if_urtwn.c revision 291695
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_urtwn.c 291695 2015-12-03 14:17:28Z avos $");
22
23/*
24 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
25 */
26
27#include "opt_wlan.h"
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/module.h>
40#include <sys/bus.h>
41#include <sys/endian.h>
42#include <sys/linker.h>
43#include <sys/firmware.h>
44#include <sys/kdb.h>
45
46#include <machine/bus.h>
47#include <machine/resource.h>
48#include <sys/rman.h>
49
50#include <net/bpf.h>
51#include <net/if.h>
52#include <net/if_var.h>
53#include <net/if_arp.h>
54#include <net/ethernet.h>
55#include <net/if_dl.h>
56#include <net/if_media.h>
57#include <net/if_types.h>
58
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_var.h>
62#include <netinet/if_ether.h>
63#include <netinet/ip.h>
64
65#include <net80211/ieee80211_var.h>
66#include <net80211/ieee80211_input.h>
67#include <net80211/ieee80211_regdomain.h>
68#include <net80211/ieee80211_radiotap.h>
69#include <net80211/ieee80211_ratectl.h>
70
71#include <dev/usb/usb.h>
72#include <dev/usb/usbdi.h>
73#include "usbdevs.h"
74
75#define USB_DEBUG_VAR urtwn_debug
76#include <dev/usb/usb_debug.h>
77
78#include <dev/usb/wlan/if_urtwnreg.h>
79#include <dev/usb/wlan/if_urtwnvar.h>
80
81#ifdef USB_DEBUG
82static int urtwn_debug = 0;
83
84SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
85SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RWTUN, &urtwn_debug, 0,
86    "Debug level");
87#endif
88
89#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
90
91/* various supported device vendors/products */
92static const STRUCT_USB_HOST_ID urtwn_devs[] = {
93#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
94#define	URTWN_RTL8188E_DEV(v,p)	\
95	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
96#define URTWN_RTL8188E  1
97	URTWN_DEV(ABOCOM,	RTL8188CU_1),
98	URTWN_DEV(ABOCOM,	RTL8188CU_2),
99	URTWN_DEV(ABOCOM,	RTL8192CU),
100	URTWN_DEV(ASUS,		RTL8192CU),
101	URTWN_DEV(ASUS,		USBN10NANO),
102	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
103	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
104	URTWN_DEV(AZUREWAVE,	RTL8188CU),
105	URTWN_DEV(BELKIN,	F7D2102),
106	URTWN_DEV(BELKIN,	RTL8188CU),
107	URTWN_DEV(BELKIN,	RTL8192CU),
108	URTWN_DEV(CHICONY,	RTL8188CUS_1),
109	URTWN_DEV(CHICONY,	RTL8188CUS_2),
110	URTWN_DEV(CHICONY,	RTL8188CUS_3),
111	URTWN_DEV(CHICONY,	RTL8188CUS_4),
112	URTWN_DEV(CHICONY,	RTL8188CUS_5),
113	URTWN_DEV(COREGA,	RTL8192CU),
114	URTWN_DEV(DLINK,	RTL8188CU),
115	URTWN_DEV(DLINK,	RTL8192CU_1),
116	URTWN_DEV(DLINK,	RTL8192CU_2),
117	URTWN_DEV(DLINK,	RTL8192CU_3),
118	URTWN_DEV(DLINK,	DWA131B),
119	URTWN_DEV(EDIMAX,	EW7811UN),
120	URTWN_DEV(EDIMAX,	RTL8192CU),
121	URTWN_DEV(FEIXUN,	RTL8188CU),
122	URTWN_DEV(FEIXUN,	RTL8192CU),
123	URTWN_DEV(GUILLEMOT,	HWNUP150),
124	URTWN_DEV(HAWKING,	RTL8192CU),
125	URTWN_DEV(HP3,		RTL8188CU),
126	URTWN_DEV(NETGEAR,	WNA1000M),
127	URTWN_DEV(NETGEAR,	RTL8192CU),
128	URTWN_DEV(NETGEAR4,	RTL8188CU),
129	URTWN_DEV(NOVATECH,	RTL8188CU),
130	URTWN_DEV(PLANEX2,	RTL8188CU_1),
131	URTWN_DEV(PLANEX2,	RTL8188CU_2),
132	URTWN_DEV(PLANEX2,	RTL8188CU_3),
133	URTWN_DEV(PLANEX2,	RTL8188CU_4),
134	URTWN_DEV(PLANEX2,	RTL8188CUS),
135	URTWN_DEV(PLANEX2,	RTL8192CU),
136	URTWN_DEV(REALTEK,	RTL8188CE_0),
137	URTWN_DEV(REALTEK,	RTL8188CE_1),
138	URTWN_DEV(REALTEK,	RTL8188CTV),
139	URTWN_DEV(REALTEK,	RTL8188CU_0),
140	URTWN_DEV(REALTEK,	RTL8188CU_1),
141	URTWN_DEV(REALTEK,	RTL8188CU_2),
142	URTWN_DEV(REALTEK,	RTL8188CU_3),
143	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
144	URTWN_DEV(REALTEK,	RTL8188CUS),
145	URTWN_DEV(REALTEK,	RTL8188RU_1),
146	URTWN_DEV(REALTEK,	RTL8188RU_2),
147	URTWN_DEV(REALTEK,	RTL8188RU_3),
148	URTWN_DEV(REALTEK,	RTL8191CU),
149	URTWN_DEV(REALTEK,	RTL8192CE),
150	URTWN_DEV(REALTEK,	RTL8192CU),
151	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
152	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
153	URTWN_DEV(SITECOMEU,	RTL8192CU),
154	URTWN_DEV(TRENDNET,	RTL8188CU),
155	URTWN_DEV(TRENDNET,	RTL8192CU),
156	URTWN_DEV(ZYXEL,	RTL8192CU),
157	/* URTWN_RTL8188E */
158	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
159	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
160	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
161	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
162	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
163#undef URTWN_RTL8188E_DEV
164#undef URTWN_DEV
165};
166
167static device_probe_t	urtwn_match;
168static device_attach_t	urtwn_attach;
169static device_detach_t	urtwn_detach;
170
171static usb_callback_t   urtwn_bulk_tx_callback;
172static usb_callback_t	urtwn_bulk_rx_callback;
173
174static void		urtwn_drain_mbufq(struct urtwn_softc *sc);
175static usb_error_t	urtwn_do_request(struct urtwn_softc *,
176			    struct usb_device_request *, void *);
177static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
178		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
179                    const uint8_t [IEEE80211_ADDR_LEN],
180                    const uint8_t [IEEE80211_ADDR_LEN]);
181static void		urtwn_vap_delete(struct ieee80211vap *);
182static struct mbuf *	urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
183			    int *);
184static struct mbuf *	urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
185			    int *, int8_t *);
186static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
187			    int);
188static int		urtwn_alloc_list(struct urtwn_softc *,
189			    struct urtwn_data[], int, int);
190static int		urtwn_alloc_rx_list(struct urtwn_softc *);
191static int		urtwn_alloc_tx_list(struct urtwn_softc *);
192static void		urtwn_free_list(struct urtwn_softc *,
193			    struct urtwn_data data[], int);
194static void		urtwn_free_rx_list(struct urtwn_softc *);
195static void		urtwn_free_tx_list(struct urtwn_softc *);
196static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
197static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
198static int		urtwn_write_region_1(struct urtwn_softc *, uint16_t,
199			    uint8_t *, int);
200static void		urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
201static void		urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
202static void		urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
203static int		urtwn_read_region_1(struct urtwn_softc *, uint16_t,
204			    uint8_t *, int);
205static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
206static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
207static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
208static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
209			    const void *, int);
210static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
211			    uint8_t, uint32_t);
212static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
213			    uint8_t, uint32_t);
214static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
215static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
216			    uint32_t);
217static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
218static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
219			    uint8_t, uint8_t);
220#ifdef URTWN_DEBUG
221static void		urtwn_dump_rom_contents(struct urtwn_softc *,
222			    uint8_t *, uint16_t);
223#endif
224static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
225			    uint16_t);
226static void		urtwn_efuse_switch_power(struct urtwn_softc *);
227static int		urtwn_read_chipid(struct urtwn_softc *);
228static int		urtwn_read_rom(struct urtwn_softc *);
229static int		urtwn_r88e_read_rom(struct urtwn_softc *);
230static int		urtwn_ra_init(struct urtwn_softc *);
231static void		urtwn_init_beacon(struct urtwn_softc *,
232			    struct urtwn_vap *);
233static int		urtwn_setup_beacon(struct urtwn_softc *,
234			    struct ieee80211_node *);
235static void		urtwn_update_beacon(struct ieee80211vap *, int);
236static int		urtwn_tx_beacon(struct urtwn_softc *sc,
237			    struct urtwn_vap *);
238static void		urtwn_tsf_task_adhoc(void *, int);
239static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
240			    struct ieee80211vap *);
241static void		urtwn_set_led(struct urtwn_softc *, int, int);
242static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
243static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
244			    struct mbuf *, int,
245			    const struct ieee80211_rx_stats *, int, int);
246static int		urtwn_newstate(struct ieee80211vap *,
247			    enum ieee80211_state, int);
248static void		urtwn_watchdog(void *);
249static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
250static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
251static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
252static int		urtwn_tx_data(struct urtwn_softc *,
253			    struct ieee80211_node *, struct mbuf *,
254			    struct urtwn_data *);
255static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
256			    uint8_t, struct urtwn_data *);
257static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
258static void		urtwn_start(struct urtwn_softc *);
259static void		urtwn_parent(struct ieee80211com *);
260static int		urtwn_r92c_power_on(struct urtwn_softc *);
261static int		urtwn_r88e_power_on(struct urtwn_softc *);
262static int		urtwn_llt_init(struct urtwn_softc *);
263static void		urtwn_fw_reset(struct urtwn_softc *);
264static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
265static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
266			    const uint8_t *, int);
267static int		urtwn_load_firmware(struct urtwn_softc *);
268static int		urtwn_r92c_dma_init(struct urtwn_softc *);
269static int		urtwn_r88e_dma_init(struct urtwn_softc *);
270static void		urtwn_mac_init(struct urtwn_softc *);
271static void		urtwn_bb_init(struct urtwn_softc *);
272static void		urtwn_rf_init(struct urtwn_softc *);
273static void		urtwn_cam_init(struct urtwn_softc *);
274static void		urtwn_pa_bias_init(struct urtwn_softc *);
275static void		urtwn_rxfilter_init(struct urtwn_softc *);
276static void		urtwn_edca_init(struct urtwn_softc *);
277static void		urtwn_write_txpower(struct urtwn_softc *, int,
278			    uint16_t[]);
279static void		urtwn_get_txpower(struct urtwn_softc *, int,
280		      	    struct ieee80211_channel *,
281			    struct ieee80211_channel *, uint16_t[]);
282static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
283		      	    struct ieee80211_channel *,
284			    struct ieee80211_channel *, uint16_t[]);
285static void		urtwn_set_txpower(struct urtwn_softc *,
286		    	    struct ieee80211_channel *,
287			    struct ieee80211_channel *);
288static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
289static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
290static void		urtwn_scan_start(struct ieee80211com *);
291static void		urtwn_scan_end(struct ieee80211com *);
292static void		urtwn_set_channel(struct ieee80211com *);
293static void		urtwn_set_promisc(struct urtwn_softc *);
294static void		urtwn_update_promisc(struct ieee80211com *);
295static void		urtwn_update_mcast(struct ieee80211com *);
296static void		urtwn_set_chan(struct urtwn_softc *,
297		    	    struct ieee80211_channel *,
298			    struct ieee80211_channel *);
299static void		urtwn_iq_calib(struct urtwn_softc *);
300static void		urtwn_lc_calib(struct urtwn_softc *);
301static void		urtwn_init(struct urtwn_softc *);
302static void		urtwn_stop(struct urtwn_softc *);
303static void		urtwn_abort_xfers(struct urtwn_softc *);
304static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
305			    const struct ieee80211_bpf_params *);
306static void		urtwn_ms_delay(struct urtwn_softc *);
307
308/* Aliases. */
309#define	urtwn_bb_write	urtwn_write_4
310#define urtwn_bb_read	urtwn_read_4
311
312static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
313	[URTWN_BULK_RX] = {
314		.type = UE_BULK,
315		.endpoint = UE_ADDR_ANY,
316		.direction = UE_DIR_IN,
317		.bufsize = URTWN_RXBUFSZ,
318		.flags = {
319			.pipe_bof = 1,
320			.short_xfer_ok = 1
321		},
322		.callback = urtwn_bulk_rx_callback,
323	},
324	[URTWN_BULK_TX_BE] = {
325		.type = UE_BULK,
326		.endpoint = 0x03,
327		.direction = UE_DIR_OUT,
328		.bufsize = URTWN_TXBUFSZ,
329		.flags = {
330			.ext_buffer = 1,
331			.pipe_bof = 1,
332			.force_short_xfer = 1
333		},
334		.callback = urtwn_bulk_tx_callback,
335		.timeout = URTWN_TX_TIMEOUT,	/* ms */
336	},
337	[URTWN_BULK_TX_BK] = {
338		.type = UE_BULK,
339		.endpoint = 0x03,
340		.direction = UE_DIR_OUT,
341		.bufsize = URTWN_TXBUFSZ,
342		.flags = {
343			.ext_buffer = 1,
344			.pipe_bof = 1,
345			.force_short_xfer = 1,
346		},
347		.callback = urtwn_bulk_tx_callback,
348		.timeout = URTWN_TX_TIMEOUT,	/* ms */
349	},
350	[URTWN_BULK_TX_VI] = {
351		.type = UE_BULK,
352		.endpoint = 0x02,
353		.direction = UE_DIR_OUT,
354		.bufsize = URTWN_TXBUFSZ,
355		.flags = {
356			.ext_buffer = 1,
357			.pipe_bof = 1,
358			.force_short_xfer = 1
359		},
360		.callback = urtwn_bulk_tx_callback,
361		.timeout = URTWN_TX_TIMEOUT,	/* ms */
362	},
363	[URTWN_BULK_TX_VO] = {
364		.type = UE_BULK,
365		.endpoint = 0x02,
366		.direction = UE_DIR_OUT,
367		.bufsize = URTWN_TXBUFSZ,
368		.flags = {
369			.ext_buffer = 1,
370			.pipe_bof = 1,
371			.force_short_xfer = 1
372		},
373		.callback = urtwn_bulk_tx_callback,
374		.timeout = URTWN_TX_TIMEOUT,	/* ms */
375	},
376};
377
378static int
379urtwn_match(device_t self)
380{
381	struct usb_attach_arg *uaa = device_get_ivars(self);
382
383	if (uaa->usb_mode != USB_MODE_HOST)
384		return (ENXIO);
385	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
386		return (ENXIO);
387	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
388		return (ENXIO);
389
390	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
391}
392
393static int
394urtwn_attach(device_t self)
395{
396	struct usb_attach_arg *uaa = device_get_ivars(self);
397	struct urtwn_softc *sc = device_get_softc(self);
398	struct ieee80211com *ic = &sc->sc_ic;
399	uint8_t iface_index, bands;
400	int error;
401
402	device_set_usb_desc(self);
403	sc->sc_udev = uaa->device;
404	sc->sc_dev = self;
405	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
406		sc->chip |= URTWN_CHIP_88E;
407
408	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
409	    MTX_NETWORK_LOCK, MTX_DEF);
410	callout_init(&sc->sc_watchdog_ch, 0);
411	mbufq_init(&sc->sc_snd, ifqmaxlen);
412
413	iface_index = URTWN_IFACE_INDEX;
414	error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
415	    urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
416	if (error) {
417		device_printf(self, "could not allocate USB transfers, "
418		    "err=%s\n", usbd_errstr(error));
419		goto detach;
420	}
421
422	URTWN_LOCK(sc);
423
424	error = urtwn_read_chipid(sc);
425	if (error) {
426		device_printf(sc->sc_dev, "unsupported test chip\n");
427		URTWN_UNLOCK(sc);
428		goto detach;
429	}
430
431	/* Determine number of Tx/Rx chains. */
432	if (sc->chip & URTWN_CHIP_92C) {
433		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
434		sc->nrxchains = 2;
435	} else {
436		sc->ntxchains = 1;
437		sc->nrxchains = 1;
438	}
439
440	if (sc->chip & URTWN_CHIP_88E)
441		error = urtwn_r88e_read_rom(sc);
442	else
443		error = urtwn_read_rom(sc);
444	if (error != 0) {
445		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
446		    __func__, error);
447		URTWN_UNLOCK(sc);
448		goto detach;
449	}
450
451	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
452	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
453	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
454	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
455	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
456	    "8188CUS", sc->ntxchains, sc->nrxchains);
457
458	URTWN_UNLOCK(sc);
459
460	ic->ic_softc = sc;
461	ic->ic_name = device_get_nameunit(self);
462	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
463	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
464
465	/* set device capabilities */
466	ic->ic_caps =
467		  IEEE80211_C_STA		/* station mode */
468		| IEEE80211_C_MONITOR		/* monitor mode */
469		| IEEE80211_C_IBSS		/* adhoc mode */
470		| IEEE80211_C_HOSTAP		/* hostap mode */
471		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
472		| IEEE80211_C_SHSLOT		/* short slot time supported */
473		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
474		| IEEE80211_C_WPA		/* 802.11i */
475		;
476
477	bands = 0;
478	setbit(&bands, IEEE80211_MODE_11B);
479	setbit(&bands, IEEE80211_MODE_11G);
480	ieee80211_init_channels(ic, NULL, &bands);
481
482	ieee80211_ifattach(ic);
483	ic->ic_raw_xmit = urtwn_raw_xmit;
484	ic->ic_scan_start = urtwn_scan_start;
485	ic->ic_scan_end = urtwn_scan_end;
486	ic->ic_set_channel = urtwn_set_channel;
487	ic->ic_transmit = urtwn_transmit;
488	ic->ic_parent = urtwn_parent;
489	ic->ic_vap_create = urtwn_vap_create;
490	ic->ic_vap_delete = urtwn_vap_delete;
491	ic->ic_update_promisc = urtwn_update_promisc;
492	ic->ic_update_mcast = urtwn_update_mcast;
493
494	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
495	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
496	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
497	    URTWN_RX_RADIOTAP_PRESENT);
498
499	if (bootverbose)
500		ieee80211_announce(ic);
501
502	return (0);
503
504detach:
505	urtwn_detach(self);
506	return (ENXIO);			/* failure */
507}
508
509static int
510urtwn_detach(device_t self)
511{
512	struct urtwn_softc *sc = device_get_softc(self);
513	struct ieee80211com *ic = &sc->sc_ic;
514	unsigned int x;
515
516	/* Prevent further ioctls. */
517	URTWN_LOCK(sc);
518	sc->sc_flags |= URTWN_DETACHED;
519	urtwn_stop(sc);
520	URTWN_UNLOCK(sc);
521
522	callout_drain(&sc->sc_watchdog_ch);
523
524	/* stop all USB transfers */
525	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
526
527	/* Prevent further allocations from RX/TX data lists. */
528	URTWN_LOCK(sc);
529	STAILQ_INIT(&sc->sc_tx_active);
530	STAILQ_INIT(&sc->sc_tx_inactive);
531	STAILQ_INIT(&sc->sc_tx_pending);
532
533	STAILQ_INIT(&sc->sc_rx_active);
534	STAILQ_INIT(&sc->sc_rx_inactive);
535	URTWN_UNLOCK(sc);
536
537	/* drain USB transfers */
538	for (x = 0; x != URTWN_N_TRANSFER; x++)
539		usbd_transfer_drain(sc->sc_xfer[x]);
540
541	/* Free data buffers. */
542	URTWN_LOCK(sc);
543	urtwn_free_tx_list(sc);
544	urtwn_free_rx_list(sc);
545	URTWN_UNLOCK(sc);
546
547	ieee80211_ifdetach(ic);
548	mtx_destroy(&sc->sc_mtx);
549
550	return (0);
551}
552
553static void
554urtwn_drain_mbufq(struct urtwn_softc *sc)
555{
556	struct mbuf *m;
557	struct ieee80211_node *ni;
558	URTWN_ASSERT_LOCKED(sc);
559	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
560		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
561		m->m_pkthdr.rcvif = NULL;
562		ieee80211_free_node(ni);
563		m_freem(m);
564	}
565}
566
567static usb_error_t
568urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
569    void *data)
570{
571	usb_error_t err;
572	int ntries = 10;
573
574	URTWN_ASSERT_LOCKED(sc);
575
576	while (ntries--) {
577		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
578		    req, data, 0, NULL, 250 /* ms */);
579		if (err == 0)
580			break;
581
582		DPRINTFN(1, "Control request failed, %s (retrying)\n",
583		    usbd_errstr(err));
584		usb_pause_mtx(&sc->sc_mtx, hz / 100);
585	}
586	return (err);
587}
588
589static struct ieee80211vap *
590urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
591    enum ieee80211_opmode opmode, int flags,
592    const uint8_t bssid[IEEE80211_ADDR_LEN],
593    const uint8_t mac[IEEE80211_ADDR_LEN])
594{
595	struct urtwn_softc *sc = ic->ic_softc;
596	struct urtwn_vap *uvp;
597	struct ieee80211vap *vap;
598
599	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
600		return (NULL);
601
602	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
603	vap = &uvp->vap;
604	/* enable s/w bmiss handling for sta mode */
605
606	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
607	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
608		/* out of memory */
609		free(uvp, M_80211_VAP);
610		return (NULL);
611	}
612
613	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
614		urtwn_init_beacon(sc, uvp);
615
616	/* override state transition machine */
617	uvp->newstate = vap->iv_newstate;
618	vap->iv_newstate = urtwn_newstate;
619	vap->iv_update_beacon = urtwn_update_beacon;
620	if (opmode == IEEE80211_M_IBSS) {
621		uvp->recv_mgmt = vap->iv_recv_mgmt;
622		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
623		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
624	}
625
626	/* complete setup */
627	ieee80211_vap_attach(vap, ieee80211_media_change,
628	    ieee80211_media_status, mac);
629	ic->ic_opmode = opmode;
630	return (vap);
631}
632
633static void
634urtwn_vap_delete(struct ieee80211vap *vap)
635{
636	struct ieee80211com *ic = vap->iv_ic;
637	struct urtwn_vap *uvp = URTWN_VAP(vap);
638
639	if (uvp->bcn_mbuf != NULL)
640		m_freem(uvp->bcn_mbuf);
641	if (vap->iv_opmode == IEEE80211_M_IBSS)
642		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
643	ieee80211_vap_detach(vap);
644	free(uvp, M_80211_VAP);
645}
646
647static struct mbuf *
648urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
649{
650	struct ieee80211com *ic = &sc->sc_ic;
651	struct ieee80211_frame *wh;
652	struct mbuf *m;
653	struct r92c_rx_stat *stat;
654	uint32_t rxdw0, rxdw3;
655	uint8_t rate;
656	int8_t rssi = 0;
657	int infosz;
658
659	/*
660	 * don't pass packets to the ieee80211 framework if the driver isn't
661	 * RUNNING.
662	 */
663	if (!(sc->sc_flags & URTWN_RUNNING))
664		return (NULL);
665
666	stat = (struct r92c_rx_stat *)buf;
667	rxdw0 = le32toh(stat->rxdw0);
668	rxdw3 = le32toh(stat->rxdw3);
669
670	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
671		/*
672		 * This should not happen since we setup our Rx filter
673		 * to not receive these frames.
674		 */
675		counter_u64_add(ic->ic_ierrors, 1);
676		return (NULL);
677	}
678	if (pktlen < sizeof(struct ieee80211_frame_ack) ||
679	    pktlen > MCLBYTES) {
680		counter_u64_add(ic->ic_ierrors, 1);
681		return (NULL);
682	}
683
684	rate = MS(rxdw3, R92C_RXDW3_RATE);
685	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
686
687	/* Get RSSI from PHY status descriptor if present. */
688	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
689		if (sc->chip & URTWN_CHIP_88E)
690			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
691		else
692			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
693		/* Update our average RSSI. */
694		urtwn_update_avgrssi(sc, rate, rssi);
695	}
696
697	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
698	if (m == NULL) {
699		device_printf(sc->sc_dev, "could not create RX mbuf\n");
700		return (NULL);
701	}
702
703	/* Finalize mbuf. */
704	wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
705	memcpy(mtod(m, uint8_t *), wh, pktlen);
706	m->m_pkthdr.len = m->m_len = pktlen;
707
708	if (ieee80211_radiotap_active(ic)) {
709		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
710
711		tap->wr_flags = 0;
712		/* Map HW rate index to 802.11 rate. */
713		if (!(rxdw3 & R92C_RXDW3_HT)) {
714			tap->wr_rate = ridx2rate[rate];
715		} else if (rate >= 12) {	/* MCS0~15. */
716			/* Bit 7 set means HT MCS instead of rate. */
717			tap->wr_rate = 0x80 | (rate - 12);
718		}
719		tap->wr_dbm_antsignal = rssi;
720		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
721		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
722		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
723	}
724
725	*rssi_p = rssi;
726
727	return (m);
728}
729
730static struct mbuf *
731urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
732    int8_t *nf)
733{
734	struct urtwn_softc *sc = data->sc;
735	struct ieee80211com *ic = &sc->sc_ic;
736	struct r92c_rx_stat *stat;
737	struct mbuf *m, *m0 = NULL, *prevm = NULL;
738	uint32_t rxdw0;
739	uint8_t *buf;
740	int len, totlen, pktlen, infosz, npkts;
741
742	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
743
744	if (len < sizeof(*stat)) {
745		counter_u64_add(ic->ic_ierrors, 1);
746		return (NULL);
747	}
748
749	buf = data->buf;
750	/* Get the number of encapsulated frames. */
751	stat = (struct r92c_rx_stat *)buf;
752	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
753	DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
754
755	/* Process all of them. */
756	while (npkts-- > 0) {
757		if (len < sizeof(*stat))
758			break;
759		stat = (struct r92c_rx_stat *)buf;
760		rxdw0 = le32toh(stat->rxdw0);
761
762		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
763		if (pktlen == 0)
764			break;
765
766		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
767
768		/* Make sure everything fits in xfer. */
769		totlen = sizeof(*stat) + infosz + pktlen;
770		if (totlen > len)
771			break;
772
773		m = urtwn_rx_frame(sc, buf, pktlen, rssi);
774		if (m0 == NULL)
775			m0 = m;
776		if (prevm == NULL)
777			prevm = m;
778		else {
779			prevm->m_next = m;
780			prevm = m;
781		}
782
783		/* Next chunk is 128-byte aligned. */
784		totlen = (totlen + 127) & ~127;
785		buf += totlen;
786		len -= totlen;
787	}
788
789	return (m0);
790}
791
792static void
793urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
794{
795	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
796	struct ieee80211com *ic = &sc->sc_ic;
797	struct ieee80211_frame_min *wh;
798	struct ieee80211_node *ni;
799	struct mbuf *m = NULL, *next;
800	struct urtwn_data *data;
801	int8_t nf;
802	int rssi = 1;
803
804	URTWN_ASSERT_LOCKED(sc);
805
806	switch (USB_GET_STATE(xfer)) {
807	case USB_ST_TRANSFERRED:
808		data = STAILQ_FIRST(&sc->sc_rx_active);
809		if (data == NULL)
810			goto tr_setup;
811		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
812		m = urtwn_rxeof(xfer, data, &rssi, &nf);
813		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
814		/* FALLTHROUGH */
815	case USB_ST_SETUP:
816tr_setup:
817		data = STAILQ_FIRST(&sc->sc_rx_inactive);
818		if (data == NULL) {
819			KASSERT(m == NULL, ("mbuf isn't NULL"));
820			return;
821		}
822		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
823		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
824		usbd_xfer_set_frame_data(xfer, 0, data->buf,
825		    usbd_xfer_max_len(xfer));
826		usbd_transfer_submit(xfer);
827
828		/*
829		 * To avoid LOR we should unlock our private mutex here to call
830		 * ieee80211_input() because here is at the end of a USB
831		 * callback and safe to unlock.
832		 */
833		URTWN_UNLOCK(sc);
834		while (m != NULL) {
835			next = m->m_next;
836			m->m_next = NULL;
837			wh = mtod(m, struct ieee80211_frame_min *);
838			if (m->m_len >= sizeof(*wh))
839				ni = ieee80211_find_rxnode(ic, wh);
840			else
841				ni = NULL;
842			nf = URTWN_NOISE_FLOOR;
843			if (ni != NULL) {
844				(void)ieee80211_input(ni, m, rssi - nf, nf);
845				ieee80211_free_node(ni);
846			} else {
847				(void)ieee80211_input_all(ic, m, rssi - nf,
848				    nf);
849			}
850			m = next;
851		}
852		URTWN_LOCK(sc);
853		break;
854	default:
855		/* needs it to the inactive queue due to a error. */
856		data = STAILQ_FIRST(&sc->sc_rx_active);
857		if (data != NULL) {
858			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
859			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
860		}
861		if (error != USB_ERR_CANCELLED) {
862			usbd_xfer_set_stall(xfer);
863			counter_u64_add(ic->ic_ierrors, 1);
864			goto tr_setup;
865		}
866		break;
867	}
868}
869
870static void
871urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
872{
873
874	URTWN_ASSERT_LOCKED(sc);
875
876	if (data->ni != NULL)	/* not a beacon frame */
877		ieee80211_tx_complete(data->ni, data->m, status);
878
879	data->ni = NULL;
880	data->m = NULL;
881
882	sc->sc_txtimer = 0;
883
884	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
885}
886
887static int
888urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
889    int ndata, int maxsz)
890{
891	int i, error;
892
893	for (i = 0; i < ndata; i++) {
894		struct urtwn_data *dp = &data[i];
895		dp->sc = sc;
896		dp->m = NULL;
897		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
898		if (dp->buf == NULL) {
899			device_printf(sc->sc_dev,
900			    "could not allocate buffer\n");
901			error = ENOMEM;
902			goto fail;
903		}
904		dp->ni = NULL;
905	}
906
907	return (0);
908fail:
909	urtwn_free_list(sc, data, ndata);
910	return (error);
911}
912
913static int
914urtwn_alloc_rx_list(struct urtwn_softc *sc)
915{
916        int error, i;
917
918	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
919	    URTWN_RXBUFSZ);
920	if (error != 0)
921		return (error);
922
923	STAILQ_INIT(&sc->sc_rx_active);
924	STAILQ_INIT(&sc->sc_rx_inactive);
925
926	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
927		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
928
929	return (0);
930}
931
932static int
933urtwn_alloc_tx_list(struct urtwn_softc *sc)
934{
935	int error, i;
936
937	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
938	    URTWN_TXBUFSZ);
939	if (error != 0)
940		return (error);
941
942	STAILQ_INIT(&sc->sc_tx_active);
943	STAILQ_INIT(&sc->sc_tx_inactive);
944	STAILQ_INIT(&sc->sc_tx_pending);
945
946	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
947		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
948
949	return (0);
950}
951
952static void
953urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
954{
955	int i;
956
957	for (i = 0; i < ndata; i++) {
958		struct urtwn_data *dp = &data[i];
959
960		if (dp->buf != NULL) {
961			free(dp->buf, M_USBDEV);
962			dp->buf = NULL;
963		}
964		if (dp->ni != NULL) {
965			ieee80211_free_node(dp->ni);
966			dp->ni = NULL;
967		}
968	}
969}
970
971static void
972urtwn_free_rx_list(struct urtwn_softc *sc)
973{
974	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
975}
976
977static void
978urtwn_free_tx_list(struct urtwn_softc *sc)
979{
980	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
981}
982
983static void
984urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
985{
986	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
987	struct urtwn_data *data;
988
989	URTWN_ASSERT_LOCKED(sc);
990
991	switch (USB_GET_STATE(xfer)){
992	case USB_ST_TRANSFERRED:
993		data = STAILQ_FIRST(&sc->sc_tx_active);
994		if (data == NULL)
995			goto tr_setup;
996		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
997		urtwn_txeof(sc, data, 0);
998		/* FALLTHROUGH */
999	case USB_ST_SETUP:
1000tr_setup:
1001		data = STAILQ_FIRST(&sc->sc_tx_pending);
1002		if (data == NULL) {
1003			DPRINTF("%s: empty pending queue\n", __func__);
1004			goto finish;
1005		}
1006		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1007		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1008		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1009		usbd_transfer_submit(xfer);
1010		break;
1011	default:
1012		data = STAILQ_FIRST(&sc->sc_tx_active);
1013		if (data == NULL)
1014			goto tr_setup;
1015		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1016		urtwn_txeof(sc, data, 1);
1017		if (error != USB_ERR_CANCELLED) {
1018			usbd_xfer_set_stall(xfer);
1019			goto tr_setup;
1020		}
1021		break;
1022	}
1023finish:
1024	/* Kick-start more transmit */
1025	urtwn_start(sc);
1026}
1027
1028static struct urtwn_data *
1029_urtwn_getbuf(struct urtwn_softc *sc)
1030{
1031	struct urtwn_data *bf;
1032
1033	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1034	if (bf != NULL)
1035		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1036	else
1037		DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
1038	return (bf);
1039}
1040
1041static struct urtwn_data *
1042urtwn_getbuf(struct urtwn_softc *sc)
1043{
1044        struct urtwn_data *bf;
1045
1046	URTWN_ASSERT_LOCKED(sc);
1047
1048	bf = _urtwn_getbuf(sc);
1049	if (bf == NULL)
1050		DPRINTF("%s: stop queue\n", __func__);
1051	return (bf);
1052}
1053
1054static int
1055urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1056    int len)
1057{
1058	usb_device_request_t req;
1059
1060	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1061	req.bRequest = R92C_REQ_REGS;
1062	USETW(req.wValue, addr);
1063	USETW(req.wIndex, 0);
1064	USETW(req.wLength, len);
1065	return (urtwn_do_request(sc, &req, buf));
1066}
1067
1068static void
1069urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1070{
1071	urtwn_write_region_1(sc, addr, &val, 1);
1072}
1073
1074
1075static void
1076urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1077{
1078	val = htole16(val);
1079	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1080}
1081
1082static void
1083urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1084{
1085	val = htole32(val);
1086	urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1087}
1088
1089static int
1090urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1091    int len)
1092{
1093	usb_device_request_t req;
1094
1095	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1096	req.bRequest = R92C_REQ_REGS;
1097	USETW(req.wValue, addr);
1098	USETW(req.wIndex, 0);
1099	USETW(req.wLength, len);
1100	return (urtwn_do_request(sc, &req, buf));
1101}
1102
1103static uint8_t
1104urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1105{
1106	uint8_t val;
1107
1108	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1109		return (0xff);
1110	return (val);
1111}
1112
1113static uint16_t
1114urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1115{
1116	uint16_t val;
1117
1118	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1119		return (0xffff);
1120	return (le16toh(val));
1121}
1122
1123static uint32_t
1124urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1125{
1126	uint32_t val;
1127
1128	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1129		return (0xffffffff);
1130	return (le32toh(val));
1131}
1132
1133static int
1134urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1135{
1136	struct r92c_fw_cmd cmd;
1137	int ntries;
1138
1139	/* Wait for current FW box to be empty. */
1140	for (ntries = 0; ntries < 100; ntries++) {
1141		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1142			break;
1143		urtwn_ms_delay(sc);
1144	}
1145	if (ntries == 100) {
1146		device_printf(sc->sc_dev,
1147		    "could not send firmware command\n");
1148		return (ETIMEDOUT);
1149	}
1150	memset(&cmd, 0, sizeof(cmd));
1151	cmd.id = id;
1152	if (len > 3)
1153		cmd.id |= R92C_CMD_FLAG_EXT;
1154	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1155	memcpy(cmd.msg, buf, len);
1156
1157	/* Write the first word last since that will trigger the FW. */
1158	urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1159	    (uint8_t *)&cmd + 4, 2);
1160	urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1161	    (uint8_t *)&cmd + 0, 4);
1162
1163	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1164	return (0);
1165}
1166
1167static __inline void
1168urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1169{
1170
1171	sc->sc_rf_write(sc, chain, addr, val);
1172}
1173
1174static void
1175urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1176    uint32_t val)
1177{
1178	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1179	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1180	    SM(R92C_LSSI_PARAM_DATA, val));
1181}
1182
1183static void
1184urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1185uint32_t val)
1186{
1187	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1188	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1189	    SM(R92C_LSSI_PARAM_DATA, val));
1190}
1191
1192static uint32_t
1193urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1194{
1195	uint32_t reg[R92C_MAX_CHAINS], val;
1196
1197	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1198	if (chain != 0)
1199		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1200
1201	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1202	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1203	urtwn_ms_delay(sc);
1204
1205	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1206	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1207	    R92C_HSSI_PARAM2_READ_EDGE);
1208	urtwn_ms_delay(sc);
1209
1210	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1211	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1212	urtwn_ms_delay(sc);
1213
1214	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1215		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1216	else
1217		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1218	return (MS(val, R92C_LSSI_READBACK_DATA));
1219}
1220
1221static int
1222urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1223{
1224	int ntries;
1225
1226	urtwn_write_4(sc, R92C_LLT_INIT,
1227	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1228	    SM(R92C_LLT_INIT_ADDR, addr) |
1229	    SM(R92C_LLT_INIT_DATA, data));
1230	/* Wait for write operation to complete. */
1231	for (ntries = 0; ntries < 20; ntries++) {
1232		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1233		    R92C_LLT_INIT_OP_NO_ACTIVE)
1234			return (0);
1235		urtwn_ms_delay(sc);
1236	}
1237	return (ETIMEDOUT);
1238}
1239
1240static int
1241urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1242{
1243	uint32_t reg;
1244	int ntries;
1245
1246	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1247		return (EFAULT);
1248
1249	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1250	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1251	reg &= ~R92C_EFUSE_CTRL_VALID;
1252
1253	urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1254	/* Wait for read operation to complete. */
1255	for (ntries = 0; ntries < 100; ntries++) {
1256		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1257		if (reg & R92C_EFUSE_CTRL_VALID)
1258			break;
1259		urtwn_ms_delay(sc);
1260	}
1261	if (ntries == 100) {
1262		device_printf(sc->sc_dev,
1263		    "could not read efuse byte at address 0x%x\n",
1264		    sc->last_rom_addr);
1265		return (ETIMEDOUT);
1266	}
1267
1268	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1269	sc->last_rom_addr++;
1270
1271	return (0);
1272}
1273
1274static int
1275urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1276    uint8_t msk)
1277{
1278	uint8_t reg;
1279	int i, error;
1280
1281	for (i = 0; i < 4; i++) {
1282		if (msk & (1 << i))
1283			continue;
1284		error = urtwn_efuse_read_next(sc, &reg);
1285		if (error != 0)
1286			return (error);
1287		DPRINTF("rom[0x%03X] == 0x%02X\n", off * 8 + i * 2, reg);
1288		rom[off * 8 + i * 2 + 0] = reg;
1289
1290		error = urtwn_efuse_read_next(sc, &reg);
1291		if (error != 0)
1292			return (error);
1293		DPRINTF("rom[0x%03X] == 0x%02X\n", off * 8 + i * 2 + 1, reg);
1294		rom[off * 8 + i * 2 + 1] = reg;
1295	}
1296
1297	return (0);
1298}
1299
1300#ifdef URTWN_DEBUG
1301static void
1302urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1303{
1304	int i;
1305
1306	/* Dump ROM contents. */
1307	device_printf(sc->sc_dev, "%s:", __func__);
1308	for (i = 0; i < size; i++) {
1309		if (i % 32 == 0)
1310			printf("\n%03X: ", i);
1311		else if (i % 4 == 0)
1312			printf(" ");
1313
1314		printf("%02X", rom[i]);
1315	}
1316	printf("\n");
1317}
1318#endif
1319
1320static int
1321urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1322{
1323#define URTWN_CHK(res) do {	\
1324	if ((error = res) != 0)	\
1325		goto end;	\
1326} while(0)
1327	uint8_t msk, off, reg;
1328	int error;
1329
1330	urtwn_efuse_switch_power(sc);
1331
1332	/* Read full ROM image. */
1333	sc->last_rom_addr = 0;
1334	memset(rom, 0xff, size);
1335
1336	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1337	while (reg != 0xff) {
1338		/* check for extended header */
1339		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1340			off = reg >> 5;
1341			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1342
1343			if ((reg & 0x0f) != 0x0f)
1344				off = ((reg & 0xf0) >> 1) | off;
1345			else
1346				continue;
1347		} else
1348			off = reg >> 4;
1349		msk = reg & 0xf;
1350
1351		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1352		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1353	}
1354
1355end:
1356
1357#ifdef URTWN_DEBUG
1358	if (urtwn_debug >= 2)
1359		urtwn_dump_rom_contents(sc, rom, size);
1360#endif
1361
1362	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1363
1364	if (error != 0) {
1365		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1366		    __func__);
1367	}
1368
1369	return (error);
1370#undef URTWN_CHK
1371}
1372
1373static void
1374urtwn_efuse_switch_power(struct urtwn_softc *sc)
1375{
1376	uint32_t reg;
1377
1378	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1379
1380	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1381	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1382		urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1383		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1384	}
1385	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1386	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1387		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1388		    reg | R92C_SYS_FUNC_EN_ELDR);
1389	}
1390	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1391	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1392	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1393		urtwn_write_2(sc, R92C_SYS_CLKR,
1394		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1395	}
1396}
1397
1398static int
1399urtwn_read_chipid(struct urtwn_softc *sc)
1400{
1401	uint32_t reg;
1402
1403	if (sc->chip & URTWN_CHIP_88E)
1404		return (0);
1405
1406	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1407	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1408		return (EIO);
1409
1410	if (reg & R92C_SYS_CFG_TYPE_92C) {
1411		sc->chip |= URTWN_CHIP_92C;
1412		/* Check if it is a castrated 8192C. */
1413		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1414		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1415		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1416			sc->chip |= URTWN_CHIP_92C_1T2R;
1417	}
1418	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1419		sc->chip |= URTWN_CHIP_UMC;
1420		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1421			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1422	}
1423	return (0);
1424}
1425
1426static int
1427urtwn_read_rom(struct urtwn_softc *sc)
1428{
1429	struct r92c_rom *rom = &sc->rom.r92c_rom;
1430	int error;
1431
1432	/* Read full ROM image. */
1433	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1434	if (error != 0)
1435		return (error);
1436
1437	/* XXX Weird but this is what the vendor driver does. */
1438	sc->last_rom_addr = 0x1fa;
1439	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1440	if (error != 0)
1441		return (error);
1442	DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1443
1444	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1445
1446	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1447	DPRINTF("regulatory type=%d\n", sc->regulatory);
1448	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1449
1450	sc->sc_rf_write = urtwn_r92c_rf_write;
1451	sc->sc_power_on = urtwn_r92c_power_on;
1452	sc->sc_dma_init = urtwn_r92c_dma_init;
1453
1454	return (0);
1455}
1456
1457static int
1458urtwn_r88e_read_rom(struct urtwn_softc *sc)
1459{
1460	uint8_t *rom = sc->rom.r88e_rom;
1461	uint16_t addr;
1462	int error, i;
1463
1464	error = urtwn_efuse_read(sc, rom, sizeof(sc->rom.r88e_rom));
1465	if (error != 0)
1466		return (error);
1467
1468	addr = 0x10;
1469	for (i = 0; i < 6; i++)
1470		sc->cck_tx_pwr[i] = rom[addr++];
1471	for (i = 0; i < 5; i++)
1472		sc->ht40_tx_pwr[i] = rom[addr++];
1473	sc->bw20_tx_pwr_diff = (rom[addr] & 0xf0) >> 4;
1474	if (sc->bw20_tx_pwr_diff & 0x08)
1475		sc->bw20_tx_pwr_diff |= 0xf0;
1476	sc->ofdm_tx_pwr_diff = (rom[addr] & 0xf);
1477	if (sc->ofdm_tx_pwr_diff & 0x08)
1478		sc->ofdm_tx_pwr_diff |= 0xf0;
1479	sc->regulatory = MS(rom[0xc1], R92C_ROM_RF1_REGULATORY);
1480	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, &rom[0xd7]);
1481
1482	sc->sc_rf_write = urtwn_r88e_rf_write;
1483	sc->sc_power_on = urtwn_r88e_power_on;
1484	sc->sc_dma_init = urtwn_r88e_dma_init;
1485
1486	return (0);
1487}
1488
1489/*
1490 * Initialize rate adaptation in firmware.
1491 */
1492static int
1493urtwn_ra_init(struct urtwn_softc *sc)
1494{
1495	struct ieee80211com *ic = &sc->sc_ic;
1496	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1497	struct ieee80211_node *ni;
1498	struct ieee80211_rateset *rs;
1499	struct r92c_fw_cmd_macid_cfg cmd;
1500	uint32_t rates, basicrates;
1501	uint8_t mode;
1502	int maxrate, maxbasicrate, error, i, j;
1503
1504	ni = ieee80211_ref_node(vap->iv_bss);
1505	rs = &ni->ni_rates;
1506
1507	/* Get normal and basic rates mask. */
1508	rates = basicrates = 0;
1509	maxrate = maxbasicrate = 0;
1510	for (i = 0; i < rs->rs_nrates; i++) {
1511		/* Convert 802.11 rate to HW rate index. */
1512		for (j = 0; j < nitems(ridx2rate); j++)
1513			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1514			    ridx2rate[j])
1515				break;
1516		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1517			continue;
1518		rates |= 1 << j;
1519		if (j > maxrate)
1520			maxrate = j;
1521		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1522			basicrates |= 1 << j;
1523			if (j > maxbasicrate)
1524				maxbasicrate = j;
1525		}
1526	}
1527	if (ic->ic_curmode == IEEE80211_MODE_11B)
1528		mode = R92C_RAID_11B;
1529	else
1530		mode = R92C_RAID_11BG;
1531	DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1532	    mode, rates, basicrates);
1533
1534	/* Set rates mask for group addressed frames. */
1535	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1536	cmd.mask = htole32(mode << 28 | basicrates);
1537	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1538	if (error != 0) {
1539		ieee80211_free_node(ni);
1540		device_printf(sc->sc_dev,
1541		    "could not add broadcast station\n");
1542		return (error);
1543	}
1544	/* Set initial MRR rate. */
1545	DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1546	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1547	    maxbasicrate);
1548
1549	/* Set rates mask for unicast frames. */
1550	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1551	cmd.mask = htole32(mode << 28 | rates);
1552	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1553	if (error != 0) {
1554		ieee80211_free_node(ni);
1555		device_printf(sc->sc_dev, "could not add BSS station\n");
1556		return (error);
1557	}
1558	/* Set initial MRR rate. */
1559	DPRINTF("maxrate=%d\n", maxrate);
1560	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1561	    maxrate);
1562
1563	/* Indicate highest supported rate. */
1564	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1565	ieee80211_free_node(ni);
1566
1567	return (0);
1568}
1569
1570static void
1571urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1572{
1573	struct r92c_tx_desc *txd = &uvp->bcn_desc;
1574
1575	txd->txdw0 = htole32(
1576	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
1577	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1578	txd->txdw1 = htole32(
1579	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
1580	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1581
1582	if (sc->chip & URTWN_CHIP_88E)
1583		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
1584	else
1585		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
1586
1587	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
1588	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
1589	txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
1590}
1591
1592static int
1593urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
1594{
1595 	struct ieee80211vap *vap = ni->ni_vap;
1596	struct urtwn_vap *uvp = URTWN_VAP(vap);
1597	struct mbuf *m;
1598	int error;
1599
1600	URTWN_ASSERT_LOCKED(sc);
1601
1602	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1603		return (EINVAL);
1604
1605	m = ieee80211_beacon_alloc(ni);
1606	if (m == NULL) {
1607		device_printf(sc->sc_dev,
1608		    "%s: could not allocate beacon frame\n", __func__);
1609		return (ENOMEM);
1610	}
1611
1612	if (uvp->bcn_mbuf != NULL)
1613		m_freem(uvp->bcn_mbuf);
1614
1615	uvp->bcn_mbuf = m;
1616
1617	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1618		return (error);
1619
1620	/* XXX bcnq stuck workaround */
1621	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
1622		return (error);
1623
1624	return (0);
1625}
1626
1627static void
1628urtwn_update_beacon(struct ieee80211vap *vap, int item)
1629{
1630	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1631	struct urtwn_vap *uvp = URTWN_VAP(vap);
1632	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
1633	struct ieee80211_node *ni = vap->iv_bss;
1634	int mcast = 0;
1635
1636	URTWN_LOCK(sc);
1637	if (uvp->bcn_mbuf == NULL) {
1638		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
1639		if (uvp->bcn_mbuf == NULL) {
1640			device_printf(sc->sc_dev,
1641			    "%s: could not allocate beacon frame\n", __func__);
1642			URTWN_UNLOCK(sc);
1643			return;
1644		}
1645	}
1646	URTWN_UNLOCK(sc);
1647
1648	if (item == IEEE80211_BEACON_TIM)
1649		mcast = 1;	/* XXX */
1650
1651	setbit(bo->bo_flags, item);
1652	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
1653
1654	URTWN_LOCK(sc);
1655	urtwn_tx_beacon(sc, uvp);
1656	URTWN_UNLOCK(sc);
1657}
1658
1659/*
1660 * Push a beacon frame into the chip. Beacon will
1661 * be repeated by the chip every R92C_BCN_INTERVAL.
1662 */
1663static int
1664urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
1665{
1666	struct r92c_tx_desc *desc = &uvp->bcn_desc;
1667	struct urtwn_data *bf;
1668
1669	URTWN_ASSERT_LOCKED(sc);
1670
1671	bf = urtwn_getbuf(sc);
1672	if (bf == NULL)
1673		return (ENOMEM);
1674
1675	memcpy(bf->buf, desc, sizeof(*desc));
1676	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
1677
1678	sc->sc_txtimer = 5;
1679	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1680
1681	return (0);
1682}
1683
1684static void
1685urtwn_tsf_task_adhoc(void *arg, int pending)
1686{
1687	struct ieee80211vap *vap = arg;
1688	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1689	struct ieee80211_node *ni;
1690	uint32_t reg;
1691
1692	URTWN_LOCK(sc);
1693	ni = ieee80211_ref_node(vap->iv_bss);
1694	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
1695
1696	/* Accept beacons with the same BSSID. */
1697	urtwn_set_rx_bssid_all(sc, 0);
1698
1699	/* Enable synchronization. */
1700	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
1701	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1702
1703	/* Synchronize. */
1704	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
1705
1706	/* Disable synchronization. */
1707	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
1708	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1709
1710	/* Remove beacon filter. */
1711	urtwn_set_rx_bssid_all(sc, 1);
1712
1713	/* Enable beaconing. */
1714	urtwn_write_1(sc, R92C_MBID_NUM,
1715	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1716	reg |= R92C_BCN_CTRL_EN_BCN;
1717
1718	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
1719	ieee80211_free_node(ni);
1720	URTWN_UNLOCK(sc);
1721}
1722
1723static void
1724urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
1725{
1726	struct ieee80211com *ic = &sc->sc_ic;
1727	struct urtwn_vap *uvp = URTWN_VAP(vap);
1728
1729	/* Reset TSF. */
1730	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1731
1732	switch (vap->iv_opmode) {
1733	case IEEE80211_M_STA:
1734		/* Enable TSF synchronization. */
1735		urtwn_write_1(sc, R92C_BCN_CTRL,
1736		    urtwn_read_1(sc, R92C_BCN_CTRL) &
1737		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1738		break;
1739	case IEEE80211_M_IBSS:
1740		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
1741		break;
1742	case IEEE80211_M_HOSTAP:
1743		/* Enable beaconing. */
1744		urtwn_write_1(sc, R92C_MBID_NUM,
1745		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
1746		urtwn_write_1(sc, R92C_BCN_CTRL,
1747		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1748		break;
1749	default:
1750		device_printf(sc->sc_dev, "undefined opmode %d\n",
1751		    vap->iv_opmode);
1752		return;
1753	}
1754}
1755
1756static void
1757urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1758{
1759	uint8_t reg;
1760
1761	if (led == URTWN_LED_LINK) {
1762		if (sc->chip & URTWN_CHIP_88E) {
1763			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1764			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1765			if (!on) {
1766				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1767				urtwn_write_1(sc, R92C_LEDCFG2,
1768				    reg | R92C_LEDCFG0_DIS);
1769				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1770				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1771				    0xfe);
1772			}
1773		} else {
1774			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1775			if (!on)
1776				reg |= R92C_LEDCFG0_DIS;
1777			urtwn_write_1(sc, R92C_LEDCFG0, reg);
1778		}
1779		sc->ledlink = on;       /* Save LED state. */
1780	}
1781}
1782
1783static void
1784urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
1785{
1786	uint8_t reg;
1787
1788	reg = urtwn_read_1(sc, R92C_MSR);
1789	reg = (reg & ~R92C_MSR_MASK) | mode;
1790	urtwn_write_1(sc, R92C_MSR, reg);
1791}
1792
1793static void
1794urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
1795    const struct ieee80211_rx_stats *rxs,
1796    int rssi, int nf)
1797{
1798	struct ieee80211vap *vap = ni->ni_vap;
1799	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
1800	struct urtwn_vap *uvp = URTWN_VAP(vap);
1801	uint64_t ni_tstamp, curr_tstamp;
1802
1803	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1804
1805	if (vap->iv_state == IEEE80211_S_RUN &&
1806	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
1807	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
1808		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
1809#ifdef D3831
1810		URTWN_LOCK(sc);
1811		urtwn_get_tsf(sc, &curr_tstamp);
1812		URTWN_UNLOCK(sc);
1813		curr_tstamp = le64toh(curr_tstamp);
1814
1815		if (ni_tstamp >= curr_tstamp)
1816			(void) ieee80211_ibss_merge(ni);
1817#else
1818		(void) sc;
1819		(void) curr_tstamp;
1820#endif
1821	}
1822}
1823
1824static int
1825urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1826{
1827	struct urtwn_vap *uvp = URTWN_VAP(vap);
1828	struct ieee80211com *ic = vap->iv_ic;
1829	struct urtwn_softc *sc = ic->ic_softc;
1830	struct ieee80211_node *ni;
1831	enum ieee80211_state ostate;
1832	uint32_t reg;
1833	uint8_t mode;
1834	int error = 0;
1835
1836	ostate = vap->iv_state;
1837	DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1838	    ieee80211_state_name[nstate]);
1839
1840	IEEE80211_UNLOCK(ic);
1841	URTWN_LOCK(sc);
1842	callout_stop(&sc->sc_watchdog_ch);
1843
1844	if (ostate == IEEE80211_S_RUN) {
1845		/* Turn link LED off. */
1846		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1847
1848		/* Set media status to 'No Link'. */
1849		urtwn_set_mode(sc, R92C_MSR_NOLINK);
1850
1851		/* Stop Rx of data frames. */
1852		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1853
1854		/* Disable TSF synchronization. */
1855		urtwn_write_1(sc, R92C_BCN_CTRL,
1856		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
1857		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1858
1859		/* Disable beaconing. */
1860		urtwn_write_1(sc, R92C_MBID_NUM,
1861		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
1862
1863		/* Reset TSF. */
1864		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
1865
1866		/* Reset EDCA parameters. */
1867		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1868		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1869		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1870		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1871	}
1872
1873	switch (nstate) {
1874	case IEEE80211_S_INIT:
1875		/* Turn link LED off. */
1876		urtwn_set_led(sc, URTWN_LED_LINK, 0);
1877		break;
1878	case IEEE80211_S_SCAN:
1879		/* Pause AC Tx queues. */
1880		urtwn_write_1(sc, R92C_TXPAUSE,
1881		    urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1882		break;
1883	case IEEE80211_S_AUTH:
1884		urtwn_set_chan(sc, ic->ic_curchan, NULL);
1885		break;
1886	case IEEE80211_S_RUN:
1887		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1888			/* Turn link LED on. */
1889			urtwn_set_led(sc, URTWN_LED_LINK, 1);
1890			break;
1891		}
1892
1893		ni = ieee80211_ref_node(vap->iv_bss);
1894
1895		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
1896		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
1897			device_printf(sc->sc_dev,
1898			    "%s: could not move to RUN state\n", __func__);
1899			error = EINVAL;
1900			goto end_run;
1901		}
1902
1903		switch (vap->iv_opmode) {
1904		case IEEE80211_M_STA:
1905			mode = R92C_MSR_INFRA;
1906			break;
1907		case IEEE80211_M_IBSS:
1908			mode = R92C_MSR_ADHOC;
1909			break;
1910		case IEEE80211_M_HOSTAP:
1911			mode = R92C_MSR_AP;
1912			break;
1913		default:
1914			device_printf(sc->sc_dev, "undefined opmode %d\n",
1915			    vap->iv_opmode);
1916			error = EINVAL;
1917			goto end_run;
1918		}
1919
1920		/* Set media status to 'Associated'. */
1921		urtwn_set_mode(sc, mode);
1922
1923		/* Set BSSID. */
1924		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1925		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1926
1927		if (ic->ic_curmode == IEEE80211_MODE_11B)
1928			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1929		else	/* 802.11b/g */
1930			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1931
1932		/* Enable Rx of data frames. */
1933		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1934
1935		/* Flush all AC queues. */
1936		urtwn_write_1(sc, R92C_TXPAUSE, 0);
1937
1938		/* Set beacon interval. */
1939		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1940
1941		/* Allow Rx from our BSSID only. */
1942		if (ic->ic_promisc == 0) {
1943			reg = urtwn_read_4(sc, R92C_RCR);
1944
1945			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
1946				reg |= R92C_RCR_CBSSID_DATA;
1947			if (vap->iv_opmode != IEEE80211_M_IBSS)
1948				reg |= R92C_RCR_CBSSID_BCN;
1949
1950			urtwn_write_4(sc, R92C_RCR, reg);
1951		}
1952
1953		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1954		    vap->iv_opmode == IEEE80211_M_IBSS) {
1955			error = urtwn_setup_beacon(sc, ni);
1956			if (error != 0) {
1957				device_printf(sc->sc_dev,
1958				    "unable to push beacon into the chip, "
1959				    "error %d\n", error);
1960				goto end_run;
1961			}
1962		}
1963
1964		/* Enable TSF synchronization. */
1965		urtwn_tsf_sync_enable(sc, vap);
1966
1967		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1968		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1969		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1970		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1971		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1972		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1973
1974		/* Intialize rate adaptation. */
1975		if (sc->chip & URTWN_CHIP_88E)
1976			ni->ni_txrate =
1977			    ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1978		else
1979			urtwn_ra_init(sc);
1980		/* Turn link LED on. */
1981		urtwn_set_led(sc, URTWN_LED_LINK, 1);
1982
1983		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1984		/* Reset temperature calibration state machine. */
1985		sc->thcal_state = 0;
1986		sc->thcal_lctemp = 0;
1987
1988end_run:
1989		ieee80211_free_node(ni);
1990		break;
1991	default:
1992		break;
1993	}
1994
1995	URTWN_UNLOCK(sc);
1996	IEEE80211_LOCK(ic);
1997	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
1998}
1999
2000static void
2001urtwn_watchdog(void *arg)
2002{
2003	struct urtwn_softc *sc = arg;
2004
2005	if (sc->sc_txtimer > 0) {
2006		if (--sc->sc_txtimer == 0) {
2007			device_printf(sc->sc_dev, "device timeout\n");
2008			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2009			return;
2010		}
2011		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2012	}
2013}
2014
2015static void
2016urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2017{
2018	int pwdb;
2019
2020	/* Convert antenna signal to percentage. */
2021	if (rssi <= -100 || rssi >= 20)
2022		pwdb = 0;
2023	else if (rssi >= 0)
2024		pwdb = 100;
2025	else
2026		pwdb = 100 + rssi;
2027	if (!(sc->chip & URTWN_CHIP_88E)) {
2028		if (rate <= URTWN_RIDX_CCK11) {
2029			/* CCK gain is smaller than OFDM/MCS gain. */
2030			pwdb += 6;
2031			if (pwdb > 100)
2032				pwdb = 100;
2033			if (pwdb <= 14)
2034				pwdb -= 4;
2035			else if (pwdb <= 26)
2036				pwdb -= 8;
2037			else if (pwdb <= 34)
2038				pwdb -= 6;
2039			else if (pwdb <= 42)
2040				pwdb -= 2;
2041		}
2042	}
2043	if (sc->avg_pwdb == -1)	/* Init. */
2044		sc->avg_pwdb = pwdb;
2045	else if (sc->avg_pwdb < pwdb)
2046		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2047	else
2048		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2049	DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
2050}
2051
2052static int8_t
2053urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2054{
2055	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2056	struct r92c_rx_phystat *phy;
2057	struct r92c_rx_cck *cck;
2058	uint8_t rpt;
2059	int8_t rssi;
2060
2061	if (rate <= URTWN_RIDX_CCK11) {
2062		cck = (struct r92c_rx_cck *)physt;
2063		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2064			rpt = (cck->agc_rpt >> 5) & 0x3;
2065			rssi = (cck->agc_rpt & 0x1f) << 1;
2066		} else {
2067			rpt = (cck->agc_rpt >> 6) & 0x3;
2068			rssi = cck->agc_rpt & 0x3e;
2069		}
2070		rssi = cckoff[rpt] - rssi;
2071	} else {	/* OFDM/HT. */
2072		phy = (struct r92c_rx_phystat *)physt;
2073		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2074	}
2075	return (rssi);
2076}
2077
2078static int8_t
2079urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2080{
2081	struct r92c_rx_phystat *phy;
2082	struct r88e_rx_cck *cck;
2083	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2084	int8_t rssi;
2085
2086	rssi = 0;
2087	if (rate <= URTWN_RIDX_CCK11) {
2088		cck = (struct r88e_rx_cck *)physt;
2089		cck_agc_rpt = cck->agc_rpt;
2090		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2091		vga_idx = cck_agc_rpt & 0x1f;
2092		switch (lna_idx) {
2093		case 7:
2094			if (vga_idx <= 27)
2095				rssi = -100 + 2* (27 - vga_idx);
2096			else
2097				rssi = -100;
2098			break;
2099		case 6:
2100			rssi = -48 + 2 * (2 - vga_idx);
2101			break;
2102		case 5:
2103			rssi = -42 + 2 * (7 - vga_idx);
2104			break;
2105		case 4:
2106			rssi = -36 + 2 * (7 - vga_idx);
2107			break;
2108		case 3:
2109			rssi = -24 + 2 * (7 - vga_idx);
2110			break;
2111		case 2:
2112			rssi = -12 + 2 * (5 - vga_idx);
2113			break;
2114		case 1:
2115			rssi = 8 - (2 * vga_idx);
2116			break;
2117		case 0:
2118			rssi = 14 - (2 * vga_idx);
2119			break;
2120		}
2121		rssi += 6;
2122	} else {	/* OFDM/HT. */
2123		phy = (struct r92c_rx_phystat *)physt;
2124		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2125	}
2126	return (rssi);
2127}
2128
2129static int
2130urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2131    struct mbuf *m, struct urtwn_data *data)
2132{
2133	struct ieee80211_frame *wh;
2134	struct ieee80211_key *k = NULL;
2135	struct ieee80211com *ic = &sc->sc_ic;
2136	struct ieee80211vap *vap = ni->ni_vap;
2137	struct r92c_tx_desc *txd;
2138	uint8_t macid, raid, ridx, subtype, type, qsel;
2139	int ismcast;
2140
2141	URTWN_ASSERT_LOCKED(sc);
2142
2143	/*
2144	 * Software crypto.
2145	 */
2146	wh = mtod(m, struct ieee80211_frame *);
2147	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2148	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2149	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2150
2151	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2152		k = ieee80211_crypto_encap(ni, m);
2153		if (k == NULL) {
2154			device_printf(sc->sc_dev,
2155			    "ieee80211_crypto_encap returns NULL.\n");
2156			return (ENOBUFS);
2157		}
2158
2159		/* in case packet header moved, reset pointer */
2160		wh = mtod(m, struct ieee80211_frame *);
2161	}
2162
2163	/* Fill Tx descriptor. */
2164	txd = (struct r92c_tx_desc *)data->buf;
2165	memset(txd, 0, sizeof(*txd));
2166
2167	txd->txdw0 |= htole32(
2168	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2169	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2170	if (ismcast)
2171		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2172
2173	raid = R92C_RAID_11B;	/* by default */
2174	ridx = URTWN_RIDX_CCK1;
2175	if (!ismcast) {
2176		macid = URTWN_MACID_BSS;
2177
2178		if (type == IEEE80211_FC0_TYPE_DATA) {
2179			qsel = R92C_TXDW1_QSEL_BE;
2180
2181			if (!(m->m_flags & M_EAPOL)) {
2182				if (ic->ic_curmode != IEEE80211_MODE_11B) {
2183					raid = R92C_RAID_11BG;
2184					ridx = URTWN_RIDX_OFDM54;
2185				} else
2186					ridx = URTWN_RIDX_CCK11;
2187			}
2188
2189			if (sc->chip & URTWN_CHIP_88E)
2190				txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
2191			else
2192				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2193
2194			if (ic->ic_flags & IEEE80211_F_USEPROT) {
2195				switch (ic->ic_protmode) {
2196				case IEEE80211_PROT_CTSONLY:
2197					txd->txdw4 |= htole32(
2198					    R92C_TXDW4_CTS2SELF |
2199					    R92C_TXDW4_HWRTSEN);
2200					break;
2201				case IEEE80211_PROT_RTSCTS:
2202					txd->txdw4 |= htole32(
2203					    R92C_TXDW4_RTSEN |
2204					    R92C_TXDW4_HWRTSEN);
2205					break;
2206				default:
2207					break;
2208				}
2209			}
2210			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2211			    URTWN_RIDX_OFDM24));
2212			txd->txdw5 |= htole32(0x0001ff00);
2213		} else	/* IEEE80211_FC0_TYPE_MGT */
2214			qsel = R92C_TXDW1_QSEL_MGNT;
2215	} else {
2216		macid = URTWN_MACID_BC;
2217		qsel = R92C_TXDW1_QSEL_MGNT;
2218	}
2219
2220	txd->txdw1 |= htole32(
2221	    SM(R92C_TXDW1_QSEL, qsel) |
2222	    SM(R92C_TXDW1_RAID, raid));
2223
2224	if (sc->chip & URTWN_CHIP_88E)
2225		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2226	else
2227		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2228
2229	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2230	/* not sure here */
2231	if (ridx <= URTWN_RIDX_CCK11)
2232		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2233
2234	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
2235		/* Use HW sequence numbering for non-QoS frames. */
2236		txd->txdseq = htole16(R92C_TXDSEQ_HWSEQ_EN);
2237	} else {
2238		/* Set sequence number. */
2239		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
2240	}
2241
2242	if (ieee80211_radiotap_active_vap(vap)) {
2243		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
2244
2245		tap->wt_flags = 0;
2246		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
2247		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
2248		if (k != NULL)
2249			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
2250		ieee80211_radiotap_tx(vap, m);
2251	}
2252
2253	data->ni = ni;
2254
2255	urtwn_tx_start(sc, m, type, data);
2256
2257	return (0);
2258}
2259
2260static void
2261urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
2262    struct urtwn_data *data)
2263{
2264	struct usb_xfer *xfer;
2265	struct r92c_tx_desc *txd;
2266	uint16_t ac, sum;
2267	int i, xferlen;
2268	struct usb_xfer *urtwn_pipes[WME_NUM_AC] = {
2269		sc->sc_xfer[URTWN_BULK_TX_BE],
2270		sc->sc_xfer[URTWN_BULK_TX_BK],
2271		sc->sc_xfer[URTWN_BULK_TX_VI],
2272		sc->sc_xfer[URTWN_BULK_TX_VO]
2273	};
2274
2275	URTWN_ASSERT_LOCKED(sc);
2276
2277	ac = M_WME_GETAC(m);
2278
2279	switch (type) {
2280	case IEEE80211_FC0_TYPE_CTL:
2281	case IEEE80211_FC0_TYPE_MGT:
2282		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
2283		break;
2284	default:
2285		xfer = urtwn_pipes[ac];
2286		break;
2287	}
2288
2289	txd = (struct r92c_tx_desc *)data->buf;
2290	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
2291
2292	/* Compute Tx descriptor checksum. */
2293	sum = 0;
2294	for (i = 0; i < sizeof(*txd) / 2; i++)
2295		sum ^= ((uint16_t *)txd)[i];
2296	txd->txdsum = sum;	/* NB: already little endian. */
2297
2298	xferlen = sizeof(*txd) + m->m_pkthdr.len;
2299	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
2300
2301	data->buflen = xferlen;
2302	data->m = m;
2303
2304	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
2305	usbd_transfer_start(xfer);
2306}
2307
2308static int
2309urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
2310{
2311	struct urtwn_softc *sc = ic->ic_softc;
2312	int error;
2313
2314	URTWN_LOCK(sc);
2315	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2316		URTWN_UNLOCK(sc);
2317		return (ENXIO);
2318	}
2319	error = mbufq_enqueue(&sc->sc_snd, m);
2320	if (error) {
2321		URTWN_UNLOCK(sc);
2322		return (error);
2323	}
2324	urtwn_start(sc);
2325	URTWN_UNLOCK(sc);
2326
2327	return (0);
2328}
2329
2330static void
2331urtwn_start(struct urtwn_softc *sc)
2332{
2333	struct ieee80211_node *ni;
2334	struct mbuf *m;
2335	struct urtwn_data *bf;
2336
2337	URTWN_ASSERT_LOCKED(sc);
2338	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
2339		bf = urtwn_getbuf(sc);
2340		if (bf == NULL) {
2341			mbufq_prepend(&sc->sc_snd, m);
2342			break;
2343		}
2344		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2345		m->m_pkthdr.rcvif = NULL;
2346		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
2347			if_inc_counter(ni->ni_vap->iv_ifp,
2348			    IFCOUNTER_OERRORS, 1);
2349			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
2350			m_freem(m);
2351			ieee80211_free_node(ni);
2352			break;
2353		}
2354		sc->sc_txtimer = 5;
2355		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2356	}
2357}
2358
2359static void
2360urtwn_parent(struct ieee80211com *ic)
2361{
2362	struct urtwn_softc *sc = ic->ic_softc;
2363	int startall = 0;
2364
2365	URTWN_LOCK(sc);
2366	if (sc->sc_flags & URTWN_DETACHED) {
2367		URTWN_UNLOCK(sc);
2368		return;
2369	}
2370	if (ic->ic_nrunning > 0) {
2371		if ((sc->sc_flags & URTWN_RUNNING) == 0) {
2372			urtwn_init(sc);
2373			startall = 1;
2374		}
2375	} else if (sc->sc_flags & URTWN_RUNNING)
2376		urtwn_stop(sc);
2377	URTWN_UNLOCK(sc);
2378
2379	if (startall)
2380		ieee80211_start_all(ic);
2381}
2382
2383static __inline int
2384urtwn_power_on(struct urtwn_softc *sc)
2385{
2386
2387	return sc->sc_power_on(sc);
2388}
2389
2390static int
2391urtwn_r92c_power_on(struct urtwn_softc *sc)
2392{
2393	uint32_t reg;
2394	int ntries;
2395
2396	/* Wait for autoload done bit. */
2397	for (ntries = 0; ntries < 1000; ntries++) {
2398		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2399			break;
2400		urtwn_ms_delay(sc);
2401	}
2402	if (ntries == 1000) {
2403		device_printf(sc->sc_dev,
2404		    "timeout waiting for chip autoload\n");
2405		return (ETIMEDOUT);
2406	}
2407
2408	/* Unlock ISO/CLK/Power control register. */
2409	urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2410	/* Move SPS into PWM mode. */
2411	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2412	urtwn_ms_delay(sc);
2413
2414	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2415	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2416		urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2417		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
2418		urtwn_ms_delay(sc);
2419		urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2420		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2421		    ~R92C_SYS_ISO_CTRL_MD2PP);
2422	}
2423
2424	/* Auto enable WLAN. */
2425	urtwn_write_2(sc, R92C_APS_FSMCO,
2426	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2427	for (ntries = 0; ntries < 1000; ntries++) {
2428		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2429		    R92C_APS_FSMCO_APFM_ONMAC))
2430			break;
2431		urtwn_ms_delay(sc);
2432	}
2433	if (ntries == 1000) {
2434		device_printf(sc->sc_dev,
2435		    "timeout waiting for MAC auto ON\n");
2436		return (ETIMEDOUT);
2437	}
2438
2439	/* Enable radio, GPIO and LED functions. */
2440	urtwn_write_2(sc, R92C_APS_FSMCO,
2441	    R92C_APS_FSMCO_AFSM_HSUS |
2442	    R92C_APS_FSMCO_PDN_EN |
2443	    R92C_APS_FSMCO_PFM_ALDN);
2444	/* Release RF digital isolation. */
2445	urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2446	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2447
2448	/* Initialize MAC. */
2449	urtwn_write_1(sc, R92C_APSD_CTRL,
2450	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2451	for (ntries = 0; ntries < 200; ntries++) {
2452		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2453		    R92C_APSD_CTRL_OFF_STATUS))
2454			break;
2455		urtwn_ms_delay(sc);
2456	}
2457	if (ntries == 200) {
2458		device_printf(sc->sc_dev,
2459		    "timeout waiting for MAC initialization\n");
2460		return (ETIMEDOUT);
2461	}
2462
2463	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2464	reg = urtwn_read_2(sc, R92C_CR);
2465	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2466	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2467	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2468	    R92C_CR_ENSEC;
2469	urtwn_write_2(sc, R92C_CR, reg);
2470
2471	urtwn_write_1(sc, 0xfe10, 0x19);
2472	return (0);
2473}
2474
2475static int
2476urtwn_r88e_power_on(struct urtwn_softc *sc)
2477{
2478	uint32_t reg;
2479	int ntries;
2480
2481	/* Wait for power ready bit. */
2482	for (ntries = 0; ntries < 5000; ntries++) {
2483		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2484			break;
2485		urtwn_ms_delay(sc);
2486	}
2487	if (ntries == 5000) {
2488		device_printf(sc->sc_dev,
2489		    "timeout waiting for chip power up\n");
2490		return (ETIMEDOUT);
2491	}
2492
2493	/* Reset BB. */
2494	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2495	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2496	    R92C_SYS_FUNC_EN_BB_GLB_RST));
2497
2498	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2499	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2500
2501	/* Disable HWPDN. */
2502	urtwn_write_2(sc, R92C_APS_FSMCO,
2503	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2504
2505	/* Disable WL suspend. */
2506	urtwn_write_2(sc, R92C_APS_FSMCO,
2507	    urtwn_read_2(sc, R92C_APS_FSMCO) &
2508	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2509
2510	urtwn_write_2(sc, R92C_APS_FSMCO,
2511	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2512	for (ntries = 0; ntries < 5000; ntries++) {
2513		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2514		    R92C_APS_FSMCO_APFM_ONMAC))
2515			break;
2516		urtwn_ms_delay(sc);
2517	}
2518	if (ntries == 5000)
2519		return (ETIMEDOUT);
2520
2521	/* Enable LDO normal mode. */
2522	urtwn_write_1(sc, R92C_LPLDO_CTRL,
2523	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2524
2525	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2526	urtwn_write_2(sc, R92C_CR, 0);
2527	reg = urtwn_read_2(sc, R92C_CR);
2528	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2529	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2530	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2531	urtwn_write_2(sc, R92C_CR, reg);
2532
2533	return (0);
2534}
2535
2536static int
2537urtwn_llt_init(struct urtwn_softc *sc)
2538{
2539	int i, error, page_count, pktbuf_count;
2540
2541	page_count = (sc->chip & URTWN_CHIP_88E) ?
2542	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2543	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2544	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2545
2546	/* Reserve pages [0; page_count]. */
2547	for (i = 0; i < page_count; i++) {
2548		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2549			return (error);
2550	}
2551	/* NB: 0xff indicates end-of-list. */
2552	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2553		return (error);
2554	/*
2555	 * Use pages [page_count + 1; pktbuf_count - 1]
2556	 * as ring buffer.
2557	 */
2558	for (++i; i < pktbuf_count - 1; i++) {
2559		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2560			return (error);
2561	}
2562	/* Make the last page point to the beginning of the ring buffer. */
2563	error = urtwn_llt_write(sc, i, page_count + 1);
2564	return (error);
2565}
2566
2567static void
2568urtwn_fw_reset(struct urtwn_softc *sc)
2569{
2570	uint16_t reg;
2571	int ntries;
2572
2573	/* Tell 8051 to reset itself. */
2574	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2575
2576	/* Wait until 8051 resets by itself. */
2577	for (ntries = 0; ntries < 100; ntries++) {
2578		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2579		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2580			return;
2581		urtwn_ms_delay(sc);
2582	}
2583	/* Force 8051 reset. */
2584	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2585}
2586
2587static void
2588urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2589{
2590	uint16_t reg;
2591
2592	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2593	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2594	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2595}
2596
2597static int
2598urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2599{
2600	uint32_t reg;
2601	int off, mlen, error = 0;
2602
2603	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2604	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2605	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2606
2607	off = R92C_FW_START_ADDR;
2608	while (len > 0) {
2609		if (len > 196)
2610			mlen = 196;
2611		else if (len > 4)
2612			mlen = 4;
2613		else
2614			mlen = 1;
2615		/* XXX fix this deconst */
2616		error = urtwn_write_region_1(sc, off,
2617		    __DECONST(uint8_t *, buf), mlen);
2618		if (error != 0)
2619			break;
2620		off += mlen;
2621		buf += mlen;
2622		len -= mlen;
2623	}
2624	return (error);
2625}
2626
2627static int
2628urtwn_load_firmware(struct urtwn_softc *sc)
2629{
2630	const struct firmware *fw;
2631	const struct r92c_fw_hdr *hdr;
2632	const char *imagename;
2633	const u_char *ptr;
2634	size_t len;
2635	uint32_t reg;
2636	int mlen, ntries, page, error;
2637
2638	URTWN_UNLOCK(sc);
2639	/* Read firmware image from the filesystem. */
2640	if (sc->chip & URTWN_CHIP_88E)
2641		imagename = "urtwn-rtl8188eufw";
2642	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2643		    URTWN_CHIP_UMC_A_CUT)
2644		imagename = "urtwn-rtl8192cfwU";
2645	else
2646		imagename = "urtwn-rtl8192cfwT";
2647
2648	fw = firmware_get(imagename);
2649	URTWN_LOCK(sc);
2650	if (fw == NULL) {
2651		device_printf(sc->sc_dev,
2652		    "failed loadfirmware of file %s\n", imagename);
2653		return (ENOENT);
2654	}
2655
2656	len = fw->datasize;
2657
2658	if (len < sizeof(*hdr)) {
2659		device_printf(sc->sc_dev, "firmware too short\n");
2660		error = EINVAL;
2661		goto fail;
2662	}
2663	ptr = fw->data;
2664	hdr = (const struct r92c_fw_hdr *)ptr;
2665	/* Check if there is a valid FW header and skip it. */
2666	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2667	    (le16toh(hdr->signature) >> 4) == 0x88e ||
2668	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2669		DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2670		    le16toh(hdr->version), le16toh(hdr->subversion),
2671		    hdr->month, hdr->date, hdr->hour, hdr->minute);
2672		ptr += sizeof(*hdr);
2673		len -= sizeof(*hdr);
2674	}
2675
2676	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2677		if (sc->chip & URTWN_CHIP_88E)
2678			urtwn_r88e_fw_reset(sc);
2679		else
2680			urtwn_fw_reset(sc);
2681		urtwn_write_1(sc, R92C_MCUFWDL, 0);
2682	}
2683
2684	if (!(sc->chip & URTWN_CHIP_88E)) {
2685		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2686		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2687		    R92C_SYS_FUNC_EN_CPUEN);
2688	}
2689	urtwn_write_1(sc, R92C_MCUFWDL,
2690	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2691	urtwn_write_1(sc, R92C_MCUFWDL + 2,
2692	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2693
2694	/* Reset the FWDL checksum. */
2695	urtwn_write_1(sc, R92C_MCUFWDL,
2696	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2697
2698	for (page = 0; len > 0; page++) {
2699		mlen = min(len, R92C_FW_PAGE_SIZE);
2700		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2701		if (error != 0) {
2702			device_printf(sc->sc_dev,
2703			    "could not load firmware page\n");
2704			goto fail;
2705		}
2706		ptr += mlen;
2707		len -= mlen;
2708	}
2709	urtwn_write_1(sc, R92C_MCUFWDL,
2710	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2711	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2712
2713	/* Wait for checksum report. */
2714	for (ntries = 0; ntries < 1000; ntries++) {
2715		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2716			break;
2717		urtwn_ms_delay(sc);
2718	}
2719	if (ntries == 1000) {
2720		device_printf(sc->sc_dev,
2721		    "timeout waiting for checksum report\n");
2722		error = ETIMEDOUT;
2723		goto fail;
2724	}
2725
2726	reg = urtwn_read_4(sc, R92C_MCUFWDL);
2727	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2728	urtwn_write_4(sc, R92C_MCUFWDL, reg);
2729	if (sc->chip & URTWN_CHIP_88E)
2730		urtwn_r88e_fw_reset(sc);
2731	/* Wait for firmware readiness. */
2732	for (ntries = 0; ntries < 1000; ntries++) {
2733		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2734			break;
2735		urtwn_ms_delay(sc);
2736	}
2737	if (ntries == 1000) {
2738		device_printf(sc->sc_dev,
2739		    "timeout waiting for firmware readiness\n");
2740		error = ETIMEDOUT;
2741		goto fail;
2742	}
2743fail:
2744	firmware_put(fw, FIRMWARE_UNLOAD);
2745	return (error);
2746}
2747
2748static __inline int
2749urtwn_dma_init(struct urtwn_softc *sc)
2750{
2751	int error;
2752
2753	/* Initialize LLT table. */
2754	error = urtwn_llt_init(sc);
2755	if (error != 0)
2756		return (error);
2757
2758	error = sc->sc_dma_init(sc);
2759	if (error != 0)
2760		return (error);
2761
2762	/* Set Tx/Rx transfer page size. */
2763	urtwn_write_1(sc, R92C_PBP,
2764	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2765	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2766
2767	return (0);
2768}
2769
2770static int
2771urtwn_r92c_dma_init(struct urtwn_softc *sc)
2772{
2773	int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2774	uint32_t reg;
2775
2776	/* Get Tx queues to USB endpoints mapping. */
2777	hashq = hasnq = haslq = 0;
2778	reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2779	DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2780	if (MS(reg, R92C_USB_EP_HQ) != 0)
2781		hashq = 1;
2782	if (MS(reg, R92C_USB_EP_NQ) != 0)
2783		hasnq = 1;
2784	if (MS(reg, R92C_USB_EP_LQ) != 0)
2785		haslq = 1;
2786	nqueues = hashq + hasnq + haslq;
2787	if (nqueues == 0)
2788		return (EIO);
2789	/* Get the number of pages for each queue. */
2790	nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2791	/* The remaining pages are assigned to the high priority queue. */
2792	nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2793
2794	/* Set number of pages for normal priority queue. */
2795	urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2796	urtwn_write_4(sc, R92C_RQPN,
2797	    /* Set number of pages for public queue. */
2798	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2799	    /* Set number of pages for high priority queue. */
2800	    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2801	    /* Set number of pages for low priority queue. */
2802	    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2803	    /* Load values. */
2804	    R92C_RQPN_LD);
2805
2806	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2807	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2808	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2809	urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2810	urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2811
2812	/* Set queue to USB pipe mapping. */
2813	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2814	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2815	if (nqueues == 1) {
2816		if (hashq)
2817			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2818		else if (hasnq)
2819			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2820		else
2821			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2822	} else if (nqueues == 2) {
2823		/* All 2-endpoints configs have a high priority queue. */
2824		if (!hashq)
2825			return (EIO);
2826		if (hasnq)
2827			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2828		else
2829			reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2830	} else
2831		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2832	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2833
2834	/* Set Tx/Rx transfer page boundary. */
2835	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2836
2837	return (0);
2838}
2839
2840static int
2841urtwn_r88e_dma_init(struct urtwn_softc *sc)
2842{
2843	struct usb_interface *iface;
2844	uint32_t reg;
2845	int nqueues;
2846
2847	/* Get Tx queues to USB endpoints mapping. */
2848	iface = usbd_get_iface(sc->sc_udev, 0);
2849	nqueues = iface->idesc->bNumEndpoints - 1;
2850	if (nqueues == 0)
2851		return (EIO);
2852
2853	/* Set number of pages for normal priority queue. */
2854	urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2855	urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2856
2857	urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2858	urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2859	urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2860	urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2861	urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2862
2863	/* Set queue to USB pipe mapping. */
2864	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2865	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2866	if (nqueues == 1)
2867		reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2868	else if (nqueues == 2)
2869		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2870	else
2871		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2872	urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2873
2874	/* Set Tx/Rx transfer page boundary. */
2875	urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2876
2877	return (0);
2878}
2879
2880static void
2881urtwn_mac_init(struct urtwn_softc *sc)
2882{
2883	int i;
2884
2885	/* Write MAC initialization values. */
2886	if (sc->chip & URTWN_CHIP_88E) {
2887		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2888			urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2889			    rtl8188eu_mac[i].val);
2890		}
2891		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2892	} else {
2893		for (i = 0; i < nitems(rtl8192cu_mac); i++)
2894			urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2895			    rtl8192cu_mac[i].val);
2896	}
2897}
2898
2899static void
2900urtwn_bb_init(struct urtwn_softc *sc)
2901{
2902	const struct urtwn_bb_prog *prog;
2903	uint32_t reg;
2904	uint8_t crystalcap;
2905	int i;
2906
2907	/* Enable BB and RF. */
2908	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2909	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2910	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2911	    R92C_SYS_FUNC_EN_DIO_RF);
2912
2913	if (!(sc->chip & URTWN_CHIP_88E))
2914		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2915
2916	urtwn_write_1(sc, R92C_RF_CTRL,
2917	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2918	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2919	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2920	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2921
2922	if (!(sc->chip & URTWN_CHIP_88E)) {
2923		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2924		urtwn_write_1(sc, 0x15, 0xe9);
2925		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2926	}
2927
2928	/* Select BB programming based on board type. */
2929	if (sc->chip & URTWN_CHIP_88E)
2930		prog = &rtl8188eu_bb_prog;
2931	else if (!(sc->chip & URTWN_CHIP_92C)) {
2932		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2933			prog = &rtl8188ce_bb_prog;
2934		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2935			prog = &rtl8188ru_bb_prog;
2936		else
2937			prog = &rtl8188cu_bb_prog;
2938	} else {
2939		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2940			prog = &rtl8192ce_bb_prog;
2941		else
2942			prog = &rtl8192cu_bb_prog;
2943	}
2944	/* Write BB initialization values. */
2945	for (i = 0; i < prog->count; i++) {
2946		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2947		urtwn_ms_delay(sc);
2948	}
2949
2950	if (sc->chip & URTWN_CHIP_92C_1T2R) {
2951		/* 8192C 1T only configuration. */
2952		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2953		reg = (reg & ~0x00000003) | 0x2;
2954		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2955
2956		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2957		reg = (reg & ~0x00300033) | 0x00200022;
2958		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2959
2960		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2961		reg = (reg & ~0xff000000) | 0x45 << 24;
2962		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2963
2964		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2965		reg = (reg & ~0x000000ff) | 0x23;
2966		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2967
2968		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2969		reg = (reg & ~0x00000030) | 1 << 4;
2970		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2971
2972		reg = urtwn_bb_read(sc, 0xe74);
2973		reg = (reg & ~0x0c000000) | 2 << 26;
2974		urtwn_bb_write(sc, 0xe74, reg);
2975		reg = urtwn_bb_read(sc, 0xe78);
2976		reg = (reg & ~0x0c000000) | 2 << 26;
2977		urtwn_bb_write(sc, 0xe78, reg);
2978		reg = urtwn_bb_read(sc, 0xe7c);
2979		reg = (reg & ~0x0c000000) | 2 << 26;
2980		urtwn_bb_write(sc, 0xe7c, reg);
2981		reg = urtwn_bb_read(sc, 0xe80);
2982		reg = (reg & ~0x0c000000) | 2 << 26;
2983		urtwn_bb_write(sc, 0xe80, reg);
2984		reg = urtwn_bb_read(sc, 0xe88);
2985		reg = (reg & ~0x0c000000) | 2 << 26;
2986		urtwn_bb_write(sc, 0xe88, reg);
2987	}
2988
2989	/* Write AGC values. */
2990	for (i = 0; i < prog->agccount; i++) {
2991		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2992		    prog->agcvals[i]);
2993		urtwn_ms_delay(sc);
2994	}
2995
2996	if (sc->chip & URTWN_CHIP_88E) {
2997		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2998		urtwn_ms_delay(sc);
2999		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
3000		urtwn_ms_delay(sc);
3001
3002		crystalcap = sc->rom.r88e_rom[0xb9];
3003		if (crystalcap == 0xff)
3004			crystalcap = 0x20;
3005		crystalcap &= 0x3f;
3006		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
3007		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
3008		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
3009		    crystalcap | crystalcap << 6));
3010	} else {
3011		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
3012		    R92C_HSSI_PARAM2_CCK_HIPWR)
3013			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
3014	}
3015}
3016
3017static void
3018urtwn_rf_init(struct urtwn_softc *sc)
3019{
3020	const struct urtwn_rf_prog *prog;
3021	uint32_t reg, type;
3022	int i, j, idx, off;
3023
3024	/* Select RF programming based on board type. */
3025	if (sc->chip & URTWN_CHIP_88E)
3026		prog = rtl8188eu_rf_prog;
3027	else if (!(sc->chip & URTWN_CHIP_92C)) {
3028		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
3029			prog = rtl8188ce_rf_prog;
3030		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3031			prog = rtl8188ru_rf_prog;
3032		else
3033			prog = rtl8188cu_rf_prog;
3034	} else
3035		prog = rtl8192ce_rf_prog;
3036
3037	for (i = 0; i < sc->nrxchains; i++) {
3038		/* Save RF_ENV control type. */
3039		idx = i / 2;
3040		off = (i % 2) * 16;
3041		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3042		type = (reg >> off) & 0x10;
3043
3044		/* Set RF_ENV enable. */
3045		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3046		reg |= 0x100000;
3047		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3048		urtwn_ms_delay(sc);
3049		/* Set RF_ENV output high. */
3050		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
3051		reg |= 0x10;
3052		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
3053		urtwn_ms_delay(sc);
3054		/* Set address and data lengths of RF registers. */
3055		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3056		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
3057		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3058		urtwn_ms_delay(sc);
3059		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
3060		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
3061		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
3062		urtwn_ms_delay(sc);
3063
3064		/* Write RF initialization values for this chain. */
3065		for (j = 0; j < prog[i].count; j++) {
3066			if (prog[i].regs[j] >= 0xf9 &&
3067			    prog[i].regs[j] <= 0xfe) {
3068				/*
3069				 * These are fake RF registers offsets that
3070				 * indicate a delay is required.
3071				 */
3072				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
3073				continue;
3074			}
3075			urtwn_rf_write(sc, i, prog[i].regs[j],
3076			    prog[i].vals[j]);
3077			urtwn_ms_delay(sc);
3078		}
3079
3080		/* Restore RF_ENV control type. */
3081		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
3082		reg &= ~(0x10 << off) | (type << off);
3083		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
3084
3085		/* Cache RF register CHNLBW. */
3086		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
3087	}
3088
3089	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3090	    URTWN_CHIP_UMC_A_CUT) {
3091		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
3092		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
3093	}
3094}
3095
3096static void
3097urtwn_cam_init(struct urtwn_softc *sc)
3098{
3099	/* Invalidate all CAM entries. */
3100	urtwn_write_4(sc, R92C_CAMCMD,
3101	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
3102}
3103
3104static void
3105urtwn_pa_bias_init(struct urtwn_softc *sc)
3106{
3107	uint8_t reg;
3108	int i;
3109
3110	for (i = 0; i < sc->nrxchains; i++) {
3111		if (sc->pa_setting & (1 << i))
3112			continue;
3113		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
3114		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
3115		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
3116		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
3117	}
3118	if (!(sc->pa_setting & 0x10)) {
3119		reg = urtwn_read_1(sc, 0x16);
3120		reg = (reg & ~0xf0) | 0x90;
3121		urtwn_write_1(sc, 0x16, reg);
3122	}
3123}
3124
3125static void
3126urtwn_rxfilter_init(struct urtwn_softc *sc)
3127{
3128	struct ieee80211com *ic = &sc->sc_ic;
3129	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3130	uint32_t rcr;
3131	uint16_t filter;
3132
3133	URTWN_ASSERT_LOCKED(sc);
3134
3135	/* Accept all multicast frames. */
3136	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
3137	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
3138
3139	/* Filter for management frames. */
3140	filter = 0x7f3f;
3141	switch (vap->iv_opmode) {
3142	case IEEE80211_M_STA:
3143		filter &= ~(
3144		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
3145		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
3146		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
3147		break;
3148	case IEEE80211_M_HOSTAP:
3149		filter &= ~(
3150		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
3151		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP) |
3152		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_BEACON));
3153		break;
3154	case IEEE80211_M_MONITOR:
3155	case IEEE80211_M_IBSS:
3156		break;
3157	default:
3158		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3159		    __func__, vap->iv_opmode);
3160		break;
3161	}
3162	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
3163
3164	/* Reject all control frames. */
3165	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
3166
3167	/* Reject all data frames. */
3168	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
3169
3170	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
3171	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
3172	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
3173
3174	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
3175		/* Accept all frames. */
3176		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
3177		       R92C_RCR_AAP;
3178	}
3179
3180	/* Set Rx filter. */
3181	urtwn_write_4(sc, R92C_RCR, rcr);
3182
3183	if (ic->ic_promisc != 0) {
3184		/* Update Rx filter. */
3185		urtwn_set_promisc(sc);
3186	}
3187}
3188
3189static void
3190urtwn_edca_init(struct urtwn_softc *sc)
3191{
3192	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
3193	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
3194	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
3195	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
3196	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
3197	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
3198	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
3199	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
3200}
3201
3202static void
3203urtwn_write_txpower(struct urtwn_softc *sc, int chain,
3204    uint16_t power[URTWN_RIDX_COUNT])
3205{
3206	uint32_t reg;
3207
3208	/* Write per-CCK rate Tx power. */
3209	if (chain == 0) {
3210		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
3211		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
3212		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
3213		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3214		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
3215		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
3216		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
3217		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3218	} else {
3219		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
3220		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
3221		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
3222		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
3223		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
3224		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
3225		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
3226		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
3227	}
3228	/* Write per-OFDM rate Tx power. */
3229	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
3230	    SM(R92C_TXAGC_RATE06, power[ 4]) |
3231	    SM(R92C_TXAGC_RATE09, power[ 5]) |
3232	    SM(R92C_TXAGC_RATE12, power[ 6]) |
3233	    SM(R92C_TXAGC_RATE18, power[ 7]));
3234	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
3235	    SM(R92C_TXAGC_RATE24, power[ 8]) |
3236	    SM(R92C_TXAGC_RATE36, power[ 9]) |
3237	    SM(R92C_TXAGC_RATE48, power[10]) |
3238	    SM(R92C_TXAGC_RATE54, power[11]));
3239	/* Write per-MCS Tx power. */
3240	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
3241	    SM(R92C_TXAGC_MCS00,  power[12]) |
3242	    SM(R92C_TXAGC_MCS01,  power[13]) |
3243	    SM(R92C_TXAGC_MCS02,  power[14]) |
3244	    SM(R92C_TXAGC_MCS03,  power[15]));
3245	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
3246	    SM(R92C_TXAGC_MCS04,  power[16]) |
3247	    SM(R92C_TXAGC_MCS05,  power[17]) |
3248	    SM(R92C_TXAGC_MCS06,  power[18]) |
3249	    SM(R92C_TXAGC_MCS07,  power[19]));
3250	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
3251	    SM(R92C_TXAGC_MCS08,  power[20]) |
3252	    SM(R92C_TXAGC_MCS09,  power[21]) |
3253	    SM(R92C_TXAGC_MCS10,  power[22]) |
3254	    SM(R92C_TXAGC_MCS11,  power[23]));
3255	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
3256	    SM(R92C_TXAGC_MCS12,  power[24]) |
3257	    SM(R92C_TXAGC_MCS13,  power[25]) |
3258	    SM(R92C_TXAGC_MCS14,  power[26]) |
3259	    SM(R92C_TXAGC_MCS15,  power[27]));
3260}
3261
3262static void
3263urtwn_get_txpower(struct urtwn_softc *sc, int chain,
3264    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3265    uint16_t power[URTWN_RIDX_COUNT])
3266{
3267	struct ieee80211com *ic = &sc->sc_ic;
3268	struct r92c_rom *rom = &sc->rom.r92c_rom;
3269	uint16_t cckpow, ofdmpow, htpow, diff, max;
3270	const struct urtwn_txpwr *base;
3271	int ridx, chan, group;
3272
3273	/* Determine channel group. */
3274	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3275	if (chan <= 3)
3276		group = 0;
3277	else if (chan <= 9)
3278		group = 1;
3279	else
3280		group = 2;
3281
3282	/* Get original Tx power based on board type and RF chain. */
3283	if (!(sc->chip & URTWN_CHIP_92C)) {
3284		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
3285			base = &rtl8188ru_txagc[chain];
3286		else
3287			base = &rtl8192cu_txagc[chain];
3288	} else
3289		base = &rtl8192cu_txagc[chain];
3290
3291	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3292	if (sc->regulatory == 0) {
3293		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3294			power[ridx] = base->pwr[0][ridx];
3295	}
3296	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3297		if (sc->regulatory == 3) {
3298			power[ridx] = base->pwr[0][ridx];
3299			/* Apply vendor limits. */
3300			if (extc != NULL)
3301				max = rom->ht40_max_pwr[group];
3302			else
3303				max = rom->ht20_max_pwr[group];
3304			max = (max >> (chain * 4)) & 0xf;
3305			if (power[ridx] > max)
3306				power[ridx] = max;
3307		} else if (sc->regulatory == 1) {
3308			if (extc == NULL)
3309				power[ridx] = base->pwr[group][ridx];
3310		} else if (sc->regulatory != 2)
3311			power[ridx] = base->pwr[0][ridx];
3312	}
3313
3314	/* Compute per-CCK rate Tx power. */
3315	cckpow = rom->cck_tx_pwr[chain][group];
3316	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3317		power[ridx] += cckpow;
3318		if (power[ridx] > R92C_MAX_TX_PWR)
3319			power[ridx] = R92C_MAX_TX_PWR;
3320	}
3321
3322	htpow = rom->ht40_1s_tx_pwr[chain][group];
3323	if (sc->ntxchains > 1) {
3324		/* Apply reduction for 2 spatial streams. */
3325		diff = rom->ht40_2s_tx_pwr_diff[group];
3326		diff = (diff >> (chain * 4)) & 0xf;
3327		htpow = (htpow > diff) ? htpow - diff : 0;
3328	}
3329
3330	/* Compute per-OFDM rate Tx power. */
3331	diff = rom->ofdm_tx_pwr_diff[group];
3332	diff = (diff >> (chain * 4)) & 0xf;
3333	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
3334	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3335		power[ridx] += ofdmpow;
3336		if (power[ridx] > R92C_MAX_TX_PWR)
3337			power[ridx] = R92C_MAX_TX_PWR;
3338	}
3339
3340	/* Compute per-MCS Tx power. */
3341	if (extc == NULL) {
3342		diff = rom->ht20_tx_pwr_diff[group];
3343		diff = (diff >> (chain * 4)) & 0xf;
3344		htpow += diff;	/* HT40->HT20 correction. */
3345	}
3346	for (ridx = 12; ridx <= 27; ridx++) {
3347		power[ridx] += htpow;
3348		if (power[ridx] > R92C_MAX_TX_PWR)
3349			power[ridx] = R92C_MAX_TX_PWR;
3350	}
3351#ifdef URTWN_DEBUG
3352	if (urtwn_debug >= 4) {
3353		/* Dump per-rate Tx power values. */
3354		printf("Tx power for chain %d:\n", chain);
3355		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
3356			printf("Rate %d = %u\n", ridx, power[ridx]);
3357	}
3358#endif
3359}
3360
3361static void
3362urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3363    struct ieee80211_channel *c, struct ieee80211_channel *extc,
3364    uint16_t power[URTWN_RIDX_COUNT])
3365{
3366	struct ieee80211com *ic = &sc->sc_ic;
3367	uint16_t cckpow, ofdmpow, bw20pow, htpow;
3368	const struct urtwn_r88e_txpwr *base;
3369	int ridx, chan, group;
3370
3371	/* Determine channel group. */
3372	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3373	if (chan <= 2)
3374		group = 0;
3375	else if (chan <= 5)
3376		group = 1;
3377	else if (chan <= 8)
3378		group = 2;
3379	else if (chan <= 11)
3380		group = 3;
3381	else if (chan <= 13)
3382		group = 4;
3383	else
3384		group = 5;
3385
3386	/* Get original Tx power based on board type and RF chain. */
3387	base = &rtl8188eu_txagc[chain];
3388
3389	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3390	if (sc->regulatory == 0) {
3391		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
3392			power[ridx] = base->pwr[0][ridx];
3393	}
3394	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
3395		if (sc->regulatory == 3)
3396			power[ridx] = base->pwr[0][ridx];
3397		else if (sc->regulatory == 1) {
3398			if (extc == NULL)
3399				power[ridx] = base->pwr[group][ridx];
3400		} else if (sc->regulatory != 2)
3401			power[ridx] = base->pwr[0][ridx];
3402	}
3403
3404	/* Compute per-CCK rate Tx power. */
3405	cckpow = sc->cck_tx_pwr[group];
3406	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
3407		power[ridx] += cckpow;
3408		if (power[ridx] > R92C_MAX_TX_PWR)
3409			power[ridx] = R92C_MAX_TX_PWR;
3410	}
3411
3412	htpow = sc->ht40_tx_pwr[group];
3413
3414	/* Compute per-OFDM rate Tx power. */
3415	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3416	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
3417		power[ridx] += ofdmpow;
3418		if (power[ridx] > R92C_MAX_TX_PWR)
3419			power[ridx] = R92C_MAX_TX_PWR;
3420	}
3421
3422	bw20pow = htpow + sc->bw20_tx_pwr_diff;
3423	for (ridx = 12; ridx <= 27; ridx++) {
3424		power[ridx] += bw20pow;
3425		if (power[ridx] > R92C_MAX_TX_PWR)
3426			power[ridx] = R92C_MAX_TX_PWR;
3427	}
3428}
3429
3430static void
3431urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3432    struct ieee80211_channel *extc)
3433{
3434	uint16_t power[URTWN_RIDX_COUNT];
3435	int i;
3436
3437	for (i = 0; i < sc->ntxchains; i++) {
3438		/* Compute per-rate Tx power values. */
3439		if (sc->chip & URTWN_CHIP_88E)
3440			urtwn_r88e_get_txpower(sc, i, c, extc, power);
3441		else
3442			urtwn_get_txpower(sc, i, c, extc, power);
3443		/* Write per-rate Tx power values to hardware. */
3444		urtwn_write_txpower(sc, i, power);
3445	}
3446}
3447
3448static void
3449urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
3450{
3451	uint32_t reg;
3452
3453	reg = urtwn_read_4(sc, R92C_RCR);
3454	if (enable)
3455		reg &= ~R92C_RCR_CBSSID_BCN;
3456	else
3457		reg |= R92C_RCR_CBSSID_BCN;
3458	urtwn_write_4(sc, R92C_RCR, reg);
3459}
3460
3461static void
3462urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
3463{
3464	uint32_t reg;
3465
3466	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
3467	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3468	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
3469
3470	if (!(sc->chip & URTWN_CHIP_88E)) {
3471		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
3472		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
3473		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
3474	}
3475}
3476
3477static void
3478urtwn_scan_start(struct ieee80211com *ic)
3479{
3480	struct urtwn_softc *sc = ic->ic_softc;
3481
3482	URTWN_LOCK(sc);
3483	/* Receive beacons / probe responses from any BSSID. */
3484	if (ic->ic_opmode != IEEE80211_M_IBSS)
3485		urtwn_set_rx_bssid_all(sc, 1);
3486
3487	/* Set gain for scanning. */
3488	urtwn_set_gain(sc, 0x20);
3489	URTWN_UNLOCK(sc);
3490}
3491
3492static void
3493urtwn_scan_end(struct ieee80211com *ic)
3494{
3495	struct urtwn_softc *sc = ic->ic_softc;
3496
3497	URTWN_LOCK(sc);
3498	/* Restore limitations. */
3499	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
3500		urtwn_set_rx_bssid_all(sc, 0);
3501
3502	/* Set gain under link. */
3503	urtwn_set_gain(sc, 0x32);
3504	URTWN_UNLOCK(sc);
3505}
3506
3507static void
3508urtwn_set_channel(struct ieee80211com *ic)
3509{
3510	struct urtwn_softc *sc = ic->ic_softc;
3511	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3512
3513	URTWN_LOCK(sc);
3514	if (vap->iv_state == IEEE80211_S_SCAN) {
3515		/* Make link LED blink during scan. */
3516		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3517	}
3518	urtwn_set_chan(sc, ic->ic_curchan, NULL);
3519	URTWN_UNLOCK(sc);
3520}
3521
3522static void
3523urtwn_set_promisc(struct urtwn_softc *sc)
3524{
3525	struct ieee80211com *ic = &sc->sc_ic;
3526	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3527	uint32_t rcr, mask1, mask2;
3528
3529	URTWN_ASSERT_LOCKED(sc);
3530
3531	if (vap->iv_opmode == IEEE80211_M_MONITOR)
3532		return;
3533
3534	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
3535	mask2 = R92C_RCR_APM;
3536
3537	if (vap->iv_state == IEEE80211_S_RUN) {
3538		switch (vap->iv_opmode) {
3539		case IEEE80211_M_STA:
3540			mask2 |= R92C_RCR_CBSSID_DATA;
3541			/* FALLTHROUGH */
3542		case IEEE80211_M_HOSTAP:
3543			mask2 |= R92C_RCR_CBSSID_BCN;
3544			break;
3545		case IEEE80211_M_IBSS:
3546			mask2 |= R92C_RCR_CBSSID_DATA;
3547			break;
3548		default:
3549			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
3550			    __func__, vap->iv_opmode);
3551			return;
3552		}
3553	}
3554
3555	rcr = urtwn_read_4(sc, R92C_RCR);
3556	if (ic->ic_promisc == 0)
3557		rcr = (rcr & ~mask1) | mask2;
3558	else
3559		rcr = (rcr & ~mask2) | mask1;
3560	urtwn_write_4(sc, R92C_RCR, rcr);
3561}
3562
3563static void
3564urtwn_update_promisc(struct ieee80211com *ic)
3565{
3566	struct urtwn_softc *sc = ic->ic_softc;
3567
3568	URTWN_LOCK(sc);
3569	if (sc->sc_flags & URTWN_RUNNING)
3570		urtwn_set_promisc(sc);
3571	URTWN_UNLOCK(sc);
3572}
3573
3574static void
3575urtwn_update_mcast(struct ieee80211com *ic)
3576{
3577	/* XXX do nothing?  */
3578}
3579
3580static void
3581urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3582    struct ieee80211_channel *extc)
3583{
3584	struct ieee80211com *ic = &sc->sc_ic;
3585	uint32_t reg;
3586	u_int chan;
3587	int i;
3588
3589	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
3590	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3591		device_printf(sc->sc_dev,
3592		    "%s: invalid channel %x\n", __func__, chan);
3593		return;
3594	}
3595
3596	/* Set Tx power for this new channel. */
3597	urtwn_set_txpower(sc, c, extc);
3598
3599	for (i = 0; i < sc->nrxchains; i++) {
3600		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3601		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3602	}
3603#ifndef IEEE80211_NO_HT
3604	if (extc != NULL) {
3605		/* Is secondary channel below or above primary? */
3606		int prichlo = c->ic_freq < extc->ic_freq;
3607
3608		urtwn_write_1(sc, R92C_BWOPMODE,
3609		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3610
3611		reg = urtwn_read_1(sc, R92C_RRSR + 2);
3612		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3613		urtwn_write_1(sc, R92C_RRSR + 2, reg);
3614
3615		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3616		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3617		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3618		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3619
3620		/* Set CCK side band. */
3621		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3622		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3623		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3624
3625		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3626		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3627		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3628
3629		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3630		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3631		    ~R92C_FPGA0_ANAPARAM2_CBW20);
3632
3633		reg = urtwn_bb_read(sc, 0x818);
3634		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3635		urtwn_bb_write(sc, 0x818, reg);
3636
3637		/* Select 40MHz bandwidth. */
3638		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3639		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
3640	} else
3641#endif
3642	{
3643		urtwn_write_1(sc, R92C_BWOPMODE,
3644		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3645
3646		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3647		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3648		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3649		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3650
3651		if (!(sc->chip & URTWN_CHIP_88E)) {
3652			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3653			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3654			    R92C_FPGA0_ANAPARAM2_CBW20);
3655		}
3656
3657		/* Select 20MHz bandwidth. */
3658		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3659		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
3660		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3661		    R92C_RF_CHNLBW_BW20));
3662	}
3663}
3664
3665static void
3666urtwn_iq_calib(struct urtwn_softc *sc)
3667{
3668	/* TODO */
3669}
3670
3671static void
3672urtwn_lc_calib(struct urtwn_softc *sc)
3673{
3674	uint32_t rf_ac[2];
3675	uint8_t txmode;
3676	int i;
3677
3678	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3679	if ((txmode & 0x70) != 0) {
3680		/* Disable all continuous Tx. */
3681		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3682
3683		/* Set RF mode to standby mode. */
3684		for (i = 0; i < sc->nrxchains; i++) {
3685			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3686			urtwn_rf_write(sc, i, R92C_RF_AC,
3687			    RW(rf_ac[i], R92C_RF_AC_MODE,
3688				R92C_RF_AC_MODE_STANDBY));
3689		}
3690	} else {
3691		/* Block all Tx queues. */
3692		urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3693	}
3694	/* Start calibration. */
3695	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3696	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3697
3698	/* Give calibration the time to complete. */
3699	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
3700
3701	/* Restore configuration. */
3702	if ((txmode & 0x70) != 0) {
3703		/* Restore Tx mode. */
3704		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3705		/* Restore RF mode. */
3706		for (i = 0; i < sc->nrxchains; i++)
3707			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3708	} else {
3709		/* Unblock all Tx queues. */
3710		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3711	}
3712}
3713
3714static void
3715urtwn_init(struct urtwn_softc *sc)
3716{
3717	struct ieee80211com *ic = &sc->sc_ic;
3718	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3719	uint8_t macaddr[IEEE80211_ADDR_LEN];
3720	uint32_t reg;
3721	int error;
3722
3723	URTWN_ASSERT_LOCKED(sc);
3724
3725	if (sc->sc_flags & URTWN_RUNNING)
3726		urtwn_stop(sc);
3727
3728	/* Init firmware commands ring. */
3729	sc->fwcur = 0;
3730
3731	/* Allocate Tx/Rx buffers. */
3732	error = urtwn_alloc_rx_list(sc);
3733	if (error != 0)
3734		goto fail;
3735
3736	error = urtwn_alloc_tx_list(sc);
3737	if (error != 0)
3738		goto fail;
3739
3740	/* Power on adapter. */
3741	error = urtwn_power_on(sc);
3742	if (error != 0)
3743		goto fail;
3744
3745	/* Initialize DMA. */
3746	error = urtwn_dma_init(sc);
3747	if (error != 0)
3748		goto fail;
3749
3750	/* Set info size in Rx descriptors (in 64-bit words). */
3751	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3752
3753	/* Init interrupts. */
3754	if (sc->chip & URTWN_CHIP_88E) {
3755		urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3756		urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3757		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3758		urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3759		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3760		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3761		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3762		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3763	} else {
3764		urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3765		urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3766	}
3767
3768	/* Set MAC address. */
3769	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3770	urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
3771
3772	/* Set initial network type. */
3773	urtwn_set_mode(sc, R92C_MSR_INFRA);
3774
3775	/* Initialize Rx filter. */
3776	urtwn_rxfilter_init(sc);
3777
3778	/* Set response rate. */
3779	reg = urtwn_read_4(sc, R92C_RRSR);
3780	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3781	urtwn_write_4(sc, R92C_RRSR, reg);
3782
3783	/* Set short/long retry limits. */
3784	urtwn_write_2(sc, R92C_RL,
3785	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3786
3787	/* Initialize EDCA parameters. */
3788	urtwn_edca_init(sc);
3789
3790	/* Setup rate fallback. */
3791	if (!(sc->chip & URTWN_CHIP_88E)) {
3792		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3793		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3794		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3795		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3796	}
3797
3798	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3799	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3800	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3801	/* Set ACK timeout. */
3802	urtwn_write_1(sc, R92C_ACKTO, 0x40);
3803
3804	/* Setup USB aggregation. */
3805	reg = urtwn_read_4(sc, R92C_TDECTRL);
3806	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3807	urtwn_write_4(sc, R92C_TDECTRL, reg);
3808	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3809	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3810	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3811	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3812	if (sc->chip & URTWN_CHIP_88E)
3813		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3814	else {
3815		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3816		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3817		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3818		    R92C_USB_SPECIAL_OPTION_AGG_EN);
3819		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3820		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3821	}
3822
3823	/* Initialize beacon parameters. */
3824	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3825	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3826	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3827	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3828	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3829
3830	if (!(sc->chip & URTWN_CHIP_88E)) {
3831		/* Setup AMPDU aggregation. */
3832		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3833		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3834		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3835
3836		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3837	}
3838
3839	/* Load 8051 microcode. */
3840	error = urtwn_load_firmware(sc);
3841	if (error != 0)
3842		goto fail;
3843
3844	/* Initialize MAC/BB/RF blocks. */
3845	urtwn_mac_init(sc);
3846	urtwn_bb_init(sc);
3847	urtwn_rf_init(sc);
3848
3849	/* Reinitialize Rx filter (D3845 is not committed yet). */
3850	urtwn_rxfilter_init(sc);
3851
3852	if (sc->chip & URTWN_CHIP_88E) {
3853		urtwn_write_2(sc, R92C_CR,
3854		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3855		    R92C_CR_MACRXEN);
3856	}
3857
3858	/* Turn CCK and OFDM blocks on. */
3859	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3860	reg |= R92C_RFMOD_CCK_EN;
3861	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3862	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3863	reg |= R92C_RFMOD_OFDM_EN;
3864	urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3865
3866	/* Clear per-station keys table. */
3867	urtwn_cam_init(sc);
3868
3869	/* Enable hardware sequence numbering. */
3870	urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3871
3872	/* Perform LO and IQ calibrations. */
3873	urtwn_iq_calib(sc);
3874	/* Perform LC calibration. */
3875	urtwn_lc_calib(sc);
3876
3877	/* Fix USB interference issue. */
3878	if (!(sc->chip & URTWN_CHIP_88E)) {
3879		urtwn_write_1(sc, 0xfe40, 0xe0);
3880		urtwn_write_1(sc, 0xfe41, 0x8d);
3881		urtwn_write_1(sc, 0xfe42, 0x80);
3882
3883		urtwn_pa_bias_init(sc);
3884	}
3885
3886	/* Initialize GPIO setting. */
3887	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3888	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3889
3890	/* Fix for lower temperature. */
3891	if (!(sc->chip & URTWN_CHIP_88E))
3892		urtwn_write_1(sc, 0x15, 0xe9);
3893
3894	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3895
3896	sc->sc_flags |= URTWN_RUNNING;
3897
3898	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3899fail:
3900	return;
3901}
3902
3903static void
3904urtwn_stop(struct urtwn_softc *sc)
3905{
3906
3907	URTWN_ASSERT_LOCKED(sc);
3908	sc->sc_flags &= ~URTWN_RUNNING;
3909	callout_stop(&sc->sc_watchdog_ch);
3910	urtwn_abort_xfers(sc);
3911
3912	urtwn_drain_mbufq(sc);
3913}
3914
3915static void
3916urtwn_abort_xfers(struct urtwn_softc *sc)
3917{
3918	int i;
3919
3920	URTWN_ASSERT_LOCKED(sc);
3921
3922	/* abort any pending transfers */
3923	for (i = 0; i < URTWN_N_TRANSFER; i++)
3924		usbd_transfer_stop(sc->sc_xfer[i]);
3925}
3926
3927static int
3928urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3929    const struct ieee80211_bpf_params *params)
3930{
3931	struct ieee80211com *ic = ni->ni_ic;
3932	struct urtwn_softc *sc = ic->ic_softc;
3933	struct urtwn_data *bf;
3934	int error;
3935
3936	/* prevent management frames from being sent if we're not ready */
3937	URTWN_LOCK(sc);
3938	if (!(sc->sc_flags & URTWN_RUNNING)) {
3939		error = ENETDOWN;
3940		goto end;
3941	}
3942
3943	bf = urtwn_getbuf(sc);
3944	if (bf == NULL) {
3945		error = ENOBUFS;
3946		goto end;
3947	}
3948
3949	if ((error = urtwn_tx_data(sc, ni, m, bf)) != 0) {
3950		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3951		goto end;
3952	}
3953
3954	sc->sc_txtimer = 5;
3955	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3956
3957end:
3958	if (error != 0)
3959		m_freem(m);
3960
3961	URTWN_UNLOCK(sc);
3962
3963	return (error);
3964}
3965
3966static void
3967urtwn_ms_delay(struct urtwn_softc *sc)
3968{
3969	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3970}
3971
3972static device_method_t urtwn_methods[] = {
3973	/* Device interface */
3974	DEVMETHOD(device_probe,		urtwn_match),
3975	DEVMETHOD(device_attach,	urtwn_attach),
3976	DEVMETHOD(device_detach,	urtwn_detach),
3977
3978	DEVMETHOD_END
3979};
3980
3981static driver_t urtwn_driver = {
3982	"urtwn",
3983	urtwn_methods,
3984	sizeof(struct urtwn_softc)
3985};
3986
3987static devclass_t urtwn_devclass;
3988
3989DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3990MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3991MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3992MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3993MODULE_VERSION(urtwn, 1);
3994