwr[group];
2527			max = (max >> (chain * 4)) & 0xf;
2528			if (power[ridx] > max)
2529				power[ridx] = max;
2530		} else if (sc->regulatory == 1) {
2531			if (extc == NULL)
2532				power[ridx] = base->pwr[group][ridx];
2533		} else if (sc->regulatory != 2)
2534			power[ridx] = base->pwr[0][ridx];
2535	}
2536
2537	/* Compute per-CCK rate Tx power. */
2538	cckpow = rom->cck_tx_pwr[chain][group];
2539	for (ridx = 0; ridx <= 3; ridx++) {
2540		power[ridx] += cckpow;
2541		if (power[ridx] > R92C_MAX_TX_PWR)
2542			power[ridx] = R92C_MAX_TX_PWR;
2543	}
2544
2545	htpow = rom->ht40_1s_tx_pwr[chain][group];
2546	if (sc->ntxchains > 1) {
2547		/* Apply reduction for 2 spatial streams. */
2548		diff = rom->ht40_2s_tx_pwr_diff[group];
2549		diff = (diff >> (chain * 4)) & 0xf;
2550		htpow = (htpow > diff) ? htpow - diff : 0;
2551	}
2552
2553	/* Compute per-OFDM rate Tx power. */
2554	diff = rom->ofdm_tx_pwr_diff[group];
2555	diff = (diff >> (chain * 4)) & 0xf;
2556	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2557	for (ridx = 4; ridx <= 11; ridx++) {
2558		power[ridx] += ofdmpow;
2559		if (power[ridx] > R92C_MAX_TX_PWR)
2560			power[ridx] = R92C_MAX_TX_PWR;
2561	}
2562
2563	/* Compute per-MCS Tx power. */
2564	if (extc == NULL) {
2565		diff = rom->ht20_tx_pwr_diff[group];
2566		diff = (diff >> (chain * 4)) & 0xf;
2567		htpow += diff;	/* HT40->HT20 correction. */
2568	}
2569	for (ridx = 12; ridx <= 27; ridx++) {
2570		power[ridx] += htpow;
2571		if (power[ridx] > R92C_MAX_TX_PWR)
2572			power[ridx] = R92C_MAX_TX_PWR;
2573	}
2574#ifdef URTWN_DEBUG
2575	if (urtwn_debug >= 4) {
2576		/* Dump per-rate Tx power values. */
2577		printf("Tx power for chain %d:\n", chain);
2578		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
2579			printf("Rate %d = %u\n", ridx, power[ridx]);
2580	}
2581#endif
2582}
2583
2584void
2585urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
2586    struct ieee80211_channel *extc)
2587{
2588	uint16_t power[URTWN_RIDX_COUNT];
2589	int i;
2590
2591	for (i = 0; i < sc->ntxchains; i++) {
2592		/* Compute per-rate Tx power values. */
2593		urtwn_get_txpower(sc, i, c, extc, power);
2594		/* Write per-rate Tx power values to hardware. */
2595		urtwn_write_txpower(sc, i, power);
2596	}
2597}
2598
2599static void
2600urtwn_scan_start(struct ieee80211com *ic)
2601{
2602	/* XXX do nothing?  */
2603}
2604
2605static void
2606urtwn_scan_end(struct ieee80211com *ic)
2607{
2608	/* XXX do nothing?  */
2609}
2610
2611static void
2612urtwn_set_channel(struct ieee80211com *ic)
2613{
2614	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
2615
2616	URTWN_LOCK(sc);
2617	urtwn_set_chan(sc, ic->ic_curchan, NULL);
2618	URTWN_UNLOCK(sc);
2619}
2620
2621static void
2622urtwn_update_mcast(struct ifnet *ifp)
2623{
2624	/* XXX do nothing?  */
2625}
2626
2627static void
2628urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
2629    struct ieee80211_channel *extc)
2630{
2631	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2632	uint32_t reg;
2633	u_int chan;
2634	int i;
2635
2636	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2637	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2638		device_printf(sc->sc_dev,
2639		    "%s: invalid channel %x\n", __func__, chan);
2640		return;
2641	}
2642
2643	/* Set Tx power for this new channel. */
2644	urtwn_set_txpower(sc, c, extc);
2645
2646	for (i = 0; i < sc->nrxchains; i++) {
2647		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2648		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2649	}
2650#ifndef IEEE80211_NO_HT
2651	if (extc != NULL) {
2652		/* Is secondary channel below or above primary? */
2653		int prichlo = c->ic_freq < extc->ic_freq;
2654
2655		urtwn_write_1(sc, R92C_BWOPMODE,
2656		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2657
2658		reg = urtwn_read_1(sc, R92C_RRSR + 2);
2659		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2660		urtwn_write_1(sc, R92C_RRSR + 2, reg);
2661
2662		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2663		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2664		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2665		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2666
2667		/* Set CCK side band. */
2668		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2669		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2670		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2671
2672		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
2673		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2674		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2675
2676		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2677		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2678		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2679
2680		reg = urtwn_bb_read(sc, 0x818);
2681		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2682		urtwn_bb_write(sc, 0x818, reg);
2683
2684		/* Select 40MHz bandwidth. */
2685		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2686		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2687	} else
2688#endif
2689	{
2690		urtwn_write_1(sc, R92C_BWOPMODE,
2691		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2692
2693		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2694		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2695		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2696		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2697
2698		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2699		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2700		    R92C_FPGA0_ANAPARAM2_CBW20);
2701
2702		/* Select 20MHz bandwidth. */
2703		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2704		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2705	}
2706}
2707
2708static void
2709urtwn_iq_calib(struct urtwn_softc *sc)
2710{
2711	/* TODO */
2712}
2713
2714static void
2715urtwn_lc_calib(struct urtwn_softc *sc)
2716{
2717	uint32_t rf_ac[2];
2718	uint8_t txmode;
2719	int i;
2720
2721	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2722	if ((txmode & 0x70) != 0) {
2723		/* Disable all continuous Tx. */
2724		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2725
2726		/* Set RF mode to standby mode. */
2727		for (i = 0; i < sc->nrxchains; i++) {
2728			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
2729			urtwn_rf_write(sc, i, R92C_RF_AC,
2730			    RW(rf_ac[i], R92C_RF_AC_MODE,
2731				R92C_RF_AC_MODE_STANDBY));
2732		}
2733	} else {
2734		/* Block all Tx queues. */
2735		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
2736	}
2737	/* Start calibration. */
2738	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2739	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2740
2741	/* Give calibration the time to complete. */
2742	usb_pause_mtx(&sc->sc_mtx, 100);
2743
2744	/* Restore configuration. */
2745	if ((txmode & 0x70) != 0) {
2746		/* Restore Tx mode. */
2747		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2748		/* Restore RF mode. */
2749		for (i = 0; i < sc->nrxchains; i++)
2750			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2751	} else {
2752		/* Unblock all Tx queues. */
2753		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2754	}
2755}
2756
2757static void
2758urtwn_init_locked(void *arg)
2759{
2760	struct urtwn_softc *sc = arg;
2761	struct ifnet *ifp = sc->sc_ifp;
2762	uint32_t reg;
2763	int error;
2764
2765	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2766		urtwn_stop_locked(ifp, 0);
2767
2768	/* Init firmware commands ring. */
2769	sc->fwcur = 0;
2770
2771	/* Allocate Tx/Rx buffers. */
2772	error = urtwn_alloc_rx_list(sc);
2773	if (error != 0)
2774		goto fail;
2775
2776	error = urtwn_alloc_tx_list(sc);
2777	if (error != 0)
2778		goto fail;
2779
2780	/* Power on adapter. */
2781	error = urtwn_power_on(sc);
2782	if (error != 0)
2783		goto fail;
2784
2785	/* Initialize DMA. */
2786	error = urtwn_dma_init(sc);
2787	if (error != 0)
2788		goto fail;
2789
2790	/* Set info size in Rx descriptors (in 64-bit words). */
2791	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
2792
2793	/* Init interrupts. */
2794	urtwn_write_4(sc, R92C_HISR, 0xffffffff);
2795	urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
2796
2797	/* Set MAC address. */
2798	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
2799	    IEEE80211_ADDR_LEN);
2800
2801	/* Set initial network type. */
2802	reg = urtwn_read_4(sc, R92C_CR);
2803	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
2804	urtwn_write_4(sc, R92C_CR, reg);
2805
2806	urtwn_rxfilter_init(sc);
2807
2808	reg = urtwn_read_4(sc, R92C_RRSR);
2809	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
2810	urtwn_write_4(sc, R92C_RRSR, reg);
2811
2812	/* Set short/long retry limits. */
2813	urtwn_write_2(sc, R92C_RL,
2814	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
2815
2816	/* Initialize EDCA parameters. */
2817	urtwn_edca_init(sc);
2818
2819	/* Setup rate fallback. */
2820	urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
2821	urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
2822	urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
2823	urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
2824
2825	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
2826	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
2827	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
2828	/* Set ACK timeout. */
2829	urtwn_write_1(sc, R92C_ACKTO, 0x40);
2830
2831	/* Setup USB aggregation. */
2832	reg = urtwn_read_4(sc, R92C_TDECTRL);
2833	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
2834	urtwn_write_4(sc, R92C_TDECTRL, reg);
2835	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
2836	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
2837	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
2838	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2839	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2840	    R92C_USB_SPECIAL_OPTION_AGG_EN);
2841	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
2842	urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
2843	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
2844	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
2845
2846	/* Initialize beacon parameters. */
2847	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
2848	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
2849	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
2850	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
2851
2852	/* Setup AMPDU aggregation. */
2853	urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
2854	urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
2855	urtwn_write_2(sc, 0x4ca, 0x0708);
2856
2857	urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
2858	urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
2859
2860	/* Load 8051 microcode. */
2861	error = urtwn_load_firmware(sc);
2862	if (error != 0)
2863		goto fail;
2864
2865	/* Initialize MAC/BB/RF blocks. */
2866	urtwn_mac_init(sc);
2867	urtwn_bb_init(sc);
2868	urtwn_rf_init(sc);
2869
2870	/* Turn CCK and OFDM blocks on. */
2871	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2872	reg |= R92C_RFMOD_CCK_EN;
2873	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2874	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2875	reg |= R92C_RFMOD_OFDM_EN;
2876	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2877
2878	/* Clear per-station keys table. */
2879	urtwn_cam_init(sc);
2880
2881	/* Enable hardware sequence numbering. */
2882	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
2883
2884	/* Perform LO and IQ calibrations. */
2885	urtwn_iq_calib(sc);
2886	/* Perform LC calibration. */
2887	urtwn_lc_calib(sc);
2888
2889	/* Fix USB interference issue. */
2890	urtwn_write_1(sc, 0xfe40, 0xe0);
2891	urtwn_write_1(sc, 0xfe41, 0x8d);
2892	urtwn_write_1(sc, 0xfe42, 0x80);
2893
2894	urtwn_pa_bias_init(sc);
2895
2896	/* Initialize GPIO setting. */
2897	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
2898	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
2899
2900	/* Fix for lower temperature. */
2901	urtwn_write_1(sc, 0x15, 0xe9);
2902
2903	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
2904
2905	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2906	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2907
2908	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2909fail:
2910	return;
2911}
2912
2913static void
2914urtwn_init(void *arg)
2915{
2916	struct urtwn_softc *sc = arg;
2917
2918	URTWN_LOCK(sc);
2919	urtwn_init_locked(arg);
2920	URTWN_UNLOCK(sc);
2921}
2922
2923static void
2924urtwn_stop_locked(struct ifnet *ifp, int disable)
2925{
2926	struct urtwn_softc *sc = ifp->if_softc;
2927
2928	(void)disable;
2929	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2930
2931	callout_stop(&sc->sc_watchdog_ch);
2932	urtwn_abort_xfers(sc);
2933}
2934
2935static void
2936urtwn_stop(struct ifnet *ifp, int disable)
2937{
2938	struct urtwn_softc *sc = ifp->if_softc;
2939
2940	URTWN_LOCK(sc);
2941	urtwn_stop_locked(ifp, disable);
2942	URTWN_UNLOCK(sc);
2943}
2944
2945static void
2946urtwn_abort_xfers(struct urtwn_softc *sc)
2947{
2948	int i;
2949
2950	URTWN_ASSERT_LOCKED(sc);
2951
2952	/* abort any pending transfers */
2953	for (i = 0; i < URTWN_N_TRANSFER; i++)
2954		usbd_transfer_stop(sc->sc_xfer[i]);
2955}
2956
2957static int
2958urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2959    const struct ieee80211_bpf_params *params)
2960{
2961	struct ieee80211com *ic = ni->ni_ic;
2962	struct ifnet *ifp = ic->ic_ifp;
2963	struct urtwn_softc *sc = ifp->if_softc;
2964	struct urtwn_data *bf;
2965
2966	/* prevent management frames from being sent if we're not ready */
2967	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2968		m_freem(m);
2969		ieee80211_free_node(ni);
2970		return (ENETDOWN);
2971	}
2972	URTWN_LOCK(sc);
2973	bf = urtwn_getbuf(sc);
2974	if (bf == NULL) {
2975		ieee80211_free_node(ni);
2976		m_freem(m);
2977		URTWN_UNLOCK(sc);
2978		return (ENOBUFS);
2979	}
2980
2981	ifp->if_opackets++;
2982	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
2983		ieee80211_free_node(ni);
2984		ifp->if_oerrors++;
2985		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2986		URTWN_UNLOCK(sc);
2987		return (EIO);
2988	}
2989	URTWN_UNLOCK(sc);
2990
2991	sc->sc_txtimer = 5;
2992	return (0);
2993}
2994
2995static device_method_t urtwn_methods[] = {
2996	/* Device interface */
2997	DEVMETHOD(device_probe,		urtwn_match),
2998	DEVMETHOD(device_attach,	urtwn_attach),
2999	DEVMETHOD(device_detach,	urtwn_detach),
3000
3001	{ 0, 0 }
3002};
3003
3004static driver_t urtwn_driver = {
3005	"urtwn",
3006	urtwn_methods,
3007	sizeof(struct urtwn_softc)
3008};
3009
3010static devclass_t urtwn_devclass;
3011
3012DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3013MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3014MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3015MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3016MODULE_DEPEND(urtwn, urtwn_fw, 1, 1, 1);
3017MODULE_VERSION(urtwn, 1);
3018