if_urtwn.c revision 261863
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19#include <sys/cdefs.h>
20__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 261863 2014-02-14 01:47:12Z rpaulo $");
21
22/*
23 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188RU/RTL8192CU.
24 */
25
26#include <sys/param.h>
27#include <sys/sockio.h>
28#include <sys/sysctl.h>
29#include <sys/lock.h>
30#include <sys/mutex.h>
31#include <sys/mbuf.h>
32#include <sys/kernel.h>
33#include <sys/socket.h>
34#include <sys/systm.h>
35#include <sys/malloc.h>
36#include <sys/module.h>
37#include <sys/bus.h>
38#include <sys/endian.h>
39#include <sys/linker.h>
40#include <sys/firmware.h>
41#include <sys/kdb.h>
42
43#include <machine/bus.h>
44#include <machine/resource.h>
45#include <sys/rman.h>
46
47#include <net/bpf.h>
48#include <net/if.h>
49#include <net/if_var.h>
50#include <net/if_arp.h>
51#include <net/ethernet.h>
52#include <net/if_dl.h>
53#include <net/if_media.h>
54#include <net/if_types.h>
55
56#include <netinet/in.h>
57#include <netinet/in_systm.h>
58#include <netinet/in_var.h>
59#include <netinet/if_ether.h>
60#include <netinet/ip.h>
61
62#include <net80211/ieee80211_var.h>
63#include <net80211/ieee80211_regdomain.h>
64#include <net80211/ieee80211_radiotap.h>
65#include <net80211/ieee80211_ratectl.h>
66
67#include <dev/usb/usb.h>
68#include <dev/usb/usbdi.h>
69#include "usbdevs.h"
70
71#define USB_DEBUG_VAR urtwn_debug
72#include <dev/usb/usb_debug.h>
73
74#include <dev/usb/wlan/if_urtwnreg.h>
75
76#ifdef USB_DEBUG
77static int urtwn_debug = 0;
78
79SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
80SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
81    "Debug level");
82#endif
83
84#define	URTWN_RSSI(r)  (r) - 110
85#define	IEEE80211_HAS_ADDR4(wh)	\
86	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
87
88/* various supported device vendors/products */
89static const STRUCT_USB_HOST_ID urtwn_devs[] = {
90#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
91	URTWN_DEV(ABOCOM,	RTL8188CU_1),
92	URTWN_DEV(ABOCOM,	RTL8188CU_2),
93	URTWN_DEV(ABOCOM,	RTL8192CU),
94	URTWN_DEV(ASUS,		RTL8192CU),
95	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
96	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
97	URTWN_DEV(AZUREWAVE,	RTL8188CU),
98	URTWN_DEV(BELKIN,	F7D2102),
99	URTWN_DEV(BELKIN,	RTL8188CU),
100	URTWN_DEV(BELKIN,	RTL8192CU),
101	URTWN_DEV(CHICONY,	RTL8188CUS_1),
102	URTWN_DEV(CHICONY,	RTL8188CUS_2),
103	URTWN_DEV(CHICONY,	RTL8188CUS_3),
104	URTWN_DEV(CHICONY,	RTL8188CUS_4),
105	URTWN_DEV(CHICONY,	RTL8188CUS_5),
106	URTWN_DEV(COREGA,	RTL8192CU),
107	URTWN_DEV(DLINK,	RTL8188CU),
108	URTWN_DEV(DLINK,	RTL8192CU_1),
109	URTWN_DEV(DLINK,	RTL8192CU_2),
110	URTWN_DEV(DLINK,	RTL8192CU_3),
111	URTWN_DEV(DLINK,	DWA131B),
112	URTWN_DEV(EDIMAX,	EW7811UN),
113	URTWN_DEV(EDIMAX,	RTL8192CU),
114	URTWN_DEV(FEIXUN,	RTL8188CU),
115	URTWN_DEV(FEIXUN,	RTL8192CU),
116	URTWN_DEV(GUILLEMOT,	HWNUP150),
117	URTWN_DEV(HAWKING,	RTL8192CU),
118	URTWN_DEV(HP3,		RTL8188CU),
119	URTWN_DEV(NETGEAR,	WNA1000M),
120	URTWN_DEV(NETGEAR,	RTL8192CU),
121	URTWN_DEV(NETGEAR4,	RTL8188CU),
122	URTWN_DEV(NOVATECH,	RTL8188CU),
123	URTWN_DEV(PLANEX2,	RTL8188CU_1),
124	URTWN_DEV(PLANEX2,	RTL8188CU_2),
125	URTWN_DEV(PLANEX2,	RTL8188CU_3),
126	URTWN_DEV(PLANEX2,	RTL8188CU_4),
127	URTWN_DEV(PLANEX2,	RTL8188CUS),
128	URTWN_DEV(PLANEX2,	RTL8192CU),
129	URTWN_DEV(REALTEK,	RTL8188CE_0),
130	URTWN_DEV(REALTEK,	RTL8188CE_1),
131	URTWN_DEV(REALTEK,	RTL8188CTV),
132	URTWN_DEV(REALTEK,	RTL8188CU_0),
133	URTWN_DEV(REALTEK,	RTL8188CU_1),
134	URTWN_DEV(REALTEK,	RTL8188CU_2),
135	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
136	URTWN_DEV(REALTEK,	RTL8188CUS),
137	URTWN_DEV(REALTEK,	RTL8188RU_1),
138	URTWN_DEV(REALTEK,	RTL8188RU_2),
139	URTWN_DEV(REALTEK,	RTL8191CU),
140	URTWN_DEV(REALTEK,	RTL8192CE),
141	URTWN_DEV(REALTEK,	RTL8192CU),
142	URTWN_DEV(REALTEK, 	RTL8188CU_0),
143	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
144	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
145	URTWN_DEV(SITECOMEU,	RTL8192CU),
146	URTWN_DEV(TRENDNET,	RTL8188CU),
147	URTWN_DEV(TRENDNET,	RTL8192CU),
148	URTWN_DEV(ZYXEL,	RTL8192CU),
149#undef URTWN_DEV
150};
151
152static device_probe_t	urtwn_match;
153static device_attach_t	urtwn_attach;
154static device_detach_t	urtwn_detach;
155
156static usb_callback_t   urtwn_bulk_tx_callback;
157static usb_callback_t	urtwn_bulk_rx_callback;
158
159static usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
160			    struct usb_device_request *req, void *data);
161static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
162		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
163                    const uint8_t [IEEE80211_ADDR_LEN],
164                    const uint8_t [IEEE80211_ADDR_LEN]);
165static void		urtwn_vap_delete(struct ieee80211vap *);
166static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
167			    int *);
168static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
169			    int *, int8_t *);
170static void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
171static int		urtwn_alloc_list(struct urtwn_softc *,
172			    struct urtwn_data[], int, int);
173static int		urtwn_alloc_rx_list(struct urtwn_softc *);
174static int		urtwn_alloc_tx_list(struct urtwn_softc *);
175static void		urtwn_free_tx_list(struct urtwn_softc *);
176static void		urtwn_free_rx_list(struct urtwn_softc *);
177static void		urtwn_free_list(struct urtwn_softc *,
178			    struct urtwn_data data[], int);
179static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
180static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
181static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
182			    uint8_t *, int);
183static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
184static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
185static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
186static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
187			    uint8_t *, int);
188static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
189static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
190static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
191static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
192			    const void *, int);
193static void		urtwn_rf_write(struct urtwn_softc *, int, uint8_t,
194			    uint32_t);
195static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
196static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
197			    uint32_t);
198static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
199static void		urtwn_efuse_read(struct urtwn_softc *);
200static int		urtwn_read_chipid(struct urtwn_softc *);
201static void		urtwn_read_rom(struct urtwn_softc *);
202static int		urtwn_ra_init(struct urtwn_softc *);
203static void		urtwn_tsf_sync_enable(struct urtwn_softc *);
204static void		urtwn_set_led(struct urtwn_softc *, int, int);
205static int		urtwn_newstate(struct ieee80211vap *,
206			    enum ieee80211_state, int);
207static void		urtwn_watchdog(void *);
208static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
209static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
210static int		urtwn_tx_start(struct urtwn_softc *,
211			    struct ieee80211_node *, struct mbuf *,
212			    struct urtwn_data *);
213static void		urtwn_start(struct ifnet *);
214static void		urtwn_start_locked(struct ifnet *,
215			    struct urtwn_softc *);
216static int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
217static int		urtwn_power_on(struct urtwn_softc *);
218static int		urtwn_llt_init(struct urtwn_softc *);
219static void		urtwn_fw_reset(struct urtwn_softc *);
220static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
221			    const uint8_t *, int);
222static int		urtwn_load_firmware(struct urtwn_softc *);
223static int		urtwn_dma_init(struct urtwn_softc *);
224static void		urtwn_mac_init(struct urtwn_softc *);
225static void		urtwn_bb_init(struct urtwn_softc *);
226static void		urtwn_rf_init(struct urtwn_softc *);
227static void		urtwn_cam_init(struct urtwn_softc *);
228static void		urtwn_pa_bias_init(struct urtwn_softc *);
229static void		urtwn_rxfilter_init(struct urtwn_softc *);
230static void		urtwn_edca_init(struct urtwn_softc *);
231static void		urtwn_write_txpower(struct urtwn_softc *, int,
232			    uint16_t[]);
233static void		urtwn_get_txpower(struct urtwn_softc *, int,
234		      	    struct ieee80211_channel *,
235			    struct ieee80211_channel *, uint16_t[]);
236static void		urtwn_set_txpower(struct urtwn_softc *,
237		    	    struct ieee80211_channel *,
238			    struct ieee80211_channel *);
239static void		urtwn_scan_start(struct ieee80211com *);
240static void		urtwn_scan_end(struct ieee80211com *);
241static void		urtwn_set_channel(struct ieee80211com *);
242static void		urtwn_set_chan(struct urtwn_softc *,
243		    	    struct ieee80211_channel *,
244			    struct ieee80211_channel *);
245static void		urtwn_update_mcast(struct ifnet *);
246static void		urtwn_iq_calib(struct urtwn_softc *);
247static void		urtwn_lc_calib(struct urtwn_softc *);
248static void		urtwn_init(void *);
249static void		urtwn_init_locked(void *);
250static void		urtwn_stop(struct ifnet *, int);
251static void		urtwn_stop_locked(struct ifnet *, int);
252static void		urtwn_abort_xfers(struct urtwn_softc *);
253static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
254			    const struct ieee80211_bpf_params *);
255
256/* Aliases. */
257#define	urtwn_bb_write	urtwn_write_4
258#define urtwn_bb_read	urtwn_read_4
259
260static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
261	[URTWN_BULK_RX] = {
262		.type = UE_BULK,
263		.endpoint = UE_ADDR_ANY,
264		.direction = UE_DIR_IN,
265		.bufsize = URTWN_RXBUFSZ,
266		.flags = {
267			.pipe_bof = 1,
268			.short_xfer_ok = 1
269		},
270		.callback = urtwn_bulk_rx_callback,
271	},
272	[URTWN_BULK_TX_BE] = {
273		.type = UE_BULK,
274		.endpoint = 0x03,
275		.direction = UE_DIR_OUT,
276		.bufsize = URTWN_TXBUFSZ,
277		.flags = {
278			.ext_buffer = 1,
279			.pipe_bof = 1,
280			.force_short_xfer = 1
281		},
282		.callback = urtwn_bulk_tx_callback,
283		.timeout = URTWN_TX_TIMEOUT,	/* ms */
284	},
285	[URTWN_BULK_TX_BK] = {
286		.type = UE_BULK,
287		.endpoint = 0x03,
288		.direction = UE_DIR_OUT,
289		.bufsize = URTWN_TXBUFSZ,
290		.flags = {
291			.ext_buffer = 1,
292			.pipe_bof = 1,
293			.force_short_xfer = 1,
294		},
295		.callback = urtwn_bulk_tx_callback,
296		.timeout = URTWN_TX_TIMEOUT,	/* ms */
297	},
298	[URTWN_BULK_TX_VI] = {
299		.type = UE_BULK,
300		.endpoint = 0x02,
301		.direction = UE_DIR_OUT,
302		.bufsize = URTWN_TXBUFSZ,
303		.flags = {
304			.ext_buffer = 1,
305			.pipe_bof = 1,
306			.force_short_xfer = 1
307		},
308		.callback = urtwn_bulk_tx_callback,
309		.timeout = URTWN_TX_TIMEOUT,	/* ms */
310	},
311	[URTWN_BULK_TX_VO] = {
312		.type = UE_BULK,
313		.endpoint = 0x02,
314		.direction = UE_DIR_OUT,
315		.bufsize = URTWN_TXBUFSZ,
316		.flags = {
317			.ext_buffer = 1,
318			.pipe_bof = 1,
319			.force_short_xfer = 1
320		},
321		.callback = urtwn_bulk_tx_callback,
322		.timeout = URTWN_TX_TIMEOUT,	/* ms */
323	},
324};
325
326static int
327urtwn_match(device_t self)
328{
329	struct usb_attach_arg *uaa = device_get_ivars(self);
330
331	if (uaa->usb_mode != USB_MODE_HOST)
332		return (ENXIO);
333	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
334		return (ENXIO);
335	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
336		return (ENXIO);
337
338	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
339}
340
341static int
342urtwn_attach(device_t self)
343{
344	struct usb_attach_arg *uaa = device_get_ivars(self);
345	struct urtwn_softc *sc = device_get_softc(self);
346	struct ifnet *ifp;
347	struct ieee80211com *ic;
348	uint8_t iface_index, bands;
349	int error;
350
351	device_set_usb_desc(self);
352	sc->sc_udev = uaa->device;
353	sc->sc_dev = self;
354
355	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
356	    MTX_NETWORK_LOCK, MTX_DEF);
357	callout_init(&sc->sc_watchdog_ch, 0);
358
359	iface_index = URTWN_IFACE_INDEX;
360	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
361	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
362	if (error) {
363		device_printf(self, "could not allocate USB transfers, "
364		    "err=%s\n", usbd_errstr(error));
365		goto detach;
366	}
367
368	URTWN_LOCK(sc);
369
370	error = urtwn_read_chipid(sc);
371	if (error) {
372		device_printf(sc->sc_dev, "unsupported test chip\n");
373		URTWN_UNLOCK(sc);
374		goto detach;
375	}
376
377	/* Determine number of Tx/Rx chains. */
378	if (sc->chip & URTWN_CHIP_92C) {
379		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
380		sc->nrxchains = 2;
381	} else {
382		sc->ntxchains = 1;
383		sc->nrxchains = 1;
384	}
385	urtwn_read_rom(sc);
386
387	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
388	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
389	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
390	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
391	    "8188CUS", sc->ntxchains, sc->nrxchains);
392
393	URTWN_UNLOCK(sc);
394
395	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
396	if (ifp == NULL) {
397		device_printf(sc->sc_dev, "can not if_alloc()\n");
398		goto detach;
399	}
400	ic = ifp->if_l2com;
401
402	ifp->if_softc = sc;
403	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
404	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
405	ifp->if_init = urtwn_init;
406	ifp->if_ioctl = urtwn_ioctl;
407	ifp->if_start = urtwn_start;
408	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
409	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
410	IFQ_SET_READY(&ifp->if_snd);
411
412	ic->ic_ifp = ifp;
413	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
414	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
415
416	/* set device capabilities */
417	ic->ic_caps =
418		  IEEE80211_C_STA		/* station mode */
419		| IEEE80211_C_MONITOR		/* monitor mode */
420		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
421		| IEEE80211_C_SHSLOT		/* short slot time supported */
422		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
423		| IEEE80211_C_WPA		/* 802.11i */
424		;
425
426	bands = 0;
427	setbit(&bands, IEEE80211_MODE_11B);
428	setbit(&bands, IEEE80211_MODE_11G);
429	ieee80211_init_channels(ic, NULL, &bands);
430
431	ieee80211_ifattach(ic, sc->sc_bssid);
432	ic->ic_raw_xmit = urtwn_raw_xmit;
433	ic->ic_scan_start = urtwn_scan_start;
434	ic->ic_scan_end = urtwn_scan_end;
435	ic->ic_set_channel = urtwn_set_channel;
436
437	ic->ic_vap_create = urtwn_vap_create;
438	ic->ic_vap_delete = urtwn_vap_delete;
439	ic->ic_update_mcast = urtwn_update_mcast;
440
441	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
442	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
443	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
444	    URTWN_RX_RADIOTAP_PRESENT);
445
446	if (bootverbose)
447		ieee80211_announce(ic);
448
449	return (0);
450
451detach:
452	urtwn_detach(self);
453	return (ENXIO);			/* failure */
454}
455
456static int
457urtwn_detach(device_t self)
458{
459	struct urtwn_softc *sc = device_get_softc(self);
460	struct ifnet *ifp = sc->sc_ifp;
461	struct ieee80211com *ic = ifp->if_l2com;
462
463	if (!device_is_attached(self))
464		return (0);
465
466	urtwn_stop(ifp, 1);
467
468	callout_drain(&sc->sc_watchdog_ch);
469
470	/* stop all USB transfers */
471	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
472	ieee80211_ifdetach(ic);
473
474	urtwn_free_tx_list(sc);
475	urtwn_free_rx_list(sc);
476
477	if_free(ifp);
478	mtx_destroy(&sc->sc_mtx);
479
480	return (0);
481}
482
483static void
484urtwn_free_tx_list(struct urtwn_softc *sc)
485{
486	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
487}
488
489static void
490urtwn_free_rx_list(struct urtwn_softc *sc)
491{
492	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
493}
494
495static void
496urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
497{
498	int i;
499
500	for (i = 0; i < ndata; i++) {
501		struct urtwn_data *dp = &data[i];
502
503		if (dp->buf != NULL) {
504			free(dp->buf, M_USBDEV);
505			dp->buf = NULL;
506		}
507		if (dp->ni != NULL) {
508			ieee80211_free_node(dp->ni);
509			dp->ni = NULL;
510		}
511	}
512}
513
514static usb_error_t
515urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
516    void *data)
517{
518	usb_error_t err;
519	int ntries = 10;
520
521	URTWN_ASSERT_LOCKED(sc);
522
523	while (ntries--) {
524		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
525		    req, data, 0, NULL, 250 /* ms */);
526		if (err == 0)
527			break;
528
529		DPRINTFN(1, "Control request failed, %s (retrying)\n",
530		    usbd_errstr(err));
531		usb_pause_mtx(&sc->sc_mtx, hz / 100);
532	}
533	return (err);
534}
535
536static struct ieee80211vap *
537urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
538    enum ieee80211_opmode opmode, int flags,
539    const uint8_t bssid[IEEE80211_ADDR_LEN],
540    const uint8_t mac[IEEE80211_ADDR_LEN])
541{
542	struct urtwn_vap *uvp;
543	struct ieee80211vap *vap;
544
545	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
546		return (NULL);
547
548	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
549	    M_80211_VAP, M_NOWAIT | M_ZERO);
550	if (uvp == NULL)
551		return (NULL);
552	vap = &uvp->vap;
553	/* enable s/w bmiss handling for sta mode */
554
555	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
556	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
557		/* out of memory */
558		free(uvp, M_80211_VAP);
559		return (NULL);
560	}
561
562	/* override state transition machine */
563	uvp->newstate = vap->iv_newstate;
564	vap->iv_newstate = urtwn_newstate;
565
566	/* complete setup */
567	ieee80211_vap_attach(vap, ieee80211_media_change,
568	    ieee80211_media_status);
569	ic->ic_opmode = opmode;
570	return (vap);
571}
572
573static void
574urtwn_vap_delete(struct ieee80211vap *vap)
575{
576	struct urtwn_vap *uvp = URTWN_VAP(vap);
577
578	ieee80211_vap_detach(vap);
579	free(uvp, M_80211_VAP);
580}
581
582static struct mbuf *
583urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
584{
585	struct ifnet *ifp = sc->sc_ifp;
586	struct ieee80211com *ic = ifp->if_l2com;
587	struct ieee80211_frame *wh;
588	struct mbuf *m;
589	struct r92c_rx_stat *stat;
590	uint32_t rxdw0, rxdw3;
591	uint8_t rate;
592	int8_t rssi = 0;
593	int infosz;
594
595	/*
596	 * don't pass packets to the ieee80211 framework if the driver isn't
597	 * RUNNING.
598	 */
599	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
600		return (NULL);
601
602	stat = (struct r92c_rx_stat *)buf;
603	rxdw0 = le32toh(stat->rxdw0);
604	rxdw3 = le32toh(stat->rxdw3);
605
606	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
607		/*
608		 * This should not happen since we setup our Rx filter
609		 * to not receive these frames.
610		 */
611		ifp->if_ierrors++;
612		return (NULL);
613	}
614
615	rate = MS(rxdw3, R92C_RXDW3_RATE);
616	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
617
618	/* Get RSSI from PHY status descriptor if present. */
619	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
620		rssi = urtwn_get_rssi(sc, rate, &stat[1]);
621		/* Update our average RSSI. */
622		urtwn_update_avgrssi(sc, rate, rssi);
623		/*
624		 * Convert the RSSI to a range that will be accepted
625		 * by net80211.
626		 */
627		rssi = URTWN_RSSI(rssi);
628	}
629
630	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
631	if (m == NULL) {
632		device_printf(sc->sc_dev, "could not create RX mbuf\n");
633		return (NULL);
634	}
635
636	/* Finalize mbuf. */
637	m->m_pkthdr.rcvif = ifp;
638	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
639	memcpy(mtod(m, uint8_t *), wh, pktlen);
640	m->m_pkthdr.len = m->m_len = pktlen;
641
642	if (ieee80211_radiotap_active(ic)) {
643		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
644
645		tap->wr_flags = 0;
646		/* Map HW rate index to 802.11 rate. */
647		if (!(rxdw3 & R92C_RXDW3_HT)) {
648			switch (rate) {
649			/* CCK. */
650			case  0: tap->wr_rate =   2; break;
651			case  1: tap->wr_rate =   4; break;
652			case  2: tap->wr_rate =  11; break;
653			case  3: tap->wr_rate =  22; break;
654			/* OFDM. */
655			case  4: tap->wr_rate =  12; break;
656			case  5: tap->wr_rate =  18; break;
657			case  6: tap->wr_rate =  24; break;
658			case  7: tap->wr_rate =  36; break;
659			case  8: tap->wr_rate =  48; break;
660			case  9: tap->wr_rate =  72; break;
661			case 10: tap->wr_rate =  96; break;
662			case 11: tap->wr_rate = 108; break;
663			}
664		} else if (rate >= 12) {	/* MCS0~15. */
665			/* Bit 7 set means HT MCS instead of rate. */
666			tap->wr_rate = 0x80 | (rate - 12);
667		}
668		tap->wr_dbm_antsignal = rssi;
669		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
670		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
671	}
672
673	*rssi_p = rssi;
674
675	return (m);
676}
677
678static struct mbuf *
679urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
680    int8_t *nf)
681{
682	struct urtwn_softc *sc = data->sc;
683	struct ifnet *ifp = sc->sc_ifp;
684	struct r92c_rx_stat *stat;
685	struct mbuf *m, *m0 = NULL, *prevm = NULL;
686	uint32_t rxdw0;
687	uint8_t *buf;
688	int len, totlen, pktlen, infosz, npkts;
689
690	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
691
692	if (len < sizeof(*stat)) {
693		ifp->if_ierrors++;
694		return (NULL);
695	}
696
697	buf = data->buf;
698	/* Get the number of encapsulated frames. */
699	stat = (struct r92c_rx_stat *)buf;
700	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
701	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
702
703	/* Process all of them. */
704	while (npkts-- > 0) {
705		if (len < sizeof(*stat))
706			break;
707		stat = (struct r92c_rx_stat *)buf;
708		rxdw0 = le32toh(stat->rxdw0);
709
710		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
711		if (pktlen == 0)
712			break;
713
714		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
715
716		/* Make sure everything fits in xfer. */
717		totlen = sizeof(*stat) + infosz + pktlen;
718		if (totlen > len)
719			break;
720
721		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
722		if (m0 == NULL)
723			m0 = m;
724		if (prevm == NULL)
725			prevm = m;
726		else {
727			prevm->m_next = m;
728			prevm = m;
729		}
730
731		/* Next chunk is 128-byte aligned. */
732		totlen = (totlen + 127) & ~127;
733		buf += totlen;
734		len -= totlen;
735	}
736
737	return (m0);
738}
739
740static void
741urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
742{
743	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
744	struct ifnet *ifp = sc->sc_ifp;
745	struct ieee80211com *ic = ifp->if_l2com;
746	struct ieee80211_frame *wh;
747	struct ieee80211_node *ni;
748	struct mbuf *m = NULL, *next;
749	struct urtwn_data *data;
750	int8_t nf;
751	int rssi = 1;
752
753	URTWN_ASSERT_LOCKED(sc);
754
755	switch (USB_GET_STATE(xfer)) {
756	case USB_ST_TRANSFERRED:
757		data = STAILQ_FIRST(&sc->sc_rx_active);
758		if (data == NULL)
759			goto tr_setup;
760		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
761		m = urtwn_rxeof(xfer, data, &rssi, &nf);
762		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
763		/* FALLTHROUGH */
764	case USB_ST_SETUP:
765tr_setup:
766		data = STAILQ_FIRST(&sc->sc_rx_inactive);
767		if (data == NULL) {
768			KASSERT(m == NULL, ("mbuf isn't NULL"));
769			return;
770		}
771		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
772		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
773		usbd_xfer_set_frame_data(xfer, 0, data->buf,
774		    usbd_xfer_max_len(xfer));
775		usbd_transfer_submit(xfer);
776
777		/*
778		 * To avoid LOR we should unlock our private mutex here to call
779		 * ieee80211_input() because here is at the end of a USB
780		 * callback and safe to unlock.
781		 */
782		URTWN_UNLOCK(sc);
783		while (m != NULL) {
784			next = m->m_next;
785			m->m_next = NULL;
786			wh = mtod(m, struct ieee80211_frame *);
787			ni = ieee80211_find_rxnode(ic,
788			    (struct ieee80211_frame_min *)wh);
789			nf = URTWN_NOISE_FLOOR;
790			if (ni != NULL) {
791				(void)ieee80211_input(ni, m, rssi, nf);
792				ieee80211_free_node(ni);
793			} else
794				(void)ieee80211_input_all(ic, m, rssi, nf);
795			m = next;
796		}
797		URTWN_LOCK(sc);
798		break;
799	default:
800		/* needs it to the inactive queue due to a error. */
801		data = STAILQ_FIRST(&sc->sc_rx_active);
802		if (data != NULL) {
803			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
804			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
805		}
806		if (error != USB_ERR_CANCELLED) {
807			usbd_xfer_set_stall(xfer);
808			ifp->if_ierrors++;
809			goto tr_setup;
810		}
811		break;
812	}
813}
814
815static void
816urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
817{
818	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
819	struct ifnet *ifp = sc->sc_ifp;
820	struct mbuf *m;
821
822	URTWN_ASSERT_LOCKED(sc);
823
824	/*
825	 * Do any tx complete callback.  Note this must be done before releasing
826	 * the node reference.
827	 */
828	if (data->m) {
829		m = data->m;
830		if (m->m_flags & M_TXCB) {
831			/* XXX status? */
832			ieee80211_process_callback(data->ni, m, 0);
833		}
834		m_freem(m);
835		data->m = NULL;
836	}
837	if (data->ni) {
838		ieee80211_free_node(data->ni);
839		data->ni = NULL;
840	}
841	sc->sc_txtimer = 0;
842	ifp->if_opackets++;
843	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
844}
845
846static void
847urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
848{
849	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
850	struct ifnet *ifp = sc->sc_ifp;
851	struct urtwn_data *data;
852
853	URTWN_ASSERT_LOCKED(sc);
854
855	switch (USB_GET_STATE(xfer)){
856	case USB_ST_TRANSFERRED:
857		data = STAILQ_FIRST(&sc->sc_tx_active);
858		if (data == NULL)
859			goto tr_setup;
860		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
861		urtwn_txeof(xfer, data);
862		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
863		/* FALLTHROUGH */
864	case USB_ST_SETUP:
865tr_setup:
866		data = STAILQ_FIRST(&sc->sc_tx_pending);
867		if (data == NULL) {
868			DPRINTF("%s: empty pending queue\n", __func__);
869			return;
870		}
871		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
872		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
873		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
874		usbd_transfer_submit(xfer);
875		urtwn_start_locked(ifp, sc);
876		break;
877	default:
878		data = STAILQ_FIRST(&sc->sc_tx_active);
879		if (data == NULL)
880			goto tr_setup;
881		if (data->ni != NULL) {
882			ieee80211_free_node(data->ni);
883			data->ni = NULL;
884			ifp->if_oerrors++;
885		}
886		if (error != USB_ERR_CANCELLED) {
887			usbd_xfer_set_stall(xfer);
888			goto tr_setup;
889		}
890		break;
891	}
892}
893
894static struct urtwn_data *
895_urtwn_getbuf(struct urtwn_softc *sc)
896{
897	struct urtwn_data *bf;
898
899	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
900	if (bf != NULL)
901		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
902	else
903		bf = NULL;
904	if (bf == NULL)
905		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
906	return (bf);
907}
908
909static struct urtwn_data *
910urtwn_getbuf(struct urtwn_softc *sc)
911{
912        struct urtwn_data *bf;
913
914	URTWN_ASSERT_LOCKED(sc);
915
916	bf = _urtwn_getbuf(sc);
917	if (bf == NULL) {
918		struct ifnet *ifp = sc->sc_ifp;
919		DPRINTF("%s: stop queue\n", __func__);
920		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
921	}
922	return (bf);
923}
924
925static int
926urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
927    int len)
928{
929	usb_device_request_t req;
930
931	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
932	req.bRequest = R92C_REQ_REGS;
933	USETW(req.wValue, addr);
934	USETW(req.wIndex, 0);
935	USETW(req.wLength, len);
936	return (urtwn_do_request(sc, &req, buf));
937}
938
939static void
940urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
941{
942	urtwn_write_region_1(sc, addr, &val, 1);
943}
944
945
946static void
947urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
948{
949	val = htole16(val);
950	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
951}
952
953static void
954urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
955{
956	val = htole32(val);
957	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
958}
959
960static int
961urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
962    int len)
963{
964	usb_device_request_t req;
965
966	req.bmRequestType = UT_READ_VENDOR_DEVICE;
967	req.bRequest = R92C_REQ_REGS;
968	USETW(req.wValue, addr);
969	USETW(req.wIndex, 0);
970	USETW(req.wLength, len);
971	return (urtwn_do_request(sc, &req, buf));
972}
973
974static uint8_t
975urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
976{
977	uint8_t val;
978
979	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
980		return (0xff);
981	return (val);
982}
983
984static uint16_t
985urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
986{
987	uint16_t val;
988
989	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
990		return (0xffff);
991	return (le16toh(val));
992}
993
994static uint32_t
995urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
996{
997	uint32_t val;
998
999	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1000		return (0xffffffff);
1001	return (le32toh(val));
1002}
1003
1004static int
1005urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1006{
1007	struct r92c_fw_cmd cmd;
1008	int ntries;
1009
1010	/* Wait for current FW box to be empty. */
1011	for (ntries = 0; ntries < 100; ntries++) {
1012		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1013			break;
1014		DELAY(1);
1015	}
1016	if (ntries == 100) {
1017		device_printf(sc->sc_dev,
1018		    "could not send firmware command\n");
1019		return (ETIMEDOUT);
1020	}
1021	memset(&cmd, 0, sizeof(cmd));
1022	cmd.id = id;
1023	if (len > 3)
1024		cmd.id |= R92C_CMD_FLAG_EXT;
1025	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1026	memcpy(cmd.msg, buf, len);
1027
1028	/* Write the first word last since that will trigger the FW. */
1029	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1030	    (uint8_t *)&cmd + 4, 2);
1031	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1032	    (uint8_t *)&cmd + 0, 4);
1033
1034	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1035	return (0);
1036}
1037
1038static void
1039urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1040{
1041	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1042	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1043	    SM(R92C_LSSI_PARAM_DATA, val));
1044}
1045
1046static uint32_t
1047urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1048{
1049	uint32_t reg[R92C_MAX_CHAINS], val;
1050
1051	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1052	if (chain != 0)
1053		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1054
1055	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1056	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1057	DELAY(1000);
1058
1059	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1060	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1061	    R92C_HSSI_PARAM2_READ_EDGE);
1062	DELAY(1000);
1063
1064	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1065	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1066	DELAY(1000);
1067
1068	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1069		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1070	else
1071		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1072	return (MS(val, R92C_LSSI_READBACK_DATA));
1073}
1074
1075static int
1076urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1077{
1078	int ntries;
1079
1080	urtwn_write_4(sc, R92C_LLT_INIT,
1081	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1082	    SM(R92C_LLT_INIT_ADDR, addr) |
1083	    SM(R92C_LLT_INIT_DATA, data));
1084	/* Wait for write operation to complete. */
1085	for (ntries = 0; ntries < 20; ntries++) {
1086		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1087		    R92C_LLT_INIT_OP_NO_ACTIVE)
1088			return (0);
1089		DELAY(5);
1090	}
1091	return (ETIMEDOUT);
1092}
1093
1094static uint8_t
1095urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1096{
1097	uint32_t reg;
1098	int ntries;
1099
1100	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1101	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1102	reg &= ~R92C_EFUSE_CTRL_VALID;
1103	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1104	/* Wait for read operation to complete. */
1105	for (ntries = 0; ntries < 100; ntries++) {
1106		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1107		if (reg & R92C_EFUSE_CTRL_VALID)
1108			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1109		DELAY(5);
1110	}
1111	device_printf(sc->sc_dev,
1112	    "could not read efuse byte at address 0x%x\n", addr);
1113	return (0xff);
1114}
1115
1116static void
1117urtwn_efuse_read(struct urtwn_softc *sc)
1118{
1119	uint8_t *rom = (uint8_t *)&sc->rom;
1120	uint16_t addr = 0;
1121	uint32_t reg;
1122	uint8_t off, msk;
1123	int i;
1124
1125	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1126	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1127		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1128		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1129	}
1130	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1131	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1132		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1133		    reg | R92C_SYS_FUNC_EN_ELDR);
1134	}
1135	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1136	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1137	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1138		urtwn_write_2(sc, R92C_SYS_CLKR,
1139		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1140	}
1141	memset(&sc->rom, 0xff, sizeof(sc->rom));
1142	while (addr < 512) {
1143		reg = urtwn_efuse_read_1(sc, addr);
1144		if (reg == 0xff)
1145			break;
1146		addr++;
1147		off = reg >> 4;
1148		msk = reg & 0xf;
1149		for (i = 0; i < 4; i++) {
1150			if (msk & (1 << i))
1151				continue;
1152			rom[off * 8 + i * 2 + 0] =
1153			    urtwn_efuse_read_1(sc, addr);
1154			addr++;
1155			rom[off * 8 + i * 2 + 1] =
1156			    urtwn_efuse_read_1(sc, addr);
1157			addr++;
1158		}
1159	}
1160#ifdef URTWN_DEBUG
1161	if (urtwn_debug >= 2) {
1162		/* Dump ROM content. */
1163		printf("\n");
1164		for (i = 0; i < sizeof(sc->rom); i++)
1165			printf("%02x:", rom[i]);
1166		printf("\n");
1167	}
1168#endif
1169}
1170
1171static int
1172urtwn_read_chipid(struct urtwn_softc *sc)
1173{
1174	uint32_t reg;
1175
1176	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1177	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1178		return (EIO);
1179
1180	if (reg & R92C_SYS_CFG_TYPE_92C) {
1181		sc->chip |= URTWN_CHIP_92C;
1182		/* Check if it is a castrated 8192C. */
1183		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1184		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1185		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1186			sc->chip |= URTWN_CHIP_92C_1T2R;
1187	}
1188	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1189		sc->chip |= URTWN_CHIP_UMC;
1190		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1191			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1192	}
1193	return (0);
1194}
1195
1196static void
1197urtwn_read_rom(struct urtwn_softc *sc)
1198{
1199	struct r92c_rom *rom = &sc->rom;
1200
1201	/* Read full ROM image. */
1202	urtwn_efuse_read(sc);
1203
1204	/* XXX Weird but this is what the vendor driver does. */
1205	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1206	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1207
1208	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1209
1210	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1211	DPRINTF("regulatory type=%d\n", sc->regulatory);
1212
1213	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1214}
1215
1216/*
1217 * Initialize rate adaptation in firmware.
1218 */
1219static int
1220urtwn_ra_init(struct urtwn_softc *sc)
1221{
1222	static const uint8_t map[] =
1223	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1224	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1225	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1226	struct ieee80211_node *ni;
1227	struct ieee80211_rateset *rs;
1228	struct r92c_fw_cmd_macid_cfg cmd;
1229	uint32_t rates, basicrates;
1230	uint8_t mode;
1231	int maxrate, maxbasicrate, error, i, j;
1232
1233	ni = ieee80211_ref_node(vap->iv_bss);
1234	rs = &ni->ni_rates;
1235
1236	/* Get normal and basic rates mask. */
1237	rates = basicrates = 0;
1238	maxrate = maxbasicrate = 0;
1239	for (i = 0; i < rs->rs_nrates; i++) {
1240		/* Convert 802.11 rate to HW rate index. */
1241		for (j = 0; j < nitems(map); j++)
1242			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1243				break;
1244		if (j == nitems(map))	/* Unknown rate, skip. */
1245			continue;
1246		rates |= 1 << j;
1247		if (j > maxrate)
1248			maxrate = j;
1249		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1250			basicrates |= 1 << j;
1251			if (j > maxbasicrate)
1252				maxbasicrate = j;
1253		}
1254	}
1255	if (ic->ic_curmode == IEEE80211_MODE_11B)
1256		mode = R92C_RAID_11B;
1257	else
1258		mode = R92C_RAID_11BG;
1259	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1260	    mode, rates, basicrates);
1261
1262	/* Set rates mask for group addressed frames. */
1263	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1264	cmd.mask = htole32(mode << 28 | basicrates);
1265	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1266	if (error != 0) {
1267		ieee80211_free_node(ni);
1268		device_printf(sc->sc_dev,
1269		    "could not add broadcast station\n");
1270		return (error);
1271	}
1272	/* Set initial MRR rate. */
1273	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1274	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1275	    maxbasicrate);
1276
1277	/* Set rates mask for unicast frames. */
1278	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1279	cmd.mask = htole32(mode << 28 | rates);
1280	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1281	if (error != 0) {
1282		ieee80211_free_node(ni);
1283		device_printf(sc->sc_dev, "could not add BSS station\n");
1284		return (error);
1285	}
1286	/* Set initial MRR rate. */
1287	DPRINTF("maxrate=%d\n", maxrate);
1288	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1289	    maxrate);
1290
1291	/* Indicate highest supported rate. */
1292	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1293	ieee80211_free_node(ni);
1294
1295	return (0);
1296}
1297
1298void
1299urtwn_tsf_sync_enable(struct urtwn_softc *sc)
1300{
1301	struct ifnet *ifp = sc->sc_ifp;
1302	struct ieee80211com *ic = ifp->if_l2com;
1303	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1304	struct ieee80211_node *ni = vap->iv_bss;
1305
1306	uint64_t tsf;
1307
1308	/* Enable TSF synchronization. */
1309	urtwn_write_1(sc, R92C_BCN_CTRL,
1310	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1311
1312	urtwn_write_1(sc, R92C_BCN_CTRL,
1313	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1314
1315	/* Set initial TSF. */
1316	memcpy(&tsf, ni->ni_tstamp.data, 8);
1317	tsf = le64toh(tsf);
1318	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1319	tsf -= IEEE80211_DUR_TU;
1320	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1321	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1322
1323	urtwn_write_1(sc, R92C_BCN_CTRL,
1324	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1325}
1326
1327static void
1328urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1329{
1330	uint8_t reg;
1331
1332	if (led == URTWN_LED_LINK) {
1333		reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1334		if (!on)
1335			reg |= R92C_LEDCFG0_DIS;
1336		urtwn_write_1(sc, R92C_LEDCFG0, reg);
1337		sc->ledlink = on;	/* Save LED state. */
1338	}
1339}
1340
1341static int
1342urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1343{
1344	struct urtwn_vap *uvp = URTWN_VAP(vap);
1345	struct ieee80211com *ic = vap->iv_ic;
1346	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1347	struct ieee80211_node *ni;
1348	enum ieee80211_state ostate;
1349	uint32_t reg;
1350
1351	ostate = vap->iv_state;
1352	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1353	    ieee80211_state_name[nstate]);
1354
1355	IEEE80211_UNLOCK(ic);
1356	URTWN_LOCK(sc);
1357	callout_stop(&sc->sc_watchdog_ch);
1358
1359	if (ostate == IEEE80211_S_RUN) {
1360		/* Turn link LED off. */
1361		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1362
1363		/* Set media status to 'No Link'. */
1364		reg = urtwn_read_4(sc, R92C_CR);
1365		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1366		urtwn_write_4(sc, R92C_CR, reg);
1367
1368		/* Stop Rx of data frames. */
1369		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1370
1371		/* Rest TSF. */
1372		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1373
1374		/* Disable TSF synchronization. */
1375		urtwn_write_1(sc, R92C_BCN_CTRL,
1376		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1377		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1378
1379		/* Reset EDCA parameters. */
1380		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1381		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1382		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1383		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1384	}
1385
1386	switch (nstate) {
1387	case IEEE80211_S_INIT:
1388		/* Turn link LED off. */
1389		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1390		break;
1391	case IEEE80211_S_SCAN:
1392		if (ostate != IEEE80211_S_SCAN) {
1393			/* Allow Rx from any BSSID. */
1394			urtwn_write_4(sc, R92C_RCR,
1395			    urtwn_read_4(sc, R92C_RCR) &
1396			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1397
1398			/* Set gain for scanning. */
1399			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1400			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1401			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1402
1403			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1404			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1405			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1406		}
1407
1408		/* Make link LED blink during scan. */
1409		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
1410
1411		/* Pause AC Tx queues. */
1412		urtwn_write_1(sc, R92C_TXPAUSE,
1413		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1414
1415		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1416		break;
1417	case IEEE80211_S_AUTH:
1418		/* Set initial gain under link. */
1419		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1420		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1421		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1422
1423		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1424		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1425		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1426
1427		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1428		break;
1429	case IEEE80211_S_RUN:
1430		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1431			/* Enable Rx of data frames. */
1432			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1433
1434			/* Turn link LED on. */
1435			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1436			break;
1437		}
1438
1439		ni = ieee80211_ref_node(vap->iv_bss);
1440		/* Set media status to 'Associated'. */
1441		reg = urtwn_read_4(sc, R92C_CR);
1442		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1443		urtwn_write_4(sc, R92C_CR, reg);
1444
1445		/* Set BSSID. */
1446		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1447		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1448
1449		if (ic->ic_curmode == IEEE80211_MODE_11B)
1450			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1451		else	/* 802.11b/g */
1452			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1453
1454		/* Enable Rx of data frames. */
1455		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1456
1457		/* Flush all AC queues. */
1458		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1459
1460		/* Set beacon interval. */
1461		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1462
1463		/* Allow Rx from our BSSID only. */
1464		urtwn_write_4(sc, R92C_RCR,
1465		    urtwn_read_4(sc, R92C_RCR) |
1466		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1467
1468		/* Enable TSF synchronization. */
1469		urtwn_tsf_sync_enable(sc);
1470
1471		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1472		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1473		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1474		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1475		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1476		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1477
1478		/* Intialize rate adaptation. */
1479		urtwn_ra_init(sc);
1480		/* Turn link LED on. */
1481		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1482
1483		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1484		/* Reset temperature calibration state machine. */
1485		sc->thcal_state = 0;
1486		sc->thcal_lctemp = 0;
1487		ieee80211_free_node(ni);
1488		break;
1489	default:
1490		break;
1491	}
1492	URTWN_UNLOCK(sc);
1493	IEEE80211_LOCK(ic);
1494	return(uvp->newstate(vap, nstate, arg));
1495}
1496
1497static void
1498urtwn_watchdog(void *arg)
1499{
1500	struct urtwn_softc *sc = arg;
1501	struct ifnet *ifp = sc->sc_ifp;
1502
1503	if (sc->sc_txtimer > 0) {
1504		if (--sc->sc_txtimer == 0) {
1505			device_printf(sc->sc_dev, "device timeout\n");
1506			ifp->if_oerrors++;
1507			return;
1508		}
1509		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1510	}
1511}
1512
1513static void
1514urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1515{
1516	int pwdb;
1517
1518	/* Convert antenna signal to percentage. */
1519	if (rssi <= -100 || rssi >= 20)
1520		pwdb = 0;
1521	else if (rssi >= 0)
1522		pwdb = 100;
1523	else
1524		pwdb = 100 + rssi;
1525	if (rate <= 3) {
1526		/* CCK gain is smaller than OFDM/MCS gain. */
1527		pwdb += 6;
1528		if (pwdb > 100)
1529			pwdb = 100;
1530		if (pwdb <= 14)
1531			pwdb -= 4;
1532		else if (pwdb <= 26)
1533			pwdb -= 8;
1534		else if (pwdb <= 34)
1535			pwdb -= 6;
1536		else if (pwdb <= 42)
1537			pwdb -= 2;
1538	}
1539	if (sc->avg_pwdb == -1)	/* Init. */
1540		sc->avg_pwdb = pwdb;
1541	else if (sc->avg_pwdb < pwdb)
1542		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1543	else
1544		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1545	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1546}
1547
1548static int8_t
1549urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1550{
1551	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1552	struct r92c_rx_phystat *phy;
1553	struct r92c_rx_cck *cck;
1554	uint8_t rpt;
1555	int8_t rssi;
1556
1557	if (rate <= 3) {
1558		cck = (struct r92c_rx_cck *)physt;
1559		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1560			rpt = (cck->agc_rpt >> 5) & 0x3;
1561			rssi = (cck->agc_rpt & 0x1f) << 1;
1562		} else {
1563			rpt = (cck->agc_rpt >> 6) & 0x3;
1564			rssi = cck->agc_rpt & 0x3e;
1565		}
1566		rssi = cckoff[rpt] - rssi;
1567	} else {	/* OFDM/HT. */
1568		phy = (struct r92c_rx_phystat *)physt;
1569		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1570	}
1571	return (rssi);
1572}
1573
1574static int
1575urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1576    struct mbuf *m0, struct urtwn_data *data)
1577{
1578	struct ifnet *ifp = sc->sc_ifp;
1579	struct ieee80211_frame *wh;
1580	struct ieee80211_key *k;
1581	struct ieee80211com *ic = ifp->if_l2com;
1582	struct ieee80211vap *vap = ni->ni_vap;
1583	struct usb_xfer *xfer;
1584	struct r92c_tx_desc *txd;
1585	uint8_t raid, type;
1586	uint16_t sum;
1587	int i, hasqos, xferlen;
1588	struct usb_xfer *urtwn_pipes[4] = {
1589		sc->sc_xfer[URTWN_BULK_TX_BE],
1590		sc->sc_xfer[URTWN_BULK_TX_BK],
1591		sc->sc_xfer[URTWN_BULK_TX_VI],
1592		sc->sc_xfer[URTWN_BULK_TX_VO]
1593	};
1594
1595	URTWN_ASSERT_LOCKED(sc);
1596
1597	/*
1598	 * Software crypto.
1599	 */
1600	wh = mtod(m0, struct ieee80211_frame *);
1601	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1602		k = ieee80211_crypto_encap(ni, m0);
1603		if (k == NULL) {
1604			device_printf(sc->sc_dev,
1605			    "ieee80211_crypto_encap returns NULL.\n");
1606			/* XXX we don't expect the fragmented frames */
1607			m_freem(m0);
1608			return (ENOBUFS);
1609		}
1610
1611		/* in case packet header moved, reset pointer */
1612		wh = mtod(m0, struct ieee80211_frame *);
1613	}
1614
1615	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1616	case IEEE80211_FC0_TYPE_CTL:
1617	case IEEE80211_FC0_TYPE_MGT:
1618		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1619		break;
1620	default:
1621		KASSERT(M_WME_GETAC(m0) < 4,
1622		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1623		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1624		break;
1625	}
1626
1627	hasqos = 0;
1628
1629	/* Fill Tx descriptor. */
1630	txd = (struct r92c_tx_desc *)data->buf;
1631	memset(txd, 0, sizeof(*txd));
1632
1633	txd->txdw0 |= htole32(
1634	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1635	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1636	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1637	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1638		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1639
1640	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1641	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1642	    type == IEEE80211_FC0_TYPE_DATA) {
1643		if (ic->ic_curmode == IEEE80211_MODE_11B)
1644			raid = R92C_RAID_11B;
1645		else
1646			raid = R92C_RAID_11BG;
1647		txd->txdw1 |= htole32(
1648		    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1649		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1650		    SM(R92C_TXDW1_RAID, raid) |
1651		    R92C_TXDW1_AGGBK);
1652
1653		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1654			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1655				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1656				    R92C_TXDW4_HWRTSEN);
1657			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1658				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1659				    R92C_TXDW4_HWRTSEN);
1660			}
1661		}
1662		/* Send RTS at OFDM24. */
1663		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1664		txd->txdw5 |= htole32(0x0001ff00);
1665		/* Send data at OFDM54. */
1666		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1667	} else {
1668		txd->txdw1 |= htole32(
1669		    SM(R92C_TXDW1_MACID, 0) |
1670		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1671		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1672
1673		/* Force CCK1. */
1674		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1675		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1676	}
1677	/* Set sequence number (already little endian). */
1678	txd->txdseq |= *(uint16_t *)wh->i_seq;
1679
1680	if (!hasqos) {
1681		/* Use HW sequence numbering for non-QoS frames. */
1682		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1683		txd->txdseq |= htole16(0x8000);
1684	} else
1685		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1686
1687	/* Compute Tx descriptor checksum. */
1688	sum = 0;
1689	for (i = 0; i < sizeof(*txd) / 2; i++)
1690		sum ^= ((uint16_t *)txd)[i];
1691	txd->txdsum = sum; 	/* NB: already little endian. */
1692
1693	if (ieee80211_radiotap_active_vap(vap)) {
1694		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1695
1696		tap->wt_flags = 0;
1697		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1698		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1699		ieee80211_radiotap_tx(vap, m0);
1700	}
1701
1702	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1703	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1704
1705	data->buflen = xferlen;
1706	data->ni = ni;
1707	data->m = m0;
1708
1709	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1710	usbd_transfer_start(xfer);
1711	return (0);
1712}
1713
1714static void
1715urtwn_start(struct ifnet *ifp)
1716{
1717	struct urtwn_softc *sc = ifp->if_softc;
1718
1719	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1720		return;
1721	URTWN_LOCK(sc);
1722	urtwn_start_locked(ifp, sc);
1723	URTWN_UNLOCK(sc);
1724}
1725
1726static void
1727urtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1728{
1729	struct ieee80211_node *ni;
1730	struct mbuf *m;
1731	struct urtwn_data *bf;
1732
1733	URTWN_ASSERT_LOCKED(sc);
1734	for (;;) {
1735		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1736		if (m == NULL)
1737			break;
1738		bf = urtwn_getbuf(sc);
1739		if (bf == NULL) {
1740			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1741			break;
1742		}
1743		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1744		m->m_pkthdr.rcvif = NULL;
1745
1746		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1747			ifp->if_oerrors++;
1748			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1749			ieee80211_free_node(ni);
1750			break;
1751		}
1752
1753		sc->sc_txtimer = 5;
1754		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1755	}
1756}
1757
1758static int
1759urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1760{
1761	struct ieee80211com *ic = ifp->if_l2com;
1762	struct ifreq *ifr = (struct ifreq *) data;
1763	int error = 0, startall = 0;
1764
1765	switch (cmd) {
1766	case SIOCSIFFLAGS:
1767		if (ifp->if_flags & IFF_UP) {
1768			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1769				urtwn_init(ifp->if_softc);
1770				startall = 1;
1771			}
1772		} else {
1773			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1774				urtwn_stop(ifp, 1);
1775		}
1776		if (startall)
1777			ieee80211_start_all(ic);
1778		break;
1779	case SIOCGIFMEDIA:
1780		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1781		break;
1782	case SIOCGIFADDR:
1783		error = ether_ioctl(ifp, cmd, data);
1784		break;
1785	default:
1786		error = EINVAL;
1787		break;
1788	}
1789	return (error);
1790}
1791
1792static int
1793urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1794    int ndata, int maxsz)
1795{
1796	int i, error;
1797
1798	for (i = 0; i < ndata; i++) {
1799		struct urtwn_data *dp = &data[i];
1800		dp->sc = sc;
1801		dp->m = NULL;
1802		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1803		if (dp->buf == NULL) {
1804			device_printf(sc->sc_dev,
1805			    "could not allocate buffer\n");
1806			error = ENOMEM;
1807			goto fail;
1808		}
1809		dp->ni = NULL;
1810	}
1811
1812	return (0);
1813fail:
1814	urtwn_free_list(sc, data, ndata);
1815	return (error);
1816}
1817
1818static int
1819urtwn_alloc_rx_list(struct urtwn_softc *sc)
1820{
1821        int error, i;
1822
1823	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1824	    URTWN_RXBUFSZ);
1825	if (error != 0)
1826		return (error);
1827
1828	STAILQ_INIT(&sc->sc_rx_active);
1829	STAILQ_INIT(&sc->sc_rx_inactive);
1830
1831	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1832		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1833
1834	return (0);
1835}
1836
1837static int
1838urtwn_alloc_tx_list(struct urtwn_softc *sc)
1839{
1840	int error, i;
1841
1842	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1843	    URTWN_TXBUFSZ);
1844	if (error != 0)
1845		return (error);
1846
1847	STAILQ_INIT(&sc->sc_tx_active);
1848	STAILQ_INIT(&sc->sc_tx_inactive);
1849	STAILQ_INIT(&sc->sc_tx_pending);
1850
1851	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1852		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1853
1854	return (0);
1855}
1856
1857static int
1858urtwn_power_on(struct urtwn_softc *sc)
1859{
1860	uint32_t reg;
1861	int ntries;
1862
1863	/* Wait for autoload done bit. */
1864	for (ntries = 0; ntries < 1000; ntries++) {
1865		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1866			break;
1867		DELAY(5);
1868	}
1869	if (ntries == 1000) {
1870		device_printf(sc->sc_dev,
1871		    "timeout waiting for chip autoload\n");
1872		return (ETIMEDOUT);
1873	}
1874
1875	/* Unlock ISO/CLK/Power control register. */
1876	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
1877	/* Move SPS into PWM mode. */
1878	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1879	DELAY(100);
1880
1881	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
1882	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
1883		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
1884		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
1885		DELAY(100);
1886		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
1887		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
1888		    ~R92C_SYS_ISO_CTRL_MD2PP);
1889	}
1890
1891	/* Auto enable WLAN. */
1892	urtwn_write_2(sc, R92C_APS_FSMCO,
1893	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1894	for (ntries = 0; ntries < 1000; ntries++) {
1895		if (urtwn_read_2(sc, R92C_APS_FSMCO) &
1896		    R92C_APS_FSMCO_APFM_ONMAC)
1897			break;
1898		DELAY(5);
1899	}
1900	if (ntries == 1000) {
1901		device_printf(sc->sc_dev,
1902		    "timeout waiting for MAC auto ON\n");
1903		return (ETIMEDOUT);
1904	}
1905
1906	/* Enable radio, GPIO and LED functions. */
1907	urtwn_write_2(sc, R92C_APS_FSMCO,
1908	    R92C_APS_FSMCO_AFSM_HSUS |
1909	    R92C_APS_FSMCO_PDN_EN |
1910	    R92C_APS_FSMCO_PFM_ALDN);
1911	/* Release RF digital isolation. */
1912	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1913	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1914
1915	/* Initialize MAC. */
1916	urtwn_write_1(sc, R92C_APSD_CTRL,
1917	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
1918	for (ntries = 0; ntries < 200; ntries++) {
1919		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
1920		    R92C_APSD_CTRL_OFF_STATUS))
1921			break;
1922		DELAY(5);
1923	}
1924	if (ntries == 200) {
1925		device_printf(sc->sc_dev,
1926		    "timeout waiting for MAC initialization\n");
1927		return (ETIMEDOUT);
1928	}
1929
1930	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
1931	reg = urtwn_read_2(sc, R92C_CR);
1932	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
1933	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
1934	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
1935	    R92C_CR_ENSEC;
1936	urtwn_write_2(sc, R92C_CR, reg);
1937
1938	urtwn_write_1(sc, 0xfe10, 0x19);
1939	return (0);
1940}
1941
1942static int
1943urtwn_llt_init(struct urtwn_softc *sc)
1944{
1945	int i, error;
1946
1947	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
1948	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
1949		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1950			return (error);
1951	}
1952	/* NB: 0xff indicates end-of-list. */
1953	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
1954		return (error);
1955	/*
1956	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
1957	 * as ring buffer.
1958	 */
1959	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
1960		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1961			return (error);
1962	}
1963	/* Make the last page point to the beginning of the ring buffer. */
1964	error = urtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
1965	return (error);
1966}
1967
1968static void
1969urtwn_fw_reset(struct urtwn_softc *sc)
1970{
1971	uint16_t reg;
1972	int ntries;
1973
1974	/* Tell 8051 to reset itself. */
1975	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1976
1977	/* Wait until 8051 resets by itself. */
1978	for (ntries = 0; ntries < 100; ntries++) {
1979		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1980		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1981			return;
1982		DELAY(50);
1983	}
1984	/* Force 8051 reset. */
1985	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1986}
1987
1988static int
1989urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
1990{
1991	uint32_t reg;
1992	int off, mlen, error = 0;
1993
1994	reg = urtwn_read_4(sc, R92C_MCUFWDL);
1995	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
1996	urtwn_write_4(sc, R92C_MCUFWDL, reg);
1997
1998	off = R92C_FW_START_ADDR;
1999	while (len > 0) {
2000		if (len > 196)
2001			mlen = 196;
2002		else if (len > 4)
2003			mlen = 4;
2004		else
2005			mlen = 1;
2006		/* XXX fix this deconst */
2007		error = urtwn_write_region_1(sc, off,
2008		    __DECONST(uint8_t *, buf), mlen);
2009		if (error != 0)
2010			break;
2011		off += mlen;
2012		buf += mlen;
2013		len -= mlen;
2014	}
2015	return (error);
2016}
2017
2018static int
2019urtwn_load_firmware(struct urtwn_softc *sc)
2020{
2021	const struct firmware *fw;
2022	const struct r92c_fw_hdr *hdr;
2023	const char *imagename;
2024	const u_char *ptr;
2025	size_t len;
2026	uint32_t reg;
2027	int mlen, ntries, page, error;
2028
2029	/* Read firmware image from the filesystem. */
2030	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2031	    URTWN_CHIP_UMC_A_CUT)
2032		imagename = "urtwn-rtl8192cfwU";
2033	else
2034		imagename = "urtwn-rtl8192cfwT";
2035
2036	fw = firmware_get(imagename);
2037	if (fw == NULL) {
2038		device_printf(sc->sc_dev,
2039		    "failed loadfirmware of file %s\n", imagename);
2040		return (ENOENT);
2041	}
2042
2043	len = fw->datasize;
2044
2045	if (len < sizeof(*hdr)) {
2046		device_printf(sc->sc_dev, "firmware too short\n");
2047		error = EINVAL;
2048		goto fail;
2049	}
2050	ptr = fw->data;
2051	hdr = (const struct r92c_fw_hdr *)ptr;
2052	/* Check if there is a valid FW header and skip it. */
2053	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2054	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2055		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2056		    le16toh(hdr->version), le16toh(hdr->subversion),
2057		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2058		ptr += sizeof(*hdr);
2059		len -= sizeof(*hdr);
2060	}
2061
2062	if (urtwn_read_1(sc, R92C_MCUFWDL) & 0x80) {
2063		urtwn_fw_reset(sc);
2064		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2065	}
2066	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2067	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2068	    R92C_SYS_FUNC_EN_CPUEN);
2069	urtwn_write_1(sc, R92C_MCUFWDL,
2070	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2071	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2072	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2073
2074	for (page = 0; len > 0; page++) {
2075		mlen = min(len, R92C_FW_PAGE_SIZE);
2076		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2077		if (error != 0) {
2078			device_printf(sc->sc_dev,
2079			    "could not load firmware page\n");
2080			goto fail;
2081		}
2082		ptr += mlen;
2083		len -= mlen;
2084	}
2085	urtwn_write_1(sc, R92C_MCUFWDL,
2086	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2087	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2088
2089	/* Wait for checksum report. */
2090	for (ntries = 0; ntries < 1000; ntries++) {
2091		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2092			break;
2093		DELAY(5);
2094	}
2095	if (ntries == 1000) {
2096		device_printf(sc->sc_dev,
2097		    "timeout waiting for checksum report\n");
2098		error = ETIMEDOUT;
2099		goto fail;
2100	}
2101
2102	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2103	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2104	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2105	/* Wait for firmware readiness. */
2106	for (ntries = 0; ntries < 1000; ntries++) {
2107		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2108			break;
2109		DELAY(5);
2110	}
2111	if (ntries == 1000) {
2112		device_printf(sc->sc_dev,
2113		    "timeout waiting for firmware readiness\n");
2114		error = ETIMEDOUT;
2115		goto fail;
2116	}
2117fail:
2118	firmware_put(fw, FIRMWARE_UNLOAD);
2119	return (error);
2120}
2121
2122static int
2123urtwn_dma_init(struct urtwn_softc *sc)
2124{
2125	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2126	uint32_t reg;
2127	int error;
2128
2129	/* Initialize LLT table. */
2130	error = urtwn_llt_init(sc);
2131	if (error != 0)
2132		return (error);
2133
2134	/* Get Tx queues to USB endpoints mapping. */
2135	hashq = hasnq = haslq = 0;
2136	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2137	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2138	if (MS(reg, R92C_USB_EP_HQ) != 0)
2139		hashq = 1;
2140	if (MS(reg, R92C_USB_EP_NQ) != 0)
2141		hasnq = 1;
2142	if (MS(reg, R92C_USB_EP_LQ) != 0)
2143		haslq = 1;
2144	nqueues = hashq + hasnq + haslq;
2145	if (nqueues == 0)
2146		return (EIO);
2147	/* Get the number of pages for each queue. */
2148	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2149	/* The remaining pages are assigned to the high priority queue. */
2150	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2151
2152	/* Set number of pages for normal priority queue. */
2153	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2154	urtwn_write_4(sc, R92C_RQPN,
2155	    /* Set number of pages for public queue. */
2156	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2157	    /* Set number of pages for high priority queue. */
2158	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2159	    /* Set number of pages for low priority queue. */
2160	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2161	    /* Load values. */
2162	    R92C_RQPN_LD);
2163
2164	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2165	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2166	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2167	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2168	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2169
2170	/* Set queue to USB pipe mapping. */
2171	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2172	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2173	if (nqueues == 1) {
2174		if (hashq)
2175			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2176		else if (hasnq)
2177			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2178		else
2179			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2180	} else if (nqueues == 2) {
2181		/* All 2-endpoints configs have a high priority queue. */
2182		if (!hashq)
2183			return (EIO);
2184		if (hasnq)
2185			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2186		else
2187			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2188	} else
2189		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2190	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2191
2192	/* Set Tx/Rx transfer page boundary. */
2193	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2194
2195	/* Set Tx/Rx transfer page size. */
2196	urtwn_write_1(sc, R92C_PBP,
2197	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2198	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2199	return (0);
2200}
2201
2202static void
2203urtwn_mac_init(struct urtwn_softc *sc)
2204{
2205	int i;
2206
2207	/* Write MAC initialization values. */
2208	for (i = 0; i < nitems(rtl8192cu_mac); i++)
2209		urtwn_write_1(sc, rtl8192cu_mac[i].reg, rtl8192cu_mac[i].val);
2210}
2211
2212static void
2213urtwn_bb_init(struct urtwn_softc *sc)
2214{
2215	const struct urtwn_bb_prog *prog;
2216	uint32_t reg;
2217	int i;
2218
2219	/* Enable BB and RF. */
2220	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2221	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2222	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2223	    R92C_SYS_FUNC_EN_DIO_RF);
2224
2225	urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2226
2227	urtwn_write_1(sc, R92C_RF_CTRL,
2228	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2229	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2230	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2231	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2232
2233	urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2234	urtwn_write_1(sc, 0x15, 0xe9);
2235	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2236
2237	/* Select BB programming based on board type. */
2238	if (!(sc->chip & URTWN_CHIP_92C)) {
2239		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2240			prog = &rtl8188ce_bb_prog;
2241		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2242			prog = &rtl8188ru_bb_prog;
2243		else
2244			prog = &rtl8188cu_bb_prog;
2245	} else {
2246		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2247			prog = &rtl8192ce_bb_prog;
2248		else
2249			prog = &rtl8192cu_bb_prog;
2250	}
2251	/* Write BB initialization values. */
2252	for (i = 0; i < prog->count; i++) {
2253		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2254		DELAY(1);
2255	}
2256
2257	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2258		/* 8192C 1T only configuration. */
2259		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2260		reg = (reg & ~0x00000003) | 0x2;
2261		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2262
2263		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2264		reg = (reg & ~0x00300033) | 0x00200022;
2265		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2266
2267		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2268		reg = (reg & ~0xff000000) | 0x45 << 24;
2269		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2270
2271		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2272		reg = (reg & ~0x000000ff) | 0x23;
2273		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2274
2275		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2276		reg = (reg & ~0x00000030) | 1 << 4;
2277		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2278
2279		reg = urtwn_bb_read(sc, 0xe74);
2280		reg = (reg & ~0x0c000000) | 2 << 26;
2281		urtwn_bb_write(sc, 0xe74, reg);
2282		reg = urtwn_bb_read(sc, 0xe78);
2283		reg = (reg & ~0x0c000000) | 2 << 26;
2284		urtwn_bb_write(sc, 0xe78, reg);
2285		reg = urtwn_bb_read(sc, 0xe7c);
2286		reg = (reg & ~0x0c000000) | 2 << 26;
2287		urtwn_bb_write(sc, 0xe7c, reg);
2288		reg = urtwn_bb_read(sc, 0xe80);
2289		reg = (reg & ~0x0c000000) | 2 << 26;
2290		urtwn_bb_write(sc, 0xe80, reg);
2291		reg = urtwn_bb_read(sc, 0xe88);
2292		reg = (reg & ~0x0c000000) | 2 << 26;
2293		urtwn_bb_write(sc, 0xe88, reg);
2294	}
2295
2296	/* Write AGC values. */
2297	for (i = 0; i < prog->agccount; i++) {
2298		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2299		    prog->agcvals[i]);
2300		DELAY(1);
2301	}
2302
2303	if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2304	    R92C_HSSI_PARAM2_CCK_HIPWR)
2305		sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2306}
2307
2308void
2309urtwn_rf_init(struct urtwn_softc *sc)
2310{
2311	const struct urtwn_rf_prog *prog;
2312	uint32_t reg, type;
2313	int i, j, idx, off;
2314
2315	/* Select RF programming based on board type. */
2316	if (!(sc->chip & URTWN_CHIP_92C)) {
2317		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2318			prog = rtl8188ce_rf_prog;
2319		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2320			prog = rtl8188ru_rf_prog;
2321		else
2322			prog = rtl8188cu_rf_prog;
2323	} else
2324		prog = rtl8192ce_rf_prog;
2325
2326	for (i = 0; i < sc->nrxchains; i++) {
2327		/* Save RF_ENV control type. */
2328		idx = i / 2;
2329		off = (i % 2) * 16;
2330		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2331		type = (reg >> off) & 0x10;
2332
2333		/* Set RF_ENV enable. */
2334		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2335		reg |= 0x100000;
2336		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2337		DELAY(1);
2338		/* Set RF_ENV output high. */
2339		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2340		reg |= 0x10;
2341		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2342		DELAY(1);
2343		/* Set address and data lengths of RF registers. */
2344		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2345		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2346		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2347		DELAY(1);
2348		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2349		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2350		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2351		DELAY(1);
2352
2353		/* Write RF initialization values for this chain. */
2354		for (j = 0; j < prog[i].count; j++) {
2355			if (prog[i].regs[j] >= 0xf9 &&
2356			    prog[i].regs[j] <= 0xfe) {
2357				/*
2358				 * These are fake RF registers offsets that
2359				 * indicate a delay is required.
2360				 */
2361				usb_pause_mtx(&sc->sc_mtx, 50);
2362				continue;
2363			}
2364			urtwn_rf_write(sc, i, prog[i].regs[j],
2365			    prog[i].vals[j]);
2366			DELAY(1);
2367		}
2368
2369		/* Restore RF_ENV control type. */
2370		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2371		reg &= ~(0x10 << off) | (type << off);
2372		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2373
2374		/* Cache RF register CHNLBW. */
2375		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2376	}
2377
2378	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2379	    URTWN_CHIP_UMC_A_CUT) {
2380		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2381		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2382	}
2383}
2384
2385static void
2386urtwn_cam_init(struct urtwn_softc *sc)
2387{
2388	/* Invalidate all CAM entries. */
2389	urtwn_write_4(sc, R92C_CAMCMD,
2390	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2391}
2392
2393static void
2394urtwn_pa_bias_init(struct urtwn_softc *sc)
2395{
2396	uint8_t reg;
2397	int i;
2398
2399	for (i = 0; i < sc->nrxchains; i++) {
2400		if (sc->pa_setting & (1 << i))
2401			continue;
2402		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2403		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2404		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2405		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2406	}
2407	if (!(sc->pa_setting & 0x10)) {
2408		reg = urtwn_read_1(sc, 0x16);
2409		reg = (reg & ~0xf0) | 0x90;
2410		urtwn_write_1(sc, 0x16, reg);
2411	}
2412}
2413
2414static void
2415urtwn_rxfilter_init(struct urtwn_softc *sc)
2416{
2417	/* Initialize Rx filter. */
2418	/* TODO: use better filter for monitor mode. */
2419	urtwn_write_4(sc, R92C_RCR,
2420	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2421	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2422	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2423	/* Accept all multicast frames. */
2424	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2425	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2426	/* Accept all management frames. */
2427	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2428	/* Reject all control frames. */
2429	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2430	/* Accept all data frames. */
2431	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2432}
2433
2434static void
2435urtwn_edca_init(struct urtwn_softc *sc)
2436{
2437	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2438	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2439	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2440	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2441	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2442	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2443	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2444	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2445}
2446
2447void
2448urtwn_write_txpower(struct urtwn_softc *sc, int chain,
2449    uint16_t power[URTWN_RIDX_COUNT])
2450{
2451	uint32_t reg;
2452
2453	/* Write per-CCK rate Tx power. */
2454	if (chain == 0) {
2455		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2456		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2457		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2458		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2459		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2460		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2461		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2462		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2463	} else {
2464		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2465		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2466		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2467		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2468		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2469		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2470		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2471		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2472	}
2473	/* Write per-OFDM rate Tx power. */
2474	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2475	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2476	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2477	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2478	    SM(R92C_TXAGC_RATE18, power[ 7]));
2479	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2480	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2481	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2482	    SM(R92C_TXAGC_RATE48, power[10]) |
2483	    SM(R92C_TXAGC_RATE54, power[11]));
2484	/* Write per-MCS Tx power. */
2485	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2486	    SM(R92C_TXAGC_MCS00,  power[12]) |
2487	    SM(R92C_TXAGC_MCS01,  power[13]) |
2488	    SM(R92C_TXAGC_MCS02,  power[14]) |
2489	    SM(R92C_TXAGC_MCS03,  power[15]));
2490	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2491	    SM(R92C_TXAGC_MCS04,  power[16]) |
2492	    SM(R92C_TXAGC_MCS05,  power[17]) |
2493	    SM(R92C_TXAGC_MCS06,  power[18]) |
2494	    SM(R92C_TXAGC_MCS07,  power[19]));
2495	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2496	    SM(R92C_TXAGC_MCS08,  power[20]) |
2497	    SM(R92C_TXAGC_MCS09,  power[21]) |
2498	    SM(R92C_TXAGC_MCS10,  power[22]) |
2499	    SM(R92C_TXAGC_MCS11,  power[23]));
2500	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2501	    SM(R92C_TXAGC_MCS12,  power[24]) |
2502	    SM(R92C_TXAGC_MCS13,  power[25]) |
2503	    SM(R92C_TXAGC_MCS14,  power[26]) |
2504	    SM(R92C_TXAGC_MCS15,  power[27]));
2505}
2506
2507void
2508urtwn_get_txpower(struct urtwn_softc *sc, int chain,
2509    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2510    uint16_t power[URTWN_RIDX_COUNT])
2511{
2512	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2513	struct r92c_rom *rom = &sc->rom;
2514	uint16_t cckpow, ofdmpow, htpow, diff, max;
2515	const struct urtwn_txpwr *base;
2516	int ridx, chan, group;
2517
2518	/* Determine channel group. */
2519	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2520	if (chan <= 3)
2521		group = 0;
2522	else if (chan <= 9)
2523		group = 1;
2524	else
2525		group = 2;
2526
2527	/* Get original Tx power based on board type and RF chain. */
2528	if (!(sc->chip & URTWN_CHIP_92C)) {
2529		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2530			base = &rtl8188ru_txagc[chain];
2531		else
2532			base = &rtl8192cu_txagc[chain];
2533	} else
2534		base = &rtl8192cu_txagc[chain];
2535
2536	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2537	if (sc->regulatory == 0) {
2538		for (ridx = 0; ridx <= 3; ridx++)
2539			power[ridx] = base->pwr[0][ridx];
2540	}
2541	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2542		if (sc->regulatory == 3) {
2543			power[ridx] = base->pwr[0][ridx];
2544			/* Apply vendor limits. */
2545			if (extc != NULL)
2546				max = rom->ht40_max_pwr[group];
2547			else
2548				max = rom->ht20_max_pwr[group];
2549			max = (max >> (chain * 4)) & 0xf;
2550			if (power[ridx] > max)
2551				power[ridx] = max;
2552		} else if (sc->regulatory == 1) {
2553			if (extc == NULL)
2554				power[ridx] = base->pwr[group][ridx];
2555		} else if (sc->regulatory != 2)
2556			power[ridx] = base->pwr[0][ridx];
2557	}
2558
2559	/* Compute per-CCK rate Tx power. */
2560	cckpow = rom->cck_tx_pwr[chain][group];
2561	for (ridx = 0; ridx <= 3; ridx++) {
2562		power[ridx] += cckpow;
2563		if (power[ridx] > R92C_MAX_TX_PWR)
2564			power[ridx] = R92C_MAX_TX_PWR;
2565	}
2566
2567	htpow = rom->ht40_1s_tx_pwr[chain][group];
2568	if (sc->ntxchains > 1) {
2569		/* Apply reduction for 2 spatial streams. */
2570		diff = rom->ht40_2s_tx_pwr_diff[group];
2571		diff = (diff >> (chain * 4)) & 0xf;
2572		htpow = (htpow > diff) ? htpow - diff : 0;
2573	}
2574
2575	/* Compute per-OFDM rate Tx power. */
2576	diff = rom->ofdm_tx_pwr_diff[group];
2577	diff = (diff >> (chain * 4)) & 0xf;
2578	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2579	for (ridx = 4; ridx <= 11; ridx++) {
2580		power[ridx] += ofdmpow;
2581		if (power[ridx] > R92C_MAX_TX_PWR)
2582			power[ridx] = R92C_MAX_TX_PWR;
2583	}
2584
2585	/* Compute per-MCS Tx power. */
2586	if (extc == NULL) {
2587		diff = rom->ht20_tx_pwr_diff[group];
2588		diff = (diff >> (chain * 4)) & 0xf;
2589		htpow += diff;	/* HT40->HT20 correction. */
2590	}
2591	for (ridx = 12; ridx <= 27; ridx++) {
2592		power[ridx] += htpow;
2593		if (power[ridx] > R92C_MAX_TX_PWR)
2594			power[ridx] = R92C_MAX_TX_PWR;
2595	}
2596#ifdef URTWN_DEBUG
2597	if (urtwn_debug >= 4) {
2598		/* Dump per-rate Tx power values. */
2599		printf("Tx power for chain %d:\n", chain);
2600		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
2601			printf("Rate %d = %u\n", ridx, power[ridx]);
2602	}
2603#endif
2604}
2605
2606void
2607urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
2608    struct ieee80211_channel *extc)
2609{
2610	uint16_t power[URTWN_RIDX_COUNT];
2611	int i;
2612
2613	for (i = 0; i < sc->ntxchains; i++) {
2614		/* Compute per-rate Tx power values. */
2615		urtwn_get_txpower(sc, i, c, extc, power);
2616		/* Write per-rate Tx power values to hardware. */
2617		urtwn_write_txpower(sc, i, power);
2618	}
2619}
2620
2621static void
2622urtwn_scan_start(struct ieee80211com *ic)
2623{
2624	/* XXX do nothing?  */
2625}
2626
2627static void
2628urtwn_scan_end(struct ieee80211com *ic)
2629{
2630	/* XXX do nothing?  */
2631}
2632
2633static void
2634urtwn_set_channel(struct ieee80211com *ic)
2635{
2636	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
2637
2638	URTWN_LOCK(sc);
2639	urtwn_set_chan(sc, ic->ic_curchan, NULL);
2640	URTWN_UNLOCK(sc);
2641}
2642
2643static void
2644urtwn_update_mcast(struct ifnet *ifp)
2645{
2646	/* XXX do nothing?  */
2647}
2648
2649static void
2650urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
2651    struct ieee80211_channel *extc)
2652{
2653	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2654	uint32_t reg;
2655	u_int chan;
2656	int i;
2657
2658	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2659	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2660		device_printf(sc->sc_dev,
2661		    "%s: invalid channel %x\n", __func__, chan);
2662		return;
2663	}
2664
2665	/* Set Tx power for this new channel. */
2666	urtwn_set_txpower(sc, c, extc);
2667
2668	for (i = 0; i < sc->nrxchains; i++) {
2669		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2670		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2671	}
2672#ifndef IEEE80211_NO_HT
2673	if (extc != NULL) {
2674		/* Is secondary channel below or above primary? */
2675		int prichlo = c->ic_freq < extc->ic_freq;
2676
2677		urtwn_write_1(sc, R92C_BWOPMODE,
2678		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2679
2680		reg = urtwn_read_1(sc, R92C_RRSR + 2);
2681		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2682		urtwn_write_1(sc, R92C_RRSR + 2, reg);
2683
2684		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2685		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2686		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2687		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2688
2689		/* Set CCK side band. */
2690		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2691		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2692		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2693
2694		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
2695		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2696		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2697
2698		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2699		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2700		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2701
2702		reg = urtwn_bb_read(sc, 0x818);
2703		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2704		urtwn_bb_write(sc, 0x818, reg);
2705
2706		/* Select 40MHz bandwidth. */
2707		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2708		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2709	} else
2710#endif
2711	{
2712		urtwn_write_1(sc, R92C_BWOPMODE,
2713		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2714
2715		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2716		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2717		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2718		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2719
2720		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2721		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2722		    R92C_FPGA0_ANAPARAM2_CBW20);
2723
2724		/* Select 20MHz bandwidth. */
2725		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2726		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2727	}
2728}
2729
2730static void
2731urtwn_iq_calib(struct urtwn_softc *sc)
2732{
2733	/* TODO */
2734}
2735
2736static void
2737urtwn_lc_calib(struct urtwn_softc *sc)
2738{
2739	uint32_t rf_ac[2];
2740	uint8_t txmode;
2741	int i;
2742
2743	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2744	if ((txmode & 0x70) != 0) {
2745		/* Disable all continuous Tx. */
2746		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2747
2748		/* Set RF mode to standby mode. */
2749		for (i = 0; i < sc->nrxchains; i++) {
2750			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
2751			urtwn_rf_write(sc, i, R92C_RF_AC,
2752			    RW(rf_ac[i], R92C_RF_AC_MODE,
2753				R92C_RF_AC_MODE_STANDBY));
2754		}
2755	} else {
2756		/* Block all Tx queues. */
2757		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
2758	}
2759	/* Start calibration. */
2760	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2761	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2762
2763	/* Give calibration the time to complete. */
2764	usb_pause_mtx(&sc->sc_mtx, 100);
2765
2766	/* Restore configuration. */
2767	if ((txmode & 0x70) != 0) {
2768		/* Restore Tx mode. */
2769		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2770		/* Restore RF mode. */
2771		for (i = 0; i < sc->nrxchains; i++)
2772			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2773	} else {
2774		/* Unblock all Tx queues. */
2775		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2776	}
2777}
2778
2779static void
2780urtwn_init_locked(void *arg)
2781{
2782	struct urtwn_softc *sc = arg;
2783	struct ifnet *ifp = sc->sc_ifp;
2784	uint32_t reg;
2785	int error;
2786
2787	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2788		urtwn_stop_locked(ifp, 0);
2789
2790	/* Init firmware commands ring. */
2791	sc->fwcur = 0;
2792
2793	/* Allocate Tx/Rx buffers. */
2794	error = urtwn_alloc_rx_list(sc);
2795	if (error != 0)
2796		goto fail;
2797
2798	error = urtwn_alloc_tx_list(sc);
2799	if (error != 0)
2800		goto fail;
2801
2802	/* Power on adapter. */
2803	error = urtwn_power_on(sc);
2804	if (error != 0)
2805		goto fail;
2806
2807	/* Initialize DMA. */
2808	error = urtwn_dma_init(sc);
2809	if (error != 0)
2810		goto fail;
2811
2812	/* Set info size in Rx descriptors (in 64-bit words). */
2813	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
2814
2815	/* Init interrupts. */
2816	urtwn_write_4(sc, R92C_HISR, 0xffffffff);
2817	urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
2818
2819	/* Set MAC address. */
2820	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
2821	    IEEE80211_ADDR_LEN);
2822
2823	/* Set initial network type. */
2824	reg = urtwn_read_4(sc, R92C_CR);
2825	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
2826	urtwn_write_4(sc, R92C_CR, reg);
2827
2828	urtwn_rxfilter_init(sc);
2829
2830	reg = urtwn_read_4(sc, R92C_RRSR);
2831	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
2832	urtwn_write_4(sc, R92C_RRSR, reg);
2833
2834	/* Set short/long retry limits. */
2835	urtwn_write_2(sc, R92C_RL,
2836	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
2837
2838	/* Initialize EDCA parameters. */
2839	urtwn_edca_init(sc);
2840
2841	/* Setup rate fallback. */
2842	urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
2843	urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
2844	urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
2845	urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
2846
2847	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
2848	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
2849	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
2850	/* Set ACK timeout. */
2851	urtwn_write_1(sc, R92C_ACKTO, 0x40);
2852
2853	/* Setup USB aggregation. */
2854	reg = urtwn_read_4(sc, R92C_TDECTRL);
2855	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
2856	urtwn_write_4(sc, R92C_TDECTRL, reg);
2857	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
2858	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
2859	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
2860	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2861	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2862	    R92C_USB_SPECIAL_OPTION_AGG_EN);
2863	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
2864	urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
2865	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
2866	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
2867
2868	/* Initialize beacon parameters. */
2869	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
2870	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
2871	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
2872	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
2873
2874	/* Setup AMPDU aggregation. */
2875	urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
2876	urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
2877	urtwn_write_2(sc, 0x4ca, 0x0708);
2878
2879	urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
2880	urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
2881
2882	/* Load 8051 microcode. */
2883	error = urtwn_load_firmware(sc);
2884	if (error != 0)
2885		goto fail;
2886
2887	/* Initialize MAC/BB/RF blocks. */
2888	urtwn_mac_init(sc);
2889	urtwn_bb_init(sc);
2890	urtwn_rf_init(sc);
2891
2892	/* Turn CCK and OFDM blocks on. */
2893	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2894	reg |= R92C_RFMOD_CCK_EN;
2895	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2896	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2897	reg |= R92C_RFMOD_OFDM_EN;
2898	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2899
2900	/* Clear per-station keys table. */
2901	urtwn_cam_init(sc);
2902
2903	/* Enable hardware sequence numbering. */
2904	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
2905
2906	/* Perform LO and IQ calibrations. */
2907	urtwn_iq_calib(sc);
2908	/* Perform LC calibration. */
2909	urtwn_lc_calib(sc);
2910
2911	/* Fix USB interference issue. */
2912	urtwn_write_1(sc, 0xfe40, 0xe0);
2913	urtwn_write_1(sc, 0xfe41, 0x8d);
2914	urtwn_write_1(sc, 0xfe42, 0x80);
2915
2916	urtwn_pa_bias_init(sc);
2917
2918	/* Initialize GPIO setting. */
2919	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
2920	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
2921
2922	/* Fix for lower temperature. */
2923	urtwn_write_1(sc, 0x15, 0xe9);
2924
2925	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
2926
2927	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2928	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2929
2930	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2931fail:
2932	return;
2933}
2934
2935static void
2936urtwn_init(void *arg)
2937{
2938	struct urtwn_softc *sc = arg;
2939
2940	URTWN_LOCK(sc);
2941	urtwn_init_locked(arg);
2942	URTWN_UNLOCK(sc);
2943}
2944
2945static void
2946urtwn_stop_locked(struct ifnet *ifp, int disable)
2947{
2948	struct urtwn_softc *sc = ifp->if_softc;
2949
2950	(void)disable;
2951	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2952
2953	callout_stop(&sc->sc_watchdog_ch);
2954	urtwn_abort_xfers(sc);
2955}
2956
2957static void
2958urtwn_stop(struct ifnet *ifp, int disable)
2959{
2960	struct urtwn_softc *sc = ifp->if_softc;
2961
2962	URTWN_LOCK(sc);
2963	urtwn_stop_locked(ifp, disable);
2964	URTWN_UNLOCK(sc);
2965}
2966
2967static void
2968urtwn_abort_xfers(struct urtwn_softc *sc)
2969{
2970	int i;
2971
2972	URTWN_ASSERT_LOCKED(sc);
2973
2974	/* abort any pending transfers */
2975	for (i = 0; i < URTWN_N_TRANSFER; i++)
2976		usbd_transfer_stop(sc->sc_xfer[i]);
2977}
2978
2979static int
2980urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2981    const struct ieee80211_bpf_params *params)
2982{
2983	struct ieee80211com *ic = ni->ni_ic;
2984	struct ifnet *ifp = ic->ic_ifp;
2985	struct urtwn_softc *sc = ifp->if_softc;
2986	struct urtwn_data *bf;
2987
2988	/* prevent management frames from being sent if we're not ready */
2989	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2990		m_freem(m);
2991		ieee80211_free_node(ni);
2992		return (ENETDOWN);
2993	}
2994	URTWN_LOCK(sc);
2995	bf = urtwn_getbuf(sc);
2996	if (bf == NULL) {
2997		ieee80211_free_node(ni);
2998		m_freem(m);
2999		URTWN_UNLOCK(sc);
3000		return (ENOBUFS);
3001	}
3002
3003	ifp->if_opackets++;
3004	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3005		ieee80211_free_node(ni);
3006		ifp->if_oerrors++;
3007		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3008		URTWN_UNLOCK(sc);
3009		return (EIO);
3010	}
3011	URTWN_UNLOCK(sc);
3012
3013	sc->sc_txtimer = 5;
3014	return (0);
3015}
3016
3017static device_method_t urtwn_methods[] = {
3018	/* Device interface */
3019	DEVMETHOD(device_probe,		urtwn_match),
3020	DEVMETHOD(device_attach,	urtwn_attach),
3021	DEVMETHOD(device_detach,	urtwn_detach),
3022
3023	{ 0, 0 }
3024};
3025
3026static driver_t urtwn_driver = {
3027	"urtwn",
3028	urtwn_methods,
3029	sizeof(struct urtwn_softc)
3030};
3031
3032static devclass_t urtwn_devclass;
3033
3034DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3035MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3036MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3037MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3038MODULE_VERSION(urtwn, 1);
3039