if_urtwn.c revision 294473
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 294473 2016-01-20 23:55:39Z avos $");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
26 */
27
28#include "opt_wlan.h"
29
30#include <sys/param.h>
31#include <sys/sockio.h>
32#include <sys/sysctl.h>
33#include <sys/lock.h>
34#include <sys/mutex.h>
35#include <sys/condvar.h>
36#include <sys/mbuf.h>
37#include <sys/kernel.h>
38#include <sys/socket.h>
39#include <sys/systm.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/bus.h>
43#include <sys/endian.h>
44#include <sys/linker.h>
45#include <sys/firmware.h>
46#include <sys/kdb.h>
47
48#include <machine/bus.h>
49#include <machine/resource.h>
50#include <sys/rman.h>
51
52#include <net/bpf.h>
53#include <net/if.h>
54#include <net/if_var.h>
55#include <net/if_arp.h>
56#include <net/ethernet.h>
57#include <net/if_dl.h>
58#include <net/if_media.h>
59#include <net/if_types.h>
60
61#include <netinet/in.h>
62#include <netinet/in_systm.h>
63#include <netinet/in_var.h>
64#include <netinet/if_ether.h>
65#include <netinet/ip.h>
66
67#include <net80211/ieee80211_var.h>
68#include <net80211/ieee80211_input.h>
69#include <net80211/ieee80211_regdomain.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_ratectl.h>
72
73#include <dev/usb/usb.h>
74#include <dev/usb/usbdi.h>
75#include <dev/usb/usb_device.h>
76#include "usbdevs.h"
77
78#include <dev/usb/usb_debug.h>
79
80#include <dev/usb/wlan/if_urtwnreg.h>
81#include <dev/usb/wlan/if_urtwnvar.h>
82
83#ifdef USB_DEBUG
84enum {
85	URTWN_DEBUG_XMIT	= 0x00000001,	/* basic xmit operation */
86	URTWN_DEBUG_RECV	= 0x00000002,	/* basic recv operation */
87	URTWN_DEBUG_STATE	= 0x00000004,	/* 802.11 state transitions */
88	URTWN_DEBUG_RA		= 0x00000008,	/* f/w rate adaptation setup */
89	URTWN_DEBUG_USB		= 0x00000010,	/* usb requests */
90	URTWN_DEBUG_FIRMWARE	= 0x00000020,	/* firmware(9) loading debug */
91	URTWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
92	URTWN_DEBUG_INTR	= 0x00000080,	/* ISR */
93	URTWN_DEBUG_TEMP	= 0x00000100,	/* temperature calibration */
94	URTWN_DEBUG_ROM		= 0x00000200,	/* various ROM info */
95	URTWN_DEBUG_KEY		= 0x00000400,	/* crypto keys management */
96	URTWN_DEBUG_TXPWR	= 0x00000800,	/* dump Tx power values */
97	URTWN_DEBUG_ANY		= 0xffffffff
98};
99
100#define URTWN_DPRINTF(_sc, _m, ...) do {			\
101	if ((_sc)->sc_debug & (_m))				\
102		device_printf((_sc)->sc_dev, __VA_ARGS__);	\
103} while(0)
104
105#else
106#define URTWN_DPRINTF(_sc, _m, ...)	do { (void) sc; } while (0)
107#endif
108
109#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
110
111/* various supported device vendors/products */
112static const STRUCT_USB_HOST_ID urtwn_devs[] = {
113#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
114#define	URTWN_RTL8188E_DEV(v,p)	\
115	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
116#define URTWN_RTL8188E  1
117	URTWN_DEV(ABOCOM,	RTL8188CU_1),
118	URTWN_DEV(ABOCOM,	RTL8188CU_2),
119	URTWN_DEV(ABOCOM,	RTL8192CU),
120	URTWN_DEV(ASUS,		RTL8192CU),
121	URTWN_DEV(ASUS,		USBN10NANO),
122	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
123	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
124	URTWN_DEV(AZUREWAVE,	RTL8188CU),
125	URTWN_DEV(BELKIN,	F7D2102),
126	URTWN_DEV(BELKIN,	RTL8188CU),
127	URTWN_DEV(BELKIN,	RTL8192CU),
128	URTWN_DEV(CHICONY,	RTL8188CUS_1),
129	URTWN_DEV(CHICONY,	RTL8188CUS_2),
130	URTWN_DEV(CHICONY,	RTL8188CUS_3),
131	URTWN_DEV(CHICONY,	RTL8188CUS_4),
132	URTWN_DEV(CHICONY,	RTL8188CUS_5),
133	URTWN_DEV(COREGA,	RTL8192CU),
134	URTWN_DEV(DLINK,	RTL8188CU),
135	URTWN_DEV(DLINK,	RTL8192CU_1),
136	URTWN_DEV(DLINK,	RTL8192CU_2),
137	URTWN_DEV(DLINK,	RTL8192CU_3),
138	URTWN_DEV(DLINK,	DWA131B),
139	URTWN_DEV(EDIMAX,	EW7811UN),
140	URTWN_DEV(EDIMAX,	RTL8192CU),
141	URTWN_DEV(FEIXUN,	RTL8188CU),
142	URTWN_DEV(FEIXUN,	RTL8192CU),
143	URTWN_DEV(GUILLEMOT,	HWNUP150),
144	URTWN_DEV(HAWKING,	RTL8192CU),
145	URTWN_DEV(HP3,		RTL8188CU),
146	URTWN_DEV(NETGEAR,	WNA1000M),
147	URTWN_DEV(NETGEAR,	RTL8192CU),
148	URTWN_DEV(NETGEAR4,	RTL8188CU),
149	URTWN_DEV(NOVATECH,	RTL8188CU),
150	URTWN_DEV(PLANEX2,	RTL8188CU_1),
151	URTWN_DEV(PLANEX2,	RTL8188CU_2),
152	URTWN_DEV(PLANEX2,	RTL8188CU_3),
153	URTWN_DEV(PLANEX2,	RTL8188CU_4),
154	URTWN_DEV(PLANEX2,	RTL8188CUS),
155	URTWN_DEV(PLANEX2,	RTL8192CU),
156	URTWN_DEV(REALTEK,	RTL8188CE_0),
157	URTWN_DEV(REALTEK,	RTL8188CE_1),
158	URTWN_DEV(REALTEK,	RTL8188CTV),
159	URTWN_DEV(REALTEK,	RTL8188CU_0),
160	URTWN_DEV(REALTEK,	RTL8188CU_1),
161	URTWN_DEV(REALTEK,	RTL8188CU_2),
162	URTWN_DEV(REALTEK,	RTL8188CU_3),
163	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
164	URTWN_DEV(REALTEK,	RTL8188CUS),
165	URTWN_DEV(REALTEK,	RTL8188RU_1),
166	URTWN_DEV(REALTEK,	RTL8188RU_2),
167	URTWN_DEV(REALTEK,	RTL8188RU_3),
168	URTWN_DEV(REALTEK,	RTL8191CU),
169	URTWN_DEV(REALTEK,	RTL8192CE),
170	URTWN_DEV(REALTEK,	RTL8192CU),
171	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
172	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
173	URTWN_DEV(SITECOMEU,	RTL8192CU),
174	URTWN_DEV(TRENDNET,	RTL8188CU),
175	URTWN_DEV(TRENDNET,	RTL8192CU),
176	URTWN_DEV(ZYXEL,	RTL8192CU),
177	/* URTWN_RTL8188E */
178	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
179	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
180	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
181	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
182	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
183#undef URTWN_RTL8188E_DEV
184#undef URTWN_DEV
185};
186
187static device_probe_t	urtwn_match;
188static device_attach_t	urtwn_attach;
189static device_detach_t	urtwn_detach;
190
191static usb_callback_t   urtwn_bulk_tx_callback;
192static usb_callback_t	urtwn_bulk_rx_callback;
193
194static void		urtwn_sysctlattach(struct urtwn_softc *);
195static void		urtwn_drain_mbufq(struct urtwn_softc *);
196static usb_error_t	urtwn_do_request(struct urtwn_softc *,
197			    struct usb_device_request *, void *);
198static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
199		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
200                    const uint8_t [IEEE80211_ADDR_LEN],
201                    const uint8_t [IEEE80211_ADDR_LEN]);
202static void		urtwn_vap_delete(struct ieee80211vap *);
203static struct mbuf *	urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
204			    struct r92c_rx_stat *, int);
205static struct mbuf *	urtwn_report_intr(struct usb_xfer *,
206			    struct urtwn_data *);
207static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
208static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
209			    void *);
210static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
211			    struct mbuf *, int8_t *);
212static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
213			    int);
214static int		urtwn_alloc_list(struct urtwn_softc *,
215			    struct urtwn_data[], int, int);
216static int		urtwn_alloc_rx_list(struct urtwn_softc *);
217static int		urtwn_alloc_tx_list(struct urtwn_softc *);
218static void		urtwn_free_list(struct urtwn_softc *,
219			    struct urtwn_data data[], int);
220static void		urtwn_free_rx_list(struct urtwn_softc *);
221static void		urtwn_free_tx_list(struct urtwn_softc *);
222static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
223static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
224static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
225			    uint8_t *, int);
226static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
227static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
228static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
229static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
230			    uint8_t *, int);
231static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
232static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
233static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
234static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
235			    const void *, int);
236static void		urtwn_cmdq_cb(void *, int);
237static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
238			    size_t, CMD_FUNC_PROTO);
239static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
240			    uint8_t, uint32_t);
241static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
242			    uint8_t, uint32_t);
243static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
244static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
245			    uint32_t);
246static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
247static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
248			    uint8_t, uint8_t);
249#ifdef USB_DEBUG
250static void		urtwn_dump_rom_contents(struct urtwn_softc *,
251			    uint8_t *, uint16_t);
252#endif
253static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
254			    uint16_t);
255static int		urtwn_efuse_switch_power(struct urtwn_softc *);
256static int		urtwn_read_chipid(struct urtwn_softc *);
257static int		urtwn_read_rom(struct urtwn_softc *);
258static int		urtwn_r88e_read_rom(struct urtwn_softc *);
259static int		urtwn_ra_init(struct urtwn_softc *);
260static void		urtwn_init_beacon(struct urtwn_softc *,
261			    struct urtwn_vap *);
262static int		urtwn_setup_beacon(struct urtwn_softc *,
263			    struct ieee80211_node *);
264static void		urtwn_update_beacon(struct ieee80211vap *, int);
265static int		urtwn_tx_beacon(struct urtwn_softc *sc,
266			    struct urtwn_vap *);
267static int		urtwn_key_alloc(struct ieee80211vap *,
268			    struct ieee80211_key *, ieee80211_keyix *,
269			    ieee80211_keyix *);
270static void		urtwn_key_set_cb(struct urtwn_softc *,
271			    union sec_param *);
272static void		urtwn_key_del_cb(struct urtwn_softc *,
273			    union sec_param *);
274static int		urtwn_key_set(struct ieee80211vap *,
275			    const struct ieee80211_key *);
276static int		urtwn_key_delete(struct ieee80211vap *,
277			    const struct ieee80211_key *);
278static void		urtwn_tsf_task_adhoc(void *, int);
279static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
280			    struct ieee80211vap *);
281static void		urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
282static void		urtwn_set_led(struct urtwn_softc *, int, int);
283static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
284static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
285			    struct mbuf *, int,
286			    const struct ieee80211_rx_stats *, int, int);
287static int		urtwn_newstate(struct ieee80211vap *,
288			    enum ieee80211_state, int);
289static void		urtwn_calib_to(void *);
290static void		urtwn_calib_cb(struct urtwn_softc *,
291			    union sec_param *);
292static void		urtwn_watchdog(void *);
293static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
294static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
295static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
296static int		urtwn_tx_data(struct urtwn_softc *,
297			    struct ieee80211_node *, struct mbuf *,
298			    struct urtwn_data *);
299static int		urtwn_tx_raw(struct urtwn_softc *,
300			    struct ieee80211_node *, struct mbuf *,
301			    struct urtwn_data *,
302			    const struct ieee80211_bpf_params *);
303static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
304			    uint8_t, struct urtwn_data *);
305static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
306static void		urtwn_start(struct urtwn_softc *);
307static void		urtwn_parent(struct ieee80211com *);
308static int		urtwn_r92c_power_on(struct urtwn_softc *);
309static int		urtwn_r88e_power_on(struct urtwn_softc *);
310static int		urtwn_llt_init(struct urtwn_softc *);
311static void		urtwn_fw_reset(struct urtwn_softc *);
312static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
313static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
314			    const uint8_t *, int);
315static int		urtwn_load_firmware(struct urtwn_softc *);
316static int		urtwn_dma_init(struct urtwn_softc *);
317static int		urtwn_mac_init(struct urtwn_softc *);
318static void		urtwn_bb_init(struct urtwn_softc *);
319static void		urtwn_rf_init(struct urtwn_softc *);
320static void		urtwn_cam_init(struct urtwn_softc *);
321static int		urtwn_cam_write(struct urtwn_softc *, uint32_t,
322			    uint32_t);
323static void		urtwn_pa_bias_init(struct urtwn_softc *);
324static void		urtwn_rxfilter_init(struct urtwn_softc *);
325static void		urtwn_edca_init(struct urtwn_softc *);
326static void		urtwn_write_txpower(struct urtwn_softc *, int,
327			    uint16_t[]);
328static void		urtwn_get_txpower(struct urtwn_softc *, int,
329		      	    struct ieee80211_channel *,
330			    struct ieee80211_channel *, uint16_t[]);
331static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
332		      	    struct ieee80211_channel *,
333			    struct ieee80211_channel *, uint16_t[]);
334static void		urtwn_set_txpower(struct urtwn_softc *,
335		    	    struct ieee80211_channel *,
336			    struct ieee80211_channel *);
337static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
338static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
339static void		urtwn_scan_start(struct ieee80211com *);
340static void		urtwn_scan_end(struct ieee80211com *);
341static void		urtwn_set_channel(struct ieee80211com *);
342static int		urtwn_wme_update(struct ieee80211com *);
343static void		urtwn_update_slot(struct ieee80211com *);
344static void		urtwn_update_slot_cb(struct urtwn_softc *,
345			    union sec_param *);
346static void		urtwn_update_aifs(struct urtwn_softc *, uint8_t);
347static void		urtwn_set_promisc(struct urtwn_softc *);
348static void		urtwn_update_promisc(struct ieee80211com *);
349static void		urtwn_update_mcast(struct ieee80211com *);
350static struct ieee80211_node *urtwn_r88e_node_alloc(struct ieee80211vap *,
351			    const uint8_t mac[IEEE80211_ADDR_LEN]);
352static void		urtwn_r88e_newassoc(struct ieee80211_node *, int);
353static void		urtwn_r88e_node_free(struct ieee80211_node *);
354static void		urtwn_set_chan(struct urtwn_softc *,
355		    	    struct ieee80211_channel *,
356			    struct ieee80211_channel *);
357static void		urtwn_iq_calib(struct urtwn_softc *);
358static void		urtwn_lc_calib(struct urtwn_softc *);
359static void		urtwn_temp_calib(struct urtwn_softc *);
360static int		urtwn_init(struct urtwn_softc *);
361static void		urtwn_stop(struct urtwn_softc *);
362static void		urtwn_abort_xfers(struct urtwn_softc *);
363static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
364			    const struct ieee80211_bpf_params *);
365static void		urtwn_ms_delay(struct urtwn_softc *);
366
367/* Aliases. */
368#define	urtwn_bb_write	urtwn_write_4
369#define urtwn_bb_read	urtwn_read_4
370
371static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
372	[URTWN_BULK_RX] = {
373		.type = UE_BULK,
374		.endpoint = UE_ADDR_ANY,
375		.direction = UE_DIR_IN,
376		.bufsize = URTWN_RXBUFSZ,
377		.flags = {
378			.pipe_bof = 1,
379			.short_xfer_ok = 1
380		},
381		.callback = urtwn_bulk_rx_callback,
382	},
383	[URTWN_BULK_TX_BE] = {
384		.type = UE_BULK,
385		.endpoint = 0x03,
386		.direction = UE_DIR_OUT,
387		.bufsize = URTWN_TXBUFSZ,
388		.flags = {
389			.ext_buffer = 1,
390			.pipe_bof = 1,
391			.force_short_xfer = 1
392		},
393		.callback = urtwn_bulk_tx_callback,
394		.timeout = URTWN_TX_TIMEOUT,	/* ms */
395	},
396	[URTWN_BULK_TX_BK] = {
397		.type = UE_BULK,
398		.endpoint = 0x03,
399		.direction = UE_DIR_OUT,
400		.bufsize = URTWN_TXBUFSZ,
401		.flags = {
402			.ext_buffer = 1,
403			.pipe_bof = 1,
404			.force_short_xfer = 1,
405		},
406		.callback = urtwn_bulk_tx_callback,
407		.timeout = URTWN_TX_TIMEOUT,	/* ms */
408	},
409	[URTWN_BULK_TX_VI] = {
410		.type = UE_BULK,
411		.endpoint = 0x02,
412		.direction = UE_DIR_OUT,
413		.bufsize = URTWN_TXBUFSZ,
414		.flags = {
415			.ext_buffer = 1,
416			.pipe_bof = 1,
417			.force_short_xfer = 1
418		},
419		.callback = urtwn_bulk_tx_callback,
420		.timeout = URTWN_TX_TIMEOUT,	/* ms */
421	},
422	[URTWN_BULK_TX_VO] = {
423		.type = UE_BULK,
424		.endpoint = 0x02,
425		.direction = UE_DIR_OUT,
426		.bufsize = URTWN_TXBUFSZ,
427		.flags = {
428			.ext_buffer = 1,
429			.pipe_bof = 1,
430			.force_short_xfer = 1
431		},
432		.callback = urtwn_bulk_tx_callback,
433		.timeout = URTWN_TX_TIMEOUT,	/* ms */
434	},
435};
436
437static const struct wme_to_queue {
438	uint16_t reg;
439	uint8_t qid;
440} wme2queue[WME_NUM_AC] = {
441	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
442	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
443	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
444	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
445};
446
447static int
448urtwn_match(device_t self)
449{
450	struct usb_attach_arg *uaa = device_get_ivars(self);
451
452	if (uaa->usb_mode != USB_MODE_HOST)
453		return (ENXIO);
454	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
455		return (ENXIO);
456	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
457		return (ENXIO);
458
459	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
460}
461
462static int
463urtwn_attach(device_t self)
464{
465	struct usb_attach_arg *uaa = device_get_ivars(self);
466	struct urtwn_softc *sc = device_get_softc(self);
467	struct ieee80211com *ic = &sc->sc_ic;
468	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
469	int error;
470
471	device_set_usb_desc(self);
472	sc->sc_udev = uaa->device;
473	sc->sc_dev = self;
474	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
475		sc->chip |= URTWN_CHIP_88E;
476
477#ifdef USB_DEBUG
478	int debug;
479	if (resource_int_value(device_get_name(sc->sc_dev),
480	    device_get_unit(sc->sc_dev), "debug", &debug) == 0)
481		sc->sc_debug = debug;
482#endif
483
484	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
485	    MTX_NETWORK_LOCK, MTX_DEF);
486	URTWN_CMDQ_LOCK_INIT(sc);
487	URTWN_NT_LOCK_INIT(sc);
488	callout_init(&sc->sc_calib_to, 0);
489	callout_init(&sc->sc_watchdog_ch, 0);
490	mbufq_init(&sc->sc_snd, ifqmaxlen);
491
492	sc->sc_iface_index = URTWN_IFACE_INDEX;
493	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
494	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
495	if (error) {
496		device_printf(self, "could not allocate USB transfers, "
497		    "err=%s\n", usbd_errstr(error));
498		goto detach;
499	}
500
501	URTWN_LOCK(sc);
502
503	error = urtwn_read_chipid(sc);
504	if (error) {
505		device_printf(sc->sc_dev, "unsupported test chip\n");
506		URTWN_UNLOCK(sc);
507		goto detach;
508	}
509
510	/* Determine number of Tx/Rx chains. */
511	if (sc->chip & URTWN_CHIP_92C) {
512		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
513		sc->nrxchains = 2;
514	} else {
515		sc->ntxchains = 1;
516		sc->nrxchains = 1;
517	}
518
519	if (sc->chip & URTWN_CHIP_88E)
520		error = urtwn_r88e_read_rom(sc);
521	else
522		error = urtwn_read_rom(sc);
523	if (error != 0) {
524		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
525		    __func__, error);
526		URTWN_UNLOCK(sc);
527		goto detach;
528	}
529
530	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
531	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
532	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
533	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
534	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
535	    "8188CUS", sc->ntxchains, sc->nrxchains);
536
537	URTWN_UNLOCK(sc);
538
539	ic->ic_softc = sc;
540	ic->ic_name = device_get_nameunit(self);
541	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
542	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
543
544	/* set device capabilities */
545	ic->ic_caps =
546		  IEEE80211_C_STA		/* station mode */
547		| IEEE80211_C_MONITOR		/* monitor mode */
548		| IEEE80211_C_IBSS		/* adhoc mode */
549		| IEEE80211_C_HOSTAP		/* hostap mode */
550		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
551		| IEEE80211_C_SHSLOT		/* short slot time supported */
552		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
553		| IEEE80211_C_WPA		/* 802.11i */
554		| IEEE80211_C_WME		/* 802.11e */
555		;
556
557	ic->ic_cryptocaps =
558	    IEEE80211_CRYPTO_WEP |
559	    IEEE80211_CRYPTO_TKIP |
560	    IEEE80211_CRYPTO_AES_CCM;
561
562	memset(bands, 0, sizeof(bands));
563	setbit(bands, IEEE80211_MODE_11B);
564	setbit(bands, IEEE80211_MODE_11G);
565	ieee80211_init_channels(ic, NULL, bands);
566
567	ieee80211_ifattach(ic);
568	ic->ic_raw_xmit = urtwn_raw_xmit;
569	ic->ic_scan_start = urtwn_scan_start;
570	ic->ic_scan_end = urtwn_scan_end;
571	ic->ic_set_channel = urtwn_set_channel;
572	ic->ic_transmit = urtwn_transmit;
573	ic->ic_parent = urtwn_parent;
574	ic->ic_vap_create = urtwn_vap_create;
575	ic->ic_vap_delete = urtwn_vap_delete;
576	ic->ic_wme.wme_update = urtwn_wme_update;
577	ic->ic_updateslot = urtwn_update_slot;
578	ic->ic_update_promisc = urtwn_update_promisc;
579	ic->ic_update_mcast = urtwn_update_mcast;
580	if (sc->chip & URTWN_CHIP_88E) {
581		ic->ic_node_alloc = urtwn_r88e_node_alloc;
582		ic->ic_newassoc = urtwn_r88e_newassoc;
583		sc->sc_node_free = ic->ic_node_free;
584		ic->ic_node_free = urtwn_r88e_node_free;
585	}
586
587	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
588	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
589	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
590	    URTWN_RX_RADIOTAP_PRESENT);
591
592	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
593
594	urtwn_sysctlattach(sc);
595
596	if (bootverbose)
597		ieee80211_announce(ic);
598
599	return (0);
600
601detach:
602	urtwn_detach(self);
603	return (ENXIO);			/* failure */
604}
605
606static void
607urtwn_sysctlattach(struct urtwn_softc *sc)
608{
609#ifdef USB_DEBUG
610	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
611	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
612
613	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
614	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
615	    "control debugging printfs");
616#endif
617}
618
619static int
620urtwn_detach(device_t self)
621{
622	struct urtwn_softc *sc = device_get_softc(self);
623	struct ieee80211com *ic = &sc->sc_ic;
624	unsigned int x;
625
626	/* Prevent further ioctls. */
627	URTWN_LOCK(sc);
628	sc->sc_flags |= URTWN_DETACHED;
629	URTWN_UNLOCK(sc);
630
631	urtwn_stop(sc);
632
633	callout_drain(&sc->sc_watchdog_ch);
634	callout_drain(&sc->sc_calib_to);
635
636	/* stop all USB transfers */
637	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
638
639	/* Prevent further allocations from RX/TX data lists. */
640	URTWN_LOCK(sc);
641	STAILQ_INIT(&sc->sc_tx_active);
642	STAILQ_INIT(&sc->sc_tx_inactive);
643	STAILQ_INIT(&sc->sc_tx_pending);
644
645	STAILQ_INIT(&sc->sc_rx_active);
646	STAILQ_INIT(&sc->sc_rx_inactive);
647	URTWN_UNLOCK(sc);
648
649	/* drain USB transfers */
650	for (x = 0; x != URTWN_N_TRANSFER; x++)
651		usbd_transfer_drain(sc->sc_xfer[x]);
652
653	/* Free data buffers. */
654	URTWN_LOCK(sc);
655	urtwn_free_tx_list(sc);
656	urtwn_free_rx_list(sc);
657	URTWN_UNLOCK(sc);
658
659	if (ic->ic_softc == sc) {
660		ieee80211_draintask(ic, &sc->cmdq_task);
661		ieee80211_ifdetach(ic);
662	}
663
664	URTWN_NT_LOCK_DESTROY(sc);
665	URTWN_CMDQ_LOCK_DESTROY(sc);
666	mtx_destroy(&sc->sc_mtx);
667
668	return (0);
669}
670
671static void
672urtwn_drain_mbufq(struct urtwn_softc *sc)
673{
674	struct mbuf *m;
675	struct ieee80211_node *ni;
676	URTWN_ASSERT_LOCKED(sc);
677	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
678		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
679		m->m_pkthdr.rcvif = NULL;
680		ieee80211_free_node(ni);
681		m_freem(m);
682	}
683}
684
685static usb_error_t
686urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
687    void *data)
688{
689	usb_error_t err;
690	int ntries = 10;
691
692	URTWN_ASSERT_LOCKED(sc);
693
694	while (ntries--) {
695		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
696		    req, data, 0, NULL, 250 /* ms */);
697		if (err == 0)
698			break;
699
700		URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
701		    "%s: control request failed, %s (retries left: %d)\n",
702		    __func__, usbd_errstr(err), ntries);
703		usb_pause_mtx(&sc->sc_mtx, hz / 100);
704	}
705	return (err);
706}
707
708static struct ieee80211vap *
709urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
710    enum ieee80211_opmode opmode, int flags,
711    const uint8_t bssid[IEEE80211_ADDR_LEN],
712    const uint8_t mac[IEEE80211_ADDR_LEN])
713{
714	struct urtwn_softc *sc = ic->ic_softc;
715	struct urtwn_vap *uvp;
716	struct ieee80211vap *vap;
717
718	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
719		return (NULL);
720
721	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
722	vap = &uvp->vap;
723	/* enable s/w bmiss handling for sta mode */
724
725	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
726	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
727		/* out of memory */
728		free(uvp, M_80211_VAP);
729		return (NULL);
730	}
731
732	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
733		urtwn_init_beacon(sc, uvp);
734
735	/* override state transition machine */
736	uvp->newstate = vap->iv_newstate;
737	vap->iv_newstate = urtwn_newstate;
738	vap->iv_update_beacon = urtwn_update_beacon;
739	vap->iv_key_alloc = urtwn_key_alloc;
740	vap->iv_key_set = urtwn_key_set;
741	vap->iv_key_delete = urtwn_key_delete;
742	if (opmode == IEEE80211_M_IBSS) {
743		uvp->recv_mgmt = vap->iv_recv_mgmt;
744		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
745		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
746	}
747
748	if (URTWN_CHIP_HAS_RATECTL(sc))
749		ieee80211_ratectl_init(vap);
750	/* complete setup */
751	ieee80211_vap_attach(vap, ieee80211_media_change,
752	    ieee80211_media_status, mac);
753	ic->ic_opmode = opmode;
754	return (vap);
755}
756
757static void
758urtwn_vap_delete(struct ieee80211vap *vap)
759{
760	struct ieee80211com *ic = vap->iv_ic;
761	struct urtwn_softc *sc = ic->ic_softc;
762	struct urtwn_vap *uvp = URTWN_VAP(vap);
763
764	if (uvp->bcn_mbuf != NULL)
765		m_freem(uvp->bcn_mbuf);
766	if (vap->iv_opmode == IEEE80211_M_IBSS)
767		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
768	if (URTWN_CHIP_HAS_RATECTL(sc))
769		ieee80211_ratectl_deinit(vap);
770	ieee80211_vap_detach(vap);
771	free(uvp, M_80211_VAP);
772}
773
774static struct mbuf *
775urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
776    int totlen)
777{
778	struct ieee80211com *ic = &sc->sc_ic;
779	struct mbuf *m;
780	uint32_t rxdw0;
781	int pktlen;
782
783	/*
784	 * don't pass packets to the ieee80211 framework if the driver isn't
785	 * RUNNING.
786	 */
787	if (!(sc->sc_flags & URTWN_RUNNING))
788		return (NULL);
789
790	rxdw0 = le32toh(stat->rxdw0);
791	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
792		/*
793		 * This should not happen since we setup our Rx filter
794		 * to not receive these frames.
795		 */
796		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
797		    "%s: RX flags error (%s)\n", __func__,
798		    rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
799		goto fail;
800	}
801
802	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
803	if (pktlen < sizeof(struct ieee80211_frame_ack)) {
804		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
805		    "%s: frame is too short: %d\n", __func__, pktlen);
806		goto fail;
807	}
808
809	if (__predict_false(totlen > MCLBYTES)) {
810		/* convert to m_getjcl if this happens */
811		device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
812		    __func__, pktlen, totlen);
813		goto fail;
814	}
815
816	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
817	if (__predict_false(m == NULL)) {
818		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
819		    __func__);
820		goto fail;
821	}
822
823	/* Finalize mbuf. */
824	memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
825	m->m_pkthdr.len = m->m_len = totlen;
826
827	return (m);
828fail:
829	counter_u64_add(ic->ic_ierrors, 1);
830	return (NULL);
831}
832
833static struct mbuf *
834urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
835{
836	struct urtwn_softc *sc = data->sc;
837	struct ieee80211com *ic = &sc->sc_ic;
838	struct r92c_rx_stat *stat;
839	uint8_t *buf;
840	int len;
841
842	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
843
844	if (len < sizeof(*stat)) {
845		counter_u64_add(ic->ic_ierrors, 1);
846		return (NULL);
847	}
848
849	buf = data->buf;
850	stat = (struct r92c_rx_stat *)buf;
851
852	if (sc->chip & URTWN_CHIP_88E) {
853		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
854
855		switch (report_sel) {
856		case R88E_RXDW3_RPT_RX:
857			return (urtwn_rxeof(sc, buf, len));
858		case R88E_RXDW3_RPT_TX1:
859			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
860			break;
861		default:
862			URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
863			    "%s: case %d was not handled\n", __func__,
864			    report_sel);
865			break;
866		}
867	} else
868		return (urtwn_rxeof(sc, buf, len));
869
870	return (NULL);
871}
872
873static struct mbuf *
874urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
875{
876	struct r92c_rx_stat *stat;
877	struct mbuf *m, *m0 = NULL, *prevm = NULL;
878	uint32_t rxdw0;
879	int totlen, pktlen, infosz, npkts;
880
881	/* Get the number of encapsulated frames. */
882	stat = (struct r92c_rx_stat *)buf;
883	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
884	URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
885	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
886
887	/* Process all of them. */
888	while (npkts-- > 0) {
889		if (len < sizeof(*stat))
890			break;
891		stat = (struct r92c_rx_stat *)buf;
892		rxdw0 = le32toh(stat->rxdw0);
893
894		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
895		if (pktlen == 0)
896			break;
897
898		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
899
900		/* Make sure everything fits in xfer. */
901		totlen = sizeof(*stat) + infosz + pktlen;
902		if (totlen > len)
903			break;
904
905		m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
906		if (m0 == NULL)
907			m0 = m;
908		if (prevm == NULL)
909			prevm = m;
910		else {
911			prevm->m_next = m;
912			prevm = m;
913		}
914
915		/* Next chunk is 128-byte aligned. */
916		totlen = (totlen + 127) & ~127;
917		buf += totlen;
918		len -= totlen;
919	}
920
921	return (m0);
922}
923
924static void
925urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
926{
927	struct r88e_tx_rpt_ccx *rpt = arg;
928	struct ieee80211vap *vap;
929	struct ieee80211_node *ni;
930	uint8_t macid;
931	int ntries;
932
933	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
934	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
935
936	URTWN_NT_LOCK(sc);
937	ni = sc->node_list[macid];
938	if (ni != NULL) {
939		vap = ni->ni_vap;
940		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
941		    "%s sent (%d retries)\n", __func__, macid,
942		    (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
943		    ntries);
944
945		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
946			ieee80211_ratectl_tx_complete(vap, ni,
947			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
948		} else {
949			ieee80211_ratectl_tx_complete(vap, ni,
950			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
951		}
952	} else {
953		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
954		    __func__, macid);
955	}
956	URTWN_NT_UNLOCK(sc);
957}
958
959static struct ieee80211_node *
960urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
961{
962	struct ieee80211com *ic = &sc->sc_ic;
963	struct ieee80211_frame_min *wh;
964	struct r92c_rx_stat *stat;
965	uint32_t rxdw0, rxdw3;
966	uint8_t rate, cipher;
967	int8_t rssi = URTWN_NOISE_FLOOR + 1;
968	int infosz;
969
970	stat = mtod(m, struct r92c_rx_stat *);
971	rxdw0 = le32toh(stat->rxdw0);
972	rxdw3 = le32toh(stat->rxdw3);
973
974	rate = MS(rxdw3, R92C_RXDW3_RATE);
975	cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
976	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
977
978	/* Get RSSI from PHY status descriptor if present. */
979	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
980		if (sc->chip & URTWN_CHIP_88E)
981			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
982		else
983			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
984		/* Update our average RSSI. */
985		urtwn_update_avgrssi(sc, rate, rssi);
986	}
987
988	if (ieee80211_radiotap_active(ic)) {
989		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
990
991		tap->wr_flags = 0;
992
993		urtwn_get_tsf(sc, &tap->wr_tsft);
994		if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
995				    le32toh(stat->rxdw5))) {
996			tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
997			tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
998		} else
999			tap->wr_tsft &= 0xffffffff00000000;
1000		tap->wr_tsft += stat->rxdw5;
1001
1002		/* Map HW rate index to 802.11 rate. */
1003		if (!(rxdw3 & R92C_RXDW3_HT)) {
1004			tap->wr_rate = ridx2rate[rate];
1005		} else if (rate >= 12) {	/* MCS0~15. */
1006			/* Bit 7 set means HT MCS instead of rate. */
1007			tap->wr_rate = 0x80 | (rate - 12);
1008		}
1009		tap->wr_dbm_antsignal = rssi;
1010		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1011	}
1012
1013	*rssi_p = rssi;
1014
1015	/* Drop descriptor. */
1016	m_adj(m, sizeof(*stat) + infosz);
1017	wh = mtod(m, struct ieee80211_frame_min *);
1018
1019	if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1020	    cipher != R92C_CAM_ALGO_NONE) {
1021		m->m_flags |= M_WEP;
1022	}
1023
1024	if (m->m_len >= sizeof(*wh))
1025		return (ieee80211_find_rxnode(ic, wh));
1026
1027	return (NULL);
1028}
1029
1030static void
1031urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1032{
1033	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1034	struct ieee80211com *ic = &sc->sc_ic;
1035	struct ieee80211_node *ni;
1036	struct mbuf *m = NULL, *next;
1037	struct urtwn_data *data;
1038	int8_t nf, rssi;
1039
1040	URTWN_ASSERT_LOCKED(sc);
1041
1042	switch (USB_GET_STATE(xfer)) {
1043	case USB_ST_TRANSFERRED:
1044		data = STAILQ_FIRST(&sc->sc_rx_active);
1045		if (data == NULL)
1046			goto tr_setup;
1047		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1048		m = urtwn_report_intr(xfer, data);
1049		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1050		/* FALLTHROUGH */
1051	case USB_ST_SETUP:
1052tr_setup:
1053		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1054		if (data == NULL) {
1055			KASSERT(m == NULL, ("mbuf isn't NULL"));
1056			return;
1057		}
1058		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1059		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1060		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1061		    usbd_xfer_max_len(xfer));
1062		usbd_transfer_submit(xfer);
1063
1064		/*
1065		 * To avoid LOR we should unlock our private mutex here to call
1066		 * ieee80211_input() because here is at the end of a USB
1067		 * callback and safe to unlock.
1068		 */
1069		while (m != NULL) {
1070			next = m->m_next;
1071			m->m_next = NULL;
1072
1073			ni = urtwn_rx_frame(sc, m, &rssi);
1074			URTWN_UNLOCK(sc);
1075
1076			nf = URTWN_NOISE_FLOOR;
1077			if (ni != NULL) {
1078				(void)ieee80211_input(ni, m, rssi - nf, nf);
1079				ieee80211_free_node(ni);
1080			} else {
1081				(void)ieee80211_input_all(ic, m, rssi - nf,
1082				    nf);
1083			}
1084
1085			URTWN_LOCK(sc);
1086			m = next;
1087		}
1088		break;
1089	default:
1090		/* needs it to the inactive queue due to a error. */
1091		data = STAILQ_FIRST(&sc->sc_rx_active);
1092		if (data != NULL) {
1093			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1094			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1095		}
1096		if (error != USB_ERR_CANCELLED) {
1097			usbd_xfer_set_stall(xfer);
1098			counter_u64_add(ic->ic_ierrors, 1);
1099			goto tr_setup;
1100		}
1101		break;
1102	}
1103}
1104
1105static void
1106urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1107{
1108
1109	URTWN_ASSERT_LOCKED(sc);
1110
1111	if (data->ni != NULL)	/* not a beacon frame */
1112		ieee80211_tx_complete(data->ni, data->m, status);
1113
1114	data->ni = NULL;
1115	data->m = NULL;
1116
1117	sc->sc_txtimer = 0;
1118
1119	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1120}
1121
1122static int
1123urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1124    int ndata, int maxsz)
1125{
1126	int i, error;
1127
1128	for (i = 0; i < ndata; i++) {
1129		struct urtwn_data *dp = &data[i];
1130		dp->sc = sc;
1131		dp->m = NULL;
1132		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1133		if (dp->buf == NULL) {
1134			device_printf(sc->sc_dev,
1135			    "could not allocate buffer\n");
1136			error = ENOMEM;
1137			goto fail;
1138		}
1139		dp->ni = NULL;
1140	}
1141
1142	return (0);
1143fail:
1144	urtwn_free_list(sc, data, ndata);
1145	return (error);
1146}
1147
1148static int
1149urtwn_alloc_rx_list(struct urtwn_softc *sc)
1150{
1151        int error, i;
1152
1153	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1154	    URTWN_RXBUFSZ);
1155	if (error != 0)
1156		return (error);
1157
1158	STAILQ_INIT(&sc->sc_rx_active);
1159	STAILQ_INIT(&sc->sc_rx_inactive);
1160
1161	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1162		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1163
1164	return (0);
1165}
1166
1167static int
1168urtwn_alloc_tx_list(struct urtwn_softc *sc)
1169{
1170	int error, i;
1171
1172	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1173	    URTWN_TXBUFSZ);
1174	if (error != 0)
1175		return (error);
1176
1177	STAILQ_INIT(&sc->sc_tx_active);
1178	STAILQ_INIT(&sc->sc_tx_inactive);
1179	STAILQ_INIT(&sc->sc_tx_pending);
1180
1181	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1182		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1183
1184	return (0);
1185}
1186
1187static void
1188urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1189{
1190	int i;
1191
1192	for (i = 0; i < ndata; i++) {
1193		struct urtwn_data *dp = &data[i];
1194
1195		if (dp->buf != NULL) {
1196			free(dp->buf, M_USBDEV);
1197			dp->buf = NULL;
1198		}
1199		if (dp->ni != NULL) {
1200			ieee80211_free_node(dp->ni);
1201			dp->ni = NULL;
1202		}
1203	}
1204}
1205
1206static void
1207urtwn_free_rx_list(struct urtwn_softc *sc)
1208{
1209	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1210}
1211
1212static void
1213urtwn_free_tx_list(struct urtwn_softc *sc)
1214{
1215	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1216}
1217
1218static void
1219urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1220{
1221	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1222	struct urtwn_data *data;
1223
1224	URTWN_ASSERT_LOCKED(sc);
1225
1226	switch (USB_GET_STATE(xfer)){
1227	case USB_ST_TRANSFERRED:
1228		data = STAILQ_FIRST(&sc->sc_tx_active);
1229		if (data == NULL)
1230			goto tr_setup;
1231		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1232		urtwn_txeof(sc, data, 0);
1233		/* FALLTHROUGH */
1234	case USB_ST_SETUP:
1235tr_setup:
1236		data = STAILQ_FIRST(&sc->sc_tx_pending);
1237		if (data == NULL) {
1238			URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1239			    "%s: empty pending queue\n", __func__);
1240			goto finish;
1241		}
1242		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1243		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1244		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1245		usbd_transfer_submit(xfer);
1246		break;
1247	default:
1248		data = STAILQ_FIRST(&sc->sc_tx_active);
1249		if (data == NULL)
1250			goto tr_setup;
1251		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1252		urtwn_txeof(sc, data, 1);
1253		if (error != USB_ERR_CANCELLED) {
1254			usbd_xfer_set_stall(xfer);
1255			goto tr_setup;
1256		}
1257		break;
1258	}
1259finish:
1260	/* Kick-start more transmit */
1261	urtwn_start(sc);
1262}
1263
1264static struct urtwn_data *
1265_urtwn_getbuf(struct urtwn_softc *sc)
1266{
1267	struct urtwn_data *bf;
1268
1269	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1270	if (bf != NULL)
1271		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1272	else {
1273		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1274		    "%s: out of xmit buffers\n", __func__);
1275	}
1276	return (bf);
1277}
1278
1279static struct urtwn_data *
1280urtwn_getbuf(struct urtwn_softc *sc)
1281{
1282        struct urtwn_data *bf;
1283
1284	URTWN_ASSERT_LOCKED(sc);
1285
1286	bf = _urtwn_getbuf(sc);
1287	if (bf == NULL) {
1288		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1289		    __func__);
1290	}
1291	return (bf);
1292}
1293
1294static usb_error_t
1295urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1296    int len)
1297{
1298	usb_device_request_t req;
1299
1300	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1301	req.bRequest = R92C_REQ_REGS;
1302	USETW(req.wValue, addr);
1303	USETW(req.wIndex, 0);
1304	USETW(req.wLength, len);
1305	return (urtwn_do_request(sc, &req, buf));
1306}
1307
1308static usb_error_t
1309urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1310{
1311	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1312}
1313
1314static usb_error_t
1315urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1316{
1317	val = htole16(val);
1318	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1319}
1320
1321static usb_error_t
1322urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1323{
1324	val = htole32(val);
1325	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1326}
1327
1328static usb_error_t
1329urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1330    int len)
1331{
1332	usb_device_request_t req;
1333
1334	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1335	req.bRequest = R92C_REQ_REGS;
1336	USETW(req.wValue, addr);
1337	USETW(req.wIndex, 0);
1338	USETW(req.wLength, len);
1339	return (urtwn_do_request(sc, &req, buf));
1340}
1341
1342static uint8_t
1343urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1344{
1345	uint8_t val;
1346
1347	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1348		return (0xff);
1349	return (val);
1350}
1351
1352static uint16_t
1353urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1354{
1355	uint16_t val;
1356
1357	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1358		return (0xffff);
1359	return (le16toh(val));
1360}
1361
1362static uint32_t
1363urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1364{
1365	uint32_t val;
1366
1367	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1368		return (0xffffffff);
1369	return (le32toh(val));
1370}
1371
1372static int
1373urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1374{
1375	struct r92c_fw_cmd cmd;
1376	usb_error_t error;
1377	int ntries;
1378
1379	/* Wait for current FW box to be empty. */
1380	for (ntries = 0; ntries < 100; ntries++) {
1381		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1382			break;
1383		urtwn_ms_delay(sc);
1384	}
1385	if (ntries == 100) {
1386		device_printf(sc->sc_dev,
1387		    "could not send firmware command\n");
1388		return (ETIMEDOUT);
1389	}
1390	memset(&cmd, 0, sizeof(cmd));
1391	cmd.id = id;
1392	if (len > 3)
1393		cmd.id |= R92C_CMD_FLAG_EXT;
1394	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1395	memcpy(cmd.msg, buf, len);
1396
1397	/* Write the first word last since that will trigger the FW. */
1398	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1399	    (uint8_t *)&cmd + 4, 2);
1400	if (error != USB_ERR_NORMAL_COMPLETION)
1401		return (EIO);
1402	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1403	    (uint8_t *)&cmd + 0, 4);
1404	if (error != USB_ERR_NORMAL_COMPLETION)
1405		return (EIO);
1406
1407	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1408	return (0);
1409}
1410
1411static void
1412urtwn_cmdq_cb(void *arg, int pending)
1413{
1414	struct urtwn_softc *sc = arg;
1415	struct urtwn_cmdq *item;
1416
1417	/*
1418	 * Device must be powered on (via urtwn_power_on())
1419	 * before any command may be sent.
1420	 */
1421	URTWN_LOCK(sc);
1422	if (!(sc->sc_flags & URTWN_RUNNING)) {
1423		URTWN_UNLOCK(sc);
1424		return;
1425	}
1426
1427	URTWN_CMDQ_LOCK(sc);
1428	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1429		item = &sc->cmdq[sc->cmdq_first];
1430		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1431		URTWN_CMDQ_UNLOCK(sc);
1432
1433		item->func(sc, &item->data);
1434
1435		URTWN_CMDQ_LOCK(sc);
1436		memset(item, 0, sizeof (*item));
1437	}
1438	URTWN_CMDQ_UNLOCK(sc);
1439	URTWN_UNLOCK(sc);
1440}
1441
1442static int
1443urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1444    CMD_FUNC_PROTO)
1445{
1446	struct ieee80211com *ic = &sc->sc_ic;
1447
1448	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1449
1450	URTWN_CMDQ_LOCK(sc);
1451	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1452		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1453		URTWN_CMDQ_UNLOCK(sc);
1454
1455		return (EAGAIN);
1456	}
1457
1458	if (ptr != NULL)
1459		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1460	sc->cmdq[sc->cmdq_last].func = func;
1461	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1462	URTWN_CMDQ_UNLOCK(sc);
1463
1464	ieee80211_runtask(ic, &sc->cmdq_task);
1465
1466	return (0);
1467}
1468
1469static __inline void
1470urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1471{
1472
1473	sc->sc_rf_write(sc, chain, addr, val);
1474}
1475
1476static void
1477urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1478    uint32_t val)
1479{
1480	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1481	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1482	    SM(R92C_LSSI_PARAM_DATA, val));
1483}
1484
1485static void
1486urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1487uint32_t val)
1488{
1489	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1490	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1491	    SM(R92C_LSSI_PARAM_DATA, val));
1492}
1493
1494static uint32_t
1495urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1496{
1497	uint32_t reg[R92C_MAX_CHAINS], val;
1498
1499	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1500	if (chain != 0)
1501		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1502
1503	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1504	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1505	urtwn_ms_delay(sc);
1506
1507	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1508	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1509	    R92C_HSSI_PARAM2_READ_EDGE);
1510	urtwn_ms_delay(sc);
1511
1512	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1513	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1514	urtwn_ms_delay(sc);
1515
1516	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1517		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1518	else
1519		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1520	return (MS(val, R92C_LSSI_READBACK_DATA));
1521}
1522
1523static int
1524urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1525{
1526	usb_error_t error;
1527	int ntries;
1528
1529	error = urtwn_write_4(sc, R92C_LLT_INIT,
1530	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1531	    SM(R92C_LLT_INIT_ADDR, addr) |
1532	    SM(R92C_LLT_INIT_DATA, data));
1533	if (error != USB_ERR_NORMAL_COMPLETION)
1534		return (EIO);
1535	/* Wait for write operation to complete. */
1536	for (ntries = 0; ntries < 20; ntries++) {
1537		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1538		    R92C_LLT_INIT_OP_NO_ACTIVE)
1539			return (0);
1540		urtwn_ms_delay(sc);
1541	}
1542	return (ETIMEDOUT);
1543}
1544
1545static int
1546urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1547{
1548	uint32_t reg;
1549	usb_error_t error;
1550	int ntries;
1551
1552	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1553		return (EFAULT);
1554
1555	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1556	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1557	reg &= ~R92C_EFUSE_CTRL_VALID;
1558
1559	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1560	if (error != USB_ERR_NORMAL_COMPLETION)
1561		return (EIO);
1562	/* Wait for read operation to complete. */
1563	for (ntries = 0; ntries < 100; ntries++) {
1564		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1565		if (reg & R92C_EFUSE_CTRL_VALID)
1566			break;
1567		urtwn_ms_delay(sc);
1568	}
1569	if (ntries == 100) {
1570		device_printf(sc->sc_dev,
1571		    "could not read efuse byte at address 0x%x\n",
1572		    sc->last_rom_addr);
1573		return (ETIMEDOUT);
1574	}
1575
1576	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1577	sc->last_rom_addr++;
1578
1579	return (0);
1580}
1581
1582static int
1583urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1584    uint8_t msk)
1585{
1586	uint8_t reg;
1587	int i, error;
1588
1589	for (i = 0; i < 4; i++) {
1590		if (msk & (1 << i))
1591			continue;
1592		error = urtwn_efuse_read_next(sc, &reg);
1593		if (error != 0)
1594			return (error);
1595		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1596		    off * 8 + i * 2, reg);
1597		rom[off * 8 + i * 2 + 0] = reg;
1598
1599		error = urtwn_efuse_read_next(sc, &reg);
1600		if (error != 0)
1601			return (error);
1602		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1603		    off * 8 + i * 2 + 1, reg);
1604		rom[off * 8 + i * 2 + 1] = reg;
1605	}
1606
1607	return (0);
1608}
1609
1610#ifdef USB_DEBUG
1611static void
1612urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1613{
1614	int i;
1615
1616	/* Dump ROM contents. */
1617	device_printf(sc->sc_dev, "%s:", __func__);
1618	for (i = 0; i < size; i++) {
1619		if (i % 32 == 0)
1620			printf("\n%03X: ", i);
1621		else if (i % 4 == 0)
1622			printf(" ");
1623
1624		printf("%02X", rom[i]);
1625	}
1626	printf("\n");
1627}
1628#endif
1629
1630static int
1631urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1632{
1633#define URTWN_CHK(res) do {	\
1634	if ((error = res) != 0)	\
1635		goto end;	\
1636} while(0)
1637	uint8_t msk, off, reg;
1638	int error;
1639
1640	URTWN_CHK(urtwn_efuse_switch_power(sc));
1641
1642	/* Read full ROM image. */
1643	sc->last_rom_addr = 0;
1644	memset(rom, 0xff, size);
1645
1646	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1647	while (reg != 0xff) {
1648		/* check for extended header */
1649		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1650			off = reg >> 5;
1651			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1652
1653			if ((reg & 0x0f) != 0x0f)
1654				off = ((reg & 0xf0) >> 1) | off;
1655			else
1656				continue;
1657		} else
1658			off = reg >> 4;
1659		msk = reg & 0xf;
1660
1661		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1662		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1663	}
1664
1665end:
1666
1667#ifdef USB_DEBUG
1668	if (sc->sc_debug & URTWN_DEBUG_ROM)
1669		urtwn_dump_rom_contents(sc, rom, size);
1670#endif
1671
1672	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1673
1674	if (error != 0) {
1675		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1676		    __func__);
1677	}
1678
1679	return (error);
1680#undef URTWN_CHK
1681}
1682
1683static int
1684urtwn_efuse_switch_power(struct urtwn_softc *sc)
1685{
1686	usb_error_t error;
1687	uint32_t reg;
1688
1689	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1690	if (error != USB_ERR_NORMAL_COMPLETION)
1691		return (EIO);
1692
1693	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1694	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1695		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1696		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1697		if (error != USB_ERR_NORMAL_COMPLETION)
1698			return (EIO);
1699	}
1700	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1701	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1702		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1703		    reg | R92C_SYS_FUNC_EN_ELDR);
1704		if (error != USB_ERR_NORMAL_COMPLETION)
1705			return (EIO);
1706	}
1707	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1708	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1709	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1710		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1711		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1712		if (error != USB_ERR_NORMAL_COMPLETION)
1713			return (EIO);
1714	}
1715
1716	return (0);
1717}
1718
1719static int
1720urtwn_read_chipid(struct urtwn_softc *sc)
1721{
1722	uint32_t reg;
1723
1724	if (sc->chip & URTWN_CHIP_88E)
1725		return (0);
1726
1727	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1728	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1729		return (EIO);
1730
1731	if (reg & R92C_SYS_CFG_TYPE_92C) {
1732		sc->chip |= URTWN_CHIP_92C;
1733		/* Check if it is a castrated 8192C. */
1734		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1735		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1736		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1737			sc->chip |= URTWN_CHIP_92C_1T2R;
1738	}
1739	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1740		sc->chip |= URTWN_CHIP_UMC;
1741		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1742			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1743	}
1744	return (0);
1745}
1746
1747static int
1748urtwn_read_rom(struct urtwn_softc *sc)
1749{
1750	struct r92c_rom *rom = &sc->rom.r92c_rom;
1751	int error;
1752
1753	/* Read full ROM image. */
1754	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1755	if (error != 0)
1756		return (error);
1757
1758	/* XXX Weird but this is what the vendor driver does. */
1759	sc->last_rom_addr = 0x1fa;
1760	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1761	if (error != 0)
1762		return (error);
1763	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1764	    sc->pa_setting);
1765
1766	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1767
1768	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1769	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1770	    __func__, sc->regulatory);
1771	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1772
1773	sc->sc_rf_write = urtwn_r92c_rf_write;
1774	sc->sc_power_on = urtwn_r92c_power_on;
1775
1776	return (0);
1777}
1778
1779static int
1780urtwn_r88e_read_rom(struct urtwn_softc *sc)
1781{
1782	struct r88e_rom *rom = &sc->rom.r88e_rom;
1783	int error;
1784
1785	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1786	if (error != 0)
1787		return (error);
1788
1789	sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1790	if (sc->bw20_tx_pwr_diff & 0x08)
1791		sc->bw20_tx_pwr_diff |= 0xf0;
1792	sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1793	if (sc->ofdm_tx_pwr_diff & 0x08)
1794		sc->ofdm_tx_pwr_diff |= 0xf0;
1795	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1796	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1797	    __func__,sc->regulatory);
1798	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1799
1800	sc->sc_rf_write = urtwn_r88e_rf_write;
1801	sc->sc_power_on = urtwn_r88e_power_on;
1802
1803	return (0);
1804}
1805
1806/*
1807 * Initialize rate adaptation in firmware.
1808 */
1809static int
1810urtwn_ra_init(struct urtwn_softc *sc)
1811{
1812	struct ieee80211com *ic = &sc->sc_ic;
1813	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1814	struct ieee80211_node *ni;
1815	struct ieee80211_rateset *rs;
1816	struct r92c_fw_cmd_macid_cfg cmd;
1817	uint32_t rates, basicrates;
1818	uint8_t mode;
1819	int maxrate, maxbasicrate, error, i, j;
1820
1821	ni = ieee80211_ref_node(vap->iv_bss);
1822	rs = &ni->ni_rates;
1823
1824	/* Get normal and basic rates mask. */
1825	rates = basicrates = 0;
1826	maxrate = maxbasicrate = 0;
1827	for (i = 0; i < rs->rs_nrates; i++) {
1828		/* Convert 802.11 rate to HW rate index. */
1829		for (j = 0; j < nitems(ridx2rate); j++)
1830			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1831			    ridx2rate[j])
1832				break;
1833		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1834			continue;
1835		rates |= 1 << j;
1836		if (j > maxrate)
1837			maxrate = j;
1838		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1839			basicrates |= 1 << j;
1840			if (j > maxbasicrate)
1841				maxbasicrate = j;
1842		}
1843	}
1844	if (ic->ic_curmode == IEEE80211_MODE_11B)
1845		mode = R92C_RAID_11B;
1846	else
1847		mode = R92C_RAID_11BG;
1848	URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
1849	    "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
1850	    mode, rates, basicrates);
1851
1852	/* Set rates mask for group addressed frames. */
1853	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1854	cmd.mask = htole32(mode << 28 | basicrates);
1855	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1856	if (error != 0) {
1857		ieee80211_free_node(ni);
1858		device_printf(sc->sc_dev,
1859		    "could not add broadcast station\n");
1860		return (error);
1861	}
1862	/* Set initial MRR rate. */
1863	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
1864	    maxbasicrate);
1865	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1866	    maxbasicrate);
1867
1868	/* Set rates mask for unicast frames. */
1869	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1870	cmd.mask = htole32(mode << 28 | rates);
1871	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1872	if (error != 0) {
1873		ieee80211_free_node(ni);
1874		device_printf(sc->sc_dev, "could not add BSS station\n");
1875		return (error);
1876	}
1877	/* Set initial MRR rate. */
1878	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
1879	    maxrate);
1880	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1881	    maxrate);
1882
1883	/* Indicate highest supported rate. */
1884	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1885	ieee80211_free_node(ni);
1886
1887	return (0);
1888}
1889
1890static void
1891urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1892{
1893	struct r92c_tx_desc *txd = &uvp->bcn_desc;
1894
1895	txd->txdw0 = htole32(
1896	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
1897	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1898	txd->txdw1 = htole32(
1899	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
1900	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1901
1902	if (sc->chip & URTWN_CHIP_88E) {
1903		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
1904		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
1905	} else {
1906		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
1907		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
1908	}
1909
1910	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
1911	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
1912}
1913
1914static int
1915urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
1916{
1917 	struct ieee80211vap *vap = ni->ni_vap;
1918	struct urtwn_vap *uvp = URTWN_VAP(vap);
1919	struct mbuf *m;
1920	int error;
1921
1922	URTWN_ASSERT_LOCKED(sc);
1923
1924	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1925		return (EINVAL);
1926
1927	m = ieee80211_beacon_alloc(ni);
1928	if (m == NULL) {
1929		device_printf(sc->sc_dev,
1930		    "%s: could not allocate beacon frame\n", __func__);
1931		return (ENOMEM);
1932	}
1933
1934	if (uvp->bcn_mbuf != NULL)
1935		m_freem(uvp->bcn_mbuf);
1936
1937	uvp->bcn_mbuf = m;
1938
1939	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1940		return (error);
1941
1942	/* XXX bcnq stuck workaround */
1943	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1944		return (error);
1945
1946	URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
1947	    __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
1948	    (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
1949
1950	return (0);
1951}
1952
1953static void
1954urtwn_update_beacon(struct ieee80211vap *vap, int item)
1955{
1956	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1957	struct urtwn_vap *uvp = URTWN_VAP(vap);
1958	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
1959	struct ieee80211_node *ni = vap->iv_bss;
1960	int mcast = 0;
1961
1962	URTWN_LOCK(sc);
1963	if (uvp->bcn_mbuf == NULL) {
1964		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
1965		if (uvp->bcn_mbuf == NULL) {
1966			device_printf(sc->sc_dev,
1967			    "%s: could not allocate beacon frame\n", __func__);
1968			URTWN_UNLOCK(sc);
1969			return;
1970		}
1971	}
1972	URTWN_UNLOCK(sc);
1973
1974	if (item == IEEE80211_BEACON_TIM)
1975		mcast = 1;	/* XXX */
1976
1977	setbit(bo->bo_flags, item);
1978	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
1979
1980	URTWN_LOCK(sc);
1981	urtwn_tx_beacon(sc, uvp);
1982	URTWN_UNLOCK(sc);
1983}
1984
1985/*
1986 * Push a beacon frame into the chip. Beacon will
1987 * be repeated by the chip every R92C_BCN_INTERVAL.
1988 */
1989static int
1990urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1991{
1992	struct r92c_tx_desc *desc = &uvp->bcn_desc;
1993	struct urtwn_data *bf;
1994
1995	URTWN_ASSERT_LOCKED(sc);
1996
1997	bf = urtwn_getbuf(sc);
1998	if (bf == NULL)
1999		return (ENOMEM);
2000
2001	memcpy(bf->buf, desc, sizeof(*desc));
2002	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2003
2004	sc->sc_txtimer = 5;
2005	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2006
2007	return (0);
2008}
2009
2010static int
2011urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2012    ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2013{
2014	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2015	uint8_t i;
2016
2017	if (!(&vap->iv_nw_keys[0] <= k &&
2018	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2019		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2020			URTWN_LOCK(sc);
2021			/*
2022			 * First 4 slots for group keys,
2023			 * what is left - for pairwise.
2024			 * XXX incompatible with IBSS RSN.
2025			 */
2026			for (i = IEEE80211_WEP_NKID;
2027			     i < R92C_CAM_ENTRY_COUNT; i++) {
2028				if ((sc->keys_bmap & (1 << i)) == 0) {
2029					sc->keys_bmap |= 1 << i;
2030					*keyix = i;
2031					break;
2032				}
2033			}
2034			URTWN_UNLOCK(sc);
2035			if (i == R92C_CAM_ENTRY_COUNT) {
2036				device_printf(sc->sc_dev,
2037				    "%s: no free space in the key table\n",
2038				    __func__);
2039				return 0;
2040			}
2041		} else
2042			*keyix = 0;
2043	} else {
2044		*keyix = k - vap->iv_nw_keys;
2045	}
2046	*rxkeyix = *keyix;
2047	return 1;
2048}
2049
2050static void
2051urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2052{
2053	struct ieee80211_key *k = &data->key;
2054	uint8_t algo, keyid;
2055	int i, error;
2056
2057	if (k->wk_keyix < IEEE80211_WEP_NKID)
2058		keyid = k->wk_keyix;
2059	else
2060		keyid = 0;
2061
2062	/* Map net80211 cipher to HW crypto algorithm. */
2063	switch (k->wk_cipher->ic_cipher) {
2064	case IEEE80211_CIPHER_WEP:
2065		if (k->wk_keylen < 8)
2066			algo = R92C_CAM_ALGO_WEP40;
2067		else
2068			algo = R92C_CAM_ALGO_WEP104;
2069		break;
2070	case IEEE80211_CIPHER_TKIP:
2071		algo = R92C_CAM_ALGO_TKIP;
2072		break;
2073	case IEEE80211_CIPHER_AES_CCM:
2074		algo = R92C_CAM_ALGO_AES;
2075		break;
2076	default:
2077		device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2078		    __func__, k->wk_cipher->ic_cipher);
2079		return;
2080	}
2081
2082	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2083	    "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2084	    "macaddr %s\n", __func__, k->wk_keyix, keyid,
2085	    k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2086	    ether_sprintf(k->wk_macaddr));
2087
2088	/* Write key. */
2089	for (i = 0; i < 4; i++) {
2090		error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2091		    LE_READ_4(&k->wk_key[i * 4]));
2092		if (error != 0)
2093			goto fail;
2094	}
2095
2096	/* Write CTL0 last since that will validate the CAM entry. */
2097	error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2098	    LE_READ_4(&k->wk_macaddr[2]));
2099	if (error != 0)
2100		goto fail;
2101	error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2102	    SM(R92C_CAM_ALGO, algo) |
2103	    SM(R92C_CAM_KEYID, keyid) |
2104	    SM(R92C_CAM_MACLO, LE_READ_2(&k->wk_macaddr[0])) |
2105	    R92C_CAM_VALID);
2106	if (error != 0)
2107		goto fail;
2108
2109	return;
2110
2111fail:
2112	device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2113}
2114
2115static void
2116urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2117{
2118	struct ieee80211_key *k = &data->key;
2119	int i;
2120
2121	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2122	    "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2123	    k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2124
2125	urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2126	urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2127
2128	/* Clear key. */
2129	for (i = 0; i < 4; i++)
2130		urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2131	sc->keys_bmap &= ~(1 << k->wk_keyix);
2132}
2133
2134static int
2135urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2136{
2137	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2138
2139	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2140		/* Not for us. */
2141		return (1);
2142	}
2143
2144	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2145}
2146
2147static int
2148urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2149{
2150	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2151
2152	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2153		/* Not for us. */
2154		return (1);
2155	}
2156
2157	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2158}
2159
2160static void
2161urtwn_tsf_task_adhoc(void *arg, int pending)
2162{
2163	struct ieee80211vap *vap = arg;
2164	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2165	struct ieee80211_node *ni;
2166	uint32_t reg;
2167
2168	URTWN_LOCK(sc);
2169	ni = ieee80211_ref_node(vap->iv_bss);
2170	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2171
2172	/* Accept beacons with the same BSSID. */
2173	urtwn_set_rx_bssid_all(sc, 0);
2174
2175	/* Enable synchronization. */
2176	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2177	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2178
2179	/* Synchronize. */
2180	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2181
2182	/* Disable synchronization. */
2183	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2184	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2185
2186	/* Remove beacon filter. */
2187	urtwn_set_rx_bssid_all(sc, 1);
2188
2189	/* Enable beaconing. */
2190	urtwn_write_1(sc, R92C_MBID_NUM,
2191	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2192	reg |= R92C_BCN_CTRL_EN_BCN;
2193
2194	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2195	ieee80211_free_node(ni);
2196	URTWN_UNLOCK(sc);
2197}
2198
2199static void
2200urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2201{
2202	struct ieee80211com *ic = &sc->sc_ic;
2203	struct urtwn_vap *uvp = URTWN_VAP(vap);
2204
2205	/* Reset TSF. */
2206	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2207
2208	switch (vap->iv_opmode) {
2209	case IEEE80211_M_STA:
2210		/* Enable TSF synchronization. */
2211		urtwn_write_1(sc, R92C_BCN_CTRL,
2212		    urtwn_read_1(sc, R92C_BCN_CTRL) &
2213		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2214		break;
2215	case IEEE80211_M_IBSS:
2216		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2217		break;
2218	case IEEE80211_M_HOSTAP:
2219		/* Enable beaconing. */
2220		urtwn_write_1(sc, R92C_MBID_NUM,
2221		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2222		urtwn_write_1(sc, R92C_BCN_CTRL,
2223		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2224		break;
2225	default:
2226		device_printf(sc->sc_dev, "undefined opmode %d\n",
2227		    vap->iv_opmode);
2228		return;
2229	}
2230}
2231
2232static void
2233urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2234{
2235	urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2236}
2237
2238static void
2239urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2240{
2241	uint8_t reg;
2242
2243	if (led == URTWN_LED_LINK) {
2244		if (sc->chip & URTWN_CHIP_88E) {
2245			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2246			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2247			if (!on) {
2248				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2249				urtwn_write_1(sc, R92C_LEDCFG2,
2250				    reg | R92C_LEDCFG0_DIS);
2251				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2252				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2253				    0xfe);
2254			}
2255		} else {
2256			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2257			if (!on)
2258				reg |= R92C_LEDCFG0_DIS;
2259			urtwn_write_1(sc, R92C_LEDCFG0, reg);
2260		}
2261		sc->ledlink = on;       /* Save LED state. */
2262	}
2263}
2264
2265static void
2266urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2267{
2268	uint8_t reg;
2269
2270	reg = urtwn_read_1(sc, R92C_MSR);
2271	reg = (reg & ~R92C_MSR_MASK) | mode;
2272	urtwn_write_1(sc, R92C_MSR, reg);
2273}
2274
2275static void
2276urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2277    const struct ieee80211_rx_stats *rxs,
2278    int rssi, int nf)
2279{
2280	struct ieee80211vap *vap = ni->ni_vap;
2281	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2282	struct urtwn_vap *uvp = URTWN_VAP(vap);
2283	uint64_t ni_tstamp, curr_tstamp;
2284
2285	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2286
2287	if (vap->iv_state == IEEE80211_S_RUN &&
2288	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2289	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2290		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2291		URTWN_LOCK(sc);
2292		urtwn_get_tsf(sc, &curr_tstamp);
2293		URTWN_UNLOCK(sc);
2294		curr_tstamp = le64toh(curr_tstamp);
2295
2296		if (ni_tstamp >= curr_tstamp)
2297			(void) ieee80211_ibss_merge(ni);
2298	}
2299}
2300
2301static int
2302urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2303{
2304	struct urtwn_vap *uvp = URTWN_VAP(vap);
2305	struct ieee80211com *ic = vap->iv_ic;
2306	struct urtwn_softc *sc = ic->ic_softc;
2307	struct ieee80211_node *ni;
2308	enum ieee80211_state ostate;
2309	uint32_t reg;
2310	uint8_t mode;
2311	int error = 0;
2312
2313	ostate = vap->iv_state;
2314	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2315	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2316
2317	IEEE80211_UNLOCK(ic);
2318	URTWN_LOCK(sc);
2319	callout_stop(&sc->sc_watchdog_ch);
2320
2321	if (ostate == IEEE80211_S_RUN) {
2322		/* Stop calibration. */
2323		callout_stop(&sc->sc_calib_to);
2324
2325		/* Turn link LED off. */
2326		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2327
2328		/* Set media status to 'No Link'. */
2329		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2330
2331		/* Stop Rx of data frames. */
2332		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2333
2334		/* Disable TSF synchronization. */
2335		urtwn_write_1(sc, R92C_BCN_CTRL,
2336		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2337		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2338
2339		/* Disable beaconing. */
2340		urtwn_write_1(sc, R92C_MBID_NUM,
2341		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2342
2343		/* Reset TSF. */
2344		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2345
2346		/* Reset EDCA parameters. */
2347		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2348		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2349		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2350		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2351	}
2352
2353	switch (nstate) {
2354	case IEEE80211_S_INIT:
2355		/* Turn link LED off. */
2356		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2357		break;
2358	case IEEE80211_S_SCAN:
2359		/* Pause AC Tx queues. */
2360		urtwn_write_1(sc, R92C_TXPAUSE,
2361		    urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2362		break;
2363	case IEEE80211_S_AUTH:
2364		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2365		break;
2366	case IEEE80211_S_RUN:
2367		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2368			/* Turn link LED on. */
2369			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2370			break;
2371		}
2372
2373		ni = ieee80211_ref_node(vap->iv_bss);
2374
2375		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2376		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2377			device_printf(sc->sc_dev,
2378			    "%s: could not move to RUN state\n", __func__);
2379			error = EINVAL;
2380			goto end_run;
2381		}
2382
2383		switch (vap->iv_opmode) {
2384		case IEEE80211_M_STA:
2385			mode = R92C_MSR_INFRA;
2386			break;
2387		case IEEE80211_M_IBSS:
2388			mode = R92C_MSR_ADHOC;
2389			break;
2390		case IEEE80211_M_HOSTAP:
2391			mode = R92C_MSR_AP;
2392			break;
2393		default:
2394			device_printf(sc->sc_dev, "undefined opmode %d\n",
2395			    vap->iv_opmode);
2396			error = EINVAL;
2397			goto end_run;
2398		}
2399
2400		/* Set media status to 'Associated'. */
2401		urtwn_set_mode(sc, mode);
2402
2403		/* Set BSSID. */
2404		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
2405		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
2406
2407		if (ic->ic_curmode == IEEE80211_MODE_11B)
2408			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2409		else	/* 802.11b/g */
2410			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2411
2412		/* Enable Rx of data frames. */
2413		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2414
2415		/* Flush all AC queues. */
2416		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2417
2418		/* Set beacon interval. */
2419		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2420
2421		/* Allow Rx from our BSSID only. */
2422		if (ic->ic_promisc == 0) {
2423			reg = urtwn_read_4(sc, R92C_RCR);
2424
2425			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2426				reg |= R92C_RCR_CBSSID_DATA;
2427			if (vap->iv_opmode != IEEE80211_M_IBSS)
2428				reg |= R92C_RCR_CBSSID_BCN;
2429
2430			urtwn_write_4(sc, R92C_RCR, reg);
2431		}
2432
2433		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2434		    vap->iv_opmode == IEEE80211_M_IBSS) {
2435			error = urtwn_setup_beacon(sc, ni);
2436			if (error != 0) {
2437				device_printf(sc->sc_dev,
2438				    "unable to push beacon into the chip, "
2439				    "error %d\n", error);
2440				goto end_run;
2441			}
2442		}
2443
2444		/* Enable TSF synchronization. */
2445		urtwn_tsf_sync_enable(sc, vap);
2446
2447		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2448		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2449		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2450		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2451		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2452		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2453
2454		/* Intialize rate adaptation. */
2455		if (!(sc->chip & URTWN_CHIP_88E))
2456			urtwn_ra_init(sc);
2457		/* Turn link LED on. */
2458		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2459
2460		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2461		/* Reset temperature calibration state machine. */
2462		sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2463		sc->thcal_lctemp = 0;
2464		/* Start periodic calibration. */
2465		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2466
2467end_run:
2468		ieee80211_free_node(ni);
2469		break;
2470	default:
2471		break;
2472	}
2473
2474	URTWN_UNLOCK(sc);
2475	IEEE80211_LOCK(ic);
2476	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2477}
2478
2479static void
2480urtwn_calib_to(void *arg)
2481{
2482	struct urtwn_softc *sc = arg;
2483
2484	/* Do it in a process context. */
2485	urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2486}
2487
2488static void
2489urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2490{
2491	/* Do temperature compensation. */
2492	urtwn_temp_calib(sc);
2493
2494	if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2495		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2496}
2497
2498static void
2499urtwn_watchdog(void *arg)
2500{
2501	struct urtwn_softc *sc = arg;
2502
2503	if (sc->sc_txtimer > 0) {
2504		if (--sc->sc_txtimer == 0) {
2505			device_printf(sc->sc_dev, "device timeout\n");
2506			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2507			return;
2508		}
2509		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2510	}
2511}
2512
2513static void
2514urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2515{
2516	int pwdb;
2517
2518	/* Convert antenna signal to percentage. */
2519	if (rssi <= -100 || rssi >= 20)
2520		pwdb = 0;
2521	else if (rssi >= 0)
2522		pwdb = 100;
2523	else
2524		pwdb = 100 + rssi;
2525	if (!(sc->chip & URTWN_CHIP_88E)) {
2526		if (rate <= URTWN_RIDX_CCK11) {
2527			/* CCK gain is smaller than OFDM/MCS gain. */
2528			pwdb += 6;
2529			if (pwdb > 100)
2530				pwdb = 100;
2531			if (pwdb <= 14)
2532				pwdb -= 4;
2533			else if (pwdb <= 26)
2534				pwdb -= 8;
2535			else if (pwdb <= 34)
2536				pwdb -= 6;
2537			else if (pwdb <= 42)
2538				pwdb -= 2;
2539		}
2540	}
2541	if (sc->avg_pwdb == -1)	/* Init. */
2542		sc->avg_pwdb = pwdb;
2543	else if (sc->avg_pwdb < pwdb)
2544		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2545	else
2546		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2547	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: PWDB %d, EMA %d\n", __func__,
2548	    pwdb, sc->avg_pwdb);
2549}
2550
2551static int8_t
2552urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2553{
2554	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2555	struct r92c_rx_phystat *phy;
2556	struct r92c_rx_cck *cck;
2557	uint8_t rpt;
2558	int8_t rssi;
2559
2560	if (rate <= URTWN_RIDX_CCK11) {
2561		cck = (struct r92c_rx_cck *)physt;
2562		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2563			rpt = (cck->agc_rpt >> 5) & 0x3;
2564			rssi = (cck->agc_rpt & 0x1f) << 1;
2565		} else {
2566			rpt = (cck->agc_rpt >> 6) & 0x3;
2567			rssi = cck->agc_rpt & 0x3e;
2568		}
2569		rssi = cckoff[rpt] - rssi;
2570	} else {	/* OFDM/HT. */
2571		phy = (struct r92c_rx_phystat *)physt;
2572		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2573	}
2574	return (rssi);
2575}
2576
2577static int8_t
2578urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2579{
2580	struct r92c_rx_phystat *phy;
2581	struct r88e_rx_cck *cck;
2582	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2583	int8_t rssi;
2584
2585	rssi = 0;
2586	if (rate <= URTWN_RIDX_CCK11) {
2587		cck = (struct r88e_rx_cck *)physt;
2588		cck_agc_rpt = cck->agc_rpt;
2589		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2590		vga_idx = cck_agc_rpt & 0x1f;
2591		switch (lna_idx) {
2592		case 7:
2593			if (vga_idx <= 27)
2594				rssi = -100 + 2* (27 - vga_idx);
2595			else
2596				rssi = -100;
2597			break;
2598		case 6:
2599			rssi = -48 + 2 * (2 - vga_idx);
2600			break;
2601		case 5:
2602			rssi = -42 + 2 * (7 - vga_idx);
2603			break;
2604		case 4:
2605			rssi = -36 + 2 * (7 - vga_idx);
2606			break;
2607		case 3:
2608			rssi = -24 + 2 * (7 - vga_idx);
2609			break;
2610		case 2:
2611			rssi = -12 + 2 * (5 - vga_idx);
2612			break;
2613		case 1:
2614			rssi = 8 - (2 * vga_idx);
2615			break;
2616		case 0:
2617			rssi = 14 - (2 * vga_idx);
2618			break;
2619		}
2620		rssi += 6;
2621	} else {	/* OFDM/HT. */
2622		phy = (struct r92c_rx_phystat *)physt;
2623		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2624	}
2625	return (rssi);
2626}
2627
2628static __inline uint8_t
2629rate2ridx(uint8_t rate)
2630{
2631	switch (rate) {
2632	case 12:	return 4;
2633	case 18:	return 5;
2634	case 24:	return 6;
2635	case 36:	return 7;
2636	case 48:	return 8;
2637	case 72:	return 9;
2638	case 96:	return 10;
2639	case 108:	return 11;
2640	case 2:		return 0;
2641	case 4:		return 1;
2642	case 11:	return 2;
2643	case 22:	return 3;
2644	default:	return 0;
2645	}
2646}
2647
2648static int
2649urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2650    struct mbuf *m, struct urtwn_data *data)
2651{
2652	const struct ieee80211_txparam *tp;
2653	struct ieee80211com *ic = &sc->sc_ic;
2654	struct ieee80211vap *vap = ni->ni_vap;
2655	struct ieee80211_key *k = NULL;
2656	struct ieee80211_channel *chan;
2657	struct ieee80211_frame *wh;
2658	struct r92c_tx_desc *txd;
2659	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2660	int hasqos, ismcast;
2661
2662	URTWN_ASSERT_LOCKED(sc);
2663
2664	/*
2665	 * Software crypto.
2666	 */
2667	wh = mtod(m, struct ieee80211_frame *);
2668	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2669	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2670	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2671	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2672
2673	/* Select TX ring for this frame. */
2674	if (hasqos) {
2675		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2676		tid &= IEEE80211_QOS_TID;
2677	} else
2678		tid = 0;
2679
2680	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2681		ni->ni_chan : ic->ic_curchan;
2682	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2683
2684	/* Choose a TX rate index. */
2685	if (type == IEEE80211_FC0_TYPE_MGT)
2686		rate = tp->mgmtrate;
2687	else if (ismcast)
2688		rate = tp->mcastrate;
2689	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2690		rate = tp->ucastrate;
2691	else if (m->m_flags & M_EAPOL)
2692		rate = tp->mgmtrate;
2693	else {
2694		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2695			/* XXX pass pktlen */
2696			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2697			rate = ni->ni_txrate;
2698		} else {
2699			if (ic->ic_curmode != IEEE80211_MODE_11B)
2700				rate = 108;
2701			else
2702				rate = 22;
2703		}
2704	}
2705
2706	ridx = rate2ridx(rate);
2707	if (ic->ic_curmode != IEEE80211_MODE_11B)
2708		raid = R92C_RAID_11BG;
2709	else
2710		raid = R92C_RAID_11B;
2711
2712	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2713		k = ieee80211_crypto_encap(ni, m);
2714		if (k == NULL) {
2715			device_printf(sc->sc_dev,
2716			    "ieee80211_crypto_encap returns NULL.\n");
2717			return (ENOBUFS);
2718		}
2719
2720		/* in case packet header moved, reset pointer */
2721		wh = mtod(m, struct ieee80211_frame *);
2722	}
2723
2724	/* Fill Tx descriptor. */
2725	txd = (struct r92c_tx_desc *)data->buf;
2726	memset(txd, 0, sizeof(*txd));
2727
2728	txd->txdw0 |= htole32(
2729	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2730	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2731	if (ismcast)
2732		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2733
2734	if (!ismcast) {
2735		if (sc->chip & URTWN_CHIP_88E) {
2736			struct urtwn_node *un = URTWN_NODE(ni);
2737			macid = un->id;
2738		} else
2739			macid = URTWN_MACID_BSS;
2740
2741		if (type == IEEE80211_FC0_TYPE_DATA) {
2742			qsel = tid % URTWN_MAX_TID;
2743
2744			if (sc->chip & URTWN_CHIP_88E) {
2745				txd->txdw2 |= htole32(
2746				    R88E_TXDW2_AGGBK |
2747				    R88E_TXDW2_CCX_RPT);
2748			} else
2749				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2750
2751			if (ic->ic_flags & IEEE80211_F_USEPROT) {
2752				switch (ic->ic_protmode) {
2753				case IEEE80211_PROT_CTSONLY:
2754					txd->txdw4 |= htole32(
2755					    R92C_TXDW4_CTS2SELF |
2756					    R92C_TXDW4_HWRTSEN);
2757					break;
2758				case IEEE80211_PROT_RTSCTS:
2759					txd->txdw4 |= htole32(
2760					    R92C_TXDW4_RTSEN |
2761					    R92C_TXDW4_HWRTSEN);
2762					break;
2763				default:
2764					break;
2765				}
2766			}
2767			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2768			    URTWN_RIDX_OFDM24));
2769			txd->txdw5 |= htole32(0x0001ff00);
2770		} else	/* IEEE80211_FC0_TYPE_MGT */
2771			qsel = R92C_TXDW1_QSEL_MGNT;
2772	} else {
2773		macid = URTWN_MACID_BC;
2774		qsel = R92C_TXDW1_QSEL_MGNT;
2775	}
2776
2777	txd->txdw1 |= htole32(
2778	    SM(R92C_TXDW1_QSEL, qsel) |
2779	    SM(R92C_TXDW1_RAID, raid));
2780
2781	if (sc->chip & URTWN_CHIP_88E)
2782		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2783	else
2784		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2785
2786	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2787	/* Force this rate if needed. */
2788	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
2789	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
2790		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2791
2792	if (!hasqos) {
2793		/* Use HW sequence numbering for non-QoS frames. */
2794		if (sc->chip & URTWN_CHIP_88E)
2795			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
2796		else
2797			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2798	} else {
2799		/* Set sequence number. */
2800		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2801	}
2802
2803	if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2804		uint8_t cipher;
2805
2806		switch (k->wk_cipher->ic_cipher) {
2807		case IEEE80211_CIPHER_WEP:
2808		case IEEE80211_CIPHER_TKIP:
2809			cipher = R92C_TXDW1_CIPHER_RC4;
2810			break;
2811		case IEEE80211_CIPHER_AES_CCM:
2812			cipher = R92C_TXDW1_CIPHER_AES;
2813			break;
2814		default:
2815			device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
2816			    __func__, k->wk_cipher->ic_cipher);
2817			return (EINVAL);
2818		}
2819
2820		txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
2821	}
2822
2823	if (ieee80211_radiotap_active_vap(vap)) {
2824		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2825
2826		tap->wt_flags = 0;
2827		if (k != NULL)
2828			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2829		ieee80211_radiotap_tx(vap, m);
2830	}
2831
2832	data->ni = ni;
2833
2834	urtwn_tx_start(sc, m, type, data);
2835
2836	return (0);
2837}
2838
2839static int
2840urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
2841    struct mbuf *m, struct urtwn_data *data,
2842    const struct ieee80211_bpf_params *params)
2843{
2844	struct ieee80211vap *vap = ni->ni_vap;
2845	struct ieee80211_key *k = NULL;
2846	struct ieee80211_frame *wh;
2847	struct r92c_tx_desc *txd;
2848	uint8_t cipher, ridx, type;
2849
2850	/* Encrypt the frame if need be. */
2851	cipher = R92C_TXDW1_CIPHER_NONE;
2852	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
2853		/* Retrieve key for TX. */
2854		k = ieee80211_crypto_encap(ni, m);
2855		if (k == NULL)
2856			return (ENOBUFS);
2857
2858		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2859			switch (k->wk_cipher->ic_cipher) {
2860			case IEEE80211_CIPHER_WEP:
2861			case IEEE80211_CIPHER_TKIP:
2862				cipher = R92C_TXDW1_CIPHER_RC4;
2863				break;
2864			case IEEE80211_CIPHER_AES_CCM:
2865				cipher = R92C_TXDW1_CIPHER_AES;
2866				break;
2867			default:
2868				device_printf(sc->sc_dev,
2869				    "%s: unknown cipher %d\n",
2870				    __func__, k->wk_cipher->ic_cipher);
2871				return (EINVAL);
2872			}
2873		}
2874	}
2875
2876	wh = mtod(m, struct ieee80211_frame *);
2877	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2878
2879	/* Fill Tx descriptor. */
2880	txd = (struct r92c_tx_desc *)data->buf;
2881	memset(txd, 0, sizeof(*txd));
2882
2883	txd->txdw0 |= htole32(
2884	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2885	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2886	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2887		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2888
2889	if (params->ibp_flags & IEEE80211_BPF_RTS)
2890		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
2891	if (params->ibp_flags & IEEE80211_BPF_CTS)
2892		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
2893	if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
2894		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
2895		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2896		    URTWN_RIDX_OFDM24));
2897	}
2898
2899	if (sc->chip & URTWN_CHIP_88E)
2900		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2901	else
2902		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2903
2904	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
2905	txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
2906
2907	/* Choose a TX rate index. */
2908	ridx = rate2ridx(params->ibp_rate0);
2909	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2910	txd->txdw5 |= htole32(0x0001ff00);
2911	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2912
2913	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
2914		/* Use HW sequence numbering for non-QoS frames. */
2915		if (sc->chip & URTWN_CHIP_88E)
2916			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
2917		else
2918			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2919	} else {
2920		/* Set sequence number. */
2921		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2922	}
2923
2924	if (ieee80211_radiotap_active_vap(vap)) {
2925		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2926
2927		tap->wt_flags = 0;
2928		if (k != NULL)
2929			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2930		ieee80211_radiotap_tx(vap, m);
2931	}
2932
2933	data->ni = ni;
2934
2935	urtwn_tx_start(sc, m, type, data);
2936
2937	return (0);
2938}
2939
2940static void
2941urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
2942    struct urtwn_data *data)
2943{
2944	struct usb_xfer *xfer;
2945	struct r92c_tx_desc *txd;
2946	uint16_t ac, sum;
2947	int i, xferlen;
2948
2949	URTWN_ASSERT_LOCKED(sc);
2950
2951	ac = M_WME_GETAC(m);
2952
2953	switch (type) {
2954	case IEEE80211_FC0_TYPE_CTL:
2955	case IEEE80211_FC0_TYPE_MGT:
2956		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
2957		break;
2958	default:
2959		xfer = sc->sc_xfer[wme2queue[ac].qid];
2960		break;
2961	}
2962
2963	txd = (struct r92c_tx_desc *)data->buf;
2964	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
2965
2966	/* Compute Tx descriptor checksum. */
2967	sum = 0;
2968	for (i = 0; i < sizeof(*txd) / 2; i++)
2969		sum ^= ((uint16_t *)txd)[i];
2970	txd->txdsum = sum;	/* NB: already little endian. */
2971
2972	xferlen = sizeof(*txd) + m->m_pkthdr.len;
2973	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
2974
2975	data->buflen = xferlen;
2976	data->m = m;
2977
2978	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2979	usbd_transfer_start(xfer);
2980}
2981
2982static int
2983urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
2984{
2985	struct urtwn_softc *sc = ic->ic_softc;
2986	int error;
2987
2988	URTWN_LOCK(sc);
2989	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2990		URTWN_UNLOCK(sc);
2991		return (ENXIO);
2992	}
2993	error = mbufq_enqueue(&sc->sc_snd, m);
2994	if (error) {
2995		URTWN_UNLOCK(sc);
2996		return (error);
2997	}
2998	urtwn_start(sc);
2999	URTWN_UNLOCK(sc);
3000
3001	return (0);
3002}
3003
3004static void
3005urtwn_start(struct urtwn_softc *sc)
3006{
3007	struct ieee80211_node *ni;
3008	struct mbuf *m;
3009	struct urtwn_data *bf;
3010
3011	URTWN_ASSERT_LOCKED(sc);
3012	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3013		bf = urtwn_getbuf(sc);
3014		if (bf == NULL) {
3015			mbufq_prepend(&sc->sc_snd, m);
3016			break;
3017		}
3018		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3019		m->m_pkthdr.rcvif = NULL;
3020		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3021			if_inc_counter(ni->ni_vap->iv_ifp,
3022			    IFCOUNTER_OERRORS, 1);
3023			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3024			m_freem(m);
3025			ieee80211_free_node(ni);
3026			break;
3027		}
3028		sc->sc_txtimer = 5;
3029		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3030	}
3031}
3032
3033static void
3034urtwn_parent(struct ieee80211com *ic)
3035{
3036	struct urtwn_softc *sc = ic->ic_softc;
3037
3038	URTWN_LOCK(sc);
3039	if (sc->sc_flags & URTWN_DETACHED) {
3040		URTWN_UNLOCK(sc);
3041		return;
3042	}
3043	URTWN_UNLOCK(sc);
3044
3045	if (ic->ic_nrunning > 0) {
3046		if (urtwn_init(sc) != 0) {
3047			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3048			if (vap != NULL)
3049				ieee80211_stop(vap);
3050		} else
3051			ieee80211_start_all(ic);
3052	} else
3053		urtwn_stop(sc);
3054}
3055
3056static __inline int
3057urtwn_power_on(struct urtwn_softc *sc)
3058{
3059
3060	return sc->sc_power_on(sc);
3061}
3062
3063static int
3064urtwn_r92c_power_on(struct urtwn_softc *sc)
3065{
3066	uint32_t reg;
3067	usb_error_t error;
3068	int ntries;
3069
3070	/* Wait for autoload done bit. */
3071	for (ntries = 0; ntries < 1000; ntries++) {
3072		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3073			break;
3074		urtwn_ms_delay(sc);
3075	}
3076	if (ntries == 1000) {
3077		device_printf(sc->sc_dev,
3078		    "timeout waiting for chip autoload\n");
3079		return (ETIMEDOUT);
3080	}
3081
3082	/* Unlock ISO/CLK/Power control register. */
3083	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3084	if (error != USB_ERR_NORMAL_COMPLETION)
3085		return (EIO);
3086	/* Move SPS into PWM mode. */
3087	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3088	if (error != USB_ERR_NORMAL_COMPLETION)
3089		return (EIO);
3090	urtwn_ms_delay(sc);
3091
3092	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3093	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3094		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3095		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
3096		if (error != USB_ERR_NORMAL_COMPLETION)
3097			return (EIO);
3098		urtwn_ms_delay(sc);
3099		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3100		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3101		    ~R92C_SYS_ISO_CTRL_MD2PP);
3102		if (error != USB_ERR_NORMAL_COMPLETION)
3103			return (EIO);
3104	}
3105
3106	/* Auto enable WLAN. */
3107	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3108	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3109	if (error != USB_ERR_NORMAL_COMPLETION)
3110		return (EIO);
3111	for (ntries = 0; ntries < 1000; ntries++) {
3112		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3113		    R92C_APS_FSMCO_APFM_ONMAC))
3114			break;
3115		urtwn_ms_delay(sc);
3116	}
3117	if (ntries == 1000) {
3118		device_printf(sc->sc_dev,
3119		    "timeout waiting for MAC auto ON\n");
3120		return (ETIMEDOUT);
3121	}
3122
3123	/* Enable radio, GPIO and LED functions. */
3124	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3125	    R92C_APS_FSMCO_AFSM_HSUS |
3126	    R92C_APS_FSMCO_PDN_EN |
3127	    R92C_APS_FSMCO_PFM_ALDN);
3128	if (error != USB_ERR_NORMAL_COMPLETION)
3129		return (EIO);
3130	/* Release RF digital isolation. */
3131	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3132	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3133	if (error != USB_ERR_NORMAL_COMPLETION)
3134		return (EIO);
3135
3136	/* Initialize MAC. */
3137	error = urtwn_write_1(sc, R92C_APSD_CTRL,
3138	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3139	if (error != USB_ERR_NORMAL_COMPLETION)
3140		return (EIO);
3141	for (ntries = 0; ntries < 200; ntries++) {
3142		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3143		    R92C_APSD_CTRL_OFF_STATUS))
3144			break;
3145		urtwn_ms_delay(sc);
3146	}
3147	if (ntries == 200) {
3148		device_printf(sc->sc_dev,
3149		    "timeout waiting for MAC initialization\n");
3150		return (ETIMEDOUT);
3151	}
3152
3153	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3154	reg = urtwn_read_2(sc, R92C_CR);
3155	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3156	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3157	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3158	    R92C_CR_ENSEC;
3159	error = urtwn_write_2(sc, R92C_CR, reg);
3160	if (error != USB_ERR_NORMAL_COMPLETION)
3161		return (EIO);
3162
3163	error = urtwn_write_1(sc, 0xfe10, 0x19);
3164	if (error != USB_ERR_NORMAL_COMPLETION)
3165		return (EIO);
3166	return (0);
3167}
3168
3169static int
3170urtwn_r88e_power_on(struct urtwn_softc *sc)
3171{
3172	uint32_t reg;
3173	usb_error_t error;
3174	int ntries;
3175
3176	/* Wait for power ready bit. */
3177	for (ntries = 0; ntries < 5000; ntries++) {
3178		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3179			break;
3180		urtwn_ms_delay(sc);
3181	}
3182	if (ntries == 5000) {
3183		device_printf(sc->sc_dev,
3184		    "timeout waiting for chip power up\n");
3185		return (ETIMEDOUT);
3186	}
3187
3188	/* Reset BB. */
3189	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3190	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3191	    R92C_SYS_FUNC_EN_BB_GLB_RST));
3192	if (error != USB_ERR_NORMAL_COMPLETION)
3193		return (EIO);
3194
3195	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3196	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3197	if (error != USB_ERR_NORMAL_COMPLETION)
3198		return (EIO);
3199
3200	/* Disable HWPDN. */
3201	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3202	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3203	if (error != USB_ERR_NORMAL_COMPLETION)
3204		return (EIO);
3205
3206	/* Disable WL suspend. */
3207	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3208	    urtwn_read_2(sc, R92C_APS_FSMCO) &
3209	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3210	if (error != USB_ERR_NORMAL_COMPLETION)
3211		return (EIO);
3212
3213	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3214	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3215	if (error != USB_ERR_NORMAL_COMPLETION)
3216		return (EIO);
3217	for (ntries = 0; ntries < 5000; ntries++) {
3218		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3219		    R92C_APS_FSMCO_APFM_ONMAC))
3220			break;
3221		urtwn_ms_delay(sc);
3222	}
3223	if (ntries == 5000)
3224		return (ETIMEDOUT);
3225
3226	/* Enable LDO normal mode. */
3227	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3228	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
3229	if (error != USB_ERR_NORMAL_COMPLETION)
3230		return (EIO);
3231
3232	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3233	error = urtwn_write_2(sc, R92C_CR, 0);
3234	if (error != USB_ERR_NORMAL_COMPLETION)
3235		return (EIO);
3236	reg = urtwn_read_2(sc, R92C_CR);
3237	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3238	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3239	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3240	error = urtwn_write_2(sc, R92C_CR, reg);
3241	if (error != USB_ERR_NORMAL_COMPLETION)
3242		return (EIO);
3243
3244	return (0);
3245}
3246
3247static int
3248urtwn_llt_init(struct urtwn_softc *sc)
3249{
3250	int i, error, page_count, pktbuf_count;
3251
3252	page_count = (sc->chip & URTWN_CHIP_88E) ?
3253	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3254	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3255	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3256
3257	/* Reserve pages [0; page_count]. */
3258	for (i = 0; i < page_count; i++) {
3259		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3260			return (error);
3261	}
3262	/* NB: 0xff indicates end-of-list. */
3263	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3264		return (error);
3265	/*
3266	 * Use pages [page_count + 1; pktbuf_count - 1]
3267	 * as ring buffer.
3268	 */
3269	for (++i; i < pktbuf_count - 1; i++) {
3270		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3271			return (error);
3272	}
3273	/* Make the last page point to the beginning of the ring buffer. */
3274	error = urtwn_llt_write(sc, i, page_count + 1);
3275	return (error);
3276}
3277
3278static void
3279urtwn_fw_reset(struct urtwn_softc *sc)
3280{
3281	uint16_t reg;
3282	int ntries;
3283
3284	/* Tell 8051 to reset itself. */
3285	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3286
3287	/* Wait until 8051 resets by itself. */
3288	for (ntries = 0; ntries < 100; ntries++) {
3289		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3290		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3291			return;
3292		urtwn_ms_delay(sc);
3293	}
3294	/* Force 8051 reset. */
3295	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3296}
3297
3298static void
3299urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3300{
3301	uint16_t reg;
3302
3303	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3304	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3305	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3306}
3307
3308static int
3309urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3310{
3311	uint32_t reg;
3312	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3313	int off, mlen;
3314
3315	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3316	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3317	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3318
3319	off = R92C_FW_START_ADDR;
3320	while (len > 0) {
3321		if (len > 196)
3322			mlen = 196;
3323		else if (len > 4)
3324			mlen = 4;
3325		else
3326			mlen = 1;
3327		/* XXX fix this deconst */
3328		error = urtwn_write_region_1(sc, off,
3329		    __DECONST(uint8_t *, buf), mlen);
3330		if (error != USB_ERR_NORMAL_COMPLETION)
3331			break;
3332		off += mlen;
3333		buf += mlen;
3334		len -= mlen;
3335	}
3336	return (error);
3337}
3338
3339static int
3340urtwn_load_firmware(struct urtwn_softc *sc)
3341{
3342	const struct firmware *fw;
3343	const struct r92c_fw_hdr *hdr;
3344	const char *imagename;
3345	const u_char *ptr;
3346	size_t len;
3347	uint32_t reg;
3348	int mlen, ntries, page, error;
3349
3350	URTWN_UNLOCK(sc);
3351	/* Read firmware image from the filesystem. */
3352	if (sc->chip & URTWN_CHIP_88E)
3353		imagename = "urtwn-rtl8188eufw";
3354	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3355		    URTWN_CHIP_UMC_A_CUT)
3356		imagename = "urtwn-rtl8192cfwU";
3357	else
3358		imagename = "urtwn-rtl8192cfwT";
3359
3360	fw = firmware_get(imagename);
3361	URTWN_LOCK(sc);
3362	if (fw == NULL) {
3363		device_printf(sc->sc_dev,
3364		    "failed loadfirmware of file %s\n", imagename);
3365		return (ENOENT);
3366	}
3367
3368	len = fw->datasize;
3369
3370	if (len < sizeof(*hdr)) {
3371		device_printf(sc->sc_dev, "firmware too short\n");
3372		error = EINVAL;
3373		goto fail;
3374	}
3375	ptr = fw->data;
3376	hdr = (const struct r92c_fw_hdr *)ptr;
3377	/* Check if there is a valid FW header and skip it. */
3378	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3379	    (le16toh(hdr->signature) >> 4) == 0x88e ||
3380	    (le16toh(hdr->signature) >> 4) == 0x92c) {
3381		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3382		    "FW V%d.%d %02d-%02d %02d:%02d\n",
3383		    le16toh(hdr->version), le16toh(hdr->subversion),
3384		    hdr->month, hdr->date, hdr->hour, hdr->minute);
3385		ptr += sizeof(*hdr);
3386		len -= sizeof(*hdr);
3387	}
3388
3389	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3390		if (sc->chip & URTWN_CHIP_88E)
3391			urtwn_r88e_fw_reset(sc);
3392		else
3393			urtwn_fw_reset(sc);
3394		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3395	}
3396
3397	if (!(sc->chip & URTWN_CHIP_88E)) {
3398		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3399		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3400		    R92C_SYS_FUNC_EN_CPUEN);
3401	}
3402	urtwn_write_1(sc, R92C_MCUFWDL,
3403	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3404	urtwn_write_1(sc, R92C_MCUFWDL + 2,
3405	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3406
3407	/* Reset the FWDL checksum. */
3408	urtwn_write_1(sc, R92C_MCUFWDL,
3409	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3410
3411	for (page = 0; len > 0; page++) {
3412		mlen = min(len, R92C_FW_PAGE_SIZE);
3413		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3414		if (error != 0) {
3415			device_printf(sc->sc_dev,
3416			    "could not load firmware page\n");
3417			goto fail;
3418		}
3419		ptr += mlen;
3420		len -= mlen;
3421	}
3422	urtwn_write_1(sc, R92C_MCUFWDL,
3423	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3424	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3425
3426	/* Wait for checksum report. */
3427	for (ntries = 0; ntries < 1000; ntries++) {
3428		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3429			break;
3430		urtwn_ms_delay(sc);
3431	}
3432	if (ntries == 1000) {
3433		device_printf(sc->sc_dev,
3434		    "timeout waiting for checksum report\n");
3435		error = ETIMEDOUT;
3436		goto fail;
3437	}
3438
3439	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3440	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3441	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3442	if (sc->chip & URTWN_CHIP_88E)
3443		urtwn_r88e_fw_reset(sc);
3444	/* Wait for firmware readiness. */
3445	for (ntries = 0; ntries < 1000; ntries++) {
3446		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3447			break;
3448		urtwn_ms_delay(sc);
3449	}
3450	if (ntries == 1000) {
3451		device_printf(sc->sc_dev,
3452		    "timeout waiting for firmware readiness\n");
3453		error = ETIMEDOUT;
3454		goto fail;
3455	}
3456fail:
3457	firmware_put(fw, FIRMWARE_UNLOAD);
3458	return (error);
3459}
3460
3461static int
3462urtwn_dma_init(struct urtwn_softc *sc)
3463{
3464	struct usb_endpoint *ep, *ep_end;
3465	usb_error_t usb_err;
3466	uint32_t reg;
3467	int hashq, hasnq, haslq, nqueues, ntx;
3468	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3469
3470	/* Initialize LLT table. */
3471	error = urtwn_llt_init(sc);
3472	if (error != 0)
3473		return (error);
3474
3475	/* Determine the number of bulk-out pipes. */
3476	ntx = 0;
3477	ep = sc->sc_udev->endpoints;
3478	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3479	for (; ep != ep_end; ep++) {
3480		if ((ep->edesc == NULL) ||
3481		    (ep->iface_index != sc->sc_iface_index))
3482			continue;
3483		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3484			ntx++;
3485	}
3486	if (ntx == 0) {
3487		device_printf(sc->sc_dev,
3488		    "%d: invalid number of Tx bulk pipes\n", ntx);
3489		return (EIO);
3490	}
3491
3492	/* Get Tx queues to USB endpoints mapping. */
3493	hashq = hasnq = haslq = nqueues = 0;
3494	switch (ntx) {
3495	case 1: hashq = 1; break;
3496	case 2: hashq = hasnq = 1; break;
3497	case 3: case 4: hashq = hasnq = haslq = 1; break;
3498	}
3499	nqueues = hashq + hasnq + haslq;
3500	if (nqueues == 0)
3501		return (EIO);
3502
3503	npubqpages = nqpages = nrempages = pagecount = 0;
3504	if (sc->chip & URTWN_CHIP_88E)
3505		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3506	else {
3507		pagecount = R92C_TX_PAGE_COUNT;
3508		npubqpages = R92C_PUBQ_NPAGES;
3509		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3510	}
3511
3512	/* Set number of pages for normal priority queue. */
3513	if (sc->chip & URTWN_CHIP_88E) {
3514		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
3515		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3516			return (EIO);
3517		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
3518		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3519			return (EIO);
3520	} else {
3521		/* Get the number of pages for each queue. */
3522		nqpages = (pagecount - npubqpages) / nqueues;
3523		/*
3524		 * The remaining pages are assigned to the high priority
3525		 * queue.
3526		 */
3527		nrempages = (pagecount - npubqpages) % nqueues;
3528		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
3529		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3530			return (EIO);
3531		usb_err = urtwn_write_4(sc, R92C_RQPN,
3532		    /* Set number of pages for public queue. */
3533		    SM(R92C_RQPN_PUBQ, npubqpages) |
3534		    /* Set number of pages for high priority queue. */
3535		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
3536		    /* Set number of pages for low priority queue. */
3537		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
3538		    /* Load values. */
3539		    R92C_RQPN_LD);
3540		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3541			return (EIO);
3542	}
3543
3544	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
3545	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3546		return (EIO);
3547	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
3548	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3549		return (EIO);
3550	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
3551	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3552		return (EIO);
3553	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
3554	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3555		return (EIO);
3556	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
3557	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3558		return (EIO);
3559
3560	/* Set queue to USB pipe mapping. */
3561	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
3562	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
3563	if (nqueues == 1) {
3564		if (hashq)
3565			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
3566		else if (hasnq)
3567			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
3568		else
3569			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
3570	} else if (nqueues == 2) {
3571		/*
3572		 * All 2-endpoints configs have high and normal
3573		 * priority queues.
3574		 */
3575		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
3576	} else
3577		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
3578	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
3579	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3580		return (EIO);
3581
3582	/* Set Tx/Rx transfer page boundary. */
3583	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
3584	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
3585	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3586		return (EIO);
3587
3588	/* Set Tx/Rx transfer page size. */
3589	usb_err = urtwn_write_1(sc, R92C_PBP,
3590	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
3591	    SM(R92C_PBP_PSTX, R92C_PBP_128));
3592	if (usb_err != USB_ERR_NORMAL_COMPLETION)
3593		return (EIO);
3594
3595	return (0);
3596}
3597
3598static int
3599urtwn_mac_init(struct urtwn_softc *sc)
3600{
3601	usb_error_t error;
3602	int i;
3603
3604	/* Write MAC initialization values. */
3605	if (sc->chip & URTWN_CHIP_88E) {
3606		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
3607			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
3608			    rtl8188eu_mac[i].val);
3609			if (error != USB_ERR_NORMAL_COMPLETION)
3610				return (EIO);
3611		}
3612		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
3613	} else {
3614		for (i = 0; i < nitems(rtl8192cu_mac); i++)
3615			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
3616			    rtl8192cu_mac[i].val);
3617			if (error != USB_ERR_NORMAL_COMPLETION)
3618				return (EIO);
3619	}
3620
3621	return (0);
3622}
3623
3624static void
3625urtwn_bb_init(struct urtwn_softc *sc)
3626{
3627	const struct urtwn_bb_prog *prog;
3628	uint32_t reg;
3629	uint8_t crystalcap;
3630	int i;
3631
3632	/* Enable BB and RF. */
3633	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3634	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3635	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
3636	    R92C_SYS_FUNC_EN_DIO_RF);
3637
3638	if (!(sc->chip & URTWN_CHIP_88E))
3639		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
3640
3641	urtwn_write_1(sc, R92C_RF_CTRL,
3642	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
3643	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3644	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
3645	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
3646
3647	if (!(sc->chip & URTWN_CHIP_88E)) {
3648		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
3649		urtwn_write_1(sc, 0x15, 0xe9);
3650		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
3651	}
3652
3653	/* Select BB programming based on board type. */
3654	if (sc->chip & URTWN_CHIP_88E)
3655		prog = &rtl8188eu_bb_prog;
3656	else if (!(sc->chip & URTWN_CHIP_92C)) {
3657		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3658			prog = &rtl8188ce_bb_prog;
3659		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3660			prog = &rtl8188ru_bb_prog;
3661		else
3662			prog = &rtl8188cu_bb_prog;
3663	} else {
3664		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3665			prog = &rtl8192ce_bb_prog;
3666		else
3667			prog = &rtl8192cu_bb_prog;
3668	}
3669	/* Write BB initialization values. */
3670	for (i = 0; i < prog->count; i++) {
3671		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
3672		urtwn_ms_delay(sc);
3673	}
3674
3675	if (sc->chip & URTWN_CHIP_92C_1T2R) {
3676		/* 8192C 1T only configuration. */
3677		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
3678		reg = (reg & ~0x00000003) | 0x2;
3679		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
3680
3681		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
3682		reg = (reg & ~0x00300033) | 0x00200022;
3683		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
3684
3685		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
3686		reg = (reg & ~0xff000000) | 0x45 << 24;
3687		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
3688
3689		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
3690		reg = (reg & ~0x000000ff) | 0x23;
3691		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
3692
3693		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
3694		reg = (reg & ~0x00000030) | 1 << 4;
3695		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
3696
3697		reg = urtwn_bb_read(sc, 0xe74);
3698		reg = (reg & ~0x0c000000) | 2 << 26;
3699		urtwn_bb_write(sc, 0xe74, reg);
3700		reg = urtwn_bb_read(sc, 0xe78);
3701		reg = (reg & ~0x0c000000) | 2 << 26;
3702		urtwn_bb_write(sc, 0xe78, reg);
3703		reg = urtwn_bb_read(sc, 0xe7c);
3704		reg = (reg & ~0x0c000000) | 2 << 26;
3705		urtwn_bb_write(sc, 0xe7c, reg);
3706		reg = urtwn_bb_read(sc, 0xe80);
3707		reg = (reg & ~0x0c000000) | 2 << 26;
3708		urtwn_bb_write(sc, 0xe80, reg);
3709		reg = urtwn_bb_read(sc, 0xe88);
3710		reg = (reg & ~0x0c000000) | 2 << 26;
3711		urtwn_bb_write(sc, 0xe88, reg);
3712	}
3713
3714	/* Write AGC values. */
3715	for (i = 0; i < prog->agccount; i++) {
3716		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
3717		    prog->agcvals[i]);
3718		urtwn_ms_delay(sc);
3719	}
3720
3721	if (sc->chip & URTWN_CHIP_88E) {
3722		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
3723		urtwn_ms_delay(sc);
3724		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
3725		urtwn_ms_delay(sc);
3726
3727		crystalcap = sc->rom.r88e_rom.crystalcap;
3728		if (crystalcap == 0xff)
3729			crystalcap = 0x20;
3730		crystalcap &= 0x3f;
3731		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
3732		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
3733		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
3734		    crystalcap | crystalcap << 6));
3735	} else {
3736		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
3737		    R92C_HSSI_PARAM2_CCK_HIPWR)
3738			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
3739	}
3740}
3741
3742static void
3743urtwn_rf_init(struct urtwn_softc *sc)
3744{
3745	const struct urtwn_rf_prog *prog;
3746	uint32_t reg, type;
3747	int i, j, idx, off;
3748
3749	/* Select RF programming based on board type. */
3750	if (sc->chip & URTWN_CHIP_88E)
3751		prog = rtl8188eu_rf_prog;
3752	else if (!(sc->chip & URTWN_CHIP_92C)) {
3753		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3754			prog = rtl8188ce_rf_prog;
3755		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3756			prog = rtl8188ru_rf_prog;
3757		else
3758			prog = rtl8188cu_rf_prog;
3759	} else
3760		prog = rtl8192ce_rf_prog;
3761
3762	for (i = 0; i < sc->nrxchains; i++) {
3763		/* Save RF_ENV control type. */
3764		idx = i / 2;
3765		off = (i % 2) * 16;
3766		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3767		type = (reg >> off) & 0x10;
3768
3769		/* Set RF_ENV enable. */
3770		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3771		reg |= 0x100000;
3772		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3773		urtwn_ms_delay(sc);
3774		/* Set RF_ENV output high. */
3775		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3776		reg |= 0x10;
3777		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3778		urtwn_ms_delay(sc);
3779		/* Set address and data lengths of RF registers. */
3780		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3781		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
3782		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3783		urtwn_ms_delay(sc);
3784		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3785		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
3786		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3787		urtwn_ms_delay(sc);
3788
3789		/* Write RF initialization values for this chain. */
3790		for (j = 0; j < prog[i].count; j++) {
3791			if (prog[i].regs[j] >= 0xf9 &&
3792			    prog[i].regs[j] <= 0xfe) {
3793				/*
3794				 * These are fake RF registers offsets that
3795				 * indicate a delay is required.
3796				 */
3797				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
3798				continue;
3799			}
3800			urtwn_rf_write(sc, i, prog[i].regs[j],
3801			    prog[i].vals[j]);
3802			urtwn_ms_delay(sc);
3803		}
3804
3805		/* Restore RF_ENV control type. */
3806		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3807		reg &= ~(0x10 << off) | (type << off);
3808		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
3809
3810		/* Cache RF register CHNLBW. */
3811		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
3812	}
3813
3814	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3815	    URTWN_CHIP_UMC_A_CUT) {
3816		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
3817		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
3818	}
3819}
3820
3821static void
3822urtwn_cam_init(struct urtwn_softc *sc)
3823{
3824	/* Invalidate all CAM entries. */
3825	urtwn_write_4(sc, R92C_CAMCMD,
3826	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
3827}
3828
3829static int
3830urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
3831{
3832	usb_error_t error;
3833
3834	error = urtwn_write_4(sc, R92C_CAMWRITE, data);
3835	if (error != USB_ERR_NORMAL_COMPLETION)
3836		return (EIO);
3837	error = urtwn_write_4(sc, R92C_CAMCMD,
3838	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
3839	    SM(R92C_CAMCMD_ADDR, addr));
3840	if (error != USB_ERR_NORMAL_COMPLETION)
3841		return (EIO);
3842
3843	return (0);
3844}
3845
3846static void
3847urtwn_pa_bias_init(struct urtwn_softc *sc)
3848{
3849	uint8_t reg;
3850	int i;
3851
3852	for (i = 0; i < sc->nrxchains; i++) {
3853		if (sc->pa_setting & (1 << i))
3854			continue;
3855		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
3856		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
3857		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
3858		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
3859	}
3860	if (!(sc->pa_setting & 0x10)) {
3861		reg = urtwn_read_1(sc, 0x16);
3862		reg = (reg & ~0xf0) | 0x90;
3863		urtwn_write_1(sc, 0x16, reg);
3864	}
3865}
3866
3867static void
3868urtwn_rxfilter_init(struct urtwn_softc *sc)
3869{
3870	struct ieee80211com *ic = &sc->sc_ic;
3871	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3872	uint32_t rcr;
3873	uint16_t filter;
3874
3875	URTWN_ASSERT_LOCKED(sc);
3876
3877	/* Accept all multicast frames. */
3878	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
3879	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
3880
3881	/* Filter for management frames. */
3882	filter = 0x7f3f;
3883	switch (vap->iv_opmode) {
3884	case IEEE80211_M_STA:
3885		filter &= ~(
3886		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
3887		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
3888		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
3889		break;
3890	case IEEE80211_M_HOSTAP:
3891		filter &= ~(
3892		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
3893		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP) |
3894		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_BEACON));
3895		break;
3896	case IEEE80211_M_MONITOR:
3897	case IEEE80211_M_IBSS:
3898		break;
3899	default:
3900		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3901		    __func__, vap->iv_opmode);
3902		break;
3903	}
3904	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
3905
3906	/* Reject all control frames. */
3907	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
3908
3909	/* Reject all data frames. */
3910	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
3911
3912	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
3913	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
3914	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
3915
3916	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
3917		/* Accept all frames. */
3918		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
3919		       R92C_RCR_AAP;
3920	}
3921
3922	/* Set Rx filter. */
3923	urtwn_write_4(sc, R92C_RCR, rcr);
3924
3925	if (ic->ic_promisc != 0) {
3926		/* Update Rx filter. */
3927		urtwn_set_promisc(sc);
3928	}
3929}
3930
3931static void
3932urtwn_edca_init(struct urtwn_softc *sc)
3933{
3934	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
3935	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
3936	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
3937	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
3938	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
3939	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
3940	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
3941	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
3942}
3943
3944static void
3945urtwn_write_txpower(struct urtwn_softc *sc, int chain,
3946    uint16_t power[URTWN_RIDX_COUNT])
3947{
3948	uint32_t reg;
3949
3950	/* Write per-CCK rate Tx power. */
3951	if (chain == 0) {
3952		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
3953		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
3954		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
3955		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3956		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
3957		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
3958		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
3959		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3960	} else {
3961		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
3962		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
3963		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
3964		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
3965		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
3966		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3967		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
3968		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3969	}
3970	/* Write per-OFDM rate Tx power. */
3971	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
3972	    SM(R92C_TXAGC_RATE06, power[ 4]) |
3973	    SM(R92C_TXAGC_RATE09, power[ 5]) |
3974	    SM(R92C_TXAGC_RATE12, power[ 6]) |
3975	    SM(R92C_TXAGC_RATE18, power[ 7]));
3976	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
3977	    SM(R92C_TXAGC_RATE24, power[ 8]) |
3978	    SM(R92C_TXAGC_RATE36, power[ 9]) |
3979	    SM(R92C_TXAGC_RATE48, power[10]) |
3980	    SM(R92C_TXAGC_RATE54, power[11]));
3981	/* Write per-MCS Tx power. */
3982	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
3983	    SM(R92C_TXAGC_MCS00,  power[12]) |
3984	    SM(R92C_TXAGC_MCS01,  power[13]) |
3985	    SM(R92C_TXAGC_MCS02,  power[14]) |
3986	    SM(R92C_TXAGC_MCS03,  power[15]));
3987	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
3988	    SM(R92C_TXAGC_MCS04,  power[16]) |
3989	    SM(R92C_TXAGC_MCS05,  power[17]) |
3990	    SM(R92C_TXAGC_MCS06,  power[18]) |
3991	    SM(R92C_TXAGC_MCS07,  power[19]));
3992	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
3993	    SM(R92C_TXAGC_MCS08,  power[20]) |
3994	    SM(R92C_TXAGC_MCS09,  power[21]) |
3995	    SM(R92C_TXAGC_MCS10,  power[22]) |
3996	    SM(R92C_TXAGC_MCS11,  power[23]));
3997	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
3998	    SM(R92C_TXAGC_MCS12,  power[24]) |
3999	    SM(R92C_TXAGC_MCS13,  power[25]) |
4000	    SM(R92C_TXAGC_MCS14,  power[26]) |
4001	    SM(R92C_TXAGC_MCS15,  power[27]));
4002}
4003
4004static void
4005urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4006    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4007    uint16_t power[URTWN_RIDX_COUNT])
4008{
4009	struct ieee80211com *ic = &sc->sc_ic;
4010	struct r92c_rom *rom = &sc->rom.r92c_rom;
4011	uint16_t cckpow, ofdmpow, htpow, diff, max;
4012	const struct urtwn_txpwr *base;
4013	int ridx, chan, group;
4014
4015	/* Determine channel group. */
4016	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4017	if (chan <= 3)
4018		group = 0;
4019	else if (chan <= 9)
4020		group = 1;
4021	else
4022		group = 2;
4023
4024	/* Get original Tx power based on board type and RF chain. */
4025	if (!(sc->chip & URTWN_CHIP_92C)) {
4026		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4027			base = &rtl8188ru_txagc[chain];
4028		else
4029			base = &rtl8192cu_txagc[chain];
4030	} else
4031		base = &rtl8192cu_txagc[chain];
4032
4033	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4034	if (sc->regulatory == 0) {
4035		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4036			power[ridx] = base->pwr[0][ridx];
4037	}
4038	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4039		if (sc->regulatory == 3) {
4040			power[ridx] = base->pwr[0][ridx];
4041			/* Apply vendor limits. */
4042			if (extc != NULL)
4043				max = rom->ht40_max_pwr[group];
4044			else
4045				max = rom->ht20_max_pwr[group];
4046			max = (max >> (chain * 4)) & 0xf;
4047			if (power[ridx] > max)
4048				power[ridx] = max;
4049		} else if (sc->regulatory == 1) {
4050			if (extc == NULL)
4051				power[ridx] = base->pwr[group][ridx];
4052		} else if (sc->regulatory != 2)
4053			power[ridx] = base->pwr[0][ridx];
4054	}
4055
4056	/* Compute per-CCK rate Tx power. */
4057	cckpow = rom->cck_tx_pwr[chain][group];
4058	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4059		power[ridx] += cckpow;
4060		if (power[ridx] > R92C_MAX_TX_PWR)
4061			power[ridx] = R92C_MAX_TX_PWR;
4062	}
4063
4064	htpow = rom->ht40_1s_tx_pwr[chain][group];
4065	if (sc->ntxchains > 1) {
4066		/* Apply reduction for 2 spatial streams. */
4067		diff = rom->ht40_2s_tx_pwr_diff[group];
4068		diff = (diff >> (chain * 4)) & 0xf;
4069		htpow = (htpow > diff) ? htpow - diff : 0;
4070	}
4071
4072	/* Compute per-OFDM rate Tx power. */
4073	diff = rom->ofdm_tx_pwr_diff[group];
4074	diff = (diff >> (chain * 4)) & 0xf;
4075	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
4076	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4077		power[ridx] += ofdmpow;
4078		if (power[ridx] > R92C_MAX_TX_PWR)
4079			power[ridx] = R92C_MAX_TX_PWR;
4080	}
4081
4082	/* Compute per-MCS Tx power. */
4083	if (extc == NULL) {
4084		diff = rom->ht20_tx_pwr_diff[group];
4085		diff = (diff >> (chain * 4)) & 0xf;
4086		htpow += diff;	/* HT40->HT20 correction. */
4087	}
4088	for (ridx = 12; ridx <= 27; ridx++) {
4089		power[ridx] += htpow;
4090		if (power[ridx] > R92C_MAX_TX_PWR)
4091			power[ridx] = R92C_MAX_TX_PWR;
4092	}
4093#ifdef USB_DEBUG
4094	if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4095		/* Dump per-rate Tx power values. */
4096		printf("Tx power for chain %d:\n", chain);
4097		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4098			printf("Rate %d = %u\n", ridx, power[ridx]);
4099	}
4100#endif
4101}
4102
4103static void
4104urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4105    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4106    uint16_t power[URTWN_RIDX_COUNT])
4107{
4108	struct ieee80211com *ic = &sc->sc_ic;
4109	struct r88e_rom *rom = &sc->rom.r88e_rom;
4110	uint16_t cckpow, ofdmpow, bw20pow, htpow;
4111	const struct urtwn_r88e_txpwr *base;
4112	int ridx, chan, group;
4113
4114	/* Determine channel group. */
4115	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4116	if (chan <= 2)
4117		group = 0;
4118	else if (chan <= 5)
4119		group = 1;
4120	else if (chan <= 8)
4121		group = 2;
4122	else if (chan <= 11)
4123		group = 3;
4124	else if (chan <= 13)
4125		group = 4;
4126	else
4127		group = 5;
4128
4129	/* Get original Tx power based on board type and RF chain. */
4130	base = &rtl8188eu_txagc[chain];
4131
4132	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4133	if (sc->regulatory == 0) {
4134		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4135			power[ridx] = base->pwr[0][ridx];
4136	}
4137	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4138		if (sc->regulatory == 3)
4139			power[ridx] = base->pwr[0][ridx];
4140		else if (sc->regulatory == 1) {
4141			if (extc == NULL)
4142				power[ridx] = base->pwr[group][ridx];
4143		} else if (sc->regulatory != 2)
4144			power[ridx] = base->pwr[0][ridx];
4145	}
4146
4147	/* Compute per-CCK rate Tx power. */
4148	cckpow = rom->cck_tx_pwr[group];
4149	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4150		power[ridx] += cckpow;
4151		if (power[ridx] > R92C_MAX_TX_PWR)
4152			power[ridx] = R92C_MAX_TX_PWR;
4153	}
4154
4155	htpow = rom->ht40_tx_pwr[group];
4156
4157	/* Compute per-OFDM rate Tx power. */
4158	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4159	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4160		power[ridx] += ofdmpow;
4161		if (power[ridx] > R92C_MAX_TX_PWR)
4162			power[ridx] = R92C_MAX_TX_PWR;
4163	}
4164
4165	bw20pow = htpow + sc->bw20_tx_pwr_diff;
4166	for (ridx = 12; ridx <= 27; ridx++) {
4167		power[ridx] += bw20pow;
4168		if (power[ridx] > R92C_MAX_TX_PWR)
4169			power[ridx] = R92C_MAX_TX_PWR;
4170	}
4171}
4172
4173static void
4174urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4175    struct ieee80211_channel *extc)
4176{
4177	uint16_t power[URTWN_RIDX_COUNT];
4178	int i;
4179
4180	for (i = 0; i < sc->ntxchains; i++) {
4181		/* Compute per-rate Tx power values. */
4182		if (sc->chip & URTWN_CHIP_88E)
4183			urtwn_r88e_get_txpower(sc, i, c, extc, power);
4184		else
4185			urtwn_get_txpower(sc, i, c, extc, power);
4186		/* Write per-rate Tx power values to hardware. */
4187		urtwn_write_txpower(sc, i, power);
4188	}
4189}
4190
4191static void
4192urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4193{
4194	uint32_t reg;
4195
4196	reg = urtwn_read_4(sc, R92C_RCR);
4197	if (enable)
4198		reg &= ~R92C_RCR_CBSSID_BCN;
4199	else
4200		reg |= R92C_RCR_CBSSID_BCN;
4201	urtwn_write_4(sc, R92C_RCR, reg);
4202}
4203
4204static void
4205urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4206{
4207	uint32_t reg;
4208
4209	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4210	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4211	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4212
4213	if (!(sc->chip & URTWN_CHIP_88E)) {
4214		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4215		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4216		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4217	}
4218}
4219
4220static void
4221urtwn_scan_start(struct ieee80211com *ic)
4222{
4223	struct urtwn_softc *sc = ic->ic_softc;
4224
4225	URTWN_LOCK(sc);
4226	/* Receive beacons / probe responses from any BSSID. */
4227	if (ic->ic_opmode != IEEE80211_M_IBSS)
4228		urtwn_set_rx_bssid_all(sc, 1);
4229
4230	/* Set gain for scanning. */
4231	urtwn_set_gain(sc, 0x20);
4232	URTWN_UNLOCK(sc);
4233}
4234
4235static void
4236urtwn_scan_end(struct ieee80211com *ic)
4237{
4238	struct urtwn_softc *sc = ic->ic_softc;
4239
4240	URTWN_LOCK(sc);
4241	/* Restore limitations. */
4242	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4243		urtwn_set_rx_bssid_all(sc, 0);
4244
4245	/* Set gain under link. */
4246	urtwn_set_gain(sc, 0x32);
4247	URTWN_UNLOCK(sc);
4248}
4249
4250static void
4251urtwn_set_channel(struct ieee80211com *ic)
4252{
4253	struct urtwn_softc *sc = ic->ic_softc;
4254	struct ieee80211_channel *c = ic->ic_curchan;
4255	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4256
4257	URTWN_LOCK(sc);
4258	if (vap->iv_state == IEEE80211_S_SCAN) {
4259		/* Make link LED blink during scan. */
4260		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4261	}
4262	urtwn_set_chan(sc, c, NULL);
4263	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4264	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4265	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4266	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4267	URTWN_UNLOCK(sc);
4268}
4269
4270static int
4271urtwn_wme_update(struct ieee80211com *ic)
4272{
4273	const struct wmeParams *wmep =
4274	    ic->ic_wme.wme_chanParams.cap_wmeParams;
4275	struct urtwn_softc *sc = ic->ic_softc;
4276	uint8_t aifs, acm, slottime;
4277	int ac;
4278
4279	acm = 0;
4280	slottime = IEEE80211_GET_SLOTTIME(ic);
4281
4282	URTWN_LOCK(sc);
4283	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4284		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4285		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4286		urtwn_write_4(sc, wme2queue[ac].reg,
4287		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4288		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4289		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4290		    SM(R92C_EDCA_PARAM_AIFS, aifs));
4291		if (ac != WME_AC_BE)
4292			acm |= wmep[ac].wmep_acm << ac;
4293	}
4294
4295	if (acm != 0)
4296		acm |= R92C_ACMHWCTRL_EN;
4297	urtwn_write_1(sc, R92C_ACMHWCTRL,
4298	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4299	    acm);
4300
4301	URTWN_UNLOCK(sc);
4302
4303	return 0;
4304}
4305
4306static void
4307urtwn_update_slot(struct ieee80211com *ic)
4308{
4309	urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4310}
4311
4312static void
4313urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4314{
4315	struct ieee80211com *ic = &sc->sc_ic;
4316	uint8_t slottime;
4317
4318	slottime = IEEE80211_GET_SLOTTIME(ic);
4319
4320	URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4321	    __func__, slottime);
4322
4323	urtwn_write_1(sc, R92C_SLOT, slottime);
4324	urtwn_update_aifs(sc, slottime);
4325}
4326
4327static void
4328urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4329{
4330	const struct wmeParams *wmep =
4331	    sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4332	uint8_t aifs, ac;
4333
4334	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4335		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4336		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4337		urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4338        }
4339}
4340
4341static void
4342urtwn_set_promisc(struct urtwn_softc *sc)
4343{
4344	struct ieee80211com *ic = &sc->sc_ic;
4345	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4346	uint32_t rcr, mask1, mask2;
4347
4348	URTWN_ASSERT_LOCKED(sc);
4349
4350	if (vap->iv_opmode == IEEE80211_M_MONITOR)
4351		return;
4352
4353	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4354	mask2 = R92C_RCR_APM;
4355
4356	if (vap->iv_state == IEEE80211_S_RUN) {
4357		switch (vap->iv_opmode) {
4358		case IEEE80211_M_STA:
4359			mask2 |= R92C_RCR_CBSSID_DATA;
4360			/* FALLTHROUGH */
4361		case IEEE80211_M_HOSTAP:
4362			mask2 |= R92C_RCR_CBSSID_BCN;
4363			break;
4364		case IEEE80211_M_IBSS:
4365			mask2 |= R92C_RCR_CBSSID_DATA;
4366			break;
4367		default:
4368			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4369			    __func__, vap->iv_opmode);
4370			return;
4371		}
4372	}
4373
4374	rcr = urtwn_read_4(sc, R92C_RCR);
4375	if (ic->ic_promisc == 0)
4376		rcr = (rcr & ~mask1) | mask2;
4377	else
4378		rcr = (rcr & ~mask2) | mask1;
4379	urtwn_write_4(sc, R92C_RCR, rcr);
4380}
4381
4382static void
4383urtwn_update_promisc(struct ieee80211com *ic)
4384{
4385	struct urtwn_softc *sc = ic->ic_softc;
4386
4387	URTWN_LOCK(sc);
4388	if (sc->sc_flags & URTWN_RUNNING)
4389		urtwn_set_promisc(sc);
4390	URTWN_UNLOCK(sc);
4391}
4392
4393static void
4394urtwn_update_mcast(struct ieee80211com *ic)
4395{
4396	/* XXX do nothing?  */
4397}
4398
4399static struct ieee80211_node *
4400urtwn_r88e_node_alloc(struct ieee80211vap *vap,
4401    const uint8_t mac[IEEE80211_ADDR_LEN])
4402{
4403	struct urtwn_node *un;
4404
4405	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
4406	    M_NOWAIT | M_ZERO);
4407
4408	if (un == NULL)
4409		return NULL;
4410
4411	un->id = URTWN_MACID_UNDEFINED;
4412
4413	return &un->ni;
4414}
4415
4416static void
4417urtwn_r88e_newassoc(struct ieee80211_node *ni, int isnew)
4418{
4419	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4420	struct urtwn_node *un = URTWN_NODE(ni);
4421	uint8_t id;
4422
4423	if (!isnew)
4424		return;
4425
4426	URTWN_NT_LOCK(sc);
4427	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
4428		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
4429			un->id = id;
4430			sc->node_list[id] = ni;
4431			break;
4432		}
4433	}
4434	URTWN_NT_UNLOCK(sc);
4435
4436	if (id > URTWN_MACID_MAX(sc)) {
4437		device_printf(sc->sc_dev, "%s: node table is full\n",
4438		    __func__);
4439	}
4440}
4441
4442static void
4443urtwn_r88e_node_free(struct ieee80211_node *ni)
4444{
4445	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4446	struct urtwn_node *un = URTWN_NODE(ni);
4447
4448	URTWN_NT_LOCK(sc);
4449	if (un->id != URTWN_MACID_UNDEFINED)
4450		sc->node_list[un->id] = NULL;
4451	URTWN_NT_UNLOCK(sc);
4452
4453	sc->sc_node_free(ni);
4454}
4455
4456static void
4457urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
4458    struct ieee80211_channel *extc)
4459{
4460	struct ieee80211com *ic = &sc->sc_ic;
4461	uint32_t reg;
4462	u_int chan;
4463	int i;
4464
4465	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4466	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
4467		device_printf(sc->sc_dev,
4468		    "%s: invalid channel %x\n", __func__, chan);
4469		return;
4470	}
4471
4472	/* Set Tx power for this new channel. */
4473	urtwn_set_txpower(sc, c, extc);
4474
4475	for (i = 0; i < sc->nrxchains; i++) {
4476		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
4477		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
4478	}
4479#ifndef IEEE80211_NO_HT
4480	if (extc != NULL) {
4481		/* Is secondary channel below or above primary? */
4482		int prichlo = c->ic_freq < extc->ic_freq;
4483
4484		urtwn_write_1(sc, R92C_BWOPMODE,
4485		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
4486
4487		reg = urtwn_read_1(sc, R92C_RRSR + 2);
4488		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
4489		urtwn_write_1(sc, R92C_RRSR + 2, reg);
4490
4491		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4492		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
4493		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4494		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
4495
4496		/* Set CCK side band. */
4497		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
4498		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
4499		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
4500
4501		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
4502		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
4503		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
4504
4505		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4506		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
4507		    ~R92C_FPGA0_ANAPARAM2_CBW20);
4508
4509		reg = urtwn_bb_read(sc, 0x818);
4510		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
4511		urtwn_bb_write(sc, 0x818, reg);
4512
4513		/* Select 40MHz bandwidth. */
4514		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4515		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
4516	} else
4517#endif
4518	{
4519		urtwn_write_1(sc, R92C_BWOPMODE,
4520		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
4521
4522		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4523		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
4524		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4525		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
4526
4527		if (!(sc->chip & URTWN_CHIP_88E)) {
4528			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4529			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
4530			    R92C_FPGA0_ANAPARAM2_CBW20);
4531		}
4532
4533		/* Select 20MHz bandwidth. */
4534		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4535		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
4536		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
4537		    R92C_RF_CHNLBW_BW20));
4538	}
4539}
4540
4541static void
4542urtwn_iq_calib(struct urtwn_softc *sc)
4543{
4544	/* TODO */
4545}
4546
4547static void
4548urtwn_lc_calib(struct urtwn_softc *sc)
4549{
4550	uint32_t rf_ac[2];
4551	uint8_t txmode;
4552	int i;
4553
4554	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
4555	if ((txmode & 0x70) != 0) {
4556		/* Disable all continuous Tx. */
4557		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
4558
4559		/* Set RF mode to standby mode. */
4560		for (i = 0; i < sc->nrxchains; i++) {
4561			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
4562			urtwn_rf_write(sc, i, R92C_RF_AC,
4563			    RW(rf_ac[i], R92C_RF_AC_MODE,
4564				R92C_RF_AC_MODE_STANDBY));
4565		}
4566	} else {
4567		/* Block all Tx queues. */
4568		urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
4569	}
4570	/* Start calibration. */
4571	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4572	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
4573
4574	/* Give calibration the time to complete. */
4575	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
4576
4577	/* Restore configuration. */
4578	if ((txmode & 0x70) != 0) {
4579		/* Restore Tx mode. */
4580		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
4581		/* Restore RF mode. */
4582		for (i = 0; i < sc->nrxchains; i++)
4583			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
4584	} else {
4585		/* Unblock all Tx queues. */
4586		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
4587	}
4588}
4589
4590static void
4591urtwn_temp_calib(struct urtwn_softc *sc)
4592{
4593	uint8_t temp;
4594
4595	URTWN_ASSERT_LOCKED(sc);
4596
4597	if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
4598		/* Start measuring temperature. */
4599		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
4600		    "%s: start measuring temperature\n", __func__);
4601		if (sc->chip & URTWN_CHIP_88E) {
4602			urtwn_rf_write(sc, 0, R88E_RF_T_METER,
4603			    R88E_RF_T_METER_START);
4604		} else {
4605			urtwn_rf_write(sc, 0, R92C_RF_T_METER,
4606			    R92C_RF_T_METER_START);
4607		}
4608		sc->sc_flags |= URTWN_TEMP_MEASURED;
4609		return;
4610	}
4611	sc->sc_flags &= ~URTWN_TEMP_MEASURED;
4612
4613	/* Read measured temperature. */
4614	if (sc->chip & URTWN_CHIP_88E) {
4615		temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
4616		    R88E_RF_T_METER_VAL);
4617	} else {
4618		temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
4619		    R92C_RF_T_METER_VAL);
4620	}
4621	if (temp == 0) {	/* Read failed, skip. */
4622		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
4623		    "%s: temperature read failed, skipping\n", __func__);
4624		return;
4625	}
4626
4627	URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
4628	    "%s: temperature: previous %u, current %u\n",
4629	    __func__, sc->thcal_lctemp, temp);
4630
4631	/*
4632	 * Redo LC calibration if temperature changed significantly since
4633	 * last calibration.
4634	 */
4635	if (sc->thcal_lctemp == 0) {
4636		/* First LC calibration is performed in urtwn_init(). */
4637		sc->thcal_lctemp = temp;
4638	} else if (abs(temp - sc->thcal_lctemp) > 1) {
4639		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
4640		    "%s: LC calib triggered by temp: %u -> %u\n",
4641		    __func__, sc->thcal_lctemp, temp);
4642		urtwn_lc_calib(sc);
4643		/* Record temperature of last LC calibration. */
4644		sc->thcal_lctemp = temp;
4645	}
4646}
4647
4648static int
4649urtwn_init(struct urtwn_softc *sc)
4650{
4651	struct ieee80211com *ic = &sc->sc_ic;
4652	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4653	uint8_t macaddr[IEEE80211_ADDR_LEN];
4654	uint32_t reg;
4655	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
4656	int error;
4657
4658	URTWN_LOCK(sc);
4659	if (sc->sc_flags & URTWN_RUNNING) {
4660		URTWN_UNLOCK(sc);
4661		return (0);
4662	}
4663
4664	/* Init firmware commands ring. */
4665	sc->fwcur = 0;
4666
4667	/* Allocate Tx/Rx buffers. */
4668	error = urtwn_alloc_rx_list(sc);
4669	if (error != 0)
4670		goto fail;
4671
4672	error = urtwn_alloc_tx_list(sc);
4673	if (error != 0)
4674		goto fail;
4675
4676	/* Power on adapter. */
4677	error = urtwn_power_on(sc);
4678	if (error != 0)
4679		goto fail;
4680
4681	/* Initialize DMA. */
4682	error = urtwn_dma_init(sc);
4683	if (error != 0)
4684		goto fail;
4685
4686	/* Set info size in Rx descriptors (in 64-bit words). */
4687	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
4688
4689	/* Init interrupts. */
4690	if (sc->chip & URTWN_CHIP_88E) {
4691		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
4692		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4693			goto fail;
4694		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
4695		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
4696		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4697			goto fail;
4698		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
4699		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
4700		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4701			goto fail;
4702		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
4703		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
4704		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
4705		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4706			goto fail;
4707	} else {
4708		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
4709		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4710			goto fail;
4711		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
4712		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4713			goto fail;
4714	}
4715
4716	/* Set MAC address. */
4717	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
4718	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
4719	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4720		goto fail;
4721
4722	/* Set initial network type. */
4723	urtwn_set_mode(sc, R92C_MSR_INFRA);
4724
4725	/* Initialize Rx filter. */
4726	urtwn_rxfilter_init(sc);
4727
4728	/* Set response rate. */
4729	reg = urtwn_read_4(sc, R92C_RRSR);
4730	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
4731	urtwn_write_4(sc, R92C_RRSR, reg);
4732
4733	/* Set short/long retry limits. */
4734	urtwn_write_2(sc, R92C_RL,
4735	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
4736
4737	/* Initialize EDCA parameters. */
4738	urtwn_edca_init(sc);
4739
4740	/* Setup rate fallback. */
4741	if (!(sc->chip & URTWN_CHIP_88E)) {
4742		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
4743		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
4744		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
4745		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
4746	}
4747
4748	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
4749	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
4750	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
4751	/* Set ACK timeout. */
4752	urtwn_write_1(sc, R92C_ACKTO, 0x40);
4753
4754	/* Setup USB aggregation. */
4755	reg = urtwn_read_4(sc, R92C_TDECTRL);
4756	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
4757	urtwn_write_4(sc, R92C_TDECTRL, reg);
4758	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
4759	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
4760	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
4761	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
4762	if (sc->chip & URTWN_CHIP_88E)
4763		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
4764	else {
4765		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
4766		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
4767		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
4768		    R92C_USB_SPECIAL_OPTION_AGG_EN);
4769		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
4770		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
4771	}
4772
4773	/* Initialize beacon parameters. */
4774	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
4775	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
4776	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
4777	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
4778	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
4779
4780	if (!(sc->chip & URTWN_CHIP_88E)) {
4781		/* Setup AMPDU aggregation. */
4782		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
4783		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
4784		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
4785
4786		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
4787	}
4788
4789	/* Load 8051 microcode. */
4790	error = urtwn_load_firmware(sc);
4791	if (error != 0)
4792		goto fail;
4793
4794	/* Initialize MAC/BB/RF blocks. */
4795	error = urtwn_mac_init(sc);
4796	if (error != 0) {
4797		device_printf(sc->sc_dev,
4798		    "%s: error while initializing MAC block\n", __func__);
4799		goto fail;
4800	}
4801	urtwn_bb_init(sc);
4802	urtwn_rf_init(sc);
4803
4804	/* Reinitialize Rx filter (D3845 is not committed yet). */
4805	urtwn_rxfilter_init(sc);
4806
4807	if (sc->chip & URTWN_CHIP_88E) {
4808		urtwn_write_2(sc, R92C_CR,
4809		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
4810		    R92C_CR_MACRXEN);
4811	}
4812
4813	/* Turn CCK and OFDM blocks on. */
4814	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
4815	reg |= R92C_RFMOD_CCK_EN;
4816	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
4817	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4818		goto fail;
4819	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
4820	reg |= R92C_RFMOD_OFDM_EN;
4821	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
4822	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4823		goto fail;
4824
4825	/* Clear per-station keys table. */
4826	urtwn_cam_init(sc);
4827
4828	/* Enable decryption / encryption. */
4829	urtwn_write_2(sc, R92C_SECCFG,
4830	    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
4831	    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
4832	    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
4833
4834	/*
4835	 * Install static keys (if any).
4836	 * Must be called after urtwn_cam_init().
4837	 */
4838	ieee80211_runtask(ic, &sc->cmdq_task);
4839
4840	/* Enable hardware sequence numbering. */
4841	urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
4842
4843	/* Enable per-packet TX report. */
4844	if (sc->chip & URTWN_CHIP_88E) {
4845		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
4846		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
4847	}
4848
4849	/* Perform LO and IQ calibrations. */
4850	urtwn_iq_calib(sc);
4851	/* Perform LC calibration. */
4852	urtwn_lc_calib(sc);
4853
4854	/* Fix USB interference issue. */
4855	if (!(sc->chip & URTWN_CHIP_88E)) {
4856		urtwn_write_1(sc, 0xfe40, 0xe0);
4857		urtwn_write_1(sc, 0xfe41, 0x8d);
4858		urtwn_write_1(sc, 0xfe42, 0x80);
4859
4860		urtwn_pa_bias_init(sc);
4861	}
4862
4863	/* Initialize GPIO setting. */
4864	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
4865	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
4866
4867	/* Fix for lower temperature. */
4868	if (!(sc->chip & URTWN_CHIP_88E))
4869		urtwn_write_1(sc, 0x15, 0xe9);
4870
4871	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
4872
4873	sc->sc_flags |= URTWN_RUNNING;
4874
4875	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
4876fail:
4877	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4878		error = EIO;
4879
4880	URTWN_UNLOCK(sc);
4881
4882	return (error);
4883}
4884
4885static void
4886urtwn_stop(struct urtwn_softc *sc)
4887{
4888
4889	URTWN_LOCK(sc);
4890	if (!(sc->sc_flags & URTWN_RUNNING)) {
4891		URTWN_UNLOCK(sc);
4892		return;
4893	}
4894
4895	sc->sc_flags &= ~(URTWN_RUNNING | URTWN_TEMP_MEASURED);
4896	sc->thcal_lctemp = 0;
4897	callout_stop(&sc->sc_watchdog_ch);
4898	urtwn_abort_xfers(sc);
4899
4900	urtwn_drain_mbufq(sc);
4901	URTWN_UNLOCK(sc);
4902}
4903
4904static void
4905urtwn_abort_xfers(struct urtwn_softc *sc)
4906{
4907	int i;
4908
4909	URTWN_ASSERT_LOCKED(sc);
4910
4911	/* abort any pending transfers */
4912	for (i = 0; i < URTWN_N_TRANSFER; i++)
4913		usbd_transfer_stop(sc->sc_xfer[i]);
4914}
4915
4916static int
4917urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
4918    const struct ieee80211_bpf_params *params)
4919{
4920	struct ieee80211com *ic = ni->ni_ic;
4921	struct urtwn_softc *sc = ic->ic_softc;
4922	struct urtwn_data *bf;
4923	int error;
4924
4925	/* prevent management frames from being sent if we're not ready */
4926	URTWN_LOCK(sc);
4927	if (!(sc->sc_flags & URTWN_RUNNING)) {
4928		error = ENETDOWN;
4929		goto end;
4930	}
4931
4932	bf = urtwn_getbuf(sc);
4933	if (bf == NULL) {
4934		error = ENOBUFS;
4935		goto end;
4936	}
4937
4938	if (params == NULL) {
4939		/*
4940		 * Legacy path; interpret frame contents to decide
4941		 * precisely how to send the frame.
4942		 */
4943		error = urtwn_tx_data(sc, ni, m, bf);
4944	} else {
4945		/*
4946		 * Caller supplied explicit parameters to use in
4947		 * sending the frame.
4948		 */
4949		error = urtwn_tx_raw(sc, ni, m, bf, params);
4950	}
4951	if (error != 0) {
4952		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
4953		goto end;
4954	}
4955
4956	sc->sc_txtimer = 5;
4957	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
4958
4959end:
4960	if (error != 0)
4961		m_freem(m);
4962
4963	URTWN_UNLOCK(sc);
4964
4965	return (error);
4966}
4967
4968static void
4969urtwn_ms_delay(struct urtwn_softc *sc)
4970{
4971	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
4972}
4973
4974static device_method_t urtwn_methods[] = {
4975	/* Device interface */
4976	DEVMETHOD(device_probe,		urtwn_match),
4977	DEVMETHOD(device_attach,	urtwn_attach),
4978	DEVMETHOD(device_detach,	urtwn_detach),
4979
4980	DEVMETHOD_END
4981};
4982
4983static driver_t urtwn_driver = {
4984	"urtwn",
4985	urtwn_methods,
4986	sizeof(struct urtwn_softc)
4987};
4988
4989static devclass_t urtwn_devclass;
4990
4991DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
4992MODULE_DEPEND(urtwn, usb, 1, 1, 1);
4993MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
4994MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
4995MODULE_VERSION(urtwn, 1);
4996USB_PNP_HOST_INFO(urtwn_devs);
4997