if_urtwn.c revision 271303
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 271303 2014-09-09 05:21:31Z kevlo $");
22
23/*
24 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25 */
26
27#include <sys/param.h>
28#include <sys/sockio.h>
29#include <sys/sysctl.h>
30#include <sys/lock.h>
31#include <sys/mutex.h>
32#include <sys/mbuf.h>
33#include <sys/kernel.h>
34#include <sys/socket.h>
35#include <sys/systm.h>
36#include <sys/malloc.h>
37#include <sys/module.h>
38#include <sys/bus.h>
39#include <sys/endian.h>
40#include <sys/linker.h>
41#include <sys/firmware.h>
42#include <sys/kdb.h>
43
44#include <machine/bus.h>
45#include <machine/resource.h>
46#include <sys/rman.h>
47
48#include <net/bpf.h>
49#include <net/if.h>
50#include <net/if_var.h>
51#include <net/if_arp.h>
52#include <net/ethernet.h>
53#include <net/if_dl.h>
54#include <net/if_media.h>
55#include <net/if_types.h>
56
57#include <netinet/in.h>
58#include <netinet/in_systm.h>
59#include <netinet/in_var.h>
60#include <netinet/if_ether.h>
61#include <netinet/ip.h>
62
63#include <net80211/ieee80211_var.h>
64#include <net80211/ieee80211_regdomain.h>
65#include <net80211/ieee80211_radiotap.h>
66#include <net80211/ieee80211_ratectl.h>
67
68#include <dev/usb/usb.h>
69#include <dev/usb/usbdi.h>
70#include "usbdevs.h"
71
72#define USB_DEBUG_VAR urtwn_debug
73#include <dev/usb/usb_debug.h>
74
75#include <dev/usb/wlan/if_urtwnreg.h>
76
77#ifdef USB_DEBUG
78static int urtwn_debug = 0;
79
80SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
81SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
82    "Debug level");
83#endif
84
85#define	URTWN_RSSI(r)  (r) - 110
86#define	IEEE80211_HAS_ADDR4(wh)	\
87	(((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
88
89/* various supported device vendors/products */
90static const STRUCT_USB_HOST_ID urtwn_devs[] = {
91#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
92#define	URTWN_RTL8188E_DEV(v,p)	\
93	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
94#define URTWN_RTL8188E  1
95	URTWN_DEV(ABOCOM,	RTL8188CU_1),
96	URTWN_DEV(ABOCOM,	RTL8188CU_2),
97	URTWN_DEV(ABOCOM,	RTL8192CU),
98	URTWN_DEV(ASUS,		RTL8192CU),
99	URTWN_DEV(ASUS,		USBN10NANO),
100	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
101	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
102	URTWN_DEV(AZUREWAVE,	RTL8188CU),
103	URTWN_DEV(BELKIN,	F7D2102),
104	URTWN_DEV(BELKIN,	RTL8188CU),
105	URTWN_DEV(BELKIN,	RTL8192CU),
106	URTWN_DEV(CHICONY,	RTL8188CUS_1),
107	URTWN_DEV(CHICONY,	RTL8188CUS_2),
108	URTWN_DEV(CHICONY,	RTL8188CUS_3),
109	URTWN_DEV(CHICONY,	RTL8188CUS_4),
110	URTWN_DEV(CHICONY,	RTL8188CUS_5),
111	URTWN_DEV(COREGA,	RTL8192CU),
112	URTWN_DEV(DLINK,	RTL8188CU),
113	URTWN_DEV(DLINK,	RTL8192CU_1),
114	URTWN_DEV(DLINK,	RTL8192CU_2),
115	URTWN_DEV(DLINK,	RTL8192CU_3),
116	URTWN_DEV(DLINK,	DWA131B),
117	URTWN_DEV(EDIMAX,	EW7811UN),
118	URTWN_DEV(EDIMAX,	RTL8192CU),
119	URTWN_DEV(FEIXUN,	RTL8188CU),
120	URTWN_DEV(FEIXUN,	RTL8192CU),
121	URTWN_DEV(GUILLEMOT,	HWNUP150),
122	URTWN_DEV(HAWKING,	RTL8192CU),
123	URTWN_DEV(HP3,		RTL8188CU),
124	URTWN_DEV(NETGEAR,	WNA1000M),
125	URTWN_DEV(NETGEAR,	RTL8192CU),
126	URTWN_DEV(NETGEAR4,	RTL8188CU),
127	URTWN_DEV(NOVATECH,	RTL8188CU),
128	URTWN_DEV(PLANEX2,	RTL8188CU_1),
129	URTWN_DEV(PLANEX2,	RTL8188CU_2),
130	URTWN_DEV(PLANEX2,	RTL8188CU_3),
131	URTWN_DEV(PLANEX2,	RTL8188CU_4),
132	URTWN_DEV(PLANEX2,	RTL8188CUS),
133	URTWN_DEV(PLANEX2,	RTL8192CU),
134	URTWN_DEV(REALTEK,	RTL8188CE_0),
135	URTWN_DEV(REALTEK,	RTL8188CE_1),
136	URTWN_DEV(REALTEK,	RTL8188CTV),
137	URTWN_DEV(REALTEK,	RTL8188CU_0),
138	URTWN_DEV(REALTEK,	RTL8188CU_1),
139	URTWN_DEV(REALTEK,	RTL8188CU_2),
140	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
141	URTWN_DEV(REALTEK,	RTL8188CUS),
142	URTWN_DEV(REALTEK,	RTL8188RU_1),
143	URTWN_DEV(REALTEK,	RTL8188RU_2),
144	URTWN_DEV(REALTEK,	RTL8191CU),
145	URTWN_DEV(REALTEK,	RTL8192CE),
146	URTWN_DEV(REALTEK,	RTL8192CU),
147	URTWN_DEV(REALTEK, 	RTL8188CU_0),
148	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
149	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
150	URTWN_DEV(SITECOMEU,	RTL8192CU),
151	URTWN_DEV(TRENDNET,	RTL8188CU),
152	URTWN_DEV(TRENDNET,	RTL8192CU),
153	URTWN_DEV(ZYXEL,	RTL8192CU),
154	/* URTWN_RTL8188E */
155	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
156	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
157	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
158#undef URTWN_RTL8188E_DEV
159#undef URTWN_DEV
160};
161
162static device_probe_t	urtwn_match;
163static device_attach_t	urtwn_attach;
164static device_detach_t	urtwn_detach;
165
166static usb_callback_t   urtwn_bulk_tx_callback;
167static usb_callback_t	urtwn_bulk_rx_callback;
168
169static usb_error_t	urtwn_do_request(struct urtwn_softc *sc,
170			    struct usb_device_request *req, void *data);
171static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
172		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
173                    const uint8_t [IEEE80211_ADDR_LEN],
174                    const uint8_t [IEEE80211_ADDR_LEN]);
175static void		urtwn_vap_delete(struct ieee80211vap *);
176static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
177			    int *);
178static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
179			    int *, int8_t *);
180static void		urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
181static int		urtwn_alloc_list(struct urtwn_softc *,
182			    struct urtwn_data[], int, int);
183static int		urtwn_alloc_rx_list(struct urtwn_softc *);
184static int		urtwn_alloc_tx_list(struct urtwn_softc *);
185static void		urtwn_free_tx_list(struct urtwn_softc *);
186static void		urtwn_free_rx_list(struct urtwn_softc *);
187static void		urtwn_free_list(struct urtwn_softc *,
188			    struct urtwn_data data[], int);
189static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
190static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
191static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
192			    uint8_t *, int);
193static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
194static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
195static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
196static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
197			    uint8_t *, int);
198static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
199static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
200static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
201static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
202			    const void *, int);
203static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
204			    uint8_t, uint32_t);
205static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
206			    uint8_t, uint32_t);
207static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
208static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
209			    uint32_t);
210static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
211static void		urtwn_efuse_read(struct urtwn_softc *);
212static void		urtwn_efuse_switch_power(struct urtwn_softc *);
213static int		urtwn_read_chipid(struct urtwn_softc *);
214static void		urtwn_read_rom(struct urtwn_softc *);
215static void		urtwn_r88e_read_rom(struct urtwn_softc *);
216static int		urtwn_ra_init(struct urtwn_softc *);
217static void		urtwn_tsf_sync_enable(struct urtwn_softc *);
218static void		urtwn_set_led(struct urtwn_softc *, int, int);
219static int		urtwn_newstate(struct ieee80211vap *,
220			    enum ieee80211_state, int);
221static void		urtwn_watchdog(void *);
222static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
223static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
224static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
225static int		urtwn_tx_start(struct urtwn_softc *,
226			    struct ieee80211_node *, struct mbuf *,
227			    struct urtwn_data *);
228static void		urtwn_start(struct ifnet *);
229static void		urtwn_start_locked(struct ifnet *,
230			    struct urtwn_softc *);
231static int		urtwn_ioctl(struct ifnet *, u_long, caddr_t);
232static int		urtwn_r92c_power_on(struct urtwn_softc *);
233static int		urtwn_r88e_power_on(struct urtwn_softc *);
234static int		urtwn_llt_init(struct urtwn_softc *);
235static void		urtwn_fw_reset(struct urtwn_softc *);
236static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
237static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
238			    const uint8_t *, int);
239static int		urtwn_load_firmware(struct urtwn_softc *);
240static int		urtwn_r92c_dma_init(struct urtwn_softc *);
241static int		urtwn_r88e_dma_init(struct urtwn_softc *);
242static void		urtwn_mac_init(struct urtwn_softc *);
243static void		urtwn_bb_init(struct urtwn_softc *);
244static void		urtwn_rf_init(struct urtwn_softc *);
245static void		urtwn_cam_init(struct urtwn_softc *);
246static void		urtwn_pa_bias_init(struct urtwn_softc *);
247static void		urtwn_rxfilter_init(struct urtwn_softc *);
248static void		urtwn_edca_init(struct urtwn_softc *);
249static void		urtwn_write_txpower(struct urtwn_softc *, int,
250			    uint16_t[]);
251static void		urtwn_get_txpower(struct urtwn_softc *, int,
252		      	    struct ieee80211_channel *,
253			    struct ieee80211_channel *, uint16_t[]);
254static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
255		      	    struct ieee80211_channel *,
256			    struct ieee80211_channel *, uint16_t[]);
257static void		urtwn_set_txpower(struct urtwn_softc *,
258		    	    struct ieee80211_channel *,
259			    struct ieee80211_channel *);
260static void		urtwn_scan_start(struct ieee80211com *);
261static void		urtwn_scan_end(struct ieee80211com *);
262static void		urtwn_set_channel(struct ieee80211com *);
263static void		urtwn_set_chan(struct urtwn_softc *,
264		    	    struct ieee80211_channel *,
265			    struct ieee80211_channel *);
266static void		urtwn_update_mcast(struct ifnet *);
267static void		urtwn_iq_calib(struct urtwn_softc *);
268static void		urtwn_lc_calib(struct urtwn_softc *);
269static void		urtwn_init(void *);
270static void		urtwn_init_locked(void *);
271static void		urtwn_stop(struct ifnet *);
272static void		urtwn_stop_locked(struct ifnet *);
273static void		urtwn_abort_xfers(struct urtwn_softc *);
274static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
275			    const struct ieee80211_bpf_params *);
276static void		urtwn_ms_delay(struct urtwn_softc *);
277
278/* Aliases. */
279#define	urtwn_bb_write	urtwn_write_4
280#define urtwn_bb_read	urtwn_read_4
281
282static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
283	[URTWN_BULK_RX] = {
284		.type = UE_BULK,
285		.endpoint = UE_ADDR_ANY,
286		.direction = UE_DIR_IN,
287		.bufsize = URTWN_RXBUFSZ,
288		.flags = {
289			.pipe_bof = 1,
290			.short_xfer_ok = 1
291		},
292		.callback = urtwn_bulk_rx_callback,
293	},
294	[URTWN_BULK_TX_BE] = {
295		.type = UE_BULK,
296		.endpoint = 0x03,
297		.direction = UE_DIR_OUT,
298		.bufsize = URTWN_TXBUFSZ,
299		.flags = {
300			.ext_buffer = 1,
301			.pipe_bof = 1,
302			.force_short_xfer = 1
303		},
304		.callback = urtwn_bulk_tx_callback,
305		.timeout = URTWN_TX_TIMEOUT,	/* ms */
306	},
307	[URTWN_BULK_TX_BK] = {
308		.type = UE_BULK,
309		.endpoint = 0x03,
310		.direction = UE_DIR_OUT,
311		.bufsize = URTWN_TXBUFSZ,
312		.flags = {
313			.ext_buffer = 1,
314			.pipe_bof = 1,
315			.force_short_xfer = 1,
316		},
317		.callback = urtwn_bulk_tx_callback,
318		.timeout = URTWN_TX_TIMEOUT,	/* ms */
319	},
320	[URTWN_BULK_TX_VI] = {
321		.type = UE_BULK,
322		.endpoint = 0x02,
323		.direction = UE_DIR_OUT,
324		.bufsize = URTWN_TXBUFSZ,
325		.flags = {
326			.ext_buffer = 1,
327			.pipe_bof = 1,
328			.force_short_xfer = 1
329		},
330		.callback = urtwn_bulk_tx_callback,
331		.timeout = URTWN_TX_TIMEOUT,	/* ms */
332	},
333	[URTWN_BULK_TX_VO] = {
334		.type = UE_BULK,
335		.endpoint = 0x02,
336		.direction = UE_DIR_OUT,
337		.bufsize = URTWN_TXBUFSZ,
338		.flags = {
339			.ext_buffer = 1,
340			.pipe_bof = 1,
341			.force_short_xfer = 1
342		},
343		.callback = urtwn_bulk_tx_callback,
344		.timeout = URTWN_TX_TIMEOUT,	/* ms */
345	},
346};
347
348static int
349urtwn_match(device_t self)
350{
351	struct usb_attach_arg *uaa = device_get_ivars(self);
352
353	if (uaa->usb_mode != USB_MODE_HOST)
354		return (ENXIO);
355	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
356		return (ENXIO);
357	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
358		return (ENXIO);
359
360	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
361}
362
363static int
364urtwn_attach(device_t self)
365{
366	struct usb_attach_arg *uaa = device_get_ivars(self);
367	struct urtwn_softc *sc = device_get_softc(self);
368	struct ifnet *ifp;
369	struct ieee80211com *ic;
370	uint8_t iface_index, bands;
371	int error;
372
373	device_set_usb_desc(self);
374	sc->sc_udev = uaa->device;
375	sc->sc_dev = self;
376	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
377		sc->chip |= URTWN_CHIP_88E;
378
379	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
380	    MTX_NETWORK_LOCK, MTX_DEF);
381	callout_init(&sc->sc_watchdog_ch, 0);
382
383	iface_index = URTWN_IFACE_INDEX;
384	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
385	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
386	if (error) {
387		device_printf(self, "could not allocate USB transfers, "
388		    "err=%s\n", usbd_errstr(error));
389		goto detach;
390	}
391
392	URTWN_LOCK(sc);
393
394	error = urtwn_read_chipid(sc);
395	if (error) {
396		device_printf(sc->sc_dev, "unsupported test chip\n");
397		URTWN_UNLOCK(sc);
398		goto detach;
399	}
400
401	/* Determine number of Tx/Rx chains. */
402	if (sc->chip & URTWN_CHIP_92C) {
403		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
404		sc->nrxchains = 2;
405	} else {
406		sc->ntxchains = 1;
407		sc->nrxchains = 1;
408	}
409
410	if (sc->chip & URTWN_CHIP_88E)
411		urtwn_r88e_read_rom(sc);
412	else
413		urtwn_read_rom(sc);
414
415	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
416	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
417	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
418	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
419	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
420	    "8188CUS", sc->ntxchains, sc->nrxchains);
421
422	URTWN_UNLOCK(sc);
423
424	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
425	if (ifp == NULL) {
426		device_printf(sc->sc_dev, "can not if_alloc()\n");
427		goto detach;
428	}
429	ic = ifp->if_l2com;
430
431	ifp->if_softc = sc;
432	if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
433	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
434	ifp->if_init = urtwn_init;
435	ifp->if_ioctl = urtwn_ioctl;
436	ifp->if_start = urtwn_start;
437	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
438	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
439	IFQ_SET_READY(&ifp->if_snd);
440
441	ic->ic_ifp = ifp;
442	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
443	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
444
445	/* set device capabilities */
446	ic->ic_caps =
447		  IEEE80211_C_STA		/* station mode */
448		| IEEE80211_C_MONITOR		/* monitor mode */
449		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
450		| IEEE80211_C_SHSLOT		/* short slot time supported */
451		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
452		| IEEE80211_C_WPA		/* 802.11i */
453		;
454
455	bands = 0;
456	setbit(&bands, IEEE80211_MODE_11B);
457	setbit(&bands, IEEE80211_MODE_11G);
458	ieee80211_init_channels(ic, NULL, &bands);
459
460	ieee80211_ifattach(ic, sc->sc_bssid);
461	ic->ic_raw_xmit = urtwn_raw_xmit;
462	ic->ic_scan_start = urtwn_scan_start;
463	ic->ic_scan_end = urtwn_scan_end;
464	ic->ic_set_channel = urtwn_set_channel;
465
466	ic->ic_vap_create = urtwn_vap_create;
467	ic->ic_vap_delete = urtwn_vap_delete;
468	ic->ic_update_mcast = urtwn_update_mcast;
469
470	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
471	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
472	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
473	    URTWN_RX_RADIOTAP_PRESENT);
474
475	if (bootverbose)
476		ieee80211_announce(ic);
477
478	return (0);
479
480detach:
481	urtwn_detach(self);
482	return (ENXIO);			/* failure */
483}
484
485static int
486urtwn_detach(device_t self)
487{
488	struct urtwn_softc *sc = device_get_softc(self);
489	struct ifnet *ifp = sc->sc_ifp;
490	struct ieee80211com *ic = ifp->if_l2com;
491	unsigned int x;
492
493	/* Prevent further ioctls. */
494	URTWN_LOCK(sc);
495	sc->sc_flags |= URTWN_DETACHED;
496	URTWN_UNLOCK(sc);
497
498	urtwn_stop(ifp);
499
500	callout_drain(&sc->sc_watchdog_ch);
501
502	/* Prevent further allocations from RX/TX data lists. */
503	URTWN_LOCK(sc);
504	STAILQ_INIT(&sc->sc_tx_active);
505	STAILQ_INIT(&sc->sc_tx_inactive);
506	STAILQ_INIT(&sc->sc_tx_pending);
507
508	STAILQ_INIT(&sc->sc_rx_active);
509	STAILQ_INIT(&sc->sc_rx_inactive);
510	URTWN_UNLOCK(sc);
511
512	/* drain USB transfers */
513	for (x = 0; x != URTWN_N_TRANSFER; x++)
514		usbd_transfer_drain(sc->sc_xfer[x]);
515
516	/* Free data buffers. */
517	URTWN_LOCK(sc);
518	urtwn_free_tx_list(sc);
519	urtwn_free_rx_list(sc);
520	URTWN_UNLOCK(sc);
521
522	/* stop all USB transfers */
523	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
524	ieee80211_ifdetach(ic);
525
526	if_free(ifp);
527	mtx_destroy(&sc->sc_mtx);
528
529	return (0);
530}
531
532static void
533urtwn_free_tx_list(struct urtwn_softc *sc)
534{
535	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
536}
537
538static void
539urtwn_free_rx_list(struct urtwn_softc *sc)
540{
541	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
542}
543
544static void
545urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
546{
547	int i;
548
549	for (i = 0; i < ndata; i++) {
550		struct urtwn_data *dp = &data[i];
551
552		if (dp->buf != NULL) {
553			free(dp->buf, M_USBDEV);
554			dp->buf = NULL;
555		}
556		if (dp->ni != NULL) {
557			ieee80211_free_node(dp->ni);
558			dp->ni = NULL;
559		}
560	}
561}
562
563static usb_error_t
564urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
565    void *data)
566{
567	usb_error_t err;
568	int ntries = 10;
569
570	URTWN_ASSERT_LOCKED(sc);
571
572	while (ntries--) {
573		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
574		    req, data, 0, NULL, 250 /* ms */);
575		if (err == 0)
576			break;
577
578		DPRINTFN(1, "Control request failed, %s (retrying)\n",
579		    usbd_errstr(err));
580		usb_pause_mtx(&sc->sc_mtx, hz / 100);
581	}
582	return (err);
583}
584
585static struct ieee80211vap *
586urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
587    enum ieee80211_opmode opmode, int flags,
588    const uint8_t bssid[IEEE80211_ADDR_LEN],
589    const uint8_t mac[IEEE80211_ADDR_LEN])
590{
591	struct urtwn_vap *uvp;
592	struct ieee80211vap *vap;
593
594	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
595		return (NULL);
596
597	uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
598	    M_80211_VAP, M_NOWAIT | M_ZERO);
599	if (uvp == NULL)
600		return (NULL);
601	vap = &uvp->vap;
602	/* enable s/w bmiss handling for sta mode */
603
604	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
605	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
606		/* out of memory */
607		free(uvp, M_80211_VAP);
608		return (NULL);
609	}
610
611	/* override state transition machine */
612	uvp->newstate = vap->iv_newstate;
613	vap->iv_newstate = urtwn_newstate;
614
615	/* complete setup */
616	ieee80211_vap_attach(vap, ieee80211_media_change,
617	    ieee80211_media_status);
618	ic->ic_opmode = opmode;
619	return (vap);
620}
621
622static void
623urtwn_vap_delete(struct ieee80211vap *vap)
624{
625	struct urtwn_vap *uvp = URTWN_VAP(vap);
626
627	ieee80211_vap_detach(vap);
628	free(uvp, M_80211_VAP);
629}
630
631static struct mbuf *
632urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
633{
634	struct ifnet *ifp = sc->sc_ifp;
635	struct ieee80211com *ic = ifp->if_l2com;
636	struct ieee80211_frame *wh;
637	struct mbuf *m;
638	struct r92c_rx_stat *stat;
639	uint32_t rxdw0, rxdw3;
640	uint8_t rate;
641	int8_t rssi = 0;
642	int infosz;
643
644	/*
645	 * don't pass packets to the ieee80211 framework if the driver isn't
646	 * RUNNING.
647	 */
648	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
649		return (NULL);
650
651	stat = (struct r92c_rx_stat *)buf;
652	rxdw0 = le32toh(stat->rxdw0);
653	rxdw3 = le32toh(stat->rxdw3);
654
655	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
656		/*
657		 * This should not happen since we setup our Rx filter
658		 * to not receive these frames.
659		 */
660		ifp->if_ierrors++;
661		return (NULL);
662	}
663	if (pktlen < sizeof(*wh) || pktlen > MCLBYTES) {
664		ifp->if_ierrors++;
665		return (NULL);
666	}
667
668	rate = MS(rxdw3, R92C_RXDW3_RATE);
669	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
670
671	/* Get RSSI from PHY status descriptor if present. */
672	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
673		if (sc->chip & URTWN_CHIP_88E)
674			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
675		else
676			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
677		/* Update our average RSSI. */
678		urtwn_update_avgrssi(sc, rate, rssi);
679		/*
680		 * Convert the RSSI to a range that will be accepted
681		 * by net80211.
682		 */
683		rssi = URTWN_RSSI(rssi);
684	}
685
686	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
687	if (m == NULL) {
688		device_printf(sc->sc_dev, "could not create RX mbuf\n");
689		return (NULL);
690	}
691
692	/* Finalize mbuf. */
693	m->m_pkthdr.rcvif = ifp;
694	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
695	memcpy(mtod(m, uint8_t *), wh, pktlen);
696	m->m_pkthdr.len = m->m_len = pktlen;
697
698	if (ieee80211_radiotap_active(ic)) {
699		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
700
701		tap->wr_flags = 0;
702		/* Map HW rate index to 802.11 rate. */
703		if (!(rxdw3 & R92C_RXDW3_HT)) {
704			switch (rate) {
705			/* CCK. */
706			case  0: tap->wr_rate =   2; break;
707			case  1: tap->wr_rate =   4; break;
708			case  2: tap->wr_rate =  11; break;
709			case  3: tap->wr_rate =  22; break;
710			/* OFDM. */
711			case  4: tap->wr_rate =  12; break;
712			case  5: tap->wr_rate =  18; break;
713			case  6: tap->wr_rate =  24; break;
714			case  7: tap->wr_rate =  36; break;
715			case  8: tap->wr_rate =  48; break;
716			case  9: tap->wr_rate =  72; break;
717			case 10: tap->wr_rate =  96; break;
718			case 11: tap->wr_rate = 108; break;
719			}
720		} else if (rate >= 12) {	/* MCS0~15. */
721			/* Bit 7 set means HT MCS instead of rate. */
722			tap->wr_rate = 0x80 | (rate - 12);
723		}
724		tap->wr_dbm_antsignal = rssi;
725		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
726		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
727	}
728
729	*rssi_p = rssi;
730
731	return (m);
732}
733
734static struct mbuf *
735urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
736    int8_t *nf)
737{
738	struct urtwn_softc *sc = data->sc;
739	struct ifnet *ifp = sc->sc_ifp;
740	struct r92c_rx_stat *stat;
741	struct mbuf *m, *m0 = NULL, *prevm = NULL;
742	uint32_t rxdw0;
743	uint8_t *buf;
744	int len, totlen, pktlen, infosz, npkts;
745
746	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
747
748	if (len < sizeof(*stat)) {
749		ifp->if_ierrors++;
750		return (NULL);
751	}
752
753	buf = data->buf;
754	/* Get the number of encapsulated frames. */
755	stat = (struct r92c_rx_stat *)buf;
756	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
757	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
758
759	/* Process all of them. */
760	while (npkts-- > 0) {
761		if (len < sizeof(*stat))
762			break;
763		stat = (struct r92c_rx_stat *)buf;
764		rxdw0 = le32toh(stat->rxdw0);
765
766		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
767		if (pktlen == 0)
768			break;
769
770		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
771
772		/* Make sure everything fits in xfer. */
773		totlen = sizeof(*stat) + infosz + pktlen;
774		if (totlen > len)
775			break;
776
777		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
778		if (m0 == NULL)
779			m0 = m;
780		if (prevm == NULL)
781			prevm = m;
782		else {
783			prevm->m_next = m;
784			prevm = m;
785		}
786
787		/* Next chunk is 128-byte aligned. */
788		totlen = (totlen + 127) & ~127;
789		buf += totlen;
790		len -= totlen;
791	}
792
793	return (m0);
794}
795
796static void
797urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
798{
799	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
800	struct ifnet *ifp = sc->sc_ifp;
801	struct ieee80211com *ic = ifp->if_l2com;
802	struct ieee80211_frame *wh;
803	struct ieee80211_node *ni;
804	struct mbuf *m = NULL, *next;
805	struct urtwn_data *data;
806	int8_t nf;
807	int rssi = 1;
808
809	URTWN_ASSERT_LOCKED(sc);
810
811	switch (USB_GET_STATE(xfer)) {
812	case USB_ST_TRANSFERRED:
813		data = STAILQ_FIRST(&sc->sc_rx_active);
814		if (data == NULL)
815			goto tr_setup;
816		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
817		m = urtwn_rxeof(xfer, data, &rssi, &nf);
818		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
819		/* FALLTHROUGH */
820	case USB_ST_SETUP:
821tr_setup:
822		data = STAILQ_FIRST(&sc->sc_rx_inactive);
823		if (data == NULL) {
824			KASSERT(m == NULL, ("mbuf isn't NULL"));
825			return;
826		}
827		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
828		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
829		usbd_xfer_set_frame_data(xfer, 0, data->buf,
830		    usbd_xfer_max_len(xfer));
831		usbd_transfer_submit(xfer);
832
833		/*
834		 * To avoid LOR we should unlock our private mutex here to call
835		 * ieee80211_input() because here is at the end of a USB
836		 * callback and safe to unlock.
837		 */
838		URTWN_UNLOCK(sc);
839		while (m != NULL) {
840			next = m->m_next;
841			m->m_next = NULL;
842			wh = mtod(m, struct ieee80211_frame *);
843			ni = ieee80211_find_rxnode(ic,
844			    (struct ieee80211_frame_min *)wh);
845			nf = URTWN_NOISE_FLOOR;
846			if (ni != NULL) {
847				(void)ieee80211_input(ni, m, rssi, nf);
848				ieee80211_free_node(ni);
849			} else
850				(void)ieee80211_input_all(ic, m, rssi, nf);
851			m = next;
852		}
853		URTWN_LOCK(sc);
854		break;
855	default:
856		/* needs it to the inactive queue due to a error. */
857		data = STAILQ_FIRST(&sc->sc_rx_active);
858		if (data != NULL) {
859			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
860			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
861		}
862		if (error != USB_ERR_CANCELLED) {
863			usbd_xfer_set_stall(xfer);
864			ifp->if_ierrors++;
865			goto tr_setup;
866		}
867		break;
868	}
869}
870
871static void
872urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
873{
874	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
875	struct ifnet *ifp = sc->sc_ifp;
876	struct mbuf *m;
877
878	URTWN_ASSERT_LOCKED(sc);
879
880	/*
881	 * Do any tx complete callback.  Note this must be done before releasing
882	 * the node reference.
883	 */
884	if (data->m) {
885		m = data->m;
886		if (m->m_flags & M_TXCB) {
887			/* XXX status? */
888			ieee80211_process_callback(data->ni, m, 0);
889		}
890		m_freem(m);
891		data->m = NULL;
892	}
893	if (data->ni) {
894		ieee80211_free_node(data->ni);
895		data->ni = NULL;
896	}
897	sc->sc_txtimer = 0;
898	ifp->if_opackets++;
899	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
900}
901
902static void
903urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
904{
905	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
906	struct ifnet *ifp = sc->sc_ifp;
907	struct urtwn_data *data;
908
909	URTWN_ASSERT_LOCKED(sc);
910
911	switch (USB_GET_STATE(xfer)){
912	case USB_ST_TRANSFERRED:
913		data = STAILQ_FIRST(&sc->sc_tx_active);
914		if (data == NULL)
915			goto tr_setup;
916		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
917		urtwn_txeof(xfer, data);
918		STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
919		/* FALLTHROUGH */
920	case USB_ST_SETUP:
921tr_setup:
922		data = STAILQ_FIRST(&sc->sc_tx_pending);
923		if (data == NULL) {
924			DPRINTF("%s: empty pending queue\n", __func__);
925			return;
926		}
927		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
928		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
929		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
930		usbd_transfer_submit(xfer);
931		urtwn_start_locked(ifp, sc);
932		break;
933	default:
934		data = STAILQ_FIRST(&sc->sc_tx_active);
935		if (data == NULL)
936			goto tr_setup;
937		if (data->ni != NULL) {
938			ieee80211_free_node(data->ni);
939			data->ni = NULL;
940			ifp->if_oerrors++;
941		}
942		if (error != USB_ERR_CANCELLED) {
943			usbd_xfer_set_stall(xfer);
944			goto tr_setup;
945		}
946		break;
947	}
948}
949
950static struct urtwn_data *
951_urtwn_getbuf(struct urtwn_softc *sc)
952{
953	struct urtwn_data *bf;
954
955	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
956	if (bf != NULL)
957		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
958	else
959		bf = NULL;
960	if (bf == NULL)
961		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
962	return (bf);
963}
964
965static struct urtwn_data *
966urtwn_getbuf(struct urtwn_softc *sc)
967{
968        struct urtwn_data *bf;
969
970	URTWN_ASSERT_LOCKED(sc);
971
972	bf = _urtwn_getbuf(sc);
973	if (bf == NULL) {
974		struct ifnet *ifp = sc->sc_ifp;
975		DPRINTF("%s: stop queue\n", __func__);
976		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
977	}
978	return (bf);
979}
980
981static int
982urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
983    int len)
984{
985	usb_device_request_t req;
986
987	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
988	req.bRequest = R92C_REQ_REGS;
989	USETW(req.wValue, addr);
990	USETW(req.wIndex, 0);
991	USETW(req.wLength, len);
992	return (urtwn_do_request(sc, &req, buf));
993}
994
995static void
996urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
997{
998	urtwn_write_region_1(sc, addr, &val, 1);
999}
1000
1001
1002static void
1003urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1004{
1005	val = htole16(val);
1006	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1007}
1008
1009static void
1010urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1011{
1012	val = htole32(val);
1013	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1014}
1015
1016static int
1017urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1018    int len)
1019{
1020	usb_device_request_t req;
1021
1022	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1023	req.bRequest = R92C_REQ_REGS;
1024	USETW(req.wValue, addr);
1025	USETW(req.wIndex, 0);
1026	USETW(req.wLength, len);
1027	return (urtwn_do_request(sc, &req, buf));
1028}
1029
1030static uint8_t
1031urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1032{
1033	uint8_t val;
1034
1035	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1036		return (0xff);
1037	return (val);
1038}
1039
1040static uint16_t
1041urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1042{
1043	uint16_t val;
1044
1045	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1046		return (0xffff);
1047	return (le16toh(val));
1048}
1049
1050static uint32_t
1051urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1052{
1053	uint32_t val;
1054
1055	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1056		return (0xffffffff);
1057	return (le32toh(val));
1058}
1059
1060static int
1061urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1062{
1063	struct r92c_fw_cmd cmd;
1064	int ntries;
1065
1066	/* Wait for current FW box to be empty. */
1067	for (ntries = 0; ntries < 100; ntries++) {
1068		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1069			break;
1070		urtwn_ms_delay(sc);
1071	}
1072	if (ntries == 100) {
1073		device_printf(sc->sc_dev,
1074		    "could not send firmware command\n");
1075		return (ETIMEDOUT);
1076	}
1077	memset(&cmd, 0, sizeof(cmd));
1078	cmd.id = id;
1079	if (len > 3)
1080		cmd.id |= R92C_CMD_FLAG_EXT;
1081	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1082	memcpy(cmd.msg, buf, len);
1083
1084	/* Write the first word last since that will trigger the FW. */
1085	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1086	    (uint8_t *)&cmd + 4, 2);
1087	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1088	    (uint8_t *)&cmd + 0, 4);
1089
1090	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1091	return (0);
1092}
1093
1094static __inline void
1095urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1096{
1097
1098	sc->sc_rf_write(sc, chain, addr, val);
1099}
1100
1101static void
1102urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1103    uint32_t val)
1104{
1105	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1106	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1107	    SM(R92C_LSSI_PARAM_DATA, val));
1108}
1109
1110static void
1111urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1112uint32_t val)
1113{
1114	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1115	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1116	    SM(R92C_LSSI_PARAM_DATA, val));
1117}
1118
1119static uint32_t
1120urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1121{
1122	uint32_t reg[R92C_MAX_CHAINS], val;
1123
1124	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1125	if (chain != 0)
1126		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1127
1128	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1129	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1130	urtwn_ms_delay(sc);
1131
1132	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1133	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1134	    R92C_HSSI_PARAM2_READ_EDGE);
1135	urtwn_ms_delay(sc);
1136
1137	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1138	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1139	urtwn_ms_delay(sc);
1140
1141	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1142		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1143	else
1144		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1145	return (MS(val, R92C_LSSI_READBACK_DATA));
1146}
1147
1148static int
1149urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1150{
1151	int ntries;
1152
1153	urtwn_write_4(sc, R92C_LLT_INIT,
1154	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1155	    SM(R92C_LLT_INIT_ADDR, addr) |
1156	    SM(R92C_LLT_INIT_DATA, data));
1157	/* Wait for write operation to complete. */
1158	for (ntries = 0; ntries < 20; ntries++) {
1159		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1160		    R92C_LLT_INIT_OP_NO_ACTIVE)
1161			return (0);
1162		urtwn_ms_delay(sc);
1163	}
1164	return (ETIMEDOUT);
1165}
1166
1167static uint8_t
1168urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1169{
1170	uint32_t reg;
1171	int ntries;
1172
1173	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1174	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1175	reg &= ~R92C_EFUSE_CTRL_VALID;
1176	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1177	/* Wait for read operation to complete. */
1178	for (ntries = 0; ntries < 100; ntries++) {
1179		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1180		if (reg & R92C_EFUSE_CTRL_VALID)
1181			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1182		urtwn_ms_delay(sc);
1183	}
1184	device_printf(sc->sc_dev,
1185	    "could not read efuse byte at address 0x%x\n", addr);
1186	return (0xff);
1187}
1188
1189static void
1190urtwn_efuse_read(struct urtwn_softc *sc)
1191{
1192	uint8_t *rom = (uint8_t *)&sc->rom;
1193	uint16_t addr = 0;
1194	uint32_t reg;
1195	uint8_t off, msk;
1196	int i;
1197
1198	urtwn_efuse_switch_power(sc);
1199
1200	memset(&sc->rom, 0xff, sizeof(sc->rom));
1201	while (addr < 512) {
1202		reg = urtwn_efuse_read_1(sc, addr);
1203		if (reg == 0xff)
1204			break;
1205		addr++;
1206		off = reg >> 4;
1207		msk = reg & 0xf;
1208		for (i = 0; i < 4; i++) {
1209			if (msk & (1 << i))
1210				continue;
1211			rom[off * 8 + i * 2 + 0] =
1212			    urtwn_efuse_read_1(sc, addr);
1213			addr++;
1214			rom[off * 8 + i * 2 + 1] =
1215			    urtwn_efuse_read_1(sc, addr);
1216			addr++;
1217		}
1218	}
1219#ifdef URTWN_DEBUG
1220	if (urtwn_debug >= 2) {
1221		/* Dump ROM content. */
1222		printf("\n");
1223		for (i = 0; i < sizeof(sc->rom); i++)
1224			printf("%02x:", rom[i]);
1225		printf("\n");
1226	}
1227#endif
1228}
1229static void
1230urtwn_efuse_switch_power(struct urtwn_softc *sc)
1231{
1232	uint32_t reg;
1233
1234	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1235	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1236		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1237		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1238	}
1239	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1240	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1241		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1242		    reg | R92C_SYS_FUNC_EN_ELDR);
1243	}
1244	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1245	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1246	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1247		urtwn_write_2(sc, R92C_SYS_CLKR,
1248		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1249	}
1250}
1251
1252static int
1253urtwn_read_chipid(struct urtwn_softc *sc)
1254{
1255	uint32_t reg;
1256
1257	if (sc->chip & URTWN_CHIP_88E)
1258		return (0);
1259
1260	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1261	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1262		return (EIO);
1263
1264	if (reg & R92C_SYS_CFG_TYPE_92C) {
1265		sc->chip |= URTWN_CHIP_92C;
1266		/* Check if it is a castrated 8192C. */
1267		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1268		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1269		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1270			sc->chip |= URTWN_CHIP_92C_1T2R;
1271	}
1272	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1273		sc->chip |= URTWN_CHIP_UMC;
1274		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1275			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1276	}
1277	return (0);
1278}
1279
1280static void
1281urtwn_read_rom(struct urtwn_softc *sc)
1282{
1283	struct r92c_rom *rom = &sc->rom;
1284
1285	/* Read full ROM image. */
1286	urtwn_efuse_read(sc);
1287
1288	/* XXX Weird but this is what the vendor driver does. */
1289	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1290	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1291
1292	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1293
1294	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1295	DPRINTF("regulatory type=%d\n", sc->regulatory);
1296	IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1297
1298	sc->sc_rf_write = urtwn_r92c_rf_write;
1299	sc->sc_power_on = urtwn_r92c_power_on;
1300	sc->sc_dma_init = urtwn_r92c_dma_init;
1301}
1302
1303static void
1304urtwn_r88e_read_rom(struct urtwn_softc *sc)
1305{
1306	uint8_t *rom = sc->r88e_rom;
1307	uint16_t addr = 0;
1308	uint32_t reg;
1309	uint8_t off, msk, tmp;
1310	int i;
1311
1312	off = 0;
1313	urtwn_efuse_switch_power(sc);
1314
1315	/* Read full ROM image. */
1316	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1317	while (addr < 1024) {
1318		reg = urtwn_efuse_read_1(sc, addr);
1319		if (reg == 0xff)
1320			break;
1321		addr++;
1322		if ((reg & 0x1f) == 0x0f) {
1323			tmp = (reg & 0xe0) >> 5;
1324			reg = urtwn_efuse_read_1(sc, addr);
1325			if ((reg & 0x0f) != 0x0f)
1326				off = ((reg & 0xf0) >> 1) | tmp;
1327			addr++;
1328		} else
1329			off = reg >> 4;
1330		msk = reg & 0xf;
1331		for (i = 0; i < 4; i++) {
1332			if (msk & (1 << i))
1333				continue;
1334			rom[off * 8 + i * 2 + 0] =
1335			    urtwn_efuse_read_1(sc, addr);
1336			addr++;
1337			rom[off * 8 + i * 2 + 1] =
1338			    urtwn_efuse_read_1(sc, addr);
1339			addr++;
1340		}
1341	}
1342
1343	addr = 0x10;
1344	for (i = 0; i < 6; i++)
1345		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1346	for (i = 0; i < 5; i++)
1347		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1348	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1349	if (sc->bw20_tx_pwr_diff & 0x08)
1350		sc->bw20_tx_pwr_diff |= 0xf0;
1351	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1352	if (sc->ofdm_tx_pwr_diff & 0x08)
1353		sc->ofdm_tx_pwr_diff |= 0xf0;
1354	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1355	IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->r88e_rom[0xd7]);
1356
1357	sc->sc_rf_write = urtwn_r88e_rf_write;
1358	sc->sc_power_on = urtwn_r88e_power_on;
1359	sc->sc_dma_init = urtwn_r88e_dma_init;
1360}
1361
1362/*
1363 * Initialize rate adaptation in firmware.
1364 */
1365static int
1366urtwn_ra_init(struct urtwn_softc *sc)
1367{
1368	static const uint8_t map[] =
1369	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1370	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1371	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1372	struct ieee80211_node *ni;
1373	struct ieee80211_rateset *rs;
1374	struct r92c_fw_cmd_macid_cfg cmd;
1375	uint32_t rates, basicrates;
1376	uint8_t mode;
1377	int maxrate, maxbasicrate, error, i, j;
1378
1379	ni = ieee80211_ref_node(vap->iv_bss);
1380	rs = &ni->ni_rates;
1381
1382	/* Get normal and basic rates mask. */
1383	rates = basicrates = 0;
1384	maxrate = maxbasicrate = 0;
1385	for (i = 0; i < rs->rs_nrates; i++) {
1386		/* Convert 802.11 rate to HW rate index. */
1387		for (j = 0; j < nitems(map); j++)
1388			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1389				break;
1390		if (j == nitems(map))	/* Unknown rate, skip. */
1391			continue;
1392		rates |= 1 << j;
1393		if (j > maxrate)
1394			maxrate = j;
1395		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1396			basicrates |= 1 << j;
1397			if (j > maxbasicrate)
1398				maxbasicrate = j;
1399		}
1400	}
1401	if (ic->ic_curmode == IEEE80211_MODE_11B)
1402		mode = R92C_RAID_11B;
1403	else
1404		mode = R92C_RAID_11BG;
1405	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1406	    mode, rates, basicrates);
1407
1408	/* Set rates mask for group addressed frames. */
1409	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1410	cmd.mask = htole32(mode << 28 | basicrates);
1411	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1412	if (error != 0) {
1413		ieee80211_free_node(ni);
1414		device_printf(sc->sc_dev,
1415		    "could not add broadcast station\n");
1416		return (error);
1417	}
1418	/* Set initial MRR rate. */
1419	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1420	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1421	    maxbasicrate);
1422
1423	/* Set rates mask for unicast frames. */
1424	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1425	cmd.mask = htole32(mode << 28 | rates);
1426	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1427	if (error != 0) {
1428		ieee80211_free_node(ni);
1429		device_printf(sc->sc_dev, "could not add BSS station\n");
1430		return (error);
1431	}
1432	/* Set initial MRR rate. */
1433	DPRINTF("maxrate=%d\n", maxrate);
1434	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1435	    maxrate);
1436
1437	/* Indicate highest supported rate. */
1438	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1439	ieee80211_free_node(ni);
1440
1441	return (0);
1442}
1443
1444void
1445urtwn_tsf_sync_enable(struct urtwn_softc *sc)
1446{
1447	struct ifnet *ifp = sc->sc_ifp;
1448	struct ieee80211com *ic = ifp->if_l2com;
1449	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1450	struct ieee80211_node *ni = vap->iv_bss;
1451
1452	uint64_t tsf;
1453
1454	/* Enable TSF synchronization. */
1455	urtwn_write_1(sc, R92C_BCN_CTRL,
1456	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1457
1458	urtwn_write_1(sc, R92C_BCN_CTRL,
1459	    urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1460
1461	/* Set initial TSF. */
1462	memcpy(&tsf, ni->ni_tstamp.data, 8);
1463	tsf = le64toh(tsf);
1464	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1465	tsf -= IEEE80211_DUR_TU;
1466	urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1467	urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1468
1469	urtwn_write_1(sc, R92C_BCN_CTRL,
1470	    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1471}
1472
1473static void
1474urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1475{
1476	uint8_t reg;
1477
1478	if (led == URTWN_LED_LINK) {
1479		if (sc->chip & URTWN_CHIP_88E) {
1480			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1481			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1482			if (!on) {
1483				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1484				urtwn_write_1(sc, R92C_LEDCFG2,
1485				    reg | R92C_LEDCFG0_DIS);
1486				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1487				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1488				    0xfe);
1489			}
1490		} else {
1491			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1492			if (!on)
1493				reg |= R92C_LEDCFG0_DIS;
1494			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1495		}
1496		sc->ledlink = on;       /* Save LED state. */
1497	}
1498}
1499
1500static int
1501urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1502{
1503	struct urtwn_vap *uvp = URTWN_VAP(vap);
1504	struct ieee80211com *ic = vap->iv_ic;
1505	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1506	struct ieee80211_node *ni;
1507	enum ieee80211_state ostate;
1508	uint32_t reg;
1509
1510	ostate = vap->iv_state;
1511	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1512	    ieee80211_state_name[nstate]);
1513
1514	IEEE80211_UNLOCK(ic);
1515	URTWN_LOCK(sc);
1516	callout_stop(&sc->sc_watchdog_ch);
1517
1518	if (ostate == IEEE80211_S_RUN) {
1519		/* Turn link LED off. */
1520		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1521
1522		/* Set media status to 'No Link'. */
1523		reg = urtwn_read_4(sc, R92C_CR);
1524		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1525		urtwn_write_4(sc, R92C_CR, reg);
1526
1527		/* Stop Rx of data frames. */
1528		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1529
1530		/* Rest TSF. */
1531		urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1532
1533		/* Disable TSF synchronization. */
1534		urtwn_write_1(sc, R92C_BCN_CTRL,
1535		    urtwn_read_1(sc, R92C_BCN_CTRL) |
1536		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1537
1538		/* Reset EDCA parameters. */
1539		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1540		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1541		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1542		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1543	}
1544
1545	switch (nstate) {
1546	case IEEE80211_S_INIT:
1547		/* Turn link LED off. */
1548		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1549		break;
1550	case IEEE80211_S_SCAN:
1551		if (ostate != IEEE80211_S_SCAN) {
1552			/* Allow Rx from any BSSID. */
1553			urtwn_write_4(sc, R92C_RCR,
1554			    urtwn_read_4(sc, R92C_RCR) &
1555			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1556
1557			/* Set gain for scanning. */
1558			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1559			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1560			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1561
1562			if (!(sc->chip & URTWN_CHIP_88E)) {
1563				reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1564				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1565				urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1566			}
1567		}
1568		/* Make link LED blink during scan. */
1569		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
1570
1571		/* Pause AC Tx queues. */
1572		urtwn_write_1(sc, R92C_TXPAUSE,
1573		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1574
1575		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1576		break;
1577	case IEEE80211_S_AUTH:
1578		/* Set initial gain under link. */
1579		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1580		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1581		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1582
1583		if (!(sc->chip & URTWN_CHIP_88E)) {
1584			reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1585			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1586			urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1587		}
1588		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1589		break;
1590	case IEEE80211_S_RUN:
1591		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1592			/* Enable Rx of data frames. */
1593			urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1594
1595			/* Turn link LED on. */
1596			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1597			break;
1598		}
1599
1600		ni = ieee80211_ref_node(vap->iv_bss);
1601		/* Set media status to 'Associated'. */
1602		reg = urtwn_read_4(sc, R92C_CR);
1603		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1604		urtwn_write_4(sc, R92C_CR, reg);
1605
1606		/* Set BSSID. */
1607		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1608		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1609
1610		if (ic->ic_curmode == IEEE80211_MODE_11B)
1611			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1612		else	/* 802.11b/g */
1613			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1614
1615		/* Enable Rx of data frames. */
1616		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1617
1618		/* Flush all AC queues. */
1619		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1620
1621		/* Set beacon interval. */
1622		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1623
1624		/* Allow Rx from our BSSID only. */
1625		urtwn_write_4(sc, R92C_RCR,
1626		    urtwn_read_4(sc, R92C_RCR) |
1627		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1628
1629		/* Enable TSF synchronization. */
1630		urtwn_tsf_sync_enable(sc);
1631
1632		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1633		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1634		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1635		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1636		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1637		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1638
1639		/* Intialize rate adaptation. */
1640		if (sc->chip & URTWN_CHIP_88E)
1641			ni->ni_txrate =
1642			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1643		else
1644			urtwn_ra_init(sc);
1645		/* Turn link LED on. */
1646		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1647
1648		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1649		/* Reset temperature calibration state machine. */
1650		sc->thcal_state = 0;
1651		sc->thcal_lctemp = 0;
1652		ieee80211_free_node(ni);
1653		break;
1654	default:
1655		break;
1656	}
1657	URTWN_UNLOCK(sc);
1658	IEEE80211_LOCK(ic);
1659	return(uvp->newstate(vap, nstate, arg));
1660}
1661
1662static void
1663urtwn_watchdog(void *arg)
1664{
1665	struct urtwn_softc *sc = arg;
1666	struct ifnet *ifp = sc->sc_ifp;
1667
1668	if (sc->sc_txtimer > 0) {
1669		if (--sc->sc_txtimer == 0) {
1670			device_printf(sc->sc_dev, "device timeout\n");
1671			ifp->if_oerrors++;
1672			return;
1673		}
1674		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1675	}
1676}
1677
1678static void
1679urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1680{
1681	int pwdb;
1682
1683	/* Convert antenna signal to percentage. */
1684	if (rssi <= -100 || rssi >= 20)
1685		pwdb = 0;
1686	else if (rssi >= 0)
1687		pwdb = 100;
1688	else
1689		pwdb = 100 + rssi;
1690	if (!(sc->chip & URTWN_CHIP_88E)) {
1691		if (rate <= 3) {
1692			/* CCK gain is smaller than OFDM/MCS gain. */
1693			pwdb += 6;
1694			if (pwdb > 100)
1695				pwdb = 100;
1696			if (pwdb <= 14)
1697				pwdb -= 4;
1698			else if (pwdb <= 26)
1699				pwdb -= 8;
1700			else if (pwdb <= 34)
1701				pwdb -= 6;
1702			else if (pwdb <= 42)
1703				pwdb -= 2;
1704		}
1705	}
1706	if (sc->avg_pwdb == -1)	/* Init. */
1707		sc->avg_pwdb = pwdb;
1708	else if (sc->avg_pwdb < pwdb)
1709		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1710	else
1711		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1712	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1713}
1714
1715static int8_t
1716urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1717{
1718	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1719	struct r92c_rx_phystat *phy;
1720	struct r92c_rx_cck *cck;
1721	uint8_t rpt;
1722	int8_t rssi;
1723
1724	if (rate <= 3) {
1725		cck = (struct r92c_rx_cck *)physt;
1726		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1727			rpt = (cck->agc_rpt >> 5) & 0x3;
1728			rssi = (cck->agc_rpt & 0x1f) << 1;
1729		} else {
1730			rpt = (cck->agc_rpt >> 6) & 0x3;
1731			rssi = cck->agc_rpt & 0x3e;
1732		}
1733		rssi = cckoff[rpt] - rssi;
1734	} else {	/* OFDM/HT. */
1735		phy = (struct r92c_rx_phystat *)physt;
1736		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1737	}
1738	return (rssi);
1739}
1740
1741static int8_t
1742urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1743{
1744	struct r92c_rx_phystat *phy;
1745	struct r88e_rx_cck *cck;
1746	uint8_t cck_agc_rpt, lna_idx, vga_idx;
1747	int8_t rssi;
1748
1749	rssi = 0;
1750	if (rate <= 3) {
1751		cck = (struct r88e_rx_cck *)physt;
1752		cck_agc_rpt = cck->agc_rpt;
1753		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1754		vga_idx = cck_agc_rpt & 0x1f;
1755		switch (lna_idx) {
1756		case 7:
1757			if (vga_idx <= 27)
1758				rssi = -100 + 2* (27 - vga_idx);
1759			else
1760				rssi = -100;
1761			break;
1762		case 6:
1763			rssi = -48 + 2 * (2 - vga_idx);
1764			break;
1765		case 5:
1766			rssi = -42 + 2 * (7 - vga_idx);
1767			break;
1768		case 4:
1769			rssi = -36 + 2 * (7 - vga_idx);
1770			break;
1771		case 3:
1772			rssi = -24 + 2 * (7 - vga_idx);
1773			break;
1774		case 2:
1775			rssi = -12 + 2 * (5 - vga_idx);
1776			break;
1777		case 1:
1778			rssi = 8 - (2 * vga_idx);
1779			break;
1780		case 0:
1781			rssi = 14 - (2 * vga_idx);
1782			break;
1783		}
1784		rssi += 6;
1785	} else {	/* OFDM/HT. */
1786		phy = (struct r92c_rx_phystat *)physt;
1787		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1788	}
1789	return (rssi);
1790}
1791
1792
1793static int
1794urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1795    struct mbuf *m0, struct urtwn_data *data)
1796{
1797	struct ifnet *ifp = sc->sc_ifp;
1798	struct ieee80211_frame *wh;
1799	struct ieee80211_key *k;
1800	struct ieee80211com *ic = ifp->if_l2com;
1801	struct ieee80211vap *vap = ni->ni_vap;
1802	struct usb_xfer *xfer;
1803	struct r92c_tx_desc *txd;
1804	uint8_t raid, type;
1805	uint16_t sum;
1806	int i, hasqos, xferlen;
1807	struct usb_xfer *urtwn_pipes[4] = {
1808		sc->sc_xfer[URTWN_BULK_TX_BE],
1809		sc->sc_xfer[URTWN_BULK_TX_BK],
1810		sc->sc_xfer[URTWN_BULK_TX_VI],
1811		sc->sc_xfer[URTWN_BULK_TX_VO]
1812	};
1813
1814	URTWN_ASSERT_LOCKED(sc);
1815
1816	/*
1817	 * Software crypto.
1818	 */
1819	wh = mtod(m0, struct ieee80211_frame *);
1820	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1821
1822	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1823		k = ieee80211_crypto_encap(ni, m0);
1824		if (k == NULL) {
1825			device_printf(sc->sc_dev,
1826			    "ieee80211_crypto_encap returns NULL.\n");
1827			/* XXX we don't expect the fragmented frames */
1828			m_freem(m0);
1829			return (ENOBUFS);
1830		}
1831
1832		/* in case packet header moved, reset pointer */
1833		wh = mtod(m0, struct ieee80211_frame *);
1834	}
1835
1836	switch (type) {
1837	case IEEE80211_FC0_TYPE_CTL:
1838	case IEEE80211_FC0_TYPE_MGT:
1839		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1840		break;
1841	default:
1842		KASSERT(M_WME_GETAC(m0) < 4,
1843		    ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1844		xfer = urtwn_pipes[M_WME_GETAC(m0)];
1845		break;
1846	}
1847
1848	hasqos = 0;
1849
1850	/* Fill Tx descriptor. */
1851	txd = (struct r92c_tx_desc *)data->buf;
1852	memset(txd, 0, sizeof(*txd));
1853
1854	txd->txdw0 |= htole32(
1855	    SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1856	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1857	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1858	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1859		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1860	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1861	    type == IEEE80211_FC0_TYPE_DATA) {
1862		if (ic->ic_curmode == IEEE80211_MODE_11B)
1863			raid = R92C_RAID_11B;
1864		else
1865			raid = R92C_RAID_11BG;
1866		if (sc->chip & URTWN_CHIP_88E) {
1867			txd->txdw1 |= htole32(
1868			    SM(R88E_TXDW1_MACID, URTWN_MACID_BSS) |
1869			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1870			    SM(R92C_TXDW1_RAID, raid));
1871			txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
1872		} else {
1873			txd->txdw1 |= htole32(
1874			    SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1875			    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1876		 	    SM(R92C_TXDW1_RAID, raid) | R92C_TXDW1_AGGBK);
1877		}
1878		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1879			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1880				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1881				    R92C_TXDW4_HWRTSEN);
1882			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1883				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1884				    R92C_TXDW4_HWRTSEN);
1885			}
1886		}
1887		/* Send RTS at OFDM24. */
1888		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1889		txd->txdw5 |= htole32(0x0001ff00);
1890		/* Send data at OFDM54. */
1891		if (sc->chip & URTWN_CHIP_88E)
1892			txd->txdw5 |= htole32(0x13 & 0x3f);
1893		else
1894			txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1895	} else {
1896		txd->txdw1 |= htole32(
1897		    SM(R92C_TXDW1_MACID, 0) |
1898		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1899		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1900
1901		/* Force CCK1. */
1902		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1903		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1904	}
1905	/* Set sequence number (already little endian). */
1906	txd->txdseq |= *(uint16_t *)wh->i_seq;
1907
1908	if (!hasqos) {
1909		/* Use HW sequence numbering for non-QoS frames. */
1910		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1911		txd->txdseq |= htole16(0x8000);
1912	} else
1913		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1914
1915	/* Compute Tx descriptor checksum. */
1916	sum = 0;
1917	for (i = 0; i < sizeof(*txd) / 2; i++)
1918		sum ^= ((uint16_t *)txd)[i];
1919	txd->txdsum = sum; 	/* NB: already little endian. */
1920
1921	if (ieee80211_radiotap_active_vap(vap)) {
1922		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1923
1924		tap->wt_flags = 0;
1925		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1926		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1927		ieee80211_radiotap_tx(vap, m0);
1928	}
1929
1930	xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1931	m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1932
1933	data->buflen = xferlen;
1934	data->ni = ni;
1935	data->m = m0;
1936
1937	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1938	usbd_transfer_start(xfer);
1939	return (0);
1940}
1941
1942static void
1943urtwn_start(struct ifnet *ifp)
1944{
1945	struct urtwn_softc *sc = ifp->if_softc;
1946
1947	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1948		return;
1949	URTWN_LOCK(sc);
1950	urtwn_start_locked(ifp, sc);
1951	URTWN_UNLOCK(sc);
1952}
1953
1954static void
1955urtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1956{
1957	struct ieee80211_node *ni;
1958	struct mbuf *m;
1959	struct urtwn_data *bf;
1960
1961	URTWN_ASSERT_LOCKED(sc);
1962	for (;;) {
1963		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1964		if (m == NULL)
1965			break;
1966		bf = urtwn_getbuf(sc);
1967		if (bf == NULL) {
1968			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1969			break;
1970		}
1971		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1972		m->m_pkthdr.rcvif = NULL;
1973
1974		if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1975			ifp->if_oerrors++;
1976			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1977			ieee80211_free_node(ni);
1978			break;
1979		}
1980
1981		sc->sc_txtimer = 5;
1982		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1983	}
1984}
1985
1986static int
1987urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1988{
1989	struct urtwn_softc *sc = ifp->if_softc;
1990	struct ieee80211com *ic = ifp->if_l2com;
1991	struct ifreq *ifr = (struct ifreq *) data;
1992	int error = 0, startall = 0;
1993
1994	URTWN_LOCK(sc);
1995	error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
1996	URTWN_UNLOCK(sc);
1997	if (error != 0)
1998		return (error);
1999
2000	switch (cmd) {
2001	case SIOCSIFFLAGS:
2002		if (ifp->if_flags & IFF_UP) {
2003			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2004				urtwn_init(ifp->if_softc);
2005				startall = 1;
2006			}
2007		} else {
2008			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2009				urtwn_stop(ifp);
2010		}
2011		if (startall)
2012			ieee80211_start_all(ic);
2013		break;
2014	case SIOCGIFMEDIA:
2015		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2016		break;
2017	case SIOCGIFADDR:
2018		error = ether_ioctl(ifp, cmd, data);
2019		break;
2020	default:
2021		error = EINVAL;
2022		break;
2023	}
2024	return (error);
2025}
2026
2027static int
2028urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
2029    int ndata, int maxsz)
2030{
2031	int i, error;
2032
2033	for (i = 0; i < ndata; i++) {
2034		struct urtwn_data *dp = &data[i];
2035		dp->sc = sc;
2036		dp->m = NULL;
2037		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
2038		if (dp->buf == NULL) {
2039			device_printf(sc->sc_dev,
2040			    "could not allocate buffer\n");
2041			error = ENOMEM;
2042			goto fail;
2043		}
2044		dp->ni = NULL;
2045	}
2046
2047	return (0);
2048fail:
2049	urtwn_free_list(sc, data, ndata);
2050	return (error);
2051}
2052
2053static int
2054urtwn_alloc_rx_list(struct urtwn_softc *sc)
2055{
2056        int error, i;
2057
2058	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
2059	    URTWN_RXBUFSZ);
2060	if (error != 0)
2061		return (error);
2062
2063	STAILQ_INIT(&sc->sc_rx_active);
2064	STAILQ_INIT(&sc->sc_rx_inactive);
2065
2066	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
2067		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
2068
2069	return (0);
2070}
2071
2072static int
2073urtwn_alloc_tx_list(struct urtwn_softc *sc)
2074{
2075	int error, i;
2076
2077	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
2078	    URTWN_TXBUFSZ);
2079	if (error != 0)
2080		return (error);
2081
2082	STAILQ_INIT(&sc->sc_tx_active);
2083	STAILQ_INIT(&sc->sc_tx_inactive);
2084	STAILQ_INIT(&sc->sc_tx_pending);
2085
2086	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
2087		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
2088
2089	return (0);
2090}
2091
2092static __inline int
2093urtwn_power_on(struct urtwn_softc *sc)
2094{
2095
2096	return sc->sc_power_on(sc);
2097}
2098
2099static int
2100urtwn_r92c_power_on(struct urtwn_softc *sc)
2101{
2102	uint32_t reg;
2103	int ntries;
2104
2105	/* Wait for autoload done bit. */
2106	for (ntries = 0; ntries < 1000; ntries++) {
2107		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2108			break;
2109		urtwn_ms_delay(sc);
2110	}
2111	if (ntries == 1000) {
2112		device_printf(sc->sc_dev,
2113		    "timeout waiting for chip autoload\n");
2114		return (ETIMEDOUT);
2115	}
2116
2117	/* Unlock ISO/CLK/Power control register. */
2118	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2119	/* Move SPS into PWM mode. */
2120	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2121	urtwn_ms_delay(sc);
2122
2123	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2124	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2125		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2126		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2127		urtwn_ms_delay(sc);
2128		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2129		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2130		    ~R92C_SYS_ISO_CTRL_MD2PP);
2131	}
2132
2133	/* Auto enable WLAN. */
2134	urtwn_write_2(sc, R92C_APS_FSMCO,
2135	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2136	for (ntries = 0; ntries < 1000; ntries++) {
2137		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2138		    R92C_APS_FSMCO_APFM_ONMAC))
2139			break;
2140		urtwn_ms_delay(sc);
2141	}
2142	if (ntries == 1000) {
2143		device_printf(sc->sc_dev,
2144		    "timeout waiting for MAC auto ON\n");
2145		return (ETIMEDOUT);
2146	}
2147
2148	/* Enable radio, GPIO and LED functions. */
2149	urtwn_write_2(sc, R92C_APS_FSMCO,
2150	    R92C_APS_FSMCO_AFSM_HSUS |
2151	    R92C_APS_FSMCO_PDN_EN |
2152	    R92C_APS_FSMCO_PFM_ALDN);
2153	/* Release RF digital isolation. */
2154	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2155	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2156
2157	/* Initialize MAC. */
2158	urtwn_write_1(sc, R92C_APSD_CTRL,
2159	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2160	for (ntries = 0; ntries < 200; ntries++) {
2161		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2162		    R92C_APSD_CTRL_OFF_STATUS))
2163			break;
2164		urtwn_ms_delay(sc);
2165	}
2166	if (ntries == 200) {
2167		device_printf(sc->sc_dev,
2168		    "timeout waiting for MAC initialization\n");
2169		return (ETIMEDOUT);
2170	}
2171
2172	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2173	reg = urtwn_read_2(sc, R92C_CR);
2174	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2175	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2176	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2177	    R92C_CR_ENSEC;
2178	urtwn_write_2(sc, R92C_CR, reg);
2179
2180	urtwn_write_1(sc, 0xfe10, 0x19);
2181	return (0);
2182}
2183
2184static int
2185urtwn_r88e_power_on(struct urtwn_softc *sc)
2186{
2187	uint8_t val;
2188	uint32_t reg;
2189	int ntries;
2190
2191	/* Wait for power ready bit. */
2192	for (ntries = 0; ntries < 5000; ntries++) {
2193		val = urtwn_read_1(sc, 0x6) & 0x2;
2194		if (val == 0x2)
2195			break;
2196		urtwn_ms_delay(sc);
2197	}
2198	if (ntries == 5000) {
2199		device_printf(sc->sc_dev,
2200		    "timeout waiting for chip power up\n");
2201		return (ETIMEDOUT);
2202	}
2203
2204	/* Reset BB. */
2205	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2206	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2207	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2208
2209	urtwn_write_1(sc, 0x26, urtwn_read_1(sc, 0x26) | 0x80);
2210
2211	/* Disable HWPDN. */
2212	urtwn_write_1(sc, 0x5, urtwn_read_1(sc, 0x5) & ~0x80);
2213
2214	/* Disable WL suspend. */
2215	urtwn_write_1(sc, 0x5, urtwn_read_1(sc, 0x5) & ~0x18);
2216
2217	urtwn_write_1(sc, 0x5, urtwn_read_1(sc, 0x5) | 0x1);
2218	for (ntries = 0; ntries < 5000; ntries++) {
2219		if (!(urtwn_read_1(sc, 0x5) & 0x1))
2220			break;
2221		urtwn_ms_delay(sc);
2222	}
2223	if (ntries == 5000)
2224		return (ETIMEDOUT);
2225
2226	/* Enable LDO normal mode. */
2227	urtwn_write_1(sc, 0x23, urtwn_read_1(sc, 0x23) & ~0x10);
2228
2229	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2230	urtwn_write_2(sc, R92C_CR, 0);
2231	reg = urtwn_read_2(sc, R92C_CR);
2232	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2233	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2234	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2235	urtwn_write_2(sc, R92C_CR, reg);
2236
2237	return (0);
2238}
2239
2240static int
2241urtwn_llt_init(struct urtwn_softc *sc)
2242{
2243	int i, error, page_count, pktbuf_count;
2244
2245	page_count = (sc->chip & URTWN_CHIP_88E) ?
2246	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2247	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2248	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2249
2250	/* Reserve pages [0; page_count]. */
2251	for (i = 0; i < page_count; i++) {
2252		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2253			return (error);
2254	}
2255	/* NB: 0xff indicates end-of-list. */
2256	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2257		return (error);
2258	/*
2259	 * Use pages [page_count + 1; pktbuf_count - 1]
2260	 * as ring buffer.
2261	 */
2262	for (++i; i < pktbuf_count - 1; i++) {
2263		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2264			return (error);
2265	}
2266	/* Make the last page point to the beginning of the ring buffer. */
2267	error = urtwn_llt_write(sc, i, page_count + 1);
2268	return (error);
2269}
2270
2271static void
2272urtwn_fw_reset(struct urtwn_softc *sc)
2273{
2274	uint16_t reg;
2275	int ntries;
2276
2277	/* Tell 8051 to reset itself. */
2278	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2279
2280	/* Wait until 8051 resets by itself. */
2281	for (ntries = 0; ntries < 100; ntries++) {
2282		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2283		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2284			return;
2285		urtwn_ms_delay(sc);
2286	}
2287	/* Force 8051 reset. */
2288	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2289}
2290
2291static void
2292urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2293{
2294	uint16_t reg;
2295
2296	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2297	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2298	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2299}
2300
2301static int
2302urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2303{
2304	uint32_t reg;
2305	int off, mlen, error = 0;
2306
2307	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2308	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2309	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2310
2311	off = R92C_FW_START_ADDR;
2312	while (len > 0) {
2313		if (len > 196)
2314			mlen = 196;
2315		else if (len > 4)
2316			mlen = 4;
2317		else
2318			mlen = 1;
2319		/* XXX fix this deconst */
2320		error = urtwn_write_region_1(sc, off,
2321		    __DECONST(uint8_t *, buf), mlen);
2322		if (error != 0)
2323			break;
2324		off += mlen;
2325		buf += mlen;
2326		len -= mlen;
2327	}
2328	return (error);
2329}
2330
2331static int
2332urtwn_load_firmware(struct urtwn_softc *sc)
2333{
2334	const struct firmware *fw;
2335	const struct r92c_fw_hdr *hdr;
2336	const char *imagename;
2337	const u_char *ptr;
2338	size_t len;
2339	uint32_t reg;
2340	int mlen, ntries, page, error;
2341
2342	URTWN_UNLOCK(sc);
2343	/* Read firmware image from the filesystem. */
2344	if (sc->chip & URTWN_CHIP_88E)
2345		imagename = "urtwn-rtl8188eufw";
2346	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2347		    URTWN_CHIP_UMC_A_CUT)
2348		imagename = "urtwn-rtl8192cfwU";
2349	else
2350		imagename = "urtwn-rtl8192cfwT";
2351
2352	fw = firmware_get(imagename);
2353	URTWN_LOCK(sc);
2354	if (fw == NULL) {
2355		device_printf(sc->sc_dev,
2356		    "failed loadfirmware of file %s\n", imagename);
2357		return (ENOENT);
2358	}
2359
2360	len = fw->datasize;
2361
2362	if (len < sizeof(*hdr)) {
2363		device_printf(sc->sc_dev, "firmware too short\n");
2364		error = EINVAL;
2365		goto fail;
2366	}
2367	ptr = fw->data;
2368	hdr = (const struct r92c_fw_hdr *)ptr;
2369	/* Check if there is a valid FW header and skip it. */
2370	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2371	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2372	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2373		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2374		    le16toh(hdr->version), le16toh(hdr->subversion),
2375		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2376		ptr += sizeof(*hdr);
2377		len -= sizeof(*hdr);
2378	}
2379
2380	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2381		if (sc->chip & URTWN_CHIP_88E)
2382			urtwn_r88e_fw_reset(sc);
2383		else
2384			urtwn_fw_reset(sc);
2385		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2386	}
2387
2388	if (!(sc->chip & URTWN_CHIP_88E)) {
2389		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2390		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2391		    R92C_SYS_FUNC_EN_CPUEN);
2392	}
2393	urtwn_write_1(sc, R92C_MCUFWDL,
2394	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2395	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2396	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2397
2398	/* Reset the FWDL checksum. */
2399	urtwn_write_1(sc, R92C_MCUFWDL,
2400	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2401
2402	for (page = 0; len > 0; page++) {
2403		mlen = min(len, R92C_FW_PAGE_SIZE);
2404		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2405		if (error != 0) {
2406			device_printf(sc->sc_dev,
2407			    "could not load firmware page\n");
2408			goto fail;
2409		}
2410		ptr += mlen;
2411		len -= mlen;
2412	}
2413	urtwn_write_1(sc, R92C_MCUFWDL,
2414	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2415	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2416
2417	/* Wait for checksum report. */
2418	for (ntries = 0; ntries < 1000; ntries++) {
2419		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2420			break;
2421		urtwn_ms_delay(sc);
2422	}
2423	if (ntries == 1000) {
2424		device_printf(sc->sc_dev,
2425		    "timeout waiting for checksum report\n");
2426		error = ETIMEDOUT;
2427		goto fail;
2428	}
2429
2430	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2431	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2432	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2433	if (sc->chip & URTWN_CHIP_88E)
2434		urtwn_r88e_fw_reset(sc);
2435	/* Wait for firmware readiness. */
2436	for (ntries = 0; ntries < 1000; ntries++) {
2437		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2438			break;
2439		urtwn_ms_delay(sc);
2440	}
2441	if (ntries == 1000) {
2442		device_printf(sc->sc_dev,
2443		    "timeout waiting for firmware readiness\n");
2444		error = ETIMEDOUT;
2445		goto fail;
2446	}
2447fail:
2448	firmware_put(fw, FIRMWARE_UNLOAD);
2449	return (error);
2450}
2451
2452static __inline int
2453urtwn_dma_init(struct urtwn_softc *sc)
2454{
2455
2456	return sc->sc_dma_init(sc);
2457}
2458
2459static int
2460urtwn_r92c_dma_init(struct urtwn_softc *sc)
2461{
2462	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2463	uint32_t reg;
2464	int error;
2465
2466	/* Initialize LLT table. */
2467	error = urtwn_llt_init(sc);
2468	if (error != 0)
2469		return (error);
2470
2471	/* Get Tx queues to USB endpoints mapping. */
2472	hashq = hasnq = haslq = 0;
2473	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2474	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2475	if (MS(reg, R92C_USB_EP_HQ) != 0)
2476		hashq = 1;
2477	if (MS(reg, R92C_USB_EP_NQ) != 0)
2478		hasnq = 1;
2479	if (MS(reg, R92C_USB_EP_LQ) != 0)
2480		haslq = 1;
2481	nqueues = hashq + hasnq + haslq;
2482	if (nqueues == 0)
2483		return (EIO);
2484	/* Get the number of pages for each queue. */
2485	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2486	/* The remaining pages are assigned to the high priority queue. */
2487	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2488
2489	/* Set number of pages for normal priority queue. */
2490	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2491	urtwn_write_4(sc, R92C_RQPN,
2492	    /* Set number of pages for public queue. */
2493	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2494	    /* Set number of pages for high priority queue. */
2495	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2496	    /* Set number of pages for low priority queue. */
2497	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2498	    /* Load values. */
2499	    R92C_RQPN_LD);
2500
2501	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2502	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2503	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2504	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2505	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2506
2507	/* Set queue to USB pipe mapping. */
2508	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2509	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2510	if (nqueues == 1) {
2511		if (hashq)
2512			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2513		else if (hasnq)
2514			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2515		else
2516			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2517	} else if (nqueues == 2) {
2518		/* All 2-endpoints configs have a high priority queue. */
2519		if (!hashq)
2520			return (EIO);
2521		if (hasnq)
2522			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2523		else
2524			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2525	} else
2526		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2527	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2528
2529	/* Set Tx/Rx transfer page boundary. */
2530	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2531
2532	/* Set Tx/Rx transfer page size. */
2533	urtwn_write_1(sc, R92C_PBP,
2534	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2535	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2536	return (0);
2537}
2538
2539static int
2540urtwn_r88e_dma_init(struct urtwn_softc *sc)
2541{
2542	struct usb_interface *iface;
2543	uint32_t reg;
2544	int nqueues;
2545	int error;
2546
2547	/* Initialize LLT table. */
2548	error = urtwn_llt_init(sc);
2549	if (error != 0)
2550		return (error);
2551
2552	/* Get Tx queues to USB endpoints mapping. */
2553	iface = usbd_get_iface(sc->sc_udev, 0);
2554	nqueues = iface->idesc->bNumEndpoints - 1;
2555	if (nqueues == 0)
2556		return (EIO);
2557
2558	/* Set number of pages for normal priority queue. */
2559	urtwn_write_2(sc, R92C_RQPN_NPQ, 0);
2560	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2561	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2562
2563	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2564	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2565	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2566	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2567	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2568
2569	/* Set queue to USB pipe mapping. */
2570	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2571	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2572	if (nqueues == 1)
2573		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2574	else if (nqueues == 2)
2575		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2576	else
2577		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2578	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2579
2580	/* Set Tx/Rx transfer page boundary. */
2581	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2582
2583	/* Set Tx/Rx transfer page size. */
2584	urtwn_write_1(sc, R92C_PBP,
2585	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2586	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2587
2588	return (0);
2589}
2590
2591static void
2592urtwn_mac_init(struct urtwn_softc *sc)
2593{
2594	int i;
2595
2596	/* Write MAC initialization values. */
2597	if (sc->chip & URTWN_CHIP_88E) {
2598		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2599			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2600			    rtl8188eu_mac[i].val);
2601		}
2602		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2603	} else {
2604		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2605			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2606			    rtl8192cu_mac[i].val);
2607	}
2608}
2609
2610static void
2611urtwn_bb_init(struct urtwn_softc *sc)
2612{
2613	const struct urtwn_bb_prog *prog;
2614	uint32_t reg;
2615	uint8_t crystalcap;
2616	int i;
2617
2618	/* Enable BB and RF. */
2619	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2620	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2621	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2622	    R92C_SYS_FUNC_EN_DIO_RF);
2623
2624	if (!(sc->chip & URTWN_CHIP_88E))
2625		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2626
2627	urtwn_write_1(sc, R92C_RF_CTRL,
2628	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2629	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2630	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2631	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2632
2633	if (!(sc->chip & URTWN_CHIP_88E)) {
2634		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2635		urtwn_write_1(sc, 0x15, 0xe9);
2636		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2637	}
2638
2639	/* Select BB programming based on board type. */
2640	if (sc->chip & URTWN_CHIP_88E)
2641		prog = &rtl8188eu_bb_prog;
2642	else if (!(sc->chip & URTWN_CHIP_92C)) {
2643		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2644			prog = &rtl8188ce_bb_prog;
2645		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2646			prog = &rtl8188ru_bb_prog;
2647		else
2648			prog = &rtl8188cu_bb_prog;
2649	} else {
2650		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2651			prog = &rtl8192ce_bb_prog;
2652		else
2653			prog = &rtl8192cu_bb_prog;
2654	}
2655	/* Write BB initialization values. */
2656	for (i = 0; i < prog->count; i++) {
2657		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2658		urtwn_ms_delay(sc);
2659	}
2660
2661	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2662		/* 8192C 1T only configuration. */
2663		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2664		reg = (reg & ~0x00000003) | 0x2;
2665		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2666
2667		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2668		reg = (reg & ~0x00300033) | 0x00200022;
2669		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2670
2671		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2672		reg = (reg & ~0xff000000) | 0x45 << 24;
2673		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2674
2675		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2676		reg = (reg & ~0x000000ff) | 0x23;
2677		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2678
2679		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2680		reg = (reg & ~0x00000030) | 1 << 4;
2681		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2682
2683		reg = urtwn_bb_read(sc, 0xe74);
2684		reg = (reg & ~0x0c000000) | 2 << 26;
2685		urtwn_bb_write(sc, 0xe74, reg);
2686		reg = urtwn_bb_read(sc, 0xe78);
2687		reg = (reg & ~0x0c000000) | 2 << 26;
2688		urtwn_bb_write(sc, 0xe78, reg);
2689		reg = urtwn_bb_read(sc, 0xe7c);
2690		reg = (reg & ~0x0c000000) | 2 << 26;
2691		urtwn_bb_write(sc, 0xe7c, reg);
2692		reg = urtwn_bb_read(sc, 0xe80);
2693		reg = (reg & ~0x0c000000) | 2 << 26;
2694		urtwn_bb_write(sc, 0xe80, reg);
2695		reg = urtwn_bb_read(sc, 0xe88);
2696		reg = (reg & ~0x0c000000) | 2 << 26;
2697		urtwn_bb_write(sc, 0xe88, reg);
2698	}
2699
2700	/* Write AGC values. */
2701	for (i = 0; i < prog->agccount; i++) {
2702		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2703		    prog->agcvals[i]);
2704		urtwn_ms_delay(sc);
2705	}
2706
2707	if (sc->chip & URTWN_CHIP_88E) {
2708		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2709		urtwn_ms_delay(sc);
2710		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2711		urtwn_ms_delay(sc);
2712
2713		crystalcap = sc->r88e_rom[0xb9];
2714		if (crystalcap == 0xff)
2715			crystalcap = 0x20;
2716		crystalcap &= 0x3f;
2717		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2718		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2719		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2720		    crystalcap | crystalcap << 6));
2721	} else {
2722		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2723		    R92C_HSSI_PARAM2_CCK_HIPWR)
2724			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2725	}
2726}
2727
2728void
2729urtwn_rf_init(struct urtwn_softc *sc)
2730{
2731	const struct urtwn_rf_prog *prog;
2732	uint32_t reg, type;
2733	int i, j, idx, off;
2734
2735	/* Select RF programming based on board type. */
2736	if (sc->chip & URTWN_CHIP_88E)
2737		prog = rtl8188eu_rf_prog;
2738	else if (!(sc->chip & URTWN_CHIP_92C)) {
2739		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2740			prog = rtl8188ce_rf_prog;
2741		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2742			prog = rtl8188ru_rf_prog;
2743		else
2744			prog = rtl8188cu_rf_prog;
2745	} else
2746		prog = rtl8192ce_rf_prog;
2747
2748	for (i = 0; i < sc->nrxchains; i++) {
2749		/* Save RF_ENV control type. */
2750		idx = i / 2;
2751		off = (i % 2) * 16;
2752		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2753		type = (reg >> off) & 0x10;
2754
2755		/* Set RF_ENV enable. */
2756		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2757		reg |= 0x100000;
2758		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2759		urtwn_ms_delay(sc);
2760		/* Set RF_ENV output high. */
2761		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2762		reg |= 0x10;
2763		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2764		urtwn_ms_delay(sc);
2765		/* Set address and data lengths of RF registers. */
2766		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2767		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2768		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2769		urtwn_ms_delay(sc);
2770		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2771		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2772		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2773		urtwn_ms_delay(sc);
2774
2775		/* Write RF initialization values for this chain. */
2776		for (j = 0; j < prog[i].count; j++) {
2777			if (prog[i].regs[j] >= 0xf9 &&
2778			    prog[i].regs[j] <= 0xfe) {
2779				/*
2780				 * These are fake RF registers offsets that
2781				 * indicate a delay is required.
2782				 */
2783				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
2784				continue;
2785			}
2786			urtwn_rf_write(sc, i, prog[i].regs[j],
2787			    prog[i].vals[j]);
2788			urtwn_ms_delay(sc);
2789		}
2790
2791		/* Restore RF_ENV control type. */
2792		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2793		reg &= ~(0x10 << off) | (type << off);
2794		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2795
2796		/* Cache RF register CHNLBW. */
2797		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2798	}
2799
2800	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2801	    URTWN_CHIP_UMC_A_CUT) {
2802		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2803		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2804	}
2805}
2806
2807static void
2808urtwn_cam_init(struct urtwn_softc *sc)
2809{
2810	/* Invalidate all CAM entries. */
2811	urtwn_write_4(sc, R92C_CAMCMD,
2812	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2813}
2814
2815static void
2816urtwn_pa_bias_init(struct urtwn_softc *sc)
2817{
2818	uint8_t reg;
2819	int i;
2820
2821	for (i = 0; i < sc->nrxchains; i++) {
2822		if (sc->pa_setting & (1 << i))
2823			continue;
2824		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2825		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2826		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2827		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2828	}
2829	if (!(sc->pa_setting & 0x10)) {
2830		reg = urtwn_read_1(sc, 0x16);
2831		reg = (reg & ~0xf0) | 0x90;
2832		urtwn_write_1(sc, 0x16, reg);
2833	}
2834}
2835
2836static void
2837urtwn_rxfilter_init(struct urtwn_softc *sc)
2838{
2839	/* Initialize Rx filter. */
2840	/* TODO: use better filter for monitor mode. */
2841	urtwn_write_4(sc, R92C_RCR,
2842	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2843	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2844	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2845	/* Accept all multicast frames. */
2846	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2847	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2848	/* Accept all management frames. */
2849	urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2850	/* Reject all control frames. */
2851	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2852	/* Accept all data frames. */
2853	urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2854}
2855
2856static void
2857urtwn_edca_init(struct urtwn_softc *sc)
2858{
2859	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2860	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2861	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2862	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2863	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2864	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2865	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2866	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2867}
2868
2869void
2870urtwn_write_txpower(struct urtwn_softc *sc, int chain,
2871    uint16_t power[URTWN_RIDX_COUNT])
2872{
2873	uint32_t reg;
2874
2875	/* Write per-CCK rate Tx power. */
2876	if (chain == 0) {
2877		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2878		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2879		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2880		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2881		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2882		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2883		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2884		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2885	} else {
2886		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2887		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2888		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2889		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2890		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2891		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2892		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2893		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2894	}
2895	/* Write per-OFDM rate Tx power. */
2896	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2897	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2898	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2899	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2900	    SM(R92C_TXAGC_RATE18, power[ 7]));
2901	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2902	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2903	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2904	    SM(R92C_TXAGC_RATE48, power[10]) |
2905	    SM(R92C_TXAGC_RATE54, power[11]));
2906	/* Write per-MCS Tx power. */
2907	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2908	    SM(R92C_TXAGC_MCS00,  power[12]) |
2909	    SM(R92C_TXAGC_MCS01,  power[13]) |
2910	    SM(R92C_TXAGC_MCS02,  power[14]) |
2911	    SM(R92C_TXAGC_MCS03,  power[15]));
2912	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2913	    SM(R92C_TXAGC_MCS04,  power[16]) |
2914	    SM(R92C_TXAGC_MCS05,  power[17]) |
2915	    SM(R92C_TXAGC_MCS06,  power[18]) |
2916	    SM(R92C_TXAGC_MCS07,  power[19]));
2917	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2918	    SM(R92C_TXAGC_MCS08,  power[20]) |
2919	    SM(R92C_TXAGC_MCS09,  power[21]) |
2920	    SM(R92C_TXAGC_MCS10,  power[22]) |
2921	    SM(R92C_TXAGC_MCS11,  power[23]));
2922	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2923	    SM(R92C_TXAGC_MCS12,  power[24]) |
2924	    SM(R92C_TXAGC_MCS13,  power[25]) |
2925	    SM(R92C_TXAGC_MCS14,  power[26]) |
2926	    SM(R92C_TXAGC_MCS15,  power[27]));
2927}
2928
2929void
2930urtwn_get_txpower(struct urtwn_softc *sc, int chain,
2931    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2932    uint16_t power[URTWN_RIDX_COUNT])
2933{
2934	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2935	struct r92c_rom *rom = &sc->rom;
2936	uint16_t cckpow, ofdmpow, htpow, diff, max;
2937	const struct urtwn_txpwr *base;
2938	int ridx, chan, group;
2939
2940	/* Determine channel group. */
2941	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2942	if (chan <= 3)
2943		group = 0;
2944	else if (chan <= 9)
2945		group = 1;
2946	else
2947		group = 2;
2948
2949	/* Get original Tx power based on board type and RF chain. */
2950	if (!(sc->chip & URTWN_CHIP_92C)) {
2951		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2952			base = &rtl8188ru_txagc[chain];
2953		else
2954			base = &rtl8192cu_txagc[chain];
2955	} else
2956		base = &rtl8192cu_txagc[chain];
2957
2958	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2959	if (sc->regulatory == 0) {
2960		for (ridx = 0; ridx <= 3; ridx++)
2961			power[ridx] = base->pwr[0][ridx];
2962	}
2963	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2964		if (sc->regulatory == 3) {
2965			power[ridx] = base->pwr[0][ridx];
2966			/* Apply vendor limits. */
2967			if (extc != NULL)
2968				max = rom->ht40_max_pwr[group];
2969			else
2970				max = rom->ht20_max_pwr[group];
2971			max = (max >> (chain * 4)) & 0xf;
2972			if (power[ridx] > max)
2973				power[ridx] = max;
2974		} else if (sc->regulatory == 1) {
2975			if (extc == NULL)
2976				power[ridx] = base->pwr[group][ridx];
2977		} else if (sc->regulatory != 2)
2978			power[ridx] = base->pwr[0][ridx];
2979	}
2980
2981	/* Compute per-CCK rate Tx power. */
2982	cckpow = rom->cck_tx_pwr[chain][group];
2983	for (ridx = 0; ridx <= 3; ridx++) {
2984		power[ridx] += cckpow;
2985		if (power[ridx] > R92C_MAX_TX_PWR)
2986			power[ridx] = R92C_MAX_TX_PWR;
2987	}
2988
2989	htpow = rom->ht40_1s_tx_pwr[chain][group];
2990	if (sc->ntxchains > 1) {
2991		/* Apply reduction for 2 spatial streams. */
2992		diff = rom->ht40_2s_tx_pwr_diff[group];
2993		diff = (diff >> (chain * 4)) & 0xf;
2994		htpow = (htpow > diff) ? htpow - diff : 0;
2995	}
2996
2997	/* Compute per-OFDM rate Tx power. */
2998	diff = rom->ofdm_tx_pwr_diff[group];
2999	diff = (diff >> (chain * 4)) & 0xf;
3000	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3001	for (ridx = 4; ridx <= 11; ridx++) {
3002		power[ridx] += ofdmpow;
3003		if (power[ridx] > R92C_MAX_TX_PWR)
3004			power[ridx] = R92C_MAX_TX_PWR;
3005	}
3006
3007	/* Compute per-MCS Tx power. */
3008	if (extc == NULL) {
3009		diff = rom->ht20_tx_pwr_diff[group];
3010		diff = (diff >> (chain * 4)) & 0xf;
3011		htpow += diff;	/* HT40->HT20 correction. */
3012	}
3013	for (ridx = 12; ridx <= 27; ridx++) {
3014		power[ridx] += htpow;
3015		if (power[ridx] > R92C_MAX_TX_PWR)
3016			power[ridx] = R92C_MAX_TX_PWR;
3017	}
3018#ifdef URTWN_DEBUG
3019	if (urtwn_debug >= 4) {
3020		/* Dump per-rate Tx power values. */
3021		printf("Tx power for chain %d:\n", chain);
3022		for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
3023			printf("Rate %d = %u\n", ridx, power[ridx]);
3024	}
3025#endif
3026}
3027
3028void
3029urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3030    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3031    uint16_t power[URTWN_RIDX_COUNT])
3032{
3033	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3034	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3035	const struct urtwn_r88e_txpwr *base;
3036	int ridx, chan, group;
3037
3038	/* Determine channel group. */
3039	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3040	if (chan <= 2)
3041		group = 0;
3042	else if (chan <= 5)
3043		group = 1;
3044	else if (chan <= 8)
3045		group = 2;
3046	else if (chan <= 11)
3047		group = 3;
3048	else if (chan <= 13)
3049		group = 4;
3050	else
3051		group = 5;
3052
3053	/* Get original Tx power based on board type and RF chain. */
3054	base = &rtl8188eu_txagc[chain];
3055
3056	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3057	if (sc->regulatory == 0) {
3058		for (ridx = 0; ridx <= 3; ridx++)
3059			power[ridx] = base->pwr[0][ridx];
3060	}
3061	for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
3062		if (sc->regulatory == 3)
3063			power[ridx] = base->pwr[0][ridx];
3064		else if (sc->regulatory == 1) {
3065			if (extc == NULL)
3066				power[ridx] = base->pwr[group][ridx];
3067		} else if (sc->regulatory != 2)
3068			power[ridx] = base->pwr[0][ridx];
3069	}
3070
3071	/* Compute per-CCK rate Tx power. */
3072	cckpow = sc->cck_tx_pwr[group];
3073	for (ridx = 0; ridx <= 3; ridx++) {
3074		power[ridx] += cckpow;
3075		if (power[ridx] > R92C_MAX_TX_PWR)
3076			power[ridx] = R92C_MAX_TX_PWR;
3077	}
3078
3079	htpow = sc->ht40_tx_pwr[group];
3080
3081	/* Compute per-OFDM rate Tx power. */
3082	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3083	for (ridx = 4; ridx <= 11; ridx++) {
3084		power[ridx] += ofdmpow;
3085		if (power[ridx] > R92C_MAX_TX_PWR)
3086			power[ridx] = R92C_MAX_TX_PWR;
3087	}
3088
3089	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3090	for (ridx = 12; ridx <= 27; ridx++) {
3091		power[ridx] += bw20pow;
3092		if (power[ridx] > R92C_MAX_TX_PWR)
3093			power[ridx] = R92C_MAX_TX_PWR;
3094	}
3095}
3096
3097void
3098urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3099    struct ieee80211_channel *extc)
3100{
3101	uint16_t power[URTWN_RIDX_COUNT];
3102	int i;
3103
3104	for (i = 0; i < sc->ntxchains; i++) {
3105		/* Compute per-rate Tx power values. */
3106		if (sc->chip & URTWN_CHIP_88E)
3107			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3108		else
3109			urtwn_get_txpower(sc, i, c, extc, power);
3110		/* Write per-rate Tx power values to hardware. */
3111		urtwn_write_txpower(sc, i, power);
3112	}
3113}
3114
3115static void
3116urtwn_scan_start(struct ieee80211com *ic)
3117{
3118	/* XXX do nothing?  */
3119}
3120
3121static void
3122urtwn_scan_end(struct ieee80211com *ic)
3123{
3124	/* XXX do nothing?  */
3125}
3126
3127static void
3128urtwn_set_channel(struct ieee80211com *ic)
3129{
3130	struct urtwn_softc *sc = ic->ic_ifp->if_softc;
3131
3132	URTWN_LOCK(sc);
3133	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3134	URTWN_UNLOCK(sc);
3135}
3136
3137static void
3138urtwn_update_mcast(struct ifnet *ifp)
3139{
3140	/* XXX do nothing?  */
3141}
3142
3143static void
3144urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3145    struct ieee80211_channel *extc)
3146{
3147	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3148	uint32_t reg;
3149	u_int chan;
3150	int i;
3151
3152	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3153	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3154		device_printf(sc->sc_dev,
3155		    "%s: invalid channel %x\n", __func__, chan);
3156		return;
3157	}
3158
3159	/* Set Tx power for this new channel. */
3160	urtwn_set_txpower(sc, c, extc);
3161
3162	for (i = 0; i < sc->nrxchains; i++) {
3163		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3164		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3165	}
3166#ifndef IEEE80211_NO_HT
3167	if (extc != NULL) {
3168		/* Is secondary channel below or above primary? */
3169		int prichlo = c->ic_freq < extc->ic_freq;
3170
3171		urtwn_write_1(sc, R92C_BWOPMODE,
3172		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3173
3174		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3175		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3176		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3177
3178		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3179		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3180		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3181		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3182
3183		/* Set CCK side band. */
3184		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3185		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3186		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3187
3188		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3189		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3190		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3191
3192		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3193		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3194		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3195
3196		reg = urtwn_bb_read(sc, 0x818);
3197		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3198		urtwn_bb_write(sc, 0x818, reg);
3199
3200		/* Select 40MHz bandwidth. */
3201		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3202		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3203	} else
3204#endif
3205	{
3206		urtwn_write_1(sc, R92C_BWOPMODE,
3207		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3208
3209		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3210		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3211		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3212		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3213
3214		if (!(sc->chip & URTWN_CHIP_88E)) {
3215			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3216			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3217			    R92C_FPGA0_ANAPARAM2_CBW20);
3218		}
3219
3220		/* Select 20MHz bandwidth. */
3221		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3222		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3223		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3224		    R92C_RF_CHNLBW_BW20));
3225	}
3226}
3227
3228static void
3229urtwn_iq_calib(struct urtwn_softc *sc)
3230{
3231	/* TODO */
3232}
3233
3234static void
3235urtwn_lc_calib(struct urtwn_softc *sc)
3236{
3237	uint32_t rf_ac[2];
3238	uint8_t txmode;
3239	int i;
3240
3241	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3242	if ((txmode & 0x70) != 0) {
3243		/* Disable all continuous Tx. */
3244		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3245
3246		/* Set RF mode to standby mode. */
3247		for (i = 0; i < sc->nrxchains; i++) {
3248			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3249			urtwn_rf_write(sc, i, R92C_RF_AC,
3250			    RW(rf_ac[i], R92C_RF_AC_MODE,
3251				R92C_RF_AC_MODE_STANDBY));
3252		}
3253	} else {
3254		/* Block all Tx queues. */
3255		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3256	}
3257	/* Start calibration. */
3258	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3259	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3260
3261	/* Give calibration the time to complete. */
3262	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3263
3264	/* Restore configuration. */
3265	if ((txmode & 0x70) != 0) {
3266		/* Restore Tx mode. */
3267		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3268		/* Restore RF mode. */
3269		for (i = 0; i < sc->nrxchains; i++)
3270			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3271	} else {
3272		/* Unblock all Tx queues. */
3273		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3274	}
3275}
3276
3277static void
3278urtwn_init_locked(void *arg)
3279{
3280	struct urtwn_softc *sc = arg;
3281	struct ifnet *ifp = sc->sc_ifp;
3282	uint32_t reg;
3283	int error;
3284
3285	URTWN_ASSERT_LOCKED(sc);
3286
3287	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3288		urtwn_stop_locked(ifp);
3289
3290	/* Init firmware commands ring. */
3291	sc->fwcur = 0;
3292
3293	/* Allocate Tx/Rx buffers. */
3294	error = urtwn_alloc_rx_list(sc);
3295	if (error != 0)
3296		goto fail;
3297
3298	error = urtwn_alloc_tx_list(sc);
3299	if (error != 0)
3300		goto fail;
3301
3302	/* Power on adapter. */
3303	error = urtwn_power_on(sc);
3304	if (error != 0)
3305		goto fail;
3306
3307	/* Initialize DMA. */
3308	error = urtwn_dma_init(sc);
3309	if (error != 0)
3310		goto fail;
3311
3312	/* Set info size in Rx descriptors (in 64-bit words). */
3313	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3314
3315	/* Init interrupts. */
3316	if (sc->chip & URTWN_CHIP_88E) {
3317		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3318		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3319		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3320		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3321		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3322		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3323		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3324		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3325	} else {
3326		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3327		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3328	}
3329
3330	/* Set MAC address. */
3331	urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
3332	    IEEE80211_ADDR_LEN);
3333
3334	/* Set initial network type. */
3335	reg = urtwn_read_4(sc, R92C_CR);
3336	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3337	urtwn_write_4(sc, R92C_CR, reg);
3338
3339	urtwn_rxfilter_init(sc);
3340
3341	reg = urtwn_read_4(sc, R92C_RRSR);
3342	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3343	urtwn_write_4(sc, R92C_RRSR, reg);
3344
3345	/* Set short/long retry limits. */
3346	urtwn_write_2(sc, R92C_RL,
3347	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3348
3349	/* Initialize EDCA parameters. */
3350	urtwn_edca_init(sc);
3351
3352	/* Setup rate fallback. */
3353	if (!(sc->chip & URTWN_CHIP_88E)) {
3354		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3355		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3356		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3357		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3358	}
3359
3360	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3361	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3362	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3363	/* Set ACK timeout. */
3364	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3365
3366	/* Setup USB aggregation. */
3367	reg = urtwn_read_4(sc, R92C_TDECTRL);
3368	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3369	urtwn_write_4(sc, R92C_TDECTRL, reg);
3370	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3371	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3372	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3373	urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3374	    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3375	    R92C_USB_SPECIAL_OPTION_AGG_EN);
3376	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3377	if (sc->chip & URTWN_CHIP_88E)
3378		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3379	else
3380		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3381	urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3382	urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3383
3384	/* Initialize beacon parameters. */
3385	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3386	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3387	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3388	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3389	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3390
3391	if (!(sc->chip & URTWN_CHIP_88E)) {
3392		/* Setup AMPDU aggregation. */
3393		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3394		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3395		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3396
3397		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3398	}
3399
3400	/* Load 8051 microcode. */
3401	error = urtwn_load_firmware(sc);
3402	if (error != 0)
3403		goto fail;
3404
3405	/* Initialize MAC/BB/RF blocks. */
3406	urtwn_mac_init(sc);
3407	urtwn_bb_init(sc);
3408	urtwn_rf_init(sc);
3409
3410	if (sc->chip & URTWN_CHIP_88E) {
3411		urtwn_write_2(sc, R92C_CR,
3412		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3413		    R92C_CR_MACRXEN);
3414	}
3415
3416	/* Turn CCK and OFDM blocks on. */
3417	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3418	reg |= R92C_RFMOD_CCK_EN;
3419	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3420	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3421	reg |= R92C_RFMOD_OFDM_EN;
3422	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3423
3424	/* Clear per-station keys table. */
3425	urtwn_cam_init(sc);
3426
3427	/* Enable hardware sequence numbering. */
3428	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3429
3430	/* Perform LO and IQ calibrations. */
3431	urtwn_iq_calib(sc);
3432	/* Perform LC calibration. */
3433	urtwn_lc_calib(sc);
3434
3435	/* Fix USB interference issue. */
3436	if (!(sc->chip & URTWN_CHIP_88E)) {
3437		urtwn_write_1(sc, 0xfe40, 0xe0);
3438		urtwn_write_1(sc, 0xfe41, 0x8d);
3439		urtwn_write_1(sc, 0xfe42, 0x80);
3440
3441		urtwn_pa_bias_init(sc);
3442	}
3443
3444	/* Initialize GPIO setting. */
3445	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3446	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3447
3448	/* Fix for lower temperature. */
3449	if (!(sc->chip & URTWN_CHIP_88E))
3450		urtwn_write_1(sc, 0x15, 0xe9);
3451
3452	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3453
3454	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3455	ifp->if_drv_flags |= IFF_DRV_RUNNING;
3456
3457	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3458fail:
3459	return;
3460}
3461
3462static void
3463urtwn_init(void *arg)
3464{
3465	struct urtwn_softc *sc = arg;
3466
3467	URTWN_LOCK(sc);
3468	urtwn_init_locked(arg);
3469	URTWN_UNLOCK(sc);
3470}
3471
3472static void
3473urtwn_stop_locked(struct ifnet *ifp)
3474{
3475	struct urtwn_softc *sc = ifp->if_softc;
3476
3477	URTWN_ASSERT_LOCKED(sc);
3478
3479	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
3480
3481	callout_stop(&sc->sc_watchdog_ch);
3482	urtwn_abort_xfers(sc);
3483}
3484
3485static void
3486urtwn_stop(struct ifnet *ifp)
3487{
3488	struct urtwn_softc *sc = ifp->if_softc;
3489
3490	URTWN_LOCK(sc);
3491	urtwn_stop_locked(ifp);
3492	URTWN_UNLOCK(sc);
3493}
3494
3495static void
3496urtwn_abort_xfers(struct urtwn_softc *sc)
3497{
3498	int i;
3499
3500	URTWN_ASSERT_LOCKED(sc);
3501
3502	/* abort any pending transfers */
3503	for (i = 0; i < URTWN_N_TRANSFER; i++)
3504		usbd_transfer_stop(sc->sc_xfer[i]);
3505}
3506
3507static int
3508urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3509    const struct ieee80211_bpf_params *params)
3510{
3511	struct ieee80211com *ic = ni->ni_ic;
3512	struct ifnet *ifp = ic->ic_ifp;
3513	struct urtwn_softc *sc = ifp->if_softc;
3514	struct urtwn_data *bf;
3515
3516	/* prevent management frames from being sent if we're not ready */
3517	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3518		m_freem(m);
3519		ieee80211_free_node(ni);
3520		return (ENETDOWN);
3521	}
3522	URTWN_LOCK(sc);
3523	bf = urtwn_getbuf(sc);
3524	if (bf == NULL) {
3525		ieee80211_free_node(ni);
3526		m_freem(m);
3527		URTWN_UNLOCK(sc);
3528		return (ENOBUFS);
3529	}
3530
3531	ifp->if_opackets++;
3532	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3533		ieee80211_free_node(ni);
3534		ifp->if_oerrors++;
3535		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3536		URTWN_UNLOCK(sc);
3537		return (EIO);
3538	}
3539	URTWN_UNLOCK(sc);
3540
3541	sc->sc_txtimer = 5;
3542	return (0);
3543}
3544
3545static void
3546urtwn_ms_delay(struct urtwn_softc *sc)
3547{
3548	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3549}
3550
3551static device_method_t urtwn_methods[] = {
3552	/* Device interface */
3553	DEVMETHOD(device_probe,		urtwn_match),
3554	DEVMETHOD(device_attach,	urtwn_attach),
3555	DEVMETHOD(device_detach,	urtwn_detach),
3556
3557	DEVMETHOD_END
3558};
3559
3560static driver_t urtwn_driver = {
3561	"urtwn",
3562	urtwn_methods,
3563	sizeof(struct urtwn_softc)
3564};
3565
3566static devclass_t urtwn_devclass;
3567
3568DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3569MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3570MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3571MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3572MODULE_VERSION(urtwn, 1);
3573