if_urtwn.c revision 257743
1251538Srpaulo/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2251538Srpaulo
3251538Srpaulo/*-
4251538Srpaulo * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5251538Srpaulo *
6251538Srpaulo * Permission to use, copy, modify, and distribute this software for any
7251538Srpaulo * purpose with or without fee is hereby granted, provided that the above
8251538Srpaulo * copyright notice and this permission notice appear in all copies.
9251538Srpaulo *
10251538Srpaulo * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11251538Srpaulo * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12251538Srpaulo * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13251538Srpaulo * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14251538Srpaulo * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15251538Srpaulo * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16251538Srpaulo * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17251538Srpaulo */
18251538Srpaulo
19251538Srpaulo#include <sys/cdefs.h>
20251538Srpaulo__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 257743 2013-11-06 12:57:01Z hselasky $");
21251538Srpaulo
22251538Srpaulo/*
23251538Srpaulo * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188RU/RTL8192CU.
24251538Srpaulo */
25251538Srpaulo
26251538Srpaulo#include <sys/param.h>
27251538Srpaulo#include <sys/sockio.h>
28251538Srpaulo#include <sys/sysctl.h>
29251538Srpaulo#include <sys/lock.h>
30251538Srpaulo#include <sys/mutex.h>
31251538Srpaulo#include <sys/mbuf.h>
32251538Srpaulo#include <sys/kernel.h>
33251538Srpaulo#include <sys/socket.h>
34251538Srpaulo#include <sys/systm.h>
35251538Srpaulo#include <sys/malloc.h>
36251538Srpaulo#include <sys/module.h>
37251538Srpaulo#include <sys/bus.h>
38251538Srpaulo#include <sys/endian.h>
39251538Srpaulo#include <sys/linker.h>
40251538Srpaulo#include <sys/firmware.h>
41251538Srpaulo#include <sys/kdb.h>
42251538Srpaulo
43251538Srpaulo#include <machine/bus.h>
44251538Srpaulo#include <machine/resource.h>
45251538Srpaulo#include <sys/rman.h>
46251538Srpaulo
47251538Srpaulo#include <net/bpf.h>
48251538Srpaulo#include <net/if.h>
49257176Sglebius#include <net/if_var.h>
50251538Srpaulo#include <net/if_arp.h>
51251538Srpaulo#include <net/ethernet.h>
52251538Srpaulo#include <net/if_dl.h>
53251538Srpaulo#include <net/if_media.h>
54251538Srpaulo#include <net/if_types.h>
55251538Srpaulo
56251538Srpaulo#include <netinet/in.h>
57251538Srpaulo#include <netinet/in_systm.h>
58251538Srpaulo#include <netinet/in_var.h>
59251538Srpaulo#include <netinet/if_ether.h>
60251538Srpaulo#include <netinet/ip.h>
61251538Srpaulo
62251538Srpaulo#include <net80211/ieee80211_var.h>
63251538Srpaulo#include <net80211/ieee80211_regdomain.h>
64251538Srpaulo#include <net80211/ieee80211_radiotap.h>
65251538Srpaulo#include <net80211/ieee80211_ratectl.h>
66251538Srpaulo
67251538Srpaulo#include <dev/usb/usb.h>
68251538Srpaulo#include <dev/usb/usbdi.h>
69251538Srpaulo#include "usbdevs.h"
70251538Srpaulo
71251538Srpaulo#define USB_DEBUG_VAR urtwn_debug
72251538Srpaulo#include <dev/usb/usb_debug.h>
73251538Srpaulo
74251538Srpaulo#include <dev/usb/wlan/if_urtwnreg.h>
75251538Srpaulo
76251538Srpaulo#ifdef USB_DEBUG
77251538Srpaulostatic int urtwn_debug = 0;
78251538Srpaulo
79251538SrpauloSYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
80251538SrpauloSYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
81251538Srpaulo    "Debug level");
82251538Srpaulo#endif
83251538Srpaulo
84252406Srpaulo#define	URTWN_RSSI(r)  (r) - 110
85251538Srpaulo#define	IEEE80211_HAS_ADDR4(wh)	\
86251538Srpaulo	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
87251538Srpaulo
88251538Srpaulo/* various supported device vendors/products */
89251596Srpaulostatic const STRUCT_USB_HOST_ID urtwn_devs[] = {
90251538Srpaulo#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
91251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_1),
92251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_2),
93251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8192CU),
94251538Srpaulo	URTWN_DEV(ASUS,		RTL8192CU),
95251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
96251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
97251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CU),
98251538Srpaulo	URTWN_DEV(BELKIN,	F7D2102),
99251538Srpaulo	URTWN_DEV(BELKIN,	RTL8188CU),
100251538Srpaulo	URTWN_DEV(BELKIN,	RTL8192CU),
101251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_1),
102251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_2),
103251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_3),
104251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_4),
105251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_5),
106251538Srpaulo	URTWN_DEV(COREGA,	RTL8192CU),
107251538Srpaulo	URTWN_DEV(DLINK,	RTL8188CU),
108251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_1),
109251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_2),
110251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_3),
111252196Skevlo	URTWN_DEV(DLINK,	DWA131B),
112251538Srpaulo	URTWN_DEV(EDIMAX,	EW7811UN),
113251538Srpaulo	URTWN_DEV(EDIMAX,	RTL8192CU),
114251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8188CU),
115251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8192CU),
116251538Srpaulo	URTWN_DEV(GUILLEMOT,	HWNUP150),
117251538Srpaulo	URTWN_DEV(HAWKING,	RTL8192CU),
118251538Srpaulo	URTWN_DEV(HP3,		RTL8188CU),
119251538Srpaulo	URTWN_DEV(NETGEAR,	WNA1000M),
120251538Srpaulo	URTWN_DEV(NETGEAR,	RTL8192CU),
121251538Srpaulo	URTWN_DEV(NETGEAR4,	RTL8188CU),
122251538Srpaulo	URTWN_DEV(NOVATECH,	RTL8188CU),
123251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_1),
124251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_2),
125251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_3),
126251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_4),
127251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CUS),
128251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8192CU),
129251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_0),
130251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_1),
131251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CTV),
132251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_0),
133251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_1),
134251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_2),
135251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
136251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CUS),
137251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_1),
138251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_2),
139251538Srpaulo	URTWN_DEV(REALTEK,	RTL8191CU),
140251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CE),
141251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CU),
142257543Salfred	URTWN_DEV(REALTEK, 	RTL8188CU_0),
143251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
144251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
145251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8192CU),
146251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8188CU),
147251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8192CU),
148251538Srpaulo	URTWN_DEV(ZYXEL,	RTL8192CU),
149251538Srpaulo#undef URTWN_DEV
150251538Srpaulo};
151251538Srpaulo
152251538Srpaulostatic device_probe_t	urtwn_match;
153251538Srpaulostatic device_attach_t	urtwn_attach;
154251538Srpaulostatic device_detach_t	urtwn_detach;
155251538Srpaulo
156251538Srpaulostatic usb_callback_t   urtwn_bulk_tx_callback;
157251538Srpaulostatic usb_callback_t	urtwn_bulk_rx_callback;
158251538Srpaulo
159251538Srpaulostatic usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
160251538Srpaulo			    struct usb_device_request *req, void *data);
161251538Srpaulostatic struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
162251538Srpaulo		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
163251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN],
164251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN]);
165251538Srpaulostatic void		urtwn_vap_delete(struct ieee80211vap *);
166251538Srpaulostatic struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
167251538Srpaulo			    int *);
168251538Srpaulostatic struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
169251538Srpaulo			    int *, int8_t *);
170251538Srpaulostatic void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
171251538Srpaulostatic int		urtwn_alloc_list(struct urtwn_softc *,
172251538Srpaulo			    struct urtwn_data[], int, int);
173251538Srpaulostatic int		urtwn_alloc_rx_list(struct urtwn_softc *);
174251538Srpaulostatic int		urtwn_alloc_tx_list(struct urtwn_softc *);
175251538Srpaulostatic void		urtwn_free_tx_list(struct urtwn_softc *);
176251538Srpaulostatic void		urtwn_free_rx_list(struct urtwn_softc *);
177251538Srpaulostatic void		urtwn_free_list(struct urtwn_softc *,
178251538Srpaulo			    struct urtwn_data data[], int);
179251538Srpaulostatic struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
180251538Srpaulostatic struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
181251538Srpaulostatic int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
182251538Srpaulo			    uint8_t *, int);
183251538Srpaulostatic void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
184251538Srpaulostatic void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
185251538Srpaulostatic void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
186251538Srpaulostatic int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
187251538Srpaulo			    uint8_t *, int);
188251538Srpaulostatic uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
189251538Srpaulostatic uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
190251538Srpaulostatic uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
191251538Srpaulostatic int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
192251538Srpaulo			    const void *, int);
193251538Srpaulostatic void		urtwn_rf_write(struct urtwn_softc *, int, uint8_t,
194251538Srpaulo			    uint32_t);
195251538Srpaulostatic uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
196251538Srpaulostatic int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
197251538Srpaulo			    uint32_t);
198251538Srpaulostatic uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
199251538Srpaulostatic void		urtwn_efuse_read(struct urtwn_softc *);
200251538Srpaulostatic int		urtwn_read_chipid(struct urtwn_softc *);
201251538Srpaulostatic void		urtwn_read_rom(struct urtwn_softc *);
202251538Srpaulostatic int		urtwn_ra_init(struct urtwn_softc *);
203251538Srpaulostatic void		urtwn_tsf_sync_enable(struct urtwn_softc *);
204251538Srpaulostatic void		urtwn_set_led(struct urtwn_softc *, int, int);
205251538Srpaulostatic int		urtwn_newstate(struct ieee80211vap *,
206251538Srpaulo			    enum ieee80211_state, int);
207251538Srpaulostatic void		urtwn_watchdog(void *);
208251538Srpaulostatic void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
209251538Srpaulostatic int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
210251538Srpaulostatic int		urtwn_tx_start(struct urtwn_softc *,
211251538Srpaulo			    struct ieee80211_node *, struct mbuf *,
212251538Srpaulo			    struct urtwn_data *);
213251538Srpaulostatic void		urtwn_start(struct ifnet *);
214251538Srpaulostatic int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
215251538Srpaulostatic int		urtwn_power_on(struct urtwn_softc *);
216251538Srpaulostatic int		urtwn_llt_init(struct urtwn_softc *);
217251538Srpaulostatic void		urtwn_fw_reset(struct urtwn_softc *);
218251538Srpaulostatic int		urtwn_fw_loadpage(struct urtwn_softc *, int,
219251538Srpaulo			    const uint8_t *, int);
220251538Srpaulostatic int		urtwn_load_firmware(struct urtwn_softc *);
221251538Srpaulostatic int		urtwn_dma_init(struct urtwn_softc *);
222251538Srpaulostatic void		urtwn_mac_init(struct urtwn_softc *);
223251538Srpaulostatic void		urtwn_bb_init(struct urtwn_softc *);
224251538Srpaulostatic void		urtwn_rf_init(struct urtwn_softc *);
225251538Srpaulostatic void		urtwn_cam_init(struct urtwn_softc *);
226251538Srpaulostatic void		urtwn_pa_bias_init(struct urtwn_softc *);
227251538Srpaulostatic void		urtwn_rxfilter_init(struct urtwn_softc *);
228251538Srpaulostatic void		urtwn_edca_init(struct urtwn_softc *);
229251538Srpaulostatic void		urtwn_write_txpower(struct urtwn_softc *, int,
230251538Srpaulo			    uint16_t[]);
231251538Srpaulostatic void		urtwn_get_txpower(struct urtwn_softc *, int,
232251538Srpaulo		      	    struct ieee80211_channel *,
233251538Srpaulo			    struct ieee80211_channel *, uint16_t[]);
234251538Srpaulostatic void		urtwn_set_txpower(struct urtwn_softc *,
235251538Srpaulo		    	    struct ieee80211_channel *,
236251538Srpaulo			    struct ieee80211_channel *);
237251538Srpaulostatic void		urtwn_scan_start(struct ieee80211com *);
238251538Srpaulostatic void		urtwn_scan_end(struct ieee80211com *);
239251538Srpaulostatic void		urtwn_set_channel(struct ieee80211com *);
240251538Srpaulostatic void		urtwn_set_chan(struct urtwn_softc *,
241251538Srpaulo		    	    struct ieee80211_channel *,
242251538Srpaulo			    struct ieee80211_channel *);
243251538Srpaulostatic void		urtwn_update_mcast(struct ifnet *);
244251538Srpaulostatic void		urtwn_iq_calib(struct urtwn_softc *);
245251538Srpaulostatic void		urtwn_lc_calib(struct urtwn_softc *);
246251538Srpaulostatic void		urtwn_init(void *);
247251538Srpaulostatic void		urtwn_init_locked(void *);
248251538Srpaulostatic void		urtwn_stop(struct ifnet *, int);
249251538Srpaulostatic void		urtwn_stop_locked(struct ifnet *, int);
250251538Srpaulostatic void		urtwn_abort_xfers(struct urtwn_softc *);
251251538Srpaulostatic int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
252251538Srpaulo			    const struct ieee80211_bpf_params *);
253251538Srpaulo
254251538Srpaulo/* Aliases. */
255251538Srpaulo#define	urtwn_bb_write	urtwn_write_4
256251538Srpaulo#define urtwn_bb_read	urtwn_read_4
257251538Srpaulo
258251538Srpaulostatic const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
259251538Srpaulo	[URTWN_BULK_RX] = {
260251538Srpaulo		.type = UE_BULK,
261251538Srpaulo		.endpoint = UE_ADDR_ANY,
262251538Srpaulo		.direction = UE_DIR_IN,
263251538Srpaulo		.bufsize = URTWN_RXBUFSZ,
264251538Srpaulo		.flags = {
265251538Srpaulo			.pipe_bof = 1,
266251538Srpaulo			.short_xfer_ok = 1
267251538Srpaulo		},
268251538Srpaulo		.callback = urtwn_bulk_rx_callback,
269251538Srpaulo	},
270251538Srpaulo	[URTWN_BULK_TX_BE] = {
271251538Srpaulo		.type = UE_BULK,
272251538Srpaulo		.endpoint = 0x03,
273251538Srpaulo		.direction = UE_DIR_OUT,
274251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
275251538Srpaulo		.flags = {
276251538Srpaulo			.ext_buffer = 1,
277251538Srpaulo			.pipe_bof = 1,
278251538Srpaulo			.force_short_xfer = 1
279251538Srpaulo		},
280251538Srpaulo		.callback = urtwn_bulk_tx_callback,
281251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
282251538Srpaulo	},
283251538Srpaulo	[URTWN_BULK_TX_BK] = {
284251538Srpaulo		.type = UE_BULK,
285251538Srpaulo		.endpoint = 0x03,
286251538Srpaulo		.direction = UE_DIR_OUT,
287251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
288251538Srpaulo		.flags = {
289251538Srpaulo			.ext_buffer = 1,
290251538Srpaulo			.pipe_bof = 1,
291251538Srpaulo			.force_short_xfer = 1,
292251538Srpaulo		},
293251538Srpaulo		.callback = urtwn_bulk_tx_callback,
294251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
295251538Srpaulo	},
296251538Srpaulo	[URTWN_BULK_TX_VI] = {
297251538Srpaulo		.type = UE_BULK,
298251538Srpaulo		.endpoint = 0x02,
299251538Srpaulo		.direction = UE_DIR_OUT,
300251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
301251538Srpaulo		.flags = {
302251538Srpaulo			.ext_buffer = 1,
303251538Srpaulo			.pipe_bof = 1,
304251538Srpaulo			.force_short_xfer = 1
305251538Srpaulo		},
306251538Srpaulo		.callback = urtwn_bulk_tx_callback,
307251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
308251538Srpaulo	},
309251538Srpaulo	[URTWN_BULK_TX_VO] = {
310251538Srpaulo		.type = UE_BULK,
311251538Srpaulo		.endpoint = 0x02,
312251538Srpaulo		.direction = UE_DIR_OUT,
313251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
314251538Srpaulo		.flags = {
315251538Srpaulo			.ext_buffer = 1,
316251538Srpaulo			.pipe_bof = 1,
317251538Srpaulo			.force_short_xfer = 1
318251538Srpaulo		},
319251538Srpaulo		.callback = urtwn_bulk_tx_callback,
320251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
321251538Srpaulo	},
322251538Srpaulo};
323251538Srpaulo
324251538Srpaulostatic int
325251538Srpaulourtwn_match(device_t self)
326251538Srpaulo{
327251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
328251538Srpaulo
329251538Srpaulo	if (uaa->usb_mode != USB_MODE_HOST)
330251538Srpaulo		return (ENXIO);
331251538Srpaulo	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
332251538Srpaulo		return (ENXIO);
333251538Srpaulo	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
334251538Srpaulo		return (ENXIO);
335251538Srpaulo
336251538Srpaulo	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
337251538Srpaulo}
338251538Srpaulo
339251538Srpaulostatic int
340251538Srpaulourtwn_attach(device_t self)
341251538Srpaulo{
342251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
343251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
344251538Srpaulo	struct ifnet *ifp;
345251538Srpaulo	struct ieee80211com *ic;
346251538Srpaulo	uint8_t iface_index, bands;
347251538Srpaulo	int error;
348251538Srpaulo
349251538Srpaulo	device_set_usb_desc(self);
350251538Srpaulo	sc->sc_udev = uaa->device;
351251538Srpaulo	sc->sc_dev = self;
352251538Srpaulo
353251538Srpaulo	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
354251538Srpaulo	    MTX_NETWORK_LOCK, MTX_DEF);
355251538Srpaulo	callout_init(&sc->sc_watchdog_ch, 0);
356251538Srpaulo
357251538Srpaulo	iface_index = URTWN_IFACE_INDEX;
358251538Srpaulo	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
359251538Srpaulo	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
360251538Srpaulo	if (error) {
361251538Srpaulo		device_printf(self, "could not allocate USB transfers, "
362251538Srpaulo		    "err=%s\n", usbd_errstr(error));
363251538Srpaulo		goto detach;
364251538Srpaulo	}
365251538Srpaulo
366251538Srpaulo	URTWN_LOCK(sc);
367251538Srpaulo
368251538Srpaulo	error = urtwn_read_chipid(sc);
369251538Srpaulo	if (error) {
370251538Srpaulo		device_printf(sc->sc_dev, "unsupported test chip\n");
371251538Srpaulo		URTWN_UNLOCK(sc);
372251538Srpaulo		goto detach;
373251538Srpaulo	}
374251538Srpaulo
375251538Srpaulo	/* Determine number of Tx/Rx chains. */
376251538Srpaulo	if (sc->chip & URTWN_CHIP_92C) {
377251538Srpaulo		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
378251538Srpaulo		sc->nrxchains = 2;
379251538Srpaulo	} else {
380251538Srpaulo		sc->ntxchains = 1;
381251538Srpaulo		sc->nrxchains = 1;
382251538Srpaulo	}
383251538Srpaulo	urtwn_read_rom(sc);
384251538Srpaulo
385251538Srpaulo	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
386251538Srpaulo	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
387251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
388251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
389251538Srpaulo	    "8188CUS", sc->ntxchains, sc->nrxchains);
390251538Srpaulo
391251538Srpaulo	URTWN_UNLOCK(sc);
392251538Srpaulo
393251538Srpaulo	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
394251538Srpaulo	if (ifp == NULL) {
395251538Srpaulo		device_printf(sc->sc_dev, "can not if_alloc()\n");
396251538Srpaulo		goto detach;
397251538Srpaulo	}
398251538Srpaulo	ic = ifp->if_l2com;
399251538Srpaulo
400251538Srpaulo	ifp->if_softc = sc;
401251538Srpaulo	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
402251538Srpaulo	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
403251538Srpaulo	ifp->if_init = urtwn_init;
404251538Srpaulo	ifp->if_ioctl = urtwn_ioctl;
405251538Srpaulo	ifp->if_start = urtwn_start;
406251538Srpaulo	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
407251538Srpaulo	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
408251538Srpaulo	IFQ_SET_READY(&ifp->if_snd);
409251538Srpaulo
410251538Srpaulo	ic->ic_ifp = ifp;
411251538Srpaulo	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
412251538Srpaulo	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
413251538Srpaulo
414251538Srpaulo	/* set device capabilities */
415251538Srpaulo	ic->ic_caps =
416251538Srpaulo		  IEEE80211_C_STA		/* station mode */
417251538Srpaulo		| IEEE80211_C_MONITOR		/* monitor mode */
418251538Srpaulo		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
419251538Srpaulo		| IEEE80211_C_SHSLOT		/* short slot time supported */
420251538Srpaulo		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
421251538Srpaulo		| IEEE80211_C_WPA		/* 802.11i */
422251538Srpaulo		;
423251538Srpaulo
424251538Srpaulo	bands = 0;
425251538Srpaulo	setbit(&bands, IEEE80211_MODE_11B);
426251538Srpaulo	setbit(&bands, IEEE80211_MODE_11G);
427251538Srpaulo	ieee80211_init_channels(ic, NULL, &bands);
428251538Srpaulo
429251538Srpaulo	ieee80211_ifattach(ic, sc->sc_bssid);
430251538Srpaulo	ic->ic_raw_xmit = urtwn_raw_xmit;
431251538Srpaulo	ic->ic_scan_start = urtwn_scan_start;
432251538Srpaulo	ic->ic_scan_end = urtwn_scan_end;
433251538Srpaulo	ic->ic_set_channel = urtwn_set_channel;
434251538Srpaulo
435251538Srpaulo	ic->ic_vap_create = urtwn_vap_create;
436251538Srpaulo	ic->ic_vap_delete = urtwn_vap_delete;
437251538Srpaulo	ic->ic_update_mcast = urtwn_update_mcast;
438251538Srpaulo
439251538Srpaulo	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
440251538Srpaulo	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
441251538Srpaulo	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
442251538Srpaulo	    URTWN_RX_RADIOTAP_PRESENT);
443251538Srpaulo
444251538Srpaulo	if (bootverbose)
445251538Srpaulo		ieee80211_announce(ic);
446251538Srpaulo
447251538Srpaulo	return (0);
448251538Srpaulo
449251538Srpaulodetach:
450251538Srpaulo	urtwn_detach(self);
451251538Srpaulo	return (ENXIO);			/* failure */
452251538Srpaulo}
453251538Srpaulo
454251538Srpaulostatic int
455251538Srpaulourtwn_detach(device_t self)
456251538Srpaulo{
457251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
458251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
459251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
460251538Srpaulo
461251538Srpaulo	if (!device_is_attached(self))
462251538Srpaulo		return (0);
463251538Srpaulo
464251538Srpaulo	urtwn_stop(ifp, 1);
465251538Srpaulo
466251538Srpaulo	callout_drain(&sc->sc_watchdog_ch);
467251538Srpaulo
468251538Srpaulo	/* stop all USB transfers */
469251538Srpaulo	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
470251538Srpaulo	ieee80211_ifdetach(ic);
471251538Srpaulo
472251538Srpaulo	urtwn_free_tx_list(sc);
473251538Srpaulo	urtwn_free_rx_list(sc);
474251538Srpaulo
475251538Srpaulo	if_free(ifp);
476251538Srpaulo	mtx_destroy(&sc->sc_mtx);
477251538Srpaulo
478251538Srpaulo	return (0);
479251538Srpaulo}
480251538Srpaulo
481251538Srpaulostatic void
482251538Srpaulourtwn_free_tx_list(struct urtwn_softc *sc)
483251538Srpaulo{
484251538Srpaulo	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
485251538Srpaulo}
486251538Srpaulo
487251538Srpaulostatic void
488251538Srpaulourtwn_free_rx_list(struct urtwn_softc *sc)
489251538Srpaulo{
490251538Srpaulo	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
491251538Srpaulo}
492251538Srpaulo
493251538Srpaulostatic void
494251538Srpaulourtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
495251538Srpaulo{
496251538Srpaulo	int i;
497251538Srpaulo
498251538Srpaulo	for (i = 0; i < ndata; i++) {
499251538Srpaulo		struct urtwn_data *dp = &data[i];
500251538Srpaulo
501251538Srpaulo		if (dp->buf != NULL) {
502251538Srpaulo			free(dp->buf, M_USBDEV);
503251538Srpaulo			dp->buf = NULL;
504251538Srpaulo		}
505251538Srpaulo		if (dp->ni != NULL) {
506251538Srpaulo			ieee80211_free_node(dp->ni);
507251538Srpaulo			dp->ni = NULL;
508251538Srpaulo		}
509251538Srpaulo	}
510251538Srpaulo}
511251538Srpaulo
512251538Srpaulostatic usb_error_t
513251538Srpaulourtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
514251538Srpaulo    void *data)
515251538Srpaulo{
516251538Srpaulo	usb_error_t err;
517251538Srpaulo	int ntries = 10;
518251538Srpaulo
519251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
520251538Srpaulo
521251538Srpaulo	while (ntries--) {
522251538Srpaulo		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
523251538Srpaulo		    req, data, 0, NULL, 250 /* ms */);
524251538Srpaulo		if (err == 0)
525251538Srpaulo			break;
526251538Srpaulo
527251538Srpaulo		DPRINTFN(1, "Control request failed, %s (retrying)\n",
528251538Srpaulo		    usbd_errstr(err));
529251538Srpaulo		usb_pause_mtx(&sc->sc_mtx, hz / 100);
530251538Srpaulo	}
531251538Srpaulo	return (err);
532251538Srpaulo}
533251538Srpaulo
534251538Srpaulostatic struct ieee80211vap *
535251538Srpaulourtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
536251538Srpaulo    enum ieee80211_opmode opmode, int flags,
537251538Srpaulo    const uint8_t bssid[IEEE80211_ADDR_LEN],
538251538Srpaulo    const uint8_t mac[IEEE80211_ADDR_LEN])
539251538Srpaulo{
540251538Srpaulo	struct urtwn_vap *uvp;
541251538Srpaulo	struct ieee80211vap *vap;
542251538Srpaulo
543251538Srpaulo	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
544251538Srpaulo		return (NULL);
545251538Srpaulo
546251538Srpaulo	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
547251538Srpaulo	    M_80211_VAP, M_NOWAIT | M_ZERO);
548251538Srpaulo	if (uvp == NULL)
549251538Srpaulo		return (NULL);
550251538Srpaulo	vap = &uvp->vap;
551251538Srpaulo	/* enable s/w bmiss handling for sta mode */
552251538Srpaulo
553257743Shselasky	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
554257743Shselasky	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
555257743Shselasky		/* out of memory */
556257743Shselasky		free(uvp, M_80211_VAP);
557257743Shselasky		return (NULL);
558257743Shselasky	}
559257743Shselasky
560251538Srpaulo	/* override state transition machine */
561251538Srpaulo	uvp->newstate = vap->iv_newstate;
562251538Srpaulo	vap->iv_newstate = urtwn_newstate;
563251538Srpaulo
564251538Srpaulo	/* complete setup */
565251538Srpaulo	ieee80211_vap_attach(vap, ieee80211_media_change,
566251538Srpaulo	    ieee80211_media_status);
567251538Srpaulo	ic->ic_opmode = opmode;
568251538Srpaulo	return (vap);
569251538Srpaulo}
570251538Srpaulo
571251538Srpaulostatic void
572251538Srpaulourtwn_vap_delete(struct ieee80211vap *vap)
573251538Srpaulo{
574251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
575251538Srpaulo
576251538Srpaulo	ieee80211_vap_detach(vap);
577251538Srpaulo	free(uvp, M_80211_VAP);
578251538Srpaulo}
579251538Srpaulo
580251538Srpaulostatic struct mbuf *
581251538Srpaulourtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
582251538Srpaulo{
583251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
584251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
585251538Srpaulo	struct ieee80211_frame *wh;
586251538Srpaulo	struct mbuf *m;
587251538Srpaulo	struct r92c_rx_stat *stat;
588251538Srpaulo	uint32_t rxdw0, rxdw3;
589251538Srpaulo	uint8_t rate;
590251538Srpaulo	int8_t rssi = 0;
591251538Srpaulo	int infosz;
592251538Srpaulo
593251538Srpaulo	/*
594251538Srpaulo	 * don't pass packets to the ieee80211 framework if the driver isn't
595251538Srpaulo	 * RUNNING.
596251538Srpaulo	 */
597251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
598251538Srpaulo		return (NULL);
599251538Srpaulo
600251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
601251538Srpaulo	rxdw0 = le32toh(stat->rxdw0);
602251538Srpaulo	rxdw3 = le32toh(stat->rxdw3);
603251538Srpaulo
604251538Srpaulo	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
605251538Srpaulo		/*
606251538Srpaulo		 * This should not happen since we setup our Rx filter
607251538Srpaulo		 * to not receive these frames.
608251538Srpaulo		 */
609251538Srpaulo		ifp->if_ierrors++;
610251538Srpaulo		return (NULL);
611251538Srpaulo	}
612251538Srpaulo
613251538Srpaulo	rate = MS(rxdw3, R92C_RXDW3_RATE);
614251538Srpaulo	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
615251538Srpaulo
616251538Srpaulo	/* Get RSSI from PHY status descriptor if present. */
617251538Srpaulo	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
618251538Srpaulo		rssi = urtwn_get_rssi(sc, rate, &stat[1]);
619251538Srpaulo		/* Update our average RSSI. */
620251538Srpaulo		urtwn_update_avgrssi(sc, rate, rssi);
621252405Srpaulo		/*
622252405Srpaulo		 * Convert the RSSI to a range that will be accepted
623252405Srpaulo		 * by net80211.
624252405Srpaulo		 */
625252405Srpaulo		rssi = URTWN_RSSI(rssi);
626251538Srpaulo	}
627251538Srpaulo
628251538Srpaulo	m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
629251538Srpaulo	if (m == NULL) {
630251538Srpaulo		device_printf(sc->sc_dev, "could not create RX mbuf\n");
631251538Srpaulo		return (NULL);
632251538Srpaulo	}
633251538Srpaulo
634251538Srpaulo	/* Finalize mbuf. */
635251538Srpaulo	m->m_pkthdr.rcvif = ifp;
636251538Srpaulo	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
637251538Srpaulo	memcpy(mtod(m, uint8_t *), wh, pktlen);
638251538Srpaulo	m->m_pkthdr.len = m->m_len = pktlen;
639251538Srpaulo
640251538Srpaulo	if (ieee80211_radiotap_active(ic)) {
641251538Srpaulo		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
642251538Srpaulo
643251538Srpaulo		tap->wr_flags = 0;
644251538Srpaulo		/* Map HW rate index to 802.11 rate. */
645251538Srpaulo		if (!(rxdw3 & R92C_RXDW3_HT)) {
646251538Srpaulo			switch (rate) {
647251538Srpaulo			/* CCK. */
648251538Srpaulo			case  0: tap->wr_rate =   2; break;
649251538Srpaulo			case  1: tap->wr_rate =   4; break;
650251538Srpaulo			case  2: tap->wr_rate =  11; break;
651251538Srpaulo			case  3: tap->wr_rate =  22; break;
652251538Srpaulo			/* OFDM. */
653251538Srpaulo			case  4: tap->wr_rate =  12; break;
654251538Srpaulo			case  5: tap->wr_rate =  18; break;
655251538Srpaulo			case  6: tap->wr_rate =  24; break;
656251538Srpaulo			case  7: tap->wr_rate =  36; break;
657251538Srpaulo			case  8: tap->wr_rate =  48; break;
658251538Srpaulo			case  9: tap->wr_rate =  72; break;
659251538Srpaulo			case 10: tap->wr_rate =  96; break;
660251538Srpaulo			case 11: tap->wr_rate = 108; break;
661251538Srpaulo			}
662251538Srpaulo		} else if (rate >= 12) {	/* MCS0~15. */
663251538Srpaulo			/* Bit 7 set means HT MCS instead of rate. */
664251538Srpaulo			tap->wr_rate = 0x80 | (rate - 12);
665251538Srpaulo		}
666251538Srpaulo		tap->wr_dbm_antsignal = rssi;
667251538Srpaulo		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
668251538Srpaulo		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
669251538Srpaulo	}
670251538Srpaulo
671251538Srpaulo	*rssi_p = rssi;
672251538Srpaulo
673251538Srpaulo	return (m);
674251538Srpaulo}
675251538Srpaulo
676251538Srpaulostatic struct mbuf *
677251538Srpaulourtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
678251538Srpaulo    int8_t *nf)
679251538Srpaulo{
680251538Srpaulo	struct urtwn_softc *sc = data->sc;
681251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
682251538Srpaulo	struct r92c_rx_stat *stat;
683251538Srpaulo	struct mbuf *m, *m0 = NULL, *prevm = NULL;
684251538Srpaulo	uint32_t rxdw0;
685251538Srpaulo	uint8_t *buf;
686251538Srpaulo	int len, totlen, pktlen, infosz, npkts;
687251538Srpaulo
688251538Srpaulo	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
689251538Srpaulo
690251538Srpaulo	if (len < sizeof(*stat)) {
691251538Srpaulo		ifp->if_ierrors++;
692251538Srpaulo		return (NULL);
693251538Srpaulo	}
694251538Srpaulo
695251538Srpaulo	buf = data->buf;
696251538Srpaulo	/* Get the number of encapsulated frames. */
697251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
698251538Srpaulo	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
699251538Srpaulo	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
700251538Srpaulo
701251538Srpaulo	/* Process all of them. */
702251538Srpaulo	while (npkts-- > 0) {
703251538Srpaulo		if (len < sizeof(*stat))
704251538Srpaulo			break;
705251538Srpaulo		stat = (struct r92c_rx_stat *)buf;
706251538Srpaulo		rxdw0 = le32toh(stat->rxdw0);
707251538Srpaulo
708251538Srpaulo		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
709251538Srpaulo		if (pktlen == 0)
710251538Srpaulo			break;
711251538Srpaulo
712251538Srpaulo		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
713251538Srpaulo
714251538Srpaulo		/* Make sure everything fits in xfer. */
715251538Srpaulo		totlen = sizeof(*stat) + infosz + pktlen;
716251538Srpaulo		if (totlen > len)
717251538Srpaulo			break;
718251538Srpaulo
719251538Srpaulo		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
720251538Srpaulo		if (m0 == NULL)
721251538Srpaulo			m0 = m;
722251538Srpaulo		if (prevm == NULL)
723251538Srpaulo			prevm = m;
724251538Srpaulo		else {
725251538Srpaulo			prevm->m_next = m;
726251538Srpaulo			prevm = m;
727251538Srpaulo		}
728251538Srpaulo
729251538Srpaulo		/* Next chunk is 128-byte aligned. */
730251538Srpaulo		totlen = (totlen + 127) & ~127;
731251538Srpaulo		buf += totlen;
732251538Srpaulo		len -= totlen;
733251538Srpaulo	}
734251538Srpaulo
735251538Srpaulo	return (m0);
736251538Srpaulo}
737251538Srpaulo
738251538Srpaulostatic void
739251538Srpaulourtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
740251538Srpaulo{
741251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
742251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
743251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
744251538Srpaulo	struct ieee80211_frame *wh;
745251538Srpaulo	struct ieee80211_node *ni;
746251538Srpaulo	struct mbuf *m = NULL, *next;
747251538Srpaulo	struct urtwn_data *data;
748251538Srpaulo	int8_t nf;
749251538Srpaulo	int rssi = 1;
750251538Srpaulo
751251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
752251538Srpaulo
753251538Srpaulo	switch (USB_GET_STATE(xfer)) {
754251538Srpaulo	case USB_ST_TRANSFERRED:
755251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
756251538Srpaulo		if (data == NULL)
757251538Srpaulo			goto tr_setup;
758251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
759251538Srpaulo		m = urtwn_rxeof(xfer, data, &rssi, &nf);
760251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
761251538Srpaulo		/* FALLTHROUGH */
762251538Srpaulo	case USB_ST_SETUP:
763251538Srpaulotr_setup:
764251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_inactive);
765251538Srpaulo		if (data == NULL) {
766251538Srpaulo			KASSERT(m == NULL, ("mbuf isn't NULL"));
767251538Srpaulo			return;
768251538Srpaulo		}
769251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
770251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
771251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf,
772251538Srpaulo		    usbd_xfer_max_len(xfer));
773251538Srpaulo		usbd_transfer_submit(xfer);
774251538Srpaulo
775251538Srpaulo		/*
776251538Srpaulo		 * To avoid LOR we should unlock our private mutex here to call
777251538Srpaulo		 * ieee80211_input() because here is at the end of a USB
778251538Srpaulo		 * callback and safe to unlock.
779251538Srpaulo		 */
780251538Srpaulo		URTWN_UNLOCK(sc);
781251538Srpaulo		while (m != NULL) {
782251538Srpaulo			next = m->m_next;
783251538Srpaulo			m->m_next = NULL;
784251538Srpaulo			wh = mtod(m, struct ieee80211_frame *);
785251538Srpaulo			ni = ieee80211_find_rxnode(ic,
786251538Srpaulo			    (struct ieee80211_frame_min *)wh);
787251538Srpaulo			nf = URTWN_NOISE_FLOOR;
788251538Srpaulo			if (ni != NULL) {
789251538Srpaulo				(void)ieee80211_input(ni, m, rssi, nf);
790251538Srpaulo				ieee80211_free_node(ni);
791251538Srpaulo			} else
792251538Srpaulo				(void)ieee80211_input_all(ic, m, rssi, nf);
793251538Srpaulo			m = next;
794251538Srpaulo		}
795251538Srpaulo		URTWN_LOCK(sc);
796251538Srpaulo		break;
797251538Srpaulo	default:
798251538Srpaulo		/* needs it to the inactive queue due to a error. */
799251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
800251538Srpaulo		if (data != NULL) {
801251538Srpaulo			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
802251538Srpaulo			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
803251538Srpaulo		}
804251538Srpaulo		if (error != USB_ERR_CANCELLED) {
805251538Srpaulo			usbd_xfer_set_stall(xfer);
806251538Srpaulo			ifp->if_ierrors++;
807251538Srpaulo			goto tr_setup;
808251538Srpaulo		}
809251538Srpaulo		break;
810251538Srpaulo	}
811251538Srpaulo}
812251538Srpaulo
813251538Srpaulostatic void
814251538Srpaulourtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
815251538Srpaulo{
816251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
817251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
818251538Srpaulo	struct mbuf *m;
819251538Srpaulo
820251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
821251538Srpaulo
822251538Srpaulo	/*
823251538Srpaulo	 * Do any tx complete callback.  Note this must be done before releasing
824251538Srpaulo	 * the node reference.
825251538Srpaulo	 */
826251538Srpaulo	if (data->m) {
827251538Srpaulo		m = data->m;
828251538Srpaulo		if (m->m_flags & M_TXCB) {
829251538Srpaulo			/* XXX status? */
830251538Srpaulo			ieee80211_process_callback(data->ni, m, 0);
831251538Srpaulo		}
832251538Srpaulo		m_freem(m);
833251538Srpaulo		data->m = NULL;
834251538Srpaulo	}
835251538Srpaulo	if (data->ni) {
836251538Srpaulo		ieee80211_free_node(data->ni);
837251538Srpaulo		data->ni = NULL;
838251538Srpaulo	}
839251538Srpaulo	sc->sc_txtimer = 0;
840251538Srpaulo	ifp->if_opackets++;
841251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
842251538Srpaulo}
843251538Srpaulo
844251538Srpaulostatic void
845251538Srpaulourtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
846251538Srpaulo{
847251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
848251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
849251538Srpaulo	struct urtwn_data *data;
850251538Srpaulo
851251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
852251538Srpaulo
853251538Srpaulo	switch (USB_GET_STATE(xfer)){
854251538Srpaulo	case USB_ST_TRANSFERRED:
855251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
856251538Srpaulo		if (data == NULL)
857251538Srpaulo			goto tr_setup;
858251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
859251538Srpaulo		urtwn_txeof(xfer, data);
860251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
861251538Srpaulo		/* FALLTHROUGH */
862251538Srpaulo	case USB_ST_SETUP:
863251538Srpaulotr_setup:
864251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_pending);
865251538Srpaulo		if (data == NULL) {
866251538Srpaulo			DPRINTF("%s: empty pending queue\n", __func__);
867251538Srpaulo			return;
868251538Srpaulo		}
869251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
870251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
871251538Srpaulo
872251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
873251538Srpaulo		usbd_transfer_submit(xfer);
874251538Srpaulo
875251538Srpaulo		URTWN_UNLOCK(sc);
876251538Srpaulo		urtwn_start(ifp);
877251538Srpaulo		URTWN_LOCK(sc);
878251538Srpaulo		break;
879251538Srpaulo	default:
880251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
881251538Srpaulo		if (data == NULL)
882251538Srpaulo			goto tr_setup;
883251538Srpaulo		if (data->ni != NULL) {
884251538Srpaulo			ieee80211_free_node(data->ni);
885251538Srpaulo			data->ni = NULL;
886251538Srpaulo			ifp->if_oerrors++;
887251538Srpaulo		}
888251538Srpaulo		if (error != USB_ERR_CANCELLED) {
889251538Srpaulo			usbd_xfer_set_stall(xfer);
890251538Srpaulo			goto tr_setup;
891251538Srpaulo		}
892251538Srpaulo		break;
893251538Srpaulo	}
894251538Srpaulo}
895251538Srpaulo
896251538Srpaulostatic struct urtwn_data *
897251538Srpaulo_urtwn_getbuf(struct urtwn_softc *sc)
898251538Srpaulo{
899251538Srpaulo	struct urtwn_data *bf;
900251538Srpaulo
901251538Srpaulo	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
902251538Srpaulo	if (bf != NULL)
903251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
904251538Srpaulo	else
905251538Srpaulo		bf = NULL;
906251538Srpaulo	if (bf == NULL)
907251538Srpaulo		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
908251538Srpaulo	return (bf);
909251538Srpaulo}
910251538Srpaulo
911251538Srpaulostatic struct urtwn_data *
912251538Srpaulourtwn_getbuf(struct urtwn_softc *sc)
913251538Srpaulo{
914251538Srpaulo        struct urtwn_data *bf;
915251538Srpaulo
916251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
917251538Srpaulo
918251538Srpaulo	bf = _urtwn_getbuf(sc);
919251538Srpaulo	if (bf == NULL) {
920251538Srpaulo		struct ifnet *ifp = sc->sc_ifp;
921251538Srpaulo		DPRINTF("%s: stop queue\n", __func__);
922251538Srpaulo		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
923251538Srpaulo	}
924251538Srpaulo	return (bf);
925251538Srpaulo}
926251538Srpaulo
927251538Srpaulostatic int
928251538Srpaulourtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
929251538Srpaulo    int len)
930251538Srpaulo{
931251538Srpaulo	usb_device_request_t req;
932251538Srpaulo
933251538Srpaulo	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
934251538Srpaulo	req.bRequest = R92C_REQ_REGS;
935251538Srpaulo	USETW(req.wValue, addr);
936251538Srpaulo	USETW(req.wIndex, 0);
937251538Srpaulo	USETW(req.wLength, len);
938251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
939251538Srpaulo}
940251538Srpaulo
941251538Srpaulostatic void
942251538Srpaulourtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
943251538Srpaulo{
944251538Srpaulo	urtwn_write_region_1(sc, addr, &val, 1);
945251538Srpaulo}
946251538Srpaulo
947251538Srpaulo
948251538Srpaulostatic void
949251538Srpaulourtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
950251538Srpaulo{
951251538Srpaulo	val = htole16(val);
952251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
953251538Srpaulo}
954251538Srpaulo
955251538Srpaulostatic void
956251538Srpaulourtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
957251538Srpaulo{
958251538Srpaulo	val = htole32(val);
959251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
960251538Srpaulo}
961251538Srpaulo
962251538Srpaulostatic int
963251538Srpaulourtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
964251538Srpaulo    int len)
965251538Srpaulo{
966251538Srpaulo	usb_device_request_t req;
967251538Srpaulo
968251538Srpaulo	req.bmRequestType = UT_READ_VENDOR_DEVICE;
969251538Srpaulo	req.bRequest = R92C_REQ_REGS;
970251538Srpaulo	USETW(req.wValue, addr);
971251538Srpaulo	USETW(req.wIndex, 0);
972251538Srpaulo	USETW(req.wLength, len);
973251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
974251538Srpaulo}
975251538Srpaulo
976251538Srpaulostatic uint8_t
977251538Srpaulourtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
978251538Srpaulo{
979251538Srpaulo	uint8_t val;
980251538Srpaulo
981251538Srpaulo	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
982251538Srpaulo		return (0xff);
983251538Srpaulo	return (val);
984251538Srpaulo}
985251538Srpaulo
986251538Srpaulostatic uint16_t
987251538Srpaulourtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
988251538Srpaulo{
989251538Srpaulo	uint16_t val;
990251538Srpaulo
991251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
992251538Srpaulo		return (0xffff);
993251538Srpaulo	return (le16toh(val));
994251538Srpaulo}
995251538Srpaulo
996251538Srpaulostatic uint32_t
997251538Srpaulourtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
998251538Srpaulo{
999251538Srpaulo	uint32_t val;
1000251538Srpaulo
1001251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1002251538Srpaulo		return (0xffffffff);
1003251538Srpaulo	return (le32toh(val));
1004251538Srpaulo}
1005251538Srpaulo
1006251538Srpaulostatic int
1007251538Srpaulourtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1008251538Srpaulo{
1009251538Srpaulo	struct r92c_fw_cmd cmd;
1010251538Srpaulo	int ntries;
1011251538Srpaulo
1012251538Srpaulo	/* Wait for current FW box to be empty. */
1013251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1014251538Srpaulo		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1015251538Srpaulo			break;
1016251538Srpaulo		DELAY(1);
1017251538Srpaulo	}
1018251538Srpaulo	if (ntries == 100) {
1019251538Srpaulo		device_printf(sc->sc_dev,
1020251538Srpaulo		    "could not send firmware command\n");
1021251538Srpaulo		return (ETIMEDOUT);
1022251538Srpaulo	}
1023251538Srpaulo	memset(&cmd, 0, sizeof(cmd));
1024251538Srpaulo	cmd.id = id;
1025251538Srpaulo	if (len > 3)
1026251538Srpaulo		cmd.id |= R92C_CMD_FLAG_EXT;
1027251538Srpaulo	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1028251538Srpaulo	memcpy(cmd.msg, buf, len);
1029251538Srpaulo
1030251538Srpaulo	/* Write the first word last since that will trigger the FW. */
1031251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1032251538Srpaulo	    (uint8_t *)&cmd + 4, 2);
1033251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1034251538Srpaulo	    (uint8_t *)&cmd + 0, 4);
1035251538Srpaulo
1036251538Srpaulo	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1037251538Srpaulo	return (0);
1038251538Srpaulo}
1039251538Srpaulo
1040251538Srpaulostatic void
1041251538Srpaulourtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1042251538Srpaulo{
1043251538Srpaulo	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1044251538Srpaulo	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1045251538Srpaulo	    SM(R92C_LSSI_PARAM_DATA, val));
1046251538Srpaulo}
1047251538Srpaulo
1048251538Srpaulostatic uint32_t
1049251538Srpaulourtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1050251538Srpaulo{
1051251538Srpaulo	uint32_t reg[R92C_MAX_CHAINS], val;
1052251538Srpaulo
1053251538Srpaulo	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1054251538Srpaulo	if (chain != 0)
1055251538Srpaulo		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1056251538Srpaulo
1057251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1058251538Srpaulo	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1059251538Srpaulo	DELAY(1000);
1060251538Srpaulo
1061251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1062251538Srpaulo	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1063251538Srpaulo	    R92C_HSSI_PARAM2_READ_EDGE);
1064251538Srpaulo	DELAY(1000);
1065251538Srpaulo
1066251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1067251538Srpaulo	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1068251538Srpaulo	DELAY(1000);
1069251538Srpaulo
1070251538Srpaulo	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1071251538Srpaulo		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1072251538Srpaulo	else
1073251538Srpaulo		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1074251538Srpaulo	return (MS(val, R92C_LSSI_READBACK_DATA));
1075251538Srpaulo}
1076251538Srpaulo
1077251538Srpaulostatic int
1078251538Srpaulourtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1079251538Srpaulo{
1080251538Srpaulo	int ntries;
1081251538Srpaulo
1082251538Srpaulo	urtwn_write_4(sc, R92C_LLT_INIT,
1083251538Srpaulo	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1084251538Srpaulo	    SM(R92C_LLT_INIT_ADDR, addr) |
1085251538Srpaulo	    SM(R92C_LLT_INIT_DATA, data));
1086251538Srpaulo	/* Wait for write operation to complete. */
1087251538Srpaulo	for (ntries = 0; ntries < 20; ntries++) {
1088251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1089251538Srpaulo		    R92C_LLT_INIT_OP_NO_ACTIVE)
1090251538Srpaulo			return (0);
1091251538Srpaulo		DELAY(5);
1092251538Srpaulo	}
1093251538Srpaulo	return (ETIMEDOUT);
1094251538Srpaulo}
1095251538Srpaulo
1096251538Srpaulostatic uint8_t
1097251538Srpaulourtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1098251538Srpaulo{
1099251538Srpaulo	uint32_t reg;
1100251538Srpaulo	int ntries;
1101251538Srpaulo
1102251538Srpaulo	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1103251538Srpaulo	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1104251538Srpaulo	reg &= ~R92C_EFUSE_CTRL_VALID;
1105251538Srpaulo	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1106251538Srpaulo	/* Wait for read operation to complete. */
1107251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1108251538Srpaulo		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1109251538Srpaulo		if (reg & R92C_EFUSE_CTRL_VALID)
1110251538Srpaulo			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1111251538Srpaulo		DELAY(5);
1112251538Srpaulo	}
1113251538Srpaulo	device_printf(sc->sc_dev,
1114251538Srpaulo	    "could not read efuse byte at address 0x%x\n", addr);
1115251538Srpaulo	return (0xff);
1116251538Srpaulo}
1117251538Srpaulo
1118251538Srpaulostatic void
1119251538Srpaulourtwn_efuse_read(struct urtwn_softc *sc)
1120251538Srpaulo{
1121251538Srpaulo	uint8_t *rom = (uint8_t *)&sc->rom;
1122251538Srpaulo	uint16_t addr = 0;
1123251538Srpaulo	uint32_t reg;
1124251538Srpaulo	uint8_t off, msk;
1125251538Srpaulo	int i;
1126251538Srpaulo
1127251538Srpaulo	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1128251538Srpaulo	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1129251538Srpaulo		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1130251538Srpaulo		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1131251538Srpaulo	}
1132251538Srpaulo	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1133251538Srpaulo	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1134251538Srpaulo		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1135251538Srpaulo		    reg | R92C_SYS_FUNC_EN_ELDR);
1136251538Srpaulo	}
1137251538Srpaulo	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1138251538Srpaulo	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1139251538Srpaulo	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1140251538Srpaulo		urtwn_write_2(sc, R92C_SYS_CLKR,
1141251538Srpaulo		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1142251538Srpaulo	}
1143251538Srpaulo	memset(&sc->rom, 0xff, sizeof(sc->rom));
1144251538Srpaulo	while (addr < 512) {
1145251538Srpaulo		reg = urtwn_efuse_read_1(sc, addr);
1146251538Srpaulo		if (reg == 0xff)
1147251538Srpaulo			break;
1148251538Srpaulo		addr++;
1149251538Srpaulo		off = reg >> 4;
1150251538Srpaulo		msk = reg & 0xf;
1151251538Srpaulo		for (i = 0; i < 4; i++) {
1152251538Srpaulo			if (msk & (1 << i))
1153251538Srpaulo				continue;
1154251538Srpaulo			rom[off * 8 + i * 2 + 0] =
1155251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1156251538Srpaulo			addr++;
1157251538Srpaulo			rom[off * 8 + i * 2 + 1] =
1158251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1159251538Srpaulo			addr++;
1160251538Srpaulo		}
1161251538Srpaulo	}
1162251538Srpaulo#ifdef URTWN_DEBUG
1163251538Srpaulo	if (urtwn_debug >= 2) {
1164251538Srpaulo		/* Dump ROM content. */
1165251538Srpaulo		printf("\n");
1166251538Srpaulo		for (i = 0; i < sizeof(sc->rom); i++)
1167251538Srpaulo			printf("%02x:", rom[i]);
1168251538Srpaulo		printf("\n");
1169251538Srpaulo	}
1170251538Srpaulo#endif
1171251538Srpaulo}
1172251538Srpaulo
1173251538Srpaulostatic int
1174251538Srpaulourtwn_read_chipid(struct urtwn_softc *sc)
1175251538Srpaulo{
1176251538Srpaulo	uint32_t reg;
1177251538Srpaulo
1178251538Srpaulo	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1179251538Srpaulo	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1180251538Srpaulo		return (EIO);
1181251538Srpaulo
1182251538Srpaulo	if (reg & R92C_SYS_CFG_TYPE_92C) {
1183251538Srpaulo		sc->chip |= URTWN_CHIP_92C;
1184251538Srpaulo		/* Check if it is a castrated 8192C. */
1185251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1186251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1187251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1188251538Srpaulo			sc->chip |= URTWN_CHIP_92C_1T2R;
1189251538Srpaulo	}
1190251538Srpaulo	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1191251538Srpaulo		sc->chip |= URTWN_CHIP_UMC;
1192251538Srpaulo		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1193251538Srpaulo			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1194251538Srpaulo	}
1195251538Srpaulo	return (0);
1196251538Srpaulo}
1197251538Srpaulo
1198251538Srpaulostatic void
1199251538Srpaulourtwn_read_rom(struct urtwn_softc *sc)
1200251538Srpaulo{
1201251538Srpaulo	struct r92c_rom *rom = &sc->rom;
1202251538Srpaulo
1203251538Srpaulo	/* Read full ROM image. */
1204251538Srpaulo	urtwn_efuse_read(sc);
1205251538Srpaulo
1206251538Srpaulo	/* XXX Weird but this is what the vendor driver does. */
1207251538Srpaulo	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1208251538Srpaulo	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1209251538Srpaulo
1210251538Srpaulo	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1211251538Srpaulo
1212251538Srpaulo	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1213251538Srpaulo	DPRINTF("regulatory type=%d\n", sc->regulatory);
1214251538Srpaulo
1215251538Srpaulo	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1216251538Srpaulo}
1217251538Srpaulo
1218251538Srpaulo/*
1219251538Srpaulo * Initialize rate adaptation in firmware.
1220251538Srpaulo */
1221251538Srpaulostatic int
1222251538Srpaulourtwn_ra_init(struct urtwn_softc *sc)
1223251538Srpaulo{
1224251538Srpaulo	static const uint8_t map[] =
1225251538Srpaulo	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1226251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1227251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1228251538Srpaulo	struct ieee80211_node *ni;
1229251538Srpaulo	struct ieee80211_rateset *rs;
1230251538Srpaulo	struct r92c_fw_cmd_macid_cfg cmd;
1231251538Srpaulo	uint32_t rates, basicrates;
1232251538Srpaulo	uint8_t mode;
1233251538Srpaulo	int maxrate, maxbasicrate, error, i, j;
1234251538Srpaulo
1235251538Srpaulo	ni = ieee80211_ref_node(vap->iv_bss);
1236251538Srpaulo	rs = &ni->ni_rates;
1237251538Srpaulo
1238251538Srpaulo	/* Get normal and basic rates mask. */
1239251538Srpaulo	rates = basicrates = 0;
1240251538Srpaulo	maxrate = maxbasicrate = 0;
1241251538Srpaulo	for (i = 0; i < rs->rs_nrates; i++) {
1242251538Srpaulo		/* Convert 802.11 rate to HW rate index. */
1243251538Srpaulo		for (j = 0; j < nitems(map); j++)
1244251538Srpaulo			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1245251538Srpaulo				break;
1246251538Srpaulo		if (j == nitems(map))	/* Unknown rate, skip. */
1247251538Srpaulo			continue;
1248251538Srpaulo		rates |= 1 << j;
1249251538Srpaulo		if (j > maxrate)
1250251538Srpaulo			maxrate = j;
1251251538Srpaulo		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1252251538Srpaulo			basicrates |= 1 << j;
1253251538Srpaulo			if (j > maxbasicrate)
1254251538Srpaulo				maxbasicrate = j;
1255251538Srpaulo		}
1256251538Srpaulo	}
1257251538Srpaulo	if (ic->ic_curmode == IEEE80211_MODE_11B)
1258251538Srpaulo		mode = R92C_RAID_11B;
1259251538Srpaulo	else
1260251538Srpaulo		mode = R92C_RAID_11BG;
1261251538Srpaulo	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1262251538Srpaulo	    mode, rates, basicrates);
1263251538Srpaulo
1264251538Srpaulo	/* Set rates mask for group addressed frames. */
1265251538Srpaulo	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1266251538Srpaulo	cmd.mask = htole32(mode << 28 | basicrates);
1267251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1268251538Srpaulo	if (error != 0) {
1269252401Srpaulo		ieee80211_free_node(ni);
1270251538Srpaulo		device_printf(sc->sc_dev,
1271251538Srpaulo		    "could not add broadcast station\n");
1272251538Srpaulo		return (error);
1273251538Srpaulo	}
1274251538Srpaulo	/* Set initial MRR rate. */
1275251538Srpaulo	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1276251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1277251538Srpaulo	    maxbasicrate);
1278251538Srpaulo
1279251538Srpaulo	/* Set rates mask for unicast frames. */
1280251538Srpaulo	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1281251538Srpaulo	cmd.mask = htole32(mode << 28 | rates);
1282251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1283251538Srpaulo	if (error != 0) {
1284252401Srpaulo		ieee80211_free_node(ni);
1285251538Srpaulo		device_printf(sc->sc_dev, "could not add BSS station\n");
1286251538Srpaulo		return (error);
1287251538Srpaulo	}
1288251538Srpaulo	/* Set initial MRR rate. */
1289251538Srpaulo	DPRINTF("maxrate=%d\n", maxrate);
1290251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1291251538Srpaulo	    maxrate);
1292251538Srpaulo
1293251538Srpaulo	/* Indicate highest supported rate. */
1294252403Srpaulo	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1295252401Srpaulo	ieee80211_free_node(ni);
1296252401Srpaulo
1297251538Srpaulo	return (0);
1298251538Srpaulo}
1299251538Srpaulo
1300251538Srpaulovoid
1301251538Srpaulourtwn_tsf_sync_enable(struct urtwn_softc *sc)
1302251538Srpaulo{
1303251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1304251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1305251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1306251538Srpaulo	struct ieee80211_node *ni = vap->iv_bss;
1307251538Srpaulo
1308251538Srpaulo	uint64_t tsf;
1309251538Srpaulo
1310251538Srpaulo	/* Enable TSF synchronization. */
1311251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1312251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1313251538Srpaulo
1314251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1315251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1316251538Srpaulo
1317251538Srpaulo	/* Set initial TSF. */
1318251538Srpaulo	memcpy(&tsf, ni->ni_tstamp.data, 8);
1319251538Srpaulo	tsf = le64toh(tsf);
1320251538Srpaulo	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1321251538Srpaulo	tsf -= IEEE80211_DUR_TU;
1322251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1323251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1324251538Srpaulo
1325251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1326251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1327251538Srpaulo}
1328251538Srpaulo
1329251538Srpaulostatic void
1330251538Srpaulourtwn_set_led(struct urtwn_softc *sc, int led, int on)
1331251538Srpaulo{
1332251538Srpaulo	uint8_t reg;
1333251538Srpaulo
1334251538Srpaulo	if (led == URTWN_LED_LINK) {
1335251538Srpaulo		reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1336251538Srpaulo		if (!on)
1337251538Srpaulo			reg |= R92C_LEDCFG0_DIS;
1338251538Srpaulo		urtwn_write_1(sc, R92C_LEDCFG0, reg);
1339251538Srpaulo		sc->ledlink = on;	/* Save LED state. */
1340251538Srpaulo	}
1341251538Srpaulo}
1342251538Srpaulo
1343251538Srpaulostatic int
1344251538Srpaulourtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1345251538Srpaulo{
1346251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
1347251538Srpaulo	struct ieee80211com *ic = vap->iv_ic;
1348251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1349251538Srpaulo	struct ieee80211_node *ni;
1350251538Srpaulo	enum ieee80211_state ostate;
1351251538Srpaulo	uint32_t reg;
1352251538Srpaulo
1353251538Srpaulo	ostate = vap->iv_state;
1354251538Srpaulo	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1355251538Srpaulo	    ieee80211_state_name[nstate]);
1356251538Srpaulo
1357251538Srpaulo	IEEE80211_UNLOCK(ic);
1358251538Srpaulo	URTWN_LOCK(sc);
1359251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
1360251538Srpaulo
1361251538Srpaulo	if (ostate == IEEE80211_S_RUN) {
1362251538Srpaulo		/* Turn link LED off. */
1363251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1364251538Srpaulo
1365251538Srpaulo		/* Set media status to 'No Link'. */
1366251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1367251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1368251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1369251538Srpaulo
1370251538Srpaulo		/* Stop Rx of data frames. */
1371251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1372251538Srpaulo
1373251538Srpaulo		/* Rest TSF. */
1374251538Srpaulo		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1375251538Srpaulo
1376251538Srpaulo		/* Disable TSF synchronization. */
1377251538Srpaulo		urtwn_write_1(sc, R92C_BCN_CTRL,
1378251538Srpaulo		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1379251538Srpaulo		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1380251538Srpaulo
1381251538Srpaulo		/* Reset EDCA parameters. */
1382251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1383251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1384251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1385251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1386251538Srpaulo	}
1387251538Srpaulo
1388251538Srpaulo	switch (nstate) {
1389251538Srpaulo	case IEEE80211_S_INIT:
1390251538Srpaulo		/* Turn link LED off. */
1391251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1392251538Srpaulo		break;
1393251538Srpaulo	case IEEE80211_S_SCAN:
1394251538Srpaulo		if (ostate != IEEE80211_S_SCAN) {
1395251538Srpaulo			/* Allow Rx from any BSSID. */
1396251538Srpaulo			urtwn_write_4(sc, R92C_RCR,
1397251538Srpaulo			    urtwn_read_4(sc, R92C_RCR) &
1398251538Srpaulo			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1399251538Srpaulo
1400251538Srpaulo			/* Set gain for scanning. */
1401251538Srpaulo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1402251538Srpaulo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1403251538Srpaulo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1404251538Srpaulo
1405251538Srpaulo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1406251538Srpaulo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1407251538Srpaulo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1408251538Srpaulo		}
1409251538Srpaulo
1410251538Srpaulo		/* Make link LED blink during scan. */
1411251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
1412251538Srpaulo
1413251538Srpaulo		/* Pause AC Tx queues. */
1414251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE,
1415251538Srpaulo		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1416251538Srpaulo
1417251538Srpaulo		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1418251538Srpaulo		break;
1419251538Srpaulo	case IEEE80211_S_AUTH:
1420251538Srpaulo		/* Set initial gain under link. */
1421251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1422251538Srpaulo		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1423251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1424251538Srpaulo
1425251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1426251538Srpaulo		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1427251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1428251538Srpaulo
1429251538Srpaulo		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1430251538Srpaulo		break;
1431251538Srpaulo	case IEEE80211_S_RUN:
1432251538Srpaulo		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1433251538Srpaulo			/* Enable Rx of data frames. */
1434251538Srpaulo			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1435251538Srpaulo
1436251538Srpaulo			/* Turn link LED on. */
1437251538Srpaulo			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1438251538Srpaulo			break;
1439251538Srpaulo		}
1440251538Srpaulo
1441251538Srpaulo		ni = ieee80211_ref_node(vap->iv_bss);
1442251538Srpaulo		/* Set media status to 'Associated'. */
1443251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1444251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1445251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1446251538Srpaulo
1447251538Srpaulo		/* Set BSSID. */
1448251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1449251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1450251538Srpaulo
1451251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1452251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1453251538Srpaulo		else	/* 802.11b/g */
1454251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1455251538Srpaulo
1456251538Srpaulo		/* Enable Rx of data frames. */
1457251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1458251538Srpaulo
1459251538Srpaulo		/* Flush all AC queues. */
1460251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1461251538Srpaulo
1462251538Srpaulo		/* Set beacon interval. */
1463251538Srpaulo		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1464251538Srpaulo
1465251538Srpaulo		/* Allow Rx from our BSSID only. */
1466251538Srpaulo		urtwn_write_4(sc, R92C_RCR,
1467251538Srpaulo		    urtwn_read_4(sc, R92C_RCR) |
1468251538Srpaulo		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1469251538Srpaulo
1470251538Srpaulo		/* Enable TSF synchronization. */
1471251538Srpaulo		urtwn_tsf_sync_enable(sc);
1472251538Srpaulo
1473251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1474251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1475251538Srpaulo		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1476251538Srpaulo		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1477251538Srpaulo		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1478251538Srpaulo		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1479251538Srpaulo
1480251538Srpaulo		/* Intialize rate adaptation. */
1481251538Srpaulo		urtwn_ra_init(sc);
1482251538Srpaulo		/* Turn link LED on. */
1483251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1484251538Srpaulo
1485251538Srpaulo		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1486251538Srpaulo		/* Reset temperature calibration state machine. */
1487251538Srpaulo		sc->thcal_state = 0;
1488251538Srpaulo		sc->thcal_lctemp = 0;
1489251538Srpaulo		ieee80211_free_node(ni);
1490251538Srpaulo		break;
1491251538Srpaulo	default:
1492251538Srpaulo		break;
1493251538Srpaulo	}
1494251538Srpaulo	URTWN_UNLOCK(sc);
1495251538Srpaulo	IEEE80211_LOCK(ic);
1496251538Srpaulo	return(uvp->newstate(vap, nstate, arg));
1497251538Srpaulo}
1498251538Srpaulo
1499251538Srpaulostatic void
1500251538Srpaulourtwn_watchdog(void *arg)
1501251538Srpaulo{
1502251538Srpaulo	struct urtwn_softc *sc = arg;
1503251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1504251538Srpaulo
1505251538Srpaulo	if (sc->sc_txtimer > 0) {
1506251538Srpaulo		if (--sc->sc_txtimer == 0) {
1507251538Srpaulo			device_printf(sc->sc_dev, "device timeout\n");
1508251538Srpaulo			ifp->if_oerrors++;
1509251538Srpaulo			return;
1510251538Srpaulo		}
1511251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1512251538Srpaulo	}
1513251538Srpaulo}
1514251538Srpaulo
1515251538Srpaulostatic void
1516251538Srpaulourtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1517251538Srpaulo{
1518251538Srpaulo	int pwdb;
1519251538Srpaulo
1520251538Srpaulo	/* Convert antenna signal to percentage. */
1521251538Srpaulo	if (rssi <= -100 || rssi >= 20)
1522251538Srpaulo		pwdb = 0;
1523251538Srpaulo	else if (rssi >= 0)
1524251538Srpaulo		pwdb = 100;
1525251538Srpaulo	else
1526251538Srpaulo		pwdb = 100 + rssi;
1527251538Srpaulo	if (rate <= 3) {
1528251538Srpaulo		/* CCK gain is smaller than OFDM/MCS gain. */
1529251538Srpaulo		pwdb += 6;
1530251538Srpaulo		if (pwdb > 100)
1531251538Srpaulo			pwdb = 100;
1532251538Srpaulo		if (pwdb <= 14)
1533251538Srpaulo			pwdb -= 4;
1534251538Srpaulo		else if (pwdb <= 26)
1535251538Srpaulo			pwdb -= 8;
1536251538Srpaulo		else if (pwdb <= 34)
1537251538Srpaulo			pwdb -= 6;
1538251538Srpaulo		else if (pwdb <= 42)
1539251538Srpaulo			pwdb -= 2;
1540251538Srpaulo	}
1541251538Srpaulo	if (sc->avg_pwdb == -1)	/* Init. */
1542251538Srpaulo		sc->avg_pwdb = pwdb;
1543251538Srpaulo	else if (sc->avg_pwdb < pwdb)
1544251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1545251538Srpaulo	else
1546251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1547251538Srpaulo	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1548251538Srpaulo}
1549251538Srpaulo
1550251538Srpaulostatic int8_t
1551251538Srpaulourtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1552251538Srpaulo{
1553251538Srpaulo	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1554251538Srpaulo	struct r92c_rx_phystat *phy;
1555251538Srpaulo	struct r92c_rx_cck *cck;
1556251538Srpaulo	uint8_t rpt;
1557251538Srpaulo	int8_t rssi;
1558251538Srpaulo
1559251538Srpaulo	if (rate <= 3) {
1560251538Srpaulo		cck = (struct r92c_rx_cck *)physt;
1561251538Srpaulo		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1562251538Srpaulo			rpt = (cck->agc_rpt >> 5) & 0x3;
1563251538Srpaulo			rssi = (cck->agc_rpt & 0x1f) << 1;
1564251538Srpaulo		} else {
1565251538Srpaulo			rpt = (cck->agc_rpt >> 6) & 0x3;
1566251538Srpaulo			rssi = cck->agc_rpt & 0x3e;
1567251538Srpaulo		}
1568251538Srpaulo		rssi = cckoff[rpt] - rssi;
1569251538Srpaulo	} else {	/* OFDM/HT. */
1570251538Srpaulo		phy = (struct r92c_rx_phystat *)physt;
1571251538Srpaulo		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1572251538Srpaulo	}
1573251538Srpaulo	return (rssi);
1574251538Srpaulo}
1575251538Srpaulo
1576251538Srpaulostatic int
1577251538Srpaulourtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1578251538Srpaulo    struct mbuf *m0, struct urtwn_data *data)
1579251538Srpaulo{
1580251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1581251538Srpaulo	struct ieee80211_frame *wh;
1582251538Srpaulo	struct ieee80211_key *k;
1583251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1584251538Srpaulo	struct ieee80211vap *vap = ni->ni_vap;
1585251538Srpaulo	struct usb_xfer *xfer;
1586251538Srpaulo	struct r92c_tx_desc *txd;
1587251538Srpaulo	uint8_t raid, type;
1588251538Srpaulo	uint16_t sum;
1589251538Srpaulo	int i, hasqos, xferlen;
1590251538Srpaulo	struct usb_xfer *urtwn_pipes[4] = {
1591251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BE],
1592251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BK],
1593251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VI],
1594251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VO]
1595251538Srpaulo	};
1596251538Srpaulo
1597251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
1598251538Srpaulo
1599251538Srpaulo	/*
1600251538Srpaulo	 * Software crypto.
1601251538Srpaulo	 */
1602251538Srpaulo	wh = mtod(m0, struct ieee80211_frame *);
1603251538Srpaulo	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1604251538Srpaulo		k = ieee80211_crypto_encap(ni, m0);
1605251538Srpaulo		if (k == NULL) {
1606251538Srpaulo			device_printf(sc->sc_dev,
1607251538Srpaulo			    "ieee80211_crypto_encap returns NULL.\n");
1608251538Srpaulo			/* XXX we don't expect the fragmented frames */
1609251538Srpaulo			m_freem(m0);
1610251538Srpaulo			return (ENOBUFS);
1611251538Srpaulo		}
1612251538Srpaulo
1613251538Srpaulo		/* in case packet header moved, reset pointer */
1614251538Srpaulo		wh = mtod(m0, struct ieee80211_frame *);
1615251538Srpaulo	}
1616251538Srpaulo
1617251538Srpaulo	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1618251538Srpaulo	case IEEE80211_FC0_TYPE_CTL:
1619251538Srpaulo	case IEEE80211_FC0_TYPE_MGT:
1620251538Srpaulo		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1621251538Srpaulo		break;
1622251538Srpaulo	default:
1623251538Srpaulo		KASSERT(M_WME_GETAC(m0) < 4,
1624251538Srpaulo		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1625251538Srpaulo		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1626251538Srpaulo		break;
1627251538Srpaulo	}
1628251538Srpaulo
1629251538Srpaulo	hasqos = 0;
1630251538Srpaulo
1631251538Srpaulo	/* Fill Tx descriptor. */
1632251538Srpaulo	txd = (struct r92c_tx_desc *)data->buf;
1633251538Srpaulo	memset(txd, 0, sizeof(*txd));
1634251538Srpaulo
1635251538Srpaulo	txd->txdw0 |= htole32(
1636251538Srpaulo	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1637251538Srpaulo	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1638251538Srpaulo	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1639251538Srpaulo	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1640251538Srpaulo		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1641251538Srpaulo
1642251538Srpaulo	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1643251538Srpaulo	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1644251538Srpaulo	    type == IEEE80211_FC0_TYPE_DATA) {
1645251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1646251538Srpaulo			raid = R92C_RAID_11B;
1647251538Srpaulo		else
1648251538Srpaulo			raid = R92C_RAID_11BG;
1649251538Srpaulo		txd->txdw1 |= htole32(
1650251538Srpaulo		    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1651251538Srpaulo		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1652251538Srpaulo		    SM(R92C_TXDW1_RAID, raid) |
1653251538Srpaulo		    R92C_TXDW1_AGGBK);
1654251538Srpaulo
1655251538Srpaulo		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1656251538Srpaulo			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1657251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1658251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1659251538Srpaulo			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1660251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1661251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1662251538Srpaulo			}
1663251538Srpaulo		}
1664251538Srpaulo		/* Send RTS at OFDM24. */
1665251538Srpaulo		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1666251538Srpaulo		txd->txdw5 |= htole32(0x0001ff00);
1667251538Srpaulo		/* Send data at OFDM54. */
1668251538Srpaulo		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1669251538Srpaulo	} else {
1670251538Srpaulo		txd->txdw1 |= htole32(
1671251538Srpaulo		    SM(R92C_TXDW1_MACID, 0) |
1672251538Srpaulo		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1673251538Srpaulo		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1674251538Srpaulo
1675251538Srpaulo		/* Force CCK1. */
1676251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1677251538Srpaulo		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1678251538Srpaulo	}
1679251538Srpaulo	/* Set sequence number (already little endian). */
1680251538Srpaulo	txd->txdseq |= *(uint16_t *)wh->i_seq;
1681251538Srpaulo
1682251538Srpaulo	if (!hasqos) {
1683251538Srpaulo		/* Use HW sequence numbering for non-QoS frames. */
1684251538Srpaulo		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1685251538Srpaulo		txd->txdseq |= htole16(0x8000);
1686251538Srpaulo	} else
1687251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1688251538Srpaulo
1689251538Srpaulo	/* Compute Tx descriptor checksum. */
1690251538Srpaulo	sum = 0;
1691251538Srpaulo	for (i = 0; i < sizeof(*txd) / 2; i++)
1692251538Srpaulo		sum ^= ((uint16_t *)txd)[i];
1693251538Srpaulo	txd->txdsum = sum; 	/* NB: already little endian. */
1694251538Srpaulo
1695251538Srpaulo	if (ieee80211_radiotap_active_vap(vap)) {
1696251538Srpaulo		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1697251538Srpaulo
1698251538Srpaulo		tap->wt_flags = 0;
1699251538Srpaulo		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1700251538Srpaulo		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1701251538Srpaulo		ieee80211_radiotap_tx(vap, m0);
1702251538Srpaulo	}
1703251538Srpaulo
1704251538Srpaulo	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1705251538Srpaulo	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1706251538Srpaulo
1707251538Srpaulo	data->buflen = xferlen;
1708251538Srpaulo	data->ni = ni;
1709251538Srpaulo	data->m = m0;
1710251538Srpaulo
1711251538Srpaulo	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1712251538Srpaulo	usbd_transfer_start(xfer);
1713251538Srpaulo	return (0);
1714251538Srpaulo}
1715251538Srpaulo
1716251538Srpaulostatic void
1717251538Srpaulourtwn_start(struct ifnet *ifp)
1718251538Srpaulo{
1719251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
1720251538Srpaulo	struct ieee80211_node *ni;
1721251538Srpaulo	struct mbuf *m;
1722251538Srpaulo	struct urtwn_data *bf;
1723251538Srpaulo
1724251538Srpaulo	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1725251538Srpaulo		return;
1726251538Srpaulo
1727251538Srpaulo	URTWN_LOCK(sc);
1728251538Srpaulo	for (;;) {
1729251538Srpaulo		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1730251538Srpaulo		if (m == NULL)
1731251538Srpaulo			break;
1732251538Srpaulo		bf = urtwn_getbuf(sc);
1733251538Srpaulo		if (bf == NULL) {
1734251538Srpaulo			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1735251538Srpaulo			break;
1736251538Srpaulo		}
1737251538Srpaulo		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1738251538Srpaulo		m->m_pkthdr.rcvif = NULL;
1739251538Srpaulo
1740251538Srpaulo		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1741251538Srpaulo			ifp->if_oerrors++;
1742251538Srpaulo			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1743251538Srpaulo			ieee80211_free_node(ni);
1744251538Srpaulo			break;
1745251538Srpaulo		}
1746251538Srpaulo
1747251538Srpaulo		sc->sc_txtimer = 5;
1748251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1749251538Srpaulo	}
1750251538Srpaulo	URTWN_UNLOCK(sc);
1751251538Srpaulo}
1752251538Srpaulo
1753251538Srpaulostatic int
1754251538Srpaulourtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1755251538Srpaulo{
1756251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1757251538Srpaulo	struct ifreq *ifr = (struct ifreq *) data;
1758251538Srpaulo	int error = 0, startall = 0;
1759251538Srpaulo
1760251538Srpaulo	switch (cmd) {
1761251538Srpaulo	case SIOCSIFFLAGS:
1762251538Srpaulo		if (ifp->if_flags & IFF_UP) {
1763251538Srpaulo			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1764251538Srpaulo				urtwn_init(ifp->if_softc);
1765251538Srpaulo				startall = 1;
1766251538Srpaulo			}
1767251538Srpaulo		} else {
1768251538Srpaulo			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1769251538Srpaulo				urtwn_stop(ifp, 1);
1770251538Srpaulo		}
1771251538Srpaulo		if (startall)
1772251538Srpaulo			ieee80211_start_all(ic);
1773251538Srpaulo		break;
1774251538Srpaulo	case SIOCGIFMEDIA:
1775251538Srpaulo		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1776251538Srpaulo		break;
1777251538Srpaulo	case SIOCGIFADDR:
1778251538Srpaulo		error = ether_ioctl(ifp, cmd, data);
1779251538Srpaulo		break;
1780251538Srpaulo	default:
1781251538Srpaulo		error = EINVAL;
1782251538Srpaulo		break;
1783251538Srpaulo	}
1784251538Srpaulo	return (error);
1785251538Srpaulo}
1786251538Srpaulo
1787251538Srpaulostatic int
1788251538Srpaulourtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1789251538Srpaulo    int ndata, int maxsz)
1790251538Srpaulo{
1791251538Srpaulo	int i, error;
1792251538Srpaulo
1793251538Srpaulo	for (i = 0; i < ndata; i++) {
1794251538Srpaulo		struct urtwn_data *dp = &data[i];
1795251538Srpaulo		dp->sc = sc;
1796251538Srpaulo		dp->m = NULL;
1797251538Srpaulo		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1798251538Srpaulo		if (dp->buf == NULL) {
1799251538Srpaulo			device_printf(sc->sc_dev,
1800251538Srpaulo			    "could not allocate buffer\n");
1801251538Srpaulo			error = ENOMEM;
1802251538Srpaulo			goto fail;
1803251538Srpaulo		}
1804251538Srpaulo		dp->ni = NULL;
1805251538Srpaulo	}
1806251538Srpaulo
1807251538Srpaulo	return (0);
1808251538Srpaulofail:
1809251538Srpaulo	urtwn_free_list(sc, data, ndata);
1810251538Srpaulo	return (error);
1811251538Srpaulo}
1812251538Srpaulo
1813251538Srpaulostatic int
1814251538Srpaulourtwn_alloc_rx_list(struct urtwn_softc *sc)
1815251538Srpaulo{
1816251538Srpaulo        int error, i;
1817251538Srpaulo
1818251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1819251538Srpaulo	    URTWN_RXBUFSZ);
1820251538Srpaulo	if (error != 0)
1821251538Srpaulo		return (error);
1822251538Srpaulo
1823251538Srpaulo	STAILQ_INIT(&sc->sc_rx_active);
1824251538Srpaulo	STAILQ_INIT(&sc->sc_rx_inactive);
1825251538Srpaulo
1826251538Srpaulo	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1827251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1828251538Srpaulo
1829251538Srpaulo	return (0);
1830251538Srpaulo}
1831251538Srpaulo
1832251538Srpaulostatic int
1833251538Srpaulourtwn_alloc_tx_list(struct urtwn_softc *sc)
1834251538Srpaulo{
1835251538Srpaulo	int error, i;
1836251538Srpaulo
1837251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1838251538Srpaulo	    URTWN_TXBUFSZ);
1839251538Srpaulo	if (error != 0)
1840251538Srpaulo		return (error);
1841251538Srpaulo
1842251538Srpaulo	STAILQ_INIT(&sc->sc_tx_active);
1843251538Srpaulo	STAILQ_INIT(&sc->sc_tx_inactive);
1844251538Srpaulo	STAILQ_INIT(&sc->sc_tx_pending);
1845251538Srpaulo
1846251538Srpaulo	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1847251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1848251538Srpaulo
1849251538Srpaulo	return (0);
1850251538Srpaulo}
1851251538Srpaulo
1852251538Srpaulostatic int
1853251538Srpaulourtwn_power_on(struct urtwn_softc *sc)
1854251538Srpaulo{
1855251538Srpaulo	uint32_t reg;
1856251538Srpaulo	int ntries;
1857251538Srpaulo
1858251538Srpaulo	/* Wait for autoload done bit. */
1859251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
1860251538Srpaulo		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1861251538Srpaulo			break;
1862251538Srpaulo		DELAY(5);
1863251538Srpaulo	}
1864251538Srpaulo	if (ntries == 1000) {
1865251538Srpaulo		device_printf(sc->sc_dev,
1866251538Srpaulo		    "timeout waiting for chip autoload\n");
1867251538Srpaulo		return (ETIMEDOUT);
1868251538Srpaulo	}
1869251538Srpaulo
1870251538Srpaulo	/* Unlock ISO/CLK/Power control register. */
1871251538Srpaulo	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
1872251538Srpaulo	/* Move SPS into PWM mode. */
1873251538Srpaulo	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1874251538Srpaulo	DELAY(100);
1875251538Srpaulo
1876251538Srpaulo	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
1877251538Srpaulo	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
1878251538Srpaulo		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
1879251538Srpaulo		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
1880251538Srpaulo		DELAY(100);
1881251538Srpaulo		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
1882251538Srpaulo		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
1883251538Srpaulo		    ~R92C_SYS_ISO_CTRL_MD2PP);
1884251538Srpaulo	}
1885251538Srpaulo
1886251538Srpaulo	/* Auto enable WLAN. */
1887251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
1888251538Srpaulo	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1889251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
1890251538Srpaulo		if (urtwn_read_2(sc, R92C_APS_FSMCO) &
1891251538Srpaulo		    R92C_APS_FSMCO_APFM_ONMAC)
1892251538Srpaulo			break;
1893251538Srpaulo		DELAY(5);
1894251538Srpaulo	}
1895251538Srpaulo	if (ntries == 1000) {
1896251538Srpaulo		device_printf(sc->sc_dev,
1897251538Srpaulo		    "timeout waiting for MAC auto ON\n");
1898251538Srpaulo		return (ETIMEDOUT);
1899251538Srpaulo	}
1900251538Srpaulo
1901251538Srpaulo	/* Enable radio, GPIO and LED functions. */
1902251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
1903251538Srpaulo	    R92C_APS_FSMCO_AFSM_HSUS |
1904251538Srpaulo	    R92C_APS_FSMCO_PDN_EN |
1905251538Srpaulo	    R92C_APS_FSMCO_PFM_ALDN);
1906251538Srpaulo	/* Release RF digital isolation. */
1907251538Srpaulo	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1908251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1909251538Srpaulo
1910251538Srpaulo	/* Initialize MAC. */
1911251538Srpaulo	urtwn_write_1(sc, R92C_APSD_CTRL,
1912251538Srpaulo	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
1913251538Srpaulo	for (ntries = 0; ntries < 200; ntries++) {
1914251538Srpaulo		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
1915251538Srpaulo		    R92C_APSD_CTRL_OFF_STATUS))
1916251538Srpaulo			break;
1917251538Srpaulo		DELAY(5);
1918251538Srpaulo	}
1919251538Srpaulo	if (ntries == 200) {
1920251538Srpaulo		device_printf(sc->sc_dev,
1921251538Srpaulo		    "timeout waiting for MAC initialization\n");
1922251538Srpaulo		return (ETIMEDOUT);
1923251538Srpaulo	}
1924251538Srpaulo
1925251538Srpaulo	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
1926251538Srpaulo	reg = urtwn_read_2(sc, R92C_CR);
1927251538Srpaulo	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
1928251538Srpaulo	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
1929251538Srpaulo	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
1930251538Srpaulo	    R92C_CR_ENSEC;
1931251538Srpaulo	urtwn_write_2(sc, R92C_CR, reg);
1932251538Srpaulo
1933251538Srpaulo	urtwn_write_1(sc, 0xfe10, 0x19);
1934251538Srpaulo	return (0);
1935251538Srpaulo}
1936251538Srpaulo
1937251538Srpaulostatic int
1938251538Srpaulourtwn_llt_init(struct urtwn_softc *sc)
1939251538Srpaulo{
1940251538Srpaulo	int i, error;
1941251538Srpaulo
1942251538Srpaulo	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
1943251538Srpaulo	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
1944251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1945251538Srpaulo			return (error);
1946251538Srpaulo	}
1947251538Srpaulo	/* NB: 0xff indicates end-of-list. */
1948251538Srpaulo	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
1949251538Srpaulo		return (error);
1950251538Srpaulo	/*
1951251538Srpaulo	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
1952251538Srpaulo	 * as ring buffer.
1953251538Srpaulo	 */
1954251538Srpaulo	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
1955251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1956251538Srpaulo			return (error);
1957251538Srpaulo	}
1958251538Srpaulo	/* Make the last page point to the beginning of the ring buffer. */
1959251538Srpaulo	error = urtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
1960251538Srpaulo	return (error);
1961251538Srpaulo}
1962251538Srpaulo
1963251538Srpaulostatic void
1964251538Srpaulourtwn_fw_reset(struct urtwn_softc *sc)
1965251538Srpaulo{
1966251538Srpaulo	uint16_t reg;
1967251538Srpaulo	int ntries;
1968251538Srpaulo
1969251538Srpaulo	/* Tell 8051 to reset itself. */
1970251538Srpaulo	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1971251538Srpaulo
1972251538Srpaulo	/* Wait until 8051 resets by itself. */
1973251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1974251538Srpaulo		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1975251538Srpaulo		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1976251538Srpaulo			return;
1977251538Srpaulo		DELAY(50);
1978251538Srpaulo	}
1979251538Srpaulo	/* Force 8051 reset. */
1980251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1981251538Srpaulo}
1982251538Srpaulo
1983251538Srpaulostatic int
1984251538Srpaulourtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
1985251538Srpaulo{
1986251538Srpaulo	uint32_t reg;
1987251538Srpaulo	int off, mlen, error = 0;
1988251538Srpaulo
1989251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
1990251538Srpaulo	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
1991251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
1992251538Srpaulo
1993251538Srpaulo	off = R92C_FW_START_ADDR;
1994251538Srpaulo	while (len > 0) {
1995251538Srpaulo		if (len > 196)
1996251538Srpaulo			mlen = 196;
1997251538Srpaulo		else if (len > 4)
1998251538Srpaulo			mlen = 4;
1999251538Srpaulo		else
2000251538Srpaulo			mlen = 1;
2001251538Srpaulo		/* XXX fix this deconst */
2002251538Srpaulo		error = urtwn_write_region_1(sc, off,
2003251538Srpaulo		    __DECONST(uint8_t *, buf), mlen);
2004251538Srpaulo		if (error != 0)
2005251538Srpaulo			break;
2006251538Srpaulo		off += mlen;
2007251538Srpaulo		buf += mlen;
2008251538Srpaulo		len -= mlen;
2009251538Srpaulo	}
2010251538Srpaulo	return (error);
2011251538Srpaulo}
2012251538Srpaulo
2013251538Srpaulostatic int
2014251538Srpaulourtwn_load_firmware(struct urtwn_softc *sc)
2015251538Srpaulo{
2016251538Srpaulo	const struct firmware *fw;
2017251538Srpaulo	const struct r92c_fw_hdr *hdr;
2018251538Srpaulo	const char *imagename;
2019251538Srpaulo	const u_char *ptr;
2020251538Srpaulo	size_t len;
2021251538Srpaulo	uint32_t reg;
2022251538Srpaulo	int mlen, ntries, page, error;
2023251538Srpaulo
2024251538Srpaulo	/* Read firmware image from the filesystem. */
2025251538Srpaulo	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2026251538Srpaulo	    URTWN_CHIP_UMC_A_CUT)
2027251538Srpaulo		imagename = "urtwn-rtl8192cfwU";
2028251538Srpaulo	else
2029251538Srpaulo		imagename = "urtwn-rtl8192cfwT";
2030251538Srpaulo
2031251538Srpaulo	fw = firmware_get(imagename);
2032251538Srpaulo	if (fw == NULL) {
2033251538Srpaulo		device_printf(sc->sc_dev,
2034251538Srpaulo		    "failed loadfirmware of file %s\n", imagename);
2035251538Srpaulo		return (ENOENT);
2036251538Srpaulo	}
2037251538Srpaulo
2038251538Srpaulo	len = fw->datasize;
2039251538Srpaulo
2040251538Srpaulo	if (len < sizeof(*hdr)) {
2041251538Srpaulo		device_printf(sc->sc_dev, "firmware too short\n");
2042251538Srpaulo		error = EINVAL;
2043251538Srpaulo		goto fail;
2044251538Srpaulo	}
2045251538Srpaulo	ptr = fw->data;
2046251538Srpaulo	hdr = (const struct r92c_fw_hdr *)ptr;
2047251538Srpaulo	/* Check if there is a valid FW header and skip it. */
2048251538Srpaulo	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2049251538Srpaulo	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2050251538Srpaulo		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2051251538Srpaulo		    le16toh(hdr->version), le16toh(hdr->subversion),
2052251538Srpaulo		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2053251538Srpaulo		ptr += sizeof(*hdr);
2054251538Srpaulo		len -= sizeof(*hdr);
2055251538Srpaulo	}
2056251538Srpaulo
2057251538Srpaulo	if (urtwn_read_1(sc, R92C_MCUFWDL) & 0x80) {
2058251538Srpaulo		urtwn_fw_reset(sc);
2059251538Srpaulo		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2060251538Srpaulo	}
2061251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2062251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2063251538Srpaulo	    R92C_SYS_FUNC_EN_CPUEN);
2064251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2065251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2066251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2067251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2068251538Srpaulo
2069251538Srpaulo	for (page = 0; len > 0; page++) {
2070251538Srpaulo		mlen = min(len, R92C_FW_PAGE_SIZE);
2071251538Srpaulo		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2072251538Srpaulo		if (error != 0) {
2073251538Srpaulo			device_printf(sc->sc_dev,
2074251538Srpaulo			    "could not load firmware page\n");
2075251538Srpaulo			goto fail;
2076251538Srpaulo		}
2077251538Srpaulo		ptr += mlen;
2078251538Srpaulo		len -= mlen;
2079251538Srpaulo	}
2080251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2081251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2082251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2083251538Srpaulo
2084251538Srpaulo	/* Wait for checksum report. */
2085251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2086251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2087251538Srpaulo			break;
2088251538Srpaulo		DELAY(5);
2089251538Srpaulo	}
2090251538Srpaulo	if (ntries == 1000) {
2091251538Srpaulo		device_printf(sc->sc_dev,
2092251538Srpaulo		    "timeout waiting for checksum report\n");
2093251538Srpaulo		error = ETIMEDOUT;
2094251538Srpaulo		goto fail;
2095251538Srpaulo	}
2096251538Srpaulo
2097251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2098251538Srpaulo	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2099251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2100251538Srpaulo	/* Wait for firmware readiness. */
2101251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2102251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2103251538Srpaulo			break;
2104251538Srpaulo		DELAY(5);
2105251538Srpaulo	}
2106251538Srpaulo	if (ntries == 1000) {
2107251538Srpaulo		device_printf(sc->sc_dev,
2108251538Srpaulo		    "timeout waiting for firmware readiness\n");
2109251538Srpaulo		error = ETIMEDOUT;
2110251538Srpaulo		goto fail;
2111251538Srpaulo	}
2112251538Srpaulofail:
2113251538Srpaulo	firmware_put(fw, FIRMWARE_UNLOAD);
2114251538Srpaulo	return (error);
2115251538Srpaulo}
2116251538Srpaulo
2117251538Srpaulostatic int
2118251538Srpaulourtwn_dma_init(struct urtwn_softc *sc)
2119251538Srpaulo{
2120251538Srpaulo	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2121251538Srpaulo	uint32_t reg;
2122251538Srpaulo	int error;
2123251538Srpaulo
2124251538Srpaulo	/* Initialize LLT table. */
2125251538Srpaulo	error = urtwn_llt_init(sc);
2126251538Srpaulo	if (error != 0)
2127251538Srpaulo		return (error);
2128251538Srpaulo
2129251538Srpaulo	/* Get Tx queues to USB endpoints mapping. */
2130251538Srpaulo	hashq = hasnq = haslq = 0;
2131251538Srpaulo	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2132251538Srpaulo	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2133251538Srpaulo	if (MS(reg, R92C_USB_EP_HQ) != 0)
2134251538Srpaulo		hashq = 1;
2135251538Srpaulo	if (MS(reg, R92C_USB_EP_NQ) != 0)
2136251538Srpaulo		hasnq = 1;
2137251538Srpaulo	if (MS(reg, R92C_USB_EP_LQ) != 0)
2138251538Srpaulo		haslq = 1;
2139251538Srpaulo	nqueues = hashq + hasnq + haslq;
2140251538Srpaulo	if (nqueues == 0)
2141251538Srpaulo		return (EIO);
2142251538Srpaulo	/* Get the number of pages for each queue. */
2143251538Srpaulo	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2144251538Srpaulo	/* The remaining pages are assigned to the high priority queue. */
2145251538Srpaulo	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2146251538Srpaulo
2147251538Srpaulo	/* Set number of pages for normal priority queue. */
2148251538Srpaulo	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2149251538Srpaulo	urtwn_write_4(sc, R92C_RQPN,
2150251538Srpaulo	    /* Set number of pages for public queue. */
2151251538Srpaulo	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2152251538Srpaulo	    /* Set number of pages for high priority queue. */
2153251538Srpaulo	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2154251538Srpaulo	    /* Set number of pages for low priority queue. */
2155251538Srpaulo	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2156251538Srpaulo	    /* Load values. */
2157251538Srpaulo	    R92C_RQPN_LD);
2158251538Srpaulo
2159251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2160251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2161251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2162251538Srpaulo	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2163251538Srpaulo	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2164251538Srpaulo
2165251538Srpaulo	/* Set queue to USB pipe mapping. */
2166251538Srpaulo	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2167251538Srpaulo	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2168251538Srpaulo	if (nqueues == 1) {
2169251538Srpaulo		if (hashq)
2170251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2171251538Srpaulo		else if (hasnq)
2172251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2173251538Srpaulo		else
2174251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2175251538Srpaulo	} else if (nqueues == 2) {
2176251538Srpaulo		/* All 2-endpoints configs have a high priority queue. */
2177251538Srpaulo		if (!hashq)
2178251538Srpaulo			return (EIO);
2179251538Srpaulo		if (hasnq)
2180251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2181251538Srpaulo		else
2182251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2183251538Srpaulo	} else
2184251538Srpaulo		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2185251538Srpaulo	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2186251538Srpaulo
2187251538Srpaulo	/* Set Tx/Rx transfer page boundary. */
2188251538Srpaulo	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2189251538Srpaulo
2190251538Srpaulo	/* Set Tx/Rx transfer page size. */
2191251538Srpaulo	urtwn_write_1(sc, R92C_PBP,
2192251538Srpaulo	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2193251538Srpaulo	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2194251538Srpaulo	return (0);
2195251538Srpaulo}
2196251538Srpaulo
2197251538Srpaulostatic void
2198251538Srpaulourtwn_mac_init(struct urtwn_softc *sc)
2199251538Srpaulo{
2200251538Srpaulo	int i;
2201251538Srpaulo
2202251538Srpaulo	/* Write MAC initialization values. */
2203251538Srpaulo	for (i = 0; i < nitems(rtl8192cu_mac); i++)
2204251538Srpaulo		urtwn_write_1(sc, rtl8192cu_mac[i].reg, rtl8192cu_mac[i].val);
2205251538Srpaulo}
2206251538Srpaulo
2207251538Srpaulostatic void
2208251538Srpaulourtwn_bb_init(struct urtwn_softc *sc)
2209251538Srpaulo{
2210251538Srpaulo	const struct urtwn_bb_prog *prog;
2211251538Srpaulo	uint32_t reg;
2212251538Srpaulo	int i;
2213251538Srpaulo
2214251538Srpaulo	/* Enable BB and RF. */
2215251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2216251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2217251538Srpaulo	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2218251538Srpaulo	    R92C_SYS_FUNC_EN_DIO_RF);
2219251538Srpaulo
2220251538Srpaulo	urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2221251538Srpaulo
2222251538Srpaulo	urtwn_write_1(sc, R92C_RF_CTRL,
2223251538Srpaulo	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2224251538Srpaulo	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2225251538Srpaulo	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2226251538Srpaulo	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2227251538Srpaulo
2228251538Srpaulo	urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2229251538Srpaulo	urtwn_write_1(sc, 0x15, 0xe9);
2230251538Srpaulo	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2231251538Srpaulo
2232251538Srpaulo	/* Select BB programming based on board type. */
2233251538Srpaulo	if (!(sc->chip & URTWN_CHIP_92C)) {
2234251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2235251538Srpaulo			prog = &rtl8188ce_bb_prog;
2236251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2237251538Srpaulo			prog = &rtl8188ru_bb_prog;
2238251538Srpaulo		else
2239251538Srpaulo			prog = &rtl8188cu_bb_prog;
2240251538Srpaulo	} else {
2241251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2242251538Srpaulo			prog = &rtl8192ce_bb_prog;
2243251538Srpaulo		else
2244251538Srpaulo			prog = &rtl8192cu_bb_prog;
2245251538Srpaulo	}
2246251538Srpaulo	/* Write BB initialization values. */
2247251538Srpaulo	for (i = 0; i < prog->count; i++) {
2248251538Srpaulo		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2249251538Srpaulo		DELAY(1);
2250251538Srpaulo	}
2251251538Srpaulo
2252251538Srpaulo	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2253251538Srpaulo		/* 8192C 1T only configuration. */
2254251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2255251538Srpaulo		reg = (reg & ~0x00000003) | 0x2;
2256251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2257251538Srpaulo
2258251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2259251538Srpaulo		reg = (reg & ~0x00300033) | 0x00200022;
2260251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2261251538Srpaulo
2262251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2263251538Srpaulo		reg = (reg & ~0xff000000) | 0x45 << 24;
2264251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2265251538Srpaulo
2266251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2267251538Srpaulo		reg = (reg & ~0x000000ff) | 0x23;
2268251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2269251538Srpaulo
2270251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2271251538Srpaulo		reg = (reg & ~0x00000030) | 1 << 4;
2272251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2273251538Srpaulo
2274251538Srpaulo		reg = urtwn_bb_read(sc, 0xe74);
2275251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2276251538Srpaulo		urtwn_bb_write(sc, 0xe74, reg);
2277251538Srpaulo		reg = urtwn_bb_read(sc, 0xe78);
2278251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2279251538Srpaulo		urtwn_bb_write(sc, 0xe78, reg);
2280251538Srpaulo		reg = urtwn_bb_read(sc, 0xe7c);
2281251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2282251538Srpaulo		urtwn_bb_write(sc, 0xe7c, reg);
2283251538Srpaulo		reg = urtwn_bb_read(sc, 0xe80);
2284251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2285251538Srpaulo		urtwn_bb_write(sc, 0xe80, reg);
2286251538Srpaulo		reg = urtwn_bb_read(sc, 0xe88);
2287251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2288251538Srpaulo		urtwn_bb_write(sc, 0xe88, reg);
2289251538Srpaulo	}
2290251538Srpaulo
2291251538Srpaulo	/* Write AGC values. */
2292251538Srpaulo	for (i = 0; i < prog->agccount; i++) {
2293251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2294251538Srpaulo		    prog->agcvals[i]);
2295251538Srpaulo		DELAY(1);
2296251538Srpaulo	}
2297251538Srpaulo
2298251538Srpaulo	if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2299251538Srpaulo	    R92C_HSSI_PARAM2_CCK_HIPWR)
2300251538Srpaulo		sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2301251538Srpaulo}
2302251538Srpaulo
2303251538Srpaulovoid
2304251538Srpaulourtwn_rf_init(struct urtwn_softc *sc)
2305251538Srpaulo{
2306251538Srpaulo	const struct urtwn_rf_prog *prog;
2307251538Srpaulo	uint32_t reg, type;
2308251538Srpaulo	int i, j, idx, off;
2309251538Srpaulo
2310251538Srpaulo	/* Select RF programming based on board type. */
2311251538Srpaulo	if (!(sc->chip & URTWN_CHIP_92C)) {
2312251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2313251538Srpaulo			prog = rtl8188ce_rf_prog;
2314251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2315251538Srpaulo			prog = rtl8188ru_rf_prog;
2316251538Srpaulo		else
2317251538Srpaulo			prog = rtl8188cu_rf_prog;
2318251538Srpaulo	} else
2319251538Srpaulo		prog = rtl8192ce_rf_prog;
2320251538Srpaulo
2321251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2322251538Srpaulo		/* Save RF_ENV control type. */
2323251538Srpaulo		idx = i / 2;
2324251538Srpaulo		off = (i % 2) * 16;
2325251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2326251538Srpaulo		type = (reg >> off) & 0x10;
2327251538Srpaulo
2328251538Srpaulo		/* Set RF_ENV enable. */
2329251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2330251538Srpaulo		reg |= 0x100000;
2331251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2332251538Srpaulo		DELAY(1);
2333251538Srpaulo		/* Set RF_ENV output high. */
2334251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2335251538Srpaulo		reg |= 0x10;
2336251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2337251538Srpaulo		DELAY(1);
2338251538Srpaulo		/* Set address and data lengths of RF registers. */
2339251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2340251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2341251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2342251538Srpaulo		DELAY(1);
2343251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2344251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2345251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2346251538Srpaulo		DELAY(1);
2347251538Srpaulo
2348251538Srpaulo		/* Write RF initialization values for this chain. */
2349251538Srpaulo		for (j = 0; j < prog[i].count; j++) {
2350251538Srpaulo			if (prog[i].regs[j] >= 0xf9 &&
2351251538Srpaulo			    prog[i].regs[j] <= 0xfe) {
2352251538Srpaulo				/*
2353251538Srpaulo				 * These are fake RF registers offsets that
2354251538Srpaulo				 * indicate a delay is required.
2355251538Srpaulo				 */
2356251538Srpaulo				usb_pause_mtx(&sc->sc_mtx, 50);
2357251538Srpaulo				continue;
2358251538Srpaulo			}
2359251538Srpaulo			urtwn_rf_write(sc, i, prog[i].regs[j],
2360251538Srpaulo			    prog[i].vals[j]);
2361251538Srpaulo			DELAY(1);
2362251538Srpaulo		}
2363251538Srpaulo
2364251538Srpaulo		/* Restore RF_ENV control type. */
2365251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2366251538Srpaulo		reg &= ~(0x10 << off) | (type << off);
2367251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2368251538Srpaulo
2369251538Srpaulo		/* Cache RF register CHNLBW. */
2370251538Srpaulo		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2371251538Srpaulo	}
2372251538Srpaulo
2373251538Srpaulo	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2374251538Srpaulo	    URTWN_CHIP_UMC_A_CUT) {
2375251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2376251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2377251538Srpaulo	}
2378251538Srpaulo}
2379251538Srpaulo
2380251538Srpaulostatic void
2381251538Srpaulourtwn_cam_init(struct urtwn_softc *sc)
2382251538Srpaulo{
2383251538Srpaulo	/* Invalidate all CAM entries. */
2384251538Srpaulo	urtwn_write_4(sc, R92C_CAMCMD,
2385251538Srpaulo	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2386251538Srpaulo}
2387251538Srpaulo
2388251538Srpaulostatic void
2389251538Srpaulourtwn_pa_bias_init(struct urtwn_softc *sc)
2390251538Srpaulo{
2391251538Srpaulo	uint8_t reg;
2392251538Srpaulo	int i;
2393251538Srpaulo
2394251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2395251538Srpaulo		if (sc->pa_setting & (1 << i))
2396251538Srpaulo			continue;
2397251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2398251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2399251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2400251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2401251538Srpaulo	}
2402251538Srpaulo	if (!(sc->pa_setting & 0x10)) {
2403251538Srpaulo		reg = urtwn_read_1(sc, 0x16);
2404251538Srpaulo		reg = (reg & ~0xf0) | 0x90;
2405251538Srpaulo		urtwn_write_1(sc, 0x16, reg);
2406251538Srpaulo	}
2407251538Srpaulo}
2408251538Srpaulo
2409251538Srpaulostatic void
2410251538Srpaulourtwn_rxfilter_init(struct urtwn_softc *sc)
2411251538Srpaulo{
2412251538Srpaulo	/* Initialize Rx filter. */
2413251538Srpaulo	/* TODO: use better filter for monitor mode. */
2414251538Srpaulo	urtwn_write_4(sc, R92C_RCR,
2415251538Srpaulo	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2416251538Srpaulo	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2417251538Srpaulo	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2418251538Srpaulo	/* Accept all multicast frames. */
2419251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2420251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2421251538Srpaulo	/* Accept all management frames. */
2422251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2423251538Srpaulo	/* Reject all control frames. */
2424251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2425251538Srpaulo	/* Accept all data frames. */
2426251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2427251538Srpaulo}
2428251538Srpaulo
2429251538Srpaulostatic void
2430251538Srpaulourtwn_edca_init(struct urtwn_softc *sc)
2431251538Srpaulo{
2432251538Srpaulo	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2433251538Srpaulo	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2434251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2435251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2436251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2437251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2438251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2439251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2440251538Srpaulo}
2441251538Srpaulo
2442251538Srpaulovoid
2443251538Srpaulourtwn_write_txpower(struct urtwn_softc *sc, int chain,
2444251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2445251538Srpaulo{
2446251538Srpaulo	uint32_t reg;
2447251538Srpaulo
2448251538Srpaulo	/* Write per-CCK rate Tx power. */
2449251538Srpaulo	if (chain == 0) {
2450251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2451251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2452251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2453251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2454251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2455251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2456251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2457251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2458251538Srpaulo	} else {
2459251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2460251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2461251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2462251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2463251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2464251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2465251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2466251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2467251538Srpaulo	}
2468251538Srpaulo	/* Write per-OFDM rate Tx power. */
2469251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2470251538Srpaulo	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2471251538Srpaulo	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2472251538Srpaulo	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2473251538Srpaulo	    SM(R92C_TXAGC_RATE18, power[ 7]));
2474251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2475251538Srpaulo	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2476251538Srpaulo	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2477251538Srpaulo	    SM(R92C_TXAGC_RATE48, power[10]) |
2478251538Srpaulo	    SM(R92C_TXAGC_RATE54, power[11]));
2479251538Srpaulo	/* Write per-MCS Tx power. */
2480251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2481251538Srpaulo	    SM(R92C_TXAGC_MCS00,  power[12]) |
2482251538Srpaulo	    SM(R92C_TXAGC_MCS01,  power[13]) |
2483251538Srpaulo	    SM(R92C_TXAGC_MCS02,  power[14]) |
2484251538Srpaulo	    SM(R92C_TXAGC_MCS03,  power[15]));
2485251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2486251538Srpaulo	    SM(R92C_TXAGC_MCS04,  power[16]) |
2487251538Srpaulo	    SM(R92C_TXAGC_MCS05,  power[17]) |
2488251538Srpaulo	    SM(R92C_TXAGC_MCS06,  power[18]) |
2489251538Srpaulo	    SM(R92C_TXAGC_MCS07,  power[19]));
2490251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2491251538Srpaulo	    SM(R92C_TXAGC_MCS08,  power[20]) |
2492251538Srpaulo	    SM(R92C_TXAGC_MCS08,  power[21]) |
2493251538Srpaulo	    SM(R92C_TXAGC_MCS10,  power[22]) |
2494251538Srpaulo	    SM(R92C_TXAGC_MCS11,  power[23]));
2495251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2496251538Srpaulo	    SM(R92C_TXAGC_MCS12,  power[24]) |
2497251538Srpaulo	    SM(R92C_TXAGC_MCS13,  power[25]) |
2498251538Srpaulo	    SM(R92C_TXAGC_MCS14,  power[26]) |
2499251538Srpaulo	    SM(R92C_TXAGC_MCS15,  power[27]));
2500251538Srpaulo}
2501251538Srpaulo
2502251538Srpaulovoid
2503251538Srpaulourtwn_get_txpower(struct urtwn_softc *sc, int chain,
2504251538Srpaulo    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2505251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2506251538Srpaulo{
2507251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2508251538Srpaulo	struct r92c_rom *rom = &sc->rom;
2509251538Srpaulo	uint16_t cckpow, ofdmpow, htpow, diff, max;
2510251538Srpaulo	const struct urtwn_txpwr *base;
2511251538Srpaulo	int ridx, chan, group;
2512251538Srpaulo
2513251538Srpaulo	/* Determine channel group. */
2514251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2515251538Srpaulo	if (chan <= 3)
2516251538Srpaulo		group = 0;
2517251538Srpaulo	else if (chan <= 9)
2518251538Srpaulo		group = 1;
2519251538Srpaulo	else
2520251538Srpaulo		group = 2;
2521251538Srpaulo
2522251538Srpaulo	/* Get original Tx power based on board type and RF chain. */
2523251538Srpaulo	if (!(sc->chip & URTWN_CHIP_92C)) {
2524251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2525251538Srpaulo			base = &rtl8188ru_txagc[chain];
2526251538Srpaulo		else
2527251538Srpaulo			base = &rtl8192cu_txagc[chain];
2528251538Srpaulo	} else
2529251538Srpaulo		base = &rtl8192cu_txagc[chain];
2530251538Srpaulo
2531251538Srpaulo	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2532251538Srpaulo	if (sc->regulatory == 0) {
2533251538Srpaulo		for (ridx = 0; ridx <= 3; ridx++)
2534251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2535251538Srpaulo	}
2536251538Srpaulo	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2537251538Srpaulo		if (sc->regulatory == 3) {
2538251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2539251538Srpaulo			/* Apply vendor limits. */
2540251538Srpaulo			if (extc != NULL)
2541251538Srpaulo				max = rom->ht40_max_pwr[group];
2542251538Srpaulo			else
2543251538Srpaulo				max = rom->ht20_max_pwr[group];
2544251538Srpaulo			max = (max >> (chain * 4)) & 0xf;
2545251538Srpaulo			if (power[ridx] > max)
2546251538Srpaulo				power[ridx] = max;
2547251538Srpaulo		} else if (sc->regulatory == 1) {
2548251538Srpaulo			if (extc == NULL)
2549251538Srpaulo				power[ridx] = base->pwr[group][ridx];
2550251538Srpaulo		} else if (sc->regulatory != 2)
2551251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2552251538Srpaulo	}
2553251538Srpaulo
2554251538Srpaulo	/* Compute per-CCK rate Tx power. */
2555251538Srpaulo	cckpow = rom->cck_tx_pwr[chain][group];
2556251538Srpaulo	for (ridx = 0; ridx <= 3; ridx++) {
2557251538Srpaulo		power[ridx] += cckpow;
2558251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
2559251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
2560251538Srpaulo	}
2561251538Srpaulo
2562251538Srpaulo	htpow = rom->ht40_1s_tx_pwr[chain][group];
2563251538Srpaulo	if (sc->ntxchains > 1) {
2564251538Srpaulo		/* Apply reduction for 2 spatial streams. */
2565251538Srpaulo		diff = rom->ht40_2s_tx_pwr_diff[group];
2566251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
2567251538Srpaulo		htpow = (htpow > diff) ? htpow - diff : 0;
2568251538Srpaulo	}
2569251538Srpaulo
2570251538Srpaulo	/* Compute per-OFDM rate Tx power. */
2571251538Srpaulo	diff = rom->ofdm_tx_pwr_diff[group];
2572251538Srpaulo	diff = (diff >> (chain * 4)) & 0xf;
2573251538Srpaulo	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2574251538Srpaulo	for (ridx = 4; ridx <= 11; ridx++) {
2575251538Srpaulo		power[ridx] += ofdmpow;
2576251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
2577251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
2578251538Srpaulo	}
2579251538Srpaulo
2580251538Srpaulo	/* Compute per-MCS Tx power. */
2581251538Srpaulo	if (extc == NULL) {
2582251538Srpaulo		diff = rom->ht20_tx_pwr_diff[group];
2583251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
2584251538Srpaulo		htpow += diff;	/* HT40->HT20 correction. */
2585251538Srpaulo	}
2586251538Srpaulo	for (ridx = 12; ridx <= 27; ridx++) {
2587251538Srpaulo		power[ridx] += htpow;
2588251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
2589251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
2590251538Srpaulo	}
2591251538Srpaulo#ifdef URTWN_DEBUG
2592251538Srpaulo	if (urtwn_debug >= 4) {
2593251538Srpaulo		/* Dump per-rate Tx power values. */
2594251538Srpaulo		printf("Tx power for chain %d:\n", chain);
2595251538Srpaulo		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
2596251538Srpaulo			printf("Rate %d = %u\n", ridx, power[ridx]);
2597251538Srpaulo	}
2598251538Srpaulo#endif
2599251538Srpaulo}
2600251538Srpaulo
2601251538Srpaulovoid
2602251538Srpaulourtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
2603251538Srpaulo    struct ieee80211_channel *extc)
2604251538Srpaulo{
2605251538Srpaulo	uint16_t power[URTWN_RIDX_COUNT];
2606251538Srpaulo	int i;
2607251538Srpaulo
2608251538Srpaulo	for (i = 0; i < sc->ntxchains; i++) {
2609251538Srpaulo		/* Compute per-rate Tx power values. */
2610251538Srpaulo		urtwn_get_txpower(sc, i, c, extc, power);
2611251538Srpaulo		/* Write per-rate Tx power values to hardware. */
2612251538Srpaulo		urtwn_write_txpower(sc, i, power);
2613251538Srpaulo	}
2614251538Srpaulo}
2615251538Srpaulo
2616251538Srpaulostatic void
2617251538Srpaulourtwn_scan_start(struct ieee80211com *ic)
2618251538Srpaulo{
2619251538Srpaulo	/* XXX do nothing?  */
2620251538Srpaulo}
2621251538Srpaulo
2622251538Srpaulostatic void
2623251538Srpaulourtwn_scan_end(struct ieee80211com *ic)
2624251538Srpaulo{
2625251538Srpaulo	/* XXX do nothing?  */
2626251538Srpaulo}
2627251538Srpaulo
2628251538Srpaulostatic void
2629251538Srpaulourtwn_set_channel(struct ieee80211com *ic)
2630251538Srpaulo{
2631251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
2632251538Srpaulo
2633251538Srpaulo	URTWN_LOCK(sc);
2634251538Srpaulo	urtwn_set_chan(sc, ic->ic_curchan, NULL);
2635251538Srpaulo	URTWN_UNLOCK(sc);
2636251538Srpaulo}
2637251538Srpaulo
2638251538Srpaulostatic void
2639251538Srpaulourtwn_update_mcast(struct ifnet *ifp)
2640251538Srpaulo{
2641251538Srpaulo	/* XXX do nothing?  */
2642251538Srpaulo}
2643251538Srpaulo
2644251538Srpaulostatic void
2645251538Srpaulourtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
2646251538Srpaulo    struct ieee80211_channel *extc)
2647251538Srpaulo{
2648251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2649251538Srpaulo	uint32_t reg;
2650251538Srpaulo	u_int chan;
2651251538Srpaulo	int i;
2652251538Srpaulo
2653251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2654251538Srpaulo	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2655251538Srpaulo		device_printf(sc->sc_dev,
2656251538Srpaulo		    "%s: invalid channel %x\n", __func__, chan);
2657251538Srpaulo		return;
2658251538Srpaulo	}
2659251538Srpaulo
2660251538Srpaulo	/* Set Tx power for this new channel. */
2661251538Srpaulo	urtwn_set_txpower(sc, c, extc);
2662251538Srpaulo
2663251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2664251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2665251538Srpaulo		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2666251538Srpaulo	}
2667251538Srpaulo#ifndef IEEE80211_NO_HT
2668251538Srpaulo	if (extc != NULL) {
2669251538Srpaulo		/* Is secondary channel below or above primary? */
2670251538Srpaulo		int prichlo = c->ic_freq < extc->ic_freq;
2671251538Srpaulo
2672251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
2673251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2674251538Srpaulo
2675251538Srpaulo		reg = urtwn_read_1(sc, R92C_RRSR + 2);
2676251538Srpaulo		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2677251538Srpaulo		urtwn_write_1(sc, R92C_RRSR + 2, reg);
2678251538Srpaulo
2679251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2680251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2681251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2682251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2683251538Srpaulo
2684251538Srpaulo		/* Set CCK side band. */
2685251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2686251538Srpaulo		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2687251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2688251538Srpaulo
2689251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
2690251538Srpaulo		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2691251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2692251538Srpaulo
2693251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2694251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2695251538Srpaulo		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2696251538Srpaulo
2697251538Srpaulo		reg = urtwn_bb_read(sc, 0x818);
2698251538Srpaulo		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2699251538Srpaulo		urtwn_bb_write(sc, 0x818, reg);
2700251538Srpaulo
2701251538Srpaulo		/* Select 40MHz bandwidth. */
2702251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2703251538Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2704251538Srpaulo	} else
2705251538Srpaulo#endif
2706251538Srpaulo	{
2707251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
2708251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2709251538Srpaulo
2710251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2711251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2712251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2713251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2714251538Srpaulo
2715251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2716251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2717251538Srpaulo		    R92C_FPGA0_ANAPARAM2_CBW20);
2718251538Srpaulo
2719251538Srpaulo		/* Select 20MHz bandwidth. */
2720251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2721251538Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2722251538Srpaulo	}
2723251538Srpaulo}
2724251538Srpaulo
2725251538Srpaulostatic void
2726251538Srpaulourtwn_iq_calib(struct urtwn_softc *sc)
2727251538Srpaulo{
2728251538Srpaulo	/* TODO */
2729251538Srpaulo}
2730251538Srpaulo
2731251538Srpaulostatic void
2732251538Srpaulourtwn_lc_calib(struct urtwn_softc *sc)
2733251538Srpaulo{
2734251538Srpaulo	uint32_t rf_ac[2];
2735251538Srpaulo	uint8_t txmode;
2736251538Srpaulo	int i;
2737251538Srpaulo
2738251538Srpaulo	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2739251538Srpaulo	if ((txmode & 0x70) != 0) {
2740251538Srpaulo		/* Disable all continuous Tx. */
2741251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2742251538Srpaulo
2743251538Srpaulo		/* Set RF mode to standby mode. */
2744251538Srpaulo		for (i = 0; i < sc->nrxchains; i++) {
2745251538Srpaulo			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
2746251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC,
2747251538Srpaulo			    RW(rf_ac[i], R92C_RF_AC_MODE,
2748251538Srpaulo				R92C_RF_AC_MODE_STANDBY));
2749251538Srpaulo		}
2750251538Srpaulo	} else {
2751251538Srpaulo		/* Block all Tx queues. */
2752251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
2753251538Srpaulo	}
2754251538Srpaulo	/* Start calibration. */
2755251538Srpaulo	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2756251538Srpaulo	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2757251538Srpaulo
2758251538Srpaulo	/* Give calibration the time to complete. */
2759251538Srpaulo	usb_pause_mtx(&sc->sc_mtx, 100);
2760251538Srpaulo
2761251538Srpaulo	/* Restore configuration. */
2762251538Srpaulo	if ((txmode & 0x70) != 0) {
2763251538Srpaulo		/* Restore Tx mode. */
2764251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2765251538Srpaulo		/* Restore RF mode. */
2766251538Srpaulo		for (i = 0; i < sc->nrxchains; i++)
2767251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2768251538Srpaulo	} else {
2769251538Srpaulo		/* Unblock all Tx queues. */
2770251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2771251538Srpaulo	}
2772251538Srpaulo}
2773251538Srpaulo
2774251538Srpaulostatic void
2775251538Srpaulourtwn_init_locked(void *arg)
2776251538Srpaulo{
2777251538Srpaulo	struct urtwn_softc *sc = arg;
2778251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
2779251538Srpaulo	uint32_t reg;
2780251538Srpaulo	int error;
2781251538Srpaulo
2782251538Srpaulo	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2783251538Srpaulo		urtwn_stop_locked(ifp, 0);
2784251538Srpaulo
2785251538Srpaulo	/* Init firmware commands ring. */
2786251538Srpaulo	sc->fwcur = 0;
2787251538Srpaulo
2788251538Srpaulo	/* Allocate Tx/Rx buffers. */
2789251538Srpaulo	error = urtwn_alloc_rx_list(sc);
2790251538Srpaulo	if (error != 0)
2791251538Srpaulo		goto fail;
2792251538Srpaulo
2793251538Srpaulo	error = urtwn_alloc_tx_list(sc);
2794251538Srpaulo	if (error != 0)
2795251538Srpaulo		goto fail;
2796251538Srpaulo
2797251538Srpaulo	/* Power on adapter. */
2798251538Srpaulo	error = urtwn_power_on(sc);
2799251538Srpaulo	if (error != 0)
2800251538Srpaulo		goto fail;
2801251538Srpaulo
2802251538Srpaulo	/* Initialize DMA. */
2803251538Srpaulo	error = urtwn_dma_init(sc);
2804251538Srpaulo	if (error != 0)
2805251538Srpaulo		goto fail;
2806251538Srpaulo
2807251538Srpaulo	/* Set info size in Rx descriptors (in 64-bit words). */
2808251538Srpaulo	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
2809251538Srpaulo
2810251538Srpaulo	/* Init interrupts. */
2811251538Srpaulo	urtwn_write_4(sc, R92C_HISR, 0xffffffff);
2812251538Srpaulo	urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
2813251538Srpaulo
2814251538Srpaulo	/* Set MAC address. */
2815251538Srpaulo	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
2816251538Srpaulo	    IEEE80211_ADDR_LEN);
2817251538Srpaulo
2818251538Srpaulo	/* Set initial network type. */
2819251538Srpaulo	reg = urtwn_read_4(sc, R92C_CR);
2820251538Srpaulo	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
2821251538Srpaulo	urtwn_write_4(sc, R92C_CR, reg);
2822251538Srpaulo
2823251538Srpaulo	urtwn_rxfilter_init(sc);
2824251538Srpaulo
2825251538Srpaulo	reg = urtwn_read_4(sc, R92C_RRSR);
2826251538Srpaulo	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
2827251538Srpaulo	urtwn_write_4(sc, R92C_RRSR, reg);
2828251538Srpaulo
2829251538Srpaulo	/* Set short/long retry limits. */
2830251538Srpaulo	urtwn_write_2(sc, R92C_RL,
2831251538Srpaulo	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
2832251538Srpaulo
2833251538Srpaulo	/* Initialize EDCA parameters. */
2834251538Srpaulo	urtwn_edca_init(sc);
2835251538Srpaulo
2836251538Srpaulo	/* Setup rate fallback. */
2837251538Srpaulo	urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
2838251538Srpaulo	urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
2839251538Srpaulo	urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
2840251538Srpaulo	urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
2841251538Srpaulo
2842251538Srpaulo	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
2843251538Srpaulo	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
2844251538Srpaulo	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
2845251538Srpaulo	/* Set ACK timeout. */
2846251538Srpaulo	urtwn_write_1(sc, R92C_ACKTO, 0x40);
2847251538Srpaulo
2848251538Srpaulo	/* Setup USB aggregation. */
2849251538Srpaulo	reg = urtwn_read_4(sc, R92C_TDECTRL);
2850251538Srpaulo	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
2851251538Srpaulo	urtwn_write_4(sc, R92C_TDECTRL, reg);
2852251538Srpaulo	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
2853251538Srpaulo	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
2854251538Srpaulo	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
2855251538Srpaulo	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2856251538Srpaulo	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2857251538Srpaulo	    R92C_USB_SPECIAL_OPTION_AGG_EN);
2858251538Srpaulo	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
2859251538Srpaulo	urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
2860251538Srpaulo	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
2861251538Srpaulo	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
2862251538Srpaulo
2863251538Srpaulo	/* Initialize beacon parameters. */
2864251538Srpaulo	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
2865251538Srpaulo	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
2866251538Srpaulo	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
2867251538Srpaulo	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
2868251538Srpaulo
2869251538Srpaulo	/* Setup AMPDU aggregation. */
2870251538Srpaulo	urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
2871251538Srpaulo	urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
2872251538Srpaulo	urtwn_write_2(sc, 0x4ca, 0x0708);
2873251538Srpaulo
2874251538Srpaulo	urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
2875251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
2876251538Srpaulo
2877251538Srpaulo	/* Load 8051 microcode. */
2878251538Srpaulo	error = urtwn_load_firmware(sc);
2879251538Srpaulo	if (error != 0)
2880251538Srpaulo		goto fail;
2881251538Srpaulo
2882251538Srpaulo	/* Initialize MAC/BB/RF blocks. */
2883251538Srpaulo	urtwn_mac_init(sc);
2884251538Srpaulo	urtwn_bb_init(sc);
2885251538Srpaulo	urtwn_rf_init(sc);
2886251538Srpaulo
2887251538Srpaulo	/* Turn CCK and OFDM blocks on. */
2888251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2889251538Srpaulo	reg |= R92C_RFMOD_CCK_EN;
2890251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2891251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2892251538Srpaulo	reg |= R92C_RFMOD_OFDM_EN;
2893251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2894251538Srpaulo
2895251538Srpaulo	/* Clear per-station keys table. */
2896251538Srpaulo	urtwn_cam_init(sc);
2897251538Srpaulo
2898251538Srpaulo	/* Enable hardware sequence numbering. */
2899251538Srpaulo	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
2900251538Srpaulo
2901251538Srpaulo	/* Perform LO and IQ calibrations. */
2902251538Srpaulo	urtwn_iq_calib(sc);
2903251538Srpaulo	/* Perform LC calibration. */
2904251538Srpaulo	urtwn_lc_calib(sc);
2905251538Srpaulo
2906251538Srpaulo	/* Fix USB interference issue. */
2907251538Srpaulo	urtwn_write_1(sc, 0xfe40, 0xe0);
2908251538Srpaulo	urtwn_write_1(sc, 0xfe41, 0x8d);
2909251538Srpaulo	urtwn_write_1(sc, 0xfe42, 0x80);
2910251538Srpaulo
2911251538Srpaulo	urtwn_pa_bias_init(sc);
2912251538Srpaulo
2913251538Srpaulo	/* Initialize GPIO setting. */
2914251538Srpaulo	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
2915251538Srpaulo	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
2916251538Srpaulo
2917251538Srpaulo	/* Fix for lower temperature. */
2918251538Srpaulo	urtwn_write_1(sc, 0x15, 0xe9);
2919251538Srpaulo
2920251538Srpaulo	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
2921251538Srpaulo
2922251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2923251538Srpaulo	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2924251538Srpaulo
2925251538Srpaulo	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2926251538Srpaulofail:
2927251538Srpaulo	return;
2928251538Srpaulo}
2929251538Srpaulo
2930251538Srpaulostatic void
2931251538Srpaulourtwn_init(void *arg)
2932251538Srpaulo{
2933251538Srpaulo	struct urtwn_softc *sc = arg;
2934251538Srpaulo
2935251538Srpaulo	URTWN_LOCK(sc);
2936251538Srpaulo	urtwn_init_locked(arg);
2937251538Srpaulo	URTWN_UNLOCK(sc);
2938251538Srpaulo}
2939251538Srpaulo
2940251538Srpaulostatic void
2941251538Srpaulourtwn_stop_locked(struct ifnet *ifp, int disable)
2942251538Srpaulo{
2943251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
2944251538Srpaulo
2945251538Srpaulo	(void)disable;
2946251538Srpaulo	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2947251538Srpaulo
2948251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
2949251538Srpaulo	urtwn_abort_xfers(sc);
2950251538Srpaulo}
2951251538Srpaulo
2952251538Srpaulostatic void
2953251538Srpaulourtwn_stop(struct ifnet *ifp, int disable)
2954251538Srpaulo{
2955251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
2956251538Srpaulo
2957251538Srpaulo	URTWN_LOCK(sc);
2958251538Srpaulo	urtwn_stop_locked(ifp, disable);
2959251538Srpaulo	URTWN_UNLOCK(sc);
2960251538Srpaulo}
2961251538Srpaulo
2962251538Srpaulostatic void
2963251538Srpaulourtwn_abort_xfers(struct urtwn_softc *sc)
2964251538Srpaulo{
2965251538Srpaulo	int i;
2966251538Srpaulo
2967251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
2968251538Srpaulo
2969251538Srpaulo	/* abort any pending transfers */
2970251538Srpaulo	for (i = 0; i < URTWN_N_TRANSFER; i++)
2971251538Srpaulo		usbd_transfer_stop(sc->sc_xfer[i]);
2972251538Srpaulo}
2973251538Srpaulo
2974251538Srpaulostatic int
2975251538Srpaulourtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2976251538Srpaulo    const struct ieee80211_bpf_params *params)
2977251538Srpaulo{
2978251538Srpaulo	struct ieee80211com *ic = ni->ni_ic;
2979251538Srpaulo	struct ifnet *ifp = ic->ic_ifp;
2980251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
2981251538Srpaulo	struct urtwn_data *bf;
2982251538Srpaulo
2983251538Srpaulo	/* prevent management frames from being sent if we're not ready */
2984251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2985251538Srpaulo		m_freem(m);
2986251538Srpaulo		ieee80211_free_node(ni);
2987251538Srpaulo		return (ENETDOWN);
2988251538Srpaulo	}
2989251538Srpaulo	URTWN_LOCK(sc);
2990251538Srpaulo	bf = urtwn_getbuf(sc);
2991251538Srpaulo	if (bf == NULL) {
2992251538Srpaulo		ieee80211_free_node(ni);
2993251538Srpaulo		m_freem(m);
2994251538Srpaulo		URTWN_UNLOCK(sc);
2995251538Srpaulo		return (ENOBUFS);
2996251538Srpaulo	}
2997251538Srpaulo
2998251538Srpaulo	ifp->if_opackets++;
2999251538Srpaulo	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3000251538Srpaulo		ieee80211_free_node(ni);
3001251538Srpaulo		ifp->if_oerrors++;
3002251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3003251538Srpaulo		URTWN_UNLOCK(sc);
3004251538Srpaulo		return (EIO);
3005251538Srpaulo	}
3006251538Srpaulo	URTWN_UNLOCK(sc);
3007251538Srpaulo
3008251538Srpaulo	sc->sc_txtimer = 5;
3009251538Srpaulo	return (0);
3010251538Srpaulo}
3011251538Srpaulo
3012251538Srpaulostatic device_method_t urtwn_methods[] = {
3013251538Srpaulo	/* Device interface */
3014251538Srpaulo	DEVMETHOD(device_probe,		urtwn_match),
3015251538Srpaulo	DEVMETHOD(device_attach,	urtwn_attach),
3016251538Srpaulo	DEVMETHOD(device_detach,	urtwn_detach),
3017251538Srpaulo
3018251538Srpaulo	{ 0, 0 }
3019251538Srpaulo};
3020251538Srpaulo
3021251538Srpaulostatic driver_t urtwn_driver = {
3022251538Srpaulo	"urtwn",
3023251538Srpaulo	urtwn_methods,
3024251538Srpaulo	sizeof(struct urtwn_softc)
3025251538Srpaulo};
3026251538Srpaulo
3027251538Srpaulostatic devclass_t urtwn_devclass;
3028251538Srpaulo
3029251538SrpauloDRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3030251538SrpauloMODULE_DEPEND(urtwn, usb, 1, 1, 1);
3031251538SrpauloMODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3032251538SrpauloMODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3033251538SrpauloMODULE_VERSION(urtwn, 1);
3034