if_urtwn.c revision 290631
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 290631 2015-11-10 00:12:00Z avos $");
22
23/*
24 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25 */
26
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/module.h>
40#include <sys/bus.h>
41#include <sys/endian.h>
42#include <sys/linker.h>
43#include <sys/firmware.h>
44#include <sys/kdb.h>
45
46#include <machine/bus.h>
47#include <machine/resource.h>
48#include <sys/rman.h>
49
50#include <net/bpf.h>
51#include <net/if.h>
52#include <net/if_var.h>
53#include <net/if_arp.h>
54#include <net/ethernet.h>
55#include <net/if_dl.h>
56#include <net/if_media.h>
57#include <net/if_types.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_var.h>
62#include <netinet/if_ether.h>
63#include <netinet/ip.h>
64
65#include <net80211/ieee80211_var.h>
66#include <net80211/ieee80211_input.h>
67#include <net80211/ieee80211_regdomain.h>
68#include <net80211/ieee80211_radiotap.h>
69#include <net80211/ieee80211_ratectl.h>
70
71#include <dev/usb/usb.h>
72#include <dev/usb/usbdi.h>
73#include "usbdevs.h"
74
75#define USB_DEBUG_VAR urtwn_debug
76#include <dev/usb/usb_debug.h>
77
78#include <dev/usb/wlan/if_urtwnreg.h>
79#include <dev/usb/wlan/if_urtwnvar.h>
80
81#ifdef USB_DEBUG
82static int urtwn_debug = 0;
83
84SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
85SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
86    "Debug level");
87#endif
88
89#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
90
91/* various supported device vendors/products */
92static const STRUCT_USB_HOST_ID urtwn_devs[] = {
93#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
94#define	URTWN_RTL8188E_DEV(v,p)	\
95	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
96#define URTWN_RTL8188E  1
97	URTWN_DEV(ABOCOM,	RTL8188CU_1),
98	URTWN_DEV(ABOCOM,	RTL8188CU_2),
99	URTWN_DEV(ABOCOM,	RTL8192CU),
100	URTWN_DEV(ASUS,		RTL8192CU),
101	URTWN_DEV(ASUS,		USBN10NANO),
102	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
103	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
104	URTWN_DEV(AZUREWAVE,	RTL8188CU),
105	URTWN_DEV(BELKIN,	F7D2102),
106	URTWN_DEV(BELKIN,	RTL8188CU),
107	URTWN_DEV(BELKIN,	RTL8192CU),
108	URTWN_DEV(CHICONY,	RTL8188CUS_1),
109	URTWN_DEV(CHICONY,	RTL8188CUS_2),
110	URTWN_DEV(CHICONY,	RTL8188CUS_3),
111	URTWN_DEV(CHICONY,	RTL8188CUS_4),
112	URTWN_DEV(CHICONY,	RTL8188CUS_5),
113	URTWN_DEV(COREGA,	RTL8192CU),
114	URTWN_DEV(DLINK,	RTL8188CU),
115	URTWN_DEV(DLINK,	RTL8192CU_1),
116	URTWN_DEV(DLINK,	RTL8192CU_2),
117	URTWN_DEV(DLINK,	RTL8192CU_3),
118	URTWN_DEV(DLINK,	DWA131B),
119	URTWN_DEV(EDIMAX,	EW7811UN),
120	URTWN_DEV(EDIMAX,	RTL8192CU),
121	URTWN_DEV(FEIXUN,	RTL8188CU),
122	URTWN_DEV(FEIXUN,	RTL8192CU),
123	URTWN_DEV(GUILLEMOT,	HWNUP150),
124	URTWN_DEV(HAWKING,	RTL8192CU),
125	URTWN_DEV(HP3,		RTL8188CU),
126	URTWN_DEV(NETGEAR,	WNA1000M),
127	URTWN_DEV(NETGEAR,	RTL8192CU),
128	URTWN_DEV(NETGEAR4,	RTL8188CU),
129	URTWN_DEV(NOVATECH,	RTL8188CU),
130	URTWN_DEV(PLANEX2,	RTL8188CU_1),
131	URTWN_DEV(PLANEX2,	RTL8188CU_2),
132	URTWN_DEV(PLANEX2,	RTL8188CU_3),
133	URTWN_DEV(PLANEX2,	RTL8188CU_4),
134	URTWN_DEV(PLANEX2,	RTL8188CUS),
135	URTWN_DEV(PLANEX2,	RTL8192CU),
136	URTWN_DEV(REALTEK,	RTL8188CE_0),
137	URTWN_DEV(REALTEK,	RTL8188CE_1),
138	URTWN_DEV(REALTEK,	RTL8188CTV),
139	URTWN_DEV(REALTEK,	RTL8188CU_0),
140	URTWN_DEV(REALTEK,	RTL8188CU_1),
141	URTWN_DEV(REALTEK,	RTL8188CU_2),
142	URTWN_DEV(REALTEK,	RTL8188CU_3),
143	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
144	URTWN_DEV(REALTEK,	RTL8188CUS),
145	URTWN_DEV(REALTEK,	RTL8188RU_1),
146	URTWN_DEV(REALTEK,	RTL8188RU_2),
147	URTWN_DEV(REALTEK,	RTL8188RU_3),
148	URTWN_DEV(REALTEK,	RTL8191CU),
149	URTWN_DEV(REALTEK,	RTL8192CE),
150	URTWN_DEV(REALTEK,	RTL8192CU),
151	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
152	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
153	URTWN_DEV(SITECOMEU,	RTL8192CU),
154	URTWN_DEV(TRENDNET,	RTL8188CU),
155	URTWN_DEV(TRENDNET,	RTL8192CU),
156	URTWN_DEV(ZYXEL,	RTL8192CU),
157	/* URTWN_RTL8188E */
158	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
159	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
160	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
161	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
162	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
163#undef URTWN_RTL8188E_DEV
164#undef URTWN_DEV
165};
166
167static device_probe_t	urtwn_match;
168static device_attach_t	urtwn_attach;
169static device_detach_t	urtwn_detach;
170
171static usb_callback_t   urtwn_bulk_tx_callback;
172static usb_callback_t	urtwn_bulk_rx_callback;
173
174static void		urtwn_drain_mbufq(struct urtwn_softc *sc);
175static usb_error_t	urtwn_do_request(struct urtwn_softc *,
176			    struct usb_device_request *, void *);
177static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
178		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
179                    const uint8_t [IEEE80211_ADDR_LEN],
180                    const uint8_t [IEEE80211_ADDR_LEN]);
181static void		urtwn_vap_delete(struct ieee80211vap *);
182static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
183			    int *);
184static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
185			    int *, int8_t *);
186static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
187			    int);
188static int		urtwn_alloc_list(struct urtwn_softc *,
189			    struct urtwn_data[], int, int);
190static int		urtwn_alloc_rx_list(struct urtwn_softc *);
191static int		urtwn_alloc_tx_list(struct urtwn_softc *);
192static void		urtwn_free_list(struct urtwn_softc *,
193			    struct urtwn_data data[], int);
194static void		urtwn_free_rx_list(struct urtwn_softc *);
195static void		urtwn_free_tx_list(struct urtwn_softc *);
196static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
197static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
198static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
199			    uint8_t *, int);
200static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
201static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
202static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
203static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
204			    uint8_t *, int);
205static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
206static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
207static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
208static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
209			    const void *, int);
210static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
211			    uint8_t, uint32_t);
212static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
213			    uint8_t, uint32_t);
214static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
215static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
216			    uint32_t);
217static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
218static void		urtwn_efuse_read(struct urtwn_softc *);
219static void		urtwn_efuse_switch_power(struct urtwn_softc *);
220static int		urtwn_read_chipid(struct urtwn_softc *);
221static void		urtwn_read_rom(struct urtwn_softc *);
222static void		urtwn_r88e_read_rom(struct urtwn_softc *);
223static int		urtwn_ra_init(struct urtwn_softc *);
224static void		urtwn_init_beacon(struct urtwn_softc *,
225			    struct urtwn_vap *);
226static int		urtwn_setup_beacon(struct urtwn_softc *,
227			    struct ieee80211_node *);
228static void		urtwn_update_beacon(struct ieee80211vap *, int);
229static int		urtwn_tx_beacon(struct urtwn_softc *sc,
230			    struct urtwn_vap *);
231static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
232			    struct ieee80211vap *);
233static void		urtwn_set_led(struct urtwn_softc *, int, int);
234static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
235static int		urtwn_newstate(struct ieee80211vap *,
236			    enum ieee80211_state, int);
237static void		urtwn_watchdog(void *);
238static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
239static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
240static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
241static int		urtwn_tx_data(struct urtwn_softc *,
242			    struct ieee80211_node *, struct mbuf *,
243			    struct urtwn_data *);
244static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
245			    uint8_t, struct urtwn_data *);
246static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
247static void		urtwn_start(struct urtwn_softc *);
248static void		urtwn_parent(struct ieee80211com *);
249static int		urtwn_r92c_power_on(struct urtwn_softc *);
250static int		urtwn_r88e_power_on(struct urtwn_softc *);
251static int		urtwn_llt_init(struct urtwn_softc *);
252static void		urtwn_fw_reset(struct urtwn_softc *);
253static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
254static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
255			    const uint8_t *, int);
256static int		urtwn_load_firmware(struct urtwn_softc *);
257static int		urtwn_r92c_dma_init(struct urtwn_softc *);
258static int		urtwn_r88e_dma_init(struct urtwn_softc *);
259static void		urtwn_mac_init(struct urtwn_softc *);
260static void		urtwn_bb_init(struct urtwn_softc *);
261static void		urtwn_rf_init(struct urtwn_softc *);
262static void		urtwn_cam_init(struct urtwn_softc *);
263static void		urtwn_pa_bias_init(struct urtwn_softc *);
264static void		urtwn_rxfilter_init(struct urtwn_softc *);
265static void		urtwn_edca_init(struct urtwn_softc *);
266static void		urtwn_write_txpower(struct urtwn_softc *, int,
267			    uint16_t[]);
268static void		urtwn_get_txpower(struct urtwn_softc *, int,
269		      	    struct ieee80211_channel *,
270			    struct ieee80211_channel *, uint16_t[]);
271static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
272		      	    struct ieee80211_channel *,
273			    struct ieee80211_channel *, uint16_t[]);
274static void		urtwn_set_txpower(struct urtwn_softc *,
275		    	    struct ieee80211_channel *,
276			    struct ieee80211_channel *);
277static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
278static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
279static void		urtwn_scan_start(struct ieee80211com *);
280static void		urtwn_scan_end(struct ieee80211com *);
281static void		urtwn_set_channel(struct ieee80211com *);
282static void		urtwn_set_promisc(struct urtwn_softc *);
283static void		urtwn_update_promisc(struct ieee80211com *);
284static void		urtwn_update_mcast(struct ieee80211com *);
285static void		urtwn_set_chan(struct urtwn_softc *,
286		    	    struct ieee80211_channel *,
287			    struct ieee80211_channel *);
288static void		urtwn_iq_calib(struct urtwn_softc *);
289static void		urtwn_lc_calib(struct urtwn_softc *);
290static void		urtwn_init(struct urtwn_softc *);
291static void		urtwn_stop(struct urtwn_softc *);
292static void		urtwn_abort_xfers(struct urtwn_softc *);
293static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
294			    const struct ieee80211_bpf_params *);
295static void		urtwn_ms_delay(struct urtwn_softc *);
296
297/* Aliases. */
298#define	urtwn_bb_write	urtwn_write_4
299#define urtwn_bb_read	urtwn_read_4
300
301static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
302	[URTWN_BULK_RX] = {
303		.type = UE_BULK,
304		.endpoint = UE_ADDR_ANY,
305		.direction = UE_DIR_IN,
306		.bufsize = URTWN_RXBUFSZ,
307		.flags = {
308			.pipe_bof = 1,
309			.short_xfer_ok = 1
310		},
311		.callback = urtwn_bulk_rx_callback,
312	},
313	[URTWN_BULK_TX_BE] = {
314		.type = UE_BULK,
315		.endpoint = 0x03,
316		.direction = UE_DIR_OUT,
317		.bufsize = URTWN_TXBUFSZ,
318		.flags = {
319			.ext_buffer = 1,
320			.pipe_bof = 1,
321			.force_short_xfer = 1
322		},
323		.callback = urtwn_bulk_tx_callback,
324		.timeout = URTWN_TX_TIMEOUT,	/* ms */
325	},
326	[URTWN_BULK_TX_BK] = {
327		.type = UE_BULK,
328		.endpoint = 0x03,
329		.direction = UE_DIR_OUT,
330		.bufsize = URTWN_TXBUFSZ,
331		.flags = {
332			.ext_buffer = 1,
333			.pipe_bof = 1,
334			.force_short_xfer = 1,
335		},
336		.callback = urtwn_bulk_tx_callback,
337		.timeout = URTWN_TX_TIMEOUT,	/* ms */
338	},
339	[URTWN_BULK_TX_VI] = {
340		.type = UE_BULK,
341		.endpoint = 0x02,
342		.direction = UE_DIR_OUT,
343		.bufsize = URTWN_TXBUFSZ,
344		.flags = {
345			.ext_buffer = 1,
346			.pipe_bof = 1,
347			.force_short_xfer = 1
348		},
349		.callback = urtwn_bulk_tx_callback,
350		.timeout = URTWN_TX_TIMEOUT,	/* ms */
351	},
352	[URTWN_BULK_TX_VO] = {
353		.type = UE_BULK,
354		.endpoint = 0x02,
355		.direction = UE_DIR_OUT,
356		.bufsize = URTWN_TXBUFSZ,
357		.flags = {
358			.ext_buffer = 1,
359			.pipe_bof = 1,
360			.force_short_xfer = 1
361		},
362		.callback = urtwn_bulk_tx_callback,
363		.timeout = URTWN_TX_TIMEOUT,	/* ms */
364	},
365};
366
367static int
368urtwn_match(device_t self)
369{
370	struct usb_attach_arg *uaa = device_get_ivars(self);
371
372	if (uaa->usb_mode != USB_MODE_HOST)
373		return (ENXIO);
374	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
375		return (ENXIO);
376	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
377		return (ENXIO);
378
379	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
380}
381
382static int
383urtwn_attach(device_t self)
384{
385	struct usb_attach_arg *uaa = device_get_ivars(self);
386	struct urtwn_softc *sc = device_get_softc(self);
387	struct ieee80211com *ic = &sc->sc_ic;
388	uint8_t iface_index, bands;
389	int error;
390
391	device_set_usb_desc(self);
392	sc->sc_udev = uaa->device;
393	sc->sc_dev = self;
394	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
395		sc->chip |= URTWN_CHIP_88E;
396
397	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
398	    MTX_NETWORK_LOCK, MTX_DEF);
399	callout_init(&sc->sc_watchdog_ch, 0);
400	mbufq_init(&sc->sc_snd, ifqmaxlen);
401
402	iface_index = URTWN_IFACE_INDEX;
403	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
404	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
405	if (error) {
406		device_printf(self, "could not allocate USB transfers, "
407		    "err=%s\n", usbd_errstr(error));
408		goto detach;
409	}
410
411	URTWN_LOCK(sc);
412
413	error = urtwn_read_chipid(sc);
414	if (error) {
415		device_printf(sc->sc_dev, "unsupported test chip\n");
416		URTWN_UNLOCK(sc);
417		goto detach;
418	}
419
420	/* Determine number of Tx/Rx chains. */
421	if (sc->chip & URTWN_CHIP_92C) {
422		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
423		sc->nrxchains = 2;
424	} else {
425		sc->ntxchains = 1;
426		sc->nrxchains = 1;
427	}
428
429	if (sc->chip & URTWN_CHIP_88E)
430		urtwn_r88e_read_rom(sc);
431	else
432		urtwn_read_rom(sc);
433
434	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
435	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
436	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
437	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
438	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
439	    "8188CUS", sc->ntxchains, sc->nrxchains);
440
441	URTWN_UNLOCK(sc);
442
443	ic->ic_softc = sc;
444	ic->ic_name = device_get_nameunit(self);
445	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
446	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
447
448	/* set device capabilities */
449	ic->ic_caps =
450		  IEEE80211_C_STA		/* station mode */
451		| IEEE80211_C_MONITOR		/* monitor mode */
452		| IEEE80211_C_HOSTAP		/* hostap mode */
453		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
454		| IEEE80211_C_SHSLOT		/* short slot time supported */
455		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
456		| IEEE80211_C_WPA		/* 802.11i */
457		;
458
459	bands = 0;
460	setbit(&bands, IEEE80211_MODE_11B);
461	setbit(&bands, IEEE80211_MODE_11G);
462	ieee80211_init_channels(ic, NULL, &bands);
463
464	ieee80211_ifattach(ic);
465	ic->ic_raw_xmit = urtwn_raw_xmit;
466	ic->ic_scan_start = urtwn_scan_start;
467	ic->ic_scan_end = urtwn_scan_end;
468	ic->ic_set_channel = urtwn_set_channel;
469	ic->ic_transmit = urtwn_transmit;
470	ic->ic_parent = urtwn_parent;
471	ic->ic_vap_create = urtwn_vap_create;
472	ic->ic_vap_delete = urtwn_vap_delete;
473	ic->ic_update_promisc = urtwn_update_promisc;
474	ic->ic_update_mcast = urtwn_update_mcast;
475
476	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
477	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
478	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
479	    URTWN_RX_RADIOTAP_PRESENT);
480
481	if (bootverbose)
482		ieee80211_announce(ic);
483
484	return (0);
485
486detach:
487	urtwn_detach(self);
488	return (ENXIO);			/* failure */
489}
490
491static int
492urtwn_detach(device_t self)
493{
494	struct urtwn_softc *sc = device_get_softc(self);
495	struct ieee80211com *ic = &sc->sc_ic;
496	unsigned int x;
497
498	/* Prevent further ioctls. */
499	URTWN_LOCK(sc);
500	sc->sc_flags |= URTWN_DETACHED;
501	urtwn_stop(sc);
502	URTWN_UNLOCK(sc);
503
504	callout_drain(&sc->sc_watchdog_ch);
505
506	/* stop all USB transfers */
507	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
508
509	/* Prevent further allocations from RX/TX data lists. */
510	URTWN_LOCK(sc);
511	STAILQ_INIT(&sc->sc_tx_active);
512	STAILQ_INIT(&sc->sc_tx_inactive);
513	STAILQ_INIT(&sc->sc_tx_pending);
514
515	STAILQ_INIT(&sc->sc_rx_active);
516	STAILQ_INIT(&sc->sc_rx_inactive);
517	URTWN_UNLOCK(sc);
518
519	/* drain USB transfers */
520	for (x = 0; x != URTWN_N_TRANSFER; x++)
521		usbd_transfer_drain(sc->sc_xfer[x]);
522
523	/* Free data buffers. */
524	URTWN_LOCK(sc);
525	urtwn_free_tx_list(sc);
526	urtwn_free_rx_list(sc);
527	URTWN_UNLOCK(sc);
528
529	ieee80211_ifdetach(ic);
530	mtx_destroy(&sc->sc_mtx);
531
532	return (0);
533}
534
535static void
536urtwn_drain_mbufq(struct urtwn_softc *sc)
537{
538	struct mbuf *m;
539	struct ieee80211_node *ni;
540	URTWN_ASSERT_LOCKED(sc);
541	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
542		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
543		m->m_pkthdr.rcvif = NULL;
544		ieee80211_free_node(ni);
545		m_freem(m);
546	}
547}
548
549static usb_error_t
550urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
551    void *data)
552{
553	usb_error_t err;
554	int ntries = 10;
555
556	URTWN_ASSERT_LOCKED(sc);
557
558	while (ntries--) {
559		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
560		    req, data, 0, NULL, 250 /* ms */);
561		if (err == 0)
562			break;
563
564		DPRINTFN(1, "Control request failed, %s (retrying)\n",
565		    usbd_errstr(err));
566		usb_pause_mtx(&sc->sc_mtx, hz / 100);
567	}
568	return (err);
569}
570
571static struct ieee80211vap *
572urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
573    enum ieee80211_opmode opmode, int flags,
574    const uint8_t bssid[IEEE80211_ADDR_LEN],
575    const uint8_t mac[IEEE80211_ADDR_LEN])
576{
577	struct urtwn_softc *sc = ic->ic_softc;
578	struct urtwn_vap *uvp;
579	struct ieee80211vap *vap;
580
581	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
582		return (NULL);
583
584	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
585	vap = &uvp->vap;
586	/* enable s/w bmiss handling for sta mode */
587
588	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
589	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
590		/* out of memory */
591		free(uvp, M_80211_VAP);
592		return (NULL);
593	}
594
595	if (opmode == IEEE80211_M_HOSTAP)
596		urtwn_init_beacon(sc, uvp);
597
598	/* override state transition machine */
599	uvp->newstate = vap->iv_newstate;
600	vap->iv_newstate = urtwn_newstate;
601	vap->iv_update_beacon = urtwn_update_beacon;
602
603	/* complete setup */
604	ieee80211_vap_attach(vap, ieee80211_media_change,
605	    ieee80211_media_status, mac);
606	ic->ic_opmode = opmode;
607	return (vap);
608}
609
610static void
611urtwn_vap_delete(struct ieee80211vap *vap)
612{
613	struct urtwn_vap *uvp = URTWN_VAP(vap);
614	enum ieee80211_opmode opmode = vap->iv_opmode;
615
616	if (opmode == IEEE80211_M_HOSTAP) {
617		if (uvp->bcn_mbuf != NULL)
618			m_freem(uvp->bcn_mbuf);
619	}
620	ieee80211_vap_detach(vap);
621	free(uvp, M_80211_VAP);
622}
623
624static struct mbuf *
625urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
626{
627	struct ieee80211com *ic = &sc->sc_ic;
628	struct ieee80211_frame *wh;
629	struct mbuf *m;
630	struct r92c_rx_stat *stat;
631	uint32_t rxdw0, rxdw3;
632	uint8_t rate;
633	int8_t rssi = 0;
634	int infosz;
635
636	/*
637	 * don't pass packets to the ieee80211 framework if the driver isn't
638	 * RUNNING.
639	 */
640	if (!(sc->sc_flags & URTWN_RUNNING))
641		return (NULL);
642
643	stat = (struct r92c_rx_stat *)buf;
644	rxdw0 = le32toh(stat->rxdw0);
645	rxdw3 = le32toh(stat->rxdw3);
646
647	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
648		/*
649		 * This should not happen since we setup our Rx filter
650		 * to not receive these frames.
651		 */
652		counter_u64_add(ic->ic_ierrors, 1);
653		return (NULL);
654	}
655	if (pktlen < sizeof(struct ieee80211_frame_ack) ||
656	    pktlen > MCLBYTES) {
657		counter_u64_add(ic->ic_ierrors, 1);
658		return (NULL);
659	}
660
661	rate = MS(rxdw3, R92C_RXDW3_RATE);
662	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
663
664	/* Get RSSI from PHY status descriptor if present. */
665	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
666		if (sc->chip & URTWN_CHIP_88E)
667			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
668		else
669			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
670		/* Update our average RSSI. */
671		urtwn_update_avgrssi(sc, rate, rssi);
672	}
673
674	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
675	if (m == NULL) {
676		device_printf(sc->sc_dev, "could not create RX mbuf\n");
677		return (NULL);
678	}
679
680	/* Finalize mbuf. */
681	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
682	memcpy(mtod(m, uint8_t *), wh, pktlen);
683	m->m_pkthdr.len = m->m_len = pktlen;
684
685	if (ieee80211_radiotap_active(ic)) {
686		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
687
688		tap->wr_flags = 0;
689		/* Map HW rate index to 802.11 rate. */
690		if (!(rxdw3 & R92C_RXDW3_HT)) {
691			tap->wr_rate = ridx2rate[rate];
692		} else if (rate >= 12) {	/* MCS0~15. */
693			/* Bit 7 set means HT MCS instead of rate. */
694			tap->wr_rate = 0x80 | (rate - 12);
695		}
696		tap->wr_dbm_antsignal = rssi;
697		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
698		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
699		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
700	}
701
702	*rssi_p = rssi;
703
704	return (m);
705}
706
707static struct mbuf *
708urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
709    int8_t *nf)
710{
711	struct urtwn_softc *sc = data->sc;
712	struct ieee80211com *ic = &sc->sc_ic;
713	struct r92c_rx_stat *stat;
714	struct mbuf *m, *m0 = NULL, *prevm = NULL;
715	uint32_t rxdw0;
716	uint8_t *buf;
717	int len, totlen, pktlen, infosz, npkts;
718
719	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
720
721	if (len < sizeof(*stat)) {
722		counter_u64_add(ic->ic_ierrors, 1);
723		return (NULL);
724	}
725
726	buf = data->buf;
727	/* Get the number of encapsulated frames. */
728	stat = (struct r92c_rx_stat *)buf;
729	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
730	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
731
732	/* Process all of them. */
733	while (npkts-- > 0) {
734		if (len < sizeof(*stat))
735			break;
736		stat = (struct r92c_rx_stat *)buf;
737		rxdw0 = le32toh(stat->rxdw0);
738
739		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
740		if (pktlen == 0)
741			break;
742
743		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
744
745		/* Make sure everything fits in xfer. */
746		totlen = sizeof(*stat) + infosz + pktlen;
747		if (totlen > len)
748			break;
749
750		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
751		if (m0 == NULL)
752			m0 = m;
753		if (prevm == NULL)
754			prevm = m;
755		else {
756			prevm->m_next = m;
757			prevm = m;
758		}
759
760		/* Next chunk is 128-byte aligned. */
761		totlen = (totlen + 127) & ~127;
762		buf += totlen;
763		len -= totlen;
764	}
765
766	return (m0);
767}
768
769static void
770urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
771{
772	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
773	struct ieee80211com *ic = &sc->sc_ic;
774	struct ieee80211_frame_min *wh;
775	struct ieee80211_node *ni;
776	struct mbuf *m = NULL, *next;
777	struct urtwn_data *data;
778	int8_t nf;
779	int rssi = 1;
780
781	URTWN_ASSERT_LOCKED(sc);
782
783	switch (USB_GET_STATE(xfer)) {
784	case USB_ST_TRANSFERRED:
785		data = STAILQ_FIRST(&sc->sc_rx_active);
786		if (data == NULL)
787			goto tr_setup;
788		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
789		m = urtwn_rxeof(xfer, data, &rssi, &nf);
790		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
791		/* FALLTHROUGH */
792	case USB_ST_SETUP:
793tr_setup:
794		data = STAILQ_FIRST(&sc->sc_rx_inactive);
795		if (data == NULL) {
796			KASSERT(m == NULL, ("mbuf isn't NULL"));
797			return;
798		}
799		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
800		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
801		usbd_xfer_set_frame_data(xfer, 0, data->buf,
802		    usbd_xfer_max_len(xfer));
803		usbd_transfer_submit(xfer);
804
805		/*
806		 * To avoid LOR we should unlock our private mutex here to call
807		 * ieee80211_input() because here is at the end of a USB
808		 * callback and safe to unlock.
809		 */
810		URTWN_UNLOCK(sc);
811		while (m != NULL) {
812			next = m->m_next;
813			m->m_next = NULL;
814			wh = mtod(m, struct ieee80211_frame_min *);
815			if (m->m_len >= sizeof(*wh))
816				ni = ieee80211_find_rxnode(ic, wh);
817			else
818				ni = NULL;
819			nf = URTWN_NOISE_FLOOR;
820			if (ni != NULL) {
821				(void)ieee80211_input(ni, m, rssi - nf, nf);
822				ieee80211_free_node(ni);
823			} else {
824				(void)ieee80211_input_all(ic, m, rssi - nf,
825				    nf);
826			}
827			m = next;
828		}
829		URTWN_LOCK(sc);
830		break;
831	default:
832		/* needs it to the inactive queue due to a error. */
833		data = STAILQ_FIRST(&sc->sc_rx_active);
834		if (data != NULL) {
835			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
836			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
837		}
838		if (error != USB_ERR_CANCELLED) {
839			usbd_xfer_set_stall(xfer);
840			counter_u64_add(ic->ic_ierrors, 1);
841			goto tr_setup;
842		}
843		break;
844	}
845}
846
847static void
848urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
849{
850
851	URTWN_ASSERT_LOCKED(sc);
852
853	if (data->ni != NULL)	/* not a beacon frame */
854		ieee80211_tx_complete(data->ni, data->m, status);
855
856	data->ni = NULL;
857	data->m = NULL;
858
859	sc->sc_txtimer = 0;
860
861	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
862}
863
864static int
865urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
866    int ndata, int maxsz)
867{
868	int i, error;
869
870	for (i = 0; i < ndata; i++) {
871		struct urtwn_data *dp = &data[i];
872		dp->sc = sc;
873		dp->m = NULL;
874		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
875		if (dp->buf == NULL) {
876			device_printf(sc->sc_dev,
877			    "could not allocate buffer\n");
878			error = ENOMEM;
879			goto fail;
880		}
881		dp->ni = NULL;
882	}
883
884	return (0);
885fail:
886	urtwn_free_list(sc, data, ndata);
887	return (error);
888}
889
890static int
891urtwn_alloc_rx_list(struct urtwn_softc *sc)
892{
893        int error, i;
894
895	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
896	    URTWN_RXBUFSZ);
897	if (error != 0)
898		return (error);
899
900	STAILQ_INIT(&sc->sc_rx_active);
901	STAILQ_INIT(&sc->sc_rx_inactive);
902
903	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
904		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
905
906	return (0);
907}
908
909static int
910urtwn_alloc_tx_list(struct urtwn_softc *sc)
911{
912	int error, i;
913
914	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
915	    URTWN_TXBUFSZ);
916	if (error != 0)
917		return (error);
918
919	STAILQ_INIT(&sc->sc_tx_active);
920	STAILQ_INIT(&sc->sc_tx_inactive);
921	STAILQ_INIT(&sc->sc_tx_pending);
922
923	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
924		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
925
926	return (0);
927}
928
929static void
930urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
931{
932	int i;
933
934	for (i = 0; i < ndata; i++) {
935		struct urtwn_data *dp = &data[i];
936
937		if (dp->buf != NULL) {
938			free(dp->buf, M_USBDEV);
939			dp->buf = NULL;
940		}
941		if (dp->ni != NULL) {
942			ieee80211_free_node(dp->ni);
943			dp->ni = NULL;
944		}
945	}
946}
947
948static void
949urtwn_free_rx_list(struct urtwn_softc *sc)
950{
951	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
952}
953
954static void
955urtwn_free_tx_list(struct urtwn_softc *sc)
956{
957	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
958}
959
960static void
961urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
962{
963	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
964	struct urtwn_data *data;
965
966	URTWN_ASSERT_LOCKED(sc);
967
968	switch (USB_GET_STATE(xfer)){
969	case USB_ST_TRANSFERRED:
970		data = STAILQ_FIRST(&sc->sc_tx_active);
971		if (data == NULL)
972			goto tr_setup;
973		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
974		urtwn_txeof(sc, data, 0);
975		/* FALLTHROUGH */
976	case USB_ST_SETUP:
977tr_setup:
978		data = STAILQ_FIRST(&sc->sc_tx_pending);
979		if (data == NULL) {
980			DPRINTF("%s: empty pending queue\n", __func__);
981			goto finish;
982		}
983		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
984		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
985		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
986		usbd_transfer_submit(xfer);
987		break;
988	default:
989		data = STAILQ_FIRST(&sc->sc_tx_active);
990		if (data == NULL)
991			goto tr_setup;
992		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
993		urtwn_txeof(sc, data, 1);
994		if (error != USB_ERR_CANCELLED) {
995			usbd_xfer_set_stall(xfer);
996			goto tr_setup;
997		}
998		break;
999	}
1000finish:
1001	/* Kick-start more transmit */
1002	urtwn_start(sc);
1003}
1004
1005static struct urtwn_data *
1006_urtwn_getbuf(struct urtwn_softc *sc)
1007{
1008	struct urtwn_data *bf;
1009
1010	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1011	if (bf != NULL)
1012		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1013	else
1014		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
1015	return (bf);
1016}
1017
1018static struct urtwn_data *
1019urtwn_getbuf(struct urtwn_softc *sc)
1020{
1021        struct urtwn_data *bf;
1022
1023	URTWN_ASSERT_LOCKED(sc);
1024
1025	bf = _urtwn_getbuf(sc);
1026	if (bf == NULL)
1027		DPRINTF("%s: stop queue\n", __func__);
1028	return (bf);
1029}
1030
1031static int
1032urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1033    int len)
1034{
1035	usb_device_request_t req;
1036
1037	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1038	req.bRequest = R92C_REQ_REGS;
1039	USETW(req.wValue, addr);
1040	USETW(req.wIndex, 0);
1041	USETW(req.wLength, len);
1042	return (urtwn_do_request(sc, &req, buf));
1043}
1044
1045static void
1046urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1047{
1048	urtwn_write_region_1(sc, addr, &val, 1);
1049}
1050
1051
1052static void
1053urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1054{
1055	val = htole16(val);
1056	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1057}
1058
1059static void
1060urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1061{
1062	val = htole32(val);
1063	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1064}
1065
1066static int
1067urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1068    int len)
1069{
1070	usb_device_request_t req;
1071
1072	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1073	req.bRequest = R92C_REQ_REGS;
1074	USETW(req.wValue, addr);
1075	USETW(req.wIndex, 0);
1076	USETW(req.wLength, len);
1077	return (urtwn_do_request(sc, &req, buf));
1078}
1079
1080static uint8_t
1081urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1082{
1083	uint8_t val;
1084
1085	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1086		return (0xff);
1087	return (val);
1088}
1089
1090static uint16_t
1091urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1092{
1093	uint16_t val;
1094
1095	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1096		return (0xffff);
1097	return (le16toh(val));
1098}
1099
1100static uint32_t
1101urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1102{
1103	uint32_t val;
1104
1105	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1106		return (0xffffffff);
1107	return (le32toh(val));
1108}
1109
1110static int
1111urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1112{
1113	struct r92c_fw_cmd cmd;
1114	int ntries;
1115
1116	/* Wait for current FW box to be empty. */
1117	for (ntries = 0; ntries < 100; ntries++) {
1118		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1119			break;
1120		urtwn_ms_delay(sc);
1121	}
1122	if (ntries == 100) {
1123		device_printf(sc->sc_dev,
1124		    "could not send firmware command\n");
1125		return (ETIMEDOUT);
1126	}
1127	memset(&cmd, 0, sizeof(cmd));
1128	cmd.id = id;
1129	if (len > 3)
1130		cmd.id |= R92C_CMD_FLAG_EXT;
1131	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1132	memcpy(cmd.msg, buf, len);
1133
1134	/* Write the first word last since that will trigger the FW. */
1135	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1136	    (uint8_t *)&cmd + 4, 2);
1137	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1138	    (uint8_t *)&cmd + 0, 4);
1139
1140	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1141	return (0);
1142}
1143
1144static __inline void
1145urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1146{
1147
1148	sc->sc_rf_write(sc, chain, addr, val);
1149}
1150
1151static void
1152urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1153    uint32_t val)
1154{
1155	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1156	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1157	    SM(R92C_LSSI_PARAM_DATA, val));
1158}
1159
1160static void
1161urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1162uint32_t val)
1163{
1164	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1165	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1166	    SM(R92C_LSSI_PARAM_DATA, val));
1167}
1168
1169static uint32_t
1170urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1171{
1172	uint32_t reg[R92C_MAX_CHAINS], val;
1173
1174	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1175	if (chain != 0)
1176		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1177
1178	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1179	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1180	urtwn_ms_delay(sc);
1181
1182	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1183	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1184	    R92C_HSSI_PARAM2_READ_EDGE);
1185	urtwn_ms_delay(sc);
1186
1187	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1188	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1189	urtwn_ms_delay(sc);
1190
1191	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1192		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1193	else
1194		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1195	return (MS(val, R92C_LSSI_READBACK_DATA));
1196}
1197
1198static int
1199urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1200{
1201	int ntries;
1202
1203	urtwn_write_4(sc, R92C_LLT_INIT,
1204	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1205	    SM(R92C_LLT_INIT_ADDR, addr) |
1206	    SM(R92C_LLT_INIT_DATA, data));
1207	/* Wait for write operation to complete. */
1208	for (ntries = 0; ntries < 20; ntries++) {
1209		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1210		    R92C_LLT_INIT_OP_NO_ACTIVE)
1211			return (0);
1212		urtwn_ms_delay(sc);
1213	}
1214	return (ETIMEDOUT);
1215}
1216
1217static uint8_t
1218urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1219{
1220	uint32_t reg;
1221	int ntries;
1222
1223	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1224	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1225	reg &= ~R92C_EFUSE_CTRL_VALID;
1226	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1227	/* Wait for read operation to complete. */
1228	for (ntries = 0; ntries < 100; ntries++) {
1229		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1230		if (reg & R92C_EFUSE_CTRL_VALID)
1231			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1232		urtwn_ms_delay(sc);
1233	}
1234	device_printf(sc->sc_dev,
1235	    "could not read efuse byte at address 0x%x\n", addr);
1236	return (0xff);
1237}
1238
1239static void
1240urtwn_efuse_read(struct urtwn_softc *sc)
1241{
1242	uint8_t *rom = (uint8_t *)&sc->rom;
1243	uint16_t addr = 0;
1244	uint32_t reg;
1245	uint8_t off, msk;
1246	int i;
1247
1248	urtwn_efuse_switch_power(sc);
1249
1250	memset(&sc->rom, 0xff, sizeof(sc->rom));
1251	while (addr < 512) {
1252		reg = urtwn_efuse_read_1(sc, addr);
1253		if (reg == 0xff)
1254			break;
1255		addr++;
1256		off = reg >> 4;
1257		msk = reg & 0xf;
1258		for (i = 0; i < 4; i++) {
1259			if (msk & (1 << i))
1260				continue;
1261			rom[off * 8 + i * 2 + 0] =
1262			    urtwn_efuse_read_1(sc, addr);
1263			addr++;
1264			rom[off * 8 + i * 2 + 1] =
1265			    urtwn_efuse_read_1(sc, addr);
1266			addr++;
1267		}
1268	}
1269#ifdef URTWN_DEBUG
1270	if (urtwn_debug >= 2) {
1271		/* Dump ROM content. */
1272		printf("\n");
1273		for (i = 0; i < sizeof(sc->rom); i++)
1274			printf("%02x:", rom[i]);
1275		printf("\n");
1276	}
1277#endif
1278	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1279}
1280
1281static void
1282urtwn_efuse_switch_power(struct urtwn_softc *sc)
1283{
1284	uint32_t reg;
1285
1286	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1287
1288	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1289	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1290		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1291		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1292	}
1293	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1294	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1295		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1296		    reg | R92C_SYS_FUNC_EN_ELDR);
1297	}
1298	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1299	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1300	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1301		urtwn_write_2(sc, R92C_SYS_CLKR,
1302		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1303	}
1304}
1305
1306static int
1307urtwn_read_chipid(struct urtwn_softc *sc)
1308{
1309	uint32_t reg;
1310
1311	if (sc->chip & URTWN_CHIP_88E)
1312		return (0);
1313
1314	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1315	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1316		return (EIO);
1317
1318	if (reg & R92C_SYS_CFG_TYPE_92C) {
1319		sc->chip |= URTWN_CHIP_92C;
1320		/* Check if it is a castrated 8192C. */
1321		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1322		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1323		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1324			sc->chip |= URTWN_CHIP_92C_1T2R;
1325	}
1326	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1327		sc->chip |= URTWN_CHIP_UMC;
1328		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1329			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1330	}
1331	return (0);
1332}
1333
1334static void
1335urtwn_read_rom(struct urtwn_softc *sc)
1336{
1337	struct r92c_rom *rom = &sc->rom;
1338
1339	/* Read full ROM image. */
1340	urtwn_efuse_read(sc);
1341
1342	/* XXX Weird but this is what the vendor driver does. */
1343	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1344	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1345
1346	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1347
1348	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1349	DPRINTF("regulatory type=%d\n", sc->regulatory);
1350	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1351
1352	sc->sc_rf_write = urtwn_r92c_rf_write;
1353	sc->sc_power_on = urtwn_r92c_power_on;
1354	sc->sc_dma_init = urtwn_r92c_dma_init;
1355}
1356
1357static void
1358urtwn_r88e_read_rom(struct urtwn_softc *sc)
1359{
1360	uint8_t *rom = sc->r88e_rom;
1361	uint16_t addr = 0;
1362	uint32_t reg;
1363	uint8_t off, msk, tmp;
1364	int i;
1365
1366	off = 0;
1367	urtwn_efuse_switch_power(sc);
1368
1369	/* Read full ROM image. */
1370	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1371	while (addr < 512) {
1372		reg = urtwn_efuse_read_1(sc, addr);
1373		if (reg == 0xff)
1374			break;
1375		addr++;
1376		if ((reg & 0x1f) == 0x0f) {
1377			tmp = (reg & 0xe0) >> 5;
1378			reg = urtwn_efuse_read_1(sc, addr);
1379			if ((reg & 0x0f) != 0x0f)
1380				off = ((reg & 0xf0) >> 1) | tmp;
1381			addr++;
1382		} else
1383			off = reg >> 4;
1384		msk = reg & 0xf;
1385		for (i = 0; i < 4; i++) {
1386			if (msk & (1 << i))
1387				continue;
1388			rom[off * 8 + i * 2 + 0] =
1389			    urtwn_efuse_read_1(sc, addr);
1390			addr++;
1391			rom[off * 8 + i * 2 + 1] =
1392			    urtwn_efuse_read_1(sc, addr);
1393			addr++;
1394		}
1395	}
1396
1397	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1398
1399	addr = 0x10;
1400	for (i = 0; i < 6; i++)
1401		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1402	for (i = 0; i < 5; i++)
1403		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1404	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1405	if (sc->bw20_tx_pwr_diff & 0x08)
1406		sc->bw20_tx_pwr_diff |= 0xf0;
1407	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1408	if (sc->ofdm_tx_pwr_diff & 0x08)
1409		sc->ofdm_tx_pwr_diff |= 0xf0;
1410	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1411	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &sc->r88e_rom[0xd7]);
1412
1413	sc->sc_rf_write = urtwn_r88e_rf_write;
1414	sc->sc_power_on = urtwn_r88e_power_on;
1415	sc->sc_dma_init = urtwn_r88e_dma_init;
1416}
1417
1418/*
1419 * Initialize rate adaptation in firmware.
1420 */
1421static int
1422urtwn_ra_init(struct urtwn_softc *sc)
1423{
1424	struct ieee80211com *ic = &sc->sc_ic;
1425	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1426	struct ieee80211_node *ni;
1427	struct ieee80211_rateset *rs;
1428	struct r92c_fw_cmd_macid_cfg cmd;
1429	uint32_t rates, basicrates;
1430	uint8_t mode;
1431	int maxrate, maxbasicrate, error, i, j;
1432
1433	ni = ieee80211_ref_node(vap->iv_bss);
1434	rs = &ni->ni_rates;
1435
1436	/* Get normal and basic rates mask. */
1437	rates = basicrates = 0;
1438	maxrate = maxbasicrate = 0;
1439	for (i = 0; i < rs->rs_nrates; i++) {
1440		/* Convert 802.11 rate to HW rate index. */
1441		for (j = 0; j < nitems(ridx2rate); j++)
1442			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1443			    ridx2rate[j])
1444				break;
1445		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1446			continue;
1447		rates |= 1 << j;
1448		if (j > maxrate)
1449			maxrate = j;
1450		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1451			basicrates |= 1 << j;
1452			if (j > maxbasicrate)
1453				maxbasicrate = j;
1454		}
1455	}
1456	if (ic->ic_curmode == IEEE80211_MODE_11B)
1457		mode = R92C_RAID_11B;
1458	else
1459		mode = R92C_RAID_11BG;
1460	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1461	    mode, rates, basicrates);
1462
1463	/* Set rates mask for group addressed frames. */
1464	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1465	cmd.mask = htole32(mode << 28 | basicrates);
1466	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1467	if (error != 0) {
1468		ieee80211_free_node(ni);
1469		device_printf(sc->sc_dev,
1470		    "could not add broadcast station\n");
1471		return (error);
1472	}
1473	/* Set initial MRR rate. */
1474	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1475	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1476	    maxbasicrate);
1477
1478	/* Set rates mask for unicast frames. */
1479	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1480	cmd.mask = htole32(mode << 28 | rates);
1481	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1482	if (error != 0) {
1483		ieee80211_free_node(ni);
1484		device_printf(sc->sc_dev, "could not add BSS station\n");
1485		return (error);
1486	}
1487	/* Set initial MRR rate. */
1488	DPRINTF("maxrate=%d\n", maxrate);
1489	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1490	    maxrate);
1491
1492	/* Indicate highest supported rate. */
1493	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1494	ieee80211_free_node(ni);
1495
1496	return (0);
1497}
1498
1499static void
1500urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1501{
1502	struct r92c_tx_desc *txd = &uvp->bcn_desc;
1503
1504	txd->txdw0 = htole32(
1505	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
1506	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1507	txd->txdw1 = htole32(
1508	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
1509	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1510
1511	if (sc->chip & URTWN_CHIP_88E)
1512		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
1513	else
1514		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
1515
1516	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
1517	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
1518	txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
1519}
1520
1521static int
1522urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
1523{
1524 	struct ieee80211vap *vap = ni->ni_vap;
1525	struct urtwn_vap *uvp = URTWN_VAP(vap);
1526	struct mbuf *m;
1527	int error;
1528
1529	URTWN_ASSERT_LOCKED(sc);
1530
1531	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1532		return (EINVAL);
1533
1534	m = ieee80211_beacon_alloc(ni);
1535	if (m == NULL) {
1536		device_printf(sc->sc_dev,
1537		    "%s: could not allocate beacon frame\n", __func__);
1538		return (ENOMEM);
1539	}
1540
1541	if (uvp->bcn_mbuf != NULL)
1542		m_freem(uvp->bcn_mbuf);
1543
1544	uvp->bcn_mbuf = m;
1545
1546	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1547		return (error);
1548
1549	/* XXX bcnq stuck workaround */
1550	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1551		return (error);
1552
1553	return (0);
1554}
1555
1556static void
1557urtwn_update_beacon(struct ieee80211vap *vap, int item)
1558{
1559	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1560	struct urtwn_vap *uvp = URTWN_VAP(vap);
1561	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
1562	struct ieee80211_node *ni = vap->iv_bss;
1563	int mcast = 0;
1564
1565	URTWN_LOCK(sc);
1566	if (uvp->bcn_mbuf == NULL) {
1567		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
1568		if (uvp->bcn_mbuf == NULL) {
1569			device_printf(sc->sc_dev,
1570			    "%s: could not allocate beacon frame\n", __func__);
1571			URTWN_UNLOCK(sc);
1572			return;
1573		}
1574	}
1575	URTWN_UNLOCK(sc);
1576
1577	if (item == IEEE80211_BEACON_TIM)
1578		mcast = 1;	/* XXX */
1579
1580	setbit(bo->bo_flags, item);
1581	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
1582
1583	URTWN_LOCK(sc);
1584	urtwn_tx_beacon(sc, uvp);
1585	URTWN_UNLOCK(sc);
1586}
1587
1588/*
1589 * Push a beacon frame into the chip. Beacon will
1590 * be repeated by the chip every R92C_BCN_INTERVAL.
1591 */
1592static int
1593urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1594{
1595	struct r92c_tx_desc *desc = &uvp->bcn_desc;
1596	struct urtwn_data *bf;
1597
1598	URTWN_ASSERT_LOCKED(sc);
1599
1600	bf = urtwn_getbuf(sc);
1601	if (bf == NULL)
1602		return (ENOMEM);
1603
1604	memcpy(bf->buf, desc, sizeof(*desc));
1605	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
1606
1607	sc->sc_txtimer = 5;
1608	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1609
1610	return (0);
1611}
1612
1613static void
1614urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
1615{
1616	/* Reset TSF. */
1617	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1618
1619	switch (vap->iv_opmode) {
1620	case IEEE80211_M_STA:
1621		/* Enable TSF synchronization. */
1622		urtwn_write_1(sc, R92C_BCN_CTRL,
1623		    urtwn_read_1(sc, R92C_BCN_CTRL) &
1624		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1625		break;
1626	case IEEE80211_M_HOSTAP:
1627		/* Enable beaconing. */
1628		urtwn_write_1(sc, R92C_MBID_NUM,
1629		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1630		urtwn_write_1(sc, R92C_BCN_CTRL,
1631		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1632		break;
1633	default:
1634		device_printf(sc->sc_dev, "undefined opmode %d\n",
1635		    vap->iv_opmode);
1636		return;
1637	}
1638}
1639
1640static void
1641urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1642{
1643	uint8_t reg;
1644
1645	if (led == URTWN_LED_LINK) {
1646		if (sc->chip & URTWN_CHIP_88E) {
1647			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1648			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1649			if (!on) {
1650				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1651				urtwn_write_1(sc, R92C_LEDCFG2,
1652				    reg | R92C_LEDCFG0_DIS);
1653				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1654				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1655				    0xfe);
1656			}
1657		} else {
1658			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1659			if (!on)
1660				reg |= R92C_LEDCFG0_DIS;
1661			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1662		}
1663		sc->ledlink = on;       /* Save LED state. */
1664	}
1665}
1666
1667static void
1668urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
1669{
1670	uint8_t reg;
1671
1672	reg = urtwn_read_1(sc, R92C_MSR);
1673	reg = (reg & ~R92C_MSR_MASK) | mode;
1674	urtwn_write_1(sc, R92C_MSR, reg);
1675}
1676
1677static int
1678urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1679{
1680	struct urtwn_vap *uvp = URTWN_VAP(vap);
1681	struct ieee80211com *ic = vap->iv_ic;
1682	struct urtwn_softc *sc = ic->ic_softc;
1683	struct ieee80211_node *ni;
1684	enum ieee80211_state ostate;
1685	uint32_t reg;
1686	uint8_t mode;
1687	int error = 0;
1688
1689	ostate = vap->iv_state;
1690	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1691	    ieee80211_state_name[nstate]);
1692
1693	IEEE80211_UNLOCK(ic);
1694	URTWN_LOCK(sc);
1695	callout_stop(&sc->sc_watchdog_ch);
1696
1697	if (ostate == IEEE80211_S_RUN) {
1698		/* Turn link LED off. */
1699		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1700
1701		/* Set media status to 'No Link'. */
1702		urtwn_set_mode(sc, R92C_MSR_NOLINK);
1703
1704		/* Stop Rx of data frames. */
1705		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1706
1707		/* Disable TSF synchronization. */
1708		urtwn_write_1(sc, R92C_BCN_CTRL,
1709		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
1710		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1711
1712		/* Disable beaconing. */
1713		urtwn_write_1(sc, R92C_MBID_NUM,
1714		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
1715
1716		/* Reset TSF. */
1717		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1718
1719		/* Reset EDCA parameters. */
1720		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1721		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1722		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1723		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1724	}
1725
1726	switch (nstate) {
1727	case IEEE80211_S_INIT:
1728		/* Turn link LED off. */
1729		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1730		break;
1731	case IEEE80211_S_SCAN:
1732		/* Pause AC Tx queues. */
1733		urtwn_write_1(sc, R92C_TXPAUSE,
1734		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1735		break;
1736	case IEEE80211_S_AUTH:
1737		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1738		break;
1739	case IEEE80211_S_RUN:
1740		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1741			/* Turn link LED on. */
1742			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1743			break;
1744		}
1745
1746		ni = ieee80211_ref_node(vap->iv_bss);
1747
1748		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1749		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1750			device_printf(sc->sc_dev,
1751			    "%s: could not move to RUN state\n", __func__);
1752			error = EINVAL;
1753			goto end_run;
1754		}
1755
1756		switch (vap->iv_opmode) {
1757		case IEEE80211_M_STA:
1758			mode = R92C_MSR_INFRA;
1759			break;
1760		case IEEE80211_M_HOSTAP:
1761			mode = R92C_MSR_AP;
1762			break;
1763		default:
1764			device_printf(sc->sc_dev, "undefined opmode %d\n",
1765			    vap->iv_opmode);
1766			error = EINVAL;
1767			goto end_run;
1768		}
1769
1770		/* Set media status to 'Associated'. */
1771		urtwn_set_mode(sc, mode);
1772
1773		/* Set BSSID. */
1774		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1775		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1776
1777		if (ic->ic_curmode == IEEE80211_MODE_11B)
1778			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1779		else	/* 802.11b/g */
1780			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1781
1782		/* Enable Rx of data frames. */
1783		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1784
1785		/* Flush all AC queues. */
1786		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1787
1788		/* Set beacon interval. */
1789		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1790
1791		/* Allow Rx from our BSSID only. */
1792		if (ic->ic_promisc == 0) {
1793			reg = urtwn_read_4(sc, R92C_RCR);
1794
1795			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
1796				reg |= R92C_RCR_CBSSID_DATA;
1797
1798			reg |= R92C_RCR_CBSSID_BCN;
1799
1800			urtwn_write_4(sc, R92C_RCR, reg);
1801		}
1802
1803		if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1804			error = urtwn_setup_beacon(sc, ni);
1805			if (error != 0) {
1806				device_printf(sc->sc_dev,
1807				    "unable to push beacon into the chip, "
1808				    "error %d\n", error);
1809				goto end_run;
1810			}
1811		}
1812
1813		/* Enable TSF synchronization. */
1814		urtwn_tsf_sync_enable(sc, vap);
1815
1816		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1817		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1818		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1819		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1820		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1821		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1822
1823		/* Intialize rate adaptation. */
1824		if (sc->chip & URTWN_CHIP_88E)
1825			ni->ni_txrate =
1826			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1827		else
1828			urtwn_ra_init(sc);
1829		/* Turn link LED on. */
1830		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1831
1832		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1833		/* Reset temperature calibration state machine. */
1834		sc->thcal_state = 0;
1835		sc->thcal_lctemp = 0;
1836
1837end_run:
1838		ieee80211_free_node(ni);
1839		break;
1840	default:
1841		break;
1842	}
1843
1844	URTWN_UNLOCK(sc);
1845	IEEE80211_LOCK(ic);
1846	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
1847}
1848
1849static void
1850urtwn_watchdog(void *arg)
1851{
1852	struct urtwn_softc *sc = arg;
1853
1854	if (sc->sc_txtimer > 0) {
1855		if (--sc->sc_txtimer == 0) {
1856			device_printf(sc->sc_dev, "device timeout\n");
1857			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1858			return;
1859		}
1860		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1861	}
1862}
1863
1864static void
1865urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1866{
1867	int pwdb;
1868
1869	/* Convert antenna signal to percentage. */
1870	if (rssi <= -100 || rssi >= 20)
1871		pwdb = 0;
1872	else if (rssi >= 0)
1873		pwdb = 100;
1874	else
1875		pwdb = 100 + rssi;
1876	if (!(sc->chip & URTWN_CHIP_88E)) {
1877		if (rate <= URTWN_RIDX_CCK11) {
1878			/* CCK gain is smaller than OFDM/MCS gain. */
1879			pwdb += 6;
1880			if (pwdb > 100)
1881				pwdb = 100;
1882			if (pwdb <= 14)
1883				pwdb -= 4;
1884			else if (pwdb <= 26)
1885				pwdb -= 8;
1886			else if (pwdb <= 34)
1887				pwdb -= 6;
1888			else if (pwdb <= 42)
1889				pwdb -= 2;
1890		}
1891	}
1892	if (sc->avg_pwdb == -1)	/* Init. */
1893		sc->avg_pwdb = pwdb;
1894	else if (sc->avg_pwdb < pwdb)
1895		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1896	else
1897		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1898	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1899}
1900
1901static int8_t
1902urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1903{
1904	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1905	struct r92c_rx_phystat *phy;
1906	struct r92c_rx_cck *cck;
1907	uint8_t rpt;
1908	int8_t rssi;
1909
1910	if (rate <= URTWN_RIDX_CCK11) {
1911		cck = (struct r92c_rx_cck *)physt;
1912		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1913			rpt = (cck->agc_rpt >> 5) & 0x3;
1914			rssi = (cck->agc_rpt & 0x1f) << 1;
1915		} else {
1916			rpt = (cck->agc_rpt >> 6) & 0x3;
1917			rssi = cck->agc_rpt & 0x3e;
1918		}
1919		rssi = cckoff[rpt] - rssi;
1920	} else {	/* OFDM/HT. */
1921		phy = (struct r92c_rx_phystat *)physt;
1922		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1923	}
1924	return (rssi);
1925}
1926
1927static int8_t
1928urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1929{
1930	struct r92c_rx_phystat *phy;
1931	struct r88e_rx_cck *cck;
1932	uint8_t cck_agc_rpt, lna_idx, vga_idx;
1933	int8_t rssi;
1934
1935	rssi = 0;
1936	if (rate <= URTWN_RIDX_CCK11) {
1937		cck = (struct r88e_rx_cck *)physt;
1938		cck_agc_rpt = cck->agc_rpt;
1939		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1940		vga_idx = cck_agc_rpt & 0x1f;
1941		switch (lna_idx) {
1942		case 7:
1943			if (vga_idx <= 27)
1944				rssi = -100 + 2* (27 - vga_idx);
1945			else
1946				rssi = -100;
1947			break;
1948		case 6:
1949			rssi = -48 + 2 * (2 - vga_idx);
1950			break;
1951		case 5:
1952			rssi = -42 + 2 * (7 - vga_idx);
1953			break;
1954		case 4:
1955			rssi = -36 + 2 * (7 - vga_idx);
1956			break;
1957		case 3:
1958			rssi = -24 + 2 * (7 - vga_idx);
1959			break;
1960		case 2:
1961			rssi = -12 + 2 * (5 - vga_idx);
1962			break;
1963		case 1:
1964			rssi = 8 - (2 * vga_idx);
1965			break;
1966		case 0:
1967			rssi = 14 - (2 * vga_idx);
1968			break;
1969		}
1970		rssi += 6;
1971	} else {	/* OFDM/HT. */
1972		phy = (struct r92c_rx_phystat *)physt;
1973		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1974	}
1975	return (rssi);
1976}
1977
1978static int
1979urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
1980    struct mbuf *m, struct urtwn_data *data)
1981{
1982	struct ieee80211_frame *wh;
1983	struct ieee80211_key *k = NULL;
1984	struct ieee80211com *ic = &sc->sc_ic;
1985	struct ieee80211vap *vap = ni->ni_vap;
1986	struct r92c_tx_desc *txd;
1987	uint8_t macid, raid, ridx, subtype, type, qsel;
1988	int ismcast;
1989
1990	URTWN_ASSERT_LOCKED(sc);
1991
1992	/*
1993	 * Software crypto.
1994	 */
1995	wh = mtod(m, struct ieee80211_frame *);
1996	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1997	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1998	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1999
2000	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2001		k = ieee80211_crypto_encap(ni, m);
2002		if (k == NULL) {
2003			device_printf(sc->sc_dev,
2004			    "ieee80211_crypto_encap returns NULL.\n");
2005			return (ENOBUFS);
2006		}
2007
2008		/* in case packet header moved, reset pointer */
2009		wh = mtod(m, struct ieee80211_frame *);
2010	}
2011
2012	/* Fill Tx descriptor. */
2013	txd = (struct r92c_tx_desc *)data->buf;
2014	memset(txd, 0, sizeof(*txd));
2015
2016	txd->txdw0 |= htole32(
2017	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2018	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2019	if (ismcast)
2020		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2021
2022	raid = R92C_RAID_11B;	/* by default */
2023	ridx = URTWN_RIDX_CCK1;
2024	if (!ismcast) {
2025		macid = URTWN_MACID_BSS;
2026
2027		if (type == IEEE80211_FC0_TYPE_DATA) {
2028			qsel = R92C_TXDW1_QSEL_BE;
2029
2030			if (!(m->m_flags & M_EAPOL)) {
2031				if (ic->ic_curmode != IEEE80211_MODE_11B) {
2032					raid = R92C_RAID_11BG;
2033					ridx = URTWN_RIDX_OFDM54;
2034				} else
2035					ridx = URTWN_RIDX_CCK11;
2036			}
2037
2038			if (sc->chip & URTWN_CHIP_88E)
2039				txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
2040			else
2041				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2042
2043			if (ic->ic_flags & IEEE80211_F_USEPROT) {
2044				switch (ic->ic_protmode) {
2045				case IEEE80211_PROT_CTSONLY:
2046					txd->txdw4 |= htole32(
2047					    R92C_TXDW4_CTS2SELF |
2048					    R92C_TXDW4_HWRTSEN);
2049					break;
2050				case IEEE80211_PROT_RTSCTS:
2051					txd->txdw4 |= htole32(
2052					    R92C_TXDW4_RTSEN |
2053					    R92C_TXDW4_HWRTSEN);
2054					break;
2055				default:
2056					break;
2057				}
2058			}
2059			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2060			    URTWN_RIDX_OFDM24));
2061			txd->txdw5 |= htole32(0x0001ff00);
2062		} else	/* IEEE80211_FC0_TYPE_MGT */
2063			qsel = R92C_TXDW1_QSEL_MGNT;
2064	} else {
2065		macid = URTWN_MACID_BC;
2066		qsel = R92C_TXDW1_QSEL_MGNT;
2067	}
2068
2069	txd->txdw1 |= htole32(
2070	    SM(R92C_TXDW1_QSEL, qsel) |
2071	    SM(R92C_TXDW1_RAID, raid));
2072
2073	if (sc->chip & URTWN_CHIP_88E)
2074		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2075	else
2076		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2077
2078	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2079	/* not sure here */
2080	if (ridx <= URTWN_RIDX_CCK11)
2081		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2082
2083	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
2084		/* Use HW sequence numbering for non-QoS frames. */
2085		txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
2086	} else {
2087		/* Set sequence number. */
2088		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2089	}
2090
2091	if (ieee80211_radiotap_active_vap(vap)) {
2092		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2093
2094		tap->wt_flags = 0;
2095		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2096		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2097		if (k != NULL)
2098			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2099		ieee80211_radiotap_tx(vap, m);
2100	}
2101
2102	data->ni = ni;
2103
2104	urtwn_tx_start(sc, m, type, data);
2105
2106	return (0);
2107}
2108
2109static void
2110urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
2111    struct urtwn_data *data)
2112{
2113	struct usb_xfer *xfer;
2114	struct r92c_tx_desc *txd;
2115	uint16_t ac, sum;
2116	int i, xferlen;
2117	struct usb_xfer *urtwn_pipes[WME_NUM_AC] = {
2118		sc->sc_xfer[URTWN_BULK_TX_BE],
2119		sc->sc_xfer[URTWN_BULK_TX_BK],
2120		sc->sc_xfer[URTWN_BULK_TX_VI],
2121		sc->sc_xfer[URTWN_BULK_TX_VO]
2122	};
2123
2124	URTWN_ASSERT_LOCKED(sc);
2125
2126	ac = M_WME_GETAC(m);
2127
2128	switch (type) {
2129	case IEEE80211_FC0_TYPE_CTL:
2130	case IEEE80211_FC0_TYPE_MGT:
2131		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
2132		break;
2133	default:
2134		xfer = urtwn_pipes[ac];
2135		break;
2136	}
2137
2138	txd = (struct r92c_tx_desc *)data->buf;
2139	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
2140
2141	/* Compute Tx descriptor checksum. */
2142	sum = 0;
2143	for (i = 0; i < sizeof(*txd) / 2; i++)
2144		sum ^= ((uint16_t *)txd)[i];
2145	txd->txdsum = sum;	/* NB: already little endian. */
2146
2147	xferlen = sizeof(*txd) + m->m_pkthdr.len;
2148	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
2149
2150	data->buflen = xferlen;
2151	data->m = m;
2152
2153	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2154	usbd_transfer_start(xfer);
2155}
2156
2157static int
2158urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
2159{
2160	struct urtwn_softc *sc = ic->ic_softc;
2161	int error;
2162
2163	URTWN_LOCK(sc);
2164	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2165		URTWN_UNLOCK(sc);
2166		return (ENXIO);
2167	}
2168	error = mbufq_enqueue(&sc->sc_snd, m);
2169	if (error) {
2170		URTWN_UNLOCK(sc);
2171		return (error);
2172	}
2173	urtwn_start(sc);
2174	URTWN_UNLOCK(sc);
2175
2176	return (0);
2177}
2178
2179static void
2180urtwn_start(struct urtwn_softc *sc)
2181{
2182	struct ieee80211_node *ni;
2183	struct mbuf *m;
2184	struct urtwn_data *bf;
2185
2186	URTWN_ASSERT_LOCKED(sc);
2187	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2188		bf = urtwn_getbuf(sc);
2189		if (bf == NULL) {
2190			mbufq_prepend(&sc->sc_snd, m);
2191			break;
2192		}
2193		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2194		m->m_pkthdr.rcvif = NULL;
2195		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
2196			if_inc_counter(ni->ni_vap->iv_ifp,
2197			    IFCOUNTER_OERRORS, 1);
2198			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2199			m_freem(m);
2200			ieee80211_free_node(ni);
2201			break;
2202		}
2203		sc->sc_txtimer = 5;
2204		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2205	}
2206}
2207
2208static void
2209urtwn_parent(struct ieee80211com *ic)
2210{
2211	struct urtwn_softc *sc = ic->ic_softc;
2212	int startall = 0;
2213
2214	URTWN_LOCK(sc);
2215	if (sc->sc_flags & URTWN_DETACHED) {
2216		URTWN_UNLOCK(sc);
2217		return;
2218	}
2219	if (ic->ic_nrunning > 0) {
2220		if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2221			urtwn_init(sc);
2222			startall = 1;
2223		}
2224	} else if (sc->sc_flags & URTWN_RUNNING)
2225		urtwn_stop(sc);
2226	URTWN_UNLOCK(sc);
2227
2228	if (startall)
2229		ieee80211_start_all(ic);
2230}
2231
2232static __inline int
2233urtwn_power_on(struct urtwn_softc *sc)
2234{
2235
2236	return sc->sc_power_on(sc);
2237}
2238
2239static int
2240urtwn_r92c_power_on(struct urtwn_softc *sc)
2241{
2242	uint32_t reg;
2243	int ntries;
2244
2245	/* Wait for autoload done bit. */
2246	for (ntries = 0; ntries < 1000; ntries++) {
2247		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2248			break;
2249		urtwn_ms_delay(sc);
2250	}
2251	if (ntries == 1000) {
2252		device_printf(sc->sc_dev,
2253		    "timeout waiting for chip autoload\n");
2254		return (ETIMEDOUT);
2255	}
2256
2257	/* Unlock ISO/CLK/Power control register. */
2258	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2259	/* Move SPS into PWM mode. */
2260	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2261	urtwn_ms_delay(sc);
2262
2263	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2264	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2265		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2266		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2267		urtwn_ms_delay(sc);
2268		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2269		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2270		    ~R92C_SYS_ISO_CTRL_MD2PP);
2271	}
2272
2273	/* Auto enable WLAN. */
2274	urtwn_write_2(sc, R92C_APS_FSMCO,
2275	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2276	for (ntries = 0; ntries < 1000; ntries++) {
2277		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2278		    R92C_APS_FSMCO_APFM_ONMAC))
2279			break;
2280		urtwn_ms_delay(sc);
2281	}
2282	if (ntries == 1000) {
2283		device_printf(sc->sc_dev,
2284		    "timeout waiting for MAC auto ON\n");
2285		return (ETIMEDOUT);
2286	}
2287
2288	/* Enable radio, GPIO and LED functions. */
2289	urtwn_write_2(sc, R92C_APS_FSMCO,
2290	    R92C_APS_FSMCO_AFSM_HSUS |
2291	    R92C_APS_FSMCO_PDN_EN |
2292	    R92C_APS_FSMCO_PFM_ALDN);
2293	/* Release RF digital isolation. */
2294	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2295	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2296
2297	/* Initialize MAC. */
2298	urtwn_write_1(sc, R92C_APSD_CTRL,
2299	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2300	for (ntries = 0; ntries < 200; ntries++) {
2301		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2302		    R92C_APSD_CTRL_OFF_STATUS))
2303			break;
2304		urtwn_ms_delay(sc);
2305	}
2306	if (ntries == 200) {
2307		device_printf(sc->sc_dev,
2308		    "timeout waiting for MAC initialization\n");
2309		return (ETIMEDOUT);
2310	}
2311
2312	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2313	reg = urtwn_read_2(sc, R92C_CR);
2314	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2315	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2316	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2317	    R92C_CR_ENSEC;
2318	urtwn_write_2(sc, R92C_CR, reg);
2319
2320	urtwn_write_1(sc, 0xfe10, 0x19);
2321	return (0);
2322}
2323
2324static int
2325urtwn_r88e_power_on(struct urtwn_softc *sc)
2326{
2327	uint32_t reg;
2328	int ntries;
2329
2330	/* Wait for power ready bit. */
2331	for (ntries = 0; ntries < 5000; ntries++) {
2332		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2333			break;
2334		urtwn_ms_delay(sc);
2335	}
2336	if (ntries == 5000) {
2337		device_printf(sc->sc_dev,
2338		    "timeout waiting for chip power up\n");
2339		return (ETIMEDOUT);
2340	}
2341
2342	/* Reset BB. */
2343	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2344	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2345	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2346
2347	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2348	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2349
2350	/* Disable HWPDN. */
2351	urtwn_write_2(sc, R92C_APS_FSMCO,
2352	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2353
2354	/* Disable WL suspend. */
2355	urtwn_write_2(sc, R92C_APS_FSMCO,
2356	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2357	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2358
2359	urtwn_write_2(sc, R92C_APS_FSMCO,
2360	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2361	for (ntries = 0; ntries < 5000; ntries++) {
2362		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2363		    R92C_APS_FSMCO_APFM_ONMAC))
2364			break;
2365		urtwn_ms_delay(sc);
2366	}
2367	if (ntries == 5000)
2368		return (ETIMEDOUT);
2369
2370	/* Enable LDO normal mode. */
2371	urtwn_write_1(sc, R92C_LPLDO_CTRL,
2372	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2373
2374	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2375	urtwn_write_2(sc, R92C_CR, 0);
2376	reg = urtwn_read_2(sc, R92C_CR);
2377	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2378	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2379	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2380	urtwn_write_2(sc, R92C_CR, reg);
2381
2382	return (0);
2383}
2384
2385static int
2386urtwn_llt_init(struct urtwn_softc *sc)
2387{
2388	int i, error, page_count, pktbuf_count;
2389
2390	page_count = (sc->chip & URTWN_CHIP_88E) ?
2391	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2392	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2393	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2394
2395	/* Reserve pages [0; page_count]. */
2396	for (i = 0; i < page_count; i++) {
2397		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2398			return (error);
2399	}
2400	/* NB: 0xff indicates end-of-list. */
2401	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2402		return (error);
2403	/*
2404	 * Use pages [page_count + 1; pktbuf_count - 1]
2405	 * as ring buffer.
2406	 */
2407	for (++i; i < pktbuf_count - 1; i++) {
2408		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2409			return (error);
2410	}
2411	/* Make the last page point to the beginning of the ring buffer. */
2412	error = urtwn_llt_write(sc, i, page_count + 1);
2413	return (error);
2414}
2415
2416static void
2417urtwn_fw_reset(struct urtwn_softc *sc)
2418{
2419	uint16_t reg;
2420	int ntries;
2421
2422	/* Tell 8051 to reset itself. */
2423	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2424
2425	/* Wait until 8051 resets by itself. */
2426	for (ntries = 0; ntries < 100; ntries++) {
2427		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2428		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2429			return;
2430		urtwn_ms_delay(sc);
2431	}
2432	/* Force 8051 reset. */
2433	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2434}
2435
2436static void
2437urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2438{
2439	uint16_t reg;
2440
2441	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2442	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2443	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2444}
2445
2446static int
2447urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2448{
2449	uint32_t reg;
2450	int off, mlen, error = 0;
2451
2452	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2453	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2454	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2455
2456	off = R92C_FW_START_ADDR;
2457	while (len > 0) {
2458		if (len > 196)
2459			mlen = 196;
2460		else if (len > 4)
2461			mlen = 4;
2462		else
2463			mlen = 1;
2464		/* XXX fix this deconst */
2465		error = urtwn_write_region_1(sc, off,
2466		    __DECONST(uint8_t *, buf), mlen);
2467		if (error != 0)
2468			break;
2469		off += mlen;
2470		buf += mlen;
2471		len -= mlen;
2472	}
2473	return (error);
2474}
2475
2476static int
2477urtwn_load_firmware(struct urtwn_softc *sc)
2478{
2479	const struct firmware *fw;
2480	const struct r92c_fw_hdr *hdr;
2481	const char *imagename;
2482	const u_char *ptr;
2483	size_t len;
2484	uint32_t reg;
2485	int mlen, ntries, page, error;
2486
2487	URTWN_UNLOCK(sc);
2488	/* Read firmware image from the filesystem. */
2489	if (sc->chip & URTWN_CHIP_88E)
2490		imagename = "urtwn-rtl8188eufw";
2491	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2492		    URTWN_CHIP_UMC_A_CUT)
2493		imagename = "urtwn-rtl8192cfwU";
2494	else
2495		imagename = "urtwn-rtl8192cfwT";
2496
2497	fw = firmware_get(imagename);
2498	URTWN_LOCK(sc);
2499	if (fw == NULL) {
2500		device_printf(sc->sc_dev,
2501		    "failed loadfirmware of file %s\n", imagename);
2502		return (ENOENT);
2503	}
2504
2505	len = fw->datasize;
2506
2507	if (len < sizeof(*hdr)) {
2508		device_printf(sc->sc_dev, "firmware too short\n");
2509		error = EINVAL;
2510		goto fail;
2511	}
2512	ptr = fw->data;
2513	hdr = (const struct r92c_fw_hdr *)ptr;
2514	/* Check if there is a valid FW header and skip it. */
2515	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2516	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2517	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2518		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2519		    le16toh(hdr->version), le16toh(hdr->subversion),
2520		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2521		ptr += sizeof(*hdr);
2522		len -= sizeof(*hdr);
2523	}
2524
2525	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2526		if (sc->chip & URTWN_CHIP_88E)
2527			urtwn_r88e_fw_reset(sc);
2528		else
2529			urtwn_fw_reset(sc);
2530		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2531	}
2532
2533	if (!(sc->chip & URTWN_CHIP_88E)) {
2534		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2535		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2536		    R92C_SYS_FUNC_EN_CPUEN);
2537	}
2538	urtwn_write_1(sc, R92C_MCUFWDL,
2539	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2540	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2541	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2542
2543	/* Reset the FWDL checksum. */
2544	urtwn_write_1(sc, R92C_MCUFWDL,
2545	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2546
2547	for (page = 0; len > 0; page++) {
2548		mlen = min(len, R92C_FW_PAGE_SIZE);
2549		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2550		if (error != 0) {
2551			device_printf(sc->sc_dev,
2552			    "could not load firmware page\n");
2553			goto fail;
2554		}
2555		ptr += mlen;
2556		len -= mlen;
2557	}
2558	urtwn_write_1(sc, R92C_MCUFWDL,
2559	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2560	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2561
2562	/* Wait for checksum report. */
2563	for (ntries = 0; ntries < 1000; ntries++) {
2564		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2565			break;
2566		urtwn_ms_delay(sc);
2567	}
2568	if (ntries == 1000) {
2569		device_printf(sc->sc_dev,
2570		    "timeout waiting for checksum report\n");
2571		error = ETIMEDOUT;
2572		goto fail;
2573	}
2574
2575	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2576	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2577	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2578	if (sc->chip & URTWN_CHIP_88E)
2579		urtwn_r88e_fw_reset(sc);
2580	/* Wait for firmware readiness. */
2581	for (ntries = 0; ntries < 1000; ntries++) {
2582		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2583			break;
2584		urtwn_ms_delay(sc);
2585	}
2586	if (ntries == 1000) {
2587		device_printf(sc->sc_dev,
2588		    "timeout waiting for firmware readiness\n");
2589		error = ETIMEDOUT;
2590		goto fail;
2591	}
2592fail:
2593	firmware_put(fw, FIRMWARE_UNLOAD);
2594	return (error);
2595}
2596
2597static __inline int
2598urtwn_dma_init(struct urtwn_softc *sc)
2599{
2600
2601	return sc->sc_dma_init(sc);
2602}
2603
2604static int
2605urtwn_r92c_dma_init(struct urtwn_softc *sc)
2606{
2607	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2608	uint32_t reg;
2609	int error;
2610
2611	/* Initialize LLT table. */
2612	error = urtwn_llt_init(sc);
2613	if (error != 0)
2614		return (error);
2615
2616	/* Get Tx queues to USB endpoints mapping. */
2617	hashq = hasnq = haslq = 0;
2618	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2619	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2620	if (MS(reg, R92C_USB_EP_HQ) != 0)
2621		hashq = 1;
2622	if (MS(reg, R92C_USB_EP_NQ) != 0)
2623		hasnq = 1;
2624	if (MS(reg, R92C_USB_EP_LQ) != 0)
2625		haslq = 1;
2626	nqueues = hashq + hasnq + haslq;
2627	if (nqueues == 0)
2628		return (EIO);
2629	/* Get the number of pages for each queue. */
2630	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2631	/* The remaining pages are assigned to the high priority queue. */
2632	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2633
2634	/* Set number of pages for normal priority queue. */
2635	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2636	urtwn_write_4(sc, R92C_RQPN,
2637	    /* Set number of pages for public queue. */
2638	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2639	    /* Set number of pages for high priority queue. */
2640	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2641	    /* Set number of pages for low priority queue. */
2642	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2643	    /* Load values. */
2644	    R92C_RQPN_LD);
2645
2646	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2647	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2648	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2649	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2650	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2651
2652	/* Set queue to USB pipe mapping. */
2653	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2654	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2655	if (nqueues == 1) {
2656		if (hashq)
2657			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2658		else if (hasnq)
2659			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2660		else
2661			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2662	} else if (nqueues == 2) {
2663		/* All 2-endpoints configs have a high priority queue. */
2664		if (!hashq)
2665			return (EIO);
2666		if (hasnq)
2667			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2668		else
2669			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2670	} else
2671		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2672	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2673
2674	/* Set Tx/Rx transfer page boundary. */
2675	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2676
2677	/* Set Tx/Rx transfer page size. */
2678	urtwn_write_1(sc, R92C_PBP,
2679	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2680	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2681	return (0);
2682}
2683
2684static int
2685urtwn_r88e_dma_init(struct urtwn_softc *sc)
2686{
2687	struct usb_interface *iface;
2688	uint32_t reg;
2689	int nqueues;
2690	int error;
2691
2692	/* Initialize LLT table. */
2693	error = urtwn_llt_init(sc);
2694	if (error != 0)
2695		return (error);
2696
2697	/* Get Tx queues to USB endpoints mapping. */
2698	iface = usbd_get_iface(sc->sc_udev, 0);
2699	nqueues = iface->idesc->bNumEndpoints - 1;
2700	if (nqueues == 0)
2701		return (EIO);
2702
2703	/* Set number of pages for normal priority queue. */
2704	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2705	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2706
2707	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2708	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2709	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2710	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2711	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2712
2713	/* Set queue to USB pipe mapping. */
2714	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2715	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2716	if (nqueues == 1)
2717		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2718	else if (nqueues == 2)
2719		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2720	else
2721		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2722	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2723
2724	/* Set Tx/Rx transfer page boundary. */
2725	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2726
2727	/* Set Tx/Rx transfer page size. */
2728	urtwn_write_1(sc, R92C_PBP,
2729	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2730	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2731
2732	return (0);
2733}
2734
2735static void
2736urtwn_mac_init(struct urtwn_softc *sc)
2737{
2738	int i;
2739
2740	/* Write MAC initialization values. */
2741	if (sc->chip & URTWN_CHIP_88E) {
2742		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2743			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2744			    rtl8188eu_mac[i].val);
2745		}
2746		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2747	} else {
2748		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2749			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2750			    rtl8192cu_mac[i].val);
2751	}
2752}
2753
2754static void
2755urtwn_bb_init(struct urtwn_softc *sc)
2756{
2757	const struct urtwn_bb_prog *prog;
2758	uint32_t reg;
2759	uint8_t crystalcap;
2760	int i;
2761
2762	/* Enable BB and RF. */
2763	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2764	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2765	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2766	    R92C_SYS_FUNC_EN_DIO_RF);
2767
2768	if (!(sc->chip & URTWN_CHIP_88E))
2769		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2770
2771	urtwn_write_1(sc, R92C_RF_CTRL,
2772	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2773	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2774	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2775	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2776
2777	if (!(sc->chip & URTWN_CHIP_88E)) {
2778		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2779		urtwn_write_1(sc, 0x15, 0xe9);
2780		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2781	}
2782
2783	/* Select BB programming based on board type. */
2784	if (sc->chip & URTWN_CHIP_88E)
2785		prog = &rtl8188eu_bb_prog;
2786	else if (!(sc->chip & URTWN_CHIP_92C)) {
2787		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2788			prog = &rtl8188ce_bb_prog;
2789		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2790			prog = &rtl8188ru_bb_prog;
2791		else
2792			prog = &rtl8188cu_bb_prog;
2793	} else {
2794		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2795			prog = &rtl8192ce_bb_prog;
2796		else
2797			prog = &rtl8192cu_bb_prog;
2798	}
2799	/* Write BB initialization values. */
2800	for (i = 0; i < prog->count; i++) {
2801		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2802		urtwn_ms_delay(sc);
2803	}
2804
2805	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2806		/* 8192C 1T only configuration. */
2807		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2808		reg = (reg & ~0x00000003) | 0x2;
2809		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2810
2811		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2812		reg = (reg & ~0x00300033) | 0x00200022;
2813		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2814
2815		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2816		reg = (reg & ~0xff000000) | 0x45 << 24;
2817		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2818
2819		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2820		reg = (reg & ~0x000000ff) | 0x23;
2821		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2822
2823		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2824		reg = (reg & ~0x00000030) | 1 << 4;
2825		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2826
2827		reg = urtwn_bb_read(sc, 0xe74);
2828		reg = (reg & ~0x0c000000) | 2 << 26;
2829		urtwn_bb_write(sc, 0xe74, reg);
2830		reg = urtwn_bb_read(sc, 0xe78);
2831		reg = (reg & ~0x0c000000) | 2 << 26;
2832		urtwn_bb_write(sc, 0xe78, reg);
2833		reg = urtwn_bb_read(sc, 0xe7c);
2834		reg = (reg & ~0x0c000000) | 2 << 26;
2835		urtwn_bb_write(sc, 0xe7c, reg);
2836		reg = urtwn_bb_read(sc, 0xe80);
2837		reg = (reg & ~0x0c000000) | 2 << 26;
2838		urtwn_bb_write(sc, 0xe80, reg);
2839		reg = urtwn_bb_read(sc, 0xe88);
2840		reg = (reg & ~0x0c000000) | 2 << 26;
2841		urtwn_bb_write(sc, 0xe88, reg);
2842	}
2843
2844	/* Write AGC values. */
2845	for (i = 0; i < prog->agccount; i++) {
2846		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2847		    prog->agcvals[i]);
2848		urtwn_ms_delay(sc);
2849	}
2850
2851	if (sc->chip & URTWN_CHIP_88E) {
2852		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2853		urtwn_ms_delay(sc);
2854		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2855		urtwn_ms_delay(sc);
2856
2857		crystalcap = sc->r88e_rom[0xb9];
2858		if (crystalcap == 0xff)
2859			crystalcap = 0x20;
2860		crystalcap &= 0x3f;
2861		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2862		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2863		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2864		    crystalcap | crystalcap << 6));
2865	} else {
2866		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2867		    R92C_HSSI_PARAM2_CCK_HIPWR)
2868			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2869	}
2870}
2871
2872static void
2873urtwn_rf_init(struct urtwn_softc *sc)
2874{
2875	const struct urtwn_rf_prog *prog;
2876	uint32_t reg, type;
2877	int i, j, idx, off;
2878
2879	/* Select RF programming based on board type. */
2880	if (sc->chip & URTWN_CHIP_88E)
2881		prog = rtl8188eu_rf_prog;
2882	else if (!(sc->chip & URTWN_CHIP_92C)) {
2883		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2884			prog = rtl8188ce_rf_prog;
2885		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2886			prog = rtl8188ru_rf_prog;
2887		else
2888			prog = rtl8188cu_rf_prog;
2889	} else
2890		prog = rtl8192ce_rf_prog;
2891
2892	for (i = 0; i < sc->nrxchains; i++) {
2893		/* Save RF_ENV control type. */
2894		idx = i / 2;
2895		off = (i % 2) * 16;
2896		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2897		type = (reg >> off) & 0x10;
2898
2899		/* Set RF_ENV enable. */
2900		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2901		reg |= 0x100000;
2902		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2903		urtwn_ms_delay(sc);
2904		/* Set RF_ENV output high. */
2905		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2906		reg |= 0x10;
2907		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2908		urtwn_ms_delay(sc);
2909		/* Set address and data lengths of RF registers. */
2910		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2911		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2912		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2913		urtwn_ms_delay(sc);
2914		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2915		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2916		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2917		urtwn_ms_delay(sc);
2918
2919		/* Write RF initialization values for this chain. */
2920		for (j = 0; j < prog[i].count; j++) {
2921			if (prog[i].regs[j] >= 0xf9 &&
2922			    prog[i].regs[j] <= 0xfe) {
2923				/*
2924				 * These are fake RF registers offsets that
2925				 * indicate a delay is required.
2926				 */
2927				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
2928				continue;
2929			}
2930			urtwn_rf_write(sc, i, prog[i].regs[j],
2931			    prog[i].vals[j]);
2932			urtwn_ms_delay(sc);
2933		}
2934
2935		/* Restore RF_ENV control type. */
2936		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2937		reg &= ~(0x10 << off) | (type << off);
2938		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2939
2940		/* Cache RF register CHNLBW. */
2941		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2942	}
2943
2944	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2945	    URTWN_CHIP_UMC_A_CUT) {
2946		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2947		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2948	}
2949}
2950
2951static void
2952urtwn_cam_init(struct urtwn_softc *sc)
2953{
2954	/* Invalidate all CAM entries. */
2955	urtwn_write_4(sc, R92C_CAMCMD,
2956	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2957}
2958
2959static void
2960urtwn_pa_bias_init(struct urtwn_softc *sc)
2961{
2962	uint8_t reg;
2963	int i;
2964
2965	for (i = 0; i < sc->nrxchains; i++) {
2966		if (sc->pa_setting & (1 << i))
2967			continue;
2968		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2969		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2970		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2971		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2972	}
2973	if (!(sc->pa_setting & 0x10)) {
2974		reg = urtwn_read_1(sc, 0x16);
2975		reg = (reg & ~0xf0) | 0x90;
2976		urtwn_write_1(sc, 0x16, reg);
2977	}
2978}
2979
2980static void
2981urtwn_rxfilter_init(struct urtwn_softc *sc)
2982{
2983	struct ieee80211com *ic = &sc->sc_ic;
2984	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2985	uint32_t rcr;
2986	uint16_t filter;
2987
2988	URTWN_ASSERT_LOCKED(sc);
2989
2990	/* Accept all multicast frames. */
2991	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2992	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2993
2994	/* Filter for management frames. */
2995	filter = 0x7f3f;
2996	switch (vap->iv_opmode) {
2997	case IEEE80211_M_STA:
2998		filter &= ~(
2999		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
3000		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
3001		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
3002		break;
3003	case IEEE80211_M_HOSTAP:
3004		filter &= ~(
3005		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
3006		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP) |
3007		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_BEACON));
3008		break;
3009	case IEEE80211_M_MONITOR:
3010		break;
3011	default:
3012		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3013		    __func__, vap->iv_opmode);
3014		break;
3015	}
3016	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
3017
3018	/* Reject all control frames. */
3019	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
3020
3021	/* Reject all data frames. */
3022	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
3023
3024	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
3025	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
3026	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
3027
3028	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
3029		/* Accept all frames. */
3030		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
3031		       R92C_RCR_AAP;
3032	}
3033
3034	/* Set Rx filter. */
3035	urtwn_write_4(sc, R92C_RCR, rcr);
3036
3037	if (ic->ic_promisc != 0) {
3038		/* Update Rx filter. */
3039		urtwn_set_promisc(sc);
3040	}
3041}
3042
3043static void
3044urtwn_edca_init(struct urtwn_softc *sc)
3045{
3046	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
3047	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
3048	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
3049	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
3050	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
3051	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
3052	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
3053	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
3054}
3055
3056static void
3057urtwn_write_txpower(struct urtwn_softc *sc, int chain,
3058    uint16_t power[URTWN_RIDX_COUNT])
3059{
3060	uint32_t reg;
3061
3062	/* Write per-CCK rate Tx power. */
3063	if (chain == 0) {
3064		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
3065		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
3066		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
3067		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3068		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
3069		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
3070		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
3071		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3072	} else {
3073		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
3074		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
3075		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
3076		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
3077		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
3078		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3079		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
3080		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3081	}
3082	/* Write per-OFDM rate Tx power. */
3083	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
3084	    SM(R92C_TXAGC_RATE06, power[ 4]) |
3085	    SM(R92C_TXAGC_RATE09, power[ 5]) |
3086	    SM(R92C_TXAGC_RATE12, power[ 6]) |
3087	    SM(R92C_TXAGC_RATE18, power[ 7]));
3088	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
3089	    SM(R92C_TXAGC_RATE24, power[ 8]) |
3090	    SM(R92C_TXAGC_RATE36, power[ 9]) |
3091	    SM(R92C_TXAGC_RATE48, power[10]) |
3092	    SM(R92C_TXAGC_RATE54, power[11]));
3093	/* Write per-MCS Tx power. */
3094	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
3095	    SM(R92C_TXAGC_MCS00,  power[12]) |
3096	    SM(R92C_TXAGC_MCS01,  power[13]) |
3097	    SM(R92C_TXAGC_MCS02,  power[14]) |
3098	    SM(R92C_TXAGC_MCS03,  power[15]));
3099	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
3100	    SM(R92C_TXAGC_MCS04,  power[16]) |
3101	    SM(R92C_TXAGC_MCS05,  power[17]) |
3102	    SM(R92C_TXAGC_MCS06,  power[18]) |
3103	    SM(R92C_TXAGC_MCS07,  power[19]));
3104	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
3105	    SM(R92C_TXAGC_MCS08,  power[20]) |
3106	    SM(R92C_TXAGC_MCS09,  power[21]) |
3107	    SM(R92C_TXAGC_MCS10,  power[22]) |
3108	    SM(R92C_TXAGC_MCS11,  power[23]));
3109	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
3110	    SM(R92C_TXAGC_MCS12,  power[24]) |
3111	    SM(R92C_TXAGC_MCS13,  power[25]) |
3112	    SM(R92C_TXAGC_MCS14,  power[26]) |
3113	    SM(R92C_TXAGC_MCS15,  power[27]));
3114}
3115
3116static void
3117urtwn_get_txpower(struct urtwn_softc *sc, int chain,
3118    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3119    uint16_t power[URTWN_RIDX_COUNT])
3120{
3121	struct ieee80211com *ic = &sc->sc_ic;
3122	struct r92c_rom *rom = &sc->rom;
3123	uint16_t cckpow, ofdmpow, htpow, diff, max;
3124	const struct urtwn_txpwr *base;
3125	int ridx, chan, group;
3126
3127	/* Determine channel group. */
3128	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3129	if (chan <= 3)
3130		group = 0;
3131	else if (chan <= 9)
3132		group = 1;
3133	else
3134		group = 2;
3135
3136	/* Get original Tx power based on board type and RF chain. */
3137	if (!(sc->chip & URTWN_CHIP_92C)) {
3138		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3139			base = &rtl8188ru_txagc[chain];
3140		else
3141			base = &rtl8192cu_txagc[chain];
3142	} else
3143		base = &rtl8192cu_txagc[chain];
3144
3145	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3146	if (sc->regulatory == 0) {
3147		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3148			power[ridx] = base->pwr[0][ridx];
3149	}
3150	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3151		if (sc->regulatory == 3) {
3152			power[ridx] = base->pwr[0][ridx];
3153			/* Apply vendor limits. */
3154			if (extc != NULL)
3155				max = rom->ht40_max_pwr[group];
3156			else
3157				max = rom->ht20_max_pwr[group];
3158			max = (max >> (chain * 4)) & 0xf;
3159			if (power[ridx] > max)
3160				power[ridx] = max;
3161		} else if (sc->regulatory == 1) {
3162			if (extc == NULL)
3163				power[ridx] = base->pwr[group][ridx];
3164		} else if (sc->regulatory != 2)
3165			power[ridx] = base->pwr[0][ridx];
3166	}
3167
3168	/* Compute per-CCK rate Tx power. */
3169	cckpow = rom->cck_tx_pwr[chain][group];
3170	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3171		power[ridx] += cckpow;
3172		if (power[ridx] > R92C_MAX_TX_PWR)
3173			power[ridx] = R92C_MAX_TX_PWR;
3174	}
3175
3176	htpow = rom->ht40_1s_tx_pwr[chain][group];
3177	if (sc->ntxchains > 1) {
3178		/* Apply reduction for 2 spatial streams. */
3179		diff = rom->ht40_2s_tx_pwr_diff[group];
3180		diff = (diff >> (chain * 4)) & 0xf;
3181		htpow = (htpow > diff) ? htpow - diff : 0;
3182	}
3183
3184	/* Compute per-OFDM rate Tx power. */
3185	diff = rom->ofdm_tx_pwr_diff[group];
3186	diff = (diff >> (chain * 4)) & 0xf;
3187	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3188	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3189		power[ridx] += ofdmpow;
3190		if (power[ridx] > R92C_MAX_TX_PWR)
3191			power[ridx] = R92C_MAX_TX_PWR;
3192	}
3193
3194	/* Compute per-MCS Tx power. */
3195	if (extc == NULL) {
3196		diff = rom->ht20_tx_pwr_diff[group];
3197		diff = (diff >> (chain * 4)) & 0xf;
3198		htpow += diff;	/* HT40->HT20 correction. */
3199	}
3200	for (ridx = 12; ridx <= 27; ridx++) {
3201		power[ridx] += htpow;
3202		if (power[ridx] > R92C_MAX_TX_PWR)
3203			power[ridx] = R92C_MAX_TX_PWR;
3204	}
3205#ifdef URTWN_DEBUG
3206	if (urtwn_debug >= 4) {
3207		/* Dump per-rate Tx power values. */
3208		printf("Tx power for chain %d:\n", chain);
3209		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
3210			printf("Rate %d = %u\n", ridx, power[ridx]);
3211	}
3212#endif
3213}
3214
3215static void
3216urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3217    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3218    uint16_t power[URTWN_RIDX_COUNT])
3219{
3220	struct ieee80211com *ic = &sc->sc_ic;
3221	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3222	const struct urtwn_r88e_txpwr *base;
3223	int ridx, chan, group;
3224
3225	/* Determine channel group. */
3226	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3227	if (chan <= 2)
3228		group = 0;
3229	else if (chan <= 5)
3230		group = 1;
3231	else if (chan <= 8)
3232		group = 2;
3233	else if (chan <= 11)
3234		group = 3;
3235	else if (chan <= 13)
3236		group = 4;
3237	else
3238		group = 5;
3239
3240	/* Get original Tx power based on board type and RF chain. */
3241	base = &rtl8188eu_txagc[chain];
3242
3243	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3244	if (sc->regulatory == 0) {
3245		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3246			power[ridx] = base->pwr[0][ridx];
3247	}
3248	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3249		if (sc->regulatory == 3)
3250			power[ridx] = base->pwr[0][ridx];
3251		else if (sc->regulatory == 1) {
3252			if (extc == NULL)
3253				power[ridx] = base->pwr[group][ridx];
3254		} else if (sc->regulatory != 2)
3255			power[ridx] = base->pwr[0][ridx];
3256	}
3257
3258	/* Compute per-CCK rate Tx power. */
3259	cckpow = sc->cck_tx_pwr[group];
3260	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3261		power[ridx] += cckpow;
3262		if (power[ridx] > R92C_MAX_TX_PWR)
3263			power[ridx] = R92C_MAX_TX_PWR;
3264	}
3265
3266	htpow = sc->ht40_tx_pwr[group];
3267
3268	/* Compute per-OFDM rate Tx power. */
3269	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3270	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3271		power[ridx] += ofdmpow;
3272		if (power[ridx] > R92C_MAX_TX_PWR)
3273			power[ridx] = R92C_MAX_TX_PWR;
3274	}
3275
3276	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3277	for (ridx = 12; ridx <= 27; ridx++) {
3278		power[ridx] += bw20pow;
3279		if (power[ridx] > R92C_MAX_TX_PWR)
3280			power[ridx] = R92C_MAX_TX_PWR;
3281	}
3282}
3283
3284static void
3285urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3286    struct ieee80211_channel *extc)
3287{
3288	uint16_t power[URTWN_RIDX_COUNT];
3289	int i;
3290
3291	for (i = 0; i < sc->ntxchains; i++) {
3292		/* Compute per-rate Tx power values. */
3293		if (sc->chip & URTWN_CHIP_88E)
3294			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3295		else
3296			urtwn_get_txpower(sc, i, c, extc, power);
3297		/* Write per-rate Tx power values to hardware. */
3298		urtwn_write_txpower(sc, i, power);
3299	}
3300}
3301
3302static void
3303urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
3304{
3305	uint32_t reg;
3306
3307	reg = urtwn_read_4(sc, R92C_RCR);
3308	if (enable)
3309		reg &= ~R92C_RCR_CBSSID_BCN;
3310	else
3311		reg |= R92C_RCR_CBSSID_BCN;
3312	urtwn_write_4(sc, R92C_RCR, reg);
3313}
3314
3315static void
3316urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
3317{
3318	uint32_t reg;
3319
3320	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
3321	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3322	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
3323
3324	if (!(sc->chip & URTWN_CHIP_88E)) {
3325		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
3326		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3327		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
3328	}
3329}
3330
3331static void
3332urtwn_scan_start(struct ieee80211com *ic)
3333{
3334	struct urtwn_softc *sc = ic->ic_softc;
3335
3336	URTWN_LOCK(sc);
3337	/* Receive beacons / probe responses from any BSSID. */
3338	urtwn_set_rx_bssid_all(sc, 1);
3339	/* Set gain for scanning. */
3340	urtwn_set_gain(sc, 0x20);
3341	URTWN_UNLOCK(sc);
3342}
3343
3344static void
3345urtwn_scan_end(struct ieee80211com *ic)
3346{
3347	struct urtwn_softc *sc = ic->ic_softc;
3348
3349	URTWN_LOCK(sc);
3350	/* Restore limitations. */
3351	if (ic->ic_promisc == 0)
3352		urtwn_set_rx_bssid_all(sc, 0);
3353	/* Set gain under link. */
3354	urtwn_set_gain(sc, 0x32);
3355	URTWN_UNLOCK(sc);
3356}
3357
3358static void
3359urtwn_set_channel(struct ieee80211com *ic)
3360{
3361	struct urtwn_softc *sc = ic->ic_softc;
3362	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3363
3364	URTWN_LOCK(sc);
3365	if (vap->iv_state == IEEE80211_S_SCAN) {
3366		/* Make link LED blink during scan. */
3367		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3368	}
3369	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3370	URTWN_UNLOCK(sc);
3371}
3372
3373static void
3374urtwn_set_promisc(struct urtwn_softc *sc)
3375{
3376	struct ieee80211com *ic = &sc->sc_ic;
3377	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3378	uint32_t rcr, mask1, mask2;
3379
3380	URTWN_ASSERT_LOCKED(sc);
3381
3382	if (vap->iv_opmode == IEEE80211_M_MONITOR)
3383		return;
3384
3385	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
3386	mask2 = R92C_RCR_APM;
3387
3388	if (vap->iv_state == IEEE80211_S_RUN) {
3389		switch (vap->iv_opmode) {
3390		case IEEE80211_M_STA:
3391			mask2 |= R92C_RCR_CBSSID_DATA;
3392			/* FALLTHROUGH */
3393		case IEEE80211_M_HOSTAP:
3394			mask2 |= R92C_RCR_CBSSID_BCN;
3395			break;
3396		default:
3397			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3398			    __func__, vap->iv_opmode);
3399			return;
3400		}
3401	}
3402
3403	rcr = urtwn_read_4(sc, R92C_RCR);
3404	if (ic->ic_promisc == 0)
3405		rcr = (rcr & ~mask1) | mask2;
3406	else
3407		rcr = (rcr & ~mask2) | mask1;
3408	urtwn_write_4(sc, R92C_RCR, rcr);
3409}
3410
3411static void
3412urtwn_update_promisc(struct ieee80211com *ic)
3413{
3414	struct urtwn_softc *sc = ic->ic_softc;
3415
3416	URTWN_LOCK(sc);
3417	if (sc->sc_flags & URTWN_RUNNING)
3418		urtwn_set_promisc(sc);
3419	URTWN_UNLOCK(sc);
3420}
3421
3422static void
3423urtwn_update_mcast(struct ieee80211com *ic)
3424{
3425	/* XXX do nothing?  */
3426}
3427
3428static void
3429urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3430    struct ieee80211_channel *extc)
3431{
3432	struct ieee80211com *ic = &sc->sc_ic;
3433	uint32_t reg;
3434	u_int chan;
3435	int i;
3436
3437	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3438	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3439		device_printf(sc->sc_dev,
3440		    "%s: invalid channel %x\n", __func__, chan);
3441		return;
3442	}
3443
3444	/* Set Tx power for this new channel. */
3445	urtwn_set_txpower(sc, c, extc);
3446
3447	for (i = 0; i < sc->nrxchains; i++) {
3448		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3449		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3450	}
3451#ifndef IEEE80211_NO_HT
3452	if (extc != NULL) {
3453		/* Is secondary channel below or above primary? */
3454		int prichlo = c->ic_freq < extc->ic_freq;
3455
3456		urtwn_write_1(sc, R92C_BWOPMODE,
3457		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3458
3459		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3460		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3461		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3462
3463		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3464		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3465		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3466		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3467
3468		/* Set CCK side band. */
3469		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3470		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3471		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3472
3473		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3474		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3475		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3476
3477		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3478		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3479		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3480
3481		reg = urtwn_bb_read(sc, 0x818);
3482		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3483		urtwn_bb_write(sc, 0x818, reg);
3484
3485		/* Select 40MHz bandwidth. */
3486		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3487		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3488	} else
3489#endif
3490	{
3491		urtwn_write_1(sc, R92C_BWOPMODE,
3492		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3493
3494		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3495		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3496		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3497		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3498
3499		if (!(sc->chip & URTWN_CHIP_88E)) {
3500			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3501			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3502			    R92C_FPGA0_ANAPARAM2_CBW20);
3503		}
3504
3505		/* Select 20MHz bandwidth. */
3506		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3507		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3508		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3509		    R92C_RF_CHNLBW_BW20));
3510	}
3511}
3512
3513static void
3514urtwn_iq_calib(struct urtwn_softc *sc)
3515{
3516	/* TODO */
3517}
3518
3519static void
3520urtwn_lc_calib(struct urtwn_softc *sc)
3521{
3522	uint32_t rf_ac[2];
3523	uint8_t txmode;
3524	int i;
3525
3526	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3527	if ((txmode & 0x70) != 0) {
3528		/* Disable all continuous Tx. */
3529		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3530
3531		/* Set RF mode to standby mode. */
3532		for (i = 0; i < sc->nrxchains; i++) {
3533			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3534			urtwn_rf_write(sc, i, R92C_RF_AC,
3535			    RW(rf_ac[i], R92C_RF_AC_MODE,
3536				R92C_RF_AC_MODE_STANDBY));
3537		}
3538	} else {
3539		/* Block all Tx queues. */
3540		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3541	}
3542	/* Start calibration. */
3543	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3544	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3545
3546	/* Give calibration the time to complete. */
3547	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3548
3549	/* Restore configuration. */
3550	if ((txmode & 0x70) != 0) {
3551		/* Restore Tx mode. */
3552		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3553		/* Restore RF mode. */
3554		for (i = 0; i < sc->nrxchains; i++)
3555			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3556	} else {
3557		/* Unblock all Tx queues. */
3558		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3559	}
3560}
3561
3562static void
3563urtwn_init(struct urtwn_softc *sc)
3564{
3565	struct ieee80211com *ic = &sc->sc_ic;
3566	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3567	uint8_t macaddr[IEEE80211_ADDR_LEN];
3568	uint32_t reg;
3569	int error;
3570
3571	URTWN_ASSERT_LOCKED(sc);
3572
3573	if (sc->sc_flags & URTWN_RUNNING)
3574		urtwn_stop(sc);
3575
3576	/* Init firmware commands ring. */
3577	sc->fwcur = 0;
3578
3579	/* Allocate Tx/Rx buffers. */
3580	error = urtwn_alloc_rx_list(sc);
3581	if (error != 0)
3582		goto fail;
3583
3584	error = urtwn_alloc_tx_list(sc);
3585	if (error != 0)
3586		goto fail;
3587
3588	/* Power on adapter. */
3589	error = urtwn_power_on(sc);
3590	if (error != 0)
3591		goto fail;
3592
3593	/* Initialize DMA. */
3594	error = urtwn_dma_init(sc);
3595	if (error != 0)
3596		goto fail;
3597
3598	/* Set info size in Rx descriptors (in 64-bit words). */
3599	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3600
3601	/* Init interrupts. */
3602	if (sc->chip & URTWN_CHIP_88E) {
3603		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3604		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3605		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3606		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3607		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3608		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3609		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3610		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3611	} else {
3612		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3613		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3614	}
3615
3616	/* Set MAC address. */
3617	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3618	urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
3619
3620	/* Set initial network type. */
3621	urtwn_set_mode(sc, R92C_MSR_INFRA);
3622
3623	/* Initialize Rx filter. */
3624	urtwn_rxfilter_init(sc);
3625
3626	/* Set response rate. */
3627	reg = urtwn_read_4(sc, R92C_RRSR);
3628	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3629	urtwn_write_4(sc, R92C_RRSR, reg);
3630
3631	/* Set short/long retry limits. */
3632	urtwn_write_2(sc, R92C_RL,
3633	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3634
3635	/* Initialize EDCA parameters. */
3636	urtwn_edca_init(sc);
3637
3638	/* Setup rate fallback. */
3639	if (!(sc->chip & URTWN_CHIP_88E)) {
3640		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3641		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3642		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3643		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3644	}
3645
3646	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3647	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3648	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3649	/* Set ACK timeout. */
3650	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3651
3652	/* Setup USB aggregation. */
3653	reg = urtwn_read_4(sc, R92C_TDECTRL);
3654	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3655	urtwn_write_4(sc, R92C_TDECTRL, reg);
3656	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3657	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3658	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3659	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3660	if (sc->chip & URTWN_CHIP_88E)
3661		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3662	else {
3663		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3664		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3665		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3666		    R92C_USB_SPECIAL_OPTION_AGG_EN);
3667		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3668		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3669	}
3670
3671	/* Initialize beacon parameters. */
3672	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3673	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3674	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3675	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3676	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3677
3678	if (!(sc->chip & URTWN_CHIP_88E)) {
3679		/* Setup AMPDU aggregation. */
3680		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3681		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3682		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3683
3684		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3685	}
3686
3687	/* Load 8051 microcode. */
3688	error = urtwn_load_firmware(sc);
3689	if (error != 0)
3690		goto fail;
3691
3692	/* Initialize MAC/BB/RF blocks. */
3693	urtwn_mac_init(sc);
3694	urtwn_bb_init(sc);
3695	urtwn_rf_init(sc);
3696
3697	/* Reinitialize Rx filter (D3845 is not committed yet). */
3698	urtwn_rxfilter_init(sc);
3699
3700	if (sc->chip & URTWN_CHIP_88E) {
3701		urtwn_write_2(sc, R92C_CR,
3702		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3703		    R92C_CR_MACRXEN);
3704	}
3705
3706	/* Turn CCK and OFDM blocks on. */
3707	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3708	reg |= R92C_RFMOD_CCK_EN;
3709	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3710	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3711	reg |= R92C_RFMOD_OFDM_EN;
3712	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3713
3714	/* Clear per-station keys table. */
3715	urtwn_cam_init(sc);
3716
3717	/* Enable hardware sequence numbering. */
3718	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3719
3720	/* Perform LO and IQ calibrations. */
3721	urtwn_iq_calib(sc);
3722	/* Perform LC calibration. */
3723	urtwn_lc_calib(sc);
3724
3725	/* Fix USB interference issue. */
3726	if (!(sc->chip & URTWN_CHIP_88E)) {
3727		urtwn_write_1(sc, 0xfe40, 0xe0);
3728		urtwn_write_1(sc, 0xfe41, 0x8d);
3729		urtwn_write_1(sc, 0xfe42, 0x80);
3730
3731		urtwn_pa_bias_init(sc);
3732	}
3733
3734	/* Initialize GPIO setting. */
3735	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3736	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3737
3738	/* Fix for lower temperature. */
3739	if (!(sc->chip & URTWN_CHIP_88E))
3740		urtwn_write_1(sc, 0x15, 0xe9);
3741
3742	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3743
3744	sc->sc_flags |= URTWN_RUNNING;
3745
3746	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3747fail:
3748	return;
3749}
3750
3751static void
3752urtwn_stop(struct urtwn_softc *sc)
3753{
3754
3755	URTWN_ASSERT_LOCKED(sc);
3756	sc->sc_flags &= ~URTWN_RUNNING;
3757	callout_stop(&sc->sc_watchdog_ch);
3758	urtwn_abort_xfers(sc);
3759
3760	urtwn_drain_mbufq(sc);
3761}
3762
3763static void
3764urtwn_abort_xfers(struct urtwn_softc *sc)
3765{
3766	int i;
3767
3768	URTWN_ASSERT_LOCKED(sc);
3769
3770	/* abort any pending transfers */
3771	for (i = 0; i < URTWN_N_TRANSFER; i++)
3772		usbd_transfer_stop(sc->sc_xfer[i]);
3773}
3774
3775static int
3776urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3777    const struct ieee80211_bpf_params *params)
3778{
3779	struct ieee80211com *ic = ni->ni_ic;
3780	struct urtwn_softc *sc = ic->ic_softc;
3781	struct urtwn_data *bf;
3782	int error;
3783
3784	/* prevent management frames from being sent if we're not ready */
3785	URTWN_LOCK(sc);
3786	if (!(sc->sc_flags & URTWN_RUNNING)) {
3787		error = ENETDOWN;
3788		goto end;
3789	}
3790
3791	bf = urtwn_getbuf(sc);
3792	if (bf == NULL) {
3793		error = ENOBUFS;
3794		goto end;
3795	}
3796
3797	if ((error = urtwn_tx_data(sc, ni, m, bf)) != 0) {
3798		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3799		goto end;
3800	}
3801
3802	sc->sc_txtimer = 5;
3803	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3804
3805end:
3806	if (error != 0)
3807		m_freem(m);
3808
3809	URTWN_UNLOCK(sc);
3810
3811	return (error);
3812}
3813
3814static void
3815urtwn_ms_delay(struct urtwn_softc *sc)
3816{
3817	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3818}
3819
3820static device_method_t urtwn_methods[] = {
3821	/* Device interface */
3822	DEVMETHOD(device_probe,		urtwn_match),
3823	DEVMETHOD(device_attach,	urtwn_attach),
3824	DEVMETHOD(device_detach,	urtwn_detach),
3825
3826	DEVMETHOD_END
3827};
3828
3829static driver_t urtwn_driver = {
3830	"urtwn",
3831	urtwn_methods,
3832	sizeof(struct urtwn_softc)
3833};
3834
3835static devclass_t urtwn_devclass;
3836
3837DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3838MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3839MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3840MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3841MODULE_VERSION(urtwn, 1);
3842