if_urtwn.c revision 290651
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 290651 2015-11-10 12:52:26Z avos $");
22
23/*
24 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25 */
26
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/module.h>
40#include <sys/bus.h>
41#include <sys/endian.h>
42#include <sys/linker.h>
43#include <sys/firmware.h>
44#include <sys/kdb.h>
45
46#include <machine/bus.h>
47#include <machine/resource.h>
48#include <sys/rman.h>
49
50#include <net/bpf.h>
51#include <net/if.h>
52#include <net/if_var.h>
53#include <net/if_arp.h>
54#include <net/ethernet.h>
55#include <net/if_dl.h>
56#include <net/if_media.h>
57#include <net/if_types.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_var.h>
62#include <netinet/if_ether.h>
63#include <netinet/ip.h>
64
65#include <net80211/ieee80211_var.h>
66#include <net80211/ieee80211_input.h>
67#include <net80211/ieee80211_regdomain.h>
68#include <net80211/ieee80211_radiotap.h>
69#include <net80211/ieee80211_ratectl.h>
70
71#include <dev/usb/usb.h>
72#include <dev/usb/usbdi.h>
73#include "usbdevs.h"
74
75#define USB_DEBUG_VAR urtwn_debug
76#include <dev/usb/usb_debug.h>
77
78#include <dev/usb/wlan/if_urtwnreg.h>
79#include <dev/usb/wlan/if_urtwnvar.h>
80
81#ifdef USB_DEBUG
82static int urtwn_debug = 0;
83
84SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
85SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
86    "Debug level");
87#endif
88
89#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
90
91/* various supported device vendors/products */
92static const STRUCT_USB_HOST_ID urtwn_devs[] = {
93#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
94#define	URTWN_RTL8188E_DEV(v,p)	\
95	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
96#define URTWN_RTL8188E  1
97	URTWN_DEV(ABOCOM,	RTL8188CU_1),
98	URTWN_DEV(ABOCOM,	RTL8188CU_2),
99	URTWN_DEV(ABOCOM,	RTL8192CU),
100	URTWN_DEV(ASUS,		RTL8192CU),
101	URTWN_DEV(ASUS,		USBN10NANO),
102	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
103	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
104	URTWN_DEV(AZUREWAVE,	RTL8188CU),
105	URTWN_DEV(BELKIN,	F7D2102),
106	URTWN_DEV(BELKIN,	RTL8188CU),
107	URTWN_DEV(BELKIN,	RTL8192CU),
108	URTWN_DEV(CHICONY,	RTL8188CUS_1),
109	URTWN_DEV(CHICONY,	RTL8188CUS_2),
110	URTWN_DEV(CHICONY,	RTL8188CUS_3),
111	URTWN_DEV(CHICONY,	RTL8188CUS_4),
112	URTWN_DEV(CHICONY,	RTL8188CUS_5),
113	URTWN_DEV(COREGA,	RTL8192CU),
114	URTWN_DEV(DLINK,	RTL8188CU),
115	URTWN_DEV(DLINK,	RTL8192CU_1),
116	URTWN_DEV(DLINK,	RTL8192CU_2),
117	URTWN_DEV(DLINK,	RTL8192CU_3),
118	URTWN_DEV(DLINK,	DWA131B),
119	URTWN_DEV(EDIMAX,	EW7811UN),
120	URTWN_DEV(EDIMAX,	RTL8192CU),
121	URTWN_DEV(FEIXUN,	RTL8188CU),
122	URTWN_DEV(FEIXUN,	RTL8192CU),
123	URTWN_DEV(GUILLEMOT,	HWNUP150),
124	URTWN_DEV(HAWKING,	RTL8192CU),
125	URTWN_DEV(HP3,		RTL8188CU),
126	URTWN_DEV(NETGEAR,	WNA1000M),
127	URTWN_DEV(NETGEAR,	RTL8192CU),
128	URTWN_DEV(NETGEAR4,	RTL8188CU),
129	URTWN_DEV(NOVATECH,	RTL8188CU),
130	URTWN_DEV(PLANEX2,	RTL8188CU_1),
131	URTWN_DEV(PLANEX2,	RTL8188CU_2),
132	URTWN_DEV(PLANEX2,	RTL8188CU_3),
133	URTWN_DEV(PLANEX2,	RTL8188CU_4),
134	URTWN_DEV(PLANEX2,	RTL8188CUS),
135	URTWN_DEV(PLANEX2,	RTL8192CU),
136	URTWN_DEV(REALTEK,	RTL8188CE_0),
137	URTWN_DEV(REALTEK,	RTL8188CE_1),
138	URTWN_DEV(REALTEK,	RTL8188CTV),
139	URTWN_DEV(REALTEK,	RTL8188CU_0),
140	URTWN_DEV(REALTEK,	RTL8188CU_1),
141	URTWN_DEV(REALTEK,	RTL8188CU_2),
142	URTWN_DEV(REALTEK,	RTL8188CU_3),
143	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
144	URTWN_DEV(REALTEK,	RTL8188CUS),
145	URTWN_DEV(REALTEK,	RTL8188RU_1),
146	URTWN_DEV(REALTEK,	RTL8188RU_2),
147	URTWN_DEV(REALTEK,	RTL8188RU_3),
148	URTWN_DEV(REALTEK,	RTL8191CU),
149	URTWN_DEV(REALTEK,	RTL8192CE),
150	URTWN_DEV(REALTEK,	RTL8192CU),
151	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
152	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
153	URTWN_DEV(SITECOMEU,	RTL8192CU),
154	URTWN_DEV(TRENDNET,	RTL8188CU),
155	URTWN_DEV(TRENDNET,	RTL8192CU),
156	URTWN_DEV(ZYXEL,	RTL8192CU),
157	/* URTWN_RTL8188E */
158	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
159	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
160	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
161	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
162	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
163#undef URTWN_RTL8188E_DEV
164#undef URTWN_DEV
165};
166
167static device_probe_t	urtwn_match;
168static device_attach_t	urtwn_attach;
169static device_detach_t	urtwn_detach;
170
171static usb_callback_t   urtwn_bulk_tx_callback;
172static usb_callback_t	urtwn_bulk_rx_callback;
173
174static void		urtwn_drain_mbufq(struct urtwn_softc *sc);
175static usb_error_t	urtwn_do_request(struct urtwn_softc *,
176			    struct usb_device_request *, void *);
177static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
178		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
179                    const uint8_t [IEEE80211_ADDR_LEN],
180                    const uint8_t [IEEE80211_ADDR_LEN]);
181static void		urtwn_vap_delete(struct ieee80211vap *);
182static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
183			    int *);
184static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
185			    int *, int8_t *);
186static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
187			    int);
188static int		urtwn_alloc_list(struct urtwn_softc *,
189			    struct urtwn_data[], int, int);
190static int		urtwn_alloc_rx_list(struct urtwn_softc *);
191static int		urtwn_alloc_tx_list(struct urtwn_softc *);
192static void		urtwn_free_list(struct urtwn_softc *,
193			    struct urtwn_data data[], int);
194static void		urtwn_free_rx_list(struct urtwn_softc *);
195static void		urtwn_free_tx_list(struct urtwn_softc *);
196static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
197static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
198static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
199			    uint8_t *, int);
200static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
201static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
202static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
203static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
204			    uint8_t *, int);
205static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
206static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
207static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
208static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
209			    const void *, int);
210static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
211			    uint8_t, uint32_t);
212static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
213			    uint8_t, uint32_t);
214static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
215static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
216			    uint32_t);
217static uint8_t		urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
218static void		urtwn_efuse_read(struct urtwn_softc *);
219static void		urtwn_efuse_switch_power(struct urtwn_softc *);
220static int		urtwn_read_chipid(struct urtwn_softc *);
221static void		urtwn_read_rom(struct urtwn_softc *);
222static void		urtwn_r88e_read_rom(struct urtwn_softc *);
223static int		urtwn_ra_init(struct urtwn_softc *);
224static void		urtwn_init_beacon(struct urtwn_softc *,
225			    struct urtwn_vap *);
226static int		urtwn_setup_beacon(struct urtwn_softc *,
227			    struct ieee80211_node *);
228static void		urtwn_update_beacon(struct ieee80211vap *, int);
229static int		urtwn_tx_beacon(struct urtwn_softc *sc,
230			    struct urtwn_vap *);
231static void		urtwn_tsf_task_adhoc(void *, int);
232static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
233			    struct ieee80211vap *);
234static void		urtwn_set_led(struct urtwn_softc *, int, int);
235static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
236static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
237			    struct mbuf *, int,
238			    const struct ieee80211_rx_stats *, int, int);
239static int		urtwn_newstate(struct ieee80211vap *,
240			    enum ieee80211_state, int);
241static void		urtwn_watchdog(void *);
242static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
243static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
244static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
245static int		urtwn_tx_data(struct urtwn_softc *,
246			    struct ieee80211_node *, struct mbuf *,
247			    struct urtwn_data *);
248static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
249			    uint8_t, struct urtwn_data *);
250static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
251static void		urtwn_start(struct urtwn_softc *);
252static void		urtwn_parent(struct ieee80211com *);
253static int		urtwn_r92c_power_on(struct urtwn_softc *);
254static int		urtwn_r88e_power_on(struct urtwn_softc *);
255static int		urtwn_llt_init(struct urtwn_softc *);
256static void		urtwn_fw_reset(struct urtwn_softc *);
257static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
258static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
259			    const uint8_t *, int);
260static int		urtwn_load_firmware(struct urtwn_softc *);
261static int		urtwn_r92c_dma_init(struct urtwn_softc *);
262static int		urtwn_r88e_dma_init(struct urtwn_softc *);
263static void		urtwn_mac_init(struct urtwn_softc *);
264static void		urtwn_bb_init(struct urtwn_softc *);
265static void		urtwn_rf_init(struct urtwn_softc *);
266static void		urtwn_cam_init(struct urtwn_softc *);
267static void		urtwn_pa_bias_init(struct urtwn_softc *);
268static void		urtwn_rxfilter_init(struct urtwn_softc *);
269static void		urtwn_edca_init(struct urtwn_softc *);
270static void		urtwn_write_txpower(struct urtwn_softc *, int,
271			    uint16_t[]);
272static void		urtwn_get_txpower(struct urtwn_softc *, int,
273		      	    struct ieee80211_channel *,
274			    struct ieee80211_channel *, uint16_t[]);
275static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
276		      	    struct ieee80211_channel *,
277			    struct ieee80211_channel *, uint16_t[]);
278static void		urtwn_set_txpower(struct urtwn_softc *,
279		    	    struct ieee80211_channel *,
280			    struct ieee80211_channel *);
281static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
282static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
283static void		urtwn_scan_start(struct ieee80211com *);
284static void		urtwn_scan_end(struct ieee80211com *);
285static void		urtwn_set_channel(struct ieee80211com *);
286static void		urtwn_set_promisc(struct urtwn_softc *);
287static void		urtwn_update_promisc(struct ieee80211com *);
288static void		urtwn_update_mcast(struct ieee80211com *);
289static void		urtwn_set_chan(struct urtwn_softc *,
290		    	    struct ieee80211_channel *,
291			    struct ieee80211_channel *);
292static void		urtwn_iq_calib(struct urtwn_softc *);
293static void		urtwn_lc_calib(struct urtwn_softc *);
294static void		urtwn_init(struct urtwn_softc *);
295static void		urtwn_stop(struct urtwn_softc *);
296static void		urtwn_abort_xfers(struct urtwn_softc *);
297static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
298			    const struct ieee80211_bpf_params *);
299static void		urtwn_ms_delay(struct urtwn_softc *);
300
301/* Aliases. */
302#define	urtwn_bb_write	urtwn_write_4
303#define urtwn_bb_read	urtwn_read_4
304
305static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
306	[URTWN_BULK_RX] = {
307		.type = UE_BULK,
308		.endpoint = UE_ADDR_ANY,
309		.direction = UE_DIR_IN,
310		.bufsize = URTWN_RXBUFSZ,
311		.flags = {
312			.pipe_bof = 1,
313			.short_xfer_ok = 1
314		},
315		.callback = urtwn_bulk_rx_callback,
316	},
317	[URTWN_BULK_TX_BE] = {
318		.type = UE_BULK,
319		.endpoint = 0x03,
320		.direction = UE_DIR_OUT,
321		.bufsize = URTWN_TXBUFSZ,
322		.flags = {
323			.ext_buffer = 1,
324			.pipe_bof = 1,
325			.force_short_xfer = 1
326		},
327		.callback = urtwn_bulk_tx_callback,
328		.timeout = URTWN_TX_TIMEOUT,	/* ms */
329	},
330	[URTWN_BULK_TX_BK] = {
331		.type = UE_BULK,
332		.endpoint = 0x03,
333		.direction = UE_DIR_OUT,
334		.bufsize = URTWN_TXBUFSZ,
335		.flags = {
336			.ext_buffer = 1,
337			.pipe_bof = 1,
338			.force_short_xfer = 1,
339		},
340		.callback = urtwn_bulk_tx_callback,
341		.timeout = URTWN_TX_TIMEOUT,	/* ms */
342	},
343	[URTWN_BULK_TX_VI] = {
344		.type = UE_BULK,
345		.endpoint = 0x02,
346		.direction = UE_DIR_OUT,
347		.bufsize = URTWN_TXBUFSZ,
348		.flags = {
349			.ext_buffer = 1,
350			.pipe_bof = 1,
351			.force_short_xfer = 1
352		},
353		.callback = urtwn_bulk_tx_callback,
354		.timeout = URTWN_TX_TIMEOUT,	/* ms */
355	},
356	[URTWN_BULK_TX_VO] = {
357		.type = UE_BULK,
358		.endpoint = 0x02,
359		.direction = UE_DIR_OUT,
360		.bufsize = URTWN_TXBUFSZ,
361		.flags = {
362			.ext_buffer = 1,
363			.pipe_bof = 1,
364			.force_short_xfer = 1
365		},
366		.callback = urtwn_bulk_tx_callback,
367		.timeout = URTWN_TX_TIMEOUT,	/* ms */
368	},
369};
370
371static int
372urtwn_match(device_t self)
373{
374	struct usb_attach_arg *uaa = device_get_ivars(self);
375
376	if (uaa->usb_mode != USB_MODE_HOST)
377		return (ENXIO);
378	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
379		return (ENXIO);
380	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
381		return (ENXIO);
382
383	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
384}
385
386static int
387urtwn_attach(device_t self)
388{
389	struct usb_attach_arg *uaa = device_get_ivars(self);
390	struct urtwn_softc *sc = device_get_softc(self);
391	struct ieee80211com *ic = &sc->sc_ic;
392	uint8_t iface_index, bands;
393	int error;
394
395	device_set_usb_desc(self);
396	sc->sc_udev = uaa->device;
397	sc->sc_dev = self;
398	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
399		sc->chip |= URTWN_CHIP_88E;
400
401	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
402	    MTX_NETWORK_LOCK, MTX_DEF);
403	callout_init(&sc->sc_watchdog_ch, 0);
404	mbufq_init(&sc->sc_snd, ifqmaxlen);
405
406	iface_index = URTWN_IFACE_INDEX;
407	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
408	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
409	if (error) {
410		device_printf(self, "could not allocate USB transfers, "
411		    "err=%s\n", usbd_errstr(error));
412		goto detach;
413	}
414
415	URTWN_LOCK(sc);
416
417	error = urtwn_read_chipid(sc);
418	if (error) {
419		device_printf(sc->sc_dev, "unsupported test chip\n");
420		URTWN_UNLOCK(sc);
421		goto detach;
422	}
423
424	/* Determine number of Tx/Rx chains. */
425	if (sc->chip & URTWN_CHIP_92C) {
426		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
427		sc->nrxchains = 2;
428	} else {
429		sc->ntxchains = 1;
430		sc->nrxchains = 1;
431	}
432
433	if (sc->chip & URTWN_CHIP_88E)
434		urtwn_r88e_read_rom(sc);
435	else
436		urtwn_read_rom(sc);
437
438	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
439	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
440	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
441	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
442	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
443	    "8188CUS", sc->ntxchains, sc->nrxchains);
444
445	URTWN_UNLOCK(sc);
446
447	ic->ic_softc = sc;
448	ic->ic_name = device_get_nameunit(self);
449	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
450	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
451
452	/* set device capabilities */
453	ic->ic_caps =
454		  IEEE80211_C_STA		/* station mode */
455		| IEEE80211_C_MONITOR		/* monitor mode */
456		| IEEE80211_C_IBSS		/* adhoc mode */
457		| IEEE80211_C_HOSTAP		/* hostap mode */
458		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
459		| IEEE80211_C_SHSLOT		/* short slot time supported */
460		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
461		| IEEE80211_C_WPA		/* 802.11i */
462		;
463
464	bands = 0;
465	setbit(&bands, IEEE80211_MODE_11B);
466	setbit(&bands, IEEE80211_MODE_11G);
467	ieee80211_init_channels(ic, NULL, &bands);
468
469	ieee80211_ifattach(ic);
470	ic->ic_raw_xmit = urtwn_raw_xmit;
471	ic->ic_scan_start = urtwn_scan_start;
472	ic->ic_scan_end = urtwn_scan_end;
473	ic->ic_set_channel = urtwn_set_channel;
474	ic->ic_transmit = urtwn_transmit;
475	ic->ic_parent = urtwn_parent;
476	ic->ic_vap_create = urtwn_vap_create;
477	ic->ic_vap_delete = urtwn_vap_delete;
478	ic->ic_update_promisc = urtwn_update_promisc;
479	ic->ic_update_mcast = urtwn_update_mcast;
480
481	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
482	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
483	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
484	    URTWN_RX_RADIOTAP_PRESENT);
485
486	if (bootverbose)
487		ieee80211_announce(ic);
488
489	return (0);
490
491detach:
492	urtwn_detach(self);
493	return (ENXIO);			/* failure */
494}
495
496static int
497urtwn_detach(device_t self)
498{
499	struct urtwn_softc *sc = device_get_softc(self);
500	struct ieee80211com *ic = &sc->sc_ic;
501	unsigned int x;
502
503	/* Prevent further ioctls. */
504	URTWN_LOCK(sc);
505	sc->sc_flags |= URTWN_DETACHED;
506	urtwn_stop(sc);
507	URTWN_UNLOCK(sc);
508
509	callout_drain(&sc->sc_watchdog_ch);
510
511	/* stop all USB transfers */
512	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
513
514	/* Prevent further allocations from RX/TX data lists. */
515	URTWN_LOCK(sc);
516	STAILQ_INIT(&sc->sc_tx_active);
517	STAILQ_INIT(&sc->sc_tx_inactive);
518	STAILQ_INIT(&sc->sc_tx_pending);
519
520	STAILQ_INIT(&sc->sc_rx_active);
521	STAILQ_INIT(&sc->sc_rx_inactive);
522	URTWN_UNLOCK(sc);
523
524	/* drain USB transfers */
525	for (x = 0; x != URTWN_N_TRANSFER; x++)
526		usbd_transfer_drain(sc->sc_xfer[x]);
527
528	/* Free data buffers. */
529	URTWN_LOCK(sc);
530	urtwn_free_tx_list(sc);
531	urtwn_free_rx_list(sc);
532	URTWN_UNLOCK(sc);
533
534	ieee80211_ifdetach(ic);
535	mtx_destroy(&sc->sc_mtx);
536
537	return (0);
538}
539
540static void
541urtwn_drain_mbufq(struct urtwn_softc *sc)
542{
543	struct mbuf *m;
544	struct ieee80211_node *ni;
545	URTWN_ASSERT_LOCKED(sc);
546	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
547		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
548		m->m_pkthdr.rcvif = NULL;
549		ieee80211_free_node(ni);
550		m_freem(m);
551	}
552}
553
554static usb_error_t
555urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
556    void *data)
557{
558	usb_error_t err;
559	int ntries = 10;
560
561	URTWN_ASSERT_LOCKED(sc);
562
563	while (ntries--) {
564		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
565		    req, data, 0, NULL, 250 /* ms */);
566		if (err == 0)
567			break;
568
569		DPRINTFN(1, "Control request failed, %s (retrying)\n",
570		    usbd_errstr(err));
571		usb_pause_mtx(&sc->sc_mtx, hz / 100);
572	}
573	return (err);
574}
575
576static struct ieee80211vap *
577urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
578    enum ieee80211_opmode opmode, int flags,
579    const uint8_t bssid[IEEE80211_ADDR_LEN],
580    const uint8_t mac[IEEE80211_ADDR_LEN])
581{
582	struct urtwn_softc *sc = ic->ic_softc;
583	struct urtwn_vap *uvp;
584	struct ieee80211vap *vap;
585
586	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
587		return (NULL);
588
589	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
590	vap = &uvp->vap;
591	/* enable s/w bmiss handling for sta mode */
592
593	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
594	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
595		/* out of memory */
596		free(uvp, M_80211_VAP);
597		return (NULL);
598	}
599
600	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
601		urtwn_init_beacon(sc, uvp);
602
603	/* override state transition machine */
604	uvp->newstate = vap->iv_newstate;
605	vap->iv_newstate = urtwn_newstate;
606	vap->iv_update_beacon = urtwn_update_beacon;
607	if (opmode == IEEE80211_M_IBSS) {
608		uvp->recv_mgmt = vap->iv_recv_mgmt;
609		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
610		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
611	}
612
613	/* complete setup */
614	ieee80211_vap_attach(vap, ieee80211_media_change,
615	    ieee80211_media_status, mac);
616	ic->ic_opmode = opmode;
617	return (vap);
618}
619
620static void
621urtwn_vap_delete(struct ieee80211vap *vap)
622{
623	struct ieee80211com *ic = vap->iv_ic;
624	struct urtwn_vap *uvp = URTWN_VAP(vap);
625
626	if (uvp->bcn_mbuf != NULL)
627		m_freem(uvp->bcn_mbuf);
628	if (vap->iv_opmode == IEEE80211_M_IBSS)
629		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
630	ieee80211_vap_detach(vap);
631	free(uvp, M_80211_VAP);
632}
633
634static struct mbuf *
635urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
636{
637	struct ieee80211com *ic = &sc->sc_ic;
638	struct ieee80211_frame *wh;
639	struct mbuf *m;
640	struct r92c_rx_stat *stat;
641	uint32_t rxdw0, rxdw3;
642	uint8_t rate;
643	int8_t rssi = 0;
644	int infosz;
645
646	/*
647	 * don't pass packets to the ieee80211 framework if the driver isn't
648	 * RUNNING.
649	 */
650	if (!(sc->sc_flags & URTWN_RUNNING))
651		return (NULL);
652
653	stat = (struct r92c_rx_stat *)buf;
654	rxdw0 = le32toh(stat->rxdw0);
655	rxdw3 = le32toh(stat->rxdw3);
656
657	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
658		/*
659		 * This should not happen since we setup our Rx filter
660		 * to not receive these frames.
661		 */
662		counter_u64_add(ic->ic_ierrors, 1);
663		return (NULL);
664	}
665	if (pktlen < sizeof(struct ieee80211_frame_ack) ||
666	    pktlen > MCLBYTES) {
667		counter_u64_add(ic->ic_ierrors, 1);
668		return (NULL);
669	}
670
671	rate = MS(rxdw3, R92C_RXDW3_RATE);
672	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
673
674	/* Get RSSI from PHY status descriptor if present. */
675	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
676		if (sc->chip & URTWN_CHIP_88E)
677			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
678		else
679			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
680		/* Update our average RSSI. */
681		urtwn_update_avgrssi(sc, rate, rssi);
682	}
683
684	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
685	if (m == NULL) {
686		device_printf(sc->sc_dev, "could not create RX mbuf\n");
687		return (NULL);
688	}
689
690	/* Finalize mbuf. */
691	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
692	memcpy(mtod(m, uint8_t *), wh, pktlen);
693	m->m_pkthdr.len = m->m_len = pktlen;
694
695	if (ieee80211_radiotap_active(ic)) {
696		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
697
698		tap->wr_flags = 0;
699		/* Map HW rate index to 802.11 rate. */
700		if (!(rxdw3 & R92C_RXDW3_HT)) {
701			tap->wr_rate = ridx2rate[rate];
702		} else if (rate >= 12) {	/* MCS0~15. */
703			/* Bit 7 set means HT MCS instead of rate. */
704			tap->wr_rate = 0x80 | (rate - 12);
705		}
706		tap->wr_dbm_antsignal = rssi;
707		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
708		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
709		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
710	}
711
712	*rssi_p = rssi;
713
714	return (m);
715}
716
717static struct mbuf *
718urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
719    int8_t *nf)
720{
721	struct urtwn_softc *sc = data->sc;
722	struct ieee80211com *ic = &sc->sc_ic;
723	struct r92c_rx_stat *stat;
724	struct mbuf *m, *m0 = NULL, *prevm = NULL;
725	uint32_t rxdw0;
726	uint8_t *buf;
727	int len, totlen, pktlen, infosz, npkts;
728
729	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
730
731	if (len < sizeof(*stat)) {
732		counter_u64_add(ic->ic_ierrors, 1);
733		return (NULL);
734	}
735
736	buf = data->buf;
737	/* Get the number of encapsulated frames. */
738	stat = (struct r92c_rx_stat *)buf;
739	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
740	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
741
742	/* Process all of them. */
743	while (npkts-- > 0) {
744		if (len < sizeof(*stat))
745			break;
746		stat = (struct r92c_rx_stat *)buf;
747		rxdw0 = le32toh(stat->rxdw0);
748
749		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
750		if (pktlen == 0)
751			break;
752
753		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
754
755		/* Make sure everything fits in xfer. */
756		totlen = sizeof(*stat) + infosz + pktlen;
757		if (totlen > len)
758			break;
759
760		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
761		if (m0 == NULL)
762			m0 = m;
763		if (prevm == NULL)
764			prevm = m;
765		else {
766			prevm->m_next = m;
767			prevm = m;
768		}
769
770		/* Next chunk is 128-byte aligned. */
771		totlen = (totlen + 127) & ~127;
772		buf += totlen;
773		len -= totlen;
774	}
775
776	return (m0);
777}
778
779static void
780urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
781{
782	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
783	struct ieee80211com *ic = &sc->sc_ic;
784	struct ieee80211_frame_min *wh;
785	struct ieee80211_node *ni;
786	struct mbuf *m = NULL, *next;
787	struct urtwn_data *data;
788	int8_t nf;
789	int rssi = 1;
790
791	URTWN_ASSERT_LOCKED(sc);
792
793	switch (USB_GET_STATE(xfer)) {
794	case USB_ST_TRANSFERRED:
795		data = STAILQ_FIRST(&sc->sc_rx_active);
796		if (data == NULL)
797			goto tr_setup;
798		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
799		m = urtwn_rxeof(xfer, data, &rssi, &nf);
800		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
801		/* FALLTHROUGH */
802	case USB_ST_SETUP:
803tr_setup:
804		data = STAILQ_FIRST(&sc->sc_rx_inactive);
805		if (data == NULL) {
806			KASSERT(m == NULL, ("mbuf isn't NULL"));
807			return;
808		}
809		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
810		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
811		usbd_xfer_set_frame_data(xfer, 0, data->buf,
812		    usbd_xfer_max_len(xfer));
813		usbd_transfer_submit(xfer);
814
815		/*
816		 * To avoid LOR we should unlock our private mutex here to call
817		 * ieee80211_input() because here is at the end of a USB
818		 * callback and safe to unlock.
819		 */
820		URTWN_UNLOCK(sc);
821		while (m != NULL) {
822			next = m->m_next;
823			m->m_next = NULL;
824			wh = mtod(m, struct ieee80211_frame_min *);
825			if (m->m_len >= sizeof(*wh))
826				ni = ieee80211_find_rxnode(ic, wh);
827			else
828				ni = NULL;
829			nf = URTWN_NOISE_FLOOR;
830			if (ni != NULL) {
831				(void)ieee80211_input(ni, m, rssi - nf, nf);
832				ieee80211_free_node(ni);
833			} else {
834				(void)ieee80211_input_all(ic, m, rssi - nf,
835				    nf);
836			}
837			m = next;
838		}
839		URTWN_LOCK(sc);
840		break;
841	default:
842		/* needs it to the inactive queue due to a error. */
843		data = STAILQ_FIRST(&sc->sc_rx_active);
844		if (data != NULL) {
845			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
846			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
847		}
848		if (error != USB_ERR_CANCELLED) {
849			usbd_xfer_set_stall(xfer);
850			counter_u64_add(ic->ic_ierrors, 1);
851			goto tr_setup;
852		}
853		break;
854	}
855}
856
857static void
858urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
859{
860
861	URTWN_ASSERT_LOCKED(sc);
862
863	if (data->ni != NULL)	/* not a beacon frame */
864		ieee80211_tx_complete(data->ni, data->m, status);
865
866	data->ni = NULL;
867	data->m = NULL;
868
869	sc->sc_txtimer = 0;
870
871	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
872}
873
874static int
875urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
876    int ndata, int maxsz)
877{
878	int i, error;
879
880	for (i = 0; i < ndata; i++) {
881		struct urtwn_data *dp = &data[i];
882		dp->sc = sc;
883		dp->m = NULL;
884		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
885		if (dp->buf == NULL) {
886			device_printf(sc->sc_dev,
887			    "could not allocate buffer\n");
888			error = ENOMEM;
889			goto fail;
890		}
891		dp->ni = NULL;
892	}
893
894	return (0);
895fail:
896	urtwn_free_list(sc, data, ndata);
897	return (error);
898}
899
900static int
901urtwn_alloc_rx_list(struct urtwn_softc *sc)
902{
903        int error, i;
904
905	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
906	    URTWN_RXBUFSZ);
907	if (error != 0)
908		return (error);
909
910	STAILQ_INIT(&sc->sc_rx_active);
911	STAILQ_INIT(&sc->sc_rx_inactive);
912
913	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
914		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
915
916	return (0);
917}
918
919static int
920urtwn_alloc_tx_list(struct urtwn_softc *sc)
921{
922	int error, i;
923
924	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
925	    URTWN_TXBUFSZ);
926	if (error != 0)
927		return (error);
928
929	STAILQ_INIT(&sc->sc_tx_active);
930	STAILQ_INIT(&sc->sc_tx_inactive);
931	STAILQ_INIT(&sc->sc_tx_pending);
932
933	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
934		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
935
936	return (0);
937}
938
939static void
940urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
941{
942	int i;
943
944	for (i = 0; i < ndata; i++) {
945		struct urtwn_data *dp = &data[i];
946
947		if (dp->buf != NULL) {
948			free(dp->buf, M_USBDEV);
949			dp->buf = NULL;
950		}
951		if (dp->ni != NULL) {
952			ieee80211_free_node(dp->ni);
953			dp->ni = NULL;
954		}
955	}
956}
957
958static void
959urtwn_free_rx_list(struct urtwn_softc *sc)
960{
961	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
962}
963
964static void
965urtwn_free_tx_list(struct urtwn_softc *sc)
966{
967	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
968}
969
970static void
971urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
972{
973	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
974	struct urtwn_data *data;
975
976	URTWN_ASSERT_LOCKED(sc);
977
978	switch (USB_GET_STATE(xfer)){
979	case USB_ST_TRANSFERRED:
980		data = STAILQ_FIRST(&sc->sc_tx_active);
981		if (data == NULL)
982			goto tr_setup;
983		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
984		urtwn_txeof(sc, data, 0);
985		/* FALLTHROUGH */
986	case USB_ST_SETUP:
987tr_setup:
988		data = STAILQ_FIRST(&sc->sc_tx_pending);
989		if (data == NULL) {
990			DPRINTF("%s: empty pending queue\n", __func__);
991			goto finish;
992		}
993		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
994		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
995		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
996		usbd_transfer_submit(xfer);
997		break;
998	default:
999		data = STAILQ_FIRST(&sc->sc_tx_active);
1000		if (data == NULL)
1001			goto tr_setup;
1002		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1003		urtwn_txeof(sc, data, 1);
1004		if (error != USB_ERR_CANCELLED) {
1005			usbd_xfer_set_stall(xfer);
1006			goto tr_setup;
1007		}
1008		break;
1009	}
1010finish:
1011	/* Kick-start more transmit */
1012	urtwn_start(sc);
1013}
1014
1015static struct urtwn_data *
1016_urtwn_getbuf(struct urtwn_softc *sc)
1017{
1018	struct urtwn_data *bf;
1019
1020	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1021	if (bf != NULL)
1022		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1023	else
1024		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
1025	return (bf);
1026}
1027
1028static struct urtwn_data *
1029urtwn_getbuf(struct urtwn_softc *sc)
1030{
1031        struct urtwn_data *bf;
1032
1033	URTWN_ASSERT_LOCKED(sc);
1034
1035	bf = _urtwn_getbuf(sc);
1036	if (bf == NULL)
1037		DPRINTF("%s: stop queue\n", __func__);
1038	return (bf);
1039}
1040
1041static int
1042urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1043    int len)
1044{
1045	usb_device_request_t req;
1046
1047	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1048	req.bRequest = R92C_REQ_REGS;
1049	USETW(req.wValue, addr);
1050	USETW(req.wIndex, 0);
1051	USETW(req.wLength, len);
1052	return (urtwn_do_request(sc, &req, buf));
1053}
1054
1055static void
1056urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1057{
1058	urtwn_write_region_1(sc, addr, &val, 1);
1059}
1060
1061
1062static void
1063urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1064{
1065	val = htole16(val);
1066	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1067}
1068
1069static void
1070urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1071{
1072	val = htole32(val);
1073	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1074}
1075
1076static int
1077urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1078    int len)
1079{
1080	usb_device_request_t req;
1081
1082	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1083	req.bRequest = R92C_REQ_REGS;
1084	USETW(req.wValue, addr);
1085	USETW(req.wIndex, 0);
1086	USETW(req.wLength, len);
1087	return (urtwn_do_request(sc, &req, buf));
1088}
1089
1090static uint8_t
1091urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1092{
1093	uint8_t val;
1094
1095	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1096		return (0xff);
1097	return (val);
1098}
1099
1100static uint16_t
1101urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1102{
1103	uint16_t val;
1104
1105	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1106		return (0xffff);
1107	return (le16toh(val));
1108}
1109
1110static uint32_t
1111urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1112{
1113	uint32_t val;
1114
1115	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1116		return (0xffffffff);
1117	return (le32toh(val));
1118}
1119
1120static int
1121urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1122{
1123	struct r92c_fw_cmd cmd;
1124	int ntries;
1125
1126	/* Wait for current FW box to be empty. */
1127	for (ntries = 0; ntries < 100; ntries++) {
1128		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1129			break;
1130		urtwn_ms_delay(sc);
1131	}
1132	if (ntries == 100) {
1133		device_printf(sc->sc_dev,
1134		    "could not send firmware command\n");
1135		return (ETIMEDOUT);
1136	}
1137	memset(&cmd, 0, sizeof(cmd));
1138	cmd.id = id;
1139	if (len > 3)
1140		cmd.id |= R92C_CMD_FLAG_EXT;
1141	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1142	memcpy(cmd.msg, buf, len);
1143
1144	/* Write the first word last since that will trigger the FW. */
1145	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1146	    (uint8_t *)&cmd + 4, 2);
1147	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1148	    (uint8_t *)&cmd + 0, 4);
1149
1150	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1151	return (0);
1152}
1153
1154static __inline void
1155urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1156{
1157
1158	sc->sc_rf_write(sc, chain, addr, val);
1159}
1160
1161static void
1162urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1163    uint32_t val)
1164{
1165	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1166	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1167	    SM(R92C_LSSI_PARAM_DATA, val));
1168}
1169
1170static void
1171urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1172uint32_t val)
1173{
1174	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1175	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1176	    SM(R92C_LSSI_PARAM_DATA, val));
1177}
1178
1179static uint32_t
1180urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1181{
1182	uint32_t reg[R92C_MAX_CHAINS], val;
1183
1184	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1185	if (chain != 0)
1186		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1187
1188	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1189	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1190	urtwn_ms_delay(sc);
1191
1192	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1193	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1194	    R92C_HSSI_PARAM2_READ_EDGE);
1195	urtwn_ms_delay(sc);
1196
1197	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1198	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1199	urtwn_ms_delay(sc);
1200
1201	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1202		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1203	else
1204		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1205	return (MS(val, R92C_LSSI_READBACK_DATA));
1206}
1207
1208static int
1209urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1210{
1211	int ntries;
1212
1213	urtwn_write_4(sc, R92C_LLT_INIT,
1214	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1215	    SM(R92C_LLT_INIT_ADDR, addr) |
1216	    SM(R92C_LLT_INIT_DATA, data));
1217	/* Wait for write operation to complete. */
1218	for (ntries = 0; ntries < 20; ntries++) {
1219		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1220		    R92C_LLT_INIT_OP_NO_ACTIVE)
1221			return (0);
1222		urtwn_ms_delay(sc);
1223	}
1224	return (ETIMEDOUT);
1225}
1226
1227static uint8_t
1228urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1229{
1230	uint32_t reg;
1231	int ntries;
1232
1233	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1234	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1235	reg &= ~R92C_EFUSE_CTRL_VALID;
1236	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1237	/* Wait for read operation to complete. */
1238	for (ntries = 0; ntries < 100; ntries++) {
1239		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1240		if (reg & R92C_EFUSE_CTRL_VALID)
1241			return (MS(reg, R92C_EFUSE_CTRL_DATA));
1242		urtwn_ms_delay(sc);
1243	}
1244	device_printf(sc->sc_dev,
1245	    "could not read efuse byte at address 0x%x\n", addr);
1246	return (0xff);
1247}
1248
1249static void
1250urtwn_efuse_read(struct urtwn_softc *sc)
1251{
1252	uint8_t *rom = (uint8_t *)&sc->rom;
1253	uint16_t addr = 0;
1254	uint32_t reg;
1255	uint8_t off, msk;
1256	int i;
1257
1258	urtwn_efuse_switch_power(sc);
1259
1260	memset(&sc->rom, 0xff, sizeof(sc->rom));
1261	while (addr < 512) {
1262		reg = urtwn_efuse_read_1(sc, addr);
1263		if (reg == 0xff)
1264			break;
1265		addr++;
1266		off = reg >> 4;
1267		msk = reg & 0xf;
1268		for (i = 0; i < 4; i++) {
1269			if (msk & (1 << i))
1270				continue;
1271			rom[off * 8 + i * 2 + 0] =
1272			    urtwn_efuse_read_1(sc, addr);
1273			addr++;
1274			rom[off * 8 + i * 2 + 1] =
1275			    urtwn_efuse_read_1(sc, addr);
1276			addr++;
1277		}
1278	}
1279#ifdef URTWN_DEBUG
1280	if (urtwn_debug >= 2) {
1281		/* Dump ROM content. */
1282		printf("\n");
1283		for (i = 0; i < sizeof(sc->rom); i++)
1284			printf("%02x:", rom[i]);
1285		printf("\n");
1286	}
1287#endif
1288	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1289}
1290
1291static void
1292urtwn_efuse_switch_power(struct urtwn_softc *sc)
1293{
1294	uint32_t reg;
1295
1296	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1297
1298	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1299	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1300		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1301		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1302	}
1303	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1304	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1305		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1306		    reg | R92C_SYS_FUNC_EN_ELDR);
1307	}
1308	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1309	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1310	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1311		urtwn_write_2(sc, R92C_SYS_CLKR,
1312		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1313	}
1314}
1315
1316static int
1317urtwn_read_chipid(struct urtwn_softc *sc)
1318{
1319	uint32_t reg;
1320
1321	if (sc->chip & URTWN_CHIP_88E)
1322		return (0);
1323
1324	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1325	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1326		return (EIO);
1327
1328	if (reg & R92C_SYS_CFG_TYPE_92C) {
1329		sc->chip |= URTWN_CHIP_92C;
1330		/* Check if it is a castrated 8192C. */
1331		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1332		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1333		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1334			sc->chip |= URTWN_CHIP_92C_1T2R;
1335	}
1336	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1337		sc->chip |= URTWN_CHIP_UMC;
1338		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1339			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1340	}
1341	return (0);
1342}
1343
1344static void
1345urtwn_read_rom(struct urtwn_softc *sc)
1346{
1347	struct r92c_rom *rom = &sc->rom;
1348
1349	/* Read full ROM image. */
1350	urtwn_efuse_read(sc);
1351
1352	/* XXX Weird but this is what the vendor driver does. */
1353	sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1354	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1355
1356	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1357
1358	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1359	DPRINTF("regulatory type=%d\n", sc->regulatory);
1360	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1361
1362	sc->sc_rf_write = urtwn_r92c_rf_write;
1363	sc->sc_power_on = urtwn_r92c_power_on;
1364	sc->sc_dma_init = urtwn_r92c_dma_init;
1365}
1366
1367static void
1368urtwn_r88e_read_rom(struct urtwn_softc *sc)
1369{
1370	uint8_t *rom = sc->r88e_rom;
1371	uint16_t addr = 0;
1372	uint32_t reg;
1373	uint8_t off, msk, tmp;
1374	int i;
1375
1376	off = 0;
1377	urtwn_efuse_switch_power(sc);
1378
1379	/* Read full ROM image. */
1380	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1381	while (addr < 512) {
1382		reg = urtwn_efuse_read_1(sc, addr);
1383		if (reg == 0xff)
1384			break;
1385		addr++;
1386		if ((reg & 0x1f) == 0x0f) {
1387			tmp = (reg & 0xe0) >> 5;
1388			reg = urtwn_efuse_read_1(sc, addr);
1389			if ((reg & 0x0f) != 0x0f)
1390				off = ((reg & 0xf0) >> 1) | tmp;
1391			addr++;
1392		} else
1393			off = reg >> 4;
1394		msk = reg & 0xf;
1395		for (i = 0; i < 4; i++) {
1396			if (msk & (1 << i))
1397				continue;
1398			rom[off * 8 + i * 2 + 0] =
1399			    urtwn_efuse_read_1(sc, addr);
1400			addr++;
1401			rom[off * 8 + i * 2 + 1] =
1402			    urtwn_efuse_read_1(sc, addr);
1403			addr++;
1404		}
1405	}
1406
1407	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1408
1409	addr = 0x10;
1410	for (i = 0; i < 6; i++)
1411		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1412	for (i = 0; i < 5; i++)
1413		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1414	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1415	if (sc->bw20_tx_pwr_diff & 0x08)
1416		sc->bw20_tx_pwr_diff |= 0xf0;
1417	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1418	if (sc->ofdm_tx_pwr_diff & 0x08)
1419		sc->ofdm_tx_pwr_diff |= 0xf0;
1420	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1421	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &sc->r88e_rom[0xd7]);
1422
1423	sc->sc_rf_write = urtwn_r88e_rf_write;
1424	sc->sc_power_on = urtwn_r88e_power_on;
1425	sc->sc_dma_init = urtwn_r88e_dma_init;
1426}
1427
1428/*
1429 * Initialize rate adaptation in firmware.
1430 */
1431static int
1432urtwn_ra_init(struct urtwn_softc *sc)
1433{
1434	struct ieee80211com *ic = &sc->sc_ic;
1435	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1436	struct ieee80211_node *ni;
1437	struct ieee80211_rateset *rs;
1438	struct r92c_fw_cmd_macid_cfg cmd;
1439	uint32_t rates, basicrates;
1440	uint8_t mode;
1441	int maxrate, maxbasicrate, error, i, j;
1442
1443	ni = ieee80211_ref_node(vap->iv_bss);
1444	rs = &ni->ni_rates;
1445
1446	/* Get normal and basic rates mask. */
1447	rates = basicrates = 0;
1448	maxrate = maxbasicrate = 0;
1449	for (i = 0; i < rs->rs_nrates; i++) {
1450		/* Convert 802.11 rate to HW rate index. */
1451		for (j = 0; j < nitems(ridx2rate); j++)
1452			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1453			    ridx2rate[j])
1454				break;
1455		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1456			continue;
1457		rates |= 1 << j;
1458		if (j > maxrate)
1459			maxrate = j;
1460		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1461			basicrates |= 1 << j;
1462			if (j > maxbasicrate)
1463				maxbasicrate = j;
1464		}
1465	}
1466	if (ic->ic_curmode == IEEE80211_MODE_11B)
1467		mode = R92C_RAID_11B;
1468	else
1469		mode = R92C_RAID_11BG;
1470	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1471	    mode, rates, basicrates);
1472
1473	/* Set rates mask for group addressed frames. */
1474	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1475	cmd.mask = htole32(mode << 28 | basicrates);
1476	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1477	if (error != 0) {
1478		ieee80211_free_node(ni);
1479		device_printf(sc->sc_dev,
1480		    "could not add broadcast station\n");
1481		return (error);
1482	}
1483	/* Set initial MRR rate. */
1484	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1485	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1486	    maxbasicrate);
1487
1488	/* Set rates mask for unicast frames. */
1489	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1490	cmd.mask = htole32(mode << 28 | rates);
1491	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1492	if (error != 0) {
1493		ieee80211_free_node(ni);
1494		device_printf(sc->sc_dev, "could not add BSS station\n");
1495		return (error);
1496	}
1497	/* Set initial MRR rate. */
1498	DPRINTF("maxrate=%d\n", maxrate);
1499	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1500	    maxrate);
1501
1502	/* Indicate highest supported rate. */
1503	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1504	ieee80211_free_node(ni);
1505
1506	return (0);
1507}
1508
1509static void
1510urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1511{
1512	struct r92c_tx_desc *txd = &uvp->bcn_desc;
1513
1514	txd->txdw0 = htole32(
1515	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
1516	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1517	txd->txdw1 = htole32(
1518	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
1519	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1520
1521	if (sc->chip & URTWN_CHIP_88E)
1522		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
1523	else
1524		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
1525
1526	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
1527	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
1528	txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
1529}
1530
1531static int
1532urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
1533{
1534 	struct ieee80211vap *vap = ni->ni_vap;
1535	struct urtwn_vap *uvp = URTWN_VAP(vap);
1536	struct mbuf *m;
1537	int error;
1538
1539	URTWN_ASSERT_LOCKED(sc);
1540
1541	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1542		return (EINVAL);
1543
1544	m = ieee80211_beacon_alloc(ni);
1545	if (m == NULL) {
1546		device_printf(sc->sc_dev,
1547		    "%s: could not allocate beacon frame\n", __func__);
1548		return (ENOMEM);
1549	}
1550
1551	if (uvp->bcn_mbuf != NULL)
1552		m_freem(uvp->bcn_mbuf);
1553
1554	uvp->bcn_mbuf = m;
1555
1556	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1557		return (error);
1558
1559	/* XXX bcnq stuck workaround */
1560	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1561		return (error);
1562
1563	return (0);
1564}
1565
1566static void
1567urtwn_update_beacon(struct ieee80211vap *vap, int item)
1568{
1569	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1570	struct urtwn_vap *uvp = URTWN_VAP(vap);
1571	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
1572	struct ieee80211_node *ni = vap->iv_bss;
1573	int mcast = 0;
1574
1575	URTWN_LOCK(sc);
1576	if (uvp->bcn_mbuf == NULL) {
1577		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
1578		if (uvp->bcn_mbuf == NULL) {
1579			device_printf(sc->sc_dev,
1580			    "%s: could not allocate beacon frame\n", __func__);
1581			URTWN_UNLOCK(sc);
1582			return;
1583		}
1584	}
1585	URTWN_UNLOCK(sc);
1586
1587	if (item == IEEE80211_BEACON_TIM)
1588		mcast = 1;	/* XXX */
1589
1590	setbit(bo->bo_flags, item);
1591	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
1592
1593	URTWN_LOCK(sc);
1594	urtwn_tx_beacon(sc, uvp);
1595	URTWN_UNLOCK(sc);
1596}
1597
1598/*
1599 * Push a beacon frame into the chip. Beacon will
1600 * be repeated by the chip every R92C_BCN_INTERVAL.
1601 */
1602static int
1603urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1604{
1605	struct r92c_tx_desc *desc = &uvp->bcn_desc;
1606	struct urtwn_data *bf;
1607
1608	URTWN_ASSERT_LOCKED(sc);
1609
1610	bf = urtwn_getbuf(sc);
1611	if (bf == NULL)
1612		return (ENOMEM);
1613
1614	memcpy(bf->buf, desc, sizeof(*desc));
1615	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
1616
1617	sc->sc_txtimer = 5;
1618	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1619
1620	return (0);
1621}
1622
1623static void
1624urtwn_tsf_task_adhoc(void *arg, int pending)
1625{
1626	struct ieee80211vap *vap = arg;
1627	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1628	struct ieee80211_node *ni;
1629	uint32_t reg;
1630
1631	URTWN_LOCK(sc);
1632	ni = ieee80211_ref_node(vap->iv_bss);
1633	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
1634
1635	/* Accept beacons with the same BSSID. */
1636	urtwn_set_rx_bssid_all(sc, 0);
1637
1638	/* Enable synchronization. */
1639	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
1640	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1641
1642	/* Synchronize. */
1643	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
1644
1645	/* Disable synchronization. */
1646	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
1647	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1648
1649	/* Remove beacon filter. */
1650	urtwn_set_rx_bssid_all(sc, 1);
1651
1652	/* Enable beaconing. */
1653	urtwn_write_1(sc, R92C_MBID_NUM,
1654	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1655	reg |= R92C_BCN_CTRL_EN_BCN;
1656
1657	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1658	ieee80211_free_node(ni);
1659	URTWN_UNLOCK(sc);
1660}
1661
1662static void
1663urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
1664{
1665	struct ieee80211com *ic = &sc->sc_ic;
1666	struct urtwn_vap *uvp = URTWN_VAP(vap);
1667
1668	/* Reset TSF. */
1669	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1670
1671	switch (vap->iv_opmode) {
1672	case IEEE80211_M_STA:
1673		/* Enable TSF synchronization. */
1674		urtwn_write_1(sc, R92C_BCN_CTRL,
1675		    urtwn_read_1(sc, R92C_BCN_CTRL) &
1676		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1677		break;
1678	case IEEE80211_M_IBSS:
1679		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
1680		break;
1681	case IEEE80211_M_HOSTAP:
1682		/* Enable beaconing. */
1683		urtwn_write_1(sc, R92C_MBID_NUM,
1684		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1685		urtwn_write_1(sc, R92C_BCN_CTRL,
1686		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1687		break;
1688	default:
1689		device_printf(sc->sc_dev, "undefined opmode %d\n",
1690		    vap->iv_opmode);
1691		return;
1692	}
1693}
1694
1695static void
1696urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1697{
1698	uint8_t reg;
1699
1700	if (led == URTWN_LED_LINK) {
1701		if (sc->chip & URTWN_CHIP_88E) {
1702			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1703			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1704			if (!on) {
1705				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1706				urtwn_write_1(sc, R92C_LEDCFG2,
1707				    reg | R92C_LEDCFG0_DIS);
1708				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1709				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1710				    0xfe);
1711			}
1712		} else {
1713			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1714			if (!on)
1715				reg |= R92C_LEDCFG0_DIS;
1716			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1717		}
1718		sc->ledlink = on;       /* Save LED state. */
1719	}
1720}
1721
1722static void
1723urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
1724{
1725	uint8_t reg;
1726
1727	reg = urtwn_read_1(sc, R92C_MSR);
1728	reg = (reg & ~R92C_MSR_MASK) | mode;
1729	urtwn_write_1(sc, R92C_MSR, reg);
1730}
1731
1732static void
1733urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
1734    const struct ieee80211_rx_stats *rxs,
1735    int rssi, int nf)
1736{
1737	struct ieee80211vap *vap = ni->ni_vap;
1738	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1739	struct urtwn_vap *uvp = URTWN_VAP(vap);
1740	uint64_t ni_tstamp, curr_tstamp;
1741
1742	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1743
1744	if (vap->iv_state == IEEE80211_S_RUN &&
1745	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
1746	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
1747		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
1748#ifdef D3831
1749		URTWN_LOCK(sc);
1750		urtwn_get_tsf(sc, &curr_tstamp);
1751		URTWN_UNLOCK(sc);
1752		curr_tstamp = le64toh(curr_tstamp);
1753
1754		if (ni_tstamp >= curr_tstamp)
1755			(void) ieee80211_ibss_merge(ni);
1756#else
1757		(void) sc;
1758		(void) curr_tstamp;
1759#endif
1760	}
1761}
1762
1763static int
1764urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1765{
1766	struct urtwn_vap *uvp = URTWN_VAP(vap);
1767	struct ieee80211com *ic = vap->iv_ic;
1768	struct urtwn_softc *sc = ic->ic_softc;
1769	struct ieee80211_node *ni;
1770	enum ieee80211_state ostate;
1771	uint32_t reg;
1772	uint8_t mode;
1773	int error = 0;
1774
1775	ostate = vap->iv_state;
1776	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1777	    ieee80211_state_name[nstate]);
1778
1779	IEEE80211_UNLOCK(ic);
1780	URTWN_LOCK(sc);
1781	callout_stop(&sc->sc_watchdog_ch);
1782
1783	if (ostate == IEEE80211_S_RUN) {
1784		/* Turn link LED off. */
1785		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1786
1787		/* Set media status to 'No Link'. */
1788		urtwn_set_mode(sc, R92C_MSR_NOLINK);
1789
1790		/* Stop Rx of data frames. */
1791		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1792
1793		/* Disable TSF synchronization. */
1794		urtwn_write_1(sc, R92C_BCN_CTRL,
1795		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
1796		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1797
1798		/* Disable beaconing. */
1799		urtwn_write_1(sc, R92C_MBID_NUM,
1800		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
1801
1802		/* Reset TSF. */
1803		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1804
1805		/* Reset EDCA parameters. */
1806		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1807		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1808		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1809		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1810	}
1811
1812	switch (nstate) {
1813	case IEEE80211_S_INIT:
1814		/* Turn link LED off. */
1815		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1816		break;
1817	case IEEE80211_S_SCAN:
1818		/* Pause AC Tx queues. */
1819		urtwn_write_1(sc, R92C_TXPAUSE,
1820		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1821		break;
1822	case IEEE80211_S_AUTH:
1823		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1824		break;
1825	case IEEE80211_S_RUN:
1826		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1827			/* Turn link LED on. */
1828			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1829			break;
1830		}
1831
1832		ni = ieee80211_ref_node(vap->iv_bss);
1833
1834		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1835		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1836			device_printf(sc->sc_dev,
1837			    "%s: could not move to RUN state\n", __func__);
1838			error = EINVAL;
1839			goto end_run;
1840		}
1841
1842		switch (vap->iv_opmode) {
1843		case IEEE80211_M_STA:
1844			mode = R92C_MSR_INFRA;
1845			break;
1846		case IEEE80211_M_IBSS:
1847			mode = R92C_MSR_ADHOC;
1848			break;
1849		case IEEE80211_M_HOSTAP:
1850			mode = R92C_MSR_AP;
1851			break;
1852		default:
1853			device_printf(sc->sc_dev, "undefined opmode %d\n",
1854			    vap->iv_opmode);
1855			error = EINVAL;
1856			goto end_run;
1857		}
1858
1859		/* Set media status to 'Associated'. */
1860		urtwn_set_mode(sc, mode);
1861
1862		/* Set BSSID. */
1863		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1864		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1865
1866		if (ic->ic_curmode == IEEE80211_MODE_11B)
1867			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1868		else	/* 802.11b/g */
1869			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1870
1871		/* Enable Rx of data frames. */
1872		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1873
1874		/* Flush all AC queues. */
1875		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1876
1877		/* Set beacon interval. */
1878		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1879
1880		/* Allow Rx from our BSSID only. */
1881		if (ic->ic_promisc == 0) {
1882			reg = urtwn_read_4(sc, R92C_RCR);
1883
1884			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
1885				reg |= R92C_RCR_CBSSID_DATA;
1886			if (vap->iv_opmode != IEEE80211_M_IBSS)
1887				reg |= R92C_RCR_CBSSID_BCN;
1888
1889			urtwn_write_4(sc, R92C_RCR, reg);
1890		}
1891
1892		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1893		    vap->iv_opmode == IEEE80211_M_IBSS) {
1894			error = urtwn_setup_beacon(sc, ni);
1895			if (error != 0) {
1896				device_printf(sc->sc_dev,
1897				    "unable to push beacon into the chip, "
1898				    "error %d\n", error);
1899				goto end_run;
1900			}
1901		}
1902
1903		/* Enable TSF synchronization. */
1904		urtwn_tsf_sync_enable(sc, vap);
1905
1906		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1907		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1908		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1909		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1910		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1911		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1912
1913		/* Intialize rate adaptation. */
1914		if (sc->chip & URTWN_CHIP_88E)
1915			ni->ni_txrate =
1916			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1917		else
1918			urtwn_ra_init(sc);
1919		/* Turn link LED on. */
1920		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1921
1922		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1923		/* Reset temperature calibration state machine. */
1924		sc->thcal_state = 0;
1925		sc->thcal_lctemp = 0;
1926
1927end_run:
1928		ieee80211_free_node(ni);
1929		break;
1930	default:
1931		break;
1932	}
1933
1934	URTWN_UNLOCK(sc);
1935	IEEE80211_LOCK(ic);
1936	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
1937}
1938
1939static void
1940urtwn_watchdog(void *arg)
1941{
1942	struct urtwn_softc *sc = arg;
1943
1944	if (sc->sc_txtimer > 0) {
1945		if (--sc->sc_txtimer == 0) {
1946			device_printf(sc->sc_dev, "device timeout\n");
1947			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1948			return;
1949		}
1950		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1951	}
1952}
1953
1954static void
1955urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1956{
1957	int pwdb;
1958
1959	/* Convert antenna signal to percentage. */
1960	if (rssi <= -100 || rssi >= 20)
1961		pwdb = 0;
1962	else if (rssi >= 0)
1963		pwdb = 100;
1964	else
1965		pwdb = 100 + rssi;
1966	if (!(sc->chip & URTWN_CHIP_88E)) {
1967		if (rate <= URTWN_RIDX_CCK11) {
1968			/* CCK gain is smaller than OFDM/MCS gain. */
1969			pwdb += 6;
1970			if (pwdb > 100)
1971				pwdb = 100;
1972			if (pwdb <= 14)
1973				pwdb -= 4;
1974			else if (pwdb <= 26)
1975				pwdb -= 8;
1976			else if (pwdb <= 34)
1977				pwdb -= 6;
1978			else if (pwdb <= 42)
1979				pwdb -= 2;
1980		}
1981	}
1982	if (sc->avg_pwdb == -1)	/* Init. */
1983		sc->avg_pwdb = pwdb;
1984	else if (sc->avg_pwdb < pwdb)
1985		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1986	else
1987		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1988	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1989}
1990
1991static int8_t
1992urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1993{
1994	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1995	struct r92c_rx_phystat *phy;
1996	struct r92c_rx_cck *cck;
1997	uint8_t rpt;
1998	int8_t rssi;
1999
2000	if (rate <= URTWN_RIDX_CCK11) {
2001		cck = (struct r92c_rx_cck *)physt;
2002		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2003			rpt = (cck->agc_rpt >> 5) & 0x3;
2004			rssi = (cck->agc_rpt & 0x1f) << 1;
2005		} else {
2006			rpt = (cck->agc_rpt >> 6) & 0x3;
2007			rssi = cck->agc_rpt & 0x3e;
2008		}
2009		rssi = cckoff[rpt] - rssi;
2010	} else {	/* OFDM/HT. */
2011		phy = (struct r92c_rx_phystat *)physt;
2012		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2013	}
2014	return (rssi);
2015}
2016
2017static int8_t
2018urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2019{
2020	struct r92c_rx_phystat *phy;
2021	struct r88e_rx_cck *cck;
2022	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2023	int8_t rssi;
2024
2025	rssi = 0;
2026	if (rate <= URTWN_RIDX_CCK11) {
2027		cck = (struct r88e_rx_cck *)physt;
2028		cck_agc_rpt = cck->agc_rpt;
2029		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2030		vga_idx = cck_agc_rpt & 0x1f;
2031		switch (lna_idx) {
2032		case 7:
2033			if (vga_idx <= 27)
2034				rssi = -100 + 2* (27 - vga_idx);
2035			else
2036				rssi = -100;
2037			break;
2038		case 6:
2039			rssi = -48 + 2 * (2 - vga_idx);
2040			break;
2041		case 5:
2042			rssi = -42 + 2 * (7 - vga_idx);
2043			break;
2044		case 4:
2045			rssi = -36 + 2 * (7 - vga_idx);
2046			break;
2047		case 3:
2048			rssi = -24 + 2 * (7 - vga_idx);
2049			break;
2050		case 2:
2051			rssi = -12 + 2 * (5 - vga_idx);
2052			break;
2053		case 1:
2054			rssi = 8 - (2 * vga_idx);
2055			break;
2056		case 0:
2057			rssi = 14 - (2 * vga_idx);
2058			break;
2059		}
2060		rssi += 6;
2061	} else {	/* OFDM/HT. */
2062		phy = (struct r92c_rx_phystat *)physt;
2063		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2064	}
2065	return (rssi);
2066}
2067
2068static int
2069urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2070    struct mbuf *m, struct urtwn_data *data)
2071{
2072	struct ieee80211_frame *wh;
2073	struct ieee80211_key *k = NULL;
2074	struct ieee80211com *ic = &sc->sc_ic;
2075	struct ieee80211vap *vap = ni->ni_vap;
2076	struct r92c_tx_desc *txd;
2077	uint8_t macid, raid, ridx, subtype, type, qsel;
2078	int ismcast;
2079
2080	URTWN_ASSERT_LOCKED(sc);
2081
2082	/*
2083	 * Software crypto.
2084	 */
2085	wh = mtod(m, struct ieee80211_frame *);
2086	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2087	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2088	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2089
2090	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2091		k = ieee80211_crypto_encap(ni, m);
2092		if (k == NULL) {
2093			device_printf(sc->sc_dev,
2094			    "ieee80211_crypto_encap returns NULL.\n");
2095			return (ENOBUFS);
2096		}
2097
2098		/* in case packet header moved, reset pointer */
2099		wh = mtod(m, struct ieee80211_frame *);
2100	}
2101
2102	/* Fill Tx descriptor. */
2103	txd = (struct r92c_tx_desc *)data->buf;
2104	memset(txd, 0, sizeof(*txd));
2105
2106	txd->txdw0 |= htole32(
2107	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2108	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2109	if (ismcast)
2110		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2111
2112	raid = R92C_RAID_11B;	/* by default */
2113	ridx = URTWN_RIDX_CCK1;
2114	if (!ismcast) {
2115		macid = URTWN_MACID_BSS;
2116
2117		if (type == IEEE80211_FC0_TYPE_DATA) {
2118			qsel = R92C_TXDW1_QSEL_BE;
2119
2120			if (!(m->m_flags & M_EAPOL)) {
2121				if (ic->ic_curmode != IEEE80211_MODE_11B) {
2122					raid = R92C_RAID_11BG;
2123					ridx = URTWN_RIDX_OFDM54;
2124				} else
2125					ridx = URTWN_RIDX_CCK11;
2126			}
2127
2128			if (sc->chip & URTWN_CHIP_88E)
2129				txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
2130			else
2131				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2132
2133			if (ic->ic_flags & IEEE80211_F_USEPROT) {
2134				switch (ic->ic_protmode) {
2135				case IEEE80211_PROT_CTSONLY:
2136					txd->txdw4 |= htole32(
2137					    R92C_TXDW4_CTS2SELF |
2138					    R92C_TXDW4_HWRTSEN);
2139					break;
2140				case IEEE80211_PROT_RTSCTS:
2141					txd->txdw4 |= htole32(
2142					    R92C_TXDW4_RTSEN |
2143					    R92C_TXDW4_HWRTSEN);
2144					break;
2145				default:
2146					break;
2147				}
2148			}
2149			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2150			    URTWN_RIDX_OFDM24));
2151			txd->txdw5 |= htole32(0x0001ff00);
2152		} else	/* IEEE80211_FC0_TYPE_MGT */
2153			qsel = R92C_TXDW1_QSEL_MGNT;
2154	} else {
2155		macid = URTWN_MACID_BC;
2156		qsel = R92C_TXDW1_QSEL_MGNT;
2157	}
2158
2159	txd->txdw1 |= htole32(
2160	    SM(R92C_TXDW1_QSEL, qsel) |
2161	    SM(R92C_TXDW1_RAID, raid));
2162
2163	if (sc->chip & URTWN_CHIP_88E)
2164		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2165	else
2166		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2167
2168	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2169	/* not sure here */
2170	if (ridx <= URTWN_RIDX_CCK11)
2171		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2172
2173	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
2174		/* Use HW sequence numbering for non-QoS frames. */
2175		txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
2176	} else {
2177		/* Set sequence number. */
2178		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2179	}
2180
2181	if (ieee80211_radiotap_active_vap(vap)) {
2182		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2183
2184		tap->wt_flags = 0;
2185		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2186		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2187		if (k != NULL)
2188			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2189		ieee80211_radiotap_tx(vap, m);
2190	}
2191
2192	data->ni = ni;
2193
2194	urtwn_tx_start(sc, m, type, data);
2195
2196	return (0);
2197}
2198
2199static void
2200urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
2201    struct urtwn_data *data)
2202{
2203	struct usb_xfer *xfer;
2204	struct r92c_tx_desc *txd;
2205	uint16_t ac, sum;
2206	int i, xferlen;
2207	struct usb_xfer *urtwn_pipes[WME_NUM_AC] = {
2208		sc->sc_xfer[URTWN_BULK_TX_BE],
2209		sc->sc_xfer[URTWN_BULK_TX_BK],
2210		sc->sc_xfer[URTWN_BULK_TX_VI],
2211		sc->sc_xfer[URTWN_BULK_TX_VO]
2212	};
2213
2214	URTWN_ASSERT_LOCKED(sc);
2215
2216	ac = M_WME_GETAC(m);
2217
2218	switch (type) {
2219	case IEEE80211_FC0_TYPE_CTL:
2220	case IEEE80211_FC0_TYPE_MGT:
2221		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
2222		break;
2223	default:
2224		xfer = urtwn_pipes[ac];
2225		break;
2226	}
2227
2228	txd = (struct r92c_tx_desc *)data->buf;
2229	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
2230
2231	/* Compute Tx descriptor checksum. */
2232	sum = 0;
2233	for (i = 0; i < sizeof(*txd) / 2; i++)
2234		sum ^= ((uint16_t *)txd)[i];
2235	txd->txdsum = sum;	/* NB: already little endian. */
2236
2237	xferlen = sizeof(*txd) + m->m_pkthdr.len;
2238	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
2239
2240	data->buflen = xferlen;
2241	data->m = m;
2242
2243	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2244	usbd_transfer_start(xfer);
2245}
2246
2247static int
2248urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
2249{
2250	struct urtwn_softc *sc = ic->ic_softc;
2251	int error;
2252
2253	URTWN_LOCK(sc);
2254	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2255		URTWN_UNLOCK(sc);
2256		return (ENXIO);
2257	}
2258	error = mbufq_enqueue(&sc->sc_snd, m);
2259	if (error) {
2260		URTWN_UNLOCK(sc);
2261		return (error);
2262	}
2263	urtwn_start(sc);
2264	URTWN_UNLOCK(sc);
2265
2266	return (0);
2267}
2268
2269static void
2270urtwn_start(struct urtwn_softc *sc)
2271{
2272	struct ieee80211_node *ni;
2273	struct mbuf *m;
2274	struct urtwn_data *bf;
2275
2276	URTWN_ASSERT_LOCKED(sc);
2277	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2278		bf = urtwn_getbuf(sc);
2279		if (bf == NULL) {
2280			mbufq_prepend(&sc->sc_snd, m);
2281			break;
2282		}
2283		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2284		m->m_pkthdr.rcvif = NULL;
2285		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
2286			if_inc_counter(ni->ni_vap->iv_ifp,
2287			    IFCOUNTER_OERRORS, 1);
2288			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2289			m_freem(m);
2290			ieee80211_free_node(ni);
2291			break;
2292		}
2293		sc->sc_txtimer = 5;
2294		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2295	}
2296}
2297
2298static void
2299urtwn_parent(struct ieee80211com *ic)
2300{
2301	struct urtwn_softc *sc = ic->ic_softc;
2302	int startall = 0;
2303
2304	URTWN_LOCK(sc);
2305	if (sc->sc_flags & URTWN_DETACHED) {
2306		URTWN_UNLOCK(sc);
2307		return;
2308	}
2309	if (ic->ic_nrunning > 0) {
2310		if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2311			urtwn_init(sc);
2312			startall = 1;
2313		}
2314	} else if (sc->sc_flags & URTWN_RUNNING)
2315		urtwn_stop(sc);
2316	URTWN_UNLOCK(sc);
2317
2318	if (startall)
2319		ieee80211_start_all(ic);
2320}
2321
2322static __inline int
2323urtwn_power_on(struct urtwn_softc *sc)
2324{
2325
2326	return sc->sc_power_on(sc);
2327}
2328
2329static int
2330urtwn_r92c_power_on(struct urtwn_softc *sc)
2331{
2332	uint32_t reg;
2333	int ntries;
2334
2335	/* Wait for autoload done bit. */
2336	for (ntries = 0; ntries < 1000; ntries++) {
2337		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2338			break;
2339		urtwn_ms_delay(sc);
2340	}
2341	if (ntries == 1000) {
2342		device_printf(sc->sc_dev,
2343		    "timeout waiting for chip autoload\n");
2344		return (ETIMEDOUT);
2345	}
2346
2347	/* Unlock ISO/CLK/Power control register. */
2348	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2349	/* Move SPS into PWM mode. */
2350	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2351	urtwn_ms_delay(sc);
2352
2353	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2354	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2355		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2356		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2357		urtwn_ms_delay(sc);
2358		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2359		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2360		    ~R92C_SYS_ISO_CTRL_MD2PP);
2361	}
2362
2363	/* Auto enable WLAN. */
2364	urtwn_write_2(sc, R92C_APS_FSMCO,
2365	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2366	for (ntries = 0; ntries < 1000; ntries++) {
2367		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2368		    R92C_APS_FSMCO_APFM_ONMAC))
2369			break;
2370		urtwn_ms_delay(sc);
2371	}
2372	if (ntries == 1000) {
2373		device_printf(sc->sc_dev,
2374		    "timeout waiting for MAC auto ON\n");
2375		return (ETIMEDOUT);
2376	}
2377
2378	/* Enable radio, GPIO and LED functions. */
2379	urtwn_write_2(sc, R92C_APS_FSMCO,
2380	    R92C_APS_FSMCO_AFSM_HSUS |
2381	    R92C_APS_FSMCO_PDN_EN |
2382	    R92C_APS_FSMCO_PFM_ALDN);
2383	/* Release RF digital isolation. */
2384	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2385	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2386
2387	/* Initialize MAC. */
2388	urtwn_write_1(sc, R92C_APSD_CTRL,
2389	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2390	for (ntries = 0; ntries < 200; ntries++) {
2391		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2392		    R92C_APSD_CTRL_OFF_STATUS))
2393			break;
2394		urtwn_ms_delay(sc);
2395	}
2396	if (ntries == 200) {
2397		device_printf(sc->sc_dev,
2398		    "timeout waiting for MAC initialization\n");
2399		return (ETIMEDOUT);
2400	}
2401
2402	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2403	reg = urtwn_read_2(sc, R92C_CR);
2404	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2405	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2406	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2407	    R92C_CR_ENSEC;
2408	urtwn_write_2(sc, R92C_CR, reg);
2409
2410	urtwn_write_1(sc, 0xfe10, 0x19);
2411	return (0);
2412}
2413
2414static int
2415urtwn_r88e_power_on(struct urtwn_softc *sc)
2416{
2417	uint32_t reg;
2418	int ntries;
2419
2420	/* Wait for power ready bit. */
2421	for (ntries = 0; ntries < 5000; ntries++) {
2422		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2423			break;
2424		urtwn_ms_delay(sc);
2425	}
2426	if (ntries == 5000) {
2427		device_printf(sc->sc_dev,
2428		    "timeout waiting for chip power up\n");
2429		return (ETIMEDOUT);
2430	}
2431
2432	/* Reset BB. */
2433	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2434	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2435	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2436
2437	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2438	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2439
2440	/* Disable HWPDN. */
2441	urtwn_write_2(sc, R92C_APS_FSMCO,
2442	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2443
2444	/* Disable WL suspend. */
2445	urtwn_write_2(sc, R92C_APS_FSMCO,
2446	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2447	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2448
2449	urtwn_write_2(sc, R92C_APS_FSMCO,
2450	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2451	for (ntries = 0; ntries < 5000; ntries++) {
2452		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2453		    R92C_APS_FSMCO_APFM_ONMAC))
2454			break;
2455		urtwn_ms_delay(sc);
2456	}
2457	if (ntries == 5000)
2458		return (ETIMEDOUT);
2459
2460	/* Enable LDO normal mode. */
2461	urtwn_write_1(sc, R92C_LPLDO_CTRL,
2462	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2463
2464	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2465	urtwn_write_2(sc, R92C_CR, 0);
2466	reg = urtwn_read_2(sc, R92C_CR);
2467	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2468	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2469	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2470	urtwn_write_2(sc, R92C_CR, reg);
2471
2472	return (0);
2473}
2474
2475static int
2476urtwn_llt_init(struct urtwn_softc *sc)
2477{
2478	int i, error, page_count, pktbuf_count;
2479
2480	page_count = (sc->chip & URTWN_CHIP_88E) ?
2481	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2482	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2483	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2484
2485	/* Reserve pages [0; page_count]. */
2486	for (i = 0; i < page_count; i++) {
2487		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2488			return (error);
2489	}
2490	/* NB: 0xff indicates end-of-list. */
2491	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2492		return (error);
2493	/*
2494	 * Use pages [page_count + 1; pktbuf_count - 1]
2495	 * as ring buffer.
2496	 */
2497	for (++i; i < pktbuf_count - 1; i++) {
2498		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2499			return (error);
2500	}
2501	/* Make the last page point to the beginning of the ring buffer. */
2502	error = urtwn_llt_write(sc, i, page_count + 1);
2503	return (error);
2504}
2505
2506static void
2507urtwn_fw_reset(struct urtwn_softc *sc)
2508{
2509	uint16_t reg;
2510	int ntries;
2511
2512	/* Tell 8051 to reset itself. */
2513	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2514
2515	/* Wait until 8051 resets by itself. */
2516	for (ntries = 0; ntries < 100; ntries++) {
2517		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2518		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2519			return;
2520		urtwn_ms_delay(sc);
2521	}
2522	/* Force 8051 reset. */
2523	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2524}
2525
2526static void
2527urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2528{
2529	uint16_t reg;
2530
2531	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2532	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2533	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2534}
2535
2536static int
2537urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2538{
2539	uint32_t reg;
2540	int off, mlen, error = 0;
2541
2542	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2543	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2544	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2545
2546	off = R92C_FW_START_ADDR;
2547	while (len > 0) {
2548		if (len > 196)
2549			mlen = 196;
2550		else if (len > 4)
2551			mlen = 4;
2552		else
2553			mlen = 1;
2554		/* XXX fix this deconst */
2555		error = urtwn_write_region_1(sc, off,
2556		    __DECONST(uint8_t *, buf), mlen);
2557		if (error != 0)
2558			break;
2559		off += mlen;
2560		buf += mlen;
2561		len -= mlen;
2562	}
2563	return (error);
2564}
2565
2566static int
2567urtwn_load_firmware(struct urtwn_softc *sc)
2568{
2569	const struct firmware *fw;
2570	const struct r92c_fw_hdr *hdr;
2571	const char *imagename;
2572	const u_char *ptr;
2573	size_t len;
2574	uint32_t reg;
2575	int mlen, ntries, page, error;
2576
2577	URTWN_UNLOCK(sc);
2578	/* Read firmware image from the filesystem. */
2579	if (sc->chip & URTWN_CHIP_88E)
2580		imagename = "urtwn-rtl8188eufw";
2581	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2582		    URTWN_CHIP_UMC_A_CUT)
2583		imagename = "urtwn-rtl8192cfwU";
2584	else
2585		imagename = "urtwn-rtl8192cfwT";
2586
2587	fw = firmware_get(imagename);
2588	URTWN_LOCK(sc);
2589	if (fw == NULL) {
2590		device_printf(sc->sc_dev,
2591		    "failed loadfirmware of file %s\n", imagename);
2592		return (ENOENT);
2593	}
2594
2595	len = fw->datasize;
2596
2597	if (len < sizeof(*hdr)) {
2598		device_printf(sc->sc_dev, "firmware too short\n");
2599		error = EINVAL;
2600		goto fail;
2601	}
2602	ptr = fw->data;
2603	hdr = (const struct r92c_fw_hdr *)ptr;
2604	/* Check if there is a valid FW header and skip it. */
2605	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2606	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2607	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2608		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2609		    le16toh(hdr->version), le16toh(hdr->subversion),
2610		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2611		ptr += sizeof(*hdr);
2612		len -= sizeof(*hdr);
2613	}
2614
2615	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2616		if (sc->chip & URTWN_CHIP_88E)
2617			urtwn_r88e_fw_reset(sc);
2618		else
2619			urtwn_fw_reset(sc);
2620		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2621	}
2622
2623	if (!(sc->chip & URTWN_CHIP_88E)) {
2624		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2625		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2626		    R92C_SYS_FUNC_EN_CPUEN);
2627	}
2628	urtwn_write_1(sc, R92C_MCUFWDL,
2629	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2630	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2631	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2632
2633	/* Reset the FWDL checksum. */
2634	urtwn_write_1(sc, R92C_MCUFWDL,
2635	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2636
2637	for (page = 0; len > 0; page++) {
2638		mlen = min(len, R92C_FW_PAGE_SIZE);
2639		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2640		if (error != 0) {
2641			device_printf(sc->sc_dev,
2642			    "could not load firmware page\n");
2643			goto fail;
2644		}
2645		ptr += mlen;
2646		len -= mlen;
2647	}
2648	urtwn_write_1(sc, R92C_MCUFWDL,
2649	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2650	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2651
2652	/* Wait for checksum report. */
2653	for (ntries = 0; ntries < 1000; ntries++) {
2654		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2655			break;
2656		urtwn_ms_delay(sc);
2657	}
2658	if (ntries == 1000) {
2659		device_printf(sc->sc_dev,
2660		    "timeout waiting for checksum report\n");
2661		error = ETIMEDOUT;
2662		goto fail;
2663	}
2664
2665	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2666	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2667	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2668	if (sc->chip & URTWN_CHIP_88E)
2669		urtwn_r88e_fw_reset(sc);
2670	/* Wait for firmware readiness. */
2671	for (ntries = 0; ntries < 1000; ntries++) {
2672		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2673			break;
2674		urtwn_ms_delay(sc);
2675	}
2676	if (ntries == 1000) {
2677		device_printf(sc->sc_dev,
2678		    "timeout waiting for firmware readiness\n");
2679		error = ETIMEDOUT;
2680		goto fail;
2681	}
2682fail:
2683	firmware_put(fw, FIRMWARE_UNLOAD);
2684	return (error);
2685}
2686
2687static __inline int
2688urtwn_dma_init(struct urtwn_softc *sc)
2689{
2690
2691	return sc->sc_dma_init(sc);
2692}
2693
2694static int
2695urtwn_r92c_dma_init(struct urtwn_softc *sc)
2696{
2697	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2698	uint32_t reg;
2699	int error;
2700
2701	/* Initialize LLT table. */
2702	error = urtwn_llt_init(sc);
2703	if (error != 0)
2704		return (error);
2705
2706	/* Get Tx queues to USB endpoints mapping. */
2707	hashq = hasnq = haslq = 0;
2708	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2709	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2710	if (MS(reg, R92C_USB_EP_HQ) != 0)
2711		hashq = 1;
2712	if (MS(reg, R92C_USB_EP_NQ) != 0)
2713		hasnq = 1;
2714	if (MS(reg, R92C_USB_EP_LQ) != 0)
2715		haslq = 1;
2716	nqueues = hashq + hasnq + haslq;
2717	if (nqueues == 0)
2718		return (EIO);
2719	/* Get the number of pages for each queue. */
2720	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2721	/* The remaining pages are assigned to the high priority queue. */
2722	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2723
2724	/* Set number of pages for normal priority queue. */
2725	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2726	urtwn_write_4(sc, R92C_RQPN,
2727	    /* Set number of pages for public queue. */
2728	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2729	    /* Set number of pages for high priority queue. */
2730	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2731	    /* Set number of pages for low priority queue. */
2732	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2733	    /* Load values. */
2734	    R92C_RQPN_LD);
2735
2736	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2737	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2738	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2739	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2740	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2741
2742	/* Set queue to USB pipe mapping. */
2743	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2744	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2745	if (nqueues == 1) {
2746		if (hashq)
2747			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2748		else if (hasnq)
2749			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2750		else
2751			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2752	} else if (nqueues == 2) {
2753		/* All 2-endpoints configs have a high priority queue. */
2754		if (!hashq)
2755			return (EIO);
2756		if (hasnq)
2757			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2758		else
2759			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2760	} else
2761		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2762	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2763
2764	/* Set Tx/Rx transfer page boundary. */
2765	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2766
2767	/* Set Tx/Rx transfer page size. */
2768	urtwn_write_1(sc, R92C_PBP,
2769	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2770	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2771	return (0);
2772}
2773
2774static int
2775urtwn_r88e_dma_init(struct urtwn_softc *sc)
2776{
2777	struct usb_interface *iface;
2778	uint32_t reg;
2779	int nqueues;
2780	int error;
2781
2782	/* Initialize LLT table. */
2783	error = urtwn_llt_init(sc);
2784	if (error != 0)
2785		return (error);
2786
2787	/* Get Tx queues to USB endpoints mapping. */
2788	iface = usbd_get_iface(sc->sc_udev, 0);
2789	nqueues = iface->idesc->bNumEndpoints - 1;
2790	if (nqueues == 0)
2791		return (EIO);
2792
2793	/* Set number of pages for normal priority queue. */
2794	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2795	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2796
2797	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2798	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2799	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2800	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2801	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2802
2803	/* Set queue to USB pipe mapping. */
2804	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2805	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2806	if (nqueues == 1)
2807		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2808	else if (nqueues == 2)
2809		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2810	else
2811		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2812	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2813
2814	/* Set Tx/Rx transfer page boundary. */
2815	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2816
2817	/* Set Tx/Rx transfer page size. */
2818	urtwn_write_1(sc, R92C_PBP,
2819	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2820	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2821
2822	return (0);
2823}
2824
2825static void
2826urtwn_mac_init(struct urtwn_softc *sc)
2827{
2828	int i;
2829
2830	/* Write MAC initialization values. */
2831	if (sc->chip & URTWN_CHIP_88E) {
2832		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2833			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2834			    rtl8188eu_mac[i].val);
2835		}
2836		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2837	} else {
2838		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2839			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2840			    rtl8192cu_mac[i].val);
2841	}
2842}
2843
2844static void
2845urtwn_bb_init(struct urtwn_softc *sc)
2846{
2847	const struct urtwn_bb_prog *prog;
2848	uint32_t reg;
2849	uint8_t crystalcap;
2850	int i;
2851
2852	/* Enable BB and RF. */
2853	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2854	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2855	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2856	    R92C_SYS_FUNC_EN_DIO_RF);
2857
2858	if (!(sc->chip & URTWN_CHIP_88E))
2859		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2860
2861	urtwn_write_1(sc, R92C_RF_CTRL,
2862	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2863	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2864	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2865	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2866
2867	if (!(sc->chip & URTWN_CHIP_88E)) {
2868		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2869		urtwn_write_1(sc, 0x15, 0xe9);
2870		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2871	}
2872
2873	/* Select BB programming based on board type. */
2874	if (sc->chip & URTWN_CHIP_88E)
2875		prog = &rtl8188eu_bb_prog;
2876	else if (!(sc->chip & URTWN_CHIP_92C)) {
2877		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2878			prog = &rtl8188ce_bb_prog;
2879		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2880			prog = &rtl8188ru_bb_prog;
2881		else
2882			prog = &rtl8188cu_bb_prog;
2883	} else {
2884		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2885			prog = &rtl8192ce_bb_prog;
2886		else
2887			prog = &rtl8192cu_bb_prog;
2888	}
2889	/* Write BB initialization values. */
2890	for (i = 0; i < prog->count; i++) {
2891		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2892		urtwn_ms_delay(sc);
2893	}
2894
2895	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2896		/* 8192C 1T only configuration. */
2897		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2898		reg = (reg & ~0x00000003) | 0x2;
2899		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2900
2901		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2902		reg = (reg & ~0x00300033) | 0x00200022;
2903		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2904
2905		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2906		reg = (reg & ~0xff000000) | 0x45 << 24;
2907		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2908
2909		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2910		reg = (reg & ~0x000000ff) | 0x23;
2911		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2912
2913		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2914		reg = (reg & ~0x00000030) | 1 << 4;
2915		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2916
2917		reg = urtwn_bb_read(sc, 0xe74);
2918		reg = (reg & ~0x0c000000) | 2 << 26;
2919		urtwn_bb_write(sc, 0xe74, reg);
2920		reg = urtwn_bb_read(sc, 0xe78);
2921		reg = (reg & ~0x0c000000) | 2 << 26;
2922		urtwn_bb_write(sc, 0xe78, reg);
2923		reg = urtwn_bb_read(sc, 0xe7c);
2924		reg = (reg & ~0x0c000000) | 2 << 26;
2925		urtwn_bb_write(sc, 0xe7c, reg);
2926		reg = urtwn_bb_read(sc, 0xe80);
2927		reg = (reg & ~0x0c000000) | 2 << 26;
2928		urtwn_bb_write(sc, 0xe80, reg);
2929		reg = urtwn_bb_read(sc, 0xe88);
2930		reg = (reg & ~0x0c000000) | 2 << 26;
2931		urtwn_bb_write(sc, 0xe88, reg);
2932	}
2933
2934	/* Write AGC values. */
2935	for (i = 0; i < prog->agccount; i++) {
2936		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2937		    prog->agcvals[i]);
2938		urtwn_ms_delay(sc);
2939	}
2940
2941	if (sc->chip & URTWN_CHIP_88E) {
2942		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2943		urtwn_ms_delay(sc);
2944		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2945		urtwn_ms_delay(sc);
2946
2947		crystalcap = sc->r88e_rom[0xb9];
2948		if (crystalcap == 0xff)
2949			crystalcap = 0x20;
2950		crystalcap &= 0x3f;
2951		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2952		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2953		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2954		    crystalcap | crystalcap << 6));
2955	} else {
2956		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2957		    R92C_HSSI_PARAM2_CCK_HIPWR)
2958			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2959	}
2960}
2961
2962static void
2963urtwn_rf_init(struct urtwn_softc *sc)
2964{
2965	const struct urtwn_rf_prog *prog;
2966	uint32_t reg, type;
2967	int i, j, idx, off;
2968
2969	/* Select RF programming based on board type. */
2970	if (sc->chip & URTWN_CHIP_88E)
2971		prog = rtl8188eu_rf_prog;
2972	else if (!(sc->chip & URTWN_CHIP_92C)) {
2973		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2974			prog = rtl8188ce_rf_prog;
2975		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2976			prog = rtl8188ru_rf_prog;
2977		else
2978			prog = rtl8188cu_rf_prog;
2979	} else
2980		prog = rtl8192ce_rf_prog;
2981
2982	for (i = 0; i < sc->nrxchains; i++) {
2983		/* Save RF_ENV control type. */
2984		idx = i / 2;
2985		off = (i % 2) * 16;
2986		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2987		type = (reg >> off) & 0x10;
2988
2989		/* Set RF_ENV enable. */
2990		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2991		reg |= 0x100000;
2992		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2993		urtwn_ms_delay(sc);
2994		/* Set RF_ENV output high. */
2995		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2996		reg |= 0x10;
2997		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2998		urtwn_ms_delay(sc);
2999		/* Set address and data lengths of RF registers. */
3000		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3001		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
3002		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3003		urtwn_ms_delay(sc);
3004		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3005		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
3006		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3007		urtwn_ms_delay(sc);
3008
3009		/* Write RF initialization values for this chain. */
3010		for (j = 0; j < prog[i].count; j++) {
3011			if (prog[i].regs[j] >= 0xf9 &&
3012			    prog[i].regs[j] <= 0xfe) {
3013				/*
3014				 * These are fake RF registers offsets that
3015				 * indicate a delay is required.
3016				 */
3017				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
3018				continue;
3019			}
3020			urtwn_rf_write(sc, i, prog[i].regs[j],
3021			    prog[i].vals[j]);
3022			urtwn_ms_delay(sc);
3023		}
3024
3025		/* Restore RF_ENV control type. */
3026		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3027		reg &= ~(0x10 << off) | (type << off);
3028		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
3029
3030		/* Cache RF register CHNLBW. */
3031		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
3032	}
3033
3034	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3035	    URTWN_CHIP_UMC_A_CUT) {
3036		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
3037		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
3038	}
3039}
3040
3041static void
3042urtwn_cam_init(struct urtwn_softc *sc)
3043{
3044	/* Invalidate all CAM entries. */
3045	urtwn_write_4(sc, R92C_CAMCMD,
3046	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
3047}
3048
3049static void
3050urtwn_pa_bias_init(struct urtwn_softc *sc)
3051{
3052	uint8_t reg;
3053	int i;
3054
3055	for (i = 0; i < sc->nrxchains; i++) {
3056		if (sc->pa_setting & (1 << i))
3057			continue;
3058		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
3059		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
3060		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
3061		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
3062	}
3063	if (!(sc->pa_setting & 0x10)) {
3064		reg = urtwn_read_1(sc, 0x16);
3065		reg = (reg & ~0xf0) | 0x90;
3066		urtwn_write_1(sc, 0x16, reg);
3067	}
3068}
3069
3070static void
3071urtwn_rxfilter_init(struct urtwn_softc *sc)
3072{
3073	struct ieee80211com *ic = &sc->sc_ic;
3074	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3075	uint32_t rcr;
3076	uint16_t filter;
3077
3078	URTWN_ASSERT_LOCKED(sc);
3079
3080	/* Accept all multicast frames. */
3081	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
3082	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
3083
3084	/* Filter for management frames. */
3085	filter = 0x7f3f;
3086	switch (vap->iv_opmode) {
3087	case IEEE80211_M_STA:
3088		filter &= ~(
3089		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
3090		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
3091		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
3092		break;
3093	case IEEE80211_M_HOSTAP:
3094		filter &= ~(
3095		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
3096		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP) |
3097		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_BEACON));
3098		break;
3099	case IEEE80211_M_MONITOR:
3100	case IEEE80211_M_IBSS:
3101		break;
3102	default:
3103		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3104		    __func__, vap->iv_opmode);
3105		break;
3106	}
3107	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
3108
3109	/* Reject all control frames. */
3110	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
3111
3112	/* Reject all data frames. */
3113	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
3114
3115	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
3116	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
3117	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
3118
3119	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
3120		/* Accept all frames. */
3121		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
3122		       R92C_RCR_AAP;
3123	}
3124
3125	/* Set Rx filter. */
3126	urtwn_write_4(sc, R92C_RCR, rcr);
3127
3128	if (ic->ic_promisc != 0) {
3129		/* Update Rx filter. */
3130		urtwn_set_promisc(sc);
3131	}
3132}
3133
3134static void
3135urtwn_edca_init(struct urtwn_softc *sc)
3136{
3137	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
3138	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
3139	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
3140	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
3141	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
3142	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
3143	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
3144	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
3145}
3146
3147static void
3148urtwn_write_txpower(struct urtwn_softc *sc, int chain,
3149    uint16_t power[URTWN_RIDX_COUNT])
3150{
3151	uint32_t reg;
3152
3153	/* Write per-CCK rate Tx power. */
3154	if (chain == 0) {
3155		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
3156		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
3157		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
3158		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3159		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
3160		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
3161		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
3162		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3163	} else {
3164		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
3165		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
3166		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
3167		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
3168		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
3169		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3170		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
3171		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3172	}
3173	/* Write per-OFDM rate Tx power. */
3174	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
3175	    SM(R92C_TXAGC_RATE06, power[ 4]) |
3176	    SM(R92C_TXAGC_RATE09, power[ 5]) |
3177	    SM(R92C_TXAGC_RATE12, power[ 6]) |
3178	    SM(R92C_TXAGC_RATE18, power[ 7]));
3179	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
3180	    SM(R92C_TXAGC_RATE24, power[ 8]) |
3181	    SM(R92C_TXAGC_RATE36, power[ 9]) |
3182	    SM(R92C_TXAGC_RATE48, power[10]) |
3183	    SM(R92C_TXAGC_RATE54, power[11]));
3184	/* Write per-MCS Tx power. */
3185	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
3186	    SM(R92C_TXAGC_MCS00,  power[12]) |
3187	    SM(R92C_TXAGC_MCS01,  power[13]) |
3188	    SM(R92C_TXAGC_MCS02,  power[14]) |
3189	    SM(R92C_TXAGC_MCS03,  power[15]));
3190	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
3191	    SM(R92C_TXAGC_MCS04,  power[16]) |
3192	    SM(R92C_TXAGC_MCS05,  power[17]) |
3193	    SM(R92C_TXAGC_MCS06,  power[18]) |
3194	    SM(R92C_TXAGC_MCS07,  power[19]));
3195	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
3196	    SM(R92C_TXAGC_MCS08,  power[20]) |
3197	    SM(R92C_TXAGC_MCS09,  power[21]) |
3198	    SM(R92C_TXAGC_MCS10,  power[22]) |
3199	    SM(R92C_TXAGC_MCS11,  power[23]));
3200	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
3201	    SM(R92C_TXAGC_MCS12,  power[24]) |
3202	    SM(R92C_TXAGC_MCS13,  power[25]) |
3203	    SM(R92C_TXAGC_MCS14,  power[26]) |
3204	    SM(R92C_TXAGC_MCS15,  power[27]));
3205}
3206
3207static void
3208urtwn_get_txpower(struct urtwn_softc *sc, int chain,
3209    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3210    uint16_t power[URTWN_RIDX_COUNT])
3211{
3212	struct ieee80211com *ic = &sc->sc_ic;
3213	struct r92c_rom *rom = &sc->rom;
3214	uint16_t cckpow, ofdmpow, htpow, diff, max;
3215	const struct urtwn_txpwr *base;
3216	int ridx, chan, group;
3217
3218	/* Determine channel group. */
3219	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3220	if (chan <= 3)
3221		group = 0;
3222	else if (chan <= 9)
3223		group = 1;
3224	else
3225		group = 2;
3226
3227	/* Get original Tx power based on board type and RF chain. */
3228	if (!(sc->chip & URTWN_CHIP_92C)) {
3229		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3230			base = &rtl8188ru_txagc[chain];
3231		else
3232			base = &rtl8192cu_txagc[chain];
3233	} else
3234		base = &rtl8192cu_txagc[chain];
3235
3236	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3237	if (sc->regulatory == 0) {
3238		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3239			power[ridx] = base->pwr[0][ridx];
3240	}
3241	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3242		if (sc->regulatory == 3) {
3243			power[ridx] = base->pwr[0][ridx];
3244			/* Apply vendor limits. */
3245			if (extc != NULL)
3246				max = rom->ht40_max_pwr[group];
3247			else
3248				max = rom->ht20_max_pwr[group];
3249			max = (max >> (chain * 4)) & 0xf;
3250			if (power[ridx] > max)
3251				power[ridx] = max;
3252		} else if (sc->regulatory == 1) {
3253			if (extc == NULL)
3254				power[ridx] = base->pwr[group][ridx];
3255		} else if (sc->regulatory != 2)
3256			power[ridx] = base->pwr[0][ridx];
3257	}
3258
3259	/* Compute per-CCK rate Tx power. */
3260	cckpow = rom->cck_tx_pwr[chain][group];
3261	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3262		power[ridx] += cckpow;
3263		if (power[ridx] > R92C_MAX_TX_PWR)
3264			power[ridx] = R92C_MAX_TX_PWR;
3265	}
3266
3267	htpow = rom->ht40_1s_tx_pwr[chain][group];
3268	if (sc->ntxchains > 1) {
3269		/* Apply reduction for 2 spatial streams. */
3270		diff = rom->ht40_2s_tx_pwr_diff[group];
3271		diff = (diff >> (chain * 4)) & 0xf;
3272		htpow = (htpow > diff) ? htpow - diff : 0;
3273	}
3274
3275	/* Compute per-OFDM rate Tx power. */
3276	diff = rom->ofdm_tx_pwr_diff[group];
3277	diff = (diff >> (chain * 4)) & 0xf;
3278	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3279	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3280		power[ridx] += ofdmpow;
3281		if (power[ridx] > R92C_MAX_TX_PWR)
3282			power[ridx] = R92C_MAX_TX_PWR;
3283	}
3284
3285	/* Compute per-MCS Tx power. */
3286	if (extc == NULL) {
3287		diff = rom->ht20_tx_pwr_diff[group];
3288		diff = (diff >> (chain * 4)) & 0xf;
3289		htpow += diff;	/* HT40->HT20 correction. */
3290	}
3291	for (ridx = 12; ridx <= 27; ridx++) {
3292		power[ridx] += htpow;
3293		if (power[ridx] > R92C_MAX_TX_PWR)
3294			power[ridx] = R92C_MAX_TX_PWR;
3295	}
3296#ifdef URTWN_DEBUG
3297	if (urtwn_debug >= 4) {
3298		/* Dump per-rate Tx power values. */
3299		printf("Tx power for chain %d:\n", chain);
3300		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
3301			printf("Rate %d = %u\n", ridx, power[ridx]);
3302	}
3303#endif
3304}
3305
3306static void
3307urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3308    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3309    uint16_t power[URTWN_RIDX_COUNT])
3310{
3311	struct ieee80211com *ic = &sc->sc_ic;
3312	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3313	const struct urtwn_r88e_txpwr *base;
3314	int ridx, chan, group;
3315
3316	/* Determine channel group. */
3317	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3318	if (chan <= 2)
3319		group = 0;
3320	else if (chan <= 5)
3321		group = 1;
3322	else if (chan <= 8)
3323		group = 2;
3324	else if (chan <= 11)
3325		group = 3;
3326	else if (chan <= 13)
3327		group = 4;
3328	else
3329		group = 5;
3330
3331	/* Get original Tx power based on board type and RF chain. */
3332	base = &rtl8188eu_txagc[chain];
3333
3334	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3335	if (sc->regulatory == 0) {
3336		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3337			power[ridx] = base->pwr[0][ridx];
3338	}
3339	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3340		if (sc->regulatory == 3)
3341			power[ridx] = base->pwr[0][ridx];
3342		else if (sc->regulatory == 1) {
3343			if (extc == NULL)
3344				power[ridx] = base->pwr[group][ridx];
3345		} else if (sc->regulatory != 2)
3346			power[ridx] = base->pwr[0][ridx];
3347	}
3348
3349	/* Compute per-CCK rate Tx power. */
3350	cckpow = sc->cck_tx_pwr[group];
3351	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3352		power[ridx] += cckpow;
3353		if (power[ridx] > R92C_MAX_TX_PWR)
3354			power[ridx] = R92C_MAX_TX_PWR;
3355	}
3356
3357	htpow = sc->ht40_tx_pwr[group];
3358
3359	/* Compute per-OFDM rate Tx power. */
3360	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3361	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3362		power[ridx] += ofdmpow;
3363		if (power[ridx] > R92C_MAX_TX_PWR)
3364			power[ridx] = R92C_MAX_TX_PWR;
3365	}
3366
3367	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3368	for (ridx = 12; ridx <= 27; ridx++) {
3369		power[ridx] += bw20pow;
3370		if (power[ridx] > R92C_MAX_TX_PWR)
3371			power[ridx] = R92C_MAX_TX_PWR;
3372	}
3373}
3374
3375static void
3376urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3377    struct ieee80211_channel *extc)
3378{
3379	uint16_t power[URTWN_RIDX_COUNT];
3380	int i;
3381
3382	for (i = 0; i < sc->ntxchains; i++) {
3383		/* Compute per-rate Tx power values. */
3384		if (sc->chip & URTWN_CHIP_88E)
3385			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3386		else
3387			urtwn_get_txpower(sc, i, c, extc, power);
3388		/* Write per-rate Tx power values to hardware. */
3389		urtwn_write_txpower(sc, i, power);
3390	}
3391}
3392
3393static void
3394urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
3395{
3396	uint32_t reg;
3397
3398	reg = urtwn_read_4(sc, R92C_RCR);
3399	if (enable)
3400		reg &= ~R92C_RCR_CBSSID_BCN;
3401	else
3402		reg |= R92C_RCR_CBSSID_BCN;
3403	urtwn_write_4(sc, R92C_RCR, reg);
3404}
3405
3406static void
3407urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
3408{
3409	uint32_t reg;
3410
3411	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
3412	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3413	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
3414
3415	if (!(sc->chip & URTWN_CHIP_88E)) {
3416		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
3417		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3418		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
3419	}
3420}
3421
3422static void
3423urtwn_scan_start(struct ieee80211com *ic)
3424{
3425	struct urtwn_softc *sc = ic->ic_softc;
3426
3427	URTWN_LOCK(sc);
3428	/* Receive beacons / probe responses from any BSSID. */
3429	if (ic->ic_opmode != IEEE80211_M_IBSS)
3430		urtwn_set_rx_bssid_all(sc, 1);
3431
3432	/* Set gain for scanning. */
3433	urtwn_set_gain(sc, 0x20);
3434	URTWN_UNLOCK(sc);
3435}
3436
3437static void
3438urtwn_scan_end(struct ieee80211com *ic)
3439{
3440	struct urtwn_softc *sc = ic->ic_softc;
3441
3442	URTWN_LOCK(sc);
3443	/* Restore limitations. */
3444	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
3445		urtwn_set_rx_bssid_all(sc, 0);
3446
3447	/* Set gain under link. */
3448	urtwn_set_gain(sc, 0x32);
3449	URTWN_UNLOCK(sc);
3450}
3451
3452static void
3453urtwn_set_channel(struct ieee80211com *ic)
3454{
3455	struct urtwn_softc *sc = ic->ic_softc;
3456	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3457
3458	URTWN_LOCK(sc);
3459	if (vap->iv_state == IEEE80211_S_SCAN) {
3460		/* Make link LED blink during scan. */
3461		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3462	}
3463	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3464	URTWN_UNLOCK(sc);
3465}
3466
3467static void
3468urtwn_set_promisc(struct urtwn_softc *sc)
3469{
3470	struct ieee80211com *ic = &sc->sc_ic;
3471	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3472	uint32_t rcr, mask1, mask2;
3473
3474	URTWN_ASSERT_LOCKED(sc);
3475
3476	if (vap->iv_opmode == IEEE80211_M_MONITOR)
3477		return;
3478
3479	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
3480	mask2 = R92C_RCR_APM;
3481
3482	if (vap->iv_state == IEEE80211_S_RUN) {
3483		switch (vap->iv_opmode) {
3484		case IEEE80211_M_STA:
3485			mask2 |= R92C_RCR_CBSSID_DATA;
3486			/* FALLTHROUGH */
3487		case IEEE80211_M_HOSTAP:
3488			mask2 |= R92C_RCR_CBSSID_BCN;
3489			break;
3490		case IEEE80211_M_IBSS:
3491			mask2 |= R92C_RCR_CBSSID_DATA;
3492			break;
3493		default:
3494			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3495			    __func__, vap->iv_opmode);
3496			return;
3497		}
3498	}
3499
3500	rcr = urtwn_read_4(sc, R92C_RCR);
3501	if (ic->ic_promisc == 0)
3502		rcr = (rcr & ~mask1) | mask2;
3503	else
3504		rcr = (rcr & ~mask2) | mask1;
3505	urtwn_write_4(sc, R92C_RCR, rcr);
3506}
3507
3508static void
3509urtwn_update_promisc(struct ieee80211com *ic)
3510{
3511	struct urtwn_softc *sc = ic->ic_softc;
3512
3513	URTWN_LOCK(sc);
3514	if (sc->sc_flags & URTWN_RUNNING)
3515		urtwn_set_promisc(sc);
3516	URTWN_UNLOCK(sc);
3517}
3518
3519static void
3520urtwn_update_mcast(struct ieee80211com *ic)
3521{
3522	/* XXX do nothing?  */
3523}
3524
3525static void
3526urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3527    struct ieee80211_channel *extc)
3528{
3529	struct ieee80211com *ic = &sc->sc_ic;
3530	uint32_t reg;
3531	u_int chan;
3532	int i;
3533
3534	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3535	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3536		device_printf(sc->sc_dev,
3537		    "%s: invalid channel %x\n", __func__, chan);
3538		return;
3539	}
3540
3541	/* Set Tx power for this new channel. */
3542	urtwn_set_txpower(sc, c, extc);
3543
3544	for (i = 0; i < sc->nrxchains; i++) {
3545		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3546		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3547	}
3548#ifndef IEEE80211_NO_HT
3549	if (extc != NULL) {
3550		/* Is secondary channel below or above primary? */
3551		int prichlo = c->ic_freq < extc->ic_freq;
3552
3553		urtwn_write_1(sc, R92C_BWOPMODE,
3554		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3555
3556		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3557		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3558		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3559
3560		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3561		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3562		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3563		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3564
3565		/* Set CCK side band. */
3566		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3567		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3568		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3569
3570		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3571		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3572		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3573
3574		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3575		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3576		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3577
3578		reg = urtwn_bb_read(sc, 0x818);
3579		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3580		urtwn_bb_write(sc, 0x818, reg);
3581
3582		/* Select 40MHz bandwidth. */
3583		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3584		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3585	} else
3586#endif
3587	{
3588		urtwn_write_1(sc, R92C_BWOPMODE,
3589		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3590
3591		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3592		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3593		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3594		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3595
3596		if (!(sc->chip & URTWN_CHIP_88E)) {
3597			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3598			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3599			    R92C_FPGA0_ANAPARAM2_CBW20);
3600		}
3601
3602		/* Select 20MHz bandwidth. */
3603		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3604		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3605		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3606		    R92C_RF_CHNLBW_BW20));
3607	}
3608}
3609
3610static void
3611urtwn_iq_calib(struct urtwn_softc *sc)
3612{
3613	/* TODO */
3614}
3615
3616static void
3617urtwn_lc_calib(struct urtwn_softc *sc)
3618{
3619	uint32_t rf_ac[2];
3620	uint8_t txmode;
3621	int i;
3622
3623	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3624	if ((txmode & 0x70) != 0) {
3625		/* Disable all continuous Tx. */
3626		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3627
3628		/* Set RF mode to standby mode. */
3629		for (i = 0; i < sc->nrxchains; i++) {
3630			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3631			urtwn_rf_write(sc, i, R92C_RF_AC,
3632			    RW(rf_ac[i], R92C_RF_AC_MODE,
3633				R92C_RF_AC_MODE_STANDBY));
3634		}
3635	} else {
3636		/* Block all Tx queues. */
3637		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3638	}
3639	/* Start calibration. */
3640	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3641	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3642
3643	/* Give calibration the time to complete. */
3644	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3645
3646	/* Restore configuration. */
3647	if ((txmode & 0x70) != 0) {
3648		/* Restore Tx mode. */
3649		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3650		/* Restore RF mode. */
3651		for (i = 0; i < sc->nrxchains; i++)
3652			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3653	} else {
3654		/* Unblock all Tx queues. */
3655		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3656	}
3657}
3658
3659static void
3660urtwn_init(struct urtwn_softc *sc)
3661{
3662	struct ieee80211com *ic = &sc->sc_ic;
3663	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3664	uint8_t macaddr[IEEE80211_ADDR_LEN];
3665	uint32_t reg;
3666	int error;
3667
3668	URTWN_ASSERT_LOCKED(sc);
3669
3670	if (sc->sc_flags & URTWN_RUNNING)
3671		urtwn_stop(sc);
3672
3673	/* Init firmware commands ring. */
3674	sc->fwcur = 0;
3675
3676	/* Allocate Tx/Rx buffers. */
3677	error = urtwn_alloc_rx_list(sc);
3678	if (error != 0)
3679		goto fail;
3680
3681	error = urtwn_alloc_tx_list(sc);
3682	if (error != 0)
3683		goto fail;
3684
3685	/* Power on adapter. */
3686	error = urtwn_power_on(sc);
3687	if (error != 0)
3688		goto fail;
3689
3690	/* Initialize DMA. */
3691	error = urtwn_dma_init(sc);
3692	if (error != 0)
3693		goto fail;
3694
3695	/* Set info size in Rx descriptors (in 64-bit words). */
3696	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3697
3698	/* Init interrupts. */
3699	if (sc->chip & URTWN_CHIP_88E) {
3700		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3701		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3702		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3703		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3704		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3705		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3706		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3707		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3708	} else {
3709		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3710		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3711	}
3712
3713	/* Set MAC address. */
3714	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3715	urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
3716
3717	/* Set initial network type. */
3718	urtwn_set_mode(sc, R92C_MSR_INFRA);
3719
3720	/* Initialize Rx filter. */
3721	urtwn_rxfilter_init(sc);
3722
3723	/* Set response rate. */
3724	reg = urtwn_read_4(sc, R92C_RRSR);
3725	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3726	urtwn_write_4(sc, R92C_RRSR, reg);
3727
3728	/* Set short/long retry limits. */
3729	urtwn_write_2(sc, R92C_RL,
3730	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3731
3732	/* Initialize EDCA parameters. */
3733	urtwn_edca_init(sc);
3734
3735	/* Setup rate fallback. */
3736	if (!(sc->chip & URTWN_CHIP_88E)) {
3737		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3738		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3739		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3740		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3741	}
3742
3743	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3744	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3745	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3746	/* Set ACK timeout. */
3747	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3748
3749	/* Setup USB aggregation. */
3750	reg = urtwn_read_4(sc, R92C_TDECTRL);
3751	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3752	urtwn_write_4(sc, R92C_TDECTRL, reg);
3753	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3754	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3755	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3756	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3757	if (sc->chip & URTWN_CHIP_88E)
3758		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3759	else {
3760		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3761		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3762		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3763		    R92C_USB_SPECIAL_OPTION_AGG_EN);
3764		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3765		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3766	}
3767
3768	/* Initialize beacon parameters. */
3769	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3770	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3771	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3772	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3773	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3774
3775	if (!(sc->chip & URTWN_CHIP_88E)) {
3776		/* Setup AMPDU aggregation. */
3777		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3778		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3779		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3780
3781		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3782	}
3783
3784	/* Load 8051 microcode. */
3785	error = urtwn_load_firmware(sc);
3786	if (error != 0)
3787		goto fail;
3788
3789	/* Initialize MAC/BB/RF blocks. */
3790	urtwn_mac_init(sc);
3791	urtwn_bb_init(sc);
3792	urtwn_rf_init(sc);
3793
3794	/* Reinitialize Rx filter (D3845 is not committed yet). */
3795	urtwn_rxfilter_init(sc);
3796
3797	if (sc->chip & URTWN_CHIP_88E) {
3798		urtwn_write_2(sc, R92C_CR,
3799		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3800		    R92C_CR_MACRXEN);
3801	}
3802
3803	/* Turn CCK and OFDM blocks on. */
3804	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3805	reg |= R92C_RFMOD_CCK_EN;
3806	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3807	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3808	reg |= R92C_RFMOD_OFDM_EN;
3809	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3810
3811	/* Clear per-station keys table. */
3812	urtwn_cam_init(sc);
3813
3814	/* Enable hardware sequence numbering. */
3815	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3816
3817	/* Perform LO and IQ calibrations. */
3818	urtwn_iq_calib(sc);
3819	/* Perform LC calibration. */
3820	urtwn_lc_calib(sc);
3821
3822	/* Fix USB interference issue. */
3823	if (!(sc->chip & URTWN_CHIP_88E)) {
3824		urtwn_write_1(sc, 0xfe40, 0xe0);
3825		urtwn_write_1(sc, 0xfe41, 0x8d);
3826		urtwn_write_1(sc, 0xfe42, 0x80);
3827
3828		urtwn_pa_bias_init(sc);
3829	}
3830
3831	/* Initialize GPIO setting. */
3832	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3833	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3834
3835	/* Fix for lower temperature. */
3836	if (!(sc->chip & URTWN_CHIP_88E))
3837		urtwn_write_1(sc, 0x15, 0xe9);
3838
3839	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3840
3841	sc->sc_flags |= URTWN_RUNNING;
3842
3843	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3844fail:
3845	return;
3846}
3847
3848static void
3849urtwn_stop(struct urtwn_softc *sc)
3850{
3851
3852	URTWN_ASSERT_LOCKED(sc);
3853	sc->sc_flags &= ~URTWN_RUNNING;
3854	callout_stop(&sc->sc_watchdog_ch);
3855	urtwn_abort_xfers(sc);
3856
3857	urtwn_drain_mbufq(sc);
3858}
3859
3860static void
3861urtwn_abort_xfers(struct urtwn_softc *sc)
3862{
3863	int i;
3864
3865	URTWN_ASSERT_LOCKED(sc);
3866
3867	/* abort any pending transfers */
3868	for (i = 0; i < URTWN_N_TRANSFER; i++)
3869		usbd_transfer_stop(sc->sc_xfer[i]);
3870}
3871
3872static int
3873urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3874    const struct ieee80211_bpf_params *params)
3875{
3876	struct ieee80211com *ic = ni->ni_ic;
3877	struct urtwn_softc *sc = ic->ic_softc;
3878	struct urtwn_data *bf;
3879	int error;
3880
3881	/* prevent management frames from being sent if we're not ready */
3882	URTWN_LOCK(sc);
3883	if (!(sc->sc_flags & URTWN_RUNNING)) {
3884		error = ENETDOWN;
3885		goto end;
3886	}
3887
3888	bf = urtwn_getbuf(sc);
3889	if (bf == NULL) {
3890		error = ENOBUFS;
3891		goto end;
3892	}
3893
3894	if ((error = urtwn_tx_data(sc, ni, m, bf)) != 0) {
3895		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3896		goto end;
3897	}
3898
3899	sc->sc_txtimer = 5;
3900	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3901
3902end:
3903	if (error != 0)
3904		m_freem(m);
3905
3906	URTWN_UNLOCK(sc);
3907
3908	return (error);
3909}
3910
3911static void
3912urtwn_ms_delay(struct urtwn_softc *sc)
3913{
3914	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3915}
3916
3917static device_method_t urtwn_methods[] = {
3918	/* Device interface */
3919	DEVMETHOD(device_probe,		urtwn_match),
3920	DEVMETHOD(device_attach,	urtwn_attach),
3921	DEVMETHOD(device_detach,	urtwn_detach),
3922
3923	DEVMETHOD_END
3924};
3925
3926static driver_t urtwn_driver = {
3927	"urtwn",
3928	urtwn_methods,
3929	sizeof(struct urtwn_softc)
3930};
3931
3932static devclass_t urtwn_devclass;
3933
3934DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3935MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3936MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3937MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3938MODULE_VERSION(urtwn, 1);
3939