if_urtwn.c revision 281918
1251538Srpaulo/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2251538Srpaulo
3251538Srpaulo/*-
4251538Srpaulo * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5264912Skevlo * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6251538Srpaulo *
7251538Srpaulo * Permission to use, copy, modify, and distribute this software for any
8251538Srpaulo * purpose with or without fee is hereby granted, provided that the above
9251538Srpaulo * copyright notice and this permission notice appear in all copies.
10251538Srpaulo *
11251538Srpaulo * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12251538Srpaulo * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13251538Srpaulo * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14251538Srpaulo * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15251538Srpaulo * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16251538Srpaulo * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17251538Srpaulo * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18251538Srpaulo */
19251538Srpaulo
20251538Srpaulo#include <sys/cdefs.h>
21251538Srpaulo__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 281918 2015-04-24 04:57:18Z kevlo $");
22251538Srpaulo
23251538Srpaulo/*
24264912Skevlo * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25251538Srpaulo */
26251538Srpaulo
27251538Srpaulo#include <sys/param.h>
28251538Srpaulo#include <sys/sockio.h>
29251538Srpaulo#include <sys/sysctl.h>
30251538Srpaulo#include <sys/lock.h>
31251538Srpaulo#include <sys/mutex.h>
32251538Srpaulo#include <sys/mbuf.h>
33251538Srpaulo#include <sys/kernel.h>
34251538Srpaulo#include <sys/socket.h>
35251538Srpaulo#include <sys/systm.h>
36251538Srpaulo#include <sys/malloc.h>
37251538Srpaulo#include <sys/module.h>
38251538Srpaulo#include <sys/bus.h>
39251538Srpaulo#include <sys/endian.h>
40251538Srpaulo#include <sys/linker.h>
41251538Srpaulo#include <sys/firmware.h>
42251538Srpaulo#include <sys/kdb.h>
43251538Srpaulo
44251538Srpaulo#include <machine/bus.h>
45251538Srpaulo#include <machine/resource.h>
46251538Srpaulo#include <sys/rman.h>
47251538Srpaulo
48251538Srpaulo#include <net/bpf.h>
49251538Srpaulo#include <net/if.h>
50257176Sglebius#include <net/if_var.h>
51251538Srpaulo#include <net/if_arp.h>
52251538Srpaulo#include <net/ethernet.h>
53251538Srpaulo#include <net/if_dl.h>
54251538Srpaulo#include <net/if_media.h>
55251538Srpaulo#include <net/if_types.h>
56251538Srpaulo
57251538Srpaulo#include <netinet/in.h>
58251538Srpaulo#include <netinet/in_systm.h>
59251538Srpaulo#include <netinet/in_var.h>
60251538Srpaulo#include <netinet/if_ether.h>
61251538Srpaulo#include <netinet/ip.h>
62251538Srpaulo
63251538Srpaulo#include <net80211/ieee80211_var.h>
64251538Srpaulo#include <net80211/ieee80211_regdomain.h>
65251538Srpaulo#include <net80211/ieee80211_radiotap.h>
66251538Srpaulo#include <net80211/ieee80211_ratectl.h>
67251538Srpaulo
68251538Srpaulo#include <dev/usb/usb.h>
69251538Srpaulo#include <dev/usb/usbdi.h>
70251538Srpaulo#include "usbdevs.h"
71251538Srpaulo
72251538Srpaulo#define USB_DEBUG_VAR urtwn_debug
73251538Srpaulo#include <dev/usb/usb_debug.h>
74251538Srpaulo
75251538Srpaulo#include <dev/usb/wlan/if_urtwnreg.h>
76251538Srpaulo
77251538Srpaulo#ifdef USB_DEBUG
78251538Srpaulostatic int urtwn_debug = 0;
79251538Srpaulo
80251538SrpauloSYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
81276701ShselaskySYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
82251538Srpaulo    "Debug level");
83251538Srpaulo#endif
84251538Srpaulo
85252406Srpaulo#define	URTWN_RSSI(r)  (r) - 110
86251538Srpaulo#define	IEEE80211_HAS_ADDR4(wh)	\
87251538Srpaulo	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
88251538Srpaulo
89251538Srpaulo/* various supported device vendors/products */
90251596Srpaulostatic const STRUCT_USB_HOST_ID urtwn_devs[] = {
91251538Srpaulo#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
92264912Skevlo#define	URTWN_RTL8188E_DEV(v,p)	\
93264912Skevlo	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
94264912Skevlo#define URTWN_RTL8188E  1
95251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_1),
96251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_2),
97251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8192CU),
98251538Srpaulo	URTWN_DEV(ASUS,		RTL8192CU),
99266721Skevlo	URTWN_DEV(ASUS,		USBN10NANO),
100251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
101251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
102251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CU),
103251538Srpaulo	URTWN_DEV(BELKIN,	F7D2102),
104251538Srpaulo	URTWN_DEV(BELKIN,	RTL8188CU),
105251538Srpaulo	URTWN_DEV(BELKIN,	RTL8192CU),
106251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_1),
107251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_2),
108251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_3),
109251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_4),
110251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_5),
111251538Srpaulo	URTWN_DEV(COREGA,	RTL8192CU),
112251538Srpaulo	URTWN_DEV(DLINK,	RTL8188CU),
113251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_1),
114251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_2),
115251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_3),
116252196Skevlo	URTWN_DEV(DLINK,	DWA131B),
117251538Srpaulo	URTWN_DEV(EDIMAX,	EW7811UN),
118251538Srpaulo	URTWN_DEV(EDIMAX,	RTL8192CU),
119251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8188CU),
120251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8192CU),
121251538Srpaulo	URTWN_DEV(GUILLEMOT,	HWNUP150),
122251538Srpaulo	URTWN_DEV(HAWKING,	RTL8192CU),
123251538Srpaulo	URTWN_DEV(HP3,		RTL8188CU),
124251538Srpaulo	URTWN_DEV(NETGEAR,	WNA1000M),
125251538Srpaulo	URTWN_DEV(NETGEAR,	RTL8192CU),
126251538Srpaulo	URTWN_DEV(NETGEAR4,	RTL8188CU),
127251538Srpaulo	URTWN_DEV(NOVATECH,	RTL8188CU),
128251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_1),
129251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_2),
130251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_3),
131251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_4),
132251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CUS),
133251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8192CU),
134251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_0),
135251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_1),
136251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CTV),
137251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_0),
138251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_1),
139251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_2),
140251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
141251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CUS),
142251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_1),
143251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_2),
144272410Shselasky	URTWN_DEV(REALTEK,	RTL8188RU_3),
145251538Srpaulo	URTWN_DEV(REALTEK,	RTL8191CU),
146251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CE),
147251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CU),
148257543Salfred	URTWN_DEV(REALTEK, 	RTL8188CU_0),
149251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
150251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
151251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8192CU),
152251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8188CU),
153251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8192CU),
154251538Srpaulo	URTWN_DEV(ZYXEL,	RTL8192CU),
155264912Skevlo	/* URTWN_RTL8188E */
156273589Skevlo	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
157270191Skevlo	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
158273589Skevlo	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
159264912Skevlo	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
160264912Skevlo	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
161264912Skevlo#undef URTWN_RTL8188E_DEV
162251538Srpaulo#undef URTWN_DEV
163251538Srpaulo};
164251538Srpaulo
165251538Srpaulostatic device_probe_t	urtwn_match;
166251538Srpaulostatic device_attach_t	urtwn_attach;
167251538Srpaulostatic device_detach_t	urtwn_detach;
168251538Srpaulo
169251538Srpaulostatic usb_callback_t   urtwn_bulk_tx_callback;
170251538Srpaulostatic usb_callback_t	urtwn_bulk_rx_callback;
171251538Srpaulo
172251538Srpaulostatic usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
173251538Srpaulo			    struct usb_device_request *req, void *data);
174251538Srpaulostatic struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
175251538Srpaulo		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
176251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN],
177251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN]);
178251538Srpaulostatic void		urtwn_vap_delete(struct ieee80211vap *);
179281069Srpaulostatic struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
180251538Srpaulo			    int *);
181281069Srpaulostatic struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
182251538Srpaulo			    int *, int8_t *);
183251538Srpaulostatic void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
184281069Srpaulostatic int		urtwn_alloc_list(struct urtwn_softc *,
185251538Srpaulo			    struct urtwn_data[], int, int);
186251538Srpaulostatic int		urtwn_alloc_rx_list(struct urtwn_softc *);
187251538Srpaulostatic int		urtwn_alloc_tx_list(struct urtwn_softc *);
188251538Srpaulostatic void		urtwn_free_tx_list(struct urtwn_softc *);
189251538Srpaulostatic void		urtwn_free_rx_list(struct urtwn_softc *);
190251538Srpaulostatic void		urtwn_free_list(struct urtwn_softc *,
191251538Srpaulo			    struct urtwn_data data[], int);
192251538Srpaulostatic struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
193251538Srpaulostatic struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
194281069Srpaulostatic int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
195251538Srpaulo			    uint8_t *, int);
196251538Srpaulostatic void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
197251538Srpaulostatic void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
198251538Srpaulostatic void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
199281069Srpaulostatic int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
200251538Srpaulo			    uint8_t *, int);
201251538Srpaulostatic uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
202251538Srpaulostatic uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
203251538Srpaulostatic uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
204281069Srpaulostatic int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
205251538Srpaulo			    const void *, int);
206264912Skevlostatic void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
207264912Skevlo			    uint8_t, uint32_t);
208281069Srpaulostatic void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
209264912Skevlo			    uint8_t, uint32_t);
210251538Srpaulostatic uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
211281069Srpaulostatic int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
212251538Srpaulo			    uint32_t);
213251538Srpaulostatic uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
214251538Srpaulostatic void		urtwn_efuse_read(struct urtwn_softc *);
215264912Skevlostatic void		urtwn_efuse_switch_power(struct urtwn_softc *);
216251538Srpaulostatic int		urtwn_read_chipid(struct urtwn_softc *);
217251538Srpaulostatic void		urtwn_read_rom(struct urtwn_softc *);
218264912Skevlostatic void		urtwn_r88e_read_rom(struct urtwn_softc *);
219251538Srpaulostatic int		urtwn_ra_init(struct urtwn_softc *);
220251538Srpaulostatic void		urtwn_tsf_sync_enable(struct urtwn_softc *);
221251538Srpaulostatic void		urtwn_set_led(struct urtwn_softc *, int, int);
222281069Srpaulostatic int		urtwn_newstate(struct ieee80211vap *,
223251538Srpaulo			    enum ieee80211_state, int);
224251538Srpaulostatic void		urtwn_watchdog(void *);
225251538Srpaulostatic void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
226251538Srpaulostatic int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
227264912Skevlostatic int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
228251538Srpaulostatic int		urtwn_tx_start(struct urtwn_softc *,
229251538Srpaulo			    struct ieee80211_node *, struct mbuf *,
230251538Srpaulo			    struct urtwn_data *);
231251538Srpaulostatic void		urtwn_start(struct ifnet *);
232261863Srpaulostatic void		urtwn_start_locked(struct ifnet *,
233261863Srpaulo			    struct urtwn_softc *);
234251538Srpaulostatic int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
235264912Skevlostatic int		urtwn_r92c_power_on(struct urtwn_softc *);
236264912Skevlostatic int		urtwn_r88e_power_on(struct urtwn_softc *);
237251538Srpaulostatic int		urtwn_llt_init(struct urtwn_softc *);
238251538Srpaulostatic void		urtwn_fw_reset(struct urtwn_softc *);
239264912Skevlostatic void		urtwn_r88e_fw_reset(struct urtwn_softc *);
240281069Srpaulostatic int		urtwn_fw_loadpage(struct urtwn_softc *, int,
241251538Srpaulo			    const uint8_t *, int);
242251538Srpaulostatic int		urtwn_load_firmware(struct urtwn_softc *);
243264912Skevlostatic int		urtwn_r92c_dma_init(struct urtwn_softc *);
244264912Skevlostatic int		urtwn_r88e_dma_init(struct urtwn_softc *);
245251538Srpaulostatic void		urtwn_mac_init(struct urtwn_softc *);
246251538Srpaulostatic void		urtwn_bb_init(struct urtwn_softc *);
247251538Srpaulostatic void		urtwn_rf_init(struct urtwn_softc *);
248251538Srpaulostatic void		urtwn_cam_init(struct urtwn_softc *);
249251538Srpaulostatic void		urtwn_pa_bias_init(struct urtwn_softc *);
250251538Srpaulostatic void		urtwn_rxfilter_init(struct urtwn_softc *);
251251538Srpaulostatic void		urtwn_edca_init(struct urtwn_softc *);
252281069Srpaulostatic void		urtwn_write_txpower(struct urtwn_softc *, int,
253251538Srpaulo			    uint16_t[]);
254251538Srpaulostatic void		urtwn_get_txpower(struct urtwn_softc *, int,
255281069Srpaulo		      	    struct ieee80211_channel *,
256251538Srpaulo			    struct ieee80211_channel *, uint16_t[]);
257264912Skevlostatic void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
258281069Srpaulo		      	    struct ieee80211_channel *,
259264912Skevlo			    struct ieee80211_channel *, uint16_t[]);
260251538Srpaulostatic void		urtwn_set_txpower(struct urtwn_softc *,
261281069Srpaulo		    	    struct ieee80211_channel *,
262251538Srpaulo			    struct ieee80211_channel *);
263251538Srpaulostatic void		urtwn_scan_start(struct ieee80211com *);
264251538Srpaulostatic void		urtwn_scan_end(struct ieee80211com *);
265251538Srpaulostatic void		urtwn_set_channel(struct ieee80211com *);
266251538Srpaulostatic void		urtwn_set_chan(struct urtwn_softc *,
267281069Srpaulo		    	    struct ieee80211_channel *,
268251538Srpaulo			    struct ieee80211_channel *);
269251538Srpaulostatic void		urtwn_update_mcast(struct ifnet *);
270251538Srpaulostatic void		urtwn_iq_calib(struct urtwn_softc *);
271251538Srpaulostatic void		urtwn_lc_calib(struct urtwn_softc *);
272251538Srpaulostatic void		urtwn_init(void *);
273251538Srpaulostatic void		urtwn_init_locked(void *);
274263153Skevlostatic void		urtwn_stop(struct ifnet *);
275263153Skevlostatic void		urtwn_stop_locked(struct ifnet *);
276251538Srpaulostatic void		urtwn_abort_xfers(struct urtwn_softc *);
277251538Srpaulostatic int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
278251538Srpaulo			    const struct ieee80211_bpf_params *);
279266472Shselaskystatic void		urtwn_ms_delay(struct urtwn_softc *);
280251538Srpaulo
281251538Srpaulo/* Aliases. */
282251538Srpaulo#define	urtwn_bb_write	urtwn_write_4
283251538Srpaulo#define urtwn_bb_read	urtwn_read_4
284251538Srpaulo
285251538Srpaulostatic const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
286251538Srpaulo	[URTWN_BULK_RX] = {
287251538Srpaulo		.type = UE_BULK,
288251538Srpaulo		.endpoint = UE_ADDR_ANY,
289251538Srpaulo		.direction = UE_DIR_IN,
290251538Srpaulo		.bufsize = URTWN_RXBUFSZ,
291251538Srpaulo		.flags = {
292251538Srpaulo			.pipe_bof = 1,
293251538Srpaulo			.short_xfer_ok = 1
294251538Srpaulo		},
295251538Srpaulo		.callback = urtwn_bulk_rx_callback,
296251538Srpaulo	},
297251538Srpaulo	[URTWN_BULK_TX_BE] = {
298251538Srpaulo		.type = UE_BULK,
299251538Srpaulo		.endpoint = 0x03,
300251538Srpaulo		.direction = UE_DIR_OUT,
301251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
302251538Srpaulo		.flags = {
303251538Srpaulo			.ext_buffer = 1,
304251538Srpaulo			.pipe_bof = 1,
305251538Srpaulo			.force_short_xfer = 1
306251538Srpaulo		},
307251538Srpaulo		.callback = urtwn_bulk_tx_callback,
308251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
309251538Srpaulo	},
310251538Srpaulo	[URTWN_BULK_TX_BK] = {
311251538Srpaulo		.type = UE_BULK,
312251538Srpaulo		.endpoint = 0x03,
313251538Srpaulo		.direction = UE_DIR_OUT,
314251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
315251538Srpaulo		.flags = {
316251538Srpaulo			.ext_buffer = 1,
317251538Srpaulo			.pipe_bof = 1,
318251538Srpaulo			.force_short_xfer = 1,
319251538Srpaulo		},
320251538Srpaulo		.callback = urtwn_bulk_tx_callback,
321251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
322251538Srpaulo	},
323251538Srpaulo	[URTWN_BULK_TX_VI] = {
324251538Srpaulo		.type = UE_BULK,
325251538Srpaulo		.endpoint = 0x02,
326251538Srpaulo		.direction = UE_DIR_OUT,
327251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
328251538Srpaulo		.flags = {
329251538Srpaulo			.ext_buffer = 1,
330251538Srpaulo			.pipe_bof = 1,
331251538Srpaulo			.force_short_xfer = 1
332251538Srpaulo		},
333251538Srpaulo		.callback = urtwn_bulk_tx_callback,
334251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
335251538Srpaulo	},
336251538Srpaulo	[URTWN_BULK_TX_VO] = {
337251538Srpaulo		.type = UE_BULK,
338251538Srpaulo		.endpoint = 0x02,
339251538Srpaulo		.direction = UE_DIR_OUT,
340251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
341251538Srpaulo		.flags = {
342251538Srpaulo			.ext_buffer = 1,
343251538Srpaulo			.pipe_bof = 1,
344251538Srpaulo			.force_short_xfer = 1
345251538Srpaulo		},
346251538Srpaulo		.callback = urtwn_bulk_tx_callback,
347251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
348251538Srpaulo	},
349251538Srpaulo};
350251538Srpaulo
351251538Srpaulostatic int
352251538Srpaulourtwn_match(device_t self)
353251538Srpaulo{
354251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
355251538Srpaulo
356251538Srpaulo	if (uaa->usb_mode != USB_MODE_HOST)
357251538Srpaulo		return (ENXIO);
358251538Srpaulo	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
359251538Srpaulo		return (ENXIO);
360251538Srpaulo	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
361251538Srpaulo		return (ENXIO);
362251538Srpaulo
363251538Srpaulo	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
364251538Srpaulo}
365251538Srpaulo
366251538Srpaulostatic int
367251538Srpaulourtwn_attach(device_t self)
368251538Srpaulo{
369251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
370251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
371251538Srpaulo	struct ifnet *ifp;
372251538Srpaulo	struct ieee80211com *ic;
373251538Srpaulo	uint8_t iface_index, bands;
374251538Srpaulo	int error;
375251538Srpaulo
376251538Srpaulo	device_set_usb_desc(self);
377251538Srpaulo	sc->sc_udev = uaa->device;
378251538Srpaulo	sc->sc_dev = self;
379264912Skevlo	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
380264912Skevlo		sc->chip |= URTWN_CHIP_88E;
381251538Srpaulo
382251538Srpaulo	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
383251538Srpaulo	    MTX_NETWORK_LOCK, MTX_DEF);
384251538Srpaulo	callout_init(&sc->sc_watchdog_ch, 0);
385251538Srpaulo
386251538Srpaulo	iface_index = URTWN_IFACE_INDEX;
387251538Srpaulo	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
388251538Srpaulo	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
389251538Srpaulo	if (error) {
390251538Srpaulo		device_printf(self, "could not allocate USB transfers, "
391251538Srpaulo		    "err=%s\n", usbd_errstr(error));
392251538Srpaulo		goto detach;
393251538Srpaulo	}
394251538Srpaulo
395251538Srpaulo	URTWN_LOCK(sc);
396251538Srpaulo
397251538Srpaulo	error = urtwn_read_chipid(sc);
398251538Srpaulo	if (error) {
399251538Srpaulo		device_printf(sc->sc_dev, "unsupported test chip\n");
400251538Srpaulo		URTWN_UNLOCK(sc);
401251538Srpaulo		goto detach;
402251538Srpaulo	}
403251538Srpaulo
404251538Srpaulo	/* Determine number of Tx/Rx chains. */
405251538Srpaulo	if (sc->chip & URTWN_CHIP_92C) {
406251538Srpaulo		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
407251538Srpaulo		sc->nrxchains = 2;
408251538Srpaulo	} else {
409251538Srpaulo		sc->ntxchains = 1;
410251538Srpaulo		sc->nrxchains = 1;
411251538Srpaulo	}
412251538Srpaulo
413264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
414264912Skevlo		urtwn_r88e_read_rom(sc);
415264912Skevlo	else
416264912Skevlo		urtwn_read_rom(sc);
417264912Skevlo
418251538Srpaulo	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
419251538Srpaulo	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
420264912Skevlo	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
421251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
422251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
423251538Srpaulo	    "8188CUS", sc->ntxchains, sc->nrxchains);
424251538Srpaulo
425251538Srpaulo	URTWN_UNLOCK(sc);
426251538Srpaulo
427251538Srpaulo	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
428251538Srpaulo	if (ifp == NULL) {
429251538Srpaulo		device_printf(sc->sc_dev, "can not if_alloc()\n");
430251538Srpaulo		goto detach;
431251538Srpaulo	}
432251538Srpaulo	ic = ifp->if_l2com;
433251538Srpaulo
434251538Srpaulo	ifp->if_softc = sc;
435251538Srpaulo	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
436251538Srpaulo	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
437251538Srpaulo	ifp->if_init = urtwn_init;
438251538Srpaulo	ifp->if_ioctl = urtwn_ioctl;
439251538Srpaulo	ifp->if_start = urtwn_start;
440251538Srpaulo	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
441251538Srpaulo	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
442251538Srpaulo	IFQ_SET_READY(&ifp->if_snd);
443251538Srpaulo
444251538Srpaulo	ic->ic_ifp = ifp;
445251538Srpaulo	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
446251538Srpaulo	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
447251538Srpaulo
448251538Srpaulo	/* set device capabilities */
449251538Srpaulo	ic->ic_caps =
450251538Srpaulo		  IEEE80211_C_STA		/* station mode */
451251538Srpaulo		| IEEE80211_C_MONITOR		/* monitor mode */
452251538Srpaulo		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
453251538Srpaulo		| IEEE80211_C_SHSLOT		/* short slot time supported */
454251538Srpaulo		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
455251538Srpaulo		| IEEE80211_C_WPA		/* 802.11i */
456251538Srpaulo		;
457251538Srpaulo
458251538Srpaulo	bands = 0;
459251538Srpaulo	setbit(&bands, IEEE80211_MODE_11B);
460251538Srpaulo	setbit(&bands, IEEE80211_MODE_11G);
461251538Srpaulo	ieee80211_init_channels(ic, NULL, &bands);
462251538Srpaulo
463251538Srpaulo	ieee80211_ifattach(ic, sc->sc_bssid);
464251538Srpaulo	ic->ic_raw_xmit = urtwn_raw_xmit;
465251538Srpaulo	ic->ic_scan_start = urtwn_scan_start;
466251538Srpaulo	ic->ic_scan_end = urtwn_scan_end;
467251538Srpaulo	ic->ic_set_channel = urtwn_set_channel;
468251538Srpaulo
469251538Srpaulo	ic->ic_vap_create = urtwn_vap_create;
470251538Srpaulo	ic->ic_vap_delete = urtwn_vap_delete;
471251538Srpaulo	ic->ic_update_mcast = urtwn_update_mcast;
472251538Srpaulo
473281069Srpaulo	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
474251538Srpaulo	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
475251538Srpaulo	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
476251538Srpaulo	    URTWN_RX_RADIOTAP_PRESENT);
477251538Srpaulo
478251538Srpaulo	if (bootverbose)
479251538Srpaulo		ieee80211_announce(ic);
480251538Srpaulo
481251538Srpaulo	return (0);
482251538Srpaulo
483251538Srpaulodetach:
484251538Srpaulo	urtwn_detach(self);
485251538Srpaulo	return (ENXIO);			/* failure */
486251538Srpaulo}
487251538Srpaulo
488251538Srpaulostatic int
489251538Srpaulourtwn_detach(device_t self)
490251538Srpaulo{
491251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
492251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
493251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
494263153Skevlo	unsigned int x;
495281069Srpaulo
496263153Skevlo	/* Prevent further ioctls. */
497263153Skevlo	URTWN_LOCK(sc);
498263153Skevlo	sc->sc_flags |= URTWN_DETACHED;
499263153Skevlo	URTWN_UNLOCK(sc);
500251538Srpaulo
501263153Skevlo	urtwn_stop(ifp);
502251538Srpaulo
503251538Srpaulo	callout_drain(&sc->sc_watchdog_ch);
504251538Srpaulo
505263153Skevlo	/* Prevent further allocations from RX/TX data lists. */
506263153Skevlo	URTWN_LOCK(sc);
507263153Skevlo	STAILQ_INIT(&sc->sc_tx_active);
508263153Skevlo	STAILQ_INIT(&sc->sc_tx_inactive);
509263153Skevlo	STAILQ_INIT(&sc->sc_tx_pending);
510263153Skevlo
511263153Skevlo	STAILQ_INIT(&sc->sc_rx_active);
512263153Skevlo	STAILQ_INIT(&sc->sc_rx_inactive);
513263153Skevlo	URTWN_UNLOCK(sc);
514263153Skevlo
515263153Skevlo	/* drain USB transfers */
516263153Skevlo	for (x = 0; x != URTWN_N_TRANSFER; x++)
517263153Skevlo		usbd_transfer_drain(sc->sc_xfer[x]);
518263153Skevlo
519263153Skevlo	/* Free data buffers. */
520263153Skevlo	URTWN_LOCK(sc);
521263153Skevlo	urtwn_free_tx_list(sc);
522263153Skevlo	urtwn_free_rx_list(sc);
523263153Skevlo	URTWN_UNLOCK(sc);
524263153Skevlo
525251538Srpaulo	/* stop all USB transfers */
526251538Srpaulo	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
527251538Srpaulo	ieee80211_ifdetach(ic);
528251538Srpaulo
529251538Srpaulo	if_free(ifp);
530251538Srpaulo	mtx_destroy(&sc->sc_mtx);
531251538Srpaulo
532251538Srpaulo	return (0);
533251538Srpaulo}
534251538Srpaulo
535251538Srpaulostatic void
536251538Srpaulourtwn_free_tx_list(struct urtwn_softc *sc)
537251538Srpaulo{
538251538Srpaulo	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
539251538Srpaulo}
540251538Srpaulo
541251538Srpaulostatic void
542251538Srpaulourtwn_free_rx_list(struct urtwn_softc *sc)
543251538Srpaulo{
544251538Srpaulo	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
545251538Srpaulo}
546251538Srpaulo
547251538Srpaulostatic void
548251538Srpaulourtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
549251538Srpaulo{
550251538Srpaulo	int i;
551251538Srpaulo
552251538Srpaulo	for (i = 0; i < ndata; i++) {
553251538Srpaulo		struct urtwn_data *dp = &data[i];
554251538Srpaulo
555251538Srpaulo		if (dp->buf != NULL) {
556251538Srpaulo			free(dp->buf, M_USBDEV);
557251538Srpaulo			dp->buf = NULL;
558251538Srpaulo		}
559251538Srpaulo		if (dp->ni != NULL) {
560251538Srpaulo			ieee80211_free_node(dp->ni);
561251538Srpaulo			dp->ni = NULL;
562251538Srpaulo		}
563251538Srpaulo	}
564251538Srpaulo}
565251538Srpaulo
566251538Srpaulostatic usb_error_t
567251538Srpaulourtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
568251538Srpaulo    void *data)
569251538Srpaulo{
570251538Srpaulo	usb_error_t err;
571251538Srpaulo	int ntries = 10;
572251538Srpaulo
573251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
574251538Srpaulo
575251538Srpaulo	while (ntries--) {
576251538Srpaulo		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
577251538Srpaulo		    req, data, 0, NULL, 250 /* ms */);
578251538Srpaulo		if (err == 0)
579251538Srpaulo			break;
580251538Srpaulo
581251538Srpaulo		DPRINTFN(1, "Control request failed, %s (retrying)\n",
582251538Srpaulo		    usbd_errstr(err));
583251538Srpaulo		usb_pause_mtx(&sc->sc_mtx, hz / 100);
584251538Srpaulo	}
585251538Srpaulo	return (err);
586251538Srpaulo}
587251538Srpaulo
588251538Srpaulostatic struct ieee80211vap *
589251538Srpaulourtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
590251538Srpaulo    enum ieee80211_opmode opmode, int flags,
591251538Srpaulo    const uint8_t bssid[IEEE80211_ADDR_LEN],
592251538Srpaulo    const uint8_t mac[IEEE80211_ADDR_LEN])
593251538Srpaulo{
594251538Srpaulo	struct urtwn_vap *uvp;
595251538Srpaulo	struct ieee80211vap *vap;
596251538Srpaulo
597251538Srpaulo	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
598251538Srpaulo		return (NULL);
599251538Srpaulo
600251538Srpaulo	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
601251538Srpaulo	    M_80211_VAP, M_NOWAIT | M_ZERO);
602251538Srpaulo	if (uvp == NULL)
603251538Srpaulo		return (NULL);
604251538Srpaulo	vap = &uvp->vap;
605251538Srpaulo	/* enable s/w bmiss handling for sta mode */
606251538Srpaulo
607281069Srpaulo	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
608257743Shselasky	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
609257743Shselasky		/* out of memory */
610257743Shselasky		free(uvp, M_80211_VAP);
611257743Shselasky		return (NULL);
612257743Shselasky	}
613257743Shselasky
614251538Srpaulo	/* override state transition machine */
615251538Srpaulo	uvp->newstate = vap->iv_newstate;
616251538Srpaulo	vap->iv_newstate = urtwn_newstate;
617251538Srpaulo
618251538Srpaulo	/* complete setup */
619251538Srpaulo	ieee80211_vap_attach(vap, ieee80211_media_change,
620251538Srpaulo	    ieee80211_media_status);
621251538Srpaulo	ic->ic_opmode = opmode;
622251538Srpaulo	return (vap);
623251538Srpaulo}
624251538Srpaulo
625251538Srpaulostatic void
626251538Srpaulourtwn_vap_delete(struct ieee80211vap *vap)
627251538Srpaulo{
628251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
629251538Srpaulo
630251538Srpaulo	ieee80211_vap_detach(vap);
631251538Srpaulo	free(uvp, M_80211_VAP);
632251538Srpaulo}
633251538Srpaulo
634251538Srpaulostatic struct mbuf *
635251538Srpaulourtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
636251538Srpaulo{
637251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
638251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
639251538Srpaulo	struct ieee80211_frame *wh;
640251538Srpaulo	struct mbuf *m;
641251538Srpaulo	struct r92c_rx_stat *stat;
642251538Srpaulo	uint32_t rxdw0, rxdw3;
643251538Srpaulo	uint8_t rate;
644251538Srpaulo	int8_t rssi = 0;
645251538Srpaulo	int infosz;
646251538Srpaulo
647251538Srpaulo	/*
648251538Srpaulo	 * don't pass packets to the ieee80211 framework if the driver isn't
649251538Srpaulo	 * RUNNING.
650251538Srpaulo	 */
651251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
652251538Srpaulo		return (NULL);
653251538Srpaulo
654251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
655251538Srpaulo	rxdw0 = le32toh(stat->rxdw0);
656251538Srpaulo	rxdw3 = le32toh(stat->rxdw3);
657251538Srpaulo
658251538Srpaulo	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
659251538Srpaulo		/*
660251538Srpaulo		 * This should not happen since we setup our Rx filter
661251538Srpaulo		 * to not receive these frames.
662251538Srpaulo		 */
663271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
664251538Srpaulo		return (NULL);
665251538Srpaulo	}
666271303Skevlo	if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) {
667271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
668271303Skevlo		return (NULL);
669271303Skevlo	}
670251538Srpaulo
671251538Srpaulo	rate = MS(rxdw3, R92C_RXDW3_RATE);
672251538Srpaulo	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
673251538Srpaulo
674251538Srpaulo	/* Get RSSI from PHY status descriptor if present. */
675251538Srpaulo	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
676281069Srpaulo		if (sc->chip & URTWN_CHIP_88E)
677264912Skevlo			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
678264912Skevlo		else
679264912Skevlo			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
680251538Srpaulo		/* Update our average RSSI. */
681251538Srpaulo		urtwn_update_avgrssi(sc, rate, rssi);
682252405Srpaulo		/*
683252405Srpaulo		 * Convert the RSSI to a range that will be accepted
684252405Srpaulo		 * by net80211.
685252405Srpaulo		 */
686252405Srpaulo		rssi = URTWN_RSSI(rssi);
687251538Srpaulo	}
688251538Srpaulo
689260463Skevlo	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
690251538Srpaulo	if (m == NULL) {
691251538Srpaulo		device_printf(sc->sc_dev, "could not create RX mbuf\n");
692251538Srpaulo		return (NULL);
693251538Srpaulo	}
694251538Srpaulo
695251538Srpaulo	/* Finalize mbuf. */
696251538Srpaulo	m->m_pkthdr.rcvif = ifp;
697251538Srpaulo	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
698251538Srpaulo	memcpy(mtod(m, uint8_t *), wh, pktlen);
699251538Srpaulo	m->m_pkthdr.len = m->m_len = pktlen;
700251538Srpaulo
701251538Srpaulo	if (ieee80211_radiotap_active(ic)) {
702251538Srpaulo		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
703251538Srpaulo
704251538Srpaulo		tap->wr_flags = 0;
705251538Srpaulo		/* Map HW rate index to 802.11 rate. */
706251538Srpaulo		if (!(rxdw3 & R92C_RXDW3_HT)) {
707251538Srpaulo			switch (rate) {
708251538Srpaulo			/* CCK. */
709251538Srpaulo			case  0: tap->wr_rate =   2; break;
710251538Srpaulo			case  1: tap->wr_rate =   4; break;
711251538Srpaulo			case  2: tap->wr_rate =  11; break;
712251538Srpaulo			case  3: tap->wr_rate =  22; break;
713251538Srpaulo			/* OFDM. */
714251538Srpaulo			case  4: tap->wr_rate =  12; break;
715251538Srpaulo			case  5: tap->wr_rate =  18; break;
716251538Srpaulo			case  6: tap->wr_rate =  24; break;
717251538Srpaulo			case  7: tap->wr_rate =  36; break;
718251538Srpaulo			case  8: tap->wr_rate =  48; break;
719251538Srpaulo			case  9: tap->wr_rate =  72; break;
720251538Srpaulo			case 10: tap->wr_rate =  96; break;
721251538Srpaulo			case 11: tap->wr_rate = 108; break;
722251538Srpaulo			}
723251538Srpaulo		} else if (rate >= 12) {	/* MCS0~15. */
724251538Srpaulo			/* Bit 7 set means HT MCS instead of rate. */
725251538Srpaulo			tap->wr_rate = 0x80 | (rate - 12);
726251538Srpaulo		}
727251538Srpaulo		tap->wr_dbm_antsignal = rssi;
728251538Srpaulo		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
729251538Srpaulo		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
730251538Srpaulo	}
731251538Srpaulo
732251538Srpaulo	*rssi_p = rssi;
733251538Srpaulo
734251538Srpaulo	return (m);
735251538Srpaulo}
736251538Srpaulo
737251538Srpaulostatic struct mbuf *
738251538Srpaulourtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
739251538Srpaulo    int8_t *nf)
740251538Srpaulo{
741251538Srpaulo	struct urtwn_softc *sc = data->sc;
742251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
743251538Srpaulo	struct r92c_rx_stat *stat;
744251538Srpaulo	struct mbuf *m, *m0 = NULL, *prevm = NULL;
745251538Srpaulo	uint32_t rxdw0;
746251538Srpaulo	uint8_t *buf;
747251538Srpaulo	int len, totlen, pktlen, infosz, npkts;
748251538Srpaulo
749251538Srpaulo	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
750251538Srpaulo
751251538Srpaulo	if (len < sizeof(*stat)) {
752271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
753251538Srpaulo		return (NULL);
754251538Srpaulo	}
755251538Srpaulo
756251538Srpaulo	buf = data->buf;
757251538Srpaulo	/* Get the number of encapsulated frames. */
758251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
759251538Srpaulo	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
760251538Srpaulo	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
761251538Srpaulo
762251538Srpaulo	/* Process all of them. */
763251538Srpaulo	while (npkts-- > 0) {
764251538Srpaulo		if (len < sizeof(*stat))
765251538Srpaulo			break;
766251538Srpaulo		stat = (struct r92c_rx_stat *)buf;
767251538Srpaulo		rxdw0 = le32toh(stat->rxdw0);
768251538Srpaulo
769251538Srpaulo		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
770251538Srpaulo		if (pktlen == 0)
771251538Srpaulo			break;
772251538Srpaulo
773251538Srpaulo		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
774251538Srpaulo
775251538Srpaulo		/* Make sure everything fits in xfer. */
776251538Srpaulo		totlen = sizeof(*stat) + infosz + pktlen;
777251538Srpaulo		if (totlen > len)
778251538Srpaulo			break;
779251538Srpaulo
780251538Srpaulo		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
781251538Srpaulo		if (m0 == NULL)
782251538Srpaulo			m0 = m;
783251538Srpaulo		if (prevm == NULL)
784251538Srpaulo			prevm = m;
785251538Srpaulo		else {
786251538Srpaulo			prevm->m_next = m;
787251538Srpaulo			prevm = m;
788251538Srpaulo		}
789251538Srpaulo
790251538Srpaulo		/* Next chunk is 128-byte aligned. */
791251538Srpaulo		totlen = (totlen + 127) & ~127;
792251538Srpaulo		buf += totlen;
793251538Srpaulo		len -= totlen;
794251538Srpaulo	}
795251538Srpaulo
796251538Srpaulo	return (m0);
797251538Srpaulo}
798251538Srpaulo
799251538Srpaulostatic void
800251538Srpaulourtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
801251538Srpaulo{
802251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
803251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
804251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
805251538Srpaulo	struct ieee80211_frame *wh;
806251538Srpaulo	struct ieee80211_node *ni;
807251538Srpaulo	struct mbuf *m = NULL, *next;
808251538Srpaulo	struct urtwn_data *data;
809251538Srpaulo	int8_t nf;
810251538Srpaulo	int rssi = 1;
811251538Srpaulo
812251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
813251538Srpaulo
814251538Srpaulo	switch (USB_GET_STATE(xfer)) {
815251538Srpaulo	case USB_ST_TRANSFERRED:
816251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
817251538Srpaulo		if (data == NULL)
818251538Srpaulo			goto tr_setup;
819251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
820251538Srpaulo		m = urtwn_rxeof(xfer, data, &rssi, &nf);
821251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
822251538Srpaulo		/* FALLTHROUGH */
823251538Srpaulo	case USB_ST_SETUP:
824251538Srpaulotr_setup:
825251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_inactive);
826251538Srpaulo		if (data == NULL) {
827251538Srpaulo			KASSERT(m == NULL, ("mbuf isn't NULL"));
828251538Srpaulo			return;
829251538Srpaulo		}
830251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
831251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
832251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf,
833251538Srpaulo		    usbd_xfer_max_len(xfer));
834251538Srpaulo		usbd_transfer_submit(xfer);
835251538Srpaulo
836251538Srpaulo		/*
837251538Srpaulo		 * To avoid LOR we should unlock our private mutex here to call
838251538Srpaulo		 * ieee80211_input() because here is at the end of a USB
839251538Srpaulo		 * callback and safe to unlock.
840251538Srpaulo		 */
841251538Srpaulo		URTWN_UNLOCK(sc);
842251538Srpaulo		while (m != NULL) {
843251538Srpaulo			next = m->m_next;
844251538Srpaulo			m->m_next = NULL;
845251538Srpaulo			wh = mtod(m, struct ieee80211_frame *);
846251538Srpaulo			ni = ieee80211_find_rxnode(ic,
847251538Srpaulo			    (struct ieee80211_frame_min *)wh);
848251538Srpaulo			nf = URTWN_NOISE_FLOOR;
849251538Srpaulo			if (ni != NULL) {
850251538Srpaulo				(void)ieee80211_input(ni, m, rssi, nf);
851251538Srpaulo				ieee80211_free_node(ni);
852251538Srpaulo			} else
853251538Srpaulo				(void)ieee80211_input_all(ic, m, rssi, nf);
854251538Srpaulo			m = next;
855251538Srpaulo		}
856251538Srpaulo		URTWN_LOCK(sc);
857251538Srpaulo		break;
858251538Srpaulo	default:
859251538Srpaulo		/* needs it to the inactive queue due to a error. */
860251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
861251538Srpaulo		if (data != NULL) {
862251538Srpaulo			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
863251538Srpaulo			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
864251538Srpaulo		}
865251538Srpaulo		if (error != USB_ERR_CANCELLED) {
866251538Srpaulo			usbd_xfer_set_stall(xfer);
867271866Sglebius			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
868251538Srpaulo			goto tr_setup;
869251538Srpaulo		}
870251538Srpaulo		break;
871251538Srpaulo	}
872251538Srpaulo}
873251538Srpaulo
874251538Srpaulostatic void
875251538Srpaulourtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
876251538Srpaulo{
877251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
878251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
879251538Srpaulo	struct mbuf *m;
880251538Srpaulo
881251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
882251538Srpaulo
883251538Srpaulo	/*
884251538Srpaulo	 * Do any tx complete callback.  Note this must be done before releasing
885251538Srpaulo	 * the node reference.
886251538Srpaulo	 */
887251538Srpaulo	if (data->m) {
888251538Srpaulo		m = data->m;
889251538Srpaulo		if (m->m_flags & M_TXCB) {
890251538Srpaulo			/* XXX status? */
891251538Srpaulo			ieee80211_process_callback(data->ni, m, 0);
892251538Srpaulo		}
893251538Srpaulo		m_freem(m);
894251538Srpaulo		data->m = NULL;
895251538Srpaulo	}
896251538Srpaulo	if (data->ni) {
897251538Srpaulo		ieee80211_free_node(data->ni);
898251538Srpaulo		data->ni = NULL;
899251538Srpaulo	}
900251538Srpaulo	sc->sc_txtimer = 0;
901271866Sglebius	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
902251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
903251538Srpaulo}
904251538Srpaulo
905251538Srpaulostatic void
906251538Srpaulourtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
907251538Srpaulo{
908251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
909251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
910251538Srpaulo	struct urtwn_data *data;
911251538Srpaulo
912251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
913251538Srpaulo
914251538Srpaulo	switch (USB_GET_STATE(xfer)){
915251538Srpaulo	case USB_ST_TRANSFERRED:
916251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
917251538Srpaulo		if (data == NULL)
918251538Srpaulo			goto tr_setup;
919251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
920251538Srpaulo		urtwn_txeof(xfer, data);
921251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
922251538Srpaulo		/* FALLTHROUGH */
923251538Srpaulo	case USB_ST_SETUP:
924251538Srpaulotr_setup:
925251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_pending);
926251538Srpaulo		if (data == NULL) {
927251538Srpaulo			DPRINTF("%s: empty pending queue\n", __func__);
928251538Srpaulo			return;
929251538Srpaulo		}
930251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
931251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
932251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
933251538Srpaulo		usbd_transfer_submit(xfer);
934261863Srpaulo		urtwn_start_locked(ifp, sc);
935251538Srpaulo		break;
936251538Srpaulo	default:
937251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
938251538Srpaulo		if (data == NULL)
939251538Srpaulo			goto tr_setup;
940251538Srpaulo		if (data->ni != NULL) {
941251538Srpaulo			ieee80211_free_node(data->ni);
942251538Srpaulo			data->ni = NULL;
943271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
944251538Srpaulo		}
945251538Srpaulo		if (error != USB_ERR_CANCELLED) {
946251538Srpaulo			usbd_xfer_set_stall(xfer);
947251538Srpaulo			goto tr_setup;
948251538Srpaulo		}
949251538Srpaulo		break;
950251538Srpaulo	}
951251538Srpaulo}
952251538Srpaulo
953251538Srpaulostatic struct urtwn_data *
954251538Srpaulo_urtwn_getbuf(struct urtwn_softc *sc)
955251538Srpaulo{
956251538Srpaulo	struct urtwn_data *bf;
957251538Srpaulo
958251538Srpaulo	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
959251538Srpaulo	if (bf != NULL)
960251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
961251538Srpaulo	else
962251538Srpaulo		bf = NULL;
963251538Srpaulo	if (bf == NULL)
964251538Srpaulo		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
965251538Srpaulo	return (bf);
966251538Srpaulo}
967251538Srpaulo
968251538Srpaulostatic struct urtwn_data *
969251538Srpaulourtwn_getbuf(struct urtwn_softc *sc)
970251538Srpaulo{
971251538Srpaulo        struct urtwn_data *bf;
972251538Srpaulo
973251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
974251538Srpaulo
975251538Srpaulo	bf = _urtwn_getbuf(sc);
976251538Srpaulo	if (bf == NULL) {
977251538Srpaulo		struct ifnet *ifp = sc->sc_ifp;
978251538Srpaulo		DPRINTF("%s: stop queue\n", __func__);
979251538Srpaulo		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
980251538Srpaulo	}
981251538Srpaulo	return (bf);
982251538Srpaulo}
983251538Srpaulo
984251538Srpaulostatic int
985251538Srpaulourtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
986251538Srpaulo    int len)
987251538Srpaulo{
988251538Srpaulo	usb_device_request_t req;
989251538Srpaulo
990251538Srpaulo	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
991251538Srpaulo	req.bRequest = R92C_REQ_REGS;
992251538Srpaulo	USETW(req.wValue, addr);
993251538Srpaulo	USETW(req.wIndex, 0);
994251538Srpaulo	USETW(req.wLength, len);
995251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
996251538Srpaulo}
997251538Srpaulo
998251538Srpaulostatic void
999251538Srpaulourtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1000251538Srpaulo{
1001251538Srpaulo	urtwn_write_region_1(sc, addr, &val, 1);
1002251538Srpaulo}
1003251538Srpaulo
1004251538Srpaulo
1005251538Srpaulostatic void
1006251538Srpaulourtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1007251538Srpaulo{
1008251538Srpaulo	val = htole16(val);
1009251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1010251538Srpaulo}
1011251538Srpaulo
1012251538Srpaulostatic void
1013251538Srpaulourtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1014251538Srpaulo{
1015251538Srpaulo	val = htole32(val);
1016251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1017251538Srpaulo}
1018251538Srpaulo
1019251538Srpaulostatic int
1020251538Srpaulourtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1021251538Srpaulo    int len)
1022251538Srpaulo{
1023251538Srpaulo	usb_device_request_t req;
1024251538Srpaulo
1025251538Srpaulo	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1026251538Srpaulo	req.bRequest = R92C_REQ_REGS;
1027251538Srpaulo	USETW(req.wValue, addr);
1028251538Srpaulo	USETW(req.wIndex, 0);
1029251538Srpaulo	USETW(req.wLength, len);
1030251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
1031251538Srpaulo}
1032251538Srpaulo
1033251538Srpaulostatic uint8_t
1034251538Srpaulourtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1035251538Srpaulo{
1036251538Srpaulo	uint8_t val;
1037251538Srpaulo
1038251538Srpaulo	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1039251538Srpaulo		return (0xff);
1040251538Srpaulo	return (val);
1041251538Srpaulo}
1042251538Srpaulo
1043251538Srpaulostatic uint16_t
1044251538Srpaulourtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1045251538Srpaulo{
1046251538Srpaulo	uint16_t val;
1047251538Srpaulo
1048251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1049251538Srpaulo		return (0xffff);
1050251538Srpaulo	return (le16toh(val));
1051251538Srpaulo}
1052251538Srpaulo
1053251538Srpaulostatic uint32_t
1054251538Srpaulourtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1055251538Srpaulo{
1056251538Srpaulo	uint32_t val;
1057251538Srpaulo
1058251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1059251538Srpaulo		return (0xffffffff);
1060251538Srpaulo	return (le32toh(val));
1061251538Srpaulo}
1062251538Srpaulo
1063251538Srpaulostatic int
1064251538Srpaulourtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1065251538Srpaulo{
1066251538Srpaulo	struct r92c_fw_cmd cmd;
1067251538Srpaulo	int ntries;
1068251538Srpaulo
1069251538Srpaulo	/* Wait for current FW box to be empty. */
1070251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1071251538Srpaulo		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1072251538Srpaulo			break;
1073266472Shselasky		urtwn_ms_delay(sc);
1074251538Srpaulo	}
1075251538Srpaulo	if (ntries == 100) {
1076251538Srpaulo		device_printf(sc->sc_dev,
1077251538Srpaulo		    "could not send firmware command\n");
1078251538Srpaulo		return (ETIMEDOUT);
1079251538Srpaulo	}
1080251538Srpaulo	memset(&cmd, 0, sizeof(cmd));
1081251538Srpaulo	cmd.id = id;
1082251538Srpaulo	if (len > 3)
1083251538Srpaulo		cmd.id |= R92C_CMD_FLAG_EXT;
1084251538Srpaulo	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1085251538Srpaulo	memcpy(cmd.msg, buf, len);
1086251538Srpaulo
1087251538Srpaulo	/* Write the first word last since that will trigger the FW. */
1088251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1089251538Srpaulo	    (uint8_t *)&cmd + 4, 2);
1090251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1091251538Srpaulo	    (uint8_t *)&cmd + 0, 4);
1092251538Srpaulo
1093251538Srpaulo	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1094251538Srpaulo	return (0);
1095251538Srpaulo}
1096251538Srpaulo
1097264912Skevlostatic __inline void
1098251538Srpaulourtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1099251538Srpaulo{
1100264912Skevlo
1101264912Skevlo	sc->sc_rf_write(sc, chain, addr, val);
1102264912Skevlo}
1103264912Skevlo
1104264912Skevlostatic void
1105264912Skevlourtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1106264912Skevlo    uint32_t val)
1107264912Skevlo{
1108251538Srpaulo	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1109251538Srpaulo	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1110251538Srpaulo	    SM(R92C_LSSI_PARAM_DATA, val));
1111251538Srpaulo}
1112251538Srpaulo
1113264912Skevlostatic void
1114264912Skevlourtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1115264912Skevlouint32_t val)
1116264912Skevlo{
1117264912Skevlo	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1118264912Skevlo	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1119264912Skevlo	    SM(R92C_LSSI_PARAM_DATA, val));
1120264912Skevlo}
1121264912Skevlo
1122251538Srpaulostatic uint32_t
1123251538Srpaulourtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1124251538Srpaulo{
1125251538Srpaulo	uint32_t reg[R92C_MAX_CHAINS], val;
1126251538Srpaulo
1127251538Srpaulo	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1128251538Srpaulo	if (chain != 0)
1129251538Srpaulo		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1130251538Srpaulo
1131251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1132251538Srpaulo	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1133266472Shselasky	urtwn_ms_delay(sc);
1134251538Srpaulo
1135251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1136251538Srpaulo	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1137251538Srpaulo	    R92C_HSSI_PARAM2_READ_EDGE);
1138266472Shselasky	urtwn_ms_delay(sc);
1139251538Srpaulo
1140251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1141251538Srpaulo	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1142266472Shselasky	urtwn_ms_delay(sc);
1143251538Srpaulo
1144251538Srpaulo	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1145251538Srpaulo		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1146251538Srpaulo	else
1147251538Srpaulo		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1148251538Srpaulo	return (MS(val, R92C_LSSI_READBACK_DATA));
1149251538Srpaulo}
1150251538Srpaulo
1151251538Srpaulostatic int
1152251538Srpaulourtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1153251538Srpaulo{
1154251538Srpaulo	int ntries;
1155251538Srpaulo
1156251538Srpaulo	urtwn_write_4(sc, R92C_LLT_INIT,
1157251538Srpaulo	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1158251538Srpaulo	    SM(R92C_LLT_INIT_ADDR, addr) |
1159251538Srpaulo	    SM(R92C_LLT_INIT_DATA, data));
1160251538Srpaulo	/* Wait for write operation to complete. */
1161251538Srpaulo	for (ntries = 0; ntries < 20; ntries++) {
1162251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1163251538Srpaulo		    R92C_LLT_INIT_OP_NO_ACTIVE)
1164251538Srpaulo			return (0);
1165266472Shselasky		urtwn_ms_delay(sc);
1166251538Srpaulo	}
1167251538Srpaulo	return (ETIMEDOUT);
1168251538Srpaulo}
1169251538Srpaulo
1170251538Srpaulostatic uint8_t
1171251538Srpaulourtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1172251538Srpaulo{
1173251538Srpaulo	uint32_t reg;
1174251538Srpaulo	int ntries;
1175251538Srpaulo
1176251538Srpaulo	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1177251538Srpaulo	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1178251538Srpaulo	reg &= ~R92C_EFUSE_CTRL_VALID;
1179251538Srpaulo	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1180251538Srpaulo	/* Wait for read operation to complete. */
1181251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1182251538Srpaulo		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1183251538Srpaulo		if (reg & R92C_EFUSE_CTRL_VALID)
1184251538Srpaulo			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1185266472Shselasky		urtwn_ms_delay(sc);
1186251538Srpaulo	}
1187281069Srpaulo	device_printf(sc->sc_dev,
1188251538Srpaulo	    "could not read efuse byte at address 0x%x\n", addr);
1189251538Srpaulo	return (0xff);
1190251538Srpaulo}
1191251538Srpaulo
1192251538Srpaulostatic void
1193251538Srpaulourtwn_efuse_read(struct urtwn_softc *sc)
1194251538Srpaulo{
1195251538Srpaulo	uint8_t *rom = (uint8_t *)&sc->rom;
1196251538Srpaulo	uint16_t addr = 0;
1197251538Srpaulo	uint32_t reg;
1198281592Skevlo	uint8_t off, msk, vol;
1199251538Srpaulo	int i;
1200251538Srpaulo
1201264912Skevlo	urtwn_efuse_switch_power(sc);
1202264912Skevlo
1203251538Srpaulo	memset(&sc->rom, 0xff, sizeof(sc->rom));
1204251538Srpaulo	while (addr < 512) {
1205251538Srpaulo		reg = urtwn_efuse_read_1(sc, addr);
1206251538Srpaulo		if (reg == 0xff)
1207251538Srpaulo			break;
1208251538Srpaulo		addr++;
1209251538Srpaulo		off = reg >> 4;
1210251538Srpaulo		msk = reg & 0xf;
1211251538Srpaulo		for (i = 0; i < 4; i++) {
1212251538Srpaulo			if (msk & (1 << i))
1213251538Srpaulo				continue;
1214251538Srpaulo			rom[off * 8 + i * 2 + 0] =
1215251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1216251538Srpaulo			addr++;
1217251538Srpaulo			rom[off * 8 + i * 2 + 1] =
1218251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1219251538Srpaulo			addr++;
1220251538Srpaulo		}
1221251538Srpaulo	}
1222251538Srpaulo#ifdef URTWN_DEBUG
1223251538Srpaulo	if (urtwn_debug >= 2) {
1224251538Srpaulo		/* Dump ROM content. */
1225251538Srpaulo		printf("\n");
1226251538Srpaulo		for (i = 0; i < sizeof(sc->rom); i++)
1227251538Srpaulo			printf("%02x:", rom[i]);
1228251538Srpaulo		printf("\n");
1229251538Srpaulo	}
1230251538Srpaulo#endif
1231281592Skevlo	/* Disable LDO 2.5V. */
1232281592Skevlo	vol = urtwn_read_1(sc, R92C_EFUSE_TEST + 3);
1233281592Skevlo	urtwn_write_1(sc, R92C_EFUSE_TEST + 3, vol & ~(0x80));
1234281592Skevlo
1235251538Srpaulo}
1236264912Skevlostatic void
1237264912Skevlourtwn_efuse_switch_power(struct urtwn_softc *sc)
1238264912Skevlo{
1239264912Skevlo	uint32_t reg;
1240251538Srpaulo
1241281918Skevlo	if (sc->chip & URTWN_CHIP_88E)
1242281918Skevlo		urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1243281918Skevlo
1244264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1245264912Skevlo	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1246264912Skevlo		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1247264912Skevlo		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1248264912Skevlo	}
1249264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1250264912Skevlo	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1251264912Skevlo		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1252264912Skevlo		    reg | R92C_SYS_FUNC_EN_ELDR);
1253264912Skevlo	}
1254264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1255264912Skevlo	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1256264912Skevlo	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1257264912Skevlo		urtwn_write_2(sc, R92C_SYS_CLKR,
1258264912Skevlo		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1259264912Skevlo	}
1260281592Skevlo
1261281918Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
1262281918Skevlo		uint8_t vol;
1263281918Skevlo
1264281918Skevlo		/* Enable LDO 2.5V. */
1265281918Skevlo		vol = urtwn_read_1(sc, R92C_EFUSE_TEST + 3);
1266281918Skevlo		vol &= 0x0f;
1267281918Skevlo		vol |= 0x30;
1268281918Skevlo		urtwn_write_1(sc, R92C_EFUSE_TEST + 3, (vol | 0x80));
1269281918Skevlo	}
1270264912Skevlo}
1271264912Skevlo
1272251538Srpaulostatic int
1273251538Srpaulourtwn_read_chipid(struct urtwn_softc *sc)
1274251538Srpaulo{
1275251538Srpaulo	uint32_t reg;
1276251538Srpaulo
1277264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
1278264912Skevlo		return (0);
1279264912Skevlo
1280251538Srpaulo	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1281251538Srpaulo	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1282251538Srpaulo		return (EIO);
1283251538Srpaulo
1284251538Srpaulo	if (reg & R92C_SYS_CFG_TYPE_92C) {
1285251538Srpaulo		sc->chip |= URTWN_CHIP_92C;
1286251538Srpaulo		/* Check if it is a castrated 8192C. */
1287251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1288251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1289251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1290251538Srpaulo			sc->chip |= URTWN_CHIP_92C_1T2R;
1291251538Srpaulo	}
1292251538Srpaulo	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1293251538Srpaulo		sc->chip |= URTWN_CHIP_UMC;
1294251538Srpaulo		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1295251538Srpaulo			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1296251538Srpaulo	}
1297251538Srpaulo	return (0);
1298251538Srpaulo}
1299251538Srpaulo
1300251538Srpaulostatic void
1301251538Srpaulourtwn_read_rom(struct urtwn_softc *sc)
1302251538Srpaulo{
1303251538Srpaulo	struct r92c_rom *rom = &sc->rom;
1304251538Srpaulo
1305251538Srpaulo	/* Read full ROM image. */
1306251538Srpaulo	urtwn_efuse_read(sc);
1307251538Srpaulo
1308251538Srpaulo	/* XXX Weird but this is what the vendor driver does. */
1309251538Srpaulo	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1310251538Srpaulo	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1311251538Srpaulo
1312251538Srpaulo	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1313251538Srpaulo
1314251538Srpaulo	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1315251538Srpaulo	DPRINTF("regulatory type=%d\n", sc->regulatory);
1316264912Skevlo	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1317251538Srpaulo
1318264912Skevlo	sc->sc_rf_write = urtwn_r92c_rf_write;
1319264912Skevlo	sc->sc_power_on = urtwn_r92c_power_on;
1320264912Skevlo	sc->sc_dma_init = urtwn_r92c_dma_init;
1321251538Srpaulo}
1322251538Srpaulo
1323264912Skevlostatic void
1324264912Skevlourtwn_r88e_read_rom(struct urtwn_softc *sc)
1325264912Skevlo{
1326264912Skevlo	uint8_t *rom = sc->r88e_rom;
1327264912Skevlo	uint16_t addr = 0;
1328264912Skevlo	uint32_t reg;
1329264912Skevlo	uint8_t off, msk, tmp;
1330264912Skevlo	int i;
1331264912Skevlo
1332264982Sandreast	off = 0;
1333264912Skevlo	urtwn_efuse_switch_power(sc);
1334264912Skevlo
1335264912Skevlo	/* Read full ROM image. */
1336264912Skevlo	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1337281918Skevlo	while (addr < 512) {
1338264912Skevlo		reg = urtwn_efuse_read_1(sc, addr);
1339264912Skevlo		if (reg == 0xff)
1340264912Skevlo			break;
1341264912Skevlo		addr++;
1342264912Skevlo		if ((reg & 0x1f) == 0x0f) {
1343264912Skevlo			tmp = (reg & 0xe0) >> 5;
1344264912Skevlo			reg = urtwn_efuse_read_1(sc, addr);
1345264912Skevlo			if ((reg & 0x0f) != 0x0f)
1346264912Skevlo				off = ((reg & 0xf0) >> 1) | tmp;
1347264912Skevlo			addr++;
1348264912Skevlo		} else
1349264912Skevlo			off = reg >> 4;
1350264912Skevlo		msk = reg & 0xf;
1351264912Skevlo		for (i = 0; i < 4; i++) {
1352264912Skevlo			if (msk & (1 << i))
1353264912Skevlo				continue;
1354264912Skevlo			rom[off * 8 + i * 2 + 0] =
1355264912Skevlo			    urtwn_efuse_read_1(sc, addr);
1356264912Skevlo			addr++;
1357264912Skevlo			rom[off * 8 + i * 2 + 1] =
1358264912Skevlo			    urtwn_efuse_read_1(sc, addr);
1359264912Skevlo			addr++;
1360264912Skevlo		}
1361264912Skevlo	}
1362264912Skevlo
1363281918Skevlo	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1364281918Skevlo
1365264912Skevlo	addr = 0x10;
1366264912Skevlo	for (i = 0; i < 6; i++)
1367264912Skevlo		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1368264912Skevlo	for (i = 0; i < 5; i++)
1369264912Skevlo		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1370264912Skevlo	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1371264912Skevlo	if (sc->bw20_tx_pwr_diff & 0x08)
1372264912Skevlo		sc->bw20_tx_pwr_diff |= 0xf0;
1373264912Skevlo	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1374264912Skevlo	if (sc->ofdm_tx_pwr_diff & 0x08)
1375264912Skevlo		sc->ofdm_tx_pwr_diff |= 0xf0;
1376264912Skevlo	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1377264912Skevlo	IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->r88e_rom[0xd7]);
1378264912Skevlo
1379264912Skevlo	sc->sc_rf_write = urtwn_r88e_rf_write;
1380264912Skevlo	sc->sc_power_on = urtwn_r88e_power_on;
1381264912Skevlo	sc->sc_dma_init = urtwn_r88e_dma_init;
1382264912Skevlo}
1383264912Skevlo
1384251538Srpaulo/*
1385251538Srpaulo * Initialize rate adaptation in firmware.
1386251538Srpaulo */
1387251538Srpaulostatic int
1388251538Srpaulourtwn_ra_init(struct urtwn_softc *sc)
1389251538Srpaulo{
1390251538Srpaulo	static const uint8_t map[] =
1391251538Srpaulo	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1392251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1393251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1394251538Srpaulo	struct ieee80211_node *ni;
1395251538Srpaulo	struct ieee80211_rateset *rs;
1396251538Srpaulo	struct r92c_fw_cmd_macid_cfg cmd;
1397251538Srpaulo	uint32_t rates, basicrates;
1398251538Srpaulo	uint8_t mode;
1399251538Srpaulo	int maxrate, maxbasicrate, error, i, j;
1400251538Srpaulo
1401251538Srpaulo	ni = ieee80211_ref_node(vap->iv_bss);
1402251538Srpaulo	rs = &ni->ni_rates;
1403251538Srpaulo
1404251538Srpaulo	/* Get normal and basic rates mask. */
1405251538Srpaulo	rates = basicrates = 0;
1406251538Srpaulo	maxrate = maxbasicrate = 0;
1407251538Srpaulo	for (i = 0; i < rs->rs_nrates; i++) {
1408251538Srpaulo		/* Convert 802.11 rate to HW rate index. */
1409251538Srpaulo		for (j = 0; j < nitems(map); j++)
1410251538Srpaulo			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1411251538Srpaulo				break;
1412251538Srpaulo		if (j == nitems(map))	/* Unknown rate, skip. */
1413251538Srpaulo			continue;
1414251538Srpaulo		rates |= 1 << j;
1415251538Srpaulo		if (j > maxrate)
1416251538Srpaulo			maxrate = j;
1417251538Srpaulo		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1418251538Srpaulo			basicrates |= 1 << j;
1419251538Srpaulo			if (j > maxbasicrate)
1420251538Srpaulo				maxbasicrate = j;
1421251538Srpaulo		}
1422251538Srpaulo	}
1423251538Srpaulo	if (ic->ic_curmode == IEEE80211_MODE_11B)
1424251538Srpaulo		mode = R92C_RAID_11B;
1425251538Srpaulo	else
1426251538Srpaulo		mode = R92C_RAID_11BG;
1427251538Srpaulo	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1428251538Srpaulo	    mode, rates, basicrates);
1429251538Srpaulo
1430251538Srpaulo	/* Set rates mask for group addressed frames. */
1431251538Srpaulo	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1432251538Srpaulo	cmd.mask = htole32(mode << 28 | basicrates);
1433251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1434251538Srpaulo	if (error != 0) {
1435252401Srpaulo		ieee80211_free_node(ni);
1436251538Srpaulo		device_printf(sc->sc_dev,
1437251538Srpaulo		    "could not add broadcast station\n");
1438251538Srpaulo		return (error);
1439251538Srpaulo	}
1440251538Srpaulo	/* Set initial MRR rate. */
1441251538Srpaulo	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1442251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1443251538Srpaulo	    maxbasicrate);
1444251538Srpaulo
1445251538Srpaulo	/* Set rates mask for unicast frames. */
1446251538Srpaulo	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1447251538Srpaulo	cmd.mask = htole32(mode << 28 | rates);
1448251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1449251538Srpaulo	if (error != 0) {
1450252401Srpaulo		ieee80211_free_node(ni);
1451251538Srpaulo		device_printf(sc->sc_dev, "could not add BSS station\n");
1452251538Srpaulo		return (error);
1453251538Srpaulo	}
1454251538Srpaulo	/* Set initial MRR rate. */
1455251538Srpaulo	DPRINTF("maxrate=%d\n", maxrate);
1456251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1457251538Srpaulo	    maxrate);
1458251538Srpaulo
1459251538Srpaulo	/* Indicate highest supported rate. */
1460252403Srpaulo	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1461252401Srpaulo	ieee80211_free_node(ni);
1462252401Srpaulo
1463251538Srpaulo	return (0);
1464251538Srpaulo}
1465251538Srpaulo
1466251538Srpaulovoid
1467251538Srpaulourtwn_tsf_sync_enable(struct urtwn_softc *sc)
1468251538Srpaulo{
1469251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1470251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1471251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1472251538Srpaulo	struct ieee80211_node *ni = vap->iv_bss;
1473251538Srpaulo
1474251538Srpaulo	uint64_t tsf;
1475251538Srpaulo
1476251538Srpaulo	/* Enable TSF synchronization. */
1477251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1478251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1479251538Srpaulo
1480251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1481251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1482251538Srpaulo
1483251538Srpaulo	/* Set initial TSF. */
1484251538Srpaulo	memcpy(&tsf, ni->ni_tstamp.data, 8);
1485251538Srpaulo	tsf = le64toh(tsf);
1486251538Srpaulo	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1487251538Srpaulo	tsf -= IEEE80211_DUR_TU;
1488251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1489251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1490251538Srpaulo
1491251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1492251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1493251538Srpaulo}
1494251538Srpaulo
1495251538Srpaulostatic void
1496251538Srpaulourtwn_set_led(struct urtwn_softc *sc, int led, int on)
1497251538Srpaulo{
1498251538Srpaulo	uint8_t reg;
1499281069Srpaulo
1500251538Srpaulo	if (led == URTWN_LED_LINK) {
1501264912Skevlo		if (sc->chip & URTWN_CHIP_88E) {
1502264912Skevlo			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1503264912Skevlo			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1504264912Skevlo			if (!on) {
1505264912Skevlo				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1506264912Skevlo				urtwn_write_1(sc, R92C_LEDCFG2,
1507264912Skevlo				    reg | R92C_LEDCFG0_DIS);
1508264912Skevlo				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1509264912Skevlo				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1510264912Skevlo				    0xfe);
1511264912Skevlo			}
1512264912Skevlo		} else {
1513264912Skevlo			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1514264912Skevlo			if (!on)
1515264912Skevlo				reg |= R92C_LEDCFG0_DIS;
1516264912Skevlo			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1517264912Skevlo		}
1518264912Skevlo		sc->ledlink = on;       /* Save LED state. */
1519251538Srpaulo	}
1520251538Srpaulo}
1521251538Srpaulo
1522251538Srpaulostatic int
1523251538Srpaulourtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1524251538Srpaulo{
1525251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
1526251538Srpaulo	struct ieee80211com *ic = vap->iv_ic;
1527251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1528251538Srpaulo	struct ieee80211_node *ni;
1529251538Srpaulo	enum ieee80211_state ostate;
1530251538Srpaulo	uint32_t reg;
1531251538Srpaulo
1532251538Srpaulo	ostate = vap->iv_state;
1533251538Srpaulo	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1534251538Srpaulo	    ieee80211_state_name[nstate]);
1535251538Srpaulo
1536251538Srpaulo	IEEE80211_UNLOCK(ic);
1537251538Srpaulo	URTWN_LOCK(sc);
1538251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
1539251538Srpaulo
1540251538Srpaulo	if (ostate == IEEE80211_S_RUN) {
1541251538Srpaulo		/* Turn link LED off. */
1542251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1543251538Srpaulo
1544251538Srpaulo		/* Set media status to 'No Link'. */
1545251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1546251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1547251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1548251538Srpaulo
1549251538Srpaulo		/* Stop Rx of data frames. */
1550251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1551251538Srpaulo
1552251538Srpaulo		/* Rest TSF. */
1553251538Srpaulo		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1554251538Srpaulo
1555251538Srpaulo		/* Disable TSF synchronization. */
1556251538Srpaulo		urtwn_write_1(sc, R92C_BCN_CTRL,
1557251538Srpaulo		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1558251538Srpaulo		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1559251538Srpaulo
1560251538Srpaulo		/* Reset EDCA parameters. */
1561251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1562251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1563251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1564251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1565251538Srpaulo	}
1566251538Srpaulo
1567251538Srpaulo	switch (nstate) {
1568251538Srpaulo	case IEEE80211_S_INIT:
1569251538Srpaulo		/* Turn link LED off. */
1570251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1571251538Srpaulo		break;
1572251538Srpaulo	case IEEE80211_S_SCAN:
1573251538Srpaulo		if (ostate != IEEE80211_S_SCAN) {
1574251538Srpaulo			/* Allow Rx from any BSSID. */
1575251538Srpaulo			urtwn_write_4(sc, R92C_RCR,
1576251538Srpaulo			    urtwn_read_4(sc, R92C_RCR) &
1577251538Srpaulo			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1578251538Srpaulo
1579251538Srpaulo			/* Set gain for scanning. */
1580251538Srpaulo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1581251538Srpaulo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1582251538Srpaulo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1583251538Srpaulo
1584264912Skevlo			if (!(sc->chip & URTWN_CHIP_88E)) {
1585264912Skevlo				reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1586264912Skevlo				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1587264912Skevlo				urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1588264912Skevlo			}
1589251538Srpaulo		}
1590251538Srpaulo		/* Pause AC Tx queues. */
1591251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE,
1592251538Srpaulo		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1593251538Srpaulo		break;
1594251538Srpaulo	case IEEE80211_S_AUTH:
1595251538Srpaulo		/* Set initial gain under link. */
1596251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1597251538Srpaulo		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1598251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1599251538Srpaulo
1600264912Skevlo		if (!(sc->chip & URTWN_CHIP_88E)) {
1601264912Skevlo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1602264912Skevlo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1603264912Skevlo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1604264912Skevlo		}
1605251538Srpaulo		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1606251538Srpaulo		break;
1607251538Srpaulo	case IEEE80211_S_RUN:
1608251538Srpaulo		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1609251538Srpaulo			/* Enable Rx of data frames. */
1610251538Srpaulo			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1611251538Srpaulo
1612251538Srpaulo			/* Turn link LED on. */
1613251538Srpaulo			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1614251538Srpaulo			break;
1615251538Srpaulo		}
1616251538Srpaulo
1617251538Srpaulo		ni = ieee80211_ref_node(vap->iv_bss);
1618251538Srpaulo		/* Set media status to 'Associated'. */
1619251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1620251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1621251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1622251538Srpaulo
1623251538Srpaulo		/* Set BSSID. */
1624251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1625251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1626251538Srpaulo
1627251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1628251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1629251538Srpaulo		else	/* 802.11b/g */
1630251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1631251538Srpaulo
1632251538Srpaulo		/* Enable Rx of data frames. */
1633251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1634251538Srpaulo
1635251538Srpaulo		/* Flush all AC queues. */
1636251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1637251538Srpaulo
1638251538Srpaulo		/* Set beacon interval. */
1639251538Srpaulo		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1640251538Srpaulo
1641251538Srpaulo		/* Allow Rx from our BSSID only. */
1642251538Srpaulo		urtwn_write_4(sc, R92C_RCR,
1643251538Srpaulo		    urtwn_read_4(sc, R92C_RCR) |
1644251538Srpaulo		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1645251538Srpaulo
1646251538Srpaulo		/* Enable TSF synchronization. */
1647251538Srpaulo		urtwn_tsf_sync_enable(sc);
1648251538Srpaulo
1649251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1650251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1651251538Srpaulo		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1652251538Srpaulo		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1653251538Srpaulo		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1654251538Srpaulo		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1655251538Srpaulo
1656251538Srpaulo		/* Intialize rate adaptation. */
1657264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
1658264912Skevlo			ni->ni_txrate =
1659264912Skevlo			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1660281069Srpaulo		else
1661264912Skevlo			urtwn_ra_init(sc);
1662251538Srpaulo		/* Turn link LED on. */
1663251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1664251538Srpaulo
1665251538Srpaulo		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1666251538Srpaulo		/* Reset temperature calibration state machine. */
1667251538Srpaulo		sc->thcal_state = 0;
1668251538Srpaulo		sc->thcal_lctemp = 0;
1669251538Srpaulo		ieee80211_free_node(ni);
1670251538Srpaulo		break;
1671251538Srpaulo	default:
1672251538Srpaulo		break;
1673251538Srpaulo	}
1674251538Srpaulo	URTWN_UNLOCK(sc);
1675251538Srpaulo	IEEE80211_LOCK(ic);
1676251538Srpaulo	return(uvp->newstate(vap, nstate, arg));
1677251538Srpaulo}
1678251538Srpaulo
1679251538Srpaulostatic void
1680251538Srpaulourtwn_watchdog(void *arg)
1681251538Srpaulo{
1682251538Srpaulo	struct urtwn_softc *sc = arg;
1683251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1684251538Srpaulo
1685251538Srpaulo	if (sc->sc_txtimer > 0) {
1686251538Srpaulo		if (--sc->sc_txtimer == 0) {
1687251538Srpaulo			device_printf(sc->sc_dev, "device timeout\n");
1688271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1689251538Srpaulo			return;
1690251538Srpaulo		}
1691251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1692251538Srpaulo	}
1693251538Srpaulo}
1694251538Srpaulo
1695251538Srpaulostatic void
1696251538Srpaulourtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1697251538Srpaulo{
1698251538Srpaulo	int pwdb;
1699251538Srpaulo
1700251538Srpaulo	/* Convert antenna signal to percentage. */
1701251538Srpaulo	if (rssi <= -100 || rssi >= 20)
1702251538Srpaulo		pwdb = 0;
1703251538Srpaulo	else if (rssi >= 0)
1704251538Srpaulo		pwdb = 100;
1705251538Srpaulo	else
1706251538Srpaulo		pwdb = 100 + rssi;
1707264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
1708264912Skevlo		if (rate <= 3) {
1709264912Skevlo			/* CCK gain is smaller than OFDM/MCS gain. */
1710264912Skevlo			pwdb += 6;
1711264912Skevlo			if (pwdb > 100)
1712264912Skevlo				pwdb = 100;
1713264912Skevlo			if (pwdb <= 14)
1714264912Skevlo				pwdb -= 4;
1715264912Skevlo			else if (pwdb <= 26)
1716264912Skevlo				pwdb -= 8;
1717264912Skevlo			else if (pwdb <= 34)
1718264912Skevlo				pwdb -= 6;
1719264912Skevlo			else if (pwdb <= 42)
1720264912Skevlo				pwdb -= 2;
1721264912Skevlo		}
1722251538Srpaulo	}
1723251538Srpaulo	if (sc->avg_pwdb == -1)	/* Init. */
1724251538Srpaulo		sc->avg_pwdb = pwdb;
1725251538Srpaulo	else if (sc->avg_pwdb < pwdb)
1726251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1727251538Srpaulo	else
1728251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1729251538Srpaulo	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1730251538Srpaulo}
1731251538Srpaulo
1732251538Srpaulostatic int8_t
1733251538Srpaulourtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1734251538Srpaulo{
1735251538Srpaulo	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1736251538Srpaulo	struct r92c_rx_phystat *phy;
1737251538Srpaulo	struct r92c_rx_cck *cck;
1738251538Srpaulo	uint8_t rpt;
1739251538Srpaulo	int8_t rssi;
1740251538Srpaulo
1741251538Srpaulo	if (rate <= 3) {
1742251538Srpaulo		cck = (struct r92c_rx_cck *)physt;
1743251538Srpaulo		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1744251538Srpaulo			rpt = (cck->agc_rpt >> 5) & 0x3;
1745251538Srpaulo			rssi = (cck->agc_rpt & 0x1f) << 1;
1746251538Srpaulo		} else {
1747251538Srpaulo			rpt = (cck->agc_rpt >> 6) & 0x3;
1748251538Srpaulo			rssi = cck->agc_rpt & 0x3e;
1749251538Srpaulo		}
1750251538Srpaulo		rssi = cckoff[rpt] - rssi;
1751251538Srpaulo	} else {	/* OFDM/HT. */
1752251538Srpaulo		phy = (struct r92c_rx_phystat *)physt;
1753251538Srpaulo		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1754251538Srpaulo	}
1755251538Srpaulo	return (rssi);
1756251538Srpaulo}
1757251538Srpaulo
1758264912Skevlostatic int8_t
1759264912Skevlourtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1760264912Skevlo{
1761264912Skevlo	struct r92c_rx_phystat *phy;
1762264912Skevlo	struct r88e_rx_cck *cck;
1763264912Skevlo	uint8_t cck_agc_rpt, lna_idx, vga_idx;
1764264912Skevlo	int8_t rssi;
1765264912Skevlo
1766264972Skevlo	rssi = 0;
1767264912Skevlo	if (rate <= 3) {
1768264912Skevlo		cck = (struct r88e_rx_cck *)physt;
1769264912Skevlo		cck_agc_rpt = cck->agc_rpt;
1770264912Skevlo		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1771281069Srpaulo		vga_idx = cck_agc_rpt & 0x1f;
1772264912Skevlo		switch (lna_idx) {
1773264912Skevlo		case 7:
1774264912Skevlo			if (vga_idx <= 27)
1775264912Skevlo				rssi = -100 + 2* (27 - vga_idx);
1776264912Skevlo			else
1777264912Skevlo				rssi = -100;
1778264912Skevlo			break;
1779264912Skevlo		case 6:
1780264912Skevlo			rssi = -48 + 2 * (2 - vga_idx);
1781264912Skevlo			break;
1782264912Skevlo		case 5:
1783264912Skevlo			rssi = -42 + 2 * (7 - vga_idx);
1784264912Skevlo			break;
1785264912Skevlo		case 4:
1786264912Skevlo			rssi = -36 + 2 * (7 - vga_idx);
1787264912Skevlo			break;
1788264912Skevlo		case 3:
1789264912Skevlo			rssi = -24 + 2 * (7 - vga_idx);
1790264912Skevlo			break;
1791264912Skevlo		case 2:
1792264912Skevlo			rssi = -12 + 2 * (5 - vga_idx);
1793264912Skevlo			break;
1794264912Skevlo		case 1:
1795264912Skevlo			rssi = 8 - (2 * vga_idx);
1796264912Skevlo			break;
1797264912Skevlo		case 0:
1798264912Skevlo			rssi = 14 - (2 * vga_idx);
1799264912Skevlo			break;
1800264912Skevlo		}
1801264912Skevlo		rssi += 6;
1802264912Skevlo	} else {	/* OFDM/HT. */
1803264912Skevlo		phy = (struct r92c_rx_phystat *)physt;
1804264912Skevlo		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1805264912Skevlo	}
1806264912Skevlo	return (rssi);
1807264912Skevlo}
1808264912Skevlo
1809264912Skevlo
1810251538Srpaulostatic int
1811281069Srpaulourtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1812251538Srpaulo    struct mbuf *m0, struct urtwn_data *data)
1813251538Srpaulo{
1814251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1815251538Srpaulo	struct ieee80211_frame *wh;
1816251538Srpaulo	struct ieee80211_key *k;
1817251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1818251538Srpaulo	struct ieee80211vap *vap = ni->ni_vap;
1819251538Srpaulo	struct usb_xfer *xfer;
1820251538Srpaulo	struct r92c_tx_desc *txd;
1821251538Srpaulo	uint8_t raid, type;
1822251538Srpaulo	uint16_t sum;
1823251538Srpaulo	int i, hasqos, xferlen;
1824251538Srpaulo	struct usb_xfer *urtwn_pipes[4] = {
1825251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BE],
1826251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BK],
1827251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VI],
1828251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VO]
1829251538Srpaulo	};
1830251538Srpaulo
1831251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
1832251538Srpaulo
1833251538Srpaulo	/*
1834251538Srpaulo	 * Software crypto.
1835251538Srpaulo	 */
1836251538Srpaulo	wh = mtod(m0, struct ieee80211_frame *);
1837264912Skevlo	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1838264912Skevlo
1839260444Skevlo	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1840251538Srpaulo		k = ieee80211_crypto_encap(ni, m0);
1841251538Srpaulo		if (k == NULL) {
1842251538Srpaulo			device_printf(sc->sc_dev,
1843251538Srpaulo			    "ieee80211_crypto_encap returns NULL.\n");
1844251538Srpaulo			/* XXX we don't expect the fragmented frames */
1845251538Srpaulo			m_freem(m0);
1846251538Srpaulo			return (ENOBUFS);
1847251538Srpaulo		}
1848251538Srpaulo
1849251538Srpaulo		/* in case packet header moved, reset pointer */
1850251538Srpaulo		wh = mtod(m0, struct ieee80211_frame *);
1851251538Srpaulo	}
1852281069Srpaulo
1853264912Skevlo	switch (type) {
1854251538Srpaulo	case IEEE80211_FC0_TYPE_CTL:
1855251538Srpaulo	case IEEE80211_FC0_TYPE_MGT:
1856251538Srpaulo		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1857251538Srpaulo		break;
1858251538Srpaulo	default:
1859251538Srpaulo		KASSERT(M_WME_GETAC(m0) < 4,
1860251538Srpaulo		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1861251538Srpaulo		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1862251538Srpaulo		break;
1863251538Srpaulo	}
1864281069Srpaulo
1865251538Srpaulo	hasqos = 0;
1866251538Srpaulo
1867251538Srpaulo	/* Fill Tx descriptor. */
1868251538Srpaulo	txd = (struct r92c_tx_desc *)data->buf;
1869251538Srpaulo	memset(txd, 0, sizeof(*txd));
1870251538Srpaulo
1871251538Srpaulo	txd->txdw0 |= htole32(
1872251538Srpaulo	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1873251538Srpaulo	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1874251538Srpaulo	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1875251538Srpaulo	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1876251538Srpaulo		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1877251538Srpaulo	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1878251538Srpaulo	    type == IEEE80211_FC0_TYPE_DATA) {
1879251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1880251538Srpaulo			raid = R92C_RAID_11B;
1881251538Srpaulo		else
1882251538Srpaulo			raid = R92C_RAID_11BG;
1883264912Skevlo		if (sc->chip & URTWN_CHIP_88E) {
1884264912Skevlo			txd->txdw1 |= htole32(
1885264912Skevlo			    SM(R88E_TXDW1_MACID, URTWN_MACID_BSS) |
1886264912Skevlo			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1887264912Skevlo			    SM(R92C_TXDW1_RAID, raid));
1888264912Skevlo			txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
1889264912Skevlo		} else {
1890264912Skevlo			txd->txdw1 |= htole32(
1891264912Skevlo			    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1892264912Skevlo			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1893264912Skevlo		 	    SM(R92C_TXDW1_RAID, raid) | R92C_TXDW1_AGGBK);
1894264912Skevlo		}
1895251538Srpaulo		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1896251538Srpaulo			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1897251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1898251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1899251538Srpaulo			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1900251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1901251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1902251538Srpaulo			}
1903251538Srpaulo		}
1904251538Srpaulo		/* Send RTS at OFDM24. */
1905251538Srpaulo		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1906251538Srpaulo		txd->txdw5 |= htole32(0x0001ff00);
1907251538Srpaulo		/* Send data at OFDM54. */
1908264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
1909264912Skevlo			txd->txdw5 |= htole32(0x13 & 0x3f);
1910264912Skevlo		else
1911264912Skevlo			txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1912251538Srpaulo	} else {
1913251538Srpaulo		txd->txdw1 |= htole32(
1914251538Srpaulo		    SM(R92C_TXDW1_MACID, 0) |
1915251538Srpaulo		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1916251538Srpaulo		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1917251538Srpaulo
1918251538Srpaulo		/* Force CCK1. */
1919251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1920251538Srpaulo		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1921251538Srpaulo	}
1922251538Srpaulo	/* Set sequence number (already little endian). */
1923251538Srpaulo	txd->txdseq |= *(uint16_t *)wh->i_seq;
1924251538Srpaulo
1925251538Srpaulo	if (!hasqos) {
1926251538Srpaulo		/* Use HW sequence numbering for non-QoS frames. */
1927251538Srpaulo		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1928251538Srpaulo		txd->txdseq |= htole16(0x8000);
1929251538Srpaulo	} else
1930251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1931251538Srpaulo
1932251538Srpaulo	/* Compute Tx descriptor checksum. */
1933251538Srpaulo	sum = 0;
1934251538Srpaulo	for (i = 0; i < sizeof(*txd) / 2; i++)
1935251538Srpaulo		sum ^= ((uint16_t *)txd)[i];
1936251538Srpaulo	txd->txdsum = sum; 	/* NB: already little endian. */
1937251538Srpaulo
1938251538Srpaulo	if (ieee80211_radiotap_active_vap(vap)) {
1939251538Srpaulo		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1940251538Srpaulo
1941251538Srpaulo		tap->wt_flags = 0;
1942251538Srpaulo		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1943251538Srpaulo		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1944251538Srpaulo		ieee80211_radiotap_tx(vap, m0);
1945251538Srpaulo	}
1946251538Srpaulo
1947251538Srpaulo	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1948251538Srpaulo	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1949251538Srpaulo
1950251538Srpaulo	data->buflen = xferlen;
1951251538Srpaulo	data->ni = ni;
1952251538Srpaulo	data->m = m0;
1953251538Srpaulo
1954251538Srpaulo	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1955251538Srpaulo	usbd_transfer_start(xfer);
1956251538Srpaulo	return (0);
1957251538Srpaulo}
1958251538Srpaulo
1959251538Srpaulostatic void
1960251538Srpaulourtwn_start(struct ifnet *ifp)
1961251538Srpaulo{
1962251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
1963261863Srpaulo
1964261863Srpaulo	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1965261863Srpaulo		return;
1966261863Srpaulo	URTWN_LOCK(sc);
1967261863Srpaulo	urtwn_start_locked(ifp, sc);
1968261863Srpaulo	URTWN_UNLOCK(sc);
1969261863Srpaulo}
1970261863Srpaulo
1971261863Srpaulostatic void
1972261863Srpaulourtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1973261863Srpaulo{
1974251538Srpaulo	struct ieee80211_node *ni;
1975251538Srpaulo	struct mbuf *m;
1976251538Srpaulo	struct urtwn_data *bf;
1977251538Srpaulo
1978261863Srpaulo	URTWN_ASSERT_LOCKED(sc);
1979251538Srpaulo	for (;;) {
1980251538Srpaulo		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1981251538Srpaulo		if (m == NULL)
1982251538Srpaulo			break;
1983251538Srpaulo		bf = urtwn_getbuf(sc);
1984251538Srpaulo		if (bf == NULL) {
1985251538Srpaulo			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1986251538Srpaulo			break;
1987251538Srpaulo		}
1988251538Srpaulo		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1989251538Srpaulo		m->m_pkthdr.rcvif = NULL;
1990251538Srpaulo
1991251538Srpaulo		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1992271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1993251538Srpaulo			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1994251538Srpaulo			ieee80211_free_node(ni);
1995251538Srpaulo			break;
1996251538Srpaulo		}
1997251538Srpaulo
1998251538Srpaulo		sc->sc_txtimer = 5;
1999251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2000251538Srpaulo	}
2001251538Srpaulo}
2002251538Srpaulo
2003251538Srpaulostatic int
2004251538Srpaulourtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2005251538Srpaulo{
2006263153Skevlo	struct urtwn_softc *sc = ifp->if_softc;
2007251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
2008251538Srpaulo	struct ifreq *ifr = (struct ifreq *) data;
2009251538Srpaulo	int error = 0, startall = 0;
2010251538Srpaulo
2011263153Skevlo	URTWN_LOCK(sc);
2012263153Skevlo	error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
2013263153Skevlo	URTWN_UNLOCK(sc);
2014263153Skevlo	if (error != 0)
2015263153Skevlo		return (error);
2016263153Skevlo
2017251538Srpaulo	switch (cmd) {
2018251538Srpaulo	case SIOCSIFFLAGS:
2019251538Srpaulo		if (ifp->if_flags & IFF_UP) {
2020251538Srpaulo			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2021251538Srpaulo				urtwn_init(ifp->if_softc);
2022251538Srpaulo				startall = 1;
2023251538Srpaulo			}
2024251538Srpaulo		} else {
2025251538Srpaulo			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2026263153Skevlo				urtwn_stop(ifp);
2027251538Srpaulo		}
2028251538Srpaulo		if (startall)
2029251538Srpaulo			ieee80211_start_all(ic);
2030251538Srpaulo		break;
2031251538Srpaulo	case SIOCGIFMEDIA:
2032251538Srpaulo		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2033251538Srpaulo		break;
2034251538Srpaulo	case SIOCGIFADDR:
2035251538Srpaulo		error = ether_ioctl(ifp, cmd, data);
2036251538Srpaulo		break;
2037251538Srpaulo	default:
2038251538Srpaulo		error = EINVAL;
2039251538Srpaulo		break;
2040251538Srpaulo	}
2041251538Srpaulo	return (error);
2042251538Srpaulo}
2043251538Srpaulo
2044251538Srpaulostatic int
2045251538Srpaulourtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
2046251538Srpaulo    int ndata, int maxsz)
2047251538Srpaulo{
2048251538Srpaulo	int i, error;
2049251538Srpaulo
2050251538Srpaulo	for (i = 0; i < ndata; i++) {
2051251538Srpaulo		struct urtwn_data *dp = &data[i];
2052251538Srpaulo		dp->sc = sc;
2053251538Srpaulo		dp->m = NULL;
2054251538Srpaulo		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
2055251538Srpaulo		if (dp->buf == NULL) {
2056251538Srpaulo			device_printf(sc->sc_dev,
2057251538Srpaulo			    "could not allocate buffer\n");
2058251538Srpaulo			error = ENOMEM;
2059251538Srpaulo			goto fail;
2060251538Srpaulo		}
2061251538Srpaulo		dp->ni = NULL;
2062251538Srpaulo	}
2063251538Srpaulo
2064251538Srpaulo	return (0);
2065251538Srpaulofail:
2066251538Srpaulo	urtwn_free_list(sc, data, ndata);
2067251538Srpaulo	return (error);
2068251538Srpaulo}
2069251538Srpaulo
2070251538Srpaulostatic int
2071251538Srpaulourtwn_alloc_rx_list(struct urtwn_softc *sc)
2072251538Srpaulo{
2073251538Srpaulo        int error, i;
2074251538Srpaulo
2075251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
2076251538Srpaulo	    URTWN_RXBUFSZ);
2077251538Srpaulo	if (error != 0)
2078251538Srpaulo		return (error);
2079251538Srpaulo
2080251538Srpaulo	STAILQ_INIT(&sc->sc_rx_active);
2081251538Srpaulo	STAILQ_INIT(&sc->sc_rx_inactive);
2082251538Srpaulo
2083251538Srpaulo	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
2084251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
2085251538Srpaulo
2086251538Srpaulo	return (0);
2087251538Srpaulo}
2088251538Srpaulo
2089251538Srpaulostatic int
2090251538Srpaulourtwn_alloc_tx_list(struct urtwn_softc *sc)
2091251538Srpaulo{
2092251538Srpaulo	int error, i;
2093251538Srpaulo
2094251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
2095251538Srpaulo	    URTWN_TXBUFSZ);
2096251538Srpaulo	if (error != 0)
2097251538Srpaulo		return (error);
2098251538Srpaulo
2099251538Srpaulo	STAILQ_INIT(&sc->sc_tx_active);
2100251538Srpaulo	STAILQ_INIT(&sc->sc_tx_inactive);
2101251538Srpaulo	STAILQ_INIT(&sc->sc_tx_pending);
2102251538Srpaulo
2103251538Srpaulo	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
2104251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
2105251538Srpaulo
2106251538Srpaulo	return (0);
2107251538Srpaulo}
2108251538Srpaulo
2109264912Skevlostatic __inline int
2110251538Srpaulourtwn_power_on(struct urtwn_softc *sc)
2111251538Srpaulo{
2112264912Skevlo
2113264912Skevlo	return sc->sc_power_on(sc);
2114264912Skevlo}
2115264912Skevlo
2116264912Skevlostatic int
2117264912Skevlourtwn_r92c_power_on(struct urtwn_softc *sc)
2118264912Skevlo{
2119251538Srpaulo	uint32_t reg;
2120251538Srpaulo	int ntries;
2121251538Srpaulo
2122251538Srpaulo	/* Wait for autoload done bit. */
2123251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2124251538Srpaulo		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2125251538Srpaulo			break;
2126266472Shselasky		urtwn_ms_delay(sc);
2127251538Srpaulo	}
2128251538Srpaulo	if (ntries == 1000) {
2129251538Srpaulo		device_printf(sc->sc_dev,
2130251538Srpaulo		    "timeout waiting for chip autoload\n");
2131251538Srpaulo		return (ETIMEDOUT);
2132251538Srpaulo	}
2133251538Srpaulo
2134251538Srpaulo	/* Unlock ISO/CLK/Power control register. */
2135251538Srpaulo	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2136251538Srpaulo	/* Move SPS into PWM mode. */
2137251538Srpaulo	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2138266472Shselasky	urtwn_ms_delay(sc);
2139251538Srpaulo
2140251538Srpaulo	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2141251538Srpaulo	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2142251538Srpaulo		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2143251538Srpaulo		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2144266472Shselasky		urtwn_ms_delay(sc);
2145251538Srpaulo		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2146251538Srpaulo		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2147251538Srpaulo		    ~R92C_SYS_ISO_CTRL_MD2PP);
2148251538Srpaulo	}
2149251538Srpaulo
2150251538Srpaulo	/* Auto enable WLAN. */
2151251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
2152251538Srpaulo	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2153251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2154262822Skevlo		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2155262822Skevlo		    R92C_APS_FSMCO_APFM_ONMAC))
2156251538Srpaulo			break;
2157266472Shselasky		urtwn_ms_delay(sc);
2158251538Srpaulo	}
2159251538Srpaulo	if (ntries == 1000) {
2160251538Srpaulo		device_printf(sc->sc_dev,
2161251538Srpaulo		    "timeout waiting for MAC auto ON\n");
2162251538Srpaulo		return (ETIMEDOUT);
2163251538Srpaulo	}
2164251538Srpaulo
2165251538Srpaulo	/* Enable radio, GPIO and LED functions. */
2166251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
2167251538Srpaulo	    R92C_APS_FSMCO_AFSM_HSUS |
2168251538Srpaulo	    R92C_APS_FSMCO_PDN_EN |
2169251538Srpaulo	    R92C_APS_FSMCO_PFM_ALDN);
2170251538Srpaulo	/* Release RF digital isolation. */
2171251538Srpaulo	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2172251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2173251538Srpaulo
2174251538Srpaulo	/* Initialize MAC. */
2175251538Srpaulo	urtwn_write_1(sc, R92C_APSD_CTRL,
2176251538Srpaulo	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2177251538Srpaulo	for (ntries = 0; ntries < 200; ntries++) {
2178251538Srpaulo		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2179251538Srpaulo		    R92C_APSD_CTRL_OFF_STATUS))
2180251538Srpaulo			break;
2181266472Shselasky		urtwn_ms_delay(sc);
2182251538Srpaulo	}
2183251538Srpaulo	if (ntries == 200) {
2184251538Srpaulo		device_printf(sc->sc_dev,
2185251538Srpaulo		    "timeout waiting for MAC initialization\n");
2186251538Srpaulo		return (ETIMEDOUT);
2187251538Srpaulo	}
2188251538Srpaulo
2189251538Srpaulo	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2190251538Srpaulo	reg = urtwn_read_2(sc, R92C_CR);
2191251538Srpaulo	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2192251538Srpaulo	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2193251538Srpaulo	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2194251538Srpaulo	    R92C_CR_ENSEC;
2195251538Srpaulo	urtwn_write_2(sc, R92C_CR, reg);
2196251538Srpaulo
2197251538Srpaulo	urtwn_write_1(sc, 0xfe10, 0x19);
2198251538Srpaulo	return (0);
2199251538Srpaulo}
2200251538Srpaulo
2201251538Srpaulostatic int
2202264912Skevlourtwn_r88e_power_on(struct urtwn_softc *sc)
2203264912Skevlo{
2204264912Skevlo	uint32_t reg;
2205264912Skevlo	int ntries;
2206264912Skevlo
2207264912Skevlo	/* Wait for power ready bit. */
2208264912Skevlo	for (ntries = 0; ntries < 5000; ntries++) {
2209281918Skevlo		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2210264912Skevlo			break;
2211266472Shselasky		urtwn_ms_delay(sc);
2212264912Skevlo	}
2213264912Skevlo	if (ntries == 5000) {
2214264912Skevlo		device_printf(sc->sc_dev,
2215264912Skevlo		    "timeout waiting for chip power up\n");
2216264912Skevlo		return (ETIMEDOUT);
2217264912Skevlo	}
2218264912Skevlo
2219264912Skevlo	/* Reset BB. */
2220264912Skevlo	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2221264912Skevlo	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2222264912Skevlo	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2223264912Skevlo
2224281918Skevlo	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2225281918Skevlo	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2226264912Skevlo
2227264912Skevlo	/* Disable HWPDN. */
2228281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2229281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2230264912Skevlo
2231264912Skevlo	/* Disable WL suspend. */
2232281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2233281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2234281918Skevlo	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2235264912Skevlo
2236281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2237281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2238264912Skevlo	for (ntries = 0; ntries < 5000; ntries++) {
2239281918Skevlo		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2240281918Skevlo		    R92C_APS_FSMCO_APFM_ONMAC))
2241264912Skevlo			break;
2242266472Shselasky		urtwn_ms_delay(sc);
2243264912Skevlo	}
2244264912Skevlo	if (ntries == 5000)
2245264912Skevlo		return (ETIMEDOUT);
2246264912Skevlo
2247264912Skevlo	/* Enable LDO normal mode. */
2248281918Skevlo	urtwn_write_1(sc, R92C_LPLDO_CTRL,
2249281918Skevlo	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2250264912Skevlo
2251264912Skevlo	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2252264912Skevlo	urtwn_write_2(sc, R92C_CR, 0);
2253264912Skevlo	reg = urtwn_read_2(sc, R92C_CR);
2254264912Skevlo	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2255264912Skevlo	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2256264912Skevlo	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2257264912Skevlo	urtwn_write_2(sc, R92C_CR, reg);
2258264912Skevlo
2259264912Skevlo	return (0);
2260264912Skevlo}
2261264912Skevlo
2262264912Skevlostatic int
2263251538Srpaulourtwn_llt_init(struct urtwn_softc *sc)
2264251538Srpaulo{
2265264912Skevlo	int i, error, page_count, pktbuf_count;
2266251538Srpaulo
2267264912Skevlo	page_count = (sc->chip & URTWN_CHIP_88E) ?
2268264912Skevlo	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2269264912Skevlo	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2270264912Skevlo	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2271264912Skevlo
2272264912Skevlo	/* Reserve pages [0; page_count]. */
2273264912Skevlo	for (i = 0; i < page_count; i++) {
2274251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2275251538Srpaulo			return (error);
2276251538Srpaulo	}
2277251538Srpaulo	/* NB: 0xff indicates end-of-list. */
2278251538Srpaulo	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2279251538Srpaulo		return (error);
2280251538Srpaulo	/*
2281264912Skevlo	 * Use pages [page_count + 1; pktbuf_count - 1]
2282251538Srpaulo	 * as ring buffer.
2283251538Srpaulo	 */
2284264912Skevlo	for (++i; i < pktbuf_count - 1; i++) {
2285251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2286251538Srpaulo			return (error);
2287251538Srpaulo	}
2288251538Srpaulo	/* Make the last page point to the beginning of the ring buffer. */
2289264912Skevlo	error = urtwn_llt_write(sc, i, page_count + 1);
2290251538Srpaulo	return (error);
2291251538Srpaulo}
2292251538Srpaulo
2293251538Srpaulostatic void
2294251538Srpaulourtwn_fw_reset(struct urtwn_softc *sc)
2295251538Srpaulo{
2296251538Srpaulo	uint16_t reg;
2297251538Srpaulo	int ntries;
2298251538Srpaulo
2299251538Srpaulo	/* Tell 8051 to reset itself. */
2300251538Srpaulo	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2301251538Srpaulo
2302251538Srpaulo	/* Wait until 8051 resets by itself. */
2303251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
2304251538Srpaulo		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2305251538Srpaulo		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2306251538Srpaulo			return;
2307266472Shselasky		urtwn_ms_delay(sc);
2308251538Srpaulo	}
2309251538Srpaulo	/* Force 8051 reset. */
2310251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2311251538Srpaulo}
2312251538Srpaulo
2313264912Skevlostatic void
2314264912Skevlourtwn_r88e_fw_reset(struct urtwn_softc *sc)
2315264912Skevlo{
2316264912Skevlo	uint16_t reg;
2317264912Skevlo
2318264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2319264912Skevlo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2320264912Skevlo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2321264912Skevlo}
2322264912Skevlo
2323251538Srpaulostatic int
2324251538Srpaulourtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2325251538Srpaulo{
2326251538Srpaulo	uint32_t reg;
2327251538Srpaulo	int off, mlen, error = 0;
2328251538Srpaulo
2329251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2330251538Srpaulo	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2331251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2332251538Srpaulo
2333251538Srpaulo	off = R92C_FW_START_ADDR;
2334251538Srpaulo	while (len > 0) {
2335251538Srpaulo		if (len > 196)
2336251538Srpaulo			mlen = 196;
2337251538Srpaulo		else if (len > 4)
2338251538Srpaulo			mlen = 4;
2339251538Srpaulo		else
2340251538Srpaulo			mlen = 1;
2341251538Srpaulo		/* XXX fix this deconst */
2342281069Srpaulo		error = urtwn_write_region_1(sc, off,
2343251538Srpaulo		    __DECONST(uint8_t *, buf), mlen);
2344251538Srpaulo		if (error != 0)
2345251538Srpaulo			break;
2346251538Srpaulo		off += mlen;
2347251538Srpaulo		buf += mlen;
2348251538Srpaulo		len -= mlen;
2349251538Srpaulo	}
2350251538Srpaulo	return (error);
2351251538Srpaulo}
2352251538Srpaulo
2353251538Srpaulostatic int
2354251538Srpaulourtwn_load_firmware(struct urtwn_softc *sc)
2355251538Srpaulo{
2356251538Srpaulo	const struct firmware *fw;
2357251538Srpaulo	const struct r92c_fw_hdr *hdr;
2358251538Srpaulo	const char *imagename;
2359251538Srpaulo	const u_char *ptr;
2360251538Srpaulo	size_t len;
2361251538Srpaulo	uint32_t reg;
2362251538Srpaulo	int mlen, ntries, page, error;
2363251538Srpaulo
2364264864Skevlo	URTWN_UNLOCK(sc);
2365251538Srpaulo	/* Read firmware image from the filesystem. */
2366264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2367264912Skevlo		imagename = "urtwn-rtl8188eufw";
2368264912Skevlo	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2369264912Skevlo		    URTWN_CHIP_UMC_A_CUT)
2370251538Srpaulo		imagename = "urtwn-rtl8192cfwU";
2371251538Srpaulo	else
2372251538Srpaulo		imagename = "urtwn-rtl8192cfwT";
2373251538Srpaulo
2374251538Srpaulo	fw = firmware_get(imagename);
2375264864Skevlo	URTWN_LOCK(sc);
2376251538Srpaulo	if (fw == NULL) {
2377251538Srpaulo		device_printf(sc->sc_dev,
2378251538Srpaulo		    "failed loadfirmware of file %s\n", imagename);
2379251538Srpaulo		return (ENOENT);
2380251538Srpaulo	}
2381251538Srpaulo
2382251538Srpaulo	len = fw->datasize;
2383251538Srpaulo
2384251538Srpaulo	if (len < sizeof(*hdr)) {
2385251538Srpaulo		device_printf(sc->sc_dev, "firmware too short\n");
2386251538Srpaulo		error = EINVAL;
2387251538Srpaulo		goto fail;
2388251538Srpaulo	}
2389251538Srpaulo	ptr = fw->data;
2390251538Srpaulo	hdr = (const struct r92c_fw_hdr *)ptr;
2391251538Srpaulo	/* Check if there is a valid FW header and skip it. */
2392251538Srpaulo	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2393264912Skevlo	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2394251538Srpaulo	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2395251538Srpaulo		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2396251538Srpaulo		    le16toh(hdr->version), le16toh(hdr->subversion),
2397251538Srpaulo		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2398251538Srpaulo		ptr += sizeof(*hdr);
2399251538Srpaulo		len -= sizeof(*hdr);
2400251538Srpaulo	}
2401251538Srpaulo
2402264912Skevlo	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2403264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
2404264912Skevlo			urtwn_r88e_fw_reset(sc);
2405264912Skevlo		else
2406264912Skevlo			urtwn_fw_reset(sc);
2407251538Srpaulo		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2408251538Srpaulo	}
2409264912Skevlo
2410268487Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
2411268487Skevlo		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2412268487Skevlo		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2413268487Skevlo		    R92C_SYS_FUNC_EN_CPUEN);
2414268487Skevlo	}
2415251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2416251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2417251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2418251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2419251538Srpaulo
2420263154Skevlo	/* Reset the FWDL checksum. */
2421263154Skevlo	urtwn_write_1(sc, R92C_MCUFWDL,
2422263154Skevlo	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2423263154Skevlo
2424251538Srpaulo	for (page = 0; len > 0; page++) {
2425251538Srpaulo		mlen = min(len, R92C_FW_PAGE_SIZE);
2426251538Srpaulo		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2427251538Srpaulo		if (error != 0) {
2428251538Srpaulo			device_printf(sc->sc_dev,
2429251538Srpaulo			    "could not load firmware page\n");
2430251538Srpaulo			goto fail;
2431251538Srpaulo		}
2432251538Srpaulo		ptr += mlen;
2433251538Srpaulo		len -= mlen;
2434251538Srpaulo	}
2435251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2436251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2437251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2438251538Srpaulo
2439251538Srpaulo	/* Wait for checksum report. */
2440251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2441251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2442251538Srpaulo			break;
2443266472Shselasky		urtwn_ms_delay(sc);
2444251538Srpaulo	}
2445251538Srpaulo	if (ntries == 1000) {
2446251538Srpaulo		device_printf(sc->sc_dev,
2447251538Srpaulo		    "timeout waiting for checksum report\n");
2448251538Srpaulo		error = ETIMEDOUT;
2449251538Srpaulo		goto fail;
2450251538Srpaulo	}
2451251538Srpaulo
2452251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2453251538Srpaulo	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2454251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2455264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2456264912Skevlo		urtwn_r88e_fw_reset(sc);
2457251538Srpaulo	/* Wait for firmware readiness. */
2458251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2459251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2460251538Srpaulo			break;
2461266472Shselasky		urtwn_ms_delay(sc);
2462251538Srpaulo	}
2463251538Srpaulo	if (ntries == 1000) {
2464251538Srpaulo		device_printf(sc->sc_dev,
2465251538Srpaulo		    "timeout waiting for firmware readiness\n");
2466251538Srpaulo		error = ETIMEDOUT;
2467251538Srpaulo		goto fail;
2468251538Srpaulo	}
2469251538Srpaulofail:
2470251538Srpaulo	firmware_put(fw, FIRMWARE_UNLOAD);
2471251538Srpaulo	return (error);
2472251538Srpaulo}
2473251538Srpaulo
2474264912Skevlostatic __inline int
2475251538Srpaulourtwn_dma_init(struct urtwn_softc *sc)
2476251538Srpaulo{
2477281069Srpaulo
2478264912Skevlo	return sc->sc_dma_init(sc);
2479264912Skevlo}
2480264912Skevlo
2481264912Skevlostatic int
2482264912Skevlourtwn_r92c_dma_init(struct urtwn_softc *sc)
2483264912Skevlo{
2484251538Srpaulo	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2485251538Srpaulo	uint32_t reg;
2486251538Srpaulo	int error;
2487251538Srpaulo
2488251538Srpaulo	/* Initialize LLT table. */
2489251538Srpaulo	error = urtwn_llt_init(sc);
2490251538Srpaulo	if (error != 0)
2491251538Srpaulo		return (error);
2492251538Srpaulo
2493251538Srpaulo	/* Get Tx queues to USB endpoints mapping. */
2494251538Srpaulo	hashq = hasnq = haslq = 0;
2495251538Srpaulo	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2496251538Srpaulo	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2497251538Srpaulo	if (MS(reg, R92C_USB_EP_HQ) != 0)
2498251538Srpaulo		hashq = 1;
2499251538Srpaulo	if (MS(reg, R92C_USB_EP_NQ) != 0)
2500251538Srpaulo		hasnq = 1;
2501251538Srpaulo	if (MS(reg, R92C_USB_EP_LQ) != 0)
2502251538Srpaulo		haslq = 1;
2503251538Srpaulo	nqueues = hashq + hasnq + haslq;
2504251538Srpaulo	if (nqueues == 0)
2505251538Srpaulo		return (EIO);
2506251538Srpaulo	/* Get the number of pages for each queue. */
2507251538Srpaulo	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2508251538Srpaulo	/* The remaining pages are assigned to the high priority queue. */
2509251538Srpaulo	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2510251538Srpaulo
2511251538Srpaulo	/* Set number of pages for normal priority queue. */
2512251538Srpaulo	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2513251538Srpaulo	urtwn_write_4(sc, R92C_RQPN,
2514251538Srpaulo	    /* Set number of pages for public queue. */
2515251538Srpaulo	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2516251538Srpaulo	    /* Set number of pages for high priority queue. */
2517251538Srpaulo	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2518251538Srpaulo	    /* Set number of pages for low priority queue. */
2519251538Srpaulo	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2520251538Srpaulo	    /* Load values. */
2521251538Srpaulo	    R92C_RQPN_LD);
2522251538Srpaulo
2523251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2524251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2525251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2526251538Srpaulo	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2527251538Srpaulo	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2528251538Srpaulo
2529251538Srpaulo	/* Set queue to USB pipe mapping. */
2530251538Srpaulo	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2531251538Srpaulo	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2532251538Srpaulo	if (nqueues == 1) {
2533251538Srpaulo		if (hashq)
2534251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2535251538Srpaulo		else if (hasnq)
2536251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2537251538Srpaulo		else
2538251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2539251538Srpaulo	} else if (nqueues == 2) {
2540251538Srpaulo		/* All 2-endpoints configs have a high priority queue. */
2541251538Srpaulo		if (!hashq)
2542251538Srpaulo			return (EIO);
2543251538Srpaulo		if (hasnq)
2544251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2545251538Srpaulo		else
2546251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2547251538Srpaulo	} else
2548251538Srpaulo		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2549251538Srpaulo	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2550251538Srpaulo
2551251538Srpaulo	/* Set Tx/Rx transfer page boundary. */
2552251538Srpaulo	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2553251538Srpaulo
2554251538Srpaulo	/* Set Tx/Rx transfer page size. */
2555251538Srpaulo	urtwn_write_1(sc, R92C_PBP,
2556251538Srpaulo	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2557251538Srpaulo	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2558251538Srpaulo	return (0);
2559251538Srpaulo}
2560251538Srpaulo
2561264912Skevlostatic int
2562264912Skevlourtwn_r88e_dma_init(struct urtwn_softc *sc)
2563264912Skevlo{
2564264912Skevlo	struct usb_interface *iface;
2565264912Skevlo	uint32_t reg;
2566264912Skevlo	int nqueues;
2567264912Skevlo	int error;
2568264912Skevlo
2569264912Skevlo	/* Initialize LLT table. */
2570264912Skevlo	error = urtwn_llt_init(sc);
2571264912Skevlo	if (error != 0)
2572264912Skevlo		return (error);
2573264912Skevlo
2574264912Skevlo	/* Get Tx queues to USB endpoints mapping. */
2575264912Skevlo	iface = usbd_get_iface(sc->sc_udev, 0);
2576264912Skevlo	nqueues = iface->idesc->bNumEndpoints - 1;
2577264912Skevlo	if (nqueues == 0)
2578264912Skevlo		return (EIO);
2579264912Skevlo
2580264912Skevlo	/* Set number of pages for normal priority queue. */
2581264912Skevlo	urtwn_write_2(sc, R92C_RQPN_NPQ, 0);
2582264912Skevlo	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2583264912Skevlo	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2584264912Skevlo
2585264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2586264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2587264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2588264912Skevlo	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2589264912Skevlo	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2590264912Skevlo
2591264912Skevlo	/* Set queue to USB pipe mapping. */
2592264912Skevlo	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2593264912Skevlo	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2594264912Skevlo	if (nqueues == 1)
2595264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2596264912Skevlo	else if (nqueues == 2)
2597264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2598264912Skevlo	else
2599264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2600264912Skevlo	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2601264912Skevlo
2602264912Skevlo	/* Set Tx/Rx transfer page boundary. */
2603264912Skevlo	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2604264912Skevlo
2605264912Skevlo	/* Set Tx/Rx transfer page size. */
2606264912Skevlo	urtwn_write_1(sc, R92C_PBP,
2607264912Skevlo	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2608264912Skevlo	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2609264912Skevlo
2610264912Skevlo	return (0);
2611264912Skevlo}
2612264912Skevlo
2613251538Srpaulostatic void
2614251538Srpaulourtwn_mac_init(struct urtwn_softc *sc)
2615251538Srpaulo{
2616251538Srpaulo	int i;
2617251538Srpaulo
2618251538Srpaulo	/* Write MAC initialization values. */
2619264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
2620264912Skevlo		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2621264912Skevlo			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2622264912Skevlo			    rtl8188eu_mac[i].val);
2623264912Skevlo		}
2624264912Skevlo		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2625264912Skevlo	} else {
2626264912Skevlo		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2627264912Skevlo			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2628264912Skevlo			    rtl8192cu_mac[i].val);
2629264912Skevlo	}
2630251538Srpaulo}
2631251538Srpaulo
2632251538Srpaulostatic void
2633251538Srpaulourtwn_bb_init(struct urtwn_softc *sc)
2634251538Srpaulo{
2635251538Srpaulo	const struct urtwn_bb_prog *prog;
2636251538Srpaulo	uint32_t reg;
2637264912Skevlo	uint8_t crystalcap;
2638251538Srpaulo	int i;
2639251538Srpaulo
2640251538Srpaulo	/* Enable BB and RF. */
2641251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2642251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2643251538Srpaulo	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2644251538Srpaulo	    R92C_SYS_FUNC_EN_DIO_RF);
2645251538Srpaulo
2646264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E))
2647264912Skevlo		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2648251538Srpaulo
2649251538Srpaulo	urtwn_write_1(sc, R92C_RF_CTRL,
2650251538Srpaulo	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2651251538Srpaulo	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2652251538Srpaulo	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2653251538Srpaulo	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2654251538Srpaulo
2655264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
2656264912Skevlo		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2657264912Skevlo		urtwn_write_1(sc, 0x15, 0xe9);
2658264912Skevlo		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2659264912Skevlo	}
2660251538Srpaulo
2661251538Srpaulo	/* Select BB programming based on board type. */
2662264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2663264912Skevlo		prog = &rtl8188eu_bb_prog;
2664264912Skevlo	else if (!(sc->chip & URTWN_CHIP_92C)) {
2665251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2666251538Srpaulo			prog = &rtl8188ce_bb_prog;
2667251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2668251538Srpaulo			prog = &rtl8188ru_bb_prog;
2669251538Srpaulo		else
2670251538Srpaulo			prog = &rtl8188cu_bb_prog;
2671251538Srpaulo	} else {
2672251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2673251538Srpaulo			prog = &rtl8192ce_bb_prog;
2674251538Srpaulo		else
2675251538Srpaulo			prog = &rtl8192cu_bb_prog;
2676251538Srpaulo	}
2677251538Srpaulo	/* Write BB initialization values. */
2678251538Srpaulo	for (i = 0; i < prog->count; i++) {
2679251538Srpaulo		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2680266472Shselasky		urtwn_ms_delay(sc);
2681251538Srpaulo	}
2682251538Srpaulo
2683251538Srpaulo	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2684251538Srpaulo		/* 8192C 1T only configuration. */
2685251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2686251538Srpaulo		reg = (reg & ~0x00000003) | 0x2;
2687251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2688251538Srpaulo
2689251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2690251538Srpaulo		reg = (reg & ~0x00300033) | 0x00200022;
2691251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2692251538Srpaulo
2693251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2694251538Srpaulo		reg = (reg & ~0xff000000) | 0x45 << 24;
2695251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2696251538Srpaulo
2697251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2698251538Srpaulo		reg = (reg & ~0x000000ff) | 0x23;
2699251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2700251538Srpaulo
2701251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2702251538Srpaulo		reg = (reg & ~0x00000030) | 1 << 4;
2703251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2704251538Srpaulo
2705251538Srpaulo		reg = urtwn_bb_read(sc, 0xe74);
2706251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2707251538Srpaulo		urtwn_bb_write(sc, 0xe74, reg);
2708251538Srpaulo		reg = urtwn_bb_read(sc, 0xe78);
2709251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2710251538Srpaulo		urtwn_bb_write(sc, 0xe78, reg);
2711251538Srpaulo		reg = urtwn_bb_read(sc, 0xe7c);
2712251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2713251538Srpaulo		urtwn_bb_write(sc, 0xe7c, reg);
2714251538Srpaulo		reg = urtwn_bb_read(sc, 0xe80);
2715251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2716251538Srpaulo		urtwn_bb_write(sc, 0xe80, reg);
2717251538Srpaulo		reg = urtwn_bb_read(sc, 0xe88);
2718251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2719251538Srpaulo		urtwn_bb_write(sc, 0xe88, reg);
2720251538Srpaulo	}
2721251538Srpaulo
2722251538Srpaulo	/* Write AGC values. */
2723251538Srpaulo	for (i = 0; i < prog->agccount; i++) {
2724251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2725251538Srpaulo		    prog->agcvals[i]);
2726266472Shselasky		urtwn_ms_delay(sc);
2727251538Srpaulo	}
2728251538Srpaulo
2729264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
2730264912Skevlo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2731266472Shselasky		urtwn_ms_delay(sc);
2732264912Skevlo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2733266472Shselasky		urtwn_ms_delay(sc);
2734264912Skevlo
2735264912Skevlo		crystalcap = sc->r88e_rom[0xb9];
2736264912Skevlo		if (crystalcap == 0xff)
2737264912Skevlo			crystalcap = 0x20;
2738264912Skevlo		crystalcap &= 0x3f;
2739264912Skevlo		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2740264912Skevlo		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2741264912Skevlo		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2742264912Skevlo		    crystalcap | crystalcap << 6));
2743264912Skevlo	} else {
2744264912Skevlo		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2745264912Skevlo		    R92C_HSSI_PARAM2_CCK_HIPWR)
2746264912Skevlo			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2747264912Skevlo	}
2748251538Srpaulo}
2749251538Srpaulo
2750251538Srpaulovoid
2751251538Srpaulourtwn_rf_init(struct urtwn_softc *sc)
2752251538Srpaulo{
2753251538Srpaulo	const struct urtwn_rf_prog *prog;
2754251538Srpaulo	uint32_t reg, type;
2755251538Srpaulo	int i, j, idx, off;
2756251538Srpaulo
2757251538Srpaulo	/* Select RF programming based on board type. */
2758264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2759264912Skevlo		prog = rtl8188eu_rf_prog;
2760264912Skevlo	else if (!(sc->chip & URTWN_CHIP_92C)) {
2761251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2762251538Srpaulo			prog = rtl8188ce_rf_prog;
2763251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2764251538Srpaulo			prog = rtl8188ru_rf_prog;
2765251538Srpaulo		else
2766251538Srpaulo			prog = rtl8188cu_rf_prog;
2767251538Srpaulo	} else
2768251538Srpaulo		prog = rtl8192ce_rf_prog;
2769251538Srpaulo
2770251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2771251538Srpaulo		/* Save RF_ENV control type. */
2772251538Srpaulo		idx = i / 2;
2773251538Srpaulo		off = (i % 2) * 16;
2774251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2775251538Srpaulo		type = (reg >> off) & 0x10;
2776251538Srpaulo
2777251538Srpaulo		/* Set RF_ENV enable. */
2778251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2779251538Srpaulo		reg |= 0x100000;
2780251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2781266472Shselasky		urtwn_ms_delay(sc);
2782251538Srpaulo		/* Set RF_ENV output high. */
2783251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2784251538Srpaulo		reg |= 0x10;
2785251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2786266472Shselasky		urtwn_ms_delay(sc);
2787251538Srpaulo		/* Set address and data lengths of RF registers. */
2788251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2789251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2790251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2791266472Shselasky		urtwn_ms_delay(sc);
2792251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2793251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2794251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2795266472Shselasky		urtwn_ms_delay(sc);
2796251538Srpaulo
2797251538Srpaulo		/* Write RF initialization values for this chain. */
2798251538Srpaulo		for (j = 0; j < prog[i].count; j++) {
2799251538Srpaulo			if (prog[i].regs[j] >= 0xf9 &&
2800251538Srpaulo			    prog[i].regs[j] <= 0xfe) {
2801251538Srpaulo				/*
2802251538Srpaulo				 * These are fake RF registers offsets that
2803251538Srpaulo				 * indicate a delay is required.
2804251538Srpaulo				 */
2805266472Shselasky				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
2806251538Srpaulo				continue;
2807251538Srpaulo			}
2808251538Srpaulo			urtwn_rf_write(sc, i, prog[i].regs[j],
2809251538Srpaulo			    prog[i].vals[j]);
2810266472Shselasky			urtwn_ms_delay(sc);
2811251538Srpaulo		}
2812251538Srpaulo
2813251538Srpaulo		/* Restore RF_ENV control type. */
2814251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2815251538Srpaulo		reg &= ~(0x10 << off) | (type << off);
2816251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2817251538Srpaulo
2818251538Srpaulo		/* Cache RF register CHNLBW. */
2819251538Srpaulo		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2820251538Srpaulo	}
2821251538Srpaulo
2822251538Srpaulo	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2823251538Srpaulo	    URTWN_CHIP_UMC_A_CUT) {
2824251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2825251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2826251538Srpaulo	}
2827251538Srpaulo}
2828251538Srpaulo
2829251538Srpaulostatic void
2830251538Srpaulourtwn_cam_init(struct urtwn_softc *sc)
2831251538Srpaulo{
2832251538Srpaulo	/* Invalidate all CAM entries. */
2833251538Srpaulo	urtwn_write_4(sc, R92C_CAMCMD,
2834251538Srpaulo	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2835251538Srpaulo}
2836251538Srpaulo
2837251538Srpaulostatic void
2838251538Srpaulourtwn_pa_bias_init(struct urtwn_softc *sc)
2839251538Srpaulo{
2840251538Srpaulo	uint8_t reg;
2841251538Srpaulo	int i;
2842251538Srpaulo
2843251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2844251538Srpaulo		if (sc->pa_setting & (1 << i))
2845251538Srpaulo			continue;
2846251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2847251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2848251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2849251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2850251538Srpaulo	}
2851251538Srpaulo	if (!(sc->pa_setting & 0x10)) {
2852251538Srpaulo		reg = urtwn_read_1(sc, 0x16);
2853251538Srpaulo		reg = (reg & ~0xf0) | 0x90;
2854251538Srpaulo		urtwn_write_1(sc, 0x16, reg);
2855251538Srpaulo	}
2856251538Srpaulo}
2857251538Srpaulo
2858251538Srpaulostatic void
2859251538Srpaulourtwn_rxfilter_init(struct urtwn_softc *sc)
2860251538Srpaulo{
2861251538Srpaulo	/* Initialize Rx filter. */
2862251538Srpaulo	/* TODO: use better filter for monitor mode. */
2863251538Srpaulo	urtwn_write_4(sc, R92C_RCR,
2864251538Srpaulo	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2865251538Srpaulo	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2866251538Srpaulo	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2867251538Srpaulo	/* Accept all multicast frames. */
2868251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2869251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2870251538Srpaulo	/* Accept all management frames. */
2871251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2872251538Srpaulo	/* Reject all control frames. */
2873251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2874251538Srpaulo	/* Accept all data frames. */
2875251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2876251538Srpaulo}
2877251538Srpaulo
2878251538Srpaulostatic void
2879251538Srpaulourtwn_edca_init(struct urtwn_softc *sc)
2880251538Srpaulo{
2881251538Srpaulo	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2882251538Srpaulo	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2883251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2884251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2885251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2886251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2887251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2888251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2889251538Srpaulo}
2890251538Srpaulo
2891251538Srpaulovoid
2892251538Srpaulourtwn_write_txpower(struct urtwn_softc *sc, int chain,
2893251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2894251538Srpaulo{
2895251538Srpaulo	uint32_t reg;
2896251538Srpaulo
2897251538Srpaulo	/* Write per-CCK rate Tx power. */
2898251538Srpaulo	if (chain == 0) {
2899251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2900251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2901251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2902251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2903251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2904251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2905251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2906251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2907251538Srpaulo	} else {
2908251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2909251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2910251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2911251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2912251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2913251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2914251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2915251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2916251538Srpaulo	}
2917251538Srpaulo	/* Write per-OFDM rate Tx power. */
2918251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2919251538Srpaulo	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2920251538Srpaulo	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2921251538Srpaulo	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2922251538Srpaulo	    SM(R92C_TXAGC_RATE18, power[ 7]));
2923251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2924251538Srpaulo	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2925251538Srpaulo	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2926251538Srpaulo	    SM(R92C_TXAGC_RATE48, power[10]) |
2927251538Srpaulo	    SM(R92C_TXAGC_RATE54, power[11]));
2928251538Srpaulo	/* Write per-MCS Tx power. */
2929251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2930251538Srpaulo	    SM(R92C_TXAGC_MCS00,  power[12]) |
2931251538Srpaulo	    SM(R92C_TXAGC_MCS01,  power[13]) |
2932251538Srpaulo	    SM(R92C_TXAGC_MCS02,  power[14]) |
2933251538Srpaulo	    SM(R92C_TXAGC_MCS03,  power[15]));
2934251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2935251538Srpaulo	    SM(R92C_TXAGC_MCS04,  power[16]) |
2936251538Srpaulo	    SM(R92C_TXAGC_MCS05,  power[17]) |
2937251538Srpaulo	    SM(R92C_TXAGC_MCS06,  power[18]) |
2938251538Srpaulo	    SM(R92C_TXAGC_MCS07,  power[19]));
2939251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2940251538Srpaulo	    SM(R92C_TXAGC_MCS08,  power[20]) |
2941261506Skevlo	    SM(R92C_TXAGC_MCS09,  power[21]) |
2942251538Srpaulo	    SM(R92C_TXAGC_MCS10,  power[22]) |
2943251538Srpaulo	    SM(R92C_TXAGC_MCS11,  power[23]));
2944251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2945251538Srpaulo	    SM(R92C_TXAGC_MCS12,  power[24]) |
2946251538Srpaulo	    SM(R92C_TXAGC_MCS13,  power[25]) |
2947251538Srpaulo	    SM(R92C_TXAGC_MCS14,  power[26]) |
2948251538Srpaulo	    SM(R92C_TXAGC_MCS15,  power[27]));
2949251538Srpaulo}
2950251538Srpaulo
2951251538Srpaulovoid
2952251538Srpaulourtwn_get_txpower(struct urtwn_softc *sc, int chain,
2953251538Srpaulo    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2954251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2955251538Srpaulo{
2956251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2957251538Srpaulo	struct r92c_rom *rom = &sc->rom;
2958251538Srpaulo	uint16_t cckpow, ofdmpow, htpow, diff, max;
2959251538Srpaulo	const struct urtwn_txpwr *base;
2960251538Srpaulo	int ridx, chan, group;
2961251538Srpaulo
2962251538Srpaulo	/* Determine channel group. */
2963251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2964251538Srpaulo	if (chan <= 3)
2965251538Srpaulo		group = 0;
2966251538Srpaulo	else if (chan <= 9)
2967251538Srpaulo		group = 1;
2968251538Srpaulo	else
2969251538Srpaulo		group = 2;
2970251538Srpaulo
2971251538Srpaulo	/* Get original Tx power based on board type and RF chain. */
2972251538Srpaulo	if (!(sc->chip & URTWN_CHIP_92C)) {
2973251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2974251538Srpaulo			base = &rtl8188ru_txagc[chain];
2975251538Srpaulo		else
2976251538Srpaulo			base = &rtl8192cu_txagc[chain];
2977251538Srpaulo	} else
2978251538Srpaulo		base = &rtl8192cu_txagc[chain];
2979251538Srpaulo
2980251538Srpaulo	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2981251538Srpaulo	if (sc->regulatory == 0) {
2982251538Srpaulo		for (ridx = 0; ridx <= 3; ridx++)
2983251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2984251538Srpaulo	}
2985251538Srpaulo	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2986251538Srpaulo		if (sc->regulatory == 3) {
2987251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2988251538Srpaulo			/* Apply vendor limits. */
2989251538Srpaulo			if (extc != NULL)
2990251538Srpaulo				max = rom->ht40_max_pwr[group];
2991251538Srpaulo			else
2992251538Srpaulo				max = rom->ht20_max_pwr[group];
2993251538Srpaulo			max = (max >> (chain * 4)) & 0xf;
2994251538Srpaulo			if (power[ridx] > max)
2995251538Srpaulo				power[ridx] = max;
2996251538Srpaulo		} else if (sc->regulatory == 1) {
2997251538Srpaulo			if (extc == NULL)
2998251538Srpaulo				power[ridx] = base->pwr[group][ridx];
2999251538Srpaulo		} else if (sc->regulatory != 2)
3000251538Srpaulo			power[ridx] = base->pwr[0][ridx];
3001251538Srpaulo	}
3002251538Srpaulo
3003251538Srpaulo	/* Compute per-CCK rate Tx power. */
3004251538Srpaulo	cckpow = rom->cck_tx_pwr[chain][group];
3005251538Srpaulo	for (ridx = 0; ridx <= 3; ridx++) {
3006251538Srpaulo		power[ridx] += cckpow;
3007251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
3008251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
3009251538Srpaulo	}
3010251538Srpaulo
3011251538Srpaulo	htpow = rom->ht40_1s_tx_pwr[chain][group];
3012251538Srpaulo	if (sc->ntxchains > 1) {
3013251538Srpaulo		/* Apply reduction for 2 spatial streams. */
3014251538Srpaulo		diff = rom->ht40_2s_tx_pwr_diff[group];
3015251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
3016251538Srpaulo		htpow = (htpow > diff) ? htpow - diff : 0;
3017251538Srpaulo	}
3018251538Srpaulo
3019251538Srpaulo	/* Compute per-OFDM rate Tx power. */
3020251538Srpaulo	diff = rom->ofdm_tx_pwr_diff[group];
3021251538Srpaulo	diff = (diff >> (chain * 4)) & 0xf;
3022251538Srpaulo	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3023251538Srpaulo	for (ridx = 4; ridx <= 11; ridx++) {
3024251538Srpaulo		power[ridx] += ofdmpow;
3025251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
3026251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
3027251538Srpaulo	}
3028251538Srpaulo
3029251538Srpaulo	/* Compute per-MCS Tx power. */
3030251538Srpaulo	if (extc == NULL) {
3031251538Srpaulo		diff = rom->ht20_tx_pwr_diff[group];
3032251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
3033251538Srpaulo		htpow += diff;	/* HT40->HT20 correction. */
3034251538Srpaulo	}
3035251538Srpaulo	for (ridx = 12; ridx <= 27; ridx++) {
3036251538Srpaulo		power[ridx] += htpow;
3037251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
3038251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
3039251538Srpaulo	}
3040251538Srpaulo#ifdef URTWN_DEBUG
3041251538Srpaulo	if (urtwn_debug >= 4) {
3042251538Srpaulo		/* Dump per-rate Tx power values. */
3043251538Srpaulo		printf("Tx power for chain %d:\n", chain);
3044251538Srpaulo		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
3045251538Srpaulo			printf("Rate %d = %u\n", ridx, power[ridx]);
3046251538Srpaulo	}
3047251538Srpaulo#endif
3048251538Srpaulo}
3049251538Srpaulo
3050251538Srpaulovoid
3051264912Skevlourtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3052264912Skevlo    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3053264912Skevlo    uint16_t power[URTWN_RIDX_COUNT])
3054264912Skevlo{
3055264912Skevlo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3056264912Skevlo	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3057264912Skevlo	const struct urtwn_r88e_txpwr *base;
3058264912Skevlo	int ridx, chan, group;
3059264912Skevlo
3060264912Skevlo	/* Determine channel group. */
3061264912Skevlo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3062264912Skevlo	if (chan <= 2)
3063264912Skevlo		group = 0;
3064264912Skevlo	else if (chan <= 5)
3065264912Skevlo		group = 1;
3066264912Skevlo	else if (chan <= 8)
3067264912Skevlo		group = 2;
3068264912Skevlo	else if (chan <= 11)
3069264912Skevlo		group = 3;
3070264912Skevlo	else if (chan <= 13)
3071264912Skevlo		group = 4;
3072264912Skevlo	else
3073264912Skevlo		group = 5;
3074264912Skevlo
3075264912Skevlo	/* Get original Tx power based on board type and RF chain. */
3076264912Skevlo	base = &rtl8188eu_txagc[chain];
3077264912Skevlo
3078264912Skevlo	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3079264912Skevlo	if (sc->regulatory == 0) {
3080264912Skevlo		for (ridx = 0; ridx <= 3; ridx++)
3081264912Skevlo			power[ridx] = base->pwr[0][ridx];
3082264912Skevlo	}
3083264912Skevlo	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
3084264912Skevlo		if (sc->regulatory == 3)
3085264912Skevlo			power[ridx] = base->pwr[0][ridx];
3086264912Skevlo		else if (sc->regulatory == 1) {
3087264912Skevlo			if (extc == NULL)
3088264912Skevlo				power[ridx] = base->pwr[group][ridx];
3089264912Skevlo		} else if (sc->regulatory != 2)
3090264912Skevlo			power[ridx] = base->pwr[0][ridx];
3091264912Skevlo	}
3092264912Skevlo
3093264912Skevlo	/* Compute per-CCK rate Tx power. */
3094264912Skevlo	cckpow = sc->cck_tx_pwr[group];
3095264912Skevlo	for (ridx = 0; ridx <= 3; ridx++) {
3096264912Skevlo		power[ridx] += cckpow;
3097264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3098264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3099264912Skevlo	}
3100264912Skevlo
3101264912Skevlo	htpow = sc->ht40_tx_pwr[group];
3102264912Skevlo
3103264912Skevlo	/* Compute per-OFDM rate Tx power. */
3104264912Skevlo	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3105264912Skevlo	for (ridx = 4; ridx <= 11; ridx++) {
3106264912Skevlo		power[ridx] += ofdmpow;
3107264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3108264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3109264912Skevlo	}
3110264912Skevlo
3111264912Skevlo	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3112264912Skevlo	for (ridx = 12; ridx <= 27; ridx++) {
3113264912Skevlo		power[ridx] += bw20pow;
3114264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3115264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3116264912Skevlo	}
3117264912Skevlo}
3118264912Skevlo
3119264912Skevlovoid
3120251538Srpaulourtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3121251538Srpaulo    struct ieee80211_channel *extc)
3122251538Srpaulo{
3123251538Srpaulo	uint16_t power[URTWN_RIDX_COUNT];
3124251538Srpaulo	int i;
3125251538Srpaulo
3126251538Srpaulo	for (i = 0; i < sc->ntxchains; i++) {
3127251538Srpaulo		/* Compute per-rate Tx power values. */
3128264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
3129264912Skevlo			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3130264912Skevlo		else
3131264912Skevlo			urtwn_get_txpower(sc, i, c, extc, power);
3132251538Srpaulo		/* Write per-rate Tx power values to hardware. */
3133251538Srpaulo		urtwn_write_txpower(sc, i, power);
3134251538Srpaulo	}
3135251538Srpaulo}
3136251538Srpaulo
3137251538Srpaulostatic void
3138251538Srpaulourtwn_scan_start(struct ieee80211com *ic)
3139251538Srpaulo{
3140251538Srpaulo	/* XXX do nothing?  */
3141251538Srpaulo}
3142251538Srpaulo
3143251538Srpaulostatic void
3144251538Srpaulourtwn_scan_end(struct ieee80211com *ic)
3145251538Srpaulo{
3146251538Srpaulo	/* XXX do nothing?  */
3147251538Srpaulo}
3148251538Srpaulo
3149251538Srpaulostatic void
3150251538Srpaulourtwn_set_channel(struct ieee80211com *ic)
3151251538Srpaulo{
3152251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
3153281070Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3154251538Srpaulo
3155251538Srpaulo	URTWN_LOCK(sc);
3156281070Srpaulo	if (vap->iv_state == IEEE80211_S_SCAN) {
3157281070Srpaulo		/* Make link LED blink during scan. */
3158281070Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3159281070Srpaulo	}
3160251538Srpaulo	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3161251538Srpaulo	URTWN_UNLOCK(sc);
3162251538Srpaulo}
3163251538Srpaulo
3164251538Srpaulostatic void
3165251538Srpaulourtwn_update_mcast(struct ifnet *ifp)
3166251538Srpaulo{
3167251538Srpaulo	/* XXX do nothing?  */
3168251538Srpaulo}
3169251538Srpaulo
3170251538Srpaulostatic void
3171251538Srpaulourtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3172251538Srpaulo    struct ieee80211_channel *extc)
3173251538Srpaulo{
3174251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3175251538Srpaulo	uint32_t reg;
3176251538Srpaulo	u_int chan;
3177251538Srpaulo	int i;
3178251538Srpaulo
3179251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3180251538Srpaulo	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3181251538Srpaulo		device_printf(sc->sc_dev,
3182251538Srpaulo		    "%s: invalid channel %x\n", __func__, chan);
3183251538Srpaulo		return;
3184251538Srpaulo	}
3185251538Srpaulo
3186251538Srpaulo	/* Set Tx power for this new channel. */
3187251538Srpaulo	urtwn_set_txpower(sc, c, extc);
3188251538Srpaulo
3189251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
3190251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3191251538Srpaulo		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3192251538Srpaulo	}
3193251538Srpaulo#ifndef IEEE80211_NO_HT
3194251538Srpaulo	if (extc != NULL) {
3195251538Srpaulo		/* Is secondary channel below or above primary? */
3196251538Srpaulo		int prichlo = c->ic_freq < extc->ic_freq;
3197251538Srpaulo
3198251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
3199251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3200251538Srpaulo
3201251538Srpaulo		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3202251538Srpaulo		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3203251538Srpaulo		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3204251538Srpaulo
3205251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3206251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3207251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3208251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3209251538Srpaulo
3210251538Srpaulo		/* Set CCK side band. */
3211251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3212251538Srpaulo		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3213251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3214251538Srpaulo
3215251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3216251538Srpaulo		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3217251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3218251538Srpaulo
3219251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3220251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3221251538Srpaulo		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3222251538Srpaulo
3223251538Srpaulo		reg = urtwn_bb_read(sc, 0x818);
3224251538Srpaulo		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3225251538Srpaulo		urtwn_bb_write(sc, 0x818, reg);
3226251538Srpaulo
3227251538Srpaulo		/* Select 40MHz bandwidth. */
3228251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3229251538Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3230251538Srpaulo	} else
3231251538Srpaulo#endif
3232251538Srpaulo	{
3233251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
3234251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3235251538Srpaulo
3236251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3237251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3238251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3239251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3240251538Srpaulo
3241264912Skevlo		if (!(sc->chip & URTWN_CHIP_88E)) {
3242264912Skevlo			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3243264912Skevlo			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3244264912Skevlo			    R92C_FPGA0_ANAPARAM2_CBW20);
3245264912Skevlo		}
3246281069Srpaulo
3247251538Srpaulo		/* Select 20MHz bandwidth. */
3248251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3249281069Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3250264912Skevlo		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3251264912Skevlo		    R92C_RF_CHNLBW_BW20));
3252251538Srpaulo	}
3253251538Srpaulo}
3254251538Srpaulo
3255251538Srpaulostatic void
3256251538Srpaulourtwn_iq_calib(struct urtwn_softc *sc)
3257251538Srpaulo{
3258251538Srpaulo	/* TODO */
3259251538Srpaulo}
3260251538Srpaulo
3261251538Srpaulostatic void
3262251538Srpaulourtwn_lc_calib(struct urtwn_softc *sc)
3263251538Srpaulo{
3264251538Srpaulo	uint32_t rf_ac[2];
3265251538Srpaulo	uint8_t txmode;
3266251538Srpaulo	int i;
3267251538Srpaulo
3268251538Srpaulo	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3269251538Srpaulo	if ((txmode & 0x70) != 0) {
3270251538Srpaulo		/* Disable all continuous Tx. */
3271251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3272251538Srpaulo
3273251538Srpaulo		/* Set RF mode to standby mode. */
3274251538Srpaulo		for (i = 0; i < sc->nrxchains; i++) {
3275251538Srpaulo			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3276251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC,
3277251538Srpaulo			    RW(rf_ac[i], R92C_RF_AC_MODE,
3278251538Srpaulo				R92C_RF_AC_MODE_STANDBY));
3279251538Srpaulo		}
3280251538Srpaulo	} else {
3281251538Srpaulo		/* Block all Tx queues. */
3282251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3283251538Srpaulo	}
3284251538Srpaulo	/* Start calibration. */
3285251538Srpaulo	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3286251538Srpaulo	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3287251538Srpaulo
3288251538Srpaulo	/* Give calibration the time to complete. */
3289266472Shselasky	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3290251538Srpaulo
3291251538Srpaulo	/* Restore configuration. */
3292251538Srpaulo	if ((txmode & 0x70) != 0) {
3293251538Srpaulo		/* Restore Tx mode. */
3294251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3295251538Srpaulo		/* Restore RF mode. */
3296251538Srpaulo		for (i = 0; i < sc->nrxchains; i++)
3297251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3298251538Srpaulo	} else {
3299251538Srpaulo		/* Unblock all Tx queues. */
3300251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3301251538Srpaulo	}
3302251538Srpaulo}
3303251538Srpaulo
3304251538Srpaulostatic void
3305251538Srpaulourtwn_init_locked(void *arg)
3306251538Srpaulo{
3307251538Srpaulo	struct urtwn_softc *sc = arg;
3308251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
3309251538Srpaulo	uint32_t reg;
3310251538Srpaulo	int error;
3311251538Srpaulo
3312264864Skevlo	URTWN_ASSERT_LOCKED(sc);
3313264864Skevlo
3314251538Srpaulo	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3315263153Skevlo		urtwn_stop_locked(ifp);
3316251538Srpaulo
3317251538Srpaulo	/* Init firmware commands ring. */
3318251538Srpaulo	sc->fwcur = 0;
3319251538Srpaulo
3320251538Srpaulo	/* Allocate Tx/Rx buffers. */
3321251538Srpaulo	error = urtwn_alloc_rx_list(sc);
3322251538Srpaulo	if (error != 0)
3323251538Srpaulo		goto fail;
3324281069Srpaulo
3325251538Srpaulo	error = urtwn_alloc_tx_list(sc);
3326251538Srpaulo	if (error != 0)
3327251538Srpaulo		goto fail;
3328251538Srpaulo
3329251538Srpaulo	/* Power on adapter. */
3330251538Srpaulo	error = urtwn_power_on(sc);
3331251538Srpaulo	if (error != 0)
3332251538Srpaulo		goto fail;
3333251538Srpaulo
3334251538Srpaulo	/* Initialize DMA. */
3335251538Srpaulo	error = urtwn_dma_init(sc);
3336251538Srpaulo	if (error != 0)
3337251538Srpaulo		goto fail;
3338251538Srpaulo
3339251538Srpaulo	/* Set info size in Rx descriptors (in 64-bit words). */
3340251538Srpaulo	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3341251538Srpaulo
3342251538Srpaulo	/* Init interrupts. */
3343264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
3344264912Skevlo		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3345264912Skevlo		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3346264912Skevlo		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3347264912Skevlo		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3348264912Skevlo		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3349264912Skevlo		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3350264912Skevlo		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3351264912Skevlo		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3352264912Skevlo	} else {
3353264912Skevlo		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3354264912Skevlo		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3355264912Skevlo	}
3356251538Srpaulo
3357251538Srpaulo	/* Set MAC address. */
3358251538Srpaulo	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
3359251538Srpaulo	    IEEE80211_ADDR_LEN);
3360251538Srpaulo
3361251538Srpaulo	/* Set initial network type. */
3362251538Srpaulo	reg = urtwn_read_4(sc, R92C_CR);
3363251538Srpaulo	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3364251538Srpaulo	urtwn_write_4(sc, R92C_CR, reg);
3365251538Srpaulo
3366251538Srpaulo	urtwn_rxfilter_init(sc);
3367251538Srpaulo
3368251538Srpaulo	reg = urtwn_read_4(sc, R92C_RRSR);
3369251538Srpaulo	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3370251538Srpaulo	urtwn_write_4(sc, R92C_RRSR, reg);
3371251538Srpaulo
3372251538Srpaulo	/* Set short/long retry limits. */
3373251538Srpaulo	urtwn_write_2(sc, R92C_RL,
3374251538Srpaulo	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3375251538Srpaulo
3376251538Srpaulo	/* Initialize EDCA parameters. */
3377251538Srpaulo	urtwn_edca_init(sc);
3378251538Srpaulo
3379251538Srpaulo	/* Setup rate fallback. */
3380264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3381264912Skevlo		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3382264912Skevlo		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3383264912Skevlo		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3384264912Skevlo		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3385264912Skevlo	}
3386251538Srpaulo
3387251538Srpaulo	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3388251538Srpaulo	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3389251538Srpaulo	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3390251538Srpaulo	/* Set ACK timeout. */
3391251538Srpaulo	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3392251538Srpaulo
3393251538Srpaulo	/* Setup USB aggregation. */
3394251538Srpaulo	reg = urtwn_read_4(sc, R92C_TDECTRL);
3395251538Srpaulo	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3396251538Srpaulo	urtwn_write_4(sc, R92C_TDECTRL, reg);
3397251538Srpaulo	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3398251538Srpaulo	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3399251538Srpaulo	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3400251538Srpaulo	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3401251538Srpaulo	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3402251538Srpaulo	    R92C_USB_SPECIAL_OPTION_AGG_EN);
3403251538Srpaulo	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3404264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
3405264912Skevlo		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3406264912Skevlo	else
3407264912Skevlo		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3408251538Srpaulo	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3409251538Srpaulo	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3410251538Srpaulo
3411251538Srpaulo	/* Initialize beacon parameters. */
3412264912Skevlo	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3413251538Srpaulo	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3414251538Srpaulo	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3415251538Srpaulo	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3416251538Srpaulo	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3417251538Srpaulo
3418264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3419264912Skevlo		/* Setup AMPDU aggregation. */
3420264912Skevlo		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3421264912Skevlo		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3422264912Skevlo		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3423251538Srpaulo
3424264912Skevlo		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3425264912Skevlo	}
3426251538Srpaulo
3427251538Srpaulo	/* Load 8051 microcode. */
3428251538Srpaulo	error = urtwn_load_firmware(sc);
3429251538Srpaulo	if (error != 0)
3430251538Srpaulo		goto fail;
3431251538Srpaulo
3432251538Srpaulo	/* Initialize MAC/BB/RF blocks. */
3433251538Srpaulo	urtwn_mac_init(sc);
3434251538Srpaulo	urtwn_bb_init(sc);
3435251538Srpaulo	urtwn_rf_init(sc);
3436251538Srpaulo
3437264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
3438264912Skevlo		urtwn_write_2(sc, R92C_CR,
3439264912Skevlo		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3440264912Skevlo		    R92C_CR_MACRXEN);
3441264912Skevlo	}
3442264912Skevlo
3443251538Srpaulo	/* Turn CCK and OFDM blocks on. */
3444251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3445251538Srpaulo	reg |= R92C_RFMOD_CCK_EN;
3446251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3447251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3448251538Srpaulo	reg |= R92C_RFMOD_OFDM_EN;
3449251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3450251538Srpaulo
3451251538Srpaulo	/* Clear per-station keys table. */
3452251538Srpaulo	urtwn_cam_init(sc);
3453251538Srpaulo
3454251538Srpaulo	/* Enable hardware sequence numbering. */
3455251538Srpaulo	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3456251538Srpaulo
3457251538Srpaulo	/* Perform LO and IQ calibrations. */
3458251538Srpaulo	urtwn_iq_calib(sc);
3459251538Srpaulo	/* Perform LC calibration. */
3460251538Srpaulo	urtwn_lc_calib(sc);
3461251538Srpaulo
3462251538Srpaulo	/* Fix USB interference issue. */
3463264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3464264912Skevlo		urtwn_write_1(sc, 0xfe40, 0xe0);
3465264912Skevlo		urtwn_write_1(sc, 0xfe41, 0x8d);
3466264912Skevlo		urtwn_write_1(sc, 0xfe42, 0x80);
3467251538Srpaulo
3468264912Skevlo		urtwn_pa_bias_init(sc);
3469264912Skevlo	}
3470251538Srpaulo
3471251538Srpaulo	/* Initialize GPIO setting. */
3472251538Srpaulo	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3473251538Srpaulo	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3474251538Srpaulo
3475251538Srpaulo	/* Fix for lower temperature. */
3476264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E))
3477264912Skevlo		urtwn_write_1(sc, 0x15, 0xe9);
3478251538Srpaulo
3479251538Srpaulo	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3480251538Srpaulo
3481251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3482251538Srpaulo	ifp->if_drv_flags |= IFF_DRV_RUNNING;
3483251538Srpaulo
3484251538Srpaulo	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3485251538Srpaulofail:
3486251538Srpaulo	return;
3487251538Srpaulo}
3488251538Srpaulo
3489251538Srpaulostatic void
3490251538Srpaulourtwn_init(void *arg)
3491251538Srpaulo{
3492251538Srpaulo	struct urtwn_softc *sc = arg;
3493251538Srpaulo
3494251538Srpaulo	URTWN_LOCK(sc);
3495251538Srpaulo	urtwn_init_locked(arg);
3496251538Srpaulo	URTWN_UNLOCK(sc);
3497251538Srpaulo}
3498251538Srpaulo
3499251538Srpaulostatic void
3500263153Skevlourtwn_stop_locked(struct ifnet *ifp)
3501251538Srpaulo{
3502251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3503251538Srpaulo
3504264864Skevlo	URTWN_ASSERT_LOCKED(sc);
3505264864Skevlo
3506251538Srpaulo	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
3507251538Srpaulo
3508251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
3509251538Srpaulo	urtwn_abort_xfers(sc);
3510251538Srpaulo}
3511251538Srpaulo
3512251538Srpaulostatic void
3513263153Skevlourtwn_stop(struct ifnet *ifp)
3514251538Srpaulo{
3515251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3516251538Srpaulo
3517251538Srpaulo	URTWN_LOCK(sc);
3518263153Skevlo	urtwn_stop_locked(ifp);
3519251538Srpaulo	URTWN_UNLOCK(sc);
3520251538Srpaulo}
3521251538Srpaulo
3522251538Srpaulostatic void
3523251538Srpaulourtwn_abort_xfers(struct urtwn_softc *sc)
3524251538Srpaulo{
3525251538Srpaulo	int i;
3526251538Srpaulo
3527251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
3528251538Srpaulo
3529251538Srpaulo	/* abort any pending transfers */
3530251538Srpaulo	for (i = 0; i < URTWN_N_TRANSFER; i++)
3531251538Srpaulo		usbd_transfer_stop(sc->sc_xfer[i]);
3532251538Srpaulo}
3533251538Srpaulo
3534251538Srpaulostatic int
3535251538Srpaulourtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3536251538Srpaulo    const struct ieee80211_bpf_params *params)
3537251538Srpaulo{
3538251538Srpaulo	struct ieee80211com *ic = ni->ni_ic;
3539251538Srpaulo	struct ifnet *ifp = ic->ic_ifp;
3540251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3541251538Srpaulo	struct urtwn_data *bf;
3542251538Srpaulo
3543251538Srpaulo	/* prevent management frames from being sent if we're not ready */
3544251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3545251538Srpaulo		m_freem(m);
3546251538Srpaulo		ieee80211_free_node(ni);
3547251538Srpaulo		return (ENETDOWN);
3548251538Srpaulo	}
3549251538Srpaulo	URTWN_LOCK(sc);
3550251538Srpaulo	bf = urtwn_getbuf(sc);
3551251538Srpaulo	if (bf == NULL) {
3552251538Srpaulo		ieee80211_free_node(ni);
3553251538Srpaulo		m_freem(m);
3554251538Srpaulo		URTWN_UNLOCK(sc);
3555251538Srpaulo		return (ENOBUFS);
3556251538Srpaulo	}
3557251538Srpaulo
3558271866Sglebius	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
3559251538Srpaulo	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3560251538Srpaulo		ieee80211_free_node(ni);
3561271866Sglebius		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
3562251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3563251538Srpaulo		URTWN_UNLOCK(sc);
3564251538Srpaulo		return (EIO);
3565251538Srpaulo	}
3566251538Srpaulo	URTWN_UNLOCK(sc);
3567251538Srpaulo
3568251538Srpaulo	sc->sc_txtimer = 5;
3569251538Srpaulo	return (0);
3570251538Srpaulo}
3571251538Srpaulo
3572266472Shselaskystatic void
3573266472Shselaskyurtwn_ms_delay(struct urtwn_softc *sc)
3574266472Shselasky{
3575266472Shselasky	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3576266472Shselasky}
3577266472Shselasky
3578251538Srpaulostatic device_method_t urtwn_methods[] = {
3579251538Srpaulo	/* Device interface */
3580251538Srpaulo	DEVMETHOD(device_probe,		urtwn_match),
3581251538Srpaulo	DEVMETHOD(device_attach,	urtwn_attach),
3582251538Srpaulo	DEVMETHOD(device_detach,	urtwn_detach),
3583251538Srpaulo
3584264912Skevlo	DEVMETHOD_END
3585251538Srpaulo};
3586251538Srpaulo
3587251538Srpaulostatic driver_t urtwn_driver = {
3588251538Srpaulo	"urtwn",
3589251538Srpaulo	urtwn_methods,
3590251538Srpaulo	sizeof(struct urtwn_softc)
3591251538Srpaulo};
3592251538Srpaulo
3593251538Srpaulostatic devclass_t urtwn_devclass;
3594251538Srpaulo
3595251538SrpauloDRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3596251538SrpauloMODULE_DEPEND(urtwn, usb, 1, 1, 1);
3597251538SrpauloMODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3598251538SrpauloMODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3599251538SrpauloMODULE_VERSION(urtwn, 1);
3600