if_urtwn.c revision 263153
1139743Simp/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
243412Snewton
343412Snewton/*-
443412Snewton * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
543412Snewton *
643412Snewton * Permission to use, copy, modify, and distribute this software for any
743412Snewton * purpose with or without fee is hereby granted, provided that the above
843412Snewton * copyright notice and this permission notice appear in all copies.
943412Snewton *
1043412Snewton * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
1143412Snewton * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
1243412Snewton * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
1343412Snewton * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
1443412Snewton * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
1543412Snewton * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1643412Snewton * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
1743412Snewton */
1843412Snewton
1943412Snewton#include <sys/cdefs.h>
2043412Snewton__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 263153 2014-03-14 06:37:08Z kevlo $");
2143412Snewton
2243412Snewton/*
2343412Snewton * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188RU/RTL8192CU.
2443412Snewton */
2543412Snewton
2643412Snewton#include <sys/param.h>
2749267Snewton#include <sys/sockio.h>
2850477Speter#include <sys/sysctl.h>
2943412Snewton#include <sys/lock.h>
3043412Snewton#include <sys/mutex.h>
3143412Snewton#include <sys/mbuf.h>
3243412Snewton#include <sys/kernel.h>
3343412Snewton#include <sys/socket.h>
3465302Sobrien#include <sys/systm.h>
3543412Snewton#include <sys/malloc.h>
3643412Snewton#include <sys/module.h>
3743412Snewton#include <sys/bus.h>
3843412Snewton#include <sys/endian.h>
3943412Snewton#include <sys/linker.h>
4043412Snewton#include <sys/firmware.h>
4143412Snewton#include <sys/kdb.h>
4243412Snewton
4343412Snewton#include <machine/bus.h>
4443412Snewton#include <machine/resource.h>
4543412Snewton#include <sys/rman.h>
4643412Snewton
4743412Snewton#include <net/bpf.h>
4843412Snewton#include <net/if.h>
4943412Snewton#include <net/if_var.h>
5043412Snewton#include <net/if_arp.h>
5143412Snewton#include <net/ethernet.h>
5243412Snewton#include <net/if_dl.h>
5343412Snewton#include <net/if_media.h>
5443412Snewton#include <net/if_types.h>
5543412Snewton
5643412Snewton#include <netinet/in.h>
5743412Snewton#include <netinet/in_systm.h>
5843412Snewton#include <netinet/in_var.h>
5943412Snewton#include <netinet/if_ether.h>
6043412Snewton#include <netinet/ip.h>
6143412Snewton
6243412Snewton#include <net80211/ieee80211_var.h>
6343412Snewton#include <net80211/ieee80211_regdomain.h>
6443412Snewton#include <net80211/ieee80211_radiotap.h>
6543412Snewton#include <net80211/ieee80211_ratectl.h>
6643412Snewton
6743412Snewton#include <dev/usb/usb.h>
6843412Snewton#include <dev/usb/usbdi.h>
6943412Snewton#include "usbdevs.h"
7043412Snewton
7143412Snewton#define USB_DEBUG_VAR urtwn_debug
7243412Snewton#include <dev/usb/usb_debug.h>
7343412Snewton
7443412Snewton#include <dev/usb/wlan/if_urtwnreg.h>
7543412Snewton
7643412Snewton#ifdef USB_DEBUG
7743412Snewtonstatic int urtwn_debug = 0;
7843412Snewton
7943412SnewtonSYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
8043412SnewtonSYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
8143412Snewton    "Debug level");
8243412Snewton#endif
8343412Snewton
8443412Snewton#define	URTWN_RSSI(r)  (r) - 110
8543412Snewton#define	IEEE80211_HAS_ADDR4(wh)	\
8643412Snewton	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
8743412Snewton
8843412Snewton/* various supported device vendors/products */
8943412Snewtonstatic const STRUCT_USB_HOST_ID urtwn_devs[] = {
9043412Snewton#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
9143412Snewton	URTWN_DEV(ABOCOM,	RTL8188CU_1),
9243412Snewton	URTWN_DEV(ABOCOM,	RTL8188CU_2),
9343412Snewton	URTWN_DEV(ABOCOM,	RTL8192CU),
9443412Snewton	URTWN_DEV(ASUS,		RTL8192CU),
9543412Snewton	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
9643412Snewton	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
9743412Snewton	URTWN_DEV(AZUREWAVE,	RTL8188CU),
9843412Snewton	URTWN_DEV(BELKIN,	F7D2102),
9943412Snewton	URTWN_DEV(BELKIN,	RTL8188CU),
10043412Snewton	URTWN_DEV(BELKIN,	RTL8192CU),
10143412Snewton	URTWN_DEV(CHICONY,	RTL8188CUS_1),
10243412Snewton	URTWN_DEV(CHICONY,	RTL8188CUS_2),
10343412Snewton	URTWN_DEV(CHICONY,	RTL8188CUS_3),
10443412Snewton	URTWN_DEV(CHICONY,	RTL8188CUS_4),
10543412Snewton	URTWN_DEV(CHICONY,	RTL8188CUS_5),
10643412Snewton	URTWN_DEV(COREGA,	RTL8192CU),
10743412Snewton	URTWN_DEV(DLINK,	RTL8188CU),
10843412Snewton	URTWN_DEV(DLINK,	RTL8192CU_1),
10943412Snewton	URTWN_DEV(DLINK,	RTL8192CU_2),
11043412Snewton	URTWN_DEV(DLINK,	RTL8192CU_3),
11143412Snewton	URTWN_DEV(DLINK,	DWA131B),
11243412Snewton	URTWN_DEV(EDIMAX,	EW7811UN),
11343412Snewton	URTWN_DEV(EDIMAX,	RTL8192CU),
11443412Snewton	URTWN_DEV(FEIXUN,	RTL8188CU),
11543412Snewton	URTWN_DEV(FEIXUN,	RTL8192CU),
11643412Snewton	URTWN_DEV(GUILLEMOT,	HWNUP150),
11743412Snewton	URTWN_DEV(HAWKING,	RTL8192CU),
11843412Snewton	URTWN_DEV(HP3,		RTL8188CU),
11943412Snewton	URTWN_DEV(NETGEAR,	WNA1000M),
12043412Snewton	URTWN_DEV(NETGEAR,	RTL8192CU),
12143412Snewton	URTWN_DEV(NETGEAR4,	RTL8188CU),
12243412Snewton	URTWN_DEV(NOVATECH,	RTL8188CU),
12343412Snewton	URTWN_DEV(PLANEX2,	RTL8188CU_1),
12443412Snewton	URTWN_DEV(PLANEX2,	RTL8188CU_2),
12543412Snewton	URTWN_DEV(PLANEX2,	RTL8188CU_3),
12643412Snewton	URTWN_DEV(PLANEX2,	RTL8188CU_4),
12743412Snewton	URTWN_DEV(PLANEX2,	RTL8188CUS),
12843412Snewton	URTWN_DEV(PLANEX2,	RTL8192CU),
12943412Snewton	URTWN_DEV(REALTEK,	RTL8188CE_0),
13043412Snewton	URTWN_DEV(REALTEK,	RTL8188CE_1),
13143412Snewton	URTWN_DEV(REALTEK,	RTL8188CTV),
13243412Snewton	URTWN_DEV(REALTEK,	RTL8188CU_0),
13343412Snewton	URTWN_DEV(REALTEK,	RTL8188CU_1),
13443412Snewton	URTWN_DEV(REALTEK,	RTL8188CU_2),
135	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
136	URTWN_DEV(REALTEK,	RTL8188CUS),
137	URTWN_DEV(REALTEK,	RTL8188RU_1),
138	URTWN_DEV(REALTEK,	RTL8188RU_2),
139	URTWN_DEV(REALTEK,	RTL8191CU),
140	URTWN_DEV(REALTEK,	RTL8192CE),
141	URTWN_DEV(REALTEK,	RTL8192CU),
142	URTWN_DEV(REALTEK, 	RTL8188CU_0),
143	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
144	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
145	URTWN_DEV(SITECOMEU,	RTL8192CU),
146	URTWN_DEV(TRENDNET,	RTL8188CU),
147	URTWN_DEV(TRENDNET,	RTL8192CU),
148	URTWN_DEV(ZYXEL,	RTL8192CU),
149#undef URTWN_DEV
150};
151
152static device_probe_t	urtwn_match;
153static device_attach_t	urtwn_attach;
154static device_detach_t	urtwn_detach;
155
156static usb_callback_t   urtwn_bulk_tx_callback;
157static usb_callback_t	urtwn_bulk_rx_callback;
158
159static usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
160			    struct usb_device_request *req, void *data);
161static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
162		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
163                    const uint8_t [IEEE80211_ADDR_LEN],
164                    const uint8_t [IEEE80211_ADDR_LEN]);
165static void		urtwn_vap_delete(struct ieee80211vap *);
166static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
167			    int *);
168static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
169			    int *, int8_t *);
170static void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
171static int		urtwn_alloc_list(struct urtwn_softc *,
172			    struct urtwn_data[], int, int);
173static int		urtwn_alloc_rx_list(struct urtwn_softc *);
174static int		urtwn_alloc_tx_list(struct urtwn_softc *);
175static void		urtwn_free_tx_list(struct urtwn_softc *);
176static void		urtwn_free_rx_list(struct urtwn_softc *);
177static void		urtwn_free_list(struct urtwn_softc *,
178			    struct urtwn_data data[], int);
179static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
180static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
181static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
182			    uint8_t *, int);
183static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
184static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
185static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
186static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
187			    uint8_t *, int);
188static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
189static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
190static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
191static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
192			    const void *, int);
193static void		urtwn_rf_write(struct urtwn_softc *, int, uint8_t,
194			    uint32_t);
195static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
196static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
197			    uint32_t);
198static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
199static void		urtwn_efuse_read(struct urtwn_softc *);
200static int		urtwn_read_chipid(struct urtwn_softc *);
201static void		urtwn_read_rom(struct urtwn_softc *);
202static int		urtwn_ra_init(struct urtwn_softc *);
203static void		urtwn_tsf_sync_enable(struct urtwn_softc *);
204static void		urtwn_set_led(struct urtwn_softc *, int, int);
205static int		urtwn_newstate(struct ieee80211vap *,
206			    enum ieee80211_state, int);
207static void		urtwn_watchdog(void *);
208static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
209static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
210static int		urtwn_tx_start(struct urtwn_softc *,
211			    struct ieee80211_node *, struct mbuf *,
212			    struct urtwn_data *);
213static void		urtwn_start(struct ifnet *);
214static void		urtwn_start_locked(struct ifnet *,
215			    struct urtwn_softc *);
216static int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
217static int		urtwn_power_on(struct urtwn_softc *);
218static int		urtwn_llt_init(struct urtwn_softc *);
219static void		urtwn_fw_reset(struct urtwn_softc *);
220static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
221			    const uint8_t *, int);
222static int		urtwn_load_firmware(struct urtwn_softc *);
223static int		urtwn_dma_init(struct urtwn_softc *);
224static void		urtwn_mac_init(struct urtwn_softc *);
225static void		urtwn_bb_init(struct urtwn_softc *);
226static void		urtwn_rf_init(struct urtwn_softc *);
227static void		urtwn_cam_init(struct urtwn_softc *);
228static void		urtwn_pa_bias_init(struct urtwn_softc *);
229static void		urtwn_rxfilter_init(struct urtwn_softc *);
230static void		urtwn_edca_init(struct urtwn_softc *);
231static void		urtwn_write_txpower(struct urtwn_softc *, int,
232			    uint16_t[]);
233static void		urtwn_get_txpower(struct urtwn_softc *, int,
234		      	    struct ieee80211_channel *,
235			    struct ieee80211_channel *, uint16_t[]);
236static void		urtwn_set_txpower(struct urtwn_softc *,
237		    	    struct ieee80211_channel *,
238			    struct ieee80211_channel *);
239static void		urtwn_scan_start(struct ieee80211com *);
240static void		urtwn_scan_end(struct ieee80211com *);
241static void		urtwn_set_channel(struct ieee80211com *);
242static void		urtwn_set_chan(struct urtwn_softc *,
243		    	    struct ieee80211_channel *,
244			    struct ieee80211_channel *);
245static void		urtwn_update_mcast(struct ifnet *);
246static void		urtwn_iq_calib(struct urtwn_softc *);
247static void		urtwn_lc_calib(struct urtwn_softc *);
248static void		urtwn_init(void *);
249static void		urtwn_init_locked(void *);
250static void		urtwn_stop(struct ifnet *);
251static void		urtwn_stop_locked(struct ifnet *);
252static void		urtwn_abort_xfers(struct urtwn_softc *);
253static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
254			    const struct ieee80211_bpf_params *);
255
256/* Aliases. */
257#define	urtwn_bb_write	urtwn_write_4
258#define urtwn_bb_read	urtwn_read_4
259
260static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
261	[URTWN_BULK_RX] = {
262		.type = UE_BULK,
263		.endpoint = UE_ADDR_ANY,
264		.direction = UE_DIR_IN,
265		.bufsize = URTWN_RXBUFSZ,
266		.flags = {
267			.pipe_bof = 1,
268			.short_xfer_ok = 1
269		},
270		.callback = urtwn_bulk_rx_callback,
271	},
272	[URTWN_BULK_TX_BE] = {
273		.type = UE_BULK,
274		.endpoint = 0x03,
275		.direction = UE_DIR_OUT,
276		.bufsize = URTWN_TXBUFSZ,
277		.flags = {
278			.ext_buffer = 1,
279			.pipe_bof = 1,
280			.force_short_xfer = 1
281		},
282		.callback = urtwn_bulk_tx_callback,
283		.timeout = URTWN_TX_TIMEOUT,	/* ms */
284	},
285	[URTWN_BULK_TX_BK] = {
286		.type = UE_BULK,
287		.endpoint = 0x03,
288		.direction = UE_DIR_OUT,
289		.bufsize = URTWN_TXBUFSZ,
290		.flags = {
291			.ext_buffer = 1,
292			.pipe_bof = 1,
293			.force_short_xfer = 1,
294		},
295		.callback = urtwn_bulk_tx_callback,
296		.timeout = URTWN_TX_TIMEOUT,	/* ms */
297	},
298	[URTWN_BULK_TX_VI] = {
299		.type = UE_BULK,
300		.endpoint = 0x02,
301		.direction = UE_DIR_OUT,
302		.bufsize = URTWN_TXBUFSZ,
303		.flags = {
304			.ext_buffer = 1,
305			.pipe_bof = 1,
306			.force_short_xfer = 1
307		},
308		.callback = urtwn_bulk_tx_callback,
309		.timeout = URTWN_TX_TIMEOUT,	/* ms */
310	},
311	[URTWN_BULK_TX_VO] = {
312		.type = UE_BULK,
313		.endpoint = 0x02,
314		.direction = UE_DIR_OUT,
315		.bufsize = URTWN_TXBUFSZ,
316		.flags = {
317			.ext_buffer = 1,
318			.pipe_bof = 1,
319			.force_short_xfer = 1
320		},
321		.callback = urtwn_bulk_tx_callback,
322		.timeout = URTWN_TX_TIMEOUT,	/* ms */
323	},
324};
325
326static int
327urtwn_match(device_t self)
328{
329	struct usb_attach_arg *uaa = device_get_ivars(self);
330
331	if (uaa->usb_mode != USB_MODE_HOST)
332		return (ENXIO);
333	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
334		return (ENXIO);
335	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
336		return (ENXIO);
337
338	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
339}
340
341static int
342urtwn_attach(device_t self)
343{
344	struct usb_attach_arg *uaa = device_get_ivars(self);
345	struct urtwn_softc *sc = device_get_softc(self);
346	struct ifnet *ifp;
347	struct ieee80211com *ic;
348	uint8_t iface_index, bands;
349	int error;
350
351	device_set_usb_desc(self);
352	sc->sc_udev = uaa->device;
353	sc->sc_dev = self;
354
355	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
356	    MTX_NETWORK_LOCK, MTX_DEF);
357	callout_init(&sc->sc_watchdog_ch, 0);
358
359	iface_index = URTWN_IFACE_INDEX;
360	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
361	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
362	if (error) {
363		device_printf(self, "could not allocate USB transfers, "
364		    "err=%s\n", usbd_errstr(error));
365		goto detach;
366	}
367
368	URTWN_LOCK(sc);
369
370	error = urtwn_read_chipid(sc);
371	if (error) {
372		device_printf(sc->sc_dev, "unsupported test chip\n");
373		URTWN_UNLOCK(sc);
374		goto detach;
375	}
376
377	/* Determine number of Tx/Rx chains. */
378	if (sc->chip & URTWN_CHIP_92C) {
379		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
380		sc->nrxchains = 2;
381	} else {
382		sc->ntxchains = 1;
383		sc->nrxchains = 1;
384	}
385	urtwn_read_rom(sc);
386
387	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
388	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
389	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
390	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
391	    "8188CUS", sc->ntxchains, sc->nrxchains);
392
393	URTWN_UNLOCK(sc);
394
395	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
396	if (ifp == NULL) {
397		device_printf(sc->sc_dev, "can not if_alloc()\n");
398		goto detach;
399	}
400	ic = ifp->if_l2com;
401
402	ifp->if_softc = sc;
403	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
404	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
405	ifp->if_init = urtwn_init;
406	ifp->if_ioctl = urtwn_ioctl;
407	ifp->if_start = urtwn_start;
408	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
409	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
410	IFQ_SET_READY(&ifp->if_snd);
411
412	ic->ic_ifp = ifp;
413	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
414	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
415
416	/* set device capabilities */
417	ic->ic_caps =
418		  IEEE80211_C_STA		/* station mode */
419		| IEEE80211_C_MONITOR		/* monitor mode */
420		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
421		| IEEE80211_C_SHSLOT		/* short slot time supported */
422		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
423		| IEEE80211_C_WPA		/* 802.11i */
424		;
425
426	bands = 0;
427	setbit(&bands, IEEE80211_MODE_11B);
428	setbit(&bands, IEEE80211_MODE_11G);
429	ieee80211_init_channels(ic, NULL, &bands);
430
431	ieee80211_ifattach(ic, sc->sc_bssid);
432	ic->ic_raw_xmit = urtwn_raw_xmit;
433	ic->ic_scan_start = urtwn_scan_start;
434	ic->ic_scan_end = urtwn_scan_end;
435	ic->ic_set_channel = urtwn_set_channel;
436
437	ic->ic_vap_create = urtwn_vap_create;
438	ic->ic_vap_delete = urtwn_vap_delete;
439	ic->ic_update_mcast = urtwn_update_mcast;
440
441	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
442	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
443	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
444	    URTWN_RX_RADIOTAP_PRESENT);
445
446	if (bootverbose)
447		ieee80211_announce(ic);
448
449	return (0);
450
451detach:
452	urtwn_detach(self);
453	return (ENXIO);			/* failure */
454}
455
456static int
457urtwn_detach(device_t self)
458{
459	struct urtwn_softc *sc = device_get_softc(self);
460	struct ifnet *ifp = sc->sc_ifp;
461	struct ieee80211com *ic = ifp->if_l2com;
462	unsigned int x;
463
464	/* Prevent further ioctls. */
465	URTWN_LOCK(sc);
466	sc->sc_flags |= URTWN_DETACHED;
467	URTWN_UNLOCK(sc);
468
469	urtwn_stop(ifp);
470
471	callout_drain(&sc->sc_watchdog_ch);
472
473	/* Prevent further allocations from RX/TX data lists. */
474	URTWN_LOCK(sc);
475	STAILQ_INIT(&sc->sc_tx_active);
476	STAILQ_INIT(&sc->sc_tx_inactive);
477	STAILQ_INIT(&sc->sc_tx_pending);
478
479	STAILQ_INIT(&sc->sc_rx_active);
480	STAILQ_INIT(&sc->sc_rx_inactive);
481	URTWN_UNLOCK(sc);
482
483	/* drain USB transfers */
484	for (x = 0; x != URTWN_N_TRANSFER; x++)
485		usbd_transfer_drain(sc->sc_xfer[x]);
486
487	/* Free data buffers. */
488	URTWN_LOCK(sc);
489	urtwn_free_tx_list(sc);
490	urtwn_free_rx_list(sc);
491	URTWN_UNLOCK(sc);
492
493	/* stop all USB transfers */
494	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
495	ieee80211_ifdetach(ic);
496
497	if_free(ifp);
498	mtx_destroy(&sc->sc_mtx);
499
500	return (0);
501}
502
503static void
504urtwn_free_tx_list(struct urtwn_softc *sc)
505{
506	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
507}
508
509static void
510urtwn_free_rx_list(struct urtwn_softc *sc)
511{
512	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
513}
514
515static void
516urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
517{
518	int i;
519
520	for (i = 0; i < ndata; i++) {
521		struct urtwn_data *dp = &data[i];
522
523		if (dp->buf != NULL) {
524			free(dp->buf, M_USBDEV);
525			dp->buf = NULL;
526		}
527		if (dp->ni != NULL) {
528			ieee80211_free_node(dp->ni);
529			dp->ni = NULL;
530		}
531	}
532}
533
534static usb_error_t
535urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
536    void *data)
537{
538	usb_error_t err;
539	int ntries = 10;
540
541	URTWN_ASSERT_LOCKED(sc);
542
543	while (ntries--) {
544		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
545		    req, data, 0, NULL, 250 /* ms */);
546		if (err == 0)
547			break;
548
549		DPRINTFN(1, "Control request failed, %s (retrying)\n",
550		    usbd_errstr(err));
551		usb_pause_mtx(&sc->sc_mtx, hz / 100);
552	}
553	return (err);
554}
555
556static struct ieee80211vap *
557urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
558    enum ieee80211_opmode opmode, int flags,
559    const uint8_t bssid[IEEE80211_ADDR_LEN],
560    const uint8_t mac[IEEE80211_ADDR_LEN])
561{
562	struct urtwn_vap *uvp;
563	struct ieee80211vap *vap;
564
565	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
566		return (NULL);
567
568	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
569	    M_80211_VAP, M_NOWAIT | M_ZERO);
570	if (uvp == NULL)
571		return (NULL);
572	vap = &uvp->vap;
573	/* enable s/w bmiss handling for sta mode */
574
575	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
576	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
577		/* out of memory */
578		free(uvp, M_80211_VAP);
579		return (NULL);
580	}
581
582	/* override state transition machine */
583	uvp->newstate = vap->iv_newstate;
584	vap->iv_newstate = urtwn_newstate;
585
586	/* complete setup */
587	ieee80211_vap_attach(vap, ieee80211_media_change,
588	    ieee80211_media_status);
589	ic->ic_opmode = opmode;
590	return (vap);
591}
592
593static void
594urtwn_vap_delete(struct ieee80211vap *vap)
595{
596	struct urtwn_vap *uvp = URTWN_VAP(vap);
597
598	ieee80211_vap_detach(vap);
599	free(uvp, M_80211_VAP);
600}
601
602static struct mbuf *
603urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
604{
605	struct ifnet *ifp = sc->sc_ifp;
606	struct ieee80211com *ic = ifp->if_l2com;
607	struct ieee80211_frame *wh;
608	struct mbuf *m;
609	struct r92c_rx_stat *stat;
610	uint32_t rxdw0, rxdw3;
611	uint8_t rate;
612	int8_t rssi = 0;
613	int infosz;
614
615	/*
616	 * don't pass packets to the ieee80211 framework if the driver isn't
617	 * RUNNING.
618	 */
619	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
620		return (NULL);
621
622	stat = (struct r92c_rx_stat *)buf;
623	rxdw0 = le32toh(stat->rxdw0);
624	rxdw3 = le32toh(stat->rxdw3);
625
626	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
627		/*
628		 * This should not happen since we setup our Rx filter
629		 * to not receive these frames.
630		 */
631		ifp->if_ierrors++;
632		return (NULL);
633	}
634
635	rate = MS(rxdw3, R92C_RXDW3_RATE);
636	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
637
638	/* Get RSSI from PHY status descriptor if present. */
639	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
640		rssi = urtwn_get_rssi(sc, rate, &stat[1]);
641		/* Update our average RSSI. */
642		urtwn_update_avgrssi(sc, rate, rssi);
643		/*
644		 * Convert the RSSI to a range that will be accepted
645		 * by net80211.
646		 */
647		rssi = URTWN_RSSI(rssi);
648	}
649
650	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
651	if (m == NULL) {
652		device_printf(sc->sc_dev, "could not create RX mbuf\n");
653		return (NULL);
654	}
655
656	/* Finalize mbuf. */
657	m->m_pkthdr.rcvif = ifp;
658	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
659	memcpy(mtod(m, uint8_t *), wh, pktlen);
660	m->m_pkthdr.len = m->m_len = pktlen;
661
662	if (ieee80211_radiotap_active(ic)) {
663		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
664
665		tap->wr_flags = 0;
666		/* Map HW rate index to 802.11 rate. */
667		if (!(rxdw3 & R92C_RXDW3_HT)) {
668			switch (rate) {
669			/* CCK. */
670			case  0: tap->wr_rate =   2; break;
671			case  1: tap->wr_rate =   4; break;
672			case  2: tap->wr_rate =  11; break;
673			case  3: tap->wr_rate =  22; break;
674			/* OFDM. */
675			case  4: tap->wr_rate =  12; break;
676			case  5: tap->wr_rate =  18; break;
677			case  6: tap->wr_rate =  24; break;
678			case  7: tap->wr_rate =  36; break;
679			case  8: tap->wr_rate =  48; break;
680			case  9: tap->wr_rate =  72; break;
681			case 10: tap->wr_rate =  96; break;
682			case 11: tap->wr_rate = 108; break;
683			}
684		} else if (rate >= 12) {	/* MCS0~15. */
685			/* Bit 7 set means HT MCS instead of rate. */
686			tap->wr_rate = 0x80 | (rate - 12);
687		}
688		tap->wr_dbm_antsignal = rssi;
689		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
690		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
691	}
692
693	*rssi_p = rssi;
694
695	return (m);
696}
697
698static struct mbuf *
699urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
700    int8_t *nf)
701{
702	struct urtwn_softc *sc = data->sc;
703	struct ifnet *ifp = sc->sc_ifp;
704	struct r92c_rx_stat *stat;
705	struct mbuf *m, *m0 = NULL, *prevm = NULL;
706	uint32_t rxdw0;
707	uint8_t *buf;
708	int len, totlen, pktlen, infosz, npkts;
709
710	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
711
712	if (len < sizeof(*stat)) {
713		ifp->if_ierrors++;
714		return (NULL);
715	}
716
717	buf = data->buf;
718	/* Get the number of encapsulated frames. */
719	stat = (struct r92c_rx_stat *)buf;
720	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
721	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
722
723	/* Process all of them. */
724	while (npkts-- > 0) {
725		if (len < sizeof(*stat))
726			break;
727		stat = (struct r92c_rx_stat *)buf;
728		rxdw0 = le32toh(stat->rxdw0);
729
730		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
731		if (pktlen == 0)
732			break;
733
734		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
735
736		/* Make sure everything fits in xfer. */
737		totlen = sizeof(*stat) + infosz + pktlen;
738		if (totlen > len)
739			break;
740
741		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
742		if (m0 == NULL)
743			m0 = m;
744		if (prevm == NULL)
745			prevm = m;
746		else {
747			prevm->m_next = m;
748			prevm = m;
749		}
750
751		/* Next chunk is 128-byte aligned. */
752		totlen = (totlen + 127) & ~127;
753		buf += totlen;
754		len -= totlen;
755	}
756
757	return (m0);
758}
759
760static void
761urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
762{
763	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
764	struct ifnet *ifp = sc->sc_ifp;
765	struct ieee80211com *ic = ifp->if_l2com;
766	struct ieee80211_frame *wh;
767	struct ieee80211_node *ni;
768	struct mbuf *m = NULL, *next;
769	struct urtwn_data *data;
770	int8_t nf;
771	int rssi = 1;
772
773	URTWN_ASSERT_LOCKED(sc);
774
775	switch (USB_GET_STATE(xfer)) {
776	case USB_ST_TRANSFERRED:
777		data = STAILQ_FIRST(&sc->sc_rx_active);
778		if (data == NULL)
779			goto tr_setup;
780		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
781		m = urtwn_rxeof(xfer, data, &rssi, &nf);
782		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
783		/* FALLTHROUGH */
784	case USB_ST_SETUP:
785tr_setup:
786		data = STAILQ_FIRST(&sc->sc_rx_inactive);
787		if (data == NULL) {
788			KASSERT(m == NULL, ("mbuf isn't NULL"));
789			return;
790		}
791		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
792		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
793		usbd_xfer_set_frame_data(xfer, 0, data->buf,
794		    usbd_xfer_max_len(xfer));
795		usbd_transfer_submit(xfer);
796
797		/*
798		 * To avoid LOR we should unlock our private mutex here to call
799		 * ieee80211_input() because here is at the end of a USB
800		 * callback and safe to unlock.
801		 */
802		URTWN_UNLOCK(sc);
803		while (m != NULL) {
804			next = m->m_next;
805			m->m_next = NULL;
806			wh = mtod(m, struct ieee80211_frame *);
807			ni = ieee80211_find_rxnode(ic,
808			    (struct ieee80211_frame_min *)wh);
809			nf = URTWN_NOISE_FLOOR;
810			if (ni != NULL) {
811				(void)ieee80211_input(ni, m, rssi, nf);
812				ieee80211_free_node(ni);
813			} else
814				(void)ieee80211_input_all(ic, m, rssi, nf);
815			m = next;
816		}
817		URTWN_LOCK(sc);
818		break;
819	default:
820		/* needs it to the inactive queue due to a error. */
821		data = STAILQ_FIRST(&sc->sc_rx_active);
822		if (data != NULL) {
823			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
824			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
825		}
826		if (error != USB_ERR_CANCELLED) {
827			usbd_xfer_set_stall(xfer);
828			ifp->if_ierrors++;
829			goto tr_setup;
830		}
831		break;
832	}
833}
834
835static void
836urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
837{
838	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
839	struct ifnet *ifp = sc->sc_ifp;
840	struct mbuf *m;
841
842	URTWN_ASSERT_LOCKED(sc);
843
844	/*
845	 * Do any tx complete callback.  Note this must be done before releasing
846	 * the node reference.
847	 */
848	if (data->m) {
849		m = data->m;
850		if (m->m_flags & M_TXCB) {
851			/* XXX status? */
852			ieee80211_process_callback(data->ni, m, 0);
853		}
854		m_freem(m);
855		data->m = NULL;
856	}
857	if (data->ni) {
858		ieee80211_free_node(data->ni);
859		data->ni = NULL;
860	}
861	sc->sc_txtimer = 0;
862	ifp->if_opackets++;
863	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
864}
865
866static void
867urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
868{
869	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
870	struct ifnet *ifp = sc->sc_ifp;
871	struct urtwn_data *data;
872
873	URTWN_ASSERT_LOCKED(sc);
874
875	switch (USB_GET_STATE(xfer)){
876	case USB_ST_TRANSFERRED:
877		data = STAILQ_FIRST(&sc->sc_tx_active);
878		if (data == NULL)
879			goto tr_setup;
880		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
881		urtwn_txeof(xfer, data);
882		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
883		/* FALLTHROUGH */
884	case USB_ST_SETUP:
885tr_setup:
886		data = STAILQ_FIRST(&sc->sc_tx_pending);
887		if (data == NULL) {
888			DPRINTF("%s: empty pending queue\n", __func__);
889			return;
890		}
891		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
892		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
893		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
894		usbd_transfer_submit(xfer);
895		urtwn_start_locked(ifp, sc);
896		break;
897	default:
898		data = STAILQ_FIRST(&sc->sc_tx_active);
899		if (data == NULL)
900			goto tr_setup;
901		if (data->ni != NULL) {
902			ieee80211_free_node(data->ni);
903			data->ni = NULL;
904			ifp->if_oerrors++;
905		}
906		if (error != USB_ERR_CANCELLED) {
907			usbd_xfer_set_stall(xfer);
908			goto tr_setup;
909		}
910		break;
911	}
912}
913
914static struct urtwn_data *
915_urtwn_getbuf(struct urtwn_softc *sc)
916{
917	struct urtwn_data *bf;
918
919	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
920	if (bf != NULL)
921		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
922	else
923		bf = NULL;
924	if (bf == NULL)
925		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
926	return (bf);
927}
928
929static struct urtwn_data *
930urtwn_getbuf(struct urtwn_softc *sc)
931{
932        struct urtwn_data *bf;
933
934	URTWN_ASSERT_LOCKED(sc);
935
936	bf = _urtwn_getbuf(sc);
937	if (bf == NULL) {
938		struct ifnet *ifp = sc->sc_ifp;
939		DPRINTF("%s: stop queue\n", __func__);
940		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
941	}
942	return (bf);
943}
944
945static int
946urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
947    int len)
948{
949	usb_device_request_t req;
950
951	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
952	req.bRequest = R92C_REQ_REGS;
953	USETW(req.wValue, addr);
954	USETW(req.wIndex, 0);
955	USETW(req.wLength, len);
956	return (urtwn_do_request(sc, &req, buf));
957}
958
959static void
960urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
961{
962	urtwn_write_region_1(sc, addr, &val, 1);
963}
964
965
966static void
967urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
968{
969	val = htole16(val);
970	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
971}
972
973static void
974urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
975{
976	val = htole32(val);
977	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
978}
979
980static int
981urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
982    int len)
983{
984	usb_device_request_t req;
985
986	req.bmRequestType = UT_READ_VENDOR_DEVICE;
987	req.bRequest = R92C_REQ_REGS;
988	USETW(req.wValue, addr);
989	USETW(req.wIndex, 0);
990	USETW(req.wLength, len);
991	return (urtwn_do_request(sc, &req, buf));
992}
993
994static uint8_t
995urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
996{
997	uint8_t val;
998
999	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1000		return (0xff);
1001	return (val);
1002}
1003
1004static uint16_t
1005urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1006{
1007	uint16_t val;
1008
1009	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1010		return (0xffff);
1011	return (le16toh(val));
1012}
1013
1014static uint32_t
1015urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1016{
1017	uint32_t val;
1018
1019	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1020		return (0xffffffff);
1021	return (le32toh(val));
1022}
1023
1024static int
1025urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1026{
1027	struct r92c_fw_cmd cmd;
1028	int ntries;
1029
1030	/* Wait for current FW box to be empty. */
1031	for (ntries = 0; ntries < 100; ntries++) {
1032		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1033			break;
1034		DELAY(1);
1035	}
1036	if (ntries == 100) {
1037		device_printf(sc->sc_dev,
1038		    "could not send firmware command\n");
1039		return (ETIMEDOUT);
1040	}
1041	memset(&cmd, 0, sizeof(cmd));
1042	cmd.id = id;
1043	if (len > 3)
1044		cmd.id |= R92C_CMD_FLAG_EXT;
1045	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1046	memcpy(cmd.msg, buf, len);
1047
1048	/* Write the first word last since that will trigger the FW. */
1049	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1050	    (uint8_t *)&cmd + 4, 2);
1051	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1052	    (uint8_t *)&cmd + 0, 4);
1053
1054	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1055	return (0);
1056}
1057
1058static void
1059urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1060{
1061	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1062	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1063	    SM(R92C_LSSI_PARAM_DATA, val));
1064}
1065
1066static uint32_t
1067urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1068{
1069	uint32_t reg[R92C_MAX_CHAINS], val;
1070
1071	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1072	if (chain != 0)
1073		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1074
1075	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1076	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1077	DELAY(1000);
1078
1079	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1080	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1081	    R92C_HSSI_PARAM2_READ_EDGE);
1082	DELAY(1000);
1083
1084	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1085	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1086	DELAY(1000);
1087
1088	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1089		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1090	else
1091		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1092	return (MS(val, R92C_LSSI_READBACK_DATA));
1093}
1094
1095static int
1096urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1097{
1098	int ntries;
1099
1100	urtwn_write_4(sc, R92C_LLT_INIT,
1101	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1102	    SM(R92C_LLT_INIT_ADDR, addr) |
1103	    SM(R92C_LLT_INIT_DATA, data));
1104	/* Wait for write operation to complete. */
1105	for (ntries = 0; ntries < 20; ntries++) {
1106		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1107		    R92C_LLT_INIT_OP_NO_ACTIVE)
1108			return (0);
1109		DELAY(5);
1110	}
1111	return (ETIMEDOUT);
1112}
1113
1114static uint8_t
1115urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1116{
1117	uint32_t reg;
1118	int ntries;
1119
1120	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1121	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1122	reg &= ~R92C_EFUSE_CTRL_VALID;
1123	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1124	/* Wait for read operation to complete. */
1125	for (ntries = 0; ntries < 100; ntries++) {
1126		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1127		if (reg & R92C_EFUSE_CTRL_VALID)
1128			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1129		DELAY(5);
1130	}
1131	device_printf(sc->sc_dev,
1132	    "could not read efuse byte at address 0x%x\n", addr);
1133	return (0xff);
1134}
1135
1136static void
1137urtwn_efuse_read(struct urtwn_softc *sc)
1138{
1139	uint8_t *rom = (uint8_t *)&sc->rom;
1140	uint16_t addr = 0;
1141	uint32_t reg;
1142	uint8_t off, msk;
1143	int i;
1144
1145	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1146	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1147		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1148		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1149	}
1150	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1151	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1152		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1153		    reg | R92C_SYS_FUNC_EN_ELDR);
1154	}
1155	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1156	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1157	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1158		urtwn_write_2(sc, R92C_SYS_CLKR,
1159		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1160	}
1161	memset(&sc->rom, 0xff, sizeof(sc->rom));
1162	while (addr < 512) {
1163		reg = urtwn_efuse_read_1(sc, addr);
1164		if (reg == 0xff)
1165			break;
1166		addr++;
1167		off = reg >> 4;
1168		msk = reg & 0xf;
1169		for (i = 0; i < 4; i++) {
1170			if (msk & (1 << i))
1171				continue;
1172			rom[off * 8 + i * 2 + 0] =
1173			    urtwn_efuse_read_1(sc, addr);
1174			addr++;
1175			rom[off * 8 + i * 2 + 1] =
1176			    urtwn_efuse_read_1(sc, addr);
1177			addr++;
1178		}
1179	}
1180#ifdef URTWN_DEBUG
1181	if (urtwn_debug >= 2) {
1182		/* Dump ROM content. */
1183		printf("\n");
1184		for (i = 0; i < sizeof(sc->rom); i++)
1185			printf("%02x:", rom[i]);
1186		printf("\n");
1187	}
1188#endif
1189}
1190
1191static int
1192urtwn_read_chipid(struct urtwn_softc *sc)
1193{
1194	uint32_t reg;
1195
1196	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1197	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1198		return (EIO);
1199
1200	if (reg & R92C_SYS_CFG_TYPE_92C) {
1201		sc->chip |= URTWN_CHIP_92C;
1202		/* Check if it is a castrated 8192C. */
1203		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1204		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1205		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1206			sc->chip |= URTWN_CHIP_92C_1T2R;
1207	}
1208	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1209		sc->chip |= URTWN_CHIP_UMC;
1210		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1211			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1212	}
1213	return (0);
1214}
1215
1216static void
1217urtwn_read_rom(struct urtwn_softc *sc)
1218{
1219	struct r92c_rom *rom = &sc->rom;
1220
1221	/* Read full ROM image. */
1222	urtwn_efuse_read(sc);
1223
1224	/* XXX Weird but this is what the vendor driver does. */
1225	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1226	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1227
1228	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1229
1230	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1231	DPRINTF("regulatory type=%d\n", sc->regulatory);
1232
1233	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1234}
1235
1236/*
1237 * Initialize rate adaptation in firmware.
1238 */
1239static int
1240urtwn_ra_init(struct urtwn_softc *sc)
1241{
1242	static const uint8_t map[] =
1243	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1244	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1245	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1246	struct ieee80211_node *ni;
1247	struct ieee80211_rateset *rs;
1248	struct r92c_fw_cmd_macid_cfg cmd;
1249	uint32_t rates, basicrates;
1250	uint8_t mode;
1251	int maxrate, maxbasicrate, error, i, j;
1252
1253	ni = ieee80211_ref_node(vap->iv_bss);
1254	rs = &ni->ni_rates;
1255
1256	/* Get normal and basic rates mask. */
1257	rates = basicrates = 0;
1258	maxrate = maxbasicrate = 0;
1259	for (i = 0; i < rs->rs_nrates; i++) {
1260		/* Convert 802.11 rate to HW rate index. */
1261		for (j = 0; j < nitems(map); j++)
1262			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1263				break;
1264		if (j == nitems(map))	/* Unknown rate, skip. */
1265			continue;
1266		rates |= 1 << j;
1267		if (j > maxrate)
1268			maxrate = j;
1269		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1270			basicrates |= 1 << j;
1271			if (j > maxbasicrate)
1272				maxbasicrate = j;
1273		}
1274	}
1275	if (ic->ic_curmode == IEEE80211_MODE_11B)
1276		mode = R92C_RAID_11B;
1277	else
1278		mode = R92C_RAID_11BG;
1279	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1280	    mode, rates, basicrates);
1281
1282	/* Set rates mask for group addressed frames. */
1283	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1284	cmd.mask = htole32(mode << 28 | basicrates);
1285	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1286	if (error != 0) {
1287		ieee80211_free_node(ni);
1288		device_printf(sc->sc_dev,
1289		    "could not add broadcast station\n");
1290		return (error);
1291	}
1292	/* Set initial MRR rate. */
1293	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1294	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1295	    maxbasicrate);
1296
1297	/* Set rates mask for unicast frames. */
1298	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1299	cmd.mask = htole32(mode << 28 | rates);
1300	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1301	if (error != 0) {
1302		ieee80211_free_node(ni);
1303		device_printf(sc->sc_dev, "could not add BSS station\n");
1304		return (error);
1305	}
1306	/* Set initial MRR rate. */
1307	DPRINTF("maxrate=%d\n", maxrate);
1308	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1309	    maxrate);
1310
1311	/* Indicate highest supported rate. */
1312	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1313	ieee80211_free_node(ni);
1314
1315	return (0);
1316}
1317
1318void
1319urtwn_tsf_sync_enable(struct urtwn_softc *sc)
1320{
1321	struct ifnet *ifp = sc->sc_ifp;
1322	struct ieee80211com *ic = ifp->if_l2com;
1323	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1324	struct ieee80211_node *ni = vap->iv_bss;
1325
1326	uint64_t tsf;
1327
1328	/* Enable TSF synchronization. */
1329	urtwn_write_1(sc, R92C_BCN_CTRL,
1330	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1331
1332	urtwn_write_1(sc, R92C_BCN_CTRL,
1333	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1334
1335	/* Set initial TSF. */
1336	memcpy(&tsf, ni->ni_tstamp.data, 8);
1337	tsf = le64toh(tsf);
1338	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1339	tsf -= IEEE80211_DUR_TU;
1340	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1341	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1342
1343	urtwn_write_1(sc, R92C_BCN_CTRL,
1344	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1345}
1346
1347static void
1348urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1349{
1350	uint8_t reg;
1351
1352	if (led == URTWN_LED_LINK) {
1353		reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1354		if (!on)
1355			reg |= R92C_LEDCFG0_DIS;
1356		urtwn_write_1(sc, R92C_LEDCFG0, reg);
1357		sc->ledlink = on;	/* Save LED state. */
1358	}
1359}
1360
1361static int
1362urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1363{
1364	struct urtwn_vap *uvp = URTWN_VAP(vap);
1365	struct ieee80211com *ic = vap->iv_ic;
1366	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1367	struct ieee80211_node *ni;
1368	enum ieee80211_state ostate;
1369	uint32_t reg;
1370
1371	ostate = vap->iv_state;
1372	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1373	    ieee80211_state_name[nstate]);
1374
1375	IEEE80211_UNLOCK(ic);
1376	URTWN_LOCK(sc);
1377	callout_stop(&sc->sc_watchdog_ch);
1378
1379	if (ostate == IEEE80211_S_RUN) {
1380		/* Turn link LED off. */
1381		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1382
1383		/* Set media status to 'No Link'. */
1384		reg = urtwn_read_4(sc, R92C_CR);
1385		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1386		urtwn_write_4(sc, R92C_CR, reg);
1387
1388		/* Stop Rx of data frames. */
1389		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1390
1391		/* Rest TSF. */
1392		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1393
1394		/* Disable TSF synchronization. */
1395		urtwn_write_1(sc, R92C_BCN_CTRL,
1396		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1397		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1398
1399		/* Reset EDCA parameters. */
1400		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1401		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1402		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1403		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1404	}
1405
1406	switch (nstate) {
1407	case IEEE80211_S_INIT:
1408		/* Turn link LED off. */
1409		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1410		break;
1411	case IEEE80211_S_SCAN:
1412		if (ostate != IEEE80211_S_SCAN) {
1413			/* Allow Rx from any BSSID. */
1414			urtwn_write_4(sc, R92C_RCR,
1415			    urtwn_read_4(sc, R92C_RCR) &
1416			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1417
1418			/* Set gain for scanning. */
1419			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1420			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1421			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1422
1423			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1424			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1425			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1426		}
1427
1428		/* Make link LED blink during scan. */
1429		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
1430
1431		/* Pause AC Tx queues. */
1432		urtwn_write_1(sc, R92C_TXPAUSE,
1433		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1434
1435		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1436		break;
1437	case IEEE80211_S_AUTH:
1438		/* Set initial gain under link. */
1439		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1440		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1441		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1442
1443		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1444		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1445		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1446
1447		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1448		break;
1449	case IEEE80211_S_RUN:
1450		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1451			/* Enable Rx of data frames. */
1452			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1453
1454			/* Turn link LED on. */
1455			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1456			break;
1457		}
1458
1459		ni = ieee80211_ref_node(vap->iv_bss);
1460		/* Set media status to 'Associated'. */
1461		reg = urtwn_read_4(sc, R92C_CR);
1462		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1463		urtwn_write_4(sc, R92C_CR, reg);
1464
1465		/* Set BSSID. */
1466		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1467		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1468
1469		if (ic->ic_curmode == IEEE80211_MODE_11B)
1470			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1471		else	/* 802.11b/g */
1472			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1473
1474		/* Enable Rx of data frames. */
1475		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1476
1477		/* Flush all AC queues. */
1478		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1479
1480		/* Set beacon interval. */
1481		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1482
1483		/* Allow Rx from our BSSID only. */
1484		urtwn_write_4(sc, R92C_RCR,
1485		    urtwn_read_4(sc, R92C_RCR) |
1486		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1487
1488		/* Enable TSF synchronization. */
1489		urtwn_tsf_sync_enable(sc);
1490
1491		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1492		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1493		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1494		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1495		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1496		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1497
1498		/* Intialize rate adaptation. */
1499		urtwn_ra_init(sc);
1500		/* Turn link LED on. */
1501		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1502
1503		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1504		/* Reset temperature calibration state machine. */
1505		sc->thcal_state = 0;
1506		sc->thcal_lctemp = 0;
1507		ieee80211_free_node(ni);
1508		break;
1509	default:
1510		break;
1511	}
1512	URTWN_UNLOCK(sc);
1513	IEEE80211_LOCK(ic);
1514	return(uvp->newstate(vap, nstate, arg));
1515}
1516
1517static void
1518urtwn_watchdog(void *arg)
1519{
1520	struct urtwn_softc *sc = arg;
1521	struct ifnet *ifp = sc->sc_ifp;
1522
1523	if (sc->sc_txtimer > 0) {
1524		if (--sc->sc_txtimer == 0) {
1525			device_printf(sc->sc_dev, "device timeout\n");
1526			ifp->if_oerrors++;
1527			return;
1528		}
1529		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1530	}
1531}
1532
1533static void
1534urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1535{
1536	int pwdb;
1537
1538	/* Convert antenna signal to percentage. */
1539	if (rssi <= -100 || rssi >= 20)
1540		pwdb = 0;
1541	else if (rssi >= 0)
1542		pwdb = 100;
1543	else
1544		pwdb = 100 + rssi;
1545	if (rate <= 3) {
1546		/* CCK gain is smaller than OFDM/MCS gain. */
1547		pwdb += 6;
1548		if (pwdb > 100)
1549			pwdb = 100;
1550		if (pwdb <= 14)
1551			pwdb -= 4;
1552		else if (pwdb <= 26)
1553			pwdb -= 8;
1554		else if (pwdb <= 34)
1555			pwdb -= 6;
1556		else if (pwdb <= 42)
1557			pwdb -= 2;
1558	}
1559	if (sc->avg_pwdb == -1)	/* Init. */
1560		sc->avg_pwdb = pwdb;
1561	else if (sc->avg_pwdb < pwdb)
1562		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1563	else
1564		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1565	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1566}
1567
1568static int8_t
1569urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1570{
1571	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1572	struct r92c_rx_phystat *phy;
1573	struct r92c_rx_cck *cck;
1574	uint8_t rpt;
1575	int8_t rssi;
1576
1577	if (rate <= 3) {
1578		cck = (struct r92c_rx_cck *)physt;
1579		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1580			rpt = (cck->agc_rpt >> 5) & 0x3;
1581			rssi = (cck->agc_rpt & 0x1f) << 1;
1582		} else {
1583			rpt = (cck->agc_rpt >> 6) & 0x3;
1584			rssi = cck->agc_rpt & 0x3e;
1585		}
1586		rssi = cckoff[rpt] - rssi;
1587	} else {	/* OFDM/HT. */
1588		phy = (struct r92c_rx_phystat *)physt;
1589		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1590	}
1591	return (rssi);
1592}
1593
1594static int
1595urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1596    struct mbuf *m0, struct urtwn_data *data)
1597{
1598	struct ifnet *ifp = sc->sc_ifp;
1599	struct ieee80211_frame *wh;
1600	struct ieee80211_key *k;
1601	struct ieee80211com *ic = ifp->if_l2com;
1602	struct ieee80211vap *vap = ni->ni_vap;
1603	struct usb_xfer *xfer;
1604	struct r92c_tx_desc *txd;
1605	uint8_t raid, type;
1606	uint16_t sum;
1607	int i, hasqos, xferlen;
1608	struct usb_xfer *urtwn_pipes[4] = {
1609		sc->sc_xfer[URTWN_BULK_TX_BE],
1610		sc->sc_xfer[URTWN_BULK_TX_BK],
1611		sc->sc_xfer[URTWN_BULK_TX_VI],
1612		sc->sc_xfer[URTWN_BULK_TX_VO]
1613	};
1614
1615	URTWN_ASSERT_LOCKED(sc);
1616
1617	/*
1618	 * Software crypto.
1619	 */
1620	wh = mtod(m0, struct ieee80211_frame *);
1621	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1622		k = ieee80211_crypto_encap(ni, m0);
1623		if (k == NULL) {
1624			device_printf(sc->sc_dev,
1625			    "ieee80211_crypto_encap returns NULL.\n");
1626			/* XXX we don't expect the fragmented frames */
1627			m_freem(m0);
1628			return (ENOBUFS);
1629		}
1630
1631		/* in case packet header moved, reset pointer */
1632		wh = mtod(m0, struct ieee80211_frame *);
1633	}
1634
1635	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1636	case IEEE80211_FC0_TYPE_CTL:
1637	case IEEE80211_FC0_TYPE_MGT:
1638		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1639		break;
1640	default:
1641		KASSERT(M_WME_GETAC(m0) < 4,
1642		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1643		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1644		break;
1645	}
1646
1647	hasqos = 0;
1648
1649	/* Fill Tx descriptor. */
1650	txd = (struct r92c_tx_desc *)data->buf;
1651	memset(txd, 0, sizeof(*txd));
1652
1653	txd->txdw0 |= htole32(
1654	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1655	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1656	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1657	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1658		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1659
1660	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1661	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1662	    type == IEEE80211_FC0_TYPE_DATA) {
1663		if (ic->ic_curmode == IEEE80211_MODE_11B)
1664			raid = R92C_RAID_11B;
1665		else
1666			raid = R92C_RAID_11BG;
1667		txd->txdw1 |= htole32(
1668		    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1669		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1670		    SM(R92C_TXDW1_RAID, raid) |
1671		    R92C_TXDW1_AGGBK);
1672
1673		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1674			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1675				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1676				    R92C_TXDW4_HWRTSEN);
1677			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1678				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1679				    R92C_TXDW4_HWRTSEN);
1680			}
1681		}
1682		/* Send RTS at OFDM24. */
1683		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1684		txd->txdw5 |= htole32(0x0001ff00);
1685		/* Send data at OFDM54. */
1686		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1687	} else {
1688		txd->txdw1 |= htole32(
1689		    SM(R92C_TXDW1_MACID, 0) |
1690		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1691		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1692
1693		/* Force CCK1. */
1694		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1695		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1696	}
1697	/* Set sequence number (already little endian). */
1698	txd->txdseq |= *(uint16_t *)wh->i_seq;
1699
1700	if (!hasqos) {
1701		/* Use HW sequence numbering for non-QoS frames. */
1702		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1703		txd->txdseq |= htole16(0x8000);
1704	} else
1705		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1706
1707	/* Compute Tx descriptor checksum. */
1708	sum = 0;
1709	for (i = 0; i < sizeof(*txd) / 2; i++)
1710		sum ^= ((uint16_t *)txd)[i];
1711	txd->txdsum = sum; 	/* NB: already little endian. */
1712
1713	if (ieee80211_radiotap_active_vap(vap)) {
1714		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1715
1716		tap->wt_flags = 0;
1717		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1718		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1719		ieee80211_radiotap_tx(vap, m0);
1720	}
1721
1722	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1723	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1724
1725	data->buflen = xferlen;
1726	data->ni = ni;
1727	data->m = m0;
1728
1729	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1730	usbd_transfer_start(xfer);
1731	return (0);
1732}
1733
1734static void
1735urtwn_start(struct ifnet *ifp)
1736{
1737	struct urtwn_softc *sc = ifp->if_softc;
1738
1739	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1740		return;
1741	URTWN_LOCK(sc);
1742	urtwn_start_locked(ifp, sc);
1743	URTWN_UNLOCK(sc);
1744}
1745
1746static void
1747urtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1748{
1749	struct ieee80211_node *ni;
1750	struct mbuf *m;
1751	struct urtwn_data *bf;
1752
1753	URTWN_ASSERT_LOCKED(sc);
1754	for (;;) {
1755		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1756		if (m == NULL)
1757			break;
1758		bf = urtwn_getbuf(sc);
1759		if (bf == NULL) {
1760			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1761			break;
1762		}
1763		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1764		m->m_pkthdr.rcvif = NULL;
1765
1766		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1767			ifp->if_oerrors++;
1768			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1769			ieee80211_free_node(ni);
1770			break;
1771		}
1772
1773		sc->sc_txtimer = 5;
1774		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1775	}
1776}
1777
1778static int
1779urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1780{
1781	struct urtwn_softc *sc = ifp->if_softc;
1782	struct ieee80211com *ic = ifp->if_l2com;
1783	struct ifreq *ifr = (struct ifreq *) data;
1784	int error = 0, startall = 0;
1785
1786	URTWN_LOCK(sc);
1787	error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
1788	URTWN_UNLOCK(sc);
1789	if (error != 0)
1790		return (error);
1791
1792	switch (cmd) {
1793	case SIOCSIFFLAGS:
1794		if (ifp->if_flags & IFF_UP) {
1795			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1796				urtwn_init(ifp->if_softc);
1797				startall = 1;
1798			}
1799		} else {
1800			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1801				urtwn_stop(ifp);
1802		}
1803		if (startall)
1804			ieee80211_start_all(ic);
1805		break;
1806	case SIOCGIFMEDIA:
1807		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1808		break;
1809	case SIOCGIFADDR:
1810		error = ether_ioctl(ifp, cmd, data);
1811		break;
1812	default:
1813		error = EINVAL;
1814		break;
1815	}
1816	return (error);
1817}
1818
1819static int
1820urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1821    int ndata, int maxsz)
1822{
1823	int i, error;
1824
1825	for (i = 0; i < ndata; i++) {
1826		struct urtwn_data *dp = &data[i];
1827		dp->sc = sc;
1828		dp->m = NULL;
1829		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1830		if (dp->buf == NULL) {
1831			device_printf(sc->sc_dev,
1832			    "could not allocate buffer\n");
1833			error = ENOMEM;
1834			goto fail;
1835		}
1836		dp->ni = NULL;
1837	}
1838
1839	return (0);
1840fail:
1841	urtwn_free_list(sc, data, ndata);
1842	return (error);
1843}
1844
1845static int
1846urtwn_alloc_rx_list(struct urtwn_softc *sc)
1847{
1848        int error, i;
1849
1850	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1851	    URTWN_RXBUFSZ);
1852	if (error != 0)
1853		return (error);
1854
1855	STAILQ_INIT(&sc->sc_rx_active);
1856	STAILQ_INIT(&sc->sc_rx_inactive);
1857
1858	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1859		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1860
1861	return (0);
1862}
1863
1864static int
1865urtwn_alloc_tx_list(struct urtwn_softc *sc)
1866{
1867	int error, i;
1868
1869	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1870	    URTWN_TXBUFSZ);
1871	if (error != 0)
1872		return (error);
1873
1874	STAILQ_INIT(&sc->sc_tx_active);
1875	STAILQ_INIT(&sc->sc_tx_inactive);
1876	STAILQ_INIT(&sc->sc_tx_pending);
1877
1878	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1879		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1880
1881	return (0);
1882}
1883
1884static int
1885urtwn_power_on(struct urtwn_softc *sc)
1886{
1887	uint32_t reg;
1888	int ntries;
1889
1890	/* Wait for autoload done bit. */
1891	for (ntries = 0; ntries < 1000; ntries++) {
1892		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1893			break;
1894		DELAY(5);
1895	}
1896	if (ntries == 1000) {
1897		device_printf(sc->sc_dev,
1898		    "timeout waiting for chip autoload\n");
1899		return (ETIMEDOUT);
1900	}
1901
1902	/* Unlock ISO/CLK/Power control register. */
1903	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
1904	/* Move SPS into PWM mode. */
1905	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1906	DELAY(100);
1907
1908	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
1909	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
1910		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
1911		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
1912		DELAY(100);
1913		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
1914		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
1915		    ~R92C_SYS_ISO_CTRL_MD2PP);
1916	}
1917
1918	/* Auto enable WLAN. */
1919	urtwn_write_2(sc, R92C_APS_FSMCO,
1920	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1921	for (ntries = 0; ntries < 1000; ntries++) {
1922		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
1923		    R92C_APS_FSMCO_APFM_ONMAC))
1924			break;
1925		DELAY(5);
1926	}
1927	if (ntries == 1000) {
1928		device_printf(sc->sc_dev,
1929		    "timeout waiting for MAC auto ON\n");
1930		return (ETIMEDOUT);
1931	}
1932
1933	/* Enable radio, GPIO and LED functions. */
1934	urtwn_write_2(sc, R92C_APS_FSMCO,
1935	    R92C_APS_FSMCO_AFSM_HSUS |
1936	    R92C_APS_FSMCO_PDN_EN |
1937	    R92C_APS_FSMCO_PFM_ALDN);
1938	/* Release RF digital isolation. */
1939	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1940	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1941
1942	/* Initialize MAC. */
1943	urtwn_write_1(sc, R92C_APSD_CTRL,
1944	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
1945	for (ntries = 0; ntries < 200; ntries++) {
1946		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
1947		    R92C_APSD_CTRL_OFF_STATUS))
1948			break;
1949		DELAY(5);
1950	}
1951	if (ntries == 200) {
1952		device_printf(sc->sc_dev,
1953		    "timeout waiting for MAC initialization\n");
1954		return (ETIMEDOUT);
1955	}
1956
1957	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
1958	reg = urtwn_read_2(sc, R92C_CR);
1959	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
1960	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
1961	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
1962	    R92C_CR_ENSEC;
1963	urtwn_write_2(sc, R92C_CR, reg);
1964
1965	urtwn_write_1(sc, 0xfe10, 0x19);
1966	return (0);
1967}
1968
1969static int
1970urtwn_llt_init(struct urtwn_softc *sc)
1971{
1972	int i, error;
1973
1974	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
1975	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
1976		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1977			return (error);
1978	}
1979	/* NB: 0xff indicates end-of-list. */
1980	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
1981		return (error);
1982	/*
1983	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
1984	 * as ring buffer.
1985	 */
1986	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
1987		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
1988			return (error);
1989	}
1990	/* Make the last page point to the beginning of the ring buffer. */
1991	error = urtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
1992	return (error);
1993}
1994
1995static void
1996urtwn_fw_reset(struct urtwn_softc *sc)
1997{
1998	uint16_t reg;
1999	int ntries;
2000
2001	/* Tell 8051 to reset itself. */
2002	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2003
2004	/* Wait until 8051 resets by itself. */
2005	for (ntries = 0; ntries < 100; ntries++) {
2006		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2007		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2008			return;
2009		DELAY(50);
2010	}
2011	/* Force 8051 reset. */
2012	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2013}
2014
2015static int
2016urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2017{
2018	uint32_t reg;
2019	int off, mlen, error = 0;
2020
2021	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2022	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2023	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2024
2025	off = R92C_FW_START_ADDR;
2026	while (len > 0) {
2027		if (len > 196)
2028			mlen = 196;
2029		else if (len > 4)
2030			mlen = 4;
2031		else
2032			mlen = 1;
2033		/* XXX fix this deconst */
2034		error = urtwn_write_region_1(sc, off,
2035		    __DECONST(uint8_t *, buf), mlen);
2036		if (error != 0)
2037			break;
2038		off += mlen;
2039		buf += mlen;
2040		len -= mlen;
2041	}
2042	return (error);
2043}
2044
2045static int
2046urtwn_load_firmware(struct urtwn_softc *sc)
2047{
2048	const struct firmware *fw;
2049	const struct r92c_fw_hdr *hdr;
2050	const char *imagename;
2051	const u_char *ptr;
2052	size_t len;
2053	uint32_t reg;
2054	int mlen, ntries, page, error;
2055
2056	/* Read firmware image from the filesystem. */
2057	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2058	    URTWN_CHIP_UMC_A_CUT)
2059		imagename = "urtwn-rtl8192cfwU";
2060	else
2061		imagename = "urtwn-rtl8192cfwT";
2062
2063	fw = firmware_get(imagename);
2064	if (fw == NULL) {
2065		device_printf(sc->sc_dev,
2066		    "failed loadfirmware of file %s\n", imagename);
2067		return (ENOENT);
2068	}
2069
2070	len = fw->datasize;
2071
2072	if (len < sizeof(*hdr)) {
2073		device_printf(sc->sc_dev, "firmware too short\n");
2074		error = EINVAL;
2075		goto fail;
2076	}
2077	ptr = fw->data;
2078	hdr = (const struct r92c_fw_hdr *)ptr;
2079	/* Check if there is a valid FW header and skip it. */
2080	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2081	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2082		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2083		    le16toh(hdr->version), le16toh(hdr->subversion),
2084		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2085		ptr += sizeof(*hdr);
2086		len -= sizeof(*hdr);
2087	}
2088
2089	if (urtwn_read_1(sc, R92C_MCUFWDL) & 0x80) {
2090		urtwn_fw_reset(sc);
2091		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2092	}
2093	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2094	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2095	    R92C_SYS_FUNC_EN_CPUEN);
2096	urtwn_write_1(sc, R92C_MCUFWDL,
2097	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2098	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2099	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2100
2101	for (page = 0; len > 0; page++) {
2102		mlen = min(len, R92C_FW_PAGE_SIZE);
2103		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2104		if (error != 0) {
2105			device_printf(sc->sc_dev,
2106			    "could not load firmware page\n");
2107			goto fail;
2108		}
2109		ptr += mlen;
2110		len -= mlen;
2111	}
2112	urtwn_write_1(sc, R92C_MCUFWDL,
2113	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2114	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2115
2116	/* Wait for checksum report. */
2117	for (ntries = 0; ntries < 1000; ntries++) {
2118		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2119			break;
2120		DELAY(5);
2121	}
2122	if (ntries == 1000) {
2123		device_printf(sc->sc_dev,
2124		    "timeout waiting for checksum report\n");
2125		error = ETIMEDOUT;
2126		goto fail;
2127	}
2128
2129	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2130	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2131	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2132	/* Wait for firmware readiness. */
2133	for (ntries = 0; ntries < 1000; ntries++) {
2134		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2135			break;
2136		DELAY(5);
2137	}
2138	if (ntries == 1000) {
2139		device_printf(sc->sc_dev,
2140		    "timeout waiting for firmware readiness\n");
2141		error = ETIMEDOUT;
2142		goto fail;
2143	}
2144fail:
2145	firmware_put(fw, FIRMWARE_UNLOAD);
2146	return (error);
2147}
2148
2149static int
2150urtwn_dma_init(struct urtwn_softc *sc)
2151{
2152	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2153	uint32_t reg;
2154	int error;
2155
2156	/* Initialize LLT table. */
2157	error = urtwn_llt_init(sc);
2158	if (error != 0)
2159		return (error);
2160
2161	/* Get Tx queues to USB endpoints mapping. */
2162	hashq = hasnq = haslq = 0;
2163	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2164	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2165	if (MS(reg, R92C_USB_EP_HQ) != 0)
2166		hashq = 1;
2167	if (MS(reg, R92C_USB_EP_NQ) != 0)
2168		hasnq = 1;
2169	if (MS(reg, R92C_USB_EP_LQ) != 0)
2170		haslq = 1;
2171	nqueues = hashq + hasnq + haslq;
2172	if (nqueues == 0)
2173		return (EIO);
2174	/* Get the number of pages for each queue. */
2175	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2176	/* The remaining pages are assigned to the high priority queue. */
2177	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2178
2179	/* Set number of pages for normal priority queue. */
2180	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2181	urtwn_write_4(sc, R92C_RQPN,
2182	    /* Set number of pages for public queue. */
2183	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2184	    /* Set number of pages for high priority queue. */
2185	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2186	    /* Set number of pages for low priority queue. */
2187	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2188	    /* Load values. */
2189	    R92C_RQPN_LD);
2190
2191	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2192	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2193	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2194	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2195	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2196
2197	/* Set queue to USB pipe mapping. */
2198	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2199	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2200	if (nqueues == 1) {
2201		if (hashq)
2202			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2203		else if (hasnq)
2204			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2205		else
2206			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2207	} else if (nqueues == 2) {
2208		/* All 2-endpoints configs have a high priority queue. */
2209		if (!hashq)
2210			return (EIO);
2211		if (hasnq)
2212			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2213		else
2214			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2215	} else
2216		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2217	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2218
2219	/* Set Tx/Rx transfer page boundary. */
2220	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2221
2222	/* Set Tx/Rx transfer page size. */
2223	urtwn_write_1(sc, R92C_PBP,
2224	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2225	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2226	return (0);
2227}
2228
2229static void
2230urtwn_mac_init(struct urtwn_softc *sc)
2231{
2232	int i;
2233
2234	/* Write MAC initialization values. */
2235	for (i = 0; i < nitems(rtl8192cu_mac); i++)
2236		urtwn_write_1(sc, rtl8192cu_mac[i].reg, rtl8192cu_mac[i].val);
2237}
2238
2239static void
2240urtwn_bb_init(struct urtwn_softc *sc)
2241{
2242	const struct urtwn_bb_prog *prog;
2243	uint32_t reg;
2244	int i;
2245
2246	/* Enable BB and RF. */
2247	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2248	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2249	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2250	    R92C_SYS_FUNC_EN_DIO_RF);
2251
2252	urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2253
2254	urtwn_write_1(sc, R92C_RF_CTRL,
2255	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2256	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2257	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2258	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2259
2260	urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2261	urtwn_write_1(sc, 0x15, 0xe9);
2262	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2263
2264	/* Select BB programming based on board type. */
2265	if (!(sc->chip & URTWN_CHIP_92C)) {
2266		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2267			prog = &rtl8188ce_bb_prog;
2268		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2269			prog = &rtl8188ru_bb_prog;
2270		else
2271			prog = &rtl8188cu_bb_prog;
2272	} else {
2273		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2274			prog = &rtl8192ce_bb_prog;
2275		else
2276			prog = &rtl8192cu_bb_prog;
2277	}
2278	/* Write BB initialization values. */
2279	for (i = 0; i < prog->count; i++) {
2280		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2281		DELAY(1);
2282	}
2283
2284	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2285		/* 8192C 1T only configuration. */
2286		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2287		reg = (reg & ~0x00000003) | 0x2;
2288		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2289
2290		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2291		reg = (reg & ~0x00300033) | 0x00200022;
2292		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2293
2294		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2295		reg = (reg & ~0xff000000) | 0x45 << 24;
2296		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2297
2298		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2299		reg = (reg & ~0x000000ff) | 0x23;
2300		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2301
2302		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2303		reg = (reg & ~0x00000030) | 1 << 4;
2304		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2305
2306		reg = urtwn_bb_read(sc, 0xe74);
2307		reg = (reg & ~0x0c000000) | 2 << 26;
2308		urtwn_bb_write(sc, 0xe74, reg);
2309		reg = urtwn_bb_read(sc, 0xe78);
2310		reg = (reg & ~0x0c000000) | 2 << 26;
2311		urtwn_bb_write(sc, 0xe78, reg);
2312		reg = urtwn_bb_read(sc, 0xe7c);
2313		reg = (reg & ~0x0c000000) | 2 << 26;
2314		urtwn_bb_write(sc, 0xe7c, reg);
2315		reg = urtwn_bb_read(sc, 0xe80);
2316		reg = (reg & ~0x0c000000) | 2 << 26;
2317		urtwn_bb_write(sc, 0xe80, reg);
2318		reg = urtwn_bb_read(sc, 0xe88);
2319		reg = (reg & ~0x0c000000) | 2 << 26;
2320		urtwn_bb_write(sc, 0xe88, reg);
2321	}
2322
2323	/* Write AGC values. */
2324	for (i = 0; i < prog->agccount; i++) {
2325		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2326		    prog->agcvals[i]);
2327		DELAY(1);
2328	}
2329
2330	if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2331	    R92C_HSSI_PARAM2_CCK_HIPWR)
2332		sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2333}
2334
2335void
2336urtwn_rf_init(struct urtwn_softc *sc)
2337{
2338	const struct urtwn_rf_prog *prog;
2339	uint32_t reg, type;
2340	int i, j, idx, off;
2341
2342	/* Select RF programming based on board type. */
2343	if (!(sc->chip & URTWN_CHIP_92C)) {
2344		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2345			prog = rtl8188ce_rf_prog;
2346		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2347			prog = rtl8188ru_rf_prog;
2348		else
2349			prog = rtl8188cu_rf_prog;
2350	} else
2351		prog = rtl8192ce_rf_prog;
2352
2353	for (i = 0; i < sc->nrxchains; i++) {
2354		/* Save RF_ENV control type. */
2355		idx = i / 2;
2356		off = (i % 2) * 16;
2357		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2358		type = (reg >> off) & 0x10;
2359
2360		/* Set RF_ENV enable. */
2361		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2362		reg |= 0x100000;
2363		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2364		DELAY(1);
2365		/* Set RF_ENV output high. */
2366		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2367		reg |= 0x10;
2368		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2369		DELAY(1);
2370		/* Set address and data lengths of RF registers. */
2371		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2372		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2373		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2374		DELAY(1);
2375		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2376		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2377		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2378		DELAY(1);
2379
2380		/* Write RF initialization values for this chain. */
2381		for (j = 0; j < prog[i].count; j++) {
2382			if (prog[i].regs[j] >= 0xf9 &&
2383			    prog[i].regs[j] <= 0xfe) {
2384				/*
2385				 * These are fake RF registers offsets that
2386				 * indicate a delay is required.
2387				 */
2388				usb_pause_mtx(&sc->sc_mtx, 50);
2389				continue;
2390			}
2391			urtwn_rf_write(sc, i, prog[i].regs[j],
2392			    prog[i].vals[j]);
2393			DELAY(1);
2394		}
2395
2396		/* Restore RF_ENV control type. */
2397		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2398		reg &= ~(0x10 << off) | (type << off);
2399		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2400
2401		/* Cache RF register CHNLBW. */
2402		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2403	}
2404
2405	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2406	    URTWN_CHIP_UMC_A_CUT) {
2407		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2408		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2409	}
2410}
2411
2412static void
2413urtwn_cam_init(struct urtwn_softc *sc)
2414{
2415	/* Invalidate all CAM entries. */
2416	urtwn_write_4(sc, R92C_CAMCMD,
2417	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2418}
2419
2420static void
2421urtwn_pa_bias_init(struct urtwn_softc *sc)
2422{
2423	uint8_t reg;
2424	int i;
2425
2426	for (i = 0; i < sc->nrxchains; i++) {
2427		if (sc->pa_setting & (1 << i))
2428			continue;
2429		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2430		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2431		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2432		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2433	}
2434	if (!(sc->pa_setting & 0x10)) {
2435		reg = urtwn_read_1(sc, 0x16);
2436		reg = (reg & ~0xf0) | 0x90;
2437		urtwn_write_1(sc, 0x16, reg);
2438	}
2439}
2440
2441static void
2442urtwn_rxfilter_init(struct urtwn_softc *sc)
2443{
2444	/* Initialize Rx filter. */
2445	/* TODO: use better filter for monitor mode. */
2446	urtwn_write_4(sc, R92C_RCR,
2447	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2448	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2449	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2450	/* Accept all multicast frames. */
2451	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2452	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2453	/* Accept all management frames. */
2454	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2455	/* Reject all control frames. */
2456	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2457	/* Accept all data frames. */
2458	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2459}
2460
2461static void
2462urtwn_edca_init(struct urtwn_softc *sc)
2463{
2464	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2465	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2466	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2467	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2468	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2469	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2470	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2471	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2472}
2473
2474void
2475urtwn_write_txpower(struct urtwn_softc *sc, int chain,
2476    uint16_t power[URTWN_RIDX_COUNT])
2477{
2478	uint32_t reg;
2479
2480	/* Write per-CCK rate Tx power. */
2481	if (chain == 0) {
2482		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2483		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2484		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2485		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2486		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2487		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2488		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2489		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2490	} else {
2491		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2492		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2493		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2494		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2495		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2496		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2497		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2498		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2499	}
2500	/* Write per-OFDM rate Tx power. */
2501	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2502	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2503	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2504	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2505	    SM(R92C_TXAGC_RATE18, power[ 7]));
2506	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2507	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2508	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2509	    SM(R92C_TXAGC_RATE48, power[10]) |
2510	    SM(R92C_TXAGC_RATE54, power[11]));
2511	/* Write per-MCS Tx power. */
2512	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2513	    SM(R92C_TXAGC_MCS00,  power[12]) |
2514	    SM(R92C_TXAGC_MCS01,  power[13]) |
2515	    SM(R92C_TXAGC_MCS02,  power[14]) |
2516	    SM(R92C_TXAGC_MCS03,  power[15]));
2517	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2518	    SM(R92C_TXAGC_MCS04,  power[16]) |
2519	    SM(R92C_TXAGC_MCS05,  power[17]) |
2520	    SM(R92C_TXAGC_MCS06,  power[18]) |
2521	    SM(R92C_TXAGC_MCS07,  power[19]));
2522	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2523	    SM(R92C_TXAGC_MCS08,  power[20]) |
2524	    SM(R92C_TXAGC_MCS09,  power[21]) |
2525	    SM(R92C_TXAGC_MCS10,  power[22]) |
2526	    SM(R92C_TXAGC_MCS11,  power[23]));
2527	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2528	    SM(R92C_TXAGC_MCS12,  power[24]) |
2529	    SM(R92C_TXAGC_MCS13,  power[25]) |
2530	    SM(R92C_TXAGC_MCS14,  power[26]) |
2531	    SM(R92C_TXAGC_MCS15,  power[27]));
2532}
2533
2534void
2535urtwn_get_txpower(struct urtwn_softc *sc, int chain,
2536    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2537    uint16_t power[URTWN_RIDX_COUNT])
2538{
2539	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2540	struct r92c_rom *rom = &sc->rom;
2541	uint16_t cckpow, ofdmpow, htpow, diff, max;
2542	const struct urtwn_txpwr *base;
2543	int ridx, chan, group;
2544
2545	/* Determine channel group. */
2546	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2547	if (chan <= 3)
2548		group = 0;
2549	else if (chan <= 9)
2550		group = 1;
2551	else
2552		group = 2;
2553
2554	/* Get original Tx power based on board type and RF chain. */
2555	if (!(sc->chip & URTWN_CHIP_92C)) {
2556		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2557			base = &rtl8188ru_txagc[chain];
2558		else
2559			base = &rtl8192cu_txagc[chain];
2560	} else
2561		base = &rtl8192cu_txagc[chain];
2562
2563	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2564	if (sc->regulatory == 0) {
2565		for (ridx = 0; ridx <= 3; ridx++)
2566			power[ridx] = base->pwr[0][ridx];
2567	}
2568	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2569		if (sc->regulatory == 3) {
2570			power[ridx] = base->pwr[0][ridx];
2571			/* Apply vendor limits. */
2572			if (extc != NULL)
2573				max = rom->ht40_max_pwr[group];
2574			else
2575				max = rom->ht20_max_pwr[group];
2576			max = (max >> (chain * 4)) & 0xf;
2577			if (power[ridx] > max)
2578				power[ridx] = max;
2579		} else if (sc->regulatory == 1) {
2580			if (extc == NULL)
2581				power[ridx] = base->pwr[group][ridx];
2582		} else if (sc->regulatory != 2)
2583			power[ridx] = base->pwr[0][ridx];
2584	}
2585
2586	/* Compute per-CCK rate Tx power. */
2587	cckpow = rom->cck_tx_pwr[chain][group];
2588	for (ridx = 0; ridx <= 3; ridx++) {
2589		power[ridx] += cckpow;
2590		if (power[ridx] > R92C_MAX_TX_PWR)
2591			power[ridx] = R92C_MAX_TX_PWR;
2592	}
2593
2594	htpow = rom->ht40_1s_tx_pwr[chain][group];
2595	if (sc->ntxchains > 1) {
2596		/* Apply reduction for 2 spatial streams. */
2597		diff = rom->ht40_2s_tx_pwr_diff[group];
2598		diff = (diff >> (chain * 4)) & 0xf;
2599		htpow = (htpow > diff) ? htpow - diff : 0;
2600	}
2601
2602	/* Compute per-OFDM rate Tx power. */
2603	diff = rom->ofdm_tx_pwr_diff[group];
2604	diff = (diff >> (chain * 4)) & 0xf;
2605	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2606	for (ridx = 4; ridx <= 11; ridx++) {
2607		power[ridx] += ofdmpow;
2608		if (power[ridx] > R92C_MAX_TX_PWR)
2609			power[ridx] = R92C_MAX_TX_PWR;
2610	}
2611
2612	/* Compute per-MCS Tx power. */
2613	if (extc == NULL) {
2614		diff = rom->ht20_tx_pwr_diff[group];
2615		diff = (diff >> (chain * 4)) & 0xf;
2616		htpow += diff;	/* HT40->HT20 correction. */
2617	}
2618	for (ridx = 12; ridx <= 27; ridx++) {
2619		power[ridx] += htpow;
2620		if (power[ridx] > R92C_MAX_TX_PWR)
2621			power[ridx] = R92C_MAX_TX_PWR;
2622	}
2623#ifdef URTWN_DEBUG
2624	if (urtwn_debug >= 4) {
2625		/* Dump per-rate Tx power values. */
2626		printf("Tx power for chain %d:\n", chain);
2627		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
2628			printf("Rate %d = %u\n", ridx, power[ridx]);
2629	}
2630#endif
2631}
2632
2633void
2634urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
2635    struct ieee80211_channel *extc)
2636{
2637	uint16_t power[URTWN_RIDX_COUNT];
2638	int i;
2639
2640	for (i = 0; i < sc->ntxchains; i++) {
2641		/* Compute per-rate Tx power values. */
2642		urtwn_get_txpower(sc, i, c, extc, power);
2643		/* Write per-rate Tx power values to hardware. */
2644		urtwn_write_txpower(sc, i, power);
2645	}
2646}
2647
2648static void
2649urtwn_scan_start(struct ieee80211com *ic)
2650{
2651	/* XXX do nothing?  */
2652}
2653
2654static void
2655urtwn_scan_end(struct ieee80211com *ic)
2656{
2657	/* XXX do nothing?  */
2658}
2659
2660static void
2661urtwn_set_channel(struct ieee80211com *ic)
2662{
2663	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
2664
2665	URTWN_LOCK(sc);
2666	urtwn_set_chan(sc, ic->ic_curchan, NULL);
2667	URTWN_UNLOCK(sc);
2668}
2669
2670static void
2671urtwn_update_mcast(struct ifnet *ifp)
2672{
2673	/* XXX do nothing?  */
2674}
2675
2676static void
2677urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
2678    struct ieee80211_channel *extc)
2679{
2680	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2681	uint32_t reg;
2682	u_int chan;
2683	int i;
2684
2685	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2686	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2687		device_printf(sc->sc_dev,
2688		    "%s: invalid channel %x\n", __func__, chan);
2689		return;
2690	}
2691
2692	/* Set Tx power for this new channel. */
2693	urtwn_set_txpower(sc, c, extc);
2694
2695	for (i = 0; i < sc->nrxchains; i++) {
2696		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2697		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2698	}
2699#ifndef IEEE80211_NO_HT
2700	if (extc != NULL) {
2701		/* Is secondary channel below or above primary? */
2702		int prichlo = c->ic_freq < extc->ic_freq;
2703
2704		urtwn_write_1(sc, R92C_BWOPMODE,
2705		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2706
2707		reg = urtwn_read_1(sc, R92C_RRSR + 2);
2708		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2709		urtwn_write_1(sc, R92C_RRSR + 2, reg);
2710
2711		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2712		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2713		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2714		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2715
2716		/* Set CCK side band. */
2717		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2718		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2719		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2720
2721		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
2722		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2723		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2724
2725		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2726		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2727		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2728
2729		reg = urtwn_bb_read(sc, 0x818);
2730		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2731		urtwn_bb_write(sc, 0x818, reg);
2732
2733		/* Select 40MHz bandwidth. */
2734		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2735		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2736	} else
2737#endif
2738	{
2739		urtwn_write_1(sc, R92C_BWOPMODE,
2740		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2741
2742		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2743		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2744		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2745		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2746
2747		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2748		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2749		    R92C_FPGA0_ANAPARAM2_CBW20);
2750
2751		/* Select 20MHz bandwidth. */
2752		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2753		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2754	}
2755}
2756
2757static void
2758urtwn_iq_calib(struct urtwn_softc *sc)
2759{
2760	/* TODO */
2761}
2762
2763static void
2764urtwn_lc_calib(struct urtwn_softc *sc)
2765{
2766	uint32_t rf_ac[2];
2767	uint8_t txmode;
2768	int i;
2769
2770	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2771	if ((txmode & 0x70) != 0) {
2772		/* Disable all continuous Tx. */
2773		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2774
2775		/* Set RF mode to standby mode. */
2776		for (i = 0; i < sc->nrxchains; i++) {
2777			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
2778			urtwn_rf_write(sc, i, R92C_RF_AC,
2779			    RW(rf_ac[i], R92C_RF_AC_MODE,
2780				R92C_RF_AC_MODE_STANDBY));
2781		}
2782	} else {
2783		/* Block all Tx queues. */
2784		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
2785	}
2786	/* Start calibration. */
2787	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2788	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2789
2790	/* Give calibration the time to complete. */
2791	usb_pause_mtx(&sc->sc_mtx, 100);
2792
2793	/* Restore configuration. */
2794	if ((txmode & 0x70) != 0) {
2795		/* Restore Tx mode. */
2796		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2797		/* Restore RF mode. */
2798		for (i = 0; i < sc->nrxchains; i++)
2799			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2800	} else {
2801		/* Unblock all Tx queues. */
2802		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2803	}
2804}
2805
2806static void
2807urtwn_init_locked(void *arg)
2808{
2809	struct urtwn_softc *sc = arg;
2810	struct ifnet *ifp = sc->sc_ifp;
2811	uint32_t reg;
2812	int error;
2813
2814	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2815		urtwn_stop_locked(ifp);
2816
2817	/* Init firmware commands ring. */
2818	sc->fwcur = 0;
2819
2820	/* Allocate Tx/Rx buffers. */
2821	error = urtwn_alloc_rx_list(sc);
2822	if (error != 0)
2823		goto fail;
2824
2825	error = urtwn_alloc_tx_list(sc);
2826	if (error != 0)
2827		goto fail;
2828
2829	/* Power on adapter. */
2830	error = urtwn_power_on(sc);
2831	if (error != 0)
2832		goto fail;
2833
2834	/* Initialize DMA. */
2835	error = urtwn_dma_init(sc);
2836	if (error != 0)
2837		goto fail;
2838
2839	/* Set info size in Rx descriptors (in 64-bit words). */
2840	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
2841
2842	/* Init interrupts. */
2843	urtwn_write_4(sc, R92C_HISR, 0xffffffff);
2844	urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
2845
2846	/* Set MAC address. */
2847	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
2848	    IEEE80211_ADDR_LEN);
2849
2850	/* Set initial network type. */
2851	reg = urtwn_read_4(sc, R92C_CR);
2852	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
2853	urtwn_write_4(sc, R92C_CR, reg);
2854
2855	urtwn_rxfilter_init(sc);
2856
2857	reg = urtwn_read_4(sc, R92C_RRSR);
2858	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
2859	urtwn_write_4(sc, R92C_RRSR, reg);
2860
2861	/* Set short/long retry limits. */
2862	urtwn_write_2(sc, R92C_RL,
2863	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
2864
2865	/* Initialize EDCA parameters. */
2866	urtwn_edca_init(sc);
2867
2868	/* Setup rate fallback. */
2869	urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
2870	urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
2871	urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
2872	urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
2873
2874	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
2875	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
2876	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
2877	/* Set ACK timeout. */
2878	urtwn_write_1(sc, R92C_ACKTO, 0x40);
2879
2880	/* Setup USB aggregation. */
2881	reg = urtwn_read_4(sc, R92C_TDECTRL);
2882	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
2883	urtwn_write_4(sc, R92C_TDECTRL, reg);
2884	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
2885	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
2886	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
2887	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2888	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2889	    R92C_USB_SPECIAL_OPTION_AGG_EN);
2890	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
2891	urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
2892	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
2893	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
2894
2895	/* Initialize beacon parameters. */
2896	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
2897	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
2898	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
2899	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
2900
2901	/* Setup AMPDU aggregation. */
2902	urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
2903	urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
2904	urtwn_write_2(sc, 0x4ca, 0x0708);
2905
2906	urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
2907	urtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
2908
2909	/* Load 8051 microcode. */
2910	error = urtwn_load_firmware(sc);
2911	if (error != 0)
2912		goto fail;
2913
2914	/* Initialize MAC/BB/RF blocks. */
2915	urtwn_mac_init(sc);
2916	urtwn_bb_init(sc);
2917	urtwn_rf_init(sc);
2918
2919	/* Turn CCK and OFDM blocks on. */
2920	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2921	reg |= R92C_RFMOD_CCK_EN;
2922	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2923	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2924	reg |= R92C_RFMOD_OFDM_EN;
2925	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2926
2927	/* Clear per-station keys table. */
2928	urtwn_cam_init(sc);
2929
2930	/* Enable hardware sequence numbering. */
2931	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
2932
2933	/* Perform LO and IQ calibrations. */
2934	urtwn_iq_calib(sc);
2935	/* Perform LC calibration. */
2936	urtwn_lc_calib(sc);
2937
2938	/* Fix USB interference issue. */
2939	urtwn_write_1(sc, 0xfe40, 0xe0);
2940	urtwn_write_1(sc, 0xfe41, 0x8d);
2941	urtwn_write_1(sc, 0xfe42, 0x80);
2942
2943	urtwn_pa_bias_init(sc);
2944
2945	/* Initialize GPIO setting. */
2946	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
2947	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
2948
2949	/* Fix for lower temperature. */
2950	urtwn_write_1(sc, 0x15, 0xe9);
2951
2952	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
2953
2954	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2955	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2956
2957	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2958fail:
2959	return;
2960}
2961
2962static void
2963urtwn_init(void *arg)
2964{
2965	struct urtwn_softc *sc = arg;
2966
2967	URTWN_LOCK(sc);
2968	urtwn_init_locked(arg);
2969	URTWN_UNLOCK(sc);
2970}
2971
2972static void
2973urtwn_stop_locked(struct ifnet *ifp)
2974{
2975	struct urtwn_softc *sc = ifp->if_softc;
2976
2977	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2978
2979	callout_stop(&sc->sc_watchdog_ch);
2980	urtwn_abort_xfers(sc);
2981}
2982
2983static void
2984urtwn_stop(struct ifnet *ifp)
2985{
2986	struct urtwn_softc *sc = ifp->if_softc;
2987
2988	URTWN_LOCK(sc);
2989	urtwn_stop_locked(ifp);
2990	URTWN_UNLOCK(sc);
2991}
2992
2993static void
2994urtwn_abort_xfers(struct urtwn_softc *sc)
2995{
2996	int i;
2997
2998	URTWN_ASSERT_LOCKED(sc);
2999
3000	/* abort any pending transfers */
3001	for (i = 0; i < URTWN_N_TRANSFER; i++)
3002		usbd_transfer_stop(sc->sc_xfer[i]);
3003}
3004
3005static int
3006urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3007    const struct ieee80211_bpf_params *params)
3008{
3009	struct ieee80211com *ic = ni->ni_ic;
3010	struct ifnet *ifp = ic->ic_ifp;
3011	struct urtwn_softc *sc = ifp->if_softc;
3012	struct urtwn_data *bf;
3013
3014	/* prevent management frames from being sent if we're not ready */
3015	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3016		m_freem(m);
3017		ieee80211_free_node(ni);
3018		return (ENETDOWN);
3019	}
3020	URTWN_LOCK(sc);
3021	bf = urtwn_getbuf(sc);
3022	if (bf == NULL) {
3023		ieee80211_free_node(ni);
3024		m_freem(m);
3025		URTWN_UNLOCK(sc);
3026		return (ENOBUFS);
3027	}
3028
3029	ifp->if_opackets++;
3030	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3031		ieee80211_free_node(ni);
3032		ifp->if_oerrors++;
3033		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3034		URTWN_UNLOCK(sc);
3035		return (EIO);
3036	}
3037	URTWN_UNLOCK(sc);
3038
3039	sc->sc_txtimer = 5;
3040	return (0);
3041}
3042
3043static device_method_t urtwn_methods[] = {
3044	/* Device interface */
3045	DEVMETHOD(device_probe,		urtwn_match),
3046	DEVMETHOD(device_attach,	urtwn_attach),
3047	DEVMETHOD(device_detach,	urtwn_detach),
3048
3049	{ 0, 0 }
3050};
3051
3052static driver_t urtwn_driver = {
3053	"urtwn",
3054	urtwn_methods,
3055	sizeof(struct urtwn_softc)
3056};
3057
3058static devclass_t urtwn_devclass;
3059
3060DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3061MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3062MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3063MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3064MODULE_VERSION(urtwn, 1);
3065