if_urtwn.c revision 283537
1251538Srpaulo/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2251538Srpaulo
3251538Srpaulo/*-
4251538Srpaulo * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5264912Skevlo * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6251538Srpaulo *
7251538Srpaulo * Permission to use, copy, modify, and distribute this software for any
8251538Srpaulo * purpose with or without fee is hereby granted, provided that the above
9251538Srpaulo * copyright notice and this permission notice appear in all copies.
10251538Srpaulo *
11251538Srpaulo * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12251538Srpaulo * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13251538Srpaulo * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14251538Srpaulo * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15251538Srpaulo * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16251538Srpaulo * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17251538Srpaulo * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18251538Srpaulo */
19251538Srpaulo
20251538Srpaulo#include <sys/cdefs.h>
21251538Srpaulo__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 283537 2015-05-25 18:50:26Z glebius $");
22251538Srpaulo
23251538Srpaulo/*
24264912Skevlo * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25251538Srpaulo */
26251538Srpaulo
27251538Srpaulo#include <sys/param.h>
28251538Srpaulo#include <sys/sockio.h>
29251538Srpaulo#include <sys/sysctl.h>
30251538Srpaulo#include <sys/lock.h>
31251538Srpaulo#include <sys/mutex.h>
32251538Srpaulo#include <sys/mbuf.h>
33251538Srpaulo#include <sys/kernel.h>
34251538Srpaulo#include <sys/socket.h>
35251538Srpaulo#include <sys/systm.h>
36251538Srpaulo#include <sys/malloc.h>
37251538Srpaulo#include <sys/module.h>
38251538Srpaulo#include <sys/bus.h>
39251538Srpaulo#include <sys/endian.h>
40251538Srpaulo#include <sys/linker.h>
41251538Srpaulo#include <sys/firmware.h>
42251538Srpaulo#include <sys/kdb.h>
43251538Srpaulo
44251538Srpaulo#include <machine/bus.h>
45251538Srpaulo#include <machine/resource.h>
46251538Srpaulo#include <sys/rman.h>
47251538Srpaulo
48251538Srpaulo#include <net/bpf.h>
49251538Srpaulo#include <net/if.h>
50257176Sglebius#include <net/if_var.h>
51251538Srpaulo#include <net/if_arp.h>
52251538Srpaulo#include <net/ethernet.h>
53251538Srpaulo#include <net/if_dl.h>
54251538Srpaulo#include <net/if_media.h>
55251538Srpaulo#include <net/if_types.h>
56251538Srpaulo
57251538Srpaulo#include <netinet/in.h>
58251538Srpaulo#include <netinet/in_systm.h>
59251538Srpaulo#include <netinet/in_var.h>
60251538Srpaulo#include <netinet/if_ether.h>
61251538Srpaulo#include <netinet/ip.h>
62251538Srpaulo
63251538Srpaulo#include <net80211/ieee80211_var.h>
64251538Srpaulo#include <net80211/ieee80211_regdomain.h>
65251538Srpaulo#include <net80211/ieee80211_radiotap.h>
66251538Srpaulo#include <net80211/ieee80211_ratectl.h>
67251538Srpaulo
68251538Srpaulo#include <dev/usb/usb.h>
69251538Srpaulo#include <dev/usb/usbdi.h>
70251538Srpaulo#include "usbdevs.h"
71251538Srpaulo
72251538Srpaulo#define USB_DEBUG_VAR urtwn_debug
73251538Srpaulo#include <dev/usb/usb_debug.h>
74251538Srpaulo
75251538Srpaulo#include <dev/usb/wlan/if_urtwnreg.h>
76251538Srpaulo
77251538Srpaulo#ifdef USB_DEBUG
78251538Srpaulostatic int urtwn_debug = 0;
79251538Srpaulo
80251538SrpauloSYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
81276701ShselaskySYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
82251538Srpaulo    "Debug level");
83251538Srpaulo#endif
84251538Srpaulo
85252406Srpaulo#define	URTWN_RSSI(r)  (r) - 110
86251538Srpaulo#define	IEEE80211_HAS_ADDR4(wh)	\
87251538Srpaulo	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
88251538Srpaulo
89251538Srpaulo/* various supported device vendors/products */
90251596Srpaulostatic const STRUCT_USB_HOST_ID urtwn_devs[] = {
91251538Srpaulo#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
92264912Skevlo#define	URTWN_RTL8188E_DEV(v,p)	\
93264912Skevlo	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
94264912Skevlo#define URTWN_RTL8188E  1
95251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_1),
96251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8188CU_2),
97251538Srpaulo	URTWN_DEV(ABOCOM,	RTL8192CU),
98251538Srpaulo	URTWN_DEV(ASUS,		RTL8192CU),
99266721Skevlo	URTWN_DEV(ASUS,		USBN10NANO),
100251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
101251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
102251538Srpaulo	URTWN_DEV(AZUREWAVE,	RTL8188CU),
103251538Srpaulo	URTWN_DEV(BELKIN,	F7D2102),
104251538Srpaulo	URTWN_DEV(BELKIN,	RTL8188CU),
105251538Srpaulo	URTWN_DEV(BELKIN,	RTL8192CU),
106251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_1),
107251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_2),
108251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_3),
109251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_4),
110251538Srpaulo	URTWN_DEV(CHICONY,	RTL8188CUS_5),
111251538Srpaulo	URTWN_DEV(COREGA,	RTL8192CU),
112251538Srpaulo	URTWN_DEV(DLINK,	RTL8188CU),
113251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_1),
114251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_2),
115251538Srpaulo	URTWN_DEV(DLINK,	RTL8192CU_3),
116252196Skevlo	URTWN_DEV(DLINK,	DWA131B),
117251538Srpaulo	URTWN_DEV(EDIMAX,	EW7811UN),
118251538Srpaulo	URTWN_DEV(EDIMAX,	RTL8192CU),
119251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8188CU),
120251538Srpaulo	URTWN_DEV(FEIXUN,	RTL8192CU),
121251538Srpaulo	URTWN_DEV(GUILLEMOT,	HWNUP150),
122251538Srpaulo	URTWN_DEV(HAWKING,	RTL8192CU),
123251538Srpaulo	URTWN_DEV(HP3,		RTL8188CU),
124251538Srpaulo	URTWN_DEV(NETGEAR,	WNA1000M),
125251538Srpaulo	URTWN_DEV(NETGEAR,	RTL8192CU),
126251538Srpaulo	URTWN_DEV(NETGEAR4,	RTL8188CU),
127251538Srpaulo	URTWN_DEV(NOVATECH,	RTL8188CU),
128251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_1),
129251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_2),
130251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_3),
131251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CU_4),
132251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8188CUS),
133251538Srpaulo	URTWN_DEV(PLANEX2,	RTL8192CU),
134251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_0),
135251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CE_1),
136251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CTV),
137251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_0),
138251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_1),
139251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_2),
140282119Skevlo	URTWN_DEV(REALTEK,	RTL8188CU_3),
141251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
142251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188CUS),
143251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_1),
144251538Srpaulo	URTWN_DEV(REALTEK,	RTL8188RU_2),
145272410Shselasky	URTWN_DEV(REALTEK,	RTL8188RU_3),
146251538Srpaulo	URTWN_DEV(REALTEK,	RTL8191CU),
147251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CE),
148251538Srpaulo	URTWN_DEV(REALTEK,	RTL8192CU),
149251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
150251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
151251538Srpaulo	URTWN_DEV(SITECOMEU,	RTL8192CU),
152251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8188CU),
153251538Srpaulo	URTWN_DEV(TRENDNET,	RTL8192CU),
154251538Srpaulo	URTWN_DEV(ZYXEL,	RTL8192CU),
155264912Skevlo	/* URTWN_RTL8188E */
156273589Skevlo	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
157270191Skevlo	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
158273589Skevlo	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
159264912Skevlo	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
160264912Skevlo	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
161264912Skevlo#undef URTWN_RTL8188E_DEV
162251538Srpaulo#undef URTWN_DEV
163251538Srpaulo};
164251538Srpaulo
165251538Srpaulostatic device_probe_t	urtwn_match;
166251538Srpaulostatic device_attach_t	urtwn_attach;
167251538Srpaulostatic device_detach_t	urtwn_detach;
168251538Srpaulo
169251538Srpaulostatic usb_callback_t   urtwn_bulk_tx_callback;
170251538Srpaulostatic usb_callback_t	urtwn_bulk_rx_callback;
171251538Srpaulo
172251538Srpaulostatic usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
173251538Srpaulo			    struct usb_device_request *req, void *data);
174251538Srpaulostatic struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
175251538Srpaulo		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
176251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN],
177251538Srpaulo                    const uint8_t [IEEE80211_ADDR_LEN]);
178251538Srpaulostatic void		urtwn_vap_delete(struct ieee80211vap *);
179281069Srpaulostatic struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
180251538Srpaulo			    int *);
181281069Srpaulostatic struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
182251538Srpaulo			    int *, int8_t *);
183251538Srpaulostatic void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
184281069Srpaulostatic int		urtwn_alloc_list(struct urtwn_softc *,
185251538Srpaulo			    struct urtwn_data[], int, int);
186251538Srpaulostatic int		urtwn_alloc_rx_list(struct urtwn_softc *);
187251538Srpaulostatic int		urtwn_alloc_tx_list(struct urtwn_softc *);
188251538Srpaulostatic void		urtwn_free_tx_list(struct urtwn_softc *);
189251538Srpaulostatic void		urtwn_free_rx_list(struct urtwn_softc *);
190251538Srpaulostatic void		urtwn_free_list(struct urtwn_softc *,
191251538Srpaulo			    struct urtwn_data data[], int);
192251538Srpaulostatic struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
193251538Srpaulostatic struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
194281069Srpaulostatic int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
195251538Srpaulo			    uint8_t *, int);
196251538Srpaulostatic void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
197251538Srpaulostatic void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
198251538Srpaulostatic void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
199281069Srpaulostatic int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
200251538Srpaulo			    uint8_t *, int);
201251538Srpaulostatic uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
202251538Srpaulostatic uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
203251538Srpaulostatic uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
204281069Srpaulostatic int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
205251538Srpaulo			    const void *, int);
206264912Skevlostatic void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
207264912Skevlo			    uint8_t, uint32_t);
208281069Srpaulostatic void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
209264912Skevlo			    uint8_t, uint32_t);
210251538Srpaulostatic uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
211281069Srpaulostatic int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
212251538Srpaulo			    uint32_t);
213251538Srpaulostatic uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
214251538Srpaulostatic void		urtwn_efuse_read(struct urtwn_softc *);
215264912Skevlostatic void		urtwn_efuse_switch_power(struct urtwn_softc *);
216251538Srpaulostatic int		urtwn_read_chipid(struct urtwn_softc *);
217251538Srpaulostatic void		urtwn_read_rom(struct urtwn_softc *);
218264912Skevlostatic void		urtwn_r88e_read_rom(struct urtwn_softc *);
219251538Srpaulostatic int		urtwn_ra_init(struct urtwn_softc *);
220251538Srpaulostatic void		urtwn_tsf_sync_enable(struct urtwn_softc *);
221251538Srpaulostatic void		urtwn_set_led(struct urtwn_softc *, int, int);
222281069Srpaulostatic int		urtwn_newstate(struct ieee80211vap *,
223251538Srpaulo			    enum ieee80211_state, int);
224251538Srpaulostatic void		urtwn_watchdog(void *);
225251538Srpaulostatic void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
226251538Srpaulostatic int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
227264912Skevlostatic int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
228251538Srpaulostatic int		urtwn_tx_start(struct urtwn_softc *,
229251538Srpaulo			    struct ieee80211_node *, struct mbuf *,
230251538Srpaulo			    struct urtwn_data *);
231251538Srpaulostatic void		urtwn_start(struct ifnet *);
232261863Srpaulostatic void		urtwn_start_locked(struct ifnet *,
233261863Srpaulo			    struct urtwn_softc *);
234251538Srpaulostatic int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
235264912Skevlostatic int		urtwn_r92c_power_on(struct urtwn_softc *);
236264912Skevlostatic int		urtwn_r88e_power_on(struct urtwn_softc *);
237251538Srpaulostatic int		urtwn_llt_init(struct urtwn_softc *);
238251538Srpaulostatic void		urtwn_fw_reset(struct urtwn_softc *);
239264912Skevlostatic void		urtwn_r88e_fw_reset(struct urtwn_softc *);
240281069Srpaulostatic int		urtwn_fw_loadpage(struct urtwn_softc *, int,
241251538Srpaulo			    const uint8_t *, int);
242251538Srpaulostatic int		urtwn_load_firmware(struct urtwn_softc *);
243264912Skevlostatic int		urtwn_r92c_dma_init(struct urtwn_softc *);
244264912Skevlostatic int		urtwn_r88e_dma_init(struct urtwn_softc *);
245251538Srpaulostatic void		urtwn_mac_init(struct urtwn_softc *);
246251538Srpaulostatic void		urtwn_bb_init(struct urtwn_softc *);
247251538Srpaulostatic void		urtwn_rf_init(struct urtwn_softc *);
248251538Srpaulostatic void		urtwn_cam_init(struct urtwn_softc *);
249251538Srpaulostatic void		urtwn_pa_bias_init(struct urtwn_softc *);
250251538Srpaulostatic void		urtwn_rxfilter_init(struct urtwn_softc *);
251251538Srpaulostatic void		urtwn_edca_init(struct urtwn_softc *);
252281069Srpaulostatic void		urtwn_write_txpower(struct urtwn_softc *, int,
253251538Srpaulo			    uint16_t[]);
254251538Srpaulostatic void		urtwn_get_txpower(struct urtwn_softc *, int,
255281069Srpaulo		      	    struct ieee80211_channel *,
256251538Srpaulo			    struct ieee80211_channel *, uint16_t[]);
257264912Skevlostatic void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
258281069Srpaulo		      	    struct ieee80211_channel *,
259264912Skevlo			    struct ieee80211_channel *, uint16_t[]);
260251538Srpaulostatic void		urtwn_set_txpower(struct urtwn_softc *,
261281069Srpaulo		    	    struct ieee80211_channel *,
262251538Srpaulo			    struct ieee80211_channel *);
263251538Srpaulostatic void		urtwn_scan_start(struct ieee80211com *);
264251538Srpaulostatic void		urtwn_scan_end(struct ieee80211com *);
265251538Srpaulostatic void		urtwn_set_channel(struct ieee80211com *);
266251538Srpaulostatic void		urtwn_set_chan(struct urtwn_softc *,
267281069Srpaulo		    	    struct ieee80211_channel *,
268251538Srpaulo			    struct ieee80211_channel *);
269251538Srpaulostatic void		urtwn_update_mcast(struct ifnet *);
270251538Srpaulostatic void		urtwn_iq_calib(struct urtwn_softc *);
271251538Srpaulostatic void		urtwn_lc_calib(struct urtwn_softc *);
272251538Srpaulostatic void		urtwn_init(void *);
273251538Srpaulostatic void		urtwn_init_locked(void *);
274263153Skevlostatic void		urtwn_stop(struct ifnet *);
275263153Skevlostatic void		urtwn_stop_locked(struct ifnet *);
276251538Srpaulostatic void		urtwn_abort_xfers(struct urtwn_softc *);
277251538Srpaulostatic int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
278251538Srpaulo			    const struct ieee80211_bpf_params *);
279266472Shselaskystatic void		urtwn_ms_delay(struct urtwn_softc *);
280251538Srpaulo
281251538Srpaulo/* Aliases. */
282251538Srpaulo#define	urtwn_bb_write	urtwn_write_4
283251538Srpaulo#define urtwn_bb_read	urtwn_read_4
284251538Srpaulo
285251538Srpaulostatic const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
286251538Srpaulo	[URTWN_BULK_RX] = {
287251538Srpaulo		.type = UE_BULK,
288251538Srpaulo		.endpoint = UE_ADDR_ANY,
289251538Srpaulo		.direction = UE_DIR_IN,
290251538Srpaulo		.bufsize = URTWN_RXBUFSZ,
291251538Srpaulo		.flags = {
292251538Srpaulo			.pipe_bof = 1,
293251538Srpaulo			.short_xfer_ok = 1
294251538Srpaulo		},
295251538Srpaulo		.callback = urtwn_bulk_rx_callback,
296251538Srpaulo	},
297251538Srpaulo	[URTWN_BULK_TX_BE] = {
298251538Srpaulo		.type = UE_BULK,
299251538Srpaulo		.endpoint = 0x03,
300251538Srpaulo		.direction = UE_DIR_OUT,
301251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
302251538Srpaulo		.flags = {
303251538Srpaulo			.ext_buffer = 1,
304251538Srpaulo			.pipe_bof = 1,
305251538Srpaulo			.force_short_xfer = 1
306251538Srpaulo		},
307251538Srpaulo		.callback = urtwn_bulk_tx_callback,
308251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
309251538Srpaulo	},
310251538Srpaulo	[URTWN_BULK_TX_BK] = {
311251538Srpaulo		.type = UE_BULK,
312251538Srpaulo		.endpoint = 0x03,
313251538Srpaulo		.direction = UE_DIR_OUT,
314251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
315251538Srpaulo		.flags = {
316251538Srpaulo			.ext_buffer = 1,
317251538Srpaulo			.pipe_bof = 1,
318251538Srpaulo			.force_short_xfer = 1,
319251538Srpaulo		},
320251538Srpaulo		.callback = urtwn_bulk_tx_callback,
321251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
322251538Srpaulo	},
323251538Srpaulo	[URTWN_BULK_TX_VI] = {
324251538Srpaulo		.type = UE_BULK,
325251538Srpaulo		.endpoint = 0x02,
326251538Srpaulo		.direction = UE_DIR_OUT,
327251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
328251538Srpaulo		.flags = {
329251538Srpaulo			.ext_buffer = 1,
330251538Srpaulo			.pipe_bof = 1,
331251538Srpaulo			.force_short_xfer = 1
332251538Srpaulo		},
333251538Srpaulo		.callback = urtwn_bulk_tx_callback,
334251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
335251538Srpaulo	},
336251538Srpaulo	[URTWN_BULK_TX_VO] = {
337251538Srpaulo		.type = UE_BULK,
338251538Srpaulo		.endpoint = 0x02,
339251538Srpaulo		.direction = UE_DIR_OUT,
340251538Srpaulo		.bufsize = URTWN_TXBUFSZ,
341251538Srpaulo		.flags = {
342251538Srpaulo			.ext_buffer = 1,
343251538Srpaulo			.pipe_bof = 1,
344251538Srpaulo			.force_short_xfer = 1
345251538Srpaulo		},
346251538Srpaulo		.callback = urtwn_bulk_tx_callback,
347251538Srpaulo		.timeout = URTWN_TX_TIMEOUT,	/* ms */
348251538Srpaulo	},
349251538Srpaulo};
350251538Srpaulo
351251538Srpaulostatic int
352251538Srpaulourtwn_match(device_t self)
353251538Srpaulo{
354251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
355251538Srpaulo
356251538Srpaulo	if (uaa->usb_mode != USB_MODE_HOST)
357251538Srpaulo		return (ENXIO);
358251538Srpaulo	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
359251538Srpaulo		return (ENXIO);
360251538Srpaulo	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
361251538Srpaulo		return (ENXIO);
362251538Srpaulo
363251538Srpaulo	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
364251538Srpaulo}
365251538Srpaulo
366251538Srpaulostatic int
367251538Srpaulourtwn_attach(device_t self)
368251538Srpaulo{
369251538Srpaulo	struct usb_attach_arg *uaa = device_get_ivars(self);
370251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
371251538Srpaulo	struct ifnet *ifp;
372251538Srpaulo	struct ieee80211com *ic;
373251538Srpaulo	uint8_t iface_index, bands;
374251538Srpaulo	int error;
375251538Srpaulo
376251538Srpaulo	device_set_usb_desc(self);
377251538Srpaulo	sc->sc_udev = uaa->device;
378251538Srpaulo	sc->sc_dev = self;
379264912Skevlo	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
380264912Skevlo		sc->chip |= URTWN_CHIP_88E;
381251538Srpaulo
382251538Srpaulo	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
383251538Srpaulo	    MTX_NETWORK_LOCK, MTX_DEF);
384251538Srpaulo	callout_init(&sc->sc_watchdog_ch, 0);
385251538Srpaulo
386251538Srpaulo	iface_index = URTWN_IFACE_INDEX;
387251538Srpaulo	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
388251538Srpaulo	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
389251538Srpaulo	if (error) {
390251538Srpaulo		device_printf(self, "could not allocate USB transfers, "
391251538Srpaulo		    "err=%s\n", usbd_errstr(error));
392251538Srpaulo		goto detach;
393251538Srpaulo	}
394251538Srpaulo
395251538Srpaulo	URTWN_LOCK(sc);
396251538Srpaulo
397251538Srpaulo	error = urtwn_read_chipid(sc);
398251538Srpaulo	if (error) {
399251538Srpaulo		device_printf(sc->sc_dev, "unsupported test chip\n");
400251538Srpaulo		URTWN_UNLOCK(sc);
401251538Srpaulo		goto detach;
402251538Srpaulo	}
403251538Srpaulo
404251538Srpaulo	/* Determine number of Tx/Rx chains. */
405251538Srpaulo	if (sc->chip & URTWN_CHIP_92C) {
406251538Srpaulo		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
407251538Srpaulo		sc->nrxchains = 2;
408251538Srpaulo	} else {
409251538Srpaulo		sc->ntxchains = 1;
410251538Srpaulo		sc->nrxchains = 1;
411251538Srpaulo	}
412251538Srpaulo
413264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
414264912Skevlo		urtwn_r88e_read_rom(sc);
415264912Skevlo	else
416264912Skevlo		urtwn_read_rom(sc);
417264912Skevlo
418251538Srpaulo	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
419251538Srpaulo	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
420264912Skevlo	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
421251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
422251538Srpaulo	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
423251538Srpaulo	    "8188CUS", sc->ntxchains, sc->nrxchains);
424251538Srpaulo
425251538Srpaulo	URTWN_UNLOCK(sc);
426251538Srpaulo
427251538Srpaulo	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
428251538Srpaulo	if (ifp == NULL) {
429251538Srpaulo		device_printf(sc->sc_dev, "can not if_alloc()\n");
430251538Srpaulo		goto detach;
431251538Srpaulo	}
432251538Srpaulo	ic = ifp->if_l2com;
433251538Srpaulo
434251538Srpaulo	ifp->if_softc = sc;
435251538Srpaulo	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
436251538Srpaulo	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
437251538Srpaulo	ifp->if_init = urtwn_init;
438251538Srpaulo	ifp->if_ioctl = urtwn_ioctl;
439251538Srpaulo	ifp->if_start = urtwn_start;
440251538Srpaulo	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
441251538Srpaulo	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
442251538Srpaulo	IFQ_SET_READY(&ifp->if_snd);
443251538Srpaulo
444251538Srpaulo	ic->ic_ifp = ifp;
445283537Sglebius	ic->ic_softc = sc;
446283527Sglebius	ic->ic_name = device_get_nameunit(self);
447251538Srpaulo	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
448251538Srpaulo	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
449251538Srpaulo
450251538Srpaulo	/* set device capabilities */
451251538Srpaulo	ic->ic_caps =
452251538Srpaulo		  IEEE80211_C_STA		/* station mode */
453251538Srpaulo		| IEEE80211_C_MONITOR		/* monitor mode */
454251538Srpaulo		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
455251538Srpaulo		| IEEE80211_C_SHSLOT		/* short slot time supported */
456251538Srpaulo		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
457251538Srpaulo		| IEEE80211_C_WPA		/* 802.11i */
458251538Srpaulo		;
459251538Srpaulo
460251538Srpaulo	bands = 0;
461251538Srpaulo	setbit(&bands, IEEE80211_MODE_11B);
462251538Srpaulo	setbit(&bands, IEEE80211_MODE_11G);
463251538Srpaulo	ieee80211_init_channels(ic, NULL, &bands);
464251538Srpaulo
465251538Srpaulo	ieee80211_ifattach(ic, sc->sc_bssid);
466251538Srpaulo	ic->ic_raw_xmit = urtwn_raw_xmit;
467251538Srpaulo	ic->ic_scan_start = urtwn_scan_start;
468251538Srpaulo	ic->ic_scan_end = urtwn_scan_end;
469251538Srpaulo	ic->ic_set_channel = urtwn_set_channel;
470251538Srpaulo
471251538Srpaulo	ic->ic_vap_create = urtwn_vap_create;
472251538Srpaulo	ic->ic_vap_delete = urtwn_vap_delete;
473251538Srpaulo	ic->ic_update_mcast = urtwn_update_mcast;
474251538Srpaulo
475281069Srpaulo	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
476251538Srpaulo	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
477251538Srpaulo	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
478251538Srpaulo	    URTWN_RX_RADIOTAP_PRESENT);
479251538Srpaulo
480251538Srpaulo	if (bootverbose)
481251538Srpaulo		ieee80211_announce(ic);
482251538Srpaulo
483251538Srpaulo	return (0);
484251538Srpaulo
485251538Srpaulodetach:
486251538Srpaulo	urtwn_detach(self);
487251538Srpaulo	return (ENXIO);			/* failure */
488251538Srpaulo}
489251538Srpaulo
490251538Srpaulostatic int
491251538Srpaulourtwn_detach(device_t self)
492251538Srpaulo{
493251538Srpaulo	struct urtwn_softc *sc = device_get_softc(self);
494251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
495251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
496263153Skevlo	unsigned int x;
497281069Srpaulo
498263153Skevlo	/* Prevent further ioctls. */
499263153Skevlo	URTWN_LOCK(sc);
500263153Skevlo	sc->sc_flags |= URTWN_DETACHED;
501263153Skevlo	URTWN_UNLOCK(sc);
502251538Srpaulo
503263153Skevlo	urtwn_stop(ifp);
504251538Srpaulo
505251538Srpaulo	callout_drain(&sc->sc_watchdog_ch);
506251538Srpaulo
507263153Skevlo	/* Prevent further allocations from RX/TX data lists. */
508263153Skevlo	URTWN_LOCK(sc);
509263153Skevlo	STAILQ_INIT(&sc->sc_tx_active);
510263153Skevlo	STAILQ_INIT(&sc->sc_tx_inactive);
511263153Skevlo	STAILQ_INIT(&sc->sc_tx_pending);
512263153Skevlo
513263153Skevlo	STAILQ_INIT(&sc->sc_rx_active);
514263153Skevlo	STAILQ_INIT(&sc->sc_rx_inactive);
515263153Skevlo	URTWN_UNLOCK(sc);
516263153Skevlo
517263153Skevlo	/* drain USB transfers */
518263153Skevlo	for (x = 0; x != URTWN_N_TRANSFER; x++)
519263153Skevlo		usbd_transfer_drain(sc->sc_xfer[x]);
520263153Skevlo
521263153Skevlo	/* Free data buffers. */
522263153Skevlo	URTWN_LOCK(sc);
523263153Skevlo	urtwn_free_tx_list(sc);
524263153Skevlo	urtwn_free_rx_list(sc);
525263153Skevlo	URTWN_UNLOCK(sc);
526263153Skevlo
527251538Srpaulo	/* stop all USB transfers */
528251538Srpaulo	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
529251538Srpaulo	ieee80211_ifdetach(ic);
530251538Srpaulo
531251538Srpaulo	if_free(ifp);
532251538Srpaulo	mtx_destroy(&sc->sc_mtx);
533251538Srpaulo
534251538Srpaulo	return (0);
535251538Srpaulo}
536251538Srpaulo
537251538Srpaulostatic void
538251538Srpaulourtwn_free_tx_list(struct urtwn_softc *sc)
539251538Srpaulo{
540251538Srpaulo	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
541251538Srpaulo}
542251538Srpaulo
543251538Srpaulostatic void
544251538Srpaulourtwn_free_rx_list(struct urtwn_softc *sc)
545251538Srpaulo{
546251538Srpaulo	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
547251538Srpaulo}
548251538Srpaulo
549251538Srpaulostatic void
550251538Srpaulourtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
551251538Srpaulo{
552251538Srpaulo	int i;
553251538Srpaulo
554251538Srpaulo	for (i = 0; i < ndata; i++) {
555251538Srpaulo		struct urtwn_data *dp = &data[i];
556251538Srpaulo
557251538Srpaulo		if (dp->buf != NULL) {
558251538Srpaulo			free(dp->buf, M_USBDEV);
559251538Srpaulo			dp->buf = NULL;
560251538Srpaulo		}
561251538Srpaulo		if (dp->ni != NULL) {
562251538Srpaulo			ieee80211_free_node(dp->ni);
563251538Srpaulo			dp->ni = NULL;
564251538Srpaulo		}
565251538Srpaulo	}
566251538Srpaulo}
567251538Srpaulo
568251538Srpaulostatic usb_error_t
569251538Srpaulourtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
570251538Srpaulo    void *data)
571251538Srpaulo{
572251538Srpaulo	usb_error_t err;
573251538Srpaulo	int ntries = 10;
574251538Srpaulo
575251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
576251538Srpaulo
577251538Srpaulo	while (ntries--) {
578251538Srpaulo		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
579251538Srpaulo		    req, data, 0, NULL, 250 /* ms */);
580251538Srpaulo		if (err == 0)
581251538Srpaulo			break;
582251538Srpaulo
583251538Srpaulo		DPRINTFN(1, "Control request failed, %s (retrying)\n",
584251538Srpaulo		    usbd_errstr(err));
585251538Srpaulo		usb_pause_mtx(&sc->sc_mtx, hz / 100);
586251538Srpaulo	}
587251538Srpaulo	return (err);
588251538Srpaulo}
589251538Srpaulo
590251538Srpaulostatic struct ieee80211vap *
591251538Srpaulourtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
592251538Srpaulo    enum ieee80211_opmode opmode, int flags,
593251538Srpaulo    const uint8_t bssid[IEEE80211_ADDR_LEN],
594251538Srpaulo    const uint8_t mac[IEEE80211_ADDR_LEN])
595251538Srpaulo{
596251538Srpaulo	struct urtwn_vap *uvp;
597251538Srpaulo	struct ieee80211vap *vap;
598251538Srpaulo
599251538Srpaulo	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
600251538Srpaulo		return (NULL);
601251538Srpaulo
602251538Srpaulo	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
603251538Srpaulo	    M_80211_VAP, M_NOWAIT | M_ZERO);
604251538Srpaulo	if (uvp == NULL)
605251538Srpaulo		return (NULL);
606251538Srpaulo	vap = &uvp->vap;
607251538Srpaulo	/* enable s/w bmiss handling for sta mode */
608251538Srpaulo
609281069Srpaulo	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
610257743Shselasky	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
611257743Shselasky		/* out of memory */
612257743Shselasky		free(uvp, M_80211_VAP);
613257743Shselasky		return (NULL);
614257743Shselasky	}
615257743Shselasky
616251538Srpaulo	/* override state transition machine */
617251538Srpaulo	uvp->newstate = vap->iv_newstate;
618251538Srpaulo	vap->iv_newstate = urtwn_newstate;
619251538Srpaulo
620251538Srpaulo	/* complete setup */
621251538Srpaulo	ieee80211_vap_attach(vap, ieee80211_media_change,
622251538Srpaulo	    ieee80211_media_status);
623251538Srpaulo	ic->ic_opmode = opmode;
624251538Srpaulo	return (vap);
625251538Srpaulo}
626251538Srpaulo
627251538Srpaulostatic void
628251538Srpaulourtwn_vap_delete(struct ieee80211vap *vap)
629251538Srpaulo{
630251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
631251538Srpaulo
632251538Srpaulo	ieee80211_vap_detach(vap);
633251538Srpaulo	free(uvp, M_80211_VAP);
634251538Srpaulo}
635251538Srpaulo
636251538Srpaulostatic struct mbuf *
637251538Srpaulourtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
638251538Srpaulo{
639251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
640251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
641251538Srpaulo	struct ieee80211_frame *wh;
642251538Srpaulo	struct mbuf *m;
643251538Srpaulo	struct r92c_rx_stat *stat;
644251538Srpaulo	uint32_t rxdw0, rxdw3;
645251538Srpaulo	uint8_t rate;
646251538Srpaulo	int8_t rssi = 0;
647251538Srpaulo	int infosz;
648251538Srpaulo
649251538Srpaulo	/*
650251538Srpaulo	 * don't pass packets to the ieee80211 framework if the driver isn't
651251538Srpaulo	 * RUNNING.
652251538Srpaulo	 */
653251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
654251538Srpaulo		return (NULL);
655251538Srpaulo
656251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
657251538Srpaulo	rxdw0 = le32toh(stat->rxdw0);
658251538Srpaulo	rxdw3 = le32toh(stat->rxdw3);
659251538Srpaulo
660251538Srpaulo	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
661251538Srpaulo		/*
662251538Srpaulo		 * This should not happen since we setup our Rx filter
663251538Srpaulo		 * to not receive these frames.
664251538Srpaulo		 */
665271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
666251538Srpaulo		return (NULL);
667251538Srpaulo	}
668271303Skevlo	if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) {
669271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
670271303Skevlo		return (NULL);
671271303Skevlo	}
672251538Srpaulo
673251538Srpaulo	rate = MS(rxdw3, R92C_RXDW3_RATE);
674251538Srpaulo	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
675251538Srpaulo
676251538Srpaulo	/* Get RSSI from PHY status descriptor if present. */
677251538Srpaulo	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
678281069Srpaulo		if (sc->chip & URTWN_CHIP_88E)
679264912Skevlo			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
680264912Skevlo		else
681264912Skevlo			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
682251538Srpaulo		/* Update our average RSSI. */
683251538Srpaulo		urtwn_update_avgrssi(sc, rate, rssi);
684252405Srpaulo		/*
685252405Srpaulo		 * Convert the RSSI to a range that will be accepted
686252405Srpaulo		 * by net80211.
687252405Srpaulo		 */
688252405Srpaulo		rssi = URTWN_RSSI(rssi);
689251538Srpaulo	}
690251538Srpaulo
691260463Skevlo	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
692251538Srpaulo	if (m == NULL) {
693251538Srpaulo		device_printf(sc->sc_dev, "could not create RX mbuf\n");
694251538Srpaulo		return (NULL);
695251538Srpaulo	}
696251538Srpaulo
697251538Srpaulo	/* Finalize mbuf. */
698251538Srpaulo	m->m_pkthdr.rcvif = ifp;
699251538Srpaulo	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
700251538Srpaulo	memcpy(mtod(m, uint8_t *), wh, pktlen);
701251538Srpaulo	m->m_pkthdr.len = m->m_len = pktlen;
702251538Srpaulo
703251538Srpaulo	if (ieee80211_radiotap_active(ic)) {
704251538Srpaulo		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
705251538Srpaulo
706251538Srpaulo		tap->wr_flags = 0;
707251538Srpaulo		/* Map HW rate index to 802.11 rate. */
708251538Srpaulo		if (!(rxdw3 & R92C_RXDW3_HT)) {
709251538Srpaulo			switch (rate) {
710251538Srpaulo			/* CCK. */
711251538Srpaulo			case  0: tap->wr_rate =   2; break;
712251538Srpaulo			case  1: tap->wr_rate =   4; break;
713251538Srpaulo			case  2: tap->wr_rate =  11; break;
714251538Srpaulo			case  3: tap->wr_rate =  22; break;
715251538Srpaulo			/* OFDM. */
716251538Srpaulo			case  4: tap->wr_rate =  12; break;
717251538Srpaulo			case  5: tap->wr_rate =  18; break;
718251538Srpaulo			case  6: tap->wr_rate =  24; break;
719251538Srpaulo			case  7: tap->wr_rate =  36; break;
720251538Srpaulo			case  8: tap->wr_rate =  48; break;
721251538Srpaulo			case  9: tap->wr_rate =  72; break;
722251538Srpaulo			case 10: tap->wr_rate =  96; break;
723251538Srpaulo			case 11: tap->wr_rate = 108; break;
724251538Srpaulo			}
725251538Srpaulo		} else if (rate >= 12) {	/* MCS0~15. */
726251538Srpaulo			/* Bit 7 set means HT MCS instead of rate. */
727251538Srpaulo			tap->wr_rate = 0x80 | (rate - 12);
728251538Srpaulo		}
729251538Srpaulo		tap->wr_dbm_antsignal = rssi;
730251538Srpaulo		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
731251538Srpaulo		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
732251538Srpaulo	}
733251538Srpaulo
734251538Srpaulo	*rssi_p = rssi;
735251538Srpaulo
736251538Srpaulo	return (m);
737251538Srpaulo}
738251538Srpaulo
739251538Srpaulostatic struct mbuf *
740251538Srpaulourtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
741251538Srpaulo    int8_t *nf)
742251538Srpaulo{
743251538Srpaulo	struct urtwn_softc *sc = data->sc;
744251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
745251538Srpaulo	struct r92c_rx_stat *stat;
746251538Srpaulo	struct mbuf *m, *m0 = NULL, *prevm = NULL;
747251538Srpaulo	uint32_t rxdw0;
748251538Srpaulo	uint8_t *buf;
749251538Srpaulo	int len, totlen, pktlen, infosz, npkts;
750251538Srpaulo
751251538Srpaulo	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
752251538Srpaulo
753251538Srpaulo	if (len < sizeof(*stat)) {
754271866Sglebius		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
755251538Srpaulo		return (NULL);
756251538Srpaulo	}
757251538Srpaulo
758251538Srpaulo	buf = data->buf;
759251538Srpaulo	/* Get the number of encapsulated frames. */
760251538Srpaulo	stat = (struct r92c_rx_stat *)buf;
761251538Srpaulo	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
762251538Srpaulo	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
763251538Srpaulo
764251538Srpaulo	/* Process all of them. */
765251538Srpaulo	while (npkts-- > 0) {
766251538Srpaulo		if (len < sizeof(*stat))
767251538Srpaulo			break;
768251538Srpaulo		stat = (struct r92c_rx_stat *)buf;
769251538Srpaulo		rxdw0 = le32toh(stat->rxdw0);
770251538Srpaulo
771251538Srpaulo		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
772251538Srpaulo		if (pktlen == 0)
773251538Srpaulo			break;
774251538Srpaulo
775251538Srpaulo		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
776251538Srpaulo
777251538Srpaulo		/* Make sure everything fits in xfer. */
778251538Srpaulo		totlen = sizeof(*stat) + infosz + pktlen;
779251538Srpaulo		if (totlen > len)
780251538Srpaulo			break;
781251538Srpaulo
782251538Srpaulo		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
783251538Srpaulo		if (m0 == NULL)
784251538Srpaulo			m0 = m;
785251538Srpaulo		if (prevm == NULL)
786251538Srpaulo			prevm = m;
787251538Srpaulo		else {
788251538Srpaulo			prevm->m_next = m;
789251538Srpaulo			prevm = m;
790251538Srpaulo		}
791251538Srpaulo
792251538Srpaulo		/* Next chunk is 128-byte aligned. */
793251538Srpaulo		totlen = (totlen + 127) & ~127;
794251538Srpaulo		buf += totlen;
795251538Srpaulo		len -= totlen;
796251538Srpaulo	}
797251538Srpaulo
798251538Srpaulo	return (m0);
799251538Srpaulo}
800251538Srpaulo
801251538Srpaulostatic void
802251538Srpaulourtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
803251538Srpaulo{
804251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
805251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
806251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
807251538Srpaulo	struct ieee80211_frame *wh;
808251538Srpaulo	struct ieee80211_node *ni;
809251538Srpaulo	struct mbuf *m = NULL, *next;
810251538Srpaulo	struct urtwn_data *data;
811251538Srpaulo	int8_t nf;
812251538Srpaulo	int rssi = 1;
813251538Srpaulo
814251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
815251538Srpaulo
816251538Srpaulo	switch (USB_GET_STATE(xfer)) {
817251538Srpaulo	case USB_ST_TRANSFERRED:
818251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
819251538Srpaulo		if (data == NULL)
820251538Srpaulo			goto tr_setup;
821251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
822251538Srpaulo		m = urtwn_rxeof(xfer, data, &rssi, &nf);
823251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
824251538Srpaulo		/* FALLTHROUGH */
825251538Srpaulo	case USB_ST_SETUP:
826251538Srpaulotr_setup:
827251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_inactive);
828251538Srpaulo		if (data == NULL) {
829251538Srpaulo			KASSERT(m == NULL, ("mbuf isn't NULL"));
830251538Srpaulo			return;
831251538Srpaulo		}
832251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
833251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
834251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf,
835251538Srpaulo		    usbd_xfer_max_len(xfer));
836251538Srpaulo		usbd_transfer_submit(xfer);
837251538Srpaulo
838251538Srpaulo		/*
839251538Srpaulo		 * To avoid LOR we should unlock our private mutex here to call
840251538Srpaulo		 * ieee80211_input() because here is at the end of a USB
841251538Srpaulo		 * callback and safe to unlock.
842251538Srpaulo		 */
843251538Srpaulo		URTWN_UNLOCK(sc);
844251538Srpaulo		while (m != NULL) {
845251538Srpaulo			next = m->m_next;
846251538Srpaulo			m->m_next = NULL;
847251538Srpaulo			wh = mtod(m, struct ieee80211_frame *);
848251538Srpaulo			ni = ieee80211_find_rxnode(ic,
849251538Srpaulo			    (struct ieee80211_frame_min *)wh);
850251538Srpaulo			nf = URTWN_NOISE_FLOOR;
851251538Srpaulo			if (ni != NULL) {
852251538Srpaulo				(void)ieee80211_input(ni, m, rssi, nf);
853251538Srpaulo				ieee80211_free_node(ni);
854251538Srpaulo			} else
855251538Srpaulo				(void)ieee80211_input_all(ic, m, rssi, nf);
856251538Srpaulo			m = next;
857251538Srpaulo		}
858251538Srpaulo		URTWN_LOCK(sc);
859251538Srpaulo		break;
860251538Srpaulo	default:
861251538Srpaulo		/* needs it to the inactive queue due to a error. */
862251538Srpaulo		data = STAILQ_FIRST(&sc->sc_rx_active);
863251538Srpaulo		if (data != NULL) {
864251538Srpaulo			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
865251538Srpaulo			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
866251538Srpaulo		}
867251538Srpaulo		if (error != USB_ERR_CANCELLED) {
868251538Srpaulo			usbd_xfer_set_stall(xfer);
869271866Sglebius			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
870251538Srpaulo			goto tr_setup;
871251538Srpaulo		}
872251538Srpaulo		break;
873251538Srpaulo	}
874251538Srpaulo}
875251538Srpaulo
876251538Srpaulostatic void
877251538Srpaulourtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
878251538Srpaulo{
879251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
880251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
881251538Srpaulo	struct mbuf *m;
882251538Srpaulo
883251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
884251538Srpaulo
885251538Srpaulo	/*
886251538Srpaulo	 * Do any tx complete callback.  Note this must be done before releasing
887251538Srpaulo	 * the node reference.
888251538Srpaulo	 */
889251538Srpaulo	if (data->m) {
890251538Srpaulo		m = data->m;
891251538Srpaulo		if (m->m_flags & M_TXCB) {
892251538Srpaulo			/* XXX status? */
893251538Srpaulo			ieee80211_process_callback(data->ni, m, 0);
894251538Srpaulo		}
895251538Srpaulo		m_freem(m);
896251538Srpaulo		data->m = NULL;
897251538Srpaulo	}
898251538Srpaulo	if (data->ni) {
899251538Srpaulo		ieee80211_free_node(data->ni);
900251538Srpaulo		data->ni = NULL;
901251538Srpaulo	}
902251538Srpaulo	sc->sc_txtimer = 0;
903271866Sglebius	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
904251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
905251538Srpaulo}
906251538Srpaulo
907251538Srpaulostatic void
908251538Srpaulourtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
909251538Srpaulo{
910251538Srpaulo	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
911251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
912251538Srpaulo	struct urtwn_data *data;
913251538Srpaulo
914251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
915251538Srpaulo
916251538Srpaulo	switch (USB_GET_STATE(xfer)){
917251538Srpaulo	case USB_ST_TRANSFERRED:
918251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
919251538Srpaulo		if (data == NULL)
920251538Srpaulo			goto tr_setup;
921251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
922251538Srpaulo		urtwn_txeof(xfer, data);
923251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
924251538Srpaulo		/* FALLTHROUGH */
925251538Srpaulo	case USB_ST_SETUP:
926251538Srpaulotr_setup:
927251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_pending);
928251538Srpaulo		if (data == NULL) {
929251538Srpaulo			DPRINTF("%s: empty pending queue\n", __func__);
930251538Srpaulo			return;
931251538Srpaulo		}
932251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
933251538Srpaulo		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
934251538Srpaulo		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
935251538Srpaulo		usbd_transfer_submit(xfer);
936261863Srpaulo		urtwn_start_locked(ifp, sc);
937251538Srpaulo		break;
938251538Srpaulo	default:
939251538Srpaulo		data = STAILQ_FIRST(&sc->sc_tx_active);
940251538Srpaulo		if (data == NULL)
941251538Srpaulo			goto tr_setup;
942251538Srpaulo		if (data->ni != NULL) {
943251538Srpaulo			ieee80211_free_node(data->ni);
944251538Srpaulo			data->ni = NULL;
945271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
946251538Srpaulo		}
947251538Srpaulo		if (error != USB_ERR_CANCELLED) {
948251538Srpaulo			usbd_xfer_set_stall(xfer);
949251538Srpaulo			goto tr_setup;
950251538Srpaulo		}
951251538Srpaulo		break;
952251538Srpaulo	}
953251538Srpaulo}
954251538Srpaulo
955251538Srpaulostatic struct urtwn_data *
956251538Srpaulo_urtwn_getbuf(struct urtwn_softc *sc)
957251538Srpaulo{
958251538Srpaulo	struct urtwn_data *bf;
959251538Srpaulo
960251538Srpaulo	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
961251538Srpaulo	if (bf != NULL)
962251538Srpaulo		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
963251538Srpaulo	else
964251538Srpaulo		bf = NULL;
965251538Srpaulo	if (bf == NULL)
966251538Srpaulo		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
967251538Srpaulo	return (bf);
968251538Srpaulo}
969251538Srpaulo
970251538Srpaulostatic struct urtwn_data *
971251538Srpaulourtwn_getbuf(struct urtwn_softc *sc)
972251538Srpaulo{
973251538Srpaulo        struct urtwn_data *bf;
974251538Srpaulo
975251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
976251538Srpaulo
977251538Srpaulo	bf = _urtwn_getbuf(sc);
978251538Srpaulo	if (bf == NULL) {
979251538Srpaulo		struct ifnet *ifp = sc->sc_ifp;
980251538Srpaulo		DPRINTF("%s: stop queue\n", __func__);
981251538Srpaulo		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
982251538Srpaulo	}
983251538Srpaulo	return (bf);
984251538Srpaulo}
985251538Srpaulo
986251538Srpaulostatic int
987251538Srpaulourtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
988251538Srpaulo    int len)
989251538Srpaulo{
990251538Srpaulo	usb_device_request_t req;
991251538Srpaulo
992251538Srpaulo	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
993251538Srpaulo	req.bRequest = R92C_REQ_REGS;
994251538Srpaulo	USETW(req.wValue, addr);
995251538Srpaulo	USETW(req.wIndex, 0);
996251538Srpaulo	USETW(req.wLength, len);
997251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
998251538Srpaulo}
999251538Srpaulo
1000251538Srpaulostatic void
1001251538Srpaulourtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1002251538Srpaulo{
1003251538Srpaulo	urtwn_write_region_1(sc, addr, &val, 1);
1004251538Srpaulo}
1005251538Srpaulo
1006251538Srpaulo
1007251538Srpaulostatic void
1008251538Srpaulourtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1009251538Srpaulo{
1010251538Srpaulo	val = htole16(val);
1011251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1012251538Srpaulo}
1013251538Srpaulo
1014251538Srpaulostatic void
1015251538Srpaulourtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1016251538Srpaulo{
1017251538Srpaulo	val = htole32(val);
1018251538Srpaulo	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1019251538Srpaulo}
1020251538Srpaulo
1021251538Srpaulostatic int
1022251538Srpaulourtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1023251538Srpaulo    int len)
1024251538Srpaulo{
1025251538Srpaulo	usb_device_request_t req;
1026251538Srpaulo
1027251538Srpaulo	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1028251538Srpaulo	req.bRequest = R92C_REQ_REGS;
1029251538Srpaulo	USETW(req.wValue, addr);
1030251538Srpaulo	USETW(req.wIndex, 0);
1031251538Srpaulo	USETW(req.wLength, len);
1032251538Srpaulo	return (urtwn_do_request(sc, &req, buf));
1033251538Srpaulo}
1034251538Srpaulo
1035251538Srpaulostatic uint8_t
1036251538Srpaulourtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1037251538Srpaulo{
1038251538Srpaulo	uint8_t val;
1039251538Srpaulo
1040251538Srpaulo	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1041251538Srpaulo		return (0xff);
1042251538Srpaulo	return (val);
1043251538Srpaulo}
1044251538Srpaulo
1045251538Srpaulostatic uint16_t
1046251538Srpaulourtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1047251538Srpaulo{
1048251538Srpaulo	uint16_t val;
1049251538Srpaulo
1050251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1051251538Srpaulo		return (0xffff);
1052251538Srpaulo	return (le16toh(val));
1053251538Srpaulo}
1054251538Srpaulo
1055251538Srpaulostatic uint32_t
1056251538Srpaulourtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1057251538Srpaulo{
1058251538Srpaulo	uint32_t val;
1059251538Srpaulo
1060251538Srpaulo	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1061251538Srpaulo		return (0xffffffff);
1062251538Srpaulo	return (le32toh(val));
1063251538Srpaulo}
1064251538Srpaulo
1065251538Srpaulostatic int
1066251538Srpaulourtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1067251538Srpaulo{
1068251538Srpaulo	struct r92c_fw_cmd cmd;
1069251538Srpaulo	int ntries;
1070251538Srpaulo
1071251538Srpaulo	/* Wait for current FW box to be empty. */
1072251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1073251538Srpaulo		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1074251538Srpaulo			break;
1075266472Shselasky		urtwn_ms_delay(sc);
1076251538Srpaulo	}
1077251538Srpaulo	if (ntries == 100) {
1078251538Srpaulo		device_printf(sc->sc_dev,
1079251538Srpaulo		    "could not send firmware command\n");
1080251538Srpaulo		return (ETIMEDOUT);
1081251538Srpaulo	}
1082251538Srpaulo	memset(&cmd, 0, sizeof(cmd));
1083251538Srpaulo	cmd.id = id;
1084251538Srpaulo	if (len > 3)
1085251538Srpaulo		cmd.id |= R92C_CMD_FLAG_EXT;
1086251538Srpaulo	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1087251538Srpaulo	memcpy(cmd.msg, buf, len);
1088251538Srpaulo
1089251538Srpaulo	/* Write the first word last since that will trigger the FW. */
1090251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1091251538Srpaulo	    (uint8_t *)&cmd + 4, 2);
1092251538Srpaulo	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1093251538Srpaulo	    (uint8_t *)&cmd + 0, 4);
1094251538Srpaulo
1095251538Srpaulo	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1096251538Srpaulo	return (0);
1097251538Srpaulo}
1098251538Srpaulo
1099264912Skevlostatic __inline void
1100251538Srpaulourtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1101251538Srpaulo{
1102264912Skevlo
1103264912Skevlo	sc->sc_rf_write(sc, chain, addr, val);
1104264912Skevlo}
1105264912Skevlo
1106264912Skevlostatic void
1107264912Skevlourtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1108264912Skevlo    uint32_t val)
1109264912Skevlo{
1110251538Srpaulo	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1111251538Srpaulo	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1112251538Srpaulo	    SM(R92C_LSSI_PARAM_DATA, val));
1113251538Srpaulo}
1114251538Srpaulo
1115264912Skevlostatic void
1116264912Skevlourtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1117264912Skevlouint32_t val)
1118264912Skevlo{
1119264912Skevlo	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1120264912Skevlo	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1121264912Skevlo	    SM(R92C_LSSI_PARAM_DATA, val));
1122264912Skevlo}
1123264912Skevlo
1124251538Srpaulostatic uint32_t
1125251538Srpaulourtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1126251538Srpaulo{
1127251538Srpaulo	uint32_t reg[R92C_MAX_CHAINS], val;
1128251538Srpaulo
1129251538Srpaulo	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1130251538Srpaulo	if (chain != 0)
1131251538Srpaulo		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1132251538Srpaulo
1133251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1134251538Srpaulo	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1135266472Shselasky	urtwn_ms_delay(sc);
1136251538Srpaulo
1137251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1138251538Srpaulo	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1139251538Srpaulo	    R92C_HSSI_PARAM2_READ_EDGE);
1140266472Shselasky	urtwn_ms_delay(sc);
1141251538Srpaulo
1142251538Srpaulo	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1143251538Srpaulo	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1144266472Shselasky	urtwn_ms_delay(sc);
1145251538Srpaulo
1146251538Srpaulo	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1147251538Srpaulo		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1148251538Srpaulo	else
1149251538Srpaulo		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1150251538Srpaulo	return (MS(val, R92C_LSSI_READBACK_DATA));
1151251538Srpaulo}
1152251538Srpaulo
1153251538Srpaulostatic int
1154251538Srpaulourtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1155251538Srpaulo{
1156251538Srpaulo	int ntries;
1157251538Srpaulo
1158251538Srpaulo	urtwn_write_4(sc, R92C_LLT_INIT,
1159251538Srpaulo	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1160251538Srpaulo	    SM(R92C_LLT_INIT_ADDR, addr) |
1161251538Srpaulo	    SM(R92C_LLT_INIT_DATA, data));
1162251538Srpaulo	/* Wait for write operation to complete. */
1163251538Srpaulo	for (ntries = 0; ntries < 20; ntries++) {
1164251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1165251538Srpaulo		    R92C_LLT_INIT_OP_NO_ACTIVE)
1166251538Srpaulo			return (0);
1167266472Shselasky		urtwn_ms_delay(sc);
1168251538Srpaulo	}
1169251538Srpaulo	return (ETIMEDOUT);
1170251538Srpaulo}
1171251538Srpaulo
1172251538Srpaulostatic uint8_t
1173251538Srpaulourtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1174251538Srpaulo{
1175251538Srpaulo	uint32_t reg;
1176251538Srpaulo	int ntries;
1177251538Srpaulo
1178251538Srpaulo	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1179251538Srpaulo	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1180251538Srpaulo	reg &= ~R92C_EFUSE_CTRL_VALID;
1181251538Srpaulo	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1182251538Srpaulo	/* Wait for read operation to complete. */
1183251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
1184251538Srpaulo		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1185251538Srpaulo		if (reg & R92C_EFUSE_CTRL_VALID)
1186251538Srpaulo			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1187266472Shselasky		urtwn_ms_delay(sc);
1188251538Srpaulo	}
1189281069Srpaulo	device_printf(sc->sc_dev,
1190251538Srpaulo	    "could not read efuse byte at address 0x%x\n", addr);
1191251538Srpaulo	return (0xff);
1192251538Srpaulo}
1193251538Srpaulo
1194251538Srpaulostatic void
1195251538Srpaulourtwn_efuse_read(struct urtwn_softc *sc)
1196251538Srpaulo{
1197251538Srpaulo	uint8_t *rom = (uint8_t *)&sc->rom;
1198251538Srpaulo	uint16_t addr = 0;
1199251538Srpaulo	uint32_t reg;
1200282623Skevlo	uint8_t off, msk;
1201251538Srpaulo	int i;
1202251538Srpaulo
1203264912Skevlo	urtwn_efuse_switch_power(sc);
1204264912Skevlo
1205251538Srpaulo	memset(&sc->rom, 0xff, sizeof(sc->rom));
1206251538Srpaulo	while (addr < 512) {
1207251538Srpaulo		reg = urtwn_efuse_read_1(sc, addr);
1208251538Srpaulo		if (reg == 0xff)
1209251538Srpaulo			break;
1210251538Srpaulo		addr++;
1211251538Srpaulo		off = reg >> 4;
1212251538Srpaulo		msk = reg & 0xf;
1213251538Srpaulo		for (i = 0; i < 4; i++) {
1214251538Srpaulo			if (msk & (1 << i))
1215251538Srpaulo				continue;
1216251538Srpaulo			rom[off * 8 + i * 2 + 0] =
1217251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1218251538Srpaulo			addr++;
1219251538Srpaulo			rom[off * 8 + i * 2 + 1] =
1220251538Srpaulo			    urtwn_efuse_read_1(sc, addr);
1221251538Srpaulo			addr++;
1222251538Srpaulo		}
1223251538Srpaulo	}
1224251538Srpaulo#ifdef URTWN_DEBUG
1225251538Srpaulo	if (urtwn_debug >= 2) {
1226251538Srpaulo		/* Dump ROM content. */
1227251538Srpaulo		printf("\n");
1228251538Srpaulo		for (i = 0; i < sizeof(sc->rom); i++)
1229251538Srpaulo			printf("%02x:", rom[i]);
1230251538Srpaulo		printf("\n");
1231251538Srpaulo	}
1232251538Srpaulo#endif
1233282623Skevlo	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1234282623Skevlo}
1235281592Skevlo
1236264912Skevlostatic void
1237264912Skevlourtwn_efuse_switch_power(struct urtwn_softc *sc)
1238264912Skevlo{
1239264912Skevlo	uint32_t reg;
1240251538Srpaulo
1241282623Skevlo	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1242281918Skevlo
1243264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1244264912Skevlo	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1245264912Skevlo		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1246264912Skevlo		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1247264912Skevlo	}
1248264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1249264912Skevlo	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1250264912Skevlo		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1251264912Skevlo		    reg | R92C_SYS_FUNC_EN_ELDR);
1252264912Skevlo	}
1253264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1254264912Skevlo	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1255264912Skevlo	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1256264912Skevlo		urtwn_write_2(sc, R92C_SYS_CLKR,
1257264912Skevlo		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1258264912Skevlo	}
1259264912Skevlo}
1260264912Skevlo
1261251538Srpaulostatic int
1262251538Srpaulourtwn_read_chipid(struct urtwn_softc *sc)
1263251538Srpaulo{
1264251538Srpaulo	uint32_t reg;
1265251538Srpaulo
1266264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
1267264912Skevlo		return (0);
1268264912Skevlo
1269251538Srpaulo	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1270251538Srpaulo	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1271251538Srpaulo		return (EIO);
1272251538Srpaulo
1273251538Srpaulo	if (reg & R92C_SYS_CFG_TYPE_92C) {
1274251538Srpaulo		sc->chip |= URTWN_CHIP_92C;
1275251538Srpaulo		/* Check if it is a castrated 8192C. */
1276251538Srpaulo		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1277251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1278251538Srpaulo		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1279251538Srpaulo			sc->chip |= URTWN_CHIP_92C_1T2R;
1280251538Srpaulo	}
1281251538Srpaulo	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1282251538Srpaulo		sc->chip |= URTWN_CHIP_UMC;
1283251538Srpaulo		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1284251538Srpaulo			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1285251538Srpaulo	}
1286251538Srpaulo	return (0);
1287251538Srpaulo}
1288251538Srpaulo
1289251538Srpaulostatic void
1290251538Srpaulourtwn_read_rom(struct urtwn_softc *sc)
1291251538Srpaulo{
1292251538Srpaulo	struct r92c_rom *rom = &sc->rom;
1293251538Srpaulo
1294251538Srpaulo	/* Read full ROM image. */
1295251538Srpaulo	urtwn_efuse_read(sc);
1296251538Srpaulo
1297251538Srpaulo	/* XXX Weird but this is what the vendor driver does. */
1298251538Srpaulo	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1299251538Srpaulo	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1300251538Srpaulo
1301251538Srpaulo	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1302251538Srpaulo
1303251538Srpaulo	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1304251538Srpaulo	DPRINTF("regulatory type=%d\n", sc->regulatory);
1305264912Skevlo	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1306251538Srpaulo
1307264912Skevlo	sc->sc_rf_write = urtwn_r92c_rf_write;
1308264912Skevlo	sc->sc_power_on = urtwn_r92c_power_on;
1309264912Skevlo	sc->sc_dma_init = urtwn_r92c_dma_init;
1310251538Srpaulo}
1311251538Srpaulo
1312264912Skevlostatic void
1313264912Skevlourtwn_r88e_read_rom(struct urtwn_softc *sc)
1314264912Skevlo{
1315264912Skevlo	uint8_t *rom = sc->r88e_rom;
1316264912Skevlo	uint16_t addr = 0;
1317264912Skevlo	uint32_t reg;
1318264912Skevlo	uint8_t off, msk, tmp;
1319264912Skevlo	int i;
1320264912Skevlo
1321264982Sandreast	off = 0;
1322264912Skevlo	urtwn_efuse_switch_power(sc);
1323264912Skevlo
1324264912Skevlo	/* Read full ROM image. */
1325264912Skevlo	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1326281918Skevlo	while (addr < 512) {
1327264912Skevlo		reg = urtwn_efuse_read_1(sc, addr);
1328264912Skevlo		if (reg == 0xff)
1329264912Skevlo			break;
1330264912Skevlo		addr++;
1331264912Skevlo		if ((reg & 0x1f) == 0x0f) {
1332264912Skevlo			tmp = (reg & 0xe0) >> 5;
1333264912Skevlo			reg = urtwn_efuse_read_1(sc, addr);
1334264912Skevlo			if ((reg & 0x0f) != 0x0f)
1335264912Skevlo				off = ((reg & 0xf0) >> 1) | tmp;
1336264912Skevlo			addr++;
1337264912Skevlo		} else
1338264912Skevlo			off = reg >> 4;
1339264912Skevlo		msk = reg & 0xf;
1340264912Skevlo		for (i = 0; i < 4; i++) {
1341264912Skevlo			if (msk & (1 << i))
1342264912Skevlo				continue;
1343264912Skevlo			rom[off * 8 + i * 2 + 0] =
1344264912Skevlo			    urtwn_efuse_read_1(sc, addr);
1345264912Skevlo			addr++;
1346264912Skevlo			rom[off * 8 + i * 2 + 1] =
1347264912Skevlo			    urtwn_efuse_read_1(sc, addr);
1348264912Skevlo			addr++;
1349264912Skevlo		}
1350264912Skevlo	}
1351264912Skevlo
1352281918Skevlo	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1353281918Skevlo
1354264912Skevlo	addr = 0x10;
1355264912Skevlo	for (i = 0; i < 6; i++)
1356264912Skevlo		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1357264912Skevlo	for (i = 0; i < 5; i++)
1358264912Skevlo		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1359264912Skevlo	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1360264912Skevlo	if (sc->bw20_tx_pwr_diff & 0x08)
1361264912Skevlo		sc->bw20_tx_pwr_diff |= 0xf0;
1362264912Skevlo	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1363264912Skevlo	if (sc->ofdm_tx_pwr_diff & 0x08)
1364264912Skevlo		sc->ofdm_tx_pwr_diff |= 0xf0;
1365264912Skevlo	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1366264912Skevlo	IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->r88e_rom[0xd7]);
1367264912Skevlo
1368264912Skevlo	sc->sc_rf_write = urtwn_r88e_rf_write;
1369264912Skevlo	sc->sc_power_on = urtwn_r88e_power_on;
1370264912Skevlo	sc->sc_dma_init = urtwn_r88e_dma_init;
1371264912Skevlo}
1372264912Skevlo
1373251538Srpaulo/*
1374251538Srpaulo * Initialize rate adaptation in firmware.
1375251538Srpaulo */
1376251538Srpaulostatic int
1377251538Srpaulourtwn_ra_init(struct urtwn_softc *sc)
1378251538Srpaulo{
1379251538Srpaulo	static const uint8_t map[] =
1380251538Srpaulo	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1381251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1382251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1383251538Srpaulo	struct ieee80211_node *ni;
1384251538Srpaulo	struct ieee80211_rateset *rs;
1385251538Srpaulo	struct r92c_fw_cmd_macid_cfg cmd;
1386251538Srpaulo	uint32_t rates, basicrates;
1387251538Srpaulo	uint8_t mode;
1388251538Srpaulo	int maxrate, maxbasicrate, error, i, j;
1389251538Srpaulo
1390251538Srpaulo	ni = ieee80211_ref_node(vap->iv_bss);
1391251538Srpaulo	rs = &ni->ni_rates;
1392251538Srpaulo
1393251538Srpaulo	/* Get normal and basic rates mask. */
1394251538Srpaulo	rates = basicrates = 0;
1395251538Srpaulo	maxrate = maxbasicrate = 0;
1396251538Srpaulo	for (i = 0; i < rs->rs_nrates; i++) {
1397251538Srpaulo		/* Convert 802.11 rate to HW rate index. */
1398251538Srpaulo		for (j = 0; j < nitems(map); j++)
1399251538Srpaulo			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1400251538Srpaulo				break;
1401251538Srpaulo		if (j == nitems(map))	/* Unknown rate, skip. */
1402251538Srpaulo			continue;
1403251538Srpaulo		rates |= 1 << j;
1404251538Srpaulo		if (j > maxrate)
1405251538Srpaulo			maxrate = j;
1406251538Srpaulo		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1407251538Srpaulo			basicrates |= 1 << j;
1408251538Srpaulo			if (j > maxbasicrate)
1409251538Srpaulo				maxbasicrate = j;
1410251538Srpaulo		}
1411251538Srpaulo	}
1412251538Srpaulo	if (ic->ic_curmode == IEEE80211_MODE_11B)
1413251538Srpaulo		mode = R92C_RAID_11B;
1414251538Srpaulo	else
1415251538Srpaulo		mode = R92C_RAID_11BG;
1416251538Srpaulo	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1417251538Srpaulo	    mode, rates, basicrates);
1418251538Srpaulo
1419251538Srpaulo	/* Set rates mask for group addressed frames. */
1420251538Srpaulo	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1421251538Srpaulo	cmd.mask = htole32(mode << 28 | basicrates);
1422251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1423251538Srpaulo	if (error != 0) {
1424252401Srpaulo		ieee80211_free_node(ni);
1425251538Srpaulo		device_printf(sc->sc_dev,
1426251538Srpaulo		    "could not add broadcast station\n");
1427251538Srpaulo		return (error);
1428251538Srpaulo	}
1429251538Srpaulo	/* Set initial MRR rate. */
1430251538Srpaulo	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1431251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1432251538Srpaulo	    maxbasicrate);
1433251538Srpaulo
1434251538Srpaulo	/* Set rates mask for unicast frames. */
1435251538Srpaulo	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1436251538Srpaulo	cmd.mask = htole32(mode << 28 | rates);
1437251538Srpaulo	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1438251538Srpaulo	if (error != 0) {
1439252401Srpaulo		ieee80211_free_node(ni);
1440251538Srpaulo		device_printf(sc->sc_dev, "could not add BSS station\n");
1441251538Srpaulo		return (error);
1442251538Srpaulo	}
1443251538Srpaulo	/* Set initial MRR rate. */
1444251538Srpaulo	DPRINTF("maxrate=%d\n", maxrate);
1445251538Srpaulo	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1446251538Srpaulo	    maxrate);
1447251538Srpaulo
1448251538Srpaulo	/* Indicate highest supported rate. */
1449252403Srpaulo	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1450252401Srpaulo	ieee80211_free_node(ni);
1451252401Srpaulo
1452251538Srpaulo	return (0);
1453251538Srpaulo}
1454251538Srpaulo
1455251538Srpaulovoid
1456251538Srpaulourtwn_tsf_sync_enable(struct urtwn_softc *sc)
1457251538Srpaulo{
1458251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1459251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1460251538Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1461251538Srpaulo	struct ieee80211_node *ni = vap->iv_bss;
1462251538Srpaulo
1463251538Srpaulo	uint64_t tsf;
1464251538Srpaulo
1465251538Srpaulo	/* Enable TSF synchronization. */
1466251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1467251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1468251538Srpaulo
1469251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1470251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1471251538Srpaulo
1472251538Srpaulo	/* Set initial TSF. */
1473251538Srpaulo	memcpy(&tsf, ni->ni_tstamp.data, 8);
1474251538Srpaulo	tsf = le64toh(tsf);
1475251538Srpaulo	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1476251538Srpaulo	tsf -= IEEE80211_DUR_TU;
1477251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1478251538Srpaulo	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1479251538Srpaulo
1480251538Srpaulo	urtwn_write_1(sc, R92C_BCN_CTRL,
1481251538Srpaulo	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1482251538Srpaulo}
1483251538Srpaulo
1484251538Srpaulostatic void
1485251538Srpaulourtwn_set_led(struct urtwn_softc *sc, int led, int on)
1486251538Srpaulo{
1487251538Srpaulo	uint8_t reg;
1488281069Srpaulo
1489251538Srpaulo	if (led == URTWN_LED_LINK) {
1490264912Skevlo		if (sc->chip & URTWN_CHIP_88E) {
1491264912Skevlo			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1492264912Skevlo			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1493264912Skevlo			if (!on) {
1494264912Skevlo				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1495264912Skevlo				urtwn_write_1(sc, R92C_LEDCFG2,
1496264912Skevlo				    reg | R92C_LEDCFG0_DIS);
1497264912Skevlo				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1498264912Skevlo				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1499264912Skevlo				    0xfe);
1500264912Skevlo			}
1501264912Skevlo		} else {
1502264912Skevlo			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1503264912Skevlo			if (!on)
1504264912Skevlo				reg |= R92C_LEDCFG0_DIS;
1505264912Skevlo			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1506264912Skevlo		}
1507264912Skevlo		sc->ledlink = on;       /* Save LED state. */
1508251538Srpaulo	}
1509251538Srpaulo}
1510251538Srpaulo
1511251538Srpaulostatic int
1512251538Srpaulourtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1513251538Srpaulo{
1514251538Srpaulo	struct urtwn_vap *uvp = URTWN_VAP(vap);
1515251538Srpaulo	struct ieee80211com *ic = vap->iv_ic;
1516251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1517251538Srpaulo	struct ieee80211_node *ni;
1518251538Srpaulo	enum ieee80211_state ostate;
1519251538Srpaulo	uint32_t reg;
1520251538Srpaulo
1521251538Srpaulo	ostate = vap->iv_state;
1522251538Srpaulo	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1523251538Srpaulo	    ieee80211_state_name[nstate]);
1524251538Srpaulo
1525251538Srpaulo	IEEE80211_UNLOCK(ic);
1526251538Srpaulo	URTWN_LOCK(sc);
1527251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
1528251538Srpaulo
1529251538Srpaulo	if (ostate == IEEE80211_S_RUN) {
1530251538Srpaulo		/* Turn link LED off. */
1531251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1532251538Srpaulo
1533251538Srpaulo		/* Set media status to 'No Link'. */
1534251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1535251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1536251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1537251538Srpaulo
1538251538Srpaulo		/* Stop Rx of data frames. */
1539251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1540251538Srpaulo
1541251538Srpaulo		/* Rest TSF. */
1542251538Srpaulo		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1543251538Srpaulo
1544251538Srpaulo		/* Disable TSF synchronization. */
1545251538Srpaulo		urtwn_write_1(sc, R92C_BCN_CTRL,
1546251538Srpaulo		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1547251538Srpaulo		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1548251538Srpaulo
1549251538Srpaulo		/* Reset EDCA parameters. */
1550251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1551251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1552251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1553251538Srpaulo		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1554251538Srpaulo	}
1555251538Srpaulo
1556251538Srpaulo	switch (nstate) {
1557251538Srpaulo	case IEEE80211_S_INIT:
1558251538Srpaulo		/* Turn link LED off. */
1559251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1560251538Srpaulo		break;
1561251538Srpaulo	case IEEE80211_S_SCAN:
1562251538Srpaulo		if (ostate != IEEE80211_S_SCAN) {
1563251538Srpaulo			/* Allow Rx from any BSSID. */
1564251538Srpaulo			urtwn_write_4(sc, R92C_RCR,
1565251538Srpaulo			    urtwn_read_4(sc, R92C_RCR) &
1566251538Srpaulo			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1567251538Srpaulo
1568251538Srpaulo			/* Set gain for scanning. */
1569251538Srpaulo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1570251538Srpaulo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1571251538Srpaulo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1572251538Srpaulo
1573264912Skevlo			if (!(sc->chip & URTWN_CHIP_88E)) {
1574264912Skevlo				reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1575264912Skevlo				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1576264912Skevlo				urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1577264912Skevlo			}
1578251538Srpaulo		}
1579251538Srpaulo		/* Pause AC Tx queues. */
1580251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE,
1581251538Srpaulo		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1582251538Srpaulo		break;
1583251538Srpaulo	case IEEE80211_S_AUTH:
1584251538Srpaulo		/* Set initial gain under link. */
1585251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1586251538Srpaulo		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1587251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1588251538Srpaulo
1589264912Skevlo		if (!(sc->chip & URTWN_CHIP_88E)) {
1590264912Skevlo			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1591264912Skevlo			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1592264912Skevlo			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1593264912Skevlo		}
1594251538Srpaulo		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1595251538Srpaulo		break;
1596251538Srpaulo	case IEEE80211_S_RUN:
1597251538Srpaulo		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1598251538Srpaulo			/* Enable Rx of data frames. */
1599251538Srpaulo			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1600251538Srpaulo
1601251538Srpaulo			/* Turn link LED on. */
1602251538Srpaulo			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1603251538Srpaulo			break;
1604251538Srpaulo		}
1605251538Srpaulo
1606251538Srpaulo		ni = ieee80211_ref_node(vap->iv_bss);
1607251538Srpaulo		/* Set media status to 'Associated'. */
1608251538Srpaulo		reg = urtwn_read_4(sc, R92C_CR);
1609251538Srpaulo		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1610251538Srpaulo		urtwn_write_4(sc, R92C_CR, reg);
1611251538Srpaulo
1612251538Srpaulo		/* Set BSSID. */
1613251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1614251538Srpaulo		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1615251538Srpaulo
1616251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1617251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1618251538Srpaulo		else	/* 802.11b/g */
1619251538Srpaulo			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1620251538Srpaulo
1621251538Srpaulo		/* Enable Rx of data frames. */
1622251538Srpaulo		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1623251538Srpaulo
1624251538Srpaulo		/* Flush all AC queues. */
1625251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1626251538Srpaulo
1627251538Srpaulo		/* Set beacon interval. */
1628251538Srpaulo		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1629251538Srpaulo
1630251538Srpaulo		/* Allow Rx from our BSSID only. */
1631251538Srpaulo		urtwn_write_4(sc, R92C_RCR,
1632251538Srpaulo		    urtwn_read_4(sc, R92C_RCR) |
1633251538Srpaulo		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1634251538Srpaulo
1635251538Srpaulo		/* Enable TSF synchronization. */
1636251538Srpaulo		urtwn_tsf_sync_enable(sc);
1637251538Srpaulo
1638251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1639251538Srpaulo		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1640251538Srpaulo		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1641251538Srpaulo		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1642251538Srpaulo		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1643251538Srpaulo		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1644251538Srpaulo
1645251538Srpaulo		/* Intialize rate adaptation. */
1646264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
1647264912Skevlo			ni->ni_txrate =
1648264912Skevlo			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1649281069Srpaulo		else
1650264912Skevlo			urtwn_ra_init(sc);
1651251538Srpaulo		/* Turn link LED on. */
1652251538Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1653251538Srpaulo
1654251538Srpaulo		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1655251538Srpaulo		/* Reset temperature calibration state machine. */
1656251538Srpaulo		sc->thcal_state = 0;
1657251538Srpaulo		sc->thcal_lctemp = 0;
1658251538Srpaulo		ieee80211_free_node(ni);
1659251538Srpaulo		break;
1660251538Srpaulo	default:
1661251538Srpaulo		break;
1662251538Srpaulo	}
1663251538Srpaulo	URTWN_UNLOCK(sc);
1664251538Srpaulo	IEEE80211_LOCK(ic);
1665251538Srpaulo	return(uvp->newstate(vap, nstate, arg));
1666251538Srpaulo}
1667251538Srpaulo
1668251538Srpaulostatic void
1669251538Srpaulourtwn_watchdog(void *arg)
1670251538Srpaulo{
1671251538Srpaulo	struct urtwn_softc *sc = arg;
1672251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1673251538Srpaulo
1674251538Srpaulo	if (sc->sc_txtimer > 0) {
1675251538Srpaulo		if (--sc->sc_txtimer == 0) {
1676251538Srpaulo			device_printf(sc->sc_dev, "device timeout\n");
1677271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1678251538Srpaulo			return;
1679251538Srpaulo		}
1680251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1681251538Srpaulo	}
1682251538Srpaulo}
1683251538Srpaulo
1684251538Srpaulostatic void
1685251538Srpaulourtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1686251538Srpaulo{
1687251538Srpaulo	int pwdb;
1688251538Srpaulo
1689251538Srpaulo	/* Convert antenna signal to percentage. */
1690251538Srpaulo	if (rssi <= -100 || rssi >= 20)
1691251538Srpaulo		pwdb = 0;
1692251538Srpaulo	else if (rssi >= 0)
1693251538Srpaulo		pwdb = 100;
1694251538Srpaulo	else
1695251538Srpaulo		pwdb = 100 + rssi;
1696264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
1697264912Skevlo		if (rate <= 3) {
1698264912Skevlo			/* CCK gain is smaller than OFDM/MCS gain. */
1699264912Skevlo			pwdb += 6;
1700264912Skevlo			if (pwdb > 100)
1701264912Skevlo				pwdb = 100;
1702264912Skevlo			if (pwdb <= 14)
1703264912Skevlo				pwdb -= 4;
1704264912Skevlo			else if (pwdb <= 26)
1705264912Skevlo				pwdb -= 8;
1706264912Skevlo			else if (pwdb <= 34)
1707264912Skevlo				pwdb -= 6;
1708264912Skevlo			else if (pwdb <= 42)
1709264912Skevlo				pwdb -= 2;
1710264912Skevlo		}
1711251538Srpaulo	}
1712251538Srpaulo	if (sc->avg_pwdb == -1)	/* Init. */
1713251538Srpaulo		sc->avg_pwdb = pwdb;
1714251538Srpaulo	else if (sc->avg_pwdb < pwdb)
1715251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1716251538Srpaulo	else
1717251538Srpaulo		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1718251538Srpaulo	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1719251538Srpaulo}
1720251538Srpaulo
1721251538Srpaulostatic int8_t
1722251538Srpaulourtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1723251538Srpaulo{
1724251538Srpaulo	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1725251538Srpaulo	struct r92c_rx_phystat *phy;
1726251538Srpaulo	struct r92c_rx_cck *cck;
1727251538Srpaulo	uint8_t rpt;
1728251538Srpaulo	int8_t rssi;
1729251538Srpaulo
1730251538Srpaulo	if (rate <= 3) {
1731251538Srpaulo		cck = (struct r92c_rx_cck *)physt;
1732251538Srpaulo		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1733251538Srpaulo			rpt = (cck->agc_rpt >> 5) & 0x3;
1734251538Srpaulo			rssi = (cck->agc_rpt & 0x1f) << 1;
1735251538Srpaulo		} else {
1736251538Srpaulo			rpt = (cck->agc_rpt >> 6) & 0x3;
1737251538Srpaulo			rssi = cck->agc_rpt & 0x3e;
1738251538Srpaulo		}
1739251538Srpaulo		rssi = cckoff[rpt] - rssi;
1740251538Srpaulo	} else {	/* OFDM/HT. */
1741251538Srpaulo		phy = (struct r92c_rx_phystat *)physt;
1742251538Srpaulo		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1743251538Srpaulo	}
1744251538Srpaulo	return (rssi);
1745251538Srpaulo}
1746251538Srpaulo
1747264912Skevlostatic int8_t
1748264912Skevlourtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1749264912Skevlo{
1750264912Skevlo	struct r92c_rx_phystat *phy;
1751264912Skevlo	struct r88e_rx_cck *cck;
1752264912Skevlo	uint8_t cck_agc_rpt, lna_idx, vga_idx;
1753264912Skevlo	int8_t rssi;
1754264912Skevlo
1755264972Skevlo	rssi = 0;
1756264912Skevlo	if (rate <= 3) {
1757264912Skevlo		cck = (struct r88e_rx_cck *)physt;
1758264912Skevlo		cck_agc_rpt = cck->agc_rpt;
1759264912Skevlo		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1760281069Srpaulo		vga_idx = cck_agc_rpt & 0x1f;
1761264912Skevlo		switch (lna_idx) {
1762264912Skevlo		case 7:
1763264912Skevlo			if (vga_idx <= 27)
1764264912Skevlo				rssi = -100 + 2* (27 - vga_idx);
1765264912Skevlo			else
1766264912Skevlo				rssi = -100;
1767264912Skevlo			break;
1768264912Skevlo		case 6:
1769264912Skevlo			rssi = -48 + 2 * (2 - vga_idx);
1770264912Skevlo			break;
1771264912Skevlo		case 5:
1772264912Skevlo			rssi = -42 + 2 * (7 - vga_idx);
1773264912Skevlo			break;
1774264912Skevlo		case 4:
1775264912Skevlo			rssi = -36 + 2 * (7 - vga_idx);
1776264912Skevlo			break;
1777264912Skevlo		case 3:
1778264912Skevlo			rssi = -24 + 2 * (7 - vga_idx);
1779264912Skevlo			break;
1780264912Skevlo		case 2:
1781264912Skevlo			rssi = -12 + 2 * (5 - vga_idx);
1782264912Skevlo			break;
1783264912Skevlo		case 1:
1784264912Skevlo			rssi = 8 - (2 * vga_idx);
1785264912Skevlo			break;
1786264912Skevlo		case 0:
1787264912Skevlo			rssi = 14 - (2 * vga_idx);
1788264912Skevlo			break;
1789264912Skevlo		}
1790264912Skevlo		rssi += 6;
1791264912Skevlo	} else {	/* OFDM/HT. */
1792264912Skevlo		phy = (struct r92c_rx_phystat *)physt;
1793264912Skevlo		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1794264912Skevlo	}
1795264912Skevlo	return (rssi);
1796264912Skevlo}
1797264912Skevlo
1798264912Skevlo
1799251538Srpaulostatic int
1800281069Srpaulourtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1801251538Srpaulo    struct mbuf *m0, struct urtwn_data *data)
1802251538Srpaulo{
1803251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
1804251538Srpaulo	struct ieee80211_frame *wh;
1805251538Srpaulo	struct ieee80211_key *k;
1806251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1807251538Srpaulo	struct ieee80211vap *vap = ni->ni_vap;
1808251538Srpaulo	struct usb_xfer *xfer;
1809251538Srpaulo	struct r92c_tx_desc *txd;
1810251538Srpaulo	uint8_t raid, type;
1811251538Srpaulo	uint16_t sum;
1812251538Srpaulo	int i, hasqos, xferlen;
1813251538Srpaulo	struct usb_xfer *urtwn_pipes[4] = {
1814251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BE],
1815251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_BK],
1816251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VI],
1817251538Srpaulo		sc->sc_xfer[URTWN_BULK_TX_VO]
1818251538Srpaulo	};
1819251538Srpaulo
1820251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
1821251538Srpaulo
1822251538Srpaulo	/*
1823251538Srpaulo	 * Software crypto.
1824251538Srpaulo	 */
1825251538Srpaulo	wh = mtod(m0, struct ieee80211_frame *);
1826264912Skevlo	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1827264912Skevlo
1828260444Skevlo	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1829251538Srpaulo		k = ieee80211_crypto_encap(ni, m0);
1830251538Srpaulo		if (k == NULL) {
1831251538Srpaulo			device_printf(sc->sc_dev,
1832251538Srpaulo			    "ieee80211_crypto_encap returns NULL.\n");
1833251538Srpaulo			/* XXX we don't expect the fragmented frames */
1834251538Srpaulo			m_freem(m0);
1835251538Srpaulo			return (ENOBUFS);
1836251538Srpaulo		}
1837251538Srpaulo
1838251538Srpaulo		/* in case packet header moved, reset pointer */
1839251538Srpaulo		wh = mtod(m0, struct ieee80211_frame *);
1840251538Srpaulo	}
1841281069Srpaulo
1842264912Skevlo	switch (type) {
1843251538Srpaulo	case IEEE80211_FC0_TYPE_CTL:
1844251538Srpaulo	case IEEE80211_FC0_TYPE_MGT:
1845251538Srpaulo		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1846251538Srpaulo		break;
1847251538Srpaulo	default:
1848251538Srpaulo		KASSERT(M_WME_GETAC(m0) < 4,
1849251538Srpaulo		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1850251538Srpaulo		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1851251538Srpaulo		break;
1852251538Srpaulo	}
1853281069Srpaulo
1854251538Srpaulo	hasqos = 0;
1855251538Srpaulo
1856251538Srpaulo	/* Fill Tx descriptor. */
1857251538Srpaulo	txd = (struct r92c_tx_desc *)data->buf;
1858251538Srpaulo	memset(txd, 0, sizeof(*txd));
1859251538Srpaulo
1860251538Srpaulo	txd->txdw0 |= htole32(
1861251538Srpaulo	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1862251538Srpaulo	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1863251538Srpaulo	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1864251538Srpaulo	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1865251538Srpaulo		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1866251538Srpaulo	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1867251538Srpaulo	    type == IEEE80211_FC0_TYPE_DATA) {
1868251538Srpaulo		if (ic->ic_curmode == IEEE80211_MODE_11B)
1869251538Srpaulo			raid = R92C_RAID_11B;
1870251538Srpaulo		else
1871251538Srpaulo			raid = R92C_RAID_11BG;
1872264912Skevlo		if (sc->chip & URTWN_CHIP_88E) {
1873264912Skevlo			txd->txdw1 |= htole32(
1874264912Skevlo			    SM(R88E_TXDW1_MACID, URTWN_MACID_BSS) |
1875264912Skevlo			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1876264912Skevlo			    SM(R92C_TXDW1_RAID, raid));
1877264912Skevlo			txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
1878264912Skevlo		} else {
1879264912Skevlo			txd->txdw1 |= htole32(
1880264912Skevlo			    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1881264912Skevlo			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1882264912Skevlo		 	    SM(R92C_TXDW1_RAID, raid) | R92C_TXDW1_AGGBK);
1883264912Skevlo		}
1884251538Srpaulo		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1885251538Srpaulo			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1886251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1887251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1888251538Srpaulo			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1889251538Srpaulo				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1890251538Srpaulo				    R92C_TXDW4_HWRTSEN);
1891251538Srpaulo			}
1892251538Srpaulo		}
1893251538Srpaulo		/* Send RTS at OFDM24. */
1894251538Srpaulo		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1895251538Srpaulo		txd->txdw5 |= htole32(0x0001ff00);
1896251538Srpaulo		/* Send data at OFDM54. */
1897282623Skevlo		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1898251538Srpaulo	} else {
1899251538Srpaulo		txd->txdw1 |= htole32(
1900251538Srpaulo		    SM(R92C_TXDW1_MACID, 0) |
1901251538Srpaulo		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1902251538Srpaulo		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1903251538Srpaulo
1904251538Srpaulo		/* Force CCK1. */
1905251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1906251538Srpaulo		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1907251538Srpaulo	}
1908251538Srpaulo	/* Set sequence number (already little endian). */
1909251538Srpaulo	txd->txdseq |= *(uint16_t *)wh->i_seq;
1910251538Srpaulo
1911251538Srpaulo	if (!hasqos) {
1912251538Srpaulo		/* Use HW sequence numbering for non-QoS frames. */
1913251538Srpaulo		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1914251538Srpaulo		txd->txdseq |= htole16(0x8000);
1915251538Srpaulo	} else
1916251538Srpaulo		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1917251538Srpaulo
1918251538Srpaulo	/* Compute Tx descriptor checksum. */
1919251538Srpaulo	sum = 0;
1920251538Srpaulo	for (i = 0; i < sizeof(*txd) / 2; i++)
1921251538Srpaulo		sum ^= ((uint16_t *)txd)[i];
1922251538Srpaulo	txd->txdsum = sum; 	/* NB: already little endian. */
1923251538Srpaulo
1924251538Srpaulo	if (ieee80211_radiotap_active_vap(vap)) {
1925251538Srpaulo		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1926251538Srpaulo
1927251538Srpaulo		tap->wt_flags = 0;
1928251538Srpaulo		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1929251538Srpaulo		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1930251538Srpaulo		ieee80211_radiotap_tx(vap, m0);
1931251538Srpaulo	}
1932251538Srpaulo
1933251538Srpaulo	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1934251538Srpaulo	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1935251538Srpaulo
1936251538Srpaulo	data->buflen = xferlen;
1937251538Srpaulo	data->ni = ni;
1938251538Srpaulo	data->m = m0;
1939251538Srpaulo
1940251538Srpaulo	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1941251538Srpaulo	usbd_transfer_start(xfer);
1942251538Srpaulo	return (0);
1943251538Srpaulo}
1944251538Srpaulo
1945251538Srpaulostatic void
1946251538Srpaulourtwn_start(struct ifnet *ifp)
1947251538Srpaulo{
1948251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
1949261863Srpaulo
1950261863Srpaulo	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1951261863Srpaulo		return;
1952261863Srpaulo	URTWN_LOCK(sc);
1953261863Srpaulo	urtwn_start_locked(ifp, sc);
1954261863Srpaulo	URTWN_UNLOCK(sc);
1955261863Srpaulo}
1956261863Srpaulo
1957261863Srpaulostatic void
1958261863Srpaulourtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1959261863Srpaulo{
1960251538Srpaulo	struct ieee80211_node *ni;
1961251538Srpaulo	struct mbuf *m;
1962251538Srpaulo	struct urtwn_data *bf;
1963251538Srpaulo
1964261863Srpaulo	URTWN_ASSERT_LOCKED(sc);
1965251538Srpaulo	for (;;) {
1966251538Srpaulo		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1967251538Srpaulo		if (m == NULL)
1968251538Srpaulo			break;
1969251538Srpaulo		bf = urtwn_getbuf(sc);
1970251538Srpaulo		if (bf == NULL) {
1971251538Srpaulo			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1972251538Srpaulo			break;
1973251538Srpaulo		}
1974251538Srpaulo		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1975251538Srpaulo		m->m_pkthdr.rcvif = NULL;
1976251538Srpaulo
1977251538Srpaulo		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1978271866Sglebius			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1979251538Srpaulo			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1980251538Srpaulo			ieee80211_free_node(ni);
1981251538Srpaulo			break;
1982251538Srpaulo		}
1983251538Srpaulo
1984251538Srpaulo		sc->sc_txtimer = 5;
1985251538Srpaulo		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1986251538Srpaulo	}
1987251538Srpaulo}
1988251538Srpaulo
1989251538Srpaulostatic int
1990251538Srpaulourtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1991251538Srpaulo{
1992263153Skevlo	struct urtwn_softc *sc = ifp->if_softc;
1993251538Srpaulo	struct ieee80211com *ic = ifp->if_l2com;
1994251538Srpaulo	struct ifreq *ifr = (struct ifreq *) data;
1995251538Srpaulo	int error = 0, startall = 0;
1996251538Srpaulo
1997263153Skevlo	URTWN_LOCK(sc);
1998263153Skevlo	error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
1999263153Skevlo	URTWN_UNLOCK(sc);
2000263153Skevlo	if (error != 0)
2001263153Skevlo		return (error);
2002263153Skevlo
2003251538Srpaulo	switch (cmd) {
2004251538Srpaulo	case SIOCSIFFLAGS:
2005251538Srpaulo		if (ifp->if_flags & IFF_UP) {
2006251538Srpaulo			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2007251538Srpaulo				urtwn_init(ifp->if_softc);
2008251538Srpaulo				startall = 1;
2009251538Srpaulo			}
2010251538Srpaulo		} else {
2011251538Srpaulo			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2012263153Skevlo				urtwn_stop(ifp);
2013251538Srpaulo		}
2014251538Srpaulo		if (startall)
2015251538Srpaulo			ieee80211_start_all(ic);
2016251538Srpaulo		break;
2017251538Srpaulo	case SIOCGIFMEDIA:
2018251538Srpaulo		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2019251538Srpaulo		break;
2020251538Srpaulo	case SIOCGIFADDR:
2021251538Srpaulo		error = ether_ioctl(ifp, cmd, data);
2022251538Srpaulo		break;
2023251538Srpaulo	default:
2024251538Srpaulo		error = EINVAL;
2025251538Srpaulo		break;
2026251538Srpaulo	}
2027251538Srpaulo	return (error);
2028251538Srpaulo}
2029251538Srpaulo
2030251538Srpaulostatic int
2031251538Srpaulourtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
2032251538Srpaulo    int ndata, int maxsz)
2033251538Srpaulo{
2034251538Srpaulo	int i, error;
2035251538Srpaulo
2036251538Srpaulo	for (i = 0; i < ndata; i++) {
2037251538Srpaulo		struct urtwn_data *dp = &data[i];
2038251538Srpaulo		dp->sc = sc;
2039251538Srpaulo		dp->m = NULL;
2040251538Srpaulo		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
2041251538Srpaulo		if (dp->buf == NULL) {
2042251538Srpaulo			device_printf(sc->sc_dev,
2043251538Srpaulo			    "could not allocate buffer\n");
2044251538Srpaulo			error = ENOMEM;
2045251538Srpaulo			goto fail;
2046251538Srpaulo		}
2047251538Srpaulo		dp->ni = NULL;
2048251538Srpaulo	}
2049251538Srpaulo
2050251538Srpaulo	return (0);
2051251538Srpaulofail:
2052251538Srpaulo	urtwn_free_list(sc, data, ndata);
2053251538Srpaulo	return (error);
2054251538Srpaulo}
2055251538Srpaulo
2056251538Srpaulostatic int
2057251538Srpaulourtwn_alloc_rx_list(struct urtwn_softc *sc)
2058251538Srpaulo{
2059251538Srpaulo        int error, i;
2060251538Srpaulo
2061251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
2062251538Srpaulo	    URTWN_RXBUFSZ);
2063251538Srpaulo	if (error != 0)
2064251538Srpaulo		return (error);
2065251538Srpaulo
2066251538Srpaulo	STAILQ_INIT(&sc->sc_rx_active);
2067251538Srpaulo	STAILQ_INIT(&sc->sc_rx_inactive);
2068251538Srpaulo
2069251538Srpaulo	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
2070251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
2071251538Srpaulo
2072251538Srpaulo	return (0);
2073251538Srpaulo}
2074251538Srpaulo
2075251538Srpaulostatic int
2076251538Srpaulourtwn_alloc_tx_list(struct urtwn_softc *sc)
2077251538Srpaulo{
2078251538Srpaulo	int error, i;
2079251538Srpaulo
2080251538Srpaulo	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
2081251538Srpaulo	    URTWN_TXBUFSZ);
2082251538Srpaulo	if (error != 0)
2083251538Srpaulo		return (error);
2084251538Srpaulo
2085251538Srpaulo	STAILQ_INIT(&sc->sc_tx_active);
2086251538Srpaulo	STAILQ_INIT(&sc->sc_tx_inactive);
2087251538Srpaulo	STAILQ_INIT(&sc->sc_tx_pending);
2088251538Srpaulo
2089251538Srpaulo	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
2090251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
2091251538Srpaulo
2092251538Srpaulo	return (0);
2093251538Srpaulo}
2094251538Srpaulo
2095264912Skevlostatic __inline int
2096251538Srpaulourtwn_power_on(struct urtwn_softc *sc)
2097251538Srpaulo{
2098264912Skevlo
2099264912Skevlo	return sc->sc_power_on(sc);
2100264912Skevlo}
2101264912Skevlo
2102264912Skevlostatic int
2103264912Skevlourtwn_r92c_power_on(struct urtwn_softc *sc)
2104264912Skevlo{
2105251538Srpaulo	uint32_t reg;
2106251538Srpaulo	int ntries;
2107251538Srpaulo
2108251538Srpaulo	/* Wait for autoload done bit. */
2109251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2110251538Srpaulo		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2111251538Srpaulo			break;
2112266472Shselasky		urtwn_ms_delay(sc);
2113251538Srpaulo	}
2114251538Srpaulo	if (ntries == 1000) {
2115251538Srpaulo		device_printf(sc->sc_dev,
2116251538Srpaulo		    "timeout waiting for chip autoload\n");
2117251538Srpaulo		return (ETIMEDOUT);
2118251538Srpaulo	}
2119251538Srpaulo
2120251538Srpaulo	/* Unlock ISO/CLK/Power control register. */
2121251538Srpaulo	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2122251538Srpaulo	/* Move SPS into PWM mode. */
2123251538Srpaulo	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2124266472Shselasky	urtwn_ms_delay(sc);
2125251538Srpaulo
2126251538Srpaulo	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2127251538Srpaulo	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2128251538Srpaulo		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2129251538Srpaulo		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2130266472Shselasky		urtwn_ms_delay(sc);
2131251538Srpaulo		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2132251538Srpaulo		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2133251538Srpaulo		    ~R92C_SYS_ISO_CTRL_MD2PP);
2134251538Srpaulo	}
2135251538Srpaulo
2136251538Srpaulo	/* Auto enable WLAN. */
2137251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
2138251538Srpaulo	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2139251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2140262822Skevlo		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2141262822Skevlo		    R92C_APS_FSMCO_APFM_ONMAC))
2142251538Srpaulo			break;
2143266472Shselasky		urtwn_ms_delay(sc);
2144251538Srpaulo	}
2145251538Srpaulo	if (ntries == 1000) {
2146251538Srpaulo		device_printf(sc->sc_dev,
2147251538Srpaulo		    "timeout waiting for MAC auto ON\n");
2148251538Srpaulo		return (ETIMEDOUT);
2149251538Srpaulo	}
2150251538Srpaulo
2151251538Srpaulo	/* Enable radio, GPIO and LED functions. */
2152251538Srpaulo	urtwn_write_2(sc, R92C_APS_FSMCO,
2153251538Srpaulo	    R92C_APS_FSMCO_AFSM_HSUS |
2154251538Srpaulo	    R92C_APS_FSMCO_PDN_EN |
2155251538Srpaulo	    R92C_APS_FSMCO_PFM_ALDN);
2156251538Srpaulo	/* Release RF digital isolation. */
2157251538Srpaulo	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2158251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2159251538Srpaulo
2160251538Srpaulo	/* Initialize MAC. */
2161251538Srpaulo	urtwn_write_1(sc, R92C_APSD_CTRL,
2162251538Srpaulo	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2163251538Srpaulo	for (ntries = 0; ntries < 200; ntries++) {
2164251538Srpaulo		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2165251538Srpaulo		    R92C_APSD_CTRL_OFF_STATUS))
2166251538Srpaulo			break;
2167266472Shselasky		urtwn_ms_delay(sc);
2168251538Srpaulo	}
2169251538Srpaulo	if (ntries == 200) {
2170251538Srpaulo		device_printf(sc->sc_dev,
2171251538Srpaulo		    "timeout waiting for MAC initialization\n");
2172251538Srpaulo		return (ETIMEDOUT);
2173251538Srpaulo	}
2174251538Srpaulo
2175251538Srpaulo	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2176251538Srpaulo	reg = urtwn_read_2(sc, R92C_CR);
2177251538Srpaulo	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2178251538Srpaulo	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2179251538Srpaulo	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2180251538Srpaulo	    R92C_CR_ENSEC;
2181251538Srpaulo	urtwn_write_2(sc, R92C_CR, reg);
2182251538Srpaulo
2183251538Srpaulo	urtwn_write_1(sc, 0xfe10, 0x19);
2184251538Srpaulo	return (0);
2185251538Srpaulo}
2186251538Srpaulo
2187251538Srpaulostatic int
2188264912Skevlourtwn_r88e_power_on(struct urtwn_softc *sc)
2189264912Skevlo{
2190264912Skevlo	uint32_t reg;
2191264912Skevlo	int ntries;
2192264912Skevlo
2193264912Skevlo	/* Wait for power ready bit. */
2194264912Skevlo	for (ntries = 0; ntries < 5000; ntries++) {
2195281918Skevlo		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2196264912Skevlo			break;
2197266472Shselasky		urtwn_ms_delay(sc);
2198264912Skevlo	}
2199264912Skevlo	if (ntries == 5000) {
2200264912Skevlo		device_printf(sc->sc_dev,
2201264912Skevlo		    "timeout waiting for chip power up\n");
2202264912Skevlo		return (ETIMEDOUT);
2203264912Skevlo	}
2204264912Skevlo
2205264912Skevlo	/* Reset BB. */
2206264912Skevlo	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2207264912Skevlo	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2208264912Skevlo	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2209264912Skevlo
2210281918Skevlo	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2211281918Skevlo	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2212264912Skevlo
2213264912Skevlo	/* Disable HWPDN. */
2214281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2215281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2216264912Skevlo
2217264912Skevlo	/* Disable WL suspend. */
2218281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2219281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2220281918Skevlo	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2221264912Skevlo
2222281918Skevlo	urtwn_write_2(sc, R92C_APS_FSMCO,
2223281918Skevlo	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2224264912Skevlo	for (ntries = 0; ntries < 5000; ntries++) {
2225281918Skevlo		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2226281918Skevlo		    R92C_APS_FSMCO_APFM_ONMAC))
2227264912Skevlo			break;
2228266472Shselasky		urtwn_ms_delay(sc);
2229264912Skevlo	}
2230264912Skevlo	if (ntries == 5000)
2231264912Skevlo		return (ETIMEDOUT);
2232264912Skevlo
2233264912Skevlo	/* Enable LDO normal mode. */
2234281918Skevlo	urtwn_write_1(sc, R92C_LPLDO_CTRL,
2235281918Skevlo	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2236264912Skevlo
2237264912Skevlo	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2238264912Skevlo	urtwn_write_2(sc, R92C_CR, 0);
2239264912Skevlo	reg = urtwn_read_2(sc, R92C_CR);
2240264912Skevlo	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2241264912Skevlo	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2242264912Skevlo	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2243264912Skevlo	urtwn_write_2(sc, R92C_CR, reg);
2244264912Skevlo
2245264912Skevlo	return (0);
2246264912Skevlo}
2247264912Skevlo
2248264912Skevlostatic int
2249251538Srpaulourtwn_llt_init(struct urtwn_softc *sc)
2250251538Srpaulo{
2251264912Skevlo	int i, error, page_count, pktbuf_count;
2252251538Srpaulo
2253264912Skevlo	page_count = (sc->chip & URTWN_CHIP_88E) ?
2254264912Skevlo	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2255264912Skevlo	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2256264912Skevlo	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2257264912Skevlo
2258264912Skevlo	/* Reserve pages [0; page_count]. */
2259264912Skevlo	for (i = 0; i < page_count; i++) {
2260251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2261251538Srpaulo			return (error);
2262251538Srpaulo	}
2263251538Srpaulo	/* NB: 0xff indicates end-of-list. */
2264251538Srpaulo	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2265251538Srpaulo		return (error);
2266251538Srpaulo	/*
2267264912Skevlo	 * Use pages [page_count + 1; pktbuf_count - 1]
2268251538Srpaulo	 * as ring buffer.
2269251538Srpaulo	 */
2270264912Skevlo	for (++i; i < pktbuf_count - 1; i++) {
2271251538Srpaulo		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2272251538Srpaulo			return (error);
2273251538Srpaulo	}
2274251538Srpaulo	/* Make the last page point to the beginning of the ring buffer. */
2275264912Skevlo	error = urtwn_llt_write(sc, i, page_count + 1);
2276251538Srpaulo	return (error);
2277251538Srpaulo}
2278251538Srpaulo
2279251538Srpaulostatic void
2280251538Srpaulourtwn_fw_reset(struct urtwn_softc *sc)
2281251538Srpaulo{
2282251538Srpaulo	uint16_t reg;
2283251538Srpaulo	int ntries;
2284251538Srpaulo
2285251538Srpaulo	/* Tell 8051 to reset itself. */
2286251538Srpaulo	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2287251538Srpaulo
2288251538Srpaulo	/* Wait until 8051 resets by itself. */
2289251538Srpaulo	for (ntries = 0; ntries < 100; ntries++) {
2290251538Srpaulo		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2291251538Srpaulo		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2292251538Srpaulo			return;
2293266472Shselasky		urtwn_ms_delay(sc);
2294251538Srpaulo	}
2295251538Srpaulo	/* Force 8051 reset. */
2296251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2297251538Srpaulo}
2298251538Srpaulo
2299264912Skevlostatic void
2300264912Skevlourtwn_r88e_fw_reset(struct urtwn_softc *sc)
2301264912Skevlo{
2302264912Skevlo	uint16_t reg;
2303264912Skevlo
2304264912Skevlo	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2305264912Skevlo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2306264912Skevlo	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2307264912Skevlo}
2308264912Skevlo
2309251538Srpaulostatic int
2310251538Srpaulourtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2311251538Srpaulo{
2312251538Srpaulo	uint32_t reg;
2313251538Srpaulo	int off, mlen, error = 0;
2314251538Srpaulo
2315251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2316251538Srpaulo	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2317251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2318251538Srpaulo
2319251538Srpaulo	off = R92C_FW_START_ADDR;
2320251538Srpaulo	while (len > 0) {
2321251538Srpaulo		if (len > 196)
2322251538Srpaulo			mlen = 196;
2323251538Srpaulo		else if (len > 4)
2324251538Srpaulo			mlen = 4;
2325251538Srpaulo		else
2326251538Srpaulo			mlen = 1;
2327251538Srpaulo		/* XXX fix this deconst */
2328281069Srpaulo		error = urtwn_write_region_1(sc, off,
2329251538Srpaulo		    __DECONST(uint8_t *, buf), mlen);
2330251538Srpaulo		if (error != 0)
2331251538Srpaulo			break;
2332251538Srpaulo		off += mlen;
2333251538Srpaulo		buf += mlen;
2334251538Srpaulo		len -= mlen;
2335251538Srpaulo	}
2336251538Srpaulo	return (error);
2337251538Srpaulo}
2338251538Srpaulo
2339251538Srpaulostatic int
2340251538Srpaulourtwn_load_firmware(struct urtwn_softc *sc)
2341251538Srpaulo{
2342251538Srpaulo	const struct firmware *fw;
2343251538Srpaulo	const struct r92c_fw_hdr *hdr;
2344251538Srpaulo	const char *imagename;
2345251538Srpaulo	const u_char *ptr;
2346251538Srpaulo	size_t len;
2347251538Srpaulo	uint32_t reg;
2348251538Srpaulo	int mlen, ntries, page, error;
2349251538Srpaulo
2350264864Skevlo	URTWN_UNLOCK(sc);
2351251538Srpaulo	/* Read firmware image from the filesystem. */
2352264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2353264912Skevlo		imagename = "urtwn-rtl8188eufw";
2354264912Skevlo	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2355264912Skevlo		    URTWN_CHIP_UMC_A_CUT)
2356251538Srpaulo		imagename = "urtwn-rtl8192cfwU";
2357251538Srpaulo	else
2358251538Srpaulo		imagename = "urtwn-rtl8192cfwT";
2359251538Srpaulo
2360251538Srpaulo	fw = firmware_get(imagename);
2361264864Skevlo	URTWN_LOCK(sc);
2362251538Srpaulo	if (fw == NULL) {
2363251538Srpaulo		device_printf(sc->sc_dev,
2364251538Srpaulo		    "failed loadfirmware of file %s\n", imagename);
2365251538Srpaulo		return (ENOENT);
2366251538Srpaulo	}
2367251538Srpaulo
2368251538Srpaulo	len = fw->datasize;
2369251538Srpaulo
2370251538Srpaulo	if (len < sizeof(*hdr)) {
2371251538Srpaulo		device_printf(sc->sc_dev, "firmware too short\n");
2372251538Srpaulo		error = EINVAL;
2373251538Srpaulo		goto fail;
2374251538Srpaulo	}
2375251538Srpaulo	ptr = fw->data;
2376251538Srpaulo	hdr = (const struct r92c_fw_hdr *)ptr;
2377251538Srpaulo	/* Check if there is a valid FW header and skip it. */
2378251538Srpaulo	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2379264912Skevlo	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2380251538Srpaulo	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2381251538Srpaulo		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2382251538Srpaulo		    le16toh(hdr->version), le16toh(hdr->subversion),
2383251538Srpaulo		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2384251538Srpaulo		ptr += sizeof(*hdr);
2385251538Srpaulo		len -= sizeof(*hdr);
2386251538Srpaulo	}
2387251538Srpaulo
2388264912Skevlo	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2389264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
2390264912Skevlo			urtwn_r88e_fw_reset(sc);
2391264912Skevlo		else
2392264912Skevlo			urtwn_fw_reset(sc);
2393251538Srpaulo		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2394251538Srpaulo	}
2395264912Skevlo
2396268487Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
2397268487Skevlo		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2398268487Skevlo		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2399268487Skevlo		    R92C_SYS_FUNC_EN_CPUEN);
2400268487Skevlo	}
2401251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2402251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2403251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2404251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2405251538Srpaulo
2406263154Skevlo	/* Reset the FWDL checksum. */
2407263154Skevlo	urtwn_write_1(sc, R92C_MCUFWDL,
2408263154Skevlo	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2409263154Skevlo
2410251538Srpaulo	for (page = 0; len > 0; page++) {
2411251538Srpaulo		mlen = min(len, R92C_FW_PAGE_SIZE);
2412251538Srpaulo		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2413251538Srpaulo		if (error != 0) {
2414251538Srpaulo			device_printf(sc->sc_dev,
2415251538Srpaulo			    "could not load firmware page\n");
2416251538Srpaulo			goto fail;
2417251538Srpaulo		}
2418251538Srpaulo		ptr += mlen;
2419251538Srpaulo		len -= mlen;
2420251538Srpaulo	}
2421251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL,
2422251538Srpaulo	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2423251538Srpaulo	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2424251538Srpaulo
2425251538Srpaulo	/* Wait for checksum report. */
2426251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2427251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2428251538Srpaulo			break;
2429266472Shselasky		urtwn_ms_delay(sc);
2430251538Srpaulo	}
2431251538Srpaulo	if (ntries == 1000) {
2432251538Srpaulo		device_printf(sc->sc_dev,
2433251538Srpaulo		    "timeout waiting for checksum report\n");
2434251538Srpaulo		error = ETIMEDOUT;
2435251538Srpaulo		goto fail;
2436251538Srpaulo	}
2437251538Srpaulo
2438251538Srpaulo	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2439251538Srpaulo	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2440251538Srpaulo	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2441264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2442264912Skevlo		urtwn_r88e_fw_reset(sc);
2443251538Srpaulo	/* Wait for firmware readiness. */
2444251538Srpaulo	for (ntries = 0; ntries < 1000; ntries++) {
2445251538Srpaulo		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2446251538Srpaulo			break;
2447266472Shselasky		urtwn_ms_delay(sc);
2448251538Srpaulo	}
2449251538Srpaulo	if (ntries == 1000) {
2450251538Srpaulo		device_printf(sc->sc_dev,
2451251538Srpaulo		    "timeout waiting for firmware readiness\n");
2452251538Srpaulo		error = ETIMEDOUT;
2453251538Srpaulo		goto fail;
2454251538Srpaulo	}
2455251538Srpaulofail:
2456251538Srpaulo	firmware_put(fw, FIRMWARE_UNLOAD);
2457251538Srpaulo	return (error);
2458251538Srpaulo}
2459251538Srpaulo
2460264912Skevlostatic __inline int
2461251538Srpaulourtwn_dma_init(struct urtwn_softc *sc)
2462251538Srpaulo{
2463281069Srpaulo
2464264912Skevlo	return sc->sc_dma_init(sc);
2465264912Skevlo}
2466264912Skevlo
2467264912Skevlostatic int
2468264912Skevlourtwn_r92c_dma_init(struct urtwn_softc *sc)
2469264912Skevlo{
2470251538Srpaulo	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2471251538Srpaulo	uint32_t reg;
2472251538Srpaulo	int error;
2473251538Srpaulo
2474251538Srpaulo	/* Initialize LLT table. */
2475251538Srpaulo	error = urtwn_llt_init(sc);
2476251538Srpaulo	if (error != 0)
2477251538Srpaulo		return (error);
2478251538Srpaulo
2479251538Srpaulo	/* Get Tx queues to USB endpoints mapping. */
2480251538Srpaulo	hashq = hasnq = haslq = 0;
2481251538Srpaulo	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2482251538Srpaulo	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2483251538Srpaulo	if (MS(reg, R92C_USB_EP_HQ) != 0)
2484251538Srpaulo		hashq = 1;
2485251538Srpaulo	if (MS(reg, R92C_USB_EP_NQ) != 0)
2486251538Srpaulo		hasnq = 1;
2487251538Srpaulo	if (MS(reg, R92C_USB_EP_LQ) != 0)
2488251538Srpaulo		haslq = 1;
2489251538Srpaulo	nqueues = hashq + hasnq + haslq;
2490251538Srpaulo	if (nqueues == 0)
2491251538Srpaulo		return (EIO);
2492251538Srpaulo	/* Get the number of pages for each queue. */
2493251538Srpaulo	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2494251538Srpaulo	/* The remaining pages are assigned to the high priority queue. */
2495251538Srpaulo	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2496251538Srpaulo
2497251538Srpaulo	/* Set number of pages for normal priority queue. */
2498251538Srpaulo	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2499251538Srpaulo	urtwn_write_4(sc, R92C_RQPN,
2500251538Srpaulo	    /* Set number of pages for public queue. */
2501251538Srpaulo	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2502251538Srpaulo	    /* Set number of pages for high priority queue. */
2503251538Srpaulo	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2504251538Srpaulo	    /* Set number of pages for low priority queue. */
2505251538Srpaulo	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2506251538Srpaulo	    /* Load values. */
2507251538Srpaulo	    R92C_RQPN_LD);
2508251538Srpaulo
2509251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2510251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2511251538Srpaulo	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2512251538Srpaulo	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2513251538Srpaulo	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2514251538Srpaulo
2515251538Srpaulo	/* Set queue to USB pipe mapping. */
2516251538Srpaulo	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2517251538Srpaulo	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2518251538Srpaulo	if (nqueues == 1) {
2519251538Srpaulo		if (hashq)
2520251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2521251538Srpaulo		else if (hasnq)
2522251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2523251538Srpaulo		else
2524251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2525251538Srpaulo	} else if (nqueues == 2) {
2526251538Srpaulo		/* All 2-endpoints configs have a high priority queue. */
2527251538Srpaulo		if (!hashq)
2528251538Srpaulo			return (EIO);
2529251538Srpaulo		if (hasnq)
2530251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2531251538Srpaulo		else
2532251538Srpaulo			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2533251538Srpaulo	} else
2534251538Srpaulo		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2535251538Srpaulo	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2536251538Srpaulo
2537251538Srpaulo	/* Set Tx/Rx transfer page boundary. */
2538251538Srpaulo	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2539251538Srpaulo
2540251538Srpaulo	/* Set Tx/Rx transfer page size. */
2541251538Srpaulo	urtwn_write_1(sc, R92C_PBP,
2542251538Srpaulo	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2543251538Srpaulo	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2544251538Srpaulo	return (0);
2545251538Srpaulo}
2546251538Srpaulo
2547264912Skevlostatic int
2548264912Skevlourtwn_r88e_dma_init(struct urtwn_softc *sc)
2549264912Skevlo{
2550264912Skevlo	struct usb_interface *iface;
2551264912Skevlo	uint32_t reg;
2552264912Skevlo	int nqueues;
2553264912Skevlo	int error;
2554264912Skevlo
2555264912Skevlo	/* Initialize LLT table. */
2556264912Skevlo	error = urtwn_llt_init(sc);
2557264912Skevlo	if (error != 0)
2558264912Skevlo		return (error);
2559264912Skevlo
2560264912Skevlo	/* Get Tx queues to USB endpoints mapping. */
2561264912Skevlo	iface = usbd_get_iface(sc->sc_udev, 0);
2562264912Skevlo	nqueues = iface->idesc->bNumEndpoints - 1;
2563264912Skevlo	if (nqueues == 0)
2564264912Skevlo		return (EIO);
2565264912Skevlo
2566264912Skevlo	/* Set number of pages for normal priority queue. */
2567264912Skevlo	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2568264912Skevlo	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2569264912Skevlo
2570264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2571264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2572264912Skevlo	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2573264912Skevlo	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2574264912Skevlo	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2575264912Skevlo
2576264912Skevlo	/* Set queue to USB pipe mapping. */
2577264912Skevlo	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2578264912Skevlo	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2579264912Skevlo	if (nqueues == 1)
2580264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2581264912Skevlo	else if (nqueues == 2)
2582264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2583264912Skevlo	else
2584264912Skevlo		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2585264912Skevlo	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2586264912Skevlo
2587264912Skevlo	/* Set Tx/Rx transfer page boundary. */
2588264912Skevlo	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2589264912Skevlo
2590264912Skevlo	/* Set Tx/Rx transfer page size. */
2591264912Skevlo	urtwn_write_1(sc, R92C_PBP,
2592264912Skevlo	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2593264912Skevlo	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2594264912Skevlo
2595264912Skevlo	return (0);
2596264912Skevlo}
2597264912Skevlo
2598251538Srpaulostatic void
2599251538Srpaulourtwn_mac_init(struct urtwn_softc *sc)
2600251538Srpaulo{
2601251538Srpaulo	int i;
2602251538Srpaulo
2603251538Srpaulo	/* Write MAC initialization values. */
2604264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
2605264912Skevlo		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2606264912Skevlo			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2607264912Skevlo			    rtl8188eu_mac[i].val);
2608264912Skevlo		}
2609264912Skevlo		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2610264912Skevlo	} else {
2611264912Skevlo		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2612264912Skevlo			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2613264912Skevlo			    rtl8192cu_mac[i].val);
2614264912Skevlo	}
2615251538Srpaulo}
2616251538Srpaulo
2617251538Srpaulostatic void
2618251538Srpaulourtwn_bb_init(struct urtwn_softc *sc)
2619251538Srpaulo{
2620251538Srpaulo	const struct urtwn_bb_prog *prog;
2621251538Srpaulo	uint32_t reg;
2622264912Skevlo	uint8_t crystalcap;
2623251538Srpaulo	int i;
2624251538Srpaulo
2625251538Srpaulo	/* Enable BB and RF. */
2626251538Srpaulo	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2627251538Srpaulo	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2628251538Srpaulo	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2629251538Srpaulo	    R92C_SYS_FUNC_EN_DIO_RF);
2630251538Srpaulo
2631264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E))
2632264912Skevlo		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2633251538Srpaulo
2634251538Srpaulo	urtwn_write_1(sc, R92C_RF_CTRL,
2635251538Srpaulo	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2636251538Srpaulo	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2637251538Srpaulo	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2638251538Srpaulo	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2639251538Srpaulo
2640264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
2641264912Skevlo		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2642264912Skevlo		urtwn_write_1(sc, 0x15, 0xe9);
2643264912Skevlo		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2644264912Skevlo	}
2645251538Srpaulo
2646251538Srpaulo	/* Select BB programming based on board type. */
2647264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2648264912Skevlo		prog = &rtl8188eu_bb_prog;
2649264912Skevlo	else if (!(sc->chip & URTWN_CHIP_92C)) {
2650251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2651251538Srpaulo			prog = &rtl8188ce_bb_prog;
2652251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2653251538Srpaulo			prog = &rtl8188ru_bb_prog;
2654251538Srpaulo		else
2655251538Srpaulo			prog = &rtl8188cu_bb_prog;
2656251538Srpaulo	} else {
2657251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2658251538Srpaulo			prog = &rtl8192ce_bb_prog;
2659251538Srpaulo		else
2660251538Srpaulo			prog = &rtl8192cu_bb_prog;
2661251538Srpaulo	}
2662251538Srpaulo	/* Write BB initialization values. */
2663251538Srpaulo	for (i = 0; i < prog->count; i++) {
2664251538Srpaulo		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2665266472Shselasky		urtwn_ms_delay(sc);
2666251538Srpaulo	}
2667251538Srpaulo
2668251538Srpaulo	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2669251538Srpaulo		/* 8192C 1T only configuration. */
2670251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2671251538Srpaulo		reg = (reg & ~0x00000003) | 0x2;
2672251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2673251538Srpaulo
2674251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2675251538Srpaulo		reg = (reg & ~0x00300033) | 0x00200022;
2676251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2677251538Srpaulo
2678251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2679251538Srpaulo		reg = (reg & ~0xff000000) | 0x45 << 24;
2680251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2681251538Srpaulo
2682251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2683251538Srpaulo		reg = (reg & ~0x000000ff) | 0x23;
2684251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2685251538Srpaulo
2686251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2687251538Srpaulo		reg = (reg & ~0x00000030) | 1 << 4;
2688251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2689251538Srpaulo
2690251538Srpaulo		reg = urtwn_bb_read(sc, 0xe74);
2691251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2692251538Srpaulo		urtwn_bb_write(sc, 0xe74, reg);
2693251538Srpaulo		reg = urtwn_bb_read(sc, 0xe78);
2694251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2695251538Srpaulo		urtwn_bb_write(sc, 0xe78, reg);
2696251538Srpaulo		reg = urtwn_bb_read(sc, 0xe7c);
2697251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2698251538Srpaulo		urtwn_bb_write(sc, 0xe7c, reg);
2699251538Srpaulo		reg = urtwn_bb_read(sc, 0xe80);
2700251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2701251538Srpaulo		urtwn_bb_write(sc, 0xe80, reg);
2702251538Srpaulo		reg = urtwn_bb_read(sc, 0xe88);
2703251538Srpaulo		reg = (reg & ~0x0c000000) | 2 << 26;
2704251538Srpaulo		urtwn_bb_write(sc, 0xe88, reg);
2705251538Srpaulo	}
2706251538Srpaulo
2707251538Srpaulo	/* Write AGC values. */
2708251538Srpaulo	for (i = 0; i < prog->agccount; i++) {
2709251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2710251538Srpaulo		    prog->agcvals[i]);
2711266472Shselasky		urtwn_ms_delay(sc);
2712251538Srpaulo	}
2713251538Srpaulo
2714264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
2715264912Skevlo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2716266472Shselasky		urtwn_ms_delay(sc);
2717264912Skevlo		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2718266472Shselasky		urtwn_ms_delay(sc);
2719264912Skevlo
2720264912Skevlo		crystalcap = sc->r88e_rom[0xb9];
2721264912Skevlo		if (crystalcap == 0xff)
2722264912Skevlo			crystalcap = 0x20;
2723264912Skevlo		crystalcap &= 0x3f;
2724264912Skevlo		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2725264912Skevlo		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2726264912Skevlo		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2727264912Skevlo		    crystalcap | crystalcap << 6));
2728264912Skevlo	} else {
2729264912Skevlo		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2730264912Skevlo		    R92C_HSSI_PARAM2_CCK_HIPWR)
2731264912Skevlo			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2732264912Skevlo	}
2733251538Srpaulo}
2734251538Srpaulo
2735251538Srpaulovoid
2736251538Srpaulourtwn_rf_init(struct urtwn_softc *sc)
2737251538Srpaulo{
2738251538Srpaulo	const struct urtwn_rf_prog *prog;
2739251538Srpaulo	uint32_t reg, type;
2740251538Srpaulo	int i, j, idx, off;
2741251538Srpaulo
2742251538Srpaulo	/* Select RF programming based on board type. */
2743264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
2744264912Skevlo		prog = rtl8188eu_rf_prog;
2745264912Skevlo	else if (!(sc->chip & URTWN_CHIP_92C)) {
2746251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2747251538Srpaulo			prog = rtl8188ce_rf_prog;
2748251538Srpaulo		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2749251538Srpaulo			prog = rtl8188ru_rf_prog;
2750251538Srpaulo		else
2751251538Srpaulo			prog = rtl8188cu_rf_prog;
2752251538Srpaulo	} else
2753251538Srpaulo		prog = rtl8192ce_rf_prog;
2754251538Srpaulo
2755251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2756251538Srpaulo		/* Save RF_ENV control type. */
2757251538Srpaulo		idx = i / 2;
2758251538Srpaulo		off = (i % 2) * 16;
2759251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2760251538Srpaulo		type = (reg >> off) & 0x10;
2761251538Srpaulo
2762251538Srpaulo		/* Set RF_ENV enable. */
2763251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2764251538Srpaulo		reg |= 0x100000;
2765251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2766266472Shselasky		urtwn_ms_delay(sc);
2767251538Srpaulo		/* Set RF_ENV output high. */
2768251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2769251538Srpaulo		reg |= 0x10;
2770251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2771266472Shselasky		urtwn_ms_delay(sc);
2772251538Srpaulo		/* Set address and data lengths of RF registers. */
2773251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2774251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2775251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2776266472Shselasky		urtwn_ms_delay(sc);
2777251538Srpaulo		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2778251538Srpaulo		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2779251538Srpaulo		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2780266472Shselasky		urtwn_ms_delay(sc);
2781251538Srpaulo
2782251538Srpaulo		/* Write RF initialization values for this chain. */
2783251538Srpaulo		for (j = 0; j < prog[i].count; j++) {
2784251538Srpaulo			if (prog[i].regs[j] >= 0xf9 &&
2785251538Srpaulo			    prog[i].regs[j] <= 0xfe) {
2786251538Srpaulo				/*
2787251538Srpaulo				 * These are fake RF registers offsets that
2788251538Srpaulo				 * indicate a delay is required.
2789251538Srpaulo				 */
2790266472Shselasky				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
2791251538Srpaulo				continue;
2792251538Srpaulo			}
2793251538Srpaulo			urtwn_rf_write(sc, i, prog[i].regs[j],
2794251538Srpaulo			    prog[i].vals[j]);
2795266472Shselasky			urtwn_ms_delay(sc);
2796251538Srpaulo		}
2797251538Srpaulo
2798251538Srpaulo		/* Restore RF_ENV control type. */
2799251538Srpaulo		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2800251538Srpaulo		reg &= ~(0x10 << off) | (type << off);
2801251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2802251538Srpaulo
2803251538Srpaulo		/* Cache RF register CHNLBW. */
2804251538Srpaulo		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2805251538Srpaulo	}
2806251538Srpaulo
2807251538Srpaulo	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2808251538Srpaulo	    URTWN_CHIP_UMC_A_CUT) {
2809251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2810251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2811251538Srpaulo	}
2812251538Srpaulo}
2813251538Srpaulo
2814251538Srpaulostatic void
2815251538Srpaulourtwn_cam_init(struct urtwn_softc *sc)
2816251538Srpaulo{
2817251538Srpaulo	/* Invalidate all CAM entries. */
2818251538Srpaulo	urtwn_write_4(sc, R92C_CAMCMD,
2819251538Srpaulo	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2820251538Srpaulo}
2821251538Srpaulo
2822251538Srpaulostatic void
2823251538Srpaulourtwn_pa_bias_init(struct urtwn_softc *sc)
2824251538Srpaulo{
2825251538Srpaulo	uint8_t reg;
2826251538Srpaulo	int i;
2827251538Srpaulo
2828251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
2829251538Srpaulo		if (sc->pa_setting & (1 << i))
2830251538Srpaulo			continue;
2831251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2832251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2833251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2834251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2835251538Srpaulo	}
2836251538Srpaulo	if (!(sc->pa_setting & 0x10)) {
2837251538Srpaulo		reg = urtwn_read_1(sc, 0x16);
2838251538Srpaulo		reg = (reg & ~0xf0) | 0x90;
2839251538Srpaulo		urtwn_write_1(sc, 0x16, reg);
2840251538Srpaulo	}
2841251538Srpaulo}
2842251538Srpaulo
2843251538Srpaulostatic void
2844251538Srpaulourtwn_rxfilter_init(struct urtwn_softc *sc)
2845251538Srpaulo{
2846251538Srpaulo	/* Initialize Rx filter. */
2847251538Srpaulo	/* TODO: use better filter for monitor mode. */
2848251538Srpaulo	urtwn_write_4(sc, R92C_RCR,
2849251538Srpaulo	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2850251538Srpaulo	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2851251538Srpaulo	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2852251538Srpaulo	/* Accept all multicast frames. */
2853251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2854251538Srpaulo	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2855251538Srpaulo	/* Accept all management frames. */
2856251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2857251538Srpaulo	/* Reject all control frames. */
2858251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2859251538Srpaulo	/* Accept all data frames. */
2860251538Srpaulo	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2861251538Srpaulo}
2862251538Srpaulo
2863251538Srpaulostatic void
2864251538Srpaulourtwn_edca_init(struct urtwn_softc *sc)
2865251538Srpaulo{
2866251538Srpaulo	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2867251538Srpaulo	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2868251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2869251538Srpaulo	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2870251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2871251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2872251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2873251538Srpaulo	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2874251538Srpaulo}
2875251538Srpaulo
2876251538Srpaulovoid
2877251538Srpaulourtwn_write_txpower(struct urtwn_softc *sc, int chain,
2878251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2879251538Srpaulo{
2880251538Srpaulo	uint32_t reg;
2881251538Srpaulo
2882251538Srpaulo	/* Write per-CCK rate Tx power. */
2883251538Srpaulo	if (chain == 0) {
2884251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2885251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2886251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2887251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2888251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2889251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2890251538Srpaulo		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2891251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2892251538Srpaulo	} else {
2893251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2894251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2895251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2896251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2897251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2898251538Srpaulo		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2899251538Srpaulo		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2900251538Srpaulo		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2901251538Srpaulo	}
2902251538Srpaulo	/* Write per-OFDM rate Tx power. */
2903251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2904251538Srpaulo	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2905251538Srpaulo	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2906251538Srpaulo	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2907251538Srpaulo	    SM(R92C_TXAGC_RATE18, power[ 7]));
2908251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2909251538Srpaulo	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2910251538Srpaulo	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2911251538Srpaulo	    SM(R92C_TXAGC_RATE48, power[10]) |
2912251538Srpaulo	    SM(R92C_TXAGC_RATE54, power[11]));
2913251538Srpaulo	/* Write per-MCS Tx power. */
2914251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2915251538Srpaulo	    SM(R92C_TXAGC_MCS00,  power[12]) |
2916251538Srpaulo	    SM(R92C_TXAGC_MCS01,  power[13]) |
2917251538Srpaulo	    SM(R92C_TXAGC_MCS02,  power[14]) |
2918251538Srpaulo	    SM(R92C_TXAGC_MCS03,  power[15]));
2919251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2920251538Srpaulo	    SM(R92C_TXAGC_MCS04,  power[16]) |
2921251538Srpaulo	    SM(R92C_TXAGC_MCS05,  power[17]) |
2922251538Srpaulo	    SM(R92C_TXAGC_MCS06,  power[18]) |
2923251538Srpaulo	    SM(R92C_TXAGC_MCS07,  power[19]));
2924251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2925251538Srpaulo	    SM(R92C_TXAGC_MCS08,  power[20]) |
2926261506Skevlo	    SM(R92C_TXAGC_MCS09,  power[21]) |
2927251538Srpaulo	    SM(R92C_TXAGC_MCS10,  power[22]) |
2928251538Srpaulo	    SM(R92C_TXAGC_MCS11,  power[23]));
2929251538Srpaulo	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2930251538Srpaulo	    SM(R92C_TXAGC_MCS12,  power[24]) |
2931251538Srpaulo	    SM(R92C_TXAGC_MCS13,  power[25]) |
2932251538Srpaulo	    SM(R92C_TXAGC_MCS14,  power[26]) |
2933251538Srpaulo	    SM(R92C_TXAGC_MCS15,  power[27]));
2934251538Srpaulo}
2935251538Srpaulo
2936251538Srpaulovoid
2937251538Srpaulourtwn_get_txpower(struct urtwn_softc *sc, int chain,
2938251538Srpaulo    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2939251538Srpaulo    uint16_t power[URTWN_RIDX_COUNT])
2940251538Srpaulo{
2941251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2942251538Srpaulo	struct r92c_rom *rom = &sc->rom;
2943251538Srpaulo	uint16_t cckpow, ofdmpow, htpow, diff, max;
2944251538Srpaulo	const struct urtwn_txpwr *base;
2945251538Srpaulo	int ridx, chan, group;
2946251538Srpaulo
2947251538Srpaulo	/* Determine channel group. */
2948251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2949251538Srpaulo	if (chan <= 3)
2950251538Srpaulo		group = 0;
2951251538Srpaulo	else if (chan <= 9)
2952251538Srpaulo		group = 1;
2953251538Srpaulo	else
2954251538Srpaulo		group = 2;
2955251538Srpaulo
2956251538Srpaulo	/* Get original Tx power based on board type and RF chain. */
2957251538Srpaulo	if (!(sc->chip & URTWN_CHIP_92C)) {
2958251538Srpaulo		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2959251538Srpaulo			base = &rtl8188ru_txagc[chain];
2960251538Srpaulo		else
2961251538Srpaulo			base = &rtl8192cu_txagc[chain];
2962251538Srpaulo	} else
2963251538Srpaulo		base = &rtl8192cu_txagc[chain];
2964251538Srpaulo
2965251538Srpaulo	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2966251538Srpaulo	if (sc->regulatory == 0) {
2967251538Srpaulo		for (ridx = 0; ridx <= 3; ridx++)
2968251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2969251538Srpaulo	}
2970251538Srpaulo	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2971251538Srpaulo		if (sc->regulatory == 3) {
2972251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2973251538Srpaulo			/* Apply vendor limits. */
2974251538Srpaulo			if (extc != NULL)
2975251538Srpaulo				max = rom->ht40_max_pwr[group];
2976251538Srpaulo			else
2977251538Srpaulo				max = rom->ht20_max_pwr[group];
2978251538Srpaulo			max = (max >> (chain * 4)) & 0xf;
2979251538Srpaulo			if (power[ridx] > max)
2980251538Srpaulo				power[ridx] = max;
2981251538Srpaulo		} else if (sc->regulatory == 1) {
2982251538Srpaulo			if (extc == NULL)
2983251538Srpaulo				power[ridx] = base->pwr[group][ridx];
2984251538Srpaulo		} else if (sc->regulatory != 2)
2985251538Srpaulo			power[ridx] = base->pwr[0][ridx];
2986251538Srpaulo	}
2987251538Srpaulo
2988251538Srpaulo	/* Compute per-CCK rate Tx power. */
2989251538Srpaulo	cckpow = rom->cck_tx_pwr[chain][group];
2990251538Srpaulo	for (ridx = 0; ridx <= 3; ridx++) {
2991251538Srpaulo		power[ridx] += cckpow;
2992251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
2993251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
2994251538Srpaulo	}
2995251538Srpaulo
2996251538Srpaulo	htpow = rom->ht40_1s_tx_pwr[chain][group];
2997251538Srpaulo	if (sc->ntxchains > 1) {
2998251538Srpaulo		/* Apply reduction for 2 spatial streams. */
2999251538Srpaulo		diff = rom->ht40_2s_tx_pwr_diff[group];
3000251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
3001251538Srpaulo		htpow = (htpow > diff) ? htpow - diff : 0;
3002251538Srpaulo	}
3003251538Srpaulo
3004251538Srpaulo	/* Compute per-OFDM rate Tx power. */
3005251538Srpaulo	diff = rom->ofdm_tx_pwr_diff[group];
3006251538Srpaulo	diff = (diff >> (chain * 4)) & 0xf;
3007251538Srpaulo	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3008251538Srpaulo	for (ridx = 4; ridx <= 11; ridx++) {
3009251538Srpaulo		power[ridx] += ofdmpow;
3010251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
3011251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
3012251538Srpaulo	}
3013251538Srpaulo
3014251538Srpaulo	/* Compute per-MCS Tx power. */
3015251538Srpaulo	if (extc == NULL) {
3016251538Srpaulo		diff = rom->ht20_tx_pwr_diff[group];
3017251538Srpaulo		diff = (diff >> (chain * 4)) & 0xf;
3018251538Srpaulo		htpow += diff;	/* HT40->HT20 correction. */
3019251538Srpaulo	}
3020251538Srpaulo	for (ridx = 12; ridx <= 27; ridx++) {
3021251538Srpaulo		power[ridx] += htpow;
3022251538Srpaulo		if (power[ridx] > R92C_MAX_TX_PWR)
3023251538Srpaulo			power[ridx] = R92C_MAX_TX_PWR;
3024251538Srpaulo	}
3025251538Srpaulo#ifdef URTWN_DEBUG
3026251538Srpaulo	if (urtwn_debug >= 4) {
3027251538Srpaulo		/* Dump per-rate Tx power values. */
3028251538Srpaulo		printf("Tx power for chain %d:\n", chain);
3029251538Srpaulo		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
3030251538Srpaulo			printf("Rate %d = %u\n", ridx, power[ridx]);
3031251538Srpaulo	}
3032251538Srpaulo#endif
3033251538Srpaulo}
3034251538Srpaulo
3035251538Srpaulovoid
3036264912Skevlourtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3037264912Skevlo    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3038264912Skevlo    uint16_t power[URTWN_RIDX_COUNT])
3039264912Skevlo{
3040264912Skevlo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3041264912Skevlo	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3042264912Skevlo	const struct urtwn_r88e_txpwr *base;
3043264912Skevlo	int ridx, chan, group;
3044264912Skevlo
3045264912Skevlo	/* Determine channel group. */
3046264912Skevlo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3047264912Skevlo	if (chan <= 2)
3048264912Skevlo		group = 0;
3049264912Skevlo	else if (chan <= 5)
3050264912Skevlo		group = 1;
3051264912Skevlo	else if (chan <= 8)
3052264912Skevlo		group = 2;
3053264912Skevlo	else if (chan <= 11)
3054264912Skevlo		group = 3;
3055264912Skevlo	else if (chan <= 13)
3056264912Skevlo		group = 4;
3057264912Skevlo	else
3058264912Skevlo		group = 5;
3059264912Skevlo
3060264912Skevlo	/* Get original Tx power based on board type and RF chain. */
3061264912Skevlo	base = &rtl8188eu_txagc[chain];
3062264912Skevlo
3063264912Skevlo	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3064264912Skevlo	if (sc->regulatory == 0) {
3065264912Skevlo		for (ridx = 0; ridx <= 3; ridx++)
3066264912Skevlo			power[ridx] = base->pwr[0][ridx];
3067264912Skevlo	}
3068264912Skevlo	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
3069264912Skevlo		if (sc->regulatory == 3)
3070264912Skevlo			power[ridx] = base->pwr[0][ridx];
3071264912Skevlo		else if (sc->regulatory == 1) {
3072264912Skevlo			if (extc == NULL)
3073264912Skevlo				power[ridx] = base->pwr[group][ridx];
3074264912Skevlo		} else if (sc->regulatory != 2)
3075264912Skevlo			power[ridx] = base->pwr[0][ridx];
3076264912Skevlo	}
3077264912Skevlo
3078264912Skevlo	/* Compute per-CCK rate Tx power. */
3079264912Skevlo	cckpow = sc->cck_tx_pwr[group];
3080264912Skevlo	for (ridx = 0; ridx <= 3; ridx++) {
3081264912Skevlo		power[ridx] += cckpow;
3082264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3083264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3084264912Skevlo	}
3085264912Skevlo
3086264912Skevlo	htpow = sc->ht40_tx_pwr[group];
3087264912Skevlo
3088264912Skevlo	/* Compute per-OFDM rate Tx power. */
3089264912Skevlo	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3090264912Skevlo	for (ridx = 4; ridx <= 11; ridx++) {
3091264912Skevlo		power[ridx] += ofdmpow;
3092264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3093264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3094264912Skevlo	}
3095264912Skevlo
3096264912Skevlo	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3097264912Skevlo	for (ridx = 12; ridx <= 27; ridx++) {
3098264912Skevlo		power[ridx] += bw20pow;
3099264912Skevlo		if (power[ridx] > R92C_MAX_TX_PWR)
3100264912Skevlo			power[ridx] = R92C_MAX_TX_PWR;
3101264912Skevlo	}
3102264912Skevlo}
3103264912Skevlo
3104264912Skevlovoid
3105251538Srpaulourtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3106251538Srpaulo    struct ieee80211_channel *extc)
3107251538Srpaulo{
3108251538Srpaulo	uint16_t power[URTWN_RIDX_COUNT];
3109251538Srpaulo	int i;
3110251538Srpaulo
3111251538Srpaulo	for (i = 0; i < sc->ntxchains; i++) {
3112251538Srpaulo		/* Compute per-rate Tx power values. */
3113264912Skevlo		if (sc->chip & URTWN_CHIP_88E)
3114264912Skevlo			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3115264912Skevlo		else
3116264912Skevlo			urtwn_get_txpower(sc, i, c, extc, power);
3117251538Srpaulo		/* Write per-rate Tx power values to hardware. */
3118251538Srpaulo		urtwn_write_txpower(sc, i, power);
3119251538Srpaulo	}
3120251538Srpaulo}
3121251538Srpaulo
3122251538Srpaulostatic void
3123251538Srpaulourtwn_scan_start(struct ieee80211com *ic)
3124251538Srpaulo{
3125251538Srpaulo	/* XXX do nothing?  */
3126251538Srpaulo}
3127251538Srpaulo
3128251538Srpaulostatic void
3129251538Srpaulourtwn_scan_end(struct ieee80211com *ic)
3130251538Srpaulo{
3131251538Srpaulo	/* XXX do nothing?  */
3132251538Srpaulo}
3133251538Srpaulo
3134251538Srpaulostatic void
3135251538Srpaulourtwn_set_channel(struct ieee80211com *ic)
3136251538Srpaulo{
3137251538Srpaulo	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
3138281070Srpaulo	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3139251538Srpaulo
3140251538Srpaulo	URTWN_LOCK(sc);
3141281070Srpaulo	if (vap->iv_state == IEEE80211_S_SCAN) {
3142281070Srpaulo		/* Make link LED blink during scan. */
3143281070Srpaulo		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3144281070Srpaulo	}
3145251538Srpaulo	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3146251538Srpaulo	URTWN_UNLOCK(sc);
3147251538Srpaulo}
3148251538Srpaulo
3149251538Srpaulostatic void
3150251538Srpaulourtwn_update_mcast(struct ifnet *ifp)
3151251538Srpaulo{
3152251538Srpaulo	/* XXX do nothing?  */
3153251538Srpaulo}
3154251538Srpaulo
3155251538Srpaulostatic void
3156251538Srpaulourtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3157251538Srpaulo    struct ieee80211_channel *extc)
3158251538Srpaulo{
3159251538Srpaulo	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3160251538Srpaulo	uint32_t reg;
3161251538Srpaulo	u_int chan;
3162251538Srpaulo	int i;
3163251538Srpaulo
3164251538Srpaulo	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3165251538Srpaulo	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3166251538Srpaulo		device_printf(sc->sc_dev,
3167251538Srpaulo		    "%s: invalid channel %x\n", __func__, chan);
3168251538Srpaulo		return;
3169251538Srpaulo	}
3170251538Srpaulo
3171251538Srpaulo	/* Set Tx power for this new channel. */
3172251538Srpaulo	urtwn_set_txpower(sc, c, extc);
3173251538Srpaulo
3174251538Srpaulo	for (i = 0; i < sc->nrxchains; i++) {
3175251538Srpaulo		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3176251538Srpaulo		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3177251538Srpaulo	}
3178251538Srpaulo#ifndef IEEE80211_NO_HT
3179251538Srpaulo	if (extc != NULL) {
3180251538Srpaulo		/* Is secondary channel below or above primary? */
3181251538Srpaulo		int prichlo = c->ic_freq < extc->ic_freq;
3182251538Srpaulo
3183251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
3184251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3185251538Srpaulo
3186251538Srpaulo		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3187251538Srpaulo		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3188251538Srpaulo		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3189251538Srpaulo
3190251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3191251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3192251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3193251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3194251538Srpaulo
3195251538Srpaulo		/* Set CCK side band. */
3196251538Srpaulo		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3197251538Srpaulo		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3198251538Srpaulo		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3199251538Srpaulo
3200251538Srpaulo		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3201251538Srpaulo		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3202251538Srpaulo		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3203251538Srpaulo
3204251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3205251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3206251538Srpaulo		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3207251538Srpaulo
3208251538Srpaulo		reg = urtwn_bb_read(sc, 0x818);
3209251538Srpaulo		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3210251538Srpaulo		urtwn_bb_write(sc, 0x818, reg);
3211251538Srpaulo
3212251538Srpaulo		/* Select 40MHz bandwidth. */
3213251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3214251538Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3215251538Srpaulo	} else
3216251538Srpaulo#endif
3217251538Srpaulo	{
3218251538Srpaulo		urtwn_write_1(sc, R92C_BWOPMODE,
3219251538Srpaulo		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3220251538Srpaulo
3221251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3222251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3223251538Srpaulo		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3224251538Srpaulo		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3225251538Srpaulo
3226264912Skevlo		if (!(sc->chip & URTWN_CHIP_88E)) {
3227264912Skevlo			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3228264912Skevlo			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3229264912Skevlo			    R92C_FPGA0_ANAPARAM2_CBW20);
3230264912Skevlo		}
3231281069Srpaulo
3232251538Srpaulo		/* Select 20MHz bandwidth. */
3233251538Srpaulo		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3234281069Srpaulo		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3235264912Skevlo		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3236264912Skevlo		    R92C_RF_CHNLBW_BW20));
3237251538Srpaulo	}
3238251538Srpaulo}
3239251538Srpaulo
3240251538Srpaulostatic void
3241251538Srpaulourtwn_iq_calib(struct urtwn_softc *sc)
3242251538Srpaulo{
3243251538Srpaulo	/* TODO */
3244251538Srpaulo}
3245251538Srpaulo
3246251538Srpaulostatic void
3247251538Srpaulourtwn_lc_calib(struct urtwn_softc *sc)
3248251538Srpaulo{
3249251538Srpaulo	uint32_t rf_ac[2];
3250251538Srpaulo	uint8_t txmode;
3251251538Srpaulo	int i;
3252251538Srpaulo
3253251538Srpaulo	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3254251538Srpaulo	if ((txmode & 0x70) != 0) {
3255251538Srpaulo		/* Disable all continuous Tx. */
3256251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3257251538Srpaulo
3258251538Srpaulo		/* Set RF mode to standby mode. */
3259251538Srpaulo		for (i = 0; i < sc->nrxchains; i++) {
3260251538Srpaulo			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3261251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC,
3262251538Srpaulo			    RW(rf_ac[i], R92C_RF_AC_MODE,
3263251538Srpaulo				R92C_RF_AC_MODE_STANDBY));
3264251538Srpaulo		}
3265251538Srpaulo	} else {
3266251538Srpaulo		/* Block all Tx queues. */
3267251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3268251538Srpaulo	}
3269251538Srpaulo	/* Start calibration. */
3270251538Srpaulo	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3271251538Srpaulo	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3272251538Srpaulo
3273251538Srpaulo	/* Give calibration the time to complete. */
3274266472Shselasky	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3275251538Srpaulo
3276251538Srpaulo	/* Restore configuration. */
3277251538Srpaulo	if ((txmode & 0x70) != 0) {
3278251538Srpaulo		/* Restore Tx mode. */
3279251538Srpaulo		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3280251538Srpaulo		/* Restore RF mode. */
3281251538Srpaulo		for (i = 0; i < sc->nrxchains; i++)
3282251538Srpaulo			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3283251538Srpaulo	} else {
3284251538Srpaulo		/* Unblock all Tx queues. */
3285251538Srpaulo		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3286251538Srpaulo	}
3287251538Srpaulo}
3288251538Srpaulo
3289251538Srpaulostatic void
3290251538Srpaulourtwn_init_locked(void *arg)
3291251538Srpaulo{
3292251538Srpaulo	struct urtwn_softc *sc = arg;
3293251538Srpaulo	struct ifnet *ifp = sc->sc_ifp;
3294251538Srpaulo	uint32_t reg;
3295251538Srpaulo	int error;
3296251538Srpaulo
3297264864Skevlo	URTWN_ASSERT_LOCKED(sc);
3298264864Skevlo
3299251538Srpaulo	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3300263153Skevlo		urtwn_stop_locked(ifp);
3301251538Srpaulo
3302251538Srpaulo	/* Init firmware commands ring. */
3303251538Srpaulo	sc->fwcur = 0;
3304251538Srpaulo
3305251538Srpaulo	/* Allocate Tx/Rx buffers. */
3306251538Srpaulo	error = urtwn_alloc_rx_list(sc);
3307251538Srpaulo	if (error != 0)
3308251538Srpaulo		goto fail;
3309281069Srpaulo
3310251538Srpaulo	error = urtwn_alloc_tx_list(sc);
3311251538Srpaulo	if (error != 0)
3312251538Srpaulo		goto fail;
3313251538Srpaulo
3314251538Srpaulo	/* Power on adapter. */
3315251538Srpaulo	error = urtwn_power_on(sc);
3316251538Srpaulo	if (error != 0)
3317251538Srpaulo		goto fail;
3318251538Srpaulo
3319251538Srpaulo	/* Initialize DMA. */
3320251538Srpaulo	error = urtwn_dma_init(sc);
3321251538Srpaulo	if (error != 0)
3322251538Srpaulo		goto fail;
3323251538Srpaulo
3324251538Srpaulo	/* Set info size in Rx descriptors (in 64-bit words). */
3325251538Srpaulo	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3326251538Srpaulo
3327251538Srpaulo	/* Init interrupts. */
3328264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
3329264912Skevlo		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3330264912Skevlo		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3331264912Skevlo		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3332264912Skevlo		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3333264912Skevlo		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3334264912Skevlo		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3335264912Skevlo		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3336264912Skevlo		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3337264912Skevlo	} else {
3338264912Skevlo		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3339264912Skevlo		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3340264912Skevlo	}
3341251538Srpaulo
3342251538Srpaulo	/* Set MAC address. */
3343251538Srpaulo	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
3344251538Srpaulo	    IEEE80211_ADDR_LEN);
3345251538Srpaulo
3346251538Srpaulo	/* Set initial network type. */
3347251538Srpaulo	reg = urtwn_read_4(sc, R92C_CR);
3348251538Srpaulo	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3349251538Srpaulo	urtwn_write_4(sc, R92C_CR, reg);
3350251538Srpaulo
3351251538Srpaulo	urtwn_rxfilter_init(sc);
3352251538Srpaulo
3353282623Skevlo	/* Set response rate. */
3354251538Srpaulo	reg = urtwn_read_4(sc, R92C_RRSR);
3355251538Srpaulo	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3356251538Srpaulo	urtwn_write_4(sc, R92C_RRSR, reg);
3357251538Srpaulo
3358251538Srpaulo	/* Set short/long retry limits. */
3359251538Srpaulo	urtwn_write_2(sc, R92C_RL,
3360251538Srpaulo	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3361251538Srpaulo
3362251538Srpaulo	/* Initialize EDCA parameters. */
3363251538Srpaulo	urtwn_edca_init(sc);
3364251538Srpaulo
3365251538Srpaulo	/* Setup rate fallback. */
3366264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3367264912Skevlo		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3368264912Skevlo		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3369264912Skevlo		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3370264912Skevlo		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3371264912Skevlo	}
3372251538Srpaulo
3373251538Srpaulo	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3374251538Srpaulo	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3375251538Srpaulo	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3376251538Srpaulo	/* Set ACK timeout. */
3377251538Srpaulo	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3378251538Srpaulo
3379251538Srpaulo	/* Setup USB aggregation. */
3380251538Srpaulo	reg = urtwn_read_4(sc, R92C_TDECTRL);
3381251538Srpaulo	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3382251538Srpaulo	urtwn_write_4(sc, R92C_TDECTRL, reg);
3383251538Srpaulo	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3384251538Srpaulo	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3385251538Srpaulo	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3386251538Srpaulo	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3387264912Skevlo	if (sc->chip & URTWN_CHIP_88E)
3388264912Skevlo		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3389282266Skevlo	else {
3390264912Skevlo		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3391282266Skevlo		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3392282266Skevlo		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3393282266Skevlo		    R92C_USB_SPECIAL_OPTION_AGG_EN);
3394282266Skevlo		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3395282266Skevlo		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3396282266Skevlo	}
3397251538Srpaulo
3398251538Srpaulo	/* Initialize beacon parameters. */
3399264912Skevlo	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3400251538Srpaulo	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3401251538Srpaulo	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3402251538Srpaulo	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3403251538Srpaulo	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3404251538Srpaulo
3405264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3406264912Skevlo		/* Setup AMPDU aggregation. */
3407264912Skevlo		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3408264912Skevlo		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3409264912Skevlo		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3410251538Srpaulo
3411264912Skevlo		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3412264912Skevlo	}
3413251538Srpaulo
3414251538Srpaulo	/* Load 8051 microcode. */
3415251538Srpaulo	error = urtwn_load_firmware(sc);
3416251538Srpaulo	if (error != 0)
3417251538Srpaulo		goto fail;
3418251538Srpaulo
3419251538Srpaulo	/* Initialize MAC/BB/RF blocks. */
3420251538Srpaulo	urtwn_mac_init(sc);
3421251538Srpaulo	urtwn_bb_init(sc);
3422251538Srpaulo	urtwn_rf_init(sc);
3423251538Srpaulo
3424264912Skevlo	if (sc->chip & URTWN_CHIP_88E) {
3425264912Skevlo		urtwn_write_2(sc, R92C_CR,
3426264912Skevlo		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3427264912Skevlo		    R92C_CR_MACRXEN);
3428264912Skevlo	}
3429264912Skevlo
3430251538Srpaulo	/* Turn CCK and OFDM blocks on. */
3431251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3432251538Srpaulo	reg |= R92C_RFMOD_CCK_EN;
3433251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3434251538Srpaulo	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3435251538Srpaulo	reg |= R92C_RFMOD_OFDM_EN;
3436251538Srpaulo	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3437251538Srpaulo
3438251538Srpaulo	/* Clear per-station keys table. */
3439251538Srpaulo	urtwn_cam_init(sc);
3440251538Srpaulo
3441251538Srpaulo	/* Enable hardware sequence numbering. */
3442251538Srpaulo	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3443251538Srpaulo
3444251538Srpaulo	/* Perform LO and IQ calibrations. */
3445251538Srpaulo	urtwn_iq_calib(sc);
3446251538Srpaulo	/* Perform LC calibration. */
3447251538Srpaulo	urtwn_lc_calib(sc);
3448251538Srpaulo
3449251538Srpaulo	/* Fix USB interference issue. */
3450264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E)) {
3451264912Skevlo		urtwn_write_1(sc, 0xfe40, 0xe0);
3452264912Skevlo		urtwn_write_1(sc, 0xfe41, 0x8d);
3453264912Skevlo		urtwn_write_1(sc, 0xfe42, 0x80);
3454251538Srpaulo
3455264912Skevlo		urtwn_pa_bias_init(sc);
3456264912Skevlo	}
3457251538Srpaulo
3458251538Srpaulo	/* Initialize GPIO setting. */
3459251538Srpaulo	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3460251538Srpaulo	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3461251538Srpaulo
3462251538Srpaulo	/* Fix for lower temperature. */
3463264912Skevlo	if (!(sc->chip & URTWN_CHIP_88E))
3464264912Skevlo		urtwn_write_1(sc, 0x15, 0xe9);
3465251538Srpaulo
3466251538Srpaulo	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3467251538Srpaulo
3468251538Srpaulo	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3469251538Srpaulo	ifp->if_drv_flags |= IFF_DRV_RUNNING;
3470251538Srpaulo
3471251538Srpaulo	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3472251538Srpaulofail:
3473251538Srpaulo	return;
3474251538Srpaulo}
3475251538Srpaulo
3476251538Srpaulostatic void
3477251538Srpaulourtwn_init(void *arg)
3478251538Srpaulo{
3479251538Srpaulo	struct urtwn_softc *sc = arg;
3480251538Srpaulo
3481251538Srpaulo	URTWN_LOCK(sc);
3482251538Srpaulo	urtwn_init_locked(arg);
3483251538Srpaulo	URTWN_UNLOCK(sc);
3484251538Srpaulo}
3485251538Srpaulo
3486251538Srpaulostatic void
3487263153Skevlourtwn_stop_locked(struct ifnet *ifp)
3488251538Srpaulo{
3489251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3490251538Srpaulo
3491264864Skevlo	URTWN_ASSERT_LOCKED(sc);
3492264864Skevlo
3493251538Srpaulo	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
3494251538Srpaulo
3495251538Srpaulo	callout_stop(&sc->sc_watchdog_ch);
3496251538Srpaulo	urtwn_abort_xfers(sc);
3497251538Srpaulo}
3498251538Srpaulo
3499251538Srpaulostatic void
3500263153Skevlourtwn_stop(struct ifnet *ifp)
3501251538Srpaulo{
3502251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3503251538Srpaulo
3504251538Srpaulo	URTWN_LOCK(sc);
3505263153Skevlo	urtwn_stop_locked(ifp);
3506251538Srpaulo	URTWN_UNLOCK(sc);
3507251538Srpaulo}
3508251538Srpaulo
3509251538Srpaulostatic void
3510251538Srpaulourtwn_abort_xfers(struct urtwn_softc *sc)
3511251538Srpaulo{
3512251538Srpaulo	int i;
3513251538Srpaulo
3514251538Srpaulo	URTWN_ASSERT_LOCKED(sc);
3515251538Srpaulo
3516251538Srpaulo	/* abort any pending transfers */
3517251538Srpaulo	for (i = 0; i < URTWN_N_TRANSFER; i++)
3518251538Srpaulo		usbd_transfer_stop(sc->sc_xfer[i]);
3519251538Srpaulo}
3520251538Srpaulo
3521251538Srpaulostatic int
3522251538Srpaulourtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3523251538Srpaulo    const struct ieee80211_bpf_params *params)
3524251538Srpaulo{
3525251538Srpaulo	struct ieee80211com *ic = ni->ni_ic;
3526251538Srpaulo	struct ifnet *ifp = ic->ic_ifp;
3527251538Srpaulo	struct urtwn_softc *sc = ifp->if_softc;
3528251538Srpaulo	struct urtwn_data *bf;
3529251538Srpaulo
3530251538Srpaulo	/* prevent management frames from being sent if we're not ready */
3531251538Srpaulo	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3532251538Srpaulo		m_freem(m);
3533251538Srpaulo		ieee80211_free_node(ni);
3534251538Srpaulo		return (ENETDOWN);
3535251538Srpaulo	}
3536251538Srpaulo	URTWN_LOCK(sc);
3537251538Srpaulo	bf = urtwn_getbuf(sc);
3538251538Srpaulo	if (bf == NULL) {
3539251538Srpaulo		ieee80211_free_node(ni);
3540251538Srpaulo		m_freem(m);
3541251538Srpaulo		URTWN_UNLOCK(sc);
3542251538Srpaulo		return (ENOBUFS);
3543251538Srpaulo	}
3544251538Srpaulo
3545271866Sglebius	if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
3546251538Srpaulo	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3547251538Srpaulo		ieee80211_free_node(ni);
3548271866Sglebius		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
3549251538Srpaulo		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3550251538Srpaulo		URTWN_UNLOCK(sc);
3551251538Srpaulo		return (EIO);
3552251538Srpaulo	}
3553251538Srpaulo	URTWN_UNLOCK(sc);
3554251538Srpaulo
3555251538Srpaulo	sc->sc_txtimer = 5;
3556251538Srpaulo	return (0);
3557251538Srpaulo}
3558251538Srpaulo
3559266472Shselaskystatic void
3560266472Shselaskyurtwn_ms_delay(struct urtwn_softc *sc)
3561266472Shselasky{
3562266472Shselasky	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3563266472Shselasky}
3564266472Shselasky
3565251538Srpaulostatic device_method_t urtwn_methods[] = {
3566251538Srpaulo	/* Device interface */
3567251538Srpaulo	DEVMETHOD(device_probe,		urtwn_match),
3568251538Srpaulo	DEVMETHOD(device_attach,	urtwn_attach),
3569251538Srpaulo	DEVMETHOD(device_detach,	urtwn_detach),
3570251538Srpaulo
3571264912Skevlo	DEVMETHOD_END
3572251538Srpaulo};
3573251538Srpaulo
3574251538Srpaulostatic driver_t urtwn_driver = {
3575251538Srpaulo	"urtwn",
3576251538Srpaulo	urtwn_methods,
3577251538Srpaulo	sizeof(struct urtwn_softc)
3578251538Srpaulo};
3579251538Srpaulo
3580251538Srpaulostatic devclass_t urtwn_devclass;
3581251538Srpaulo
3582251538SrpauloDRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3583251538SrpauloMODULE_DEPEND(urtwn, usb, 1, 1, 1);
3584251538SrpauloMODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3585251538SrpauloMODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3586251538SrpauloMODULE_VERSION(urtwn, 1);
3587